I want to create a network with a bunch of routers and switches to be used as a test network for company employees to remotely login and learn networking.I don't want this network to interfere with the rest of the network in any way.I am basically trying to create a stub network or a passive network!!
View 4 RepliesI am working in an enterprise LAN environment. We have about 100 switches, mostly 3560 and 3750's. This is a typical Cisco network, yet it's flat. No routing on the access layers. The core switch does do the routing. We use an third party vendor network monitoring tool, and we use Secure CRT to remote into devices.
Here's the problem. There was a device we stumbled into that had not been put into our monitoring software. It has the same IOS as our other devices. All I can say is that it's the same version and type. Each device has a management v LAN. And each device has it's own management IP. An ACL exists to prevent unauthorized SSH access into the devices, yet allows the management v LAN scope to get in.
So, here's the problem...we can't SSH into our problem mystery device, let's call it Switch X. Switch X has an IP of 10.10.100.150. Now, I can be logged into it's up link device, let's call it switch B. Switch B has an IP of 10.10.100.130. The ACL allows all devices from 10.10.100.0/24 to SSH. Our PC's at our desk are also in the same management V LAN. SSH version 2 is on the configs, and the domain names are the same on these two devices.
So, let's be clear. From my desktop, I can connect to any device on my network EXCEPT switch X. When I try to connect using SSH, port 22...it just sits there until it times out. I can do the same thing to any other switch, and connect just fine. We are using TACACS+ and RADIUS as well, and they are up and running just fine. The configs on Switch X like I said are the same for switch B, except it's IP address of course. While logged into switch B, I can do a CDP neighbor and see switch X connected via trunk link. Both sides are running dot1q encapsulation, and both are in trunk mode. I can ping switch X from switch B. When I try to SSH from B to X..I get timeout with no connection.
So, I hiked over to the building where switch X is located. I consoled into the switch. I confirmed that the ACL is the same as the ACL for switch B. It is set up to allow the management v lan inbound on the VTY 0 - 15. Yes, it's access-class (name) in on both vty 0 4 and 5 15. It also is set up for transport ssh in and transport ssh out.
I rechecked the domain name on Switch X; it was correct. I also did a crypto key and regenerated the crypto key. SSH v2 came up. Again, while in Switch X, I can do a CDP neighbor and see switch B. But I cannot SSH from switch X to Switch B, or any other devices that I tried. Now, we did find a config error with VTP; the VTP domain name was different. But VTP has nothing to do with SSH. Just to placate my co-workers, I went ahead and renamed the VTP domain name (it's running transparent mode). After I regenerated the crypto key, I saved everything of course. I then reloaded the switch. When all came back up, I still could not SSH
This is a 3560 switch, and it is trunk to a 3750.
Question re: DIR-655; Hardware ver A4; Firmware version 1.32NA
During bandwidth tests to several sites (principally speedtest.net) I get ping times of 10-11 ms, download speeds of 12+ to 17+ mbps but failure on upload tests using my DIR-655.
When I bypass the 655 and test directly with my cable modem, all (including upload) tests work reliably and consistently.
I have swapped the two ethernet cables involved as well as replacing both with new cables but the results are the same (uploads fail with 655 and work without it)
I have seen several postings over the the last year with this same problem but have never seen any comment from D-Link, or a solution from any reader.
Not that it should have any bearing, but I have TA785GE-128M motherboard and am running Windows 7 (patch current) on COMCAST
is this problem acknowledged by D-Link and is there a solution?
We just got a new ASA5510 (straight out of the box). I’m new to the Cisco but feel we followed the directions. We connect to the management port and have our workstation set to get an ip via dhcp. A cat5 is connected to the management port, that goes into a hub (tested to work) and a cat5 is connected from the hub to the workstation (tested to work). Nothing else is connected. The workstation does not get an ip address. (assigns APIPA) Both the 5510 and workstation have been rebooted.The workstation works otherwise. We have also connected both a crossover and straight through cable from the 5510 to the workstation. We have statically assigned an ip of 192.168.1.2 to the workstation and cannot ping the cisco (192.168.1.1).
View 2 Replies View RelatedThe application here is a wind power project, built in two phases, without any effort to coordinate or integrate the two sites during the design phase. All operations activities for both phases are performed by one staff out of a common location. This is a rural area and Internet connectivity is mission critical due to contractual obligation with Electrical Utilities.
The client has a need to reconfigure a network which has grown over time in a layer by layer approach, whereas at every point in time that an additional T-1 or other changes occurred to address a specific need, no thought was ever put into integrating the entire site as a whole. It is at best a dysfunctional solution which somewhat accomplishes thier needs, and at worst, a kludgy, grossly security compromised, and difficult to use infrastructure. There is every kind of equipment one can imagine, each installed by some entity providing needed services on the site, but forced to make uninformed decisions because the client really has no IT department to coordinate with. Over time, every vendor just provided their own switch, router, or maybe figured out how to reconfigure another existing device to also provide the routing or access needed, To say the least, it's a mess.
The client requests a solution which provides a means to accomodate 6 internet connections (4 T-1 lines, and 2 satellite) in a manner which aggregates available bandwith and provides redundancy. The T-1 lines will be the main internet access, with the satellite connections only used if available bandwidth falls below some threshold, say 3Mb. There are many internal networks which need to be routed to and between, in total, about 20 subnets. There are 2 SCADA (Control) networks which have a mandatory requirement of 1Mb each, a VoIP system which does not use any internet connetivity as there are 6 POTS lines dedicated to it, an internal office LAN and a turbine manufacturers site LAN.
The T-1 lines, at 1.5Mb x 4 = 6Mb.
The 2 SCADA networks require a guaranteed 1Mb each, the remaining 4Mb is to be allocated between the office LAN and the turbine manufacturer site LAN. The satellite connection are only to be active in the event bandwidth falls below 3Mb.
There are 2 Cisco 2801 routers on site which could be reutilized if appropriate. Each T-1 has it's own Adtran CSU with Ethernet out. All T-1 lines are /29 IP Blocks. 2 of the T-1 lines are adjacent IP Blocks, for what its worth.
Everything here is open to reconfiguration. The client wants this finally integrated correctly with the ability to address emerging Electrical Utility cybersecurity requirements in the immediate future.
An ideal solution would be fully redundant to eliminate the single point of failure at the edge router. As to whether there needs to be separate edge and interior routers, I just don't know that. I would guess everything could be done with just a pair of redundant routers at the edge, but perhaps it is better to do the interior routing between subnets on a different router(s).
Again, the goal is a well integrated, redundant, and secure solution. My part is mostly complete, with the OSP part of the network finally at 100% after 5 years of stupid and careless misconfigurations and bad fiber splicing (by others).
I'm absolutely covered up in business at Layer 1 & 2 on these sites, as the physical plant and associated network elements are typically very poorly designed, specified, and implemented. The complexity of this job leads me to seek outside advice and ultimately a more qualified Cisco professional than me. I'm experienced enough with Cisco to know when I'm in over my head. I know a diagram would be nice, but at this point I've only got a very detailed diagram which reveals too much site identity information to make public. I'll wait to see a few comments and in the meantime work on removing site identity info so I can post a good diagram for everyone to see.
I have an interesting SVPN challenge that I'm asking the subject experts here to assist me in solving.A customer in Domain A wants to transmit data to Domain B. The customers have agreed to establishing a secure vpn connection from Domain A to Domain B to transmit real time data. The challenge comes from sending unencrypted data from nodeA to nodeB & nodeC withing an encrypted VPN tunned to node d.The challenge is sending non-encrypted data from NodeA to NodeB where an encrypted VPN session is active. Every time I attempt to configure the interface (AppC) the VPN session is terminated, and the interface can no longer "see" nodeD via IP mapping. An engineer recommended adding a second NIC card to NodeB thereby permitting control of the AppC even when the VPN is up and running.Can I send live non-encrypted data to NodeB data buffer, while AppC sends data to NodeD in a VPN tunnel ?
View 1 Replies View RelatedI am trying to manage my Dell switch that is trunked from my Cisco 2950, I have trunked vlan 251 (management vlan) and 252,configs below
Cisco 2950 :-
Current configuration : 4794 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
[code]....
I've downloaded Prime Infrastructure 1.2 eval and wanted to see what it looked from WCS that I am currently using to manage the wireless network and I added the WLC (4404) device but it list the device as "Managed with Warning" and I can't find what the warning is.
View 3 Replies View RelatedRunning Cisco NAC 4.1.6 OOB on the LAN. For some reason in the middle of the night, the snmp trap mac-notification added command appeared on the trunk uplink port of one of our switches.
I don't know exactly when the command was added but at 2am when the backup of the config was taken, it was there. At around 4:30am, the uplink went off-line. Is there anything within NAC that would push a change like that automatically to a switch. We do have NAC Profiler running on the network also.The problem was in a branch office so I only got the information second hand what was on the switch itself. We moved the uplink to a different port which allowed the switch to show up on the CAM again, however when I viewed it, the uplink port was set to controlled!
Does this make any sense?
how long devices will stay in the certified device list if no timer is configured to clear it out?
I have been trying to convince my bosses, the IT department, and others where I work, in a small call center, to switch to a different browser other than IE. The reason is IE times out on the techs a lot and freezes up constantly. I am able to use Firefox and Chrome at the lead station and do not have any issues, but the only browser currently allowed on the techs computers is IE. The reason I am getting as to why this is not possible is that with IE, IT is able to block certain options in IE from being changed such as proxy settings, add-ons, and advanced settings, but that these settings cannot be blocked or managed in firefox and chrome.
View 4 Replies View RelatedIs it possible to manage Lightweight Access Points in Ciscoworks LMS 4.0?
View 3 Replies View RelatedI have a small lan of around 10 computers in my office which are connected through a switch connected to a airtel broadband connection. I want to configure a network server so that I could manage an control the internet traffic used by all the workstations in the lan through that server. All the workstations have either WinXP or Windows 7 on it. I haven't purchased a server. I want to use a desktop(having some good configuration) as my network server.
View 6 Replies View RelatedAnyone got a single VSM (albiet in HA) managing two vDS split over two ESX clusters connected to a single instance of vCenter?
View 0 Replies View RelatedWe are currently using several AP's in our organization. And in this one AP i want to give a user the power to change the password of the wireless network to prevent miss use. I was wondering if it was possible to create an account who only has the privilege to change the WPA key?? I want to prevent that he will accidently change other settings.
View 5 Replies View RelatedThis is a newbie question regarding CSS11500 series loadbalancers as I trying to get up to speed with managing them as part of my job. I noticed that there are a couple of CSS "clustered together" since I see they are managed using a single ip address.
My question is around how to establish a session to each individual device in this cluster, if at all possible? If is not possible, how do manage the secondary device in this cluster to perform tasks such as copying new software to it, backing it up, etc.?
I am currently managing an ASA5510 using ASDM through the management port but I would like to manage the ASA through the internal port.
My concern is that I thought I remembered reading someplace that if you setup an internal port for management that it can't be used for anything else. Is this correct?
I only configured one internal port and it is the path to my LAN. I would hate to configure the port for management only to find that I disconnected my firewall from my internal network in the process. Can I use my one and only configured internal port for both ASA management and route from my LAN thru the ASA firewall?
I currently have the management port set to 192.168.1.1 and my internal interface is 10.1.1.1. If I open ASDM and connect thru the management port and select Configuration/Device Management/Management Access/ASDM/HTTPS/Telnet/SSH
select "ADD"
select access type "ASDM/HTTPS"
select interface "internal"
IP Address "10.1.1.0"
Mask "255.255.255.0"
Will that give me access to ASA management thru my internal network but cripple my network access to the ASA?
I have a 2911 router connected to a 3750 switch. I have configured vlan interfaces on the 2911 router:I am using the vlan 89 (89.2) as the management ip address for me to remotely get to the switch. Is this a proper configuration or could this cause issues in the future.
View 4 Replies View RelatedI'm used to seeing DWDM and muxes being used in the service provider world, but when and why would an enterprise want to use this kind of gear?The two basically lets you combine streams of signaling from many different physical sources into one media, but can't a VLAN trunk or a routed link, for example, do the same? Sure, they all operate at different layers of the OSI model, but in all cases you're still getting separate streams of data from Point A, putting it all on one wire, and sending it to Point B.
View 8 Replies View RelatedNot sure if this belongs here on in a different section. We are in the process of purchasing a new ACS 5.x appliance. I would like to take a look at implementing WPA2 Enterprise with our Cisco APs.
View 4 Replies View RelatedI've got the E2000 at home for our private network.
We are three guys sharing a flat. We have personal laptops, work laptops, mobile phones, games consoles, tablets etc that connect to the internet.
Problem is that when someone downloads stuff, the speed is slow for the rest of us. So i was hoping i could set up something like three "channels" so each of us could have the same download speed, ie 1 mbs each regardless if others are using the network at the same time. And then maybe a guest network for all the mobiles and tablets etc. MAC filtering for access for our personal laptops should work.
We have a 20mbit cable network line.
Can i do all of this on the E2000 and how?
I have tried everything including removing the system, changing the network settings, using cmd.exe, ect. they all say access denied and theres no possible way to get around this.
View 2 Replies View RelatedI want to reinstall the MSE image that was sent to me by Cisco TAC Team, however when I try to reinstall the MSE Application, however when I try to install it, the CD boots and show me the Red Hat enterprise image, then sends me black screen with the message "Kernel alive, Kernel direct mapping tables up to 480000000 @ 8000-1b000" and it stay there.
View 2 Replies View RelatedI have a Win2008 server set up as a radius server (192.168.32.71) and a stand alone AP (192.168.201.9) [code]
View 3 Replies View RelatedOPTEMAN: 3 routers connected via a private subnet (/29) over the OPTEMAN: Site A, Site B, and HQ. Site A is a 3560 that is the gateway for two subnets: siteA1 and siteA2. SiteB is a 2621, and HQ is a 6509 w/ MFSC.
HQ also connects to 4 other sites via MPLS: SiteC, SiteD, SiteE, and Site F.
HQ has the server subnet, Internet connection, and connection to other services via MPLS.
I have basic EIGRP setup on HQ, SiteA, and SiteB. So far only siteA and HQ are updating each other. Not sure why. I am looking for the best practice example of how I should setup my enterprise EIGRP. I currently use static routes between the sites. I would prefer to be able to setup EIGRP in parallel, the remove the static routes.
I'm looking for documentation on the Enterprise mesh solution based on 7.0 MR1...In this release e.g 802.11n APs are supported and clean air for the client radio etc...The current Cisco Mesh Access Points, Design and Deployment Guide is based on the previous 7.0 release.Apart from the configuration guide I can't find any additional guides.
View 1 Replies View RelatedHow to treat your enterprise network in terms of security? Do you firewall between sites? Between subnets? I've been a little gung-ho with packet filtering, and the more the network is growing the harder is becoming to make that scalable and manageable. It's looking like a pretty good idea to just open up access to/from all my sites. I'm going to continue locking down user areas where we can't necessarily trust the boxes, but all our server subnets I think can be opened up to unfettered access.
View 4 Replies View RelatedI want to change the SSID on all my APs without it affecting the connected devicesThe users should possible not be affected with the connecttion to the wifi networkHow can I go about it?
View 3 Replies View Relatedif any of you are controlling iPhones within your organizations. I was hoping to use JUNOS Pulse licenses on my SA700 to control things, but all they offer for iOS devices is SSL VPN. I can do remote wipes with activesync, but I'm worried about cloud backups of corporate data on mobileme, and setting and enforcing security policies in a scalable way. I know I can manually deploy XML config from the iPhone configuration utility, but that's a bit of a PITA for remote devices (ie other countries) that I'llnever have physical access to.
View 11 Replies View Relatedwe need to use Nexus technology over 6500 based VSS in entreprise ?
View 1 Replies View RelatedI have a Cisco 2811 running Advance Enterprise v 15.1-2. I've just configured it using ccp for internet access (on 2 lines) and a firewall. The configuration is pretty much all default and I used the ccp wizard to create a 'medium-secure' firewall. I have 2 blocks of public IP addresses for my internal network and for the DMZ. The 2800 is configured as follows:
- 2 x default routes. one to each dialer.
- 6 zone pairs as follows:
- ccp-zp-self-out (seems to mostly work... I can ping any IP address from a console but not a hostname)
- ccp-zp-in-out (works fine, both interfaces seem to be in use)
- ccp-zp-in-dmz
- which by default set to ccp-permit-dmzservice
- which inspects ccp-dmz-traffic
- which matches group dmz_traffic and has a class map dmz-traffic
- cnc-zp-dmz-out which is set to ccp-inspect. (my own zone pair to allow systems in the DMZ zone to see the internet. This works fine.)
- ccp-zp-out-dmz (works fine. I can see my web server from any system outside my own network)
- ccp-zp-out-self (which, I guess allows anything permitted to get to the 2811)
Internet works from within the DMZ and in-zone. The outside can access my dmz servers. The inside can access most things on the outside using the firewall rules.
1) Although I have the zones set up to allow the same access from in->dmz as I do from out->dmz and out->dmz seems to work, I cannot seem to access anything in the dmz from the inside.
2) When setting up the firewall I ticked the box for 'allow PPTP clients to make connections from the inside' (or something like that). I cannot seem to make a PPTP connection from my workstation.
I have scoured the internet for guides, looked through these forums & the cisco configuration guides and experimented all day but still cannot figure this out.Do I need a special route between the inside and dmz? I have seem references to static routes on ASA firewalls but the command 'static (inside,dmz)...' does not work on a 2800 series router.
Recently bought a laptop HP Pavilion DM4 with Windows 7 home premium 64 bit for use in a college wireless environment. The school insists on WPA2 Enterprise connection, which is supposedly the recommended Microsoft security protocol for Win 7. I have all the correct settings, such that I can routinely connect to the wireless network but on this model HP I consistently get speeds way under 10kbs, while if I use EXACT same settings on a different Lenovo, Dell, or other models of HP get speeds of over 5MG. Yes 500x faster.Of course HP wanted to blame the network, but after sending 2 technicians to visit on campus, they agreed it was their hardware, so they sent a replacement unit. Unfortunately, the replacement unit has the EXACT same problem. BTW the problem computers do connect flawlessly to other wifi networks at full speed, just not the WPA2 Enterprise network.
View 1 Replies View RelatedI currently work for an enterprise that want to deploy wireless network (6AP for now) and I'm the one who will manage and install it.I had initially planed to deploy Ubiquiti network because I've heard lot of good thing about them. But they did not wait me and bought (crappy?) HP access point (MSM410)
What do you think about HP wireless network ? They did not yet buy the access point controller and I'm not sure they want to buy one.I can't find any review on the HP solutions it looks like no one is using it.
Do you recommend me to continue with the HP solution and buy a HP controller or go with Ubiquiti and rebuy the access points (no so much expensive in comparison with the price of the HP controller alone)
if i have just DCNM-N7K-K9 (DCNM for LAN Enterprise License for one Nexus 7000 Chassis) installed on a server, i can manage all nexus switches like 5k and 2k??
View 1 Replies View Related