I have 2 links to 2 different departments switch with an up link of 10mb. I want to guarantee that both departments get at least 5mb, but can use part of the other 5mb that not in use. Is this possible?
View 3 RepliesI have a 2921 where I am shaping some traffic based on sub net on my lan. I have applied the shaping policy to the lan interface in the outgoing direction.
Topology is as follows:
ISP - ASA - ROUTER - LAN
Policy map:
Policy Map shape-lan
[code]....
I am seeing a lot of no-buffer drops on the policy and I am wondering what the best solution is to solve this:
Class-map: tc-class (match-any)
8730680 packets, 10803689863 bytes
5 minute offered rate 4453000 bps, drop rate 0 bps
[code]....
Should I just be increasing the queue-limit or should I be changing something else?
Now I have a 172.16.0.0/16 network with a def. gw. for internet where is a MS Forefront TMG 2010 with BSplitter for traffic shaping. I purchased an 2921, 2,5 GB RAM, security+data license and an EHWIC-D-8ESG.
I made 4 subnets in a test environment with some access-lists, nothing fancy yet. How can I use FF TMG for bandwidth management, where should I put it? For those 4 subnets the def. gw. is, normally, the 2921 router. TMG is splitting traffic by client IP.
I want to connect 2 ISP links into one Gigabit-interface on my Router 2921, can any one tell me how to do that ? sub-interface creation is not possible on cisco 2921
View 1 Replies View RelatedWe have an ISP connection that is connected via an ethernet interface on a 5510 ASA. We are allotted 10Mbps. I have currently have the interface set to 10Mbps Full. However we want to upgrade the connection to 25Mbps. I know I can set the port speed to 100Mbps and then set a shape/police statement and shape down to 25Mbps.
Management wants to be able to call the ISP and arbitrarily adjust that speed up temporarily at any time without any user/admin intervention on our side. I can simply leave the port at 100Mbps i.e. no shape statement on my side however I will run into problems with large amounts drops, overruns, retransmissions, etc due to the ISP shaping the connection speed during normal operations. However they then could then adjust the speed at any time without needing me.
I do not know the best way to make this work. Is there some sort of dynamic/smart shaper in the ASA or another cisco device?
I am trying to get ride of an old traffic management appliance and would like to replace it by a simple Cisco 3845.
The configuration is really simple:
Customers -- Router 3845 -- Internet
I want to be able to provide bundles to customer such 64kps garanteed/ 2mbps MIR (retail) and 2mbps garanteed no MIR (business).
I need also to specify to the router the total internet bandwitdh available (example: 20mbps symetrical).
This configuration will work ? Should I worry about any performance issue if I start to have a lot of customers ?
ip access-list extended Cust1
permit ip any sub_Cust1
permit ip subCust1 any
We are a new medical school located in PA. Just have just completed a new building and are now working on getting our network finished. Here is the situation we have a 50MB Internet Connection that comes into our network that then hits the ISPs Cisco 3750 which sends it to two of our Cisco 3750s for redundancy. From the 3750 goes into our Cisco 6509 with a FWSM module, then out from there to our distribution switches which are all Cisco 2960s.
What we would like to do is to control how much WAN connectivity each of our VRFs get. Right now we have a Faculty, Student, and Research VRF formed, and are trying to figure out the best spot where we can say Faculty gets 30MB of Bandwidth, Students gets 10, and Research gets 10. If possible would like burst capabilities.
How do I setup this on the SRP527W? I already block most of the video stuff on the internet. But I want to make this one more step.
View 1 Replies View RelatedWhat I’m looking to do is setup a net-flow monitor for traffic going across a PIX firewall. I know unfortunately I can’t do this directly from the PIX because it does not support net-flow.
I do have a 2921 router on the same network that I have net-flow enabled to monitor traffic across the MPLS Connection.
Since the traffic for the MPLS is going out a direct interface I have applied the IP Flow egress/ingress commands to that interface to obtain the net-flow data I need. The PIX firewall however is not a direct interface so this can’t be done. I have done a little reading and believe I could use a policy map to create a “filter” so that any traffic that meets the ACL associated with the Policy-Map would get sent to net-flow monitor.
My question is how do I set that up so that so I can have the two net-flow data “streams/sources” go to separate net-flow ports so that I can monitor them independently of each other or is that not possible?
Both devices are connected to a 3750X switch; however neither is connected to a 10GB port. To my understanding that means I can’t run net-flow on the switch itself.
the cisco 2921 Router has a default ip hhtp access class command found in it. Just i changed the default IP to the new ip i will use.The Router is accessable from the LAN only but not from the internet configured the Public ip . I think this is due to the standard access list 23 . how will i access the Router from the Internet using the Public IP.
View 6 Replies View RelatedI have 2921 router and I have 3 very basic switches that I need to connect to the router. The switches have very basic default configurations and there is no way to edit them, so I only have one VLAN and one default gateway. I can't assign the same IP address to each LAN port. I'm not sure how to make this setup work.
View 12 Replies View RelatedI am trying to do policy on the interfaces of my switch WS-4507R, below the configuration I used to shap the traffic to 1 Mbps. However, when I tested it the traffic excceded the 1 Mbps.
class-map match-all 1MB
match access-group name 1MB
!
policy-map 1MB
class 1MB
[code]...
how I can restrict my bandwidth on the interface on 1 Mbps.
I am looking for step-by-step configuration on how to enable rate-limit and traffic shaping on Cisco 6513 vlan interfaces. I am not able to find this particular document on CCO.
View 3 Replies View RelatedI am configuring a 3560 to provide internet access for our customers and I need to make sure they don't use more bandwidth than they have contracted for.I see that the 3560 supports the rate-limit command, but was told that I should use traffic shaping and policing along with access lists to manage the bandwidth.Is there a reason that I should avoid using the rate-limit command - it looks much simpler.
View 10 Replies View RelatedI am configuring DHCP pool for voice vlan on cisco 2921 router.
Here is the setup.
2921 router -> 3750 -> 2960 PoE -> 7942 IP Phone
Router Config
ip dhcp excluded-address 10.146.54.1 10.146.89.50
!
ip dhcp pool VoiceVlan
network 10.146.54.0 255.255.255.0
subnet prefix-length 24
dns-server 10.144.68.32 10.144.68.33
option 150 ip 10.146.68.36
default-router 10.146.54.1
netbios-name-server 10.144.68.32 10.144.68.33
netbios-node-type h-node
[code]....
i have an 2921 connected to an Catalyst 3560. My router interface shows quite a lot of input queue drops. Load is not too much max 5/255.
View 1 Replies View RelatedI need to implement the shaping VLAN only on the trunk link between the 6500 and 3560. [code]
View 8 Replies View RelatedWe have some ASR WAN routers which have a dedicated 400M interface to a remote site.
Servers on our Local network source the data through some firewalls via 10G interfaces, which connects to 4500X WAN switches then to the Routers on 1G links.
The sources are rate limiting the traffic but the routers are periodically dropping packets which I think is mostly due to burstiness in the traffic between as it traverses through from 10G links to 1G then to 400M.
How to setup traffic shaping on the 4500X outbound port to our WAN routers.I'd like to see if we could buffer and smoothe out the traffic as it exits the 4500X WAN switch 1G port to the WAN Routers.
I have catalyst 3750 I want to controle traffics on every port I have tried Frame-Relay Traffice shaping and Quality of service but there is no support for these commands in the switch.do we have any way to limit traffic on every port in catalyst 3750 and 2960 switches ?
View 4 Replies View RelatedI have an environment where i have two nexus 7010 switches, along with 2 nexus 5510's. I need to run OSPF as a layer 3 routing protocol between the vpc peer links. I have 1 link being used as a keep alive link, and 3 other links being used as a VpC link.
1) Is it best to configure a separate Vpc VLAN i.e 1010
2) Is it best to configure a vrf context keep-alive
3) just have the management address as the peer ip's.
Checking the logs we have seen the following messages:
%SPANTREE-3-PRESTD_NEIGH: pre-standard MST interaction not configured (Port-channel3). Please, configure: 'spanning-tree mst pre-standard' on ports connected to MST pre-standard switches.
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/0/1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel3, changed state to down
%LINK-3-UPDOWN: Interface Port-channel3, changed state to down
%LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down
%LINK-3-UPDOWN: Interface GigabitEthernet2/0/1, changed state to down
When this happened, the interface that was actually blocked by STP didn't come to forwarding state, and as a result this switch became isolated.This switch is connected to a switch that runs standard MST, and to some switches that run PVST but have bpdufilter enabled as we don't want them to participate on the STP. It is a 3750 switch with software version 12.2(55)SE5.
As far as I knew, when a MST pre-standard BPDU was received, the interface was able to receive more pre-standard BPDUs, but I didn't know it would turn the link down. Why the links went down, and if there is any way we can configure those links to accept only MST standard BPDUs.
I would also like to know if there is any chance a switch running PVST can send a MST pre-standard BPDU if it has a software version 12.2(25)SEE3.
Any issues with SXJ and source specific multicast? We upgraded our core from SXI6 to SXJ2 and multicast stopped working for all but our L3 links.Our L2/L3 links stopped working and the only thing that has changed is the IOS version. All the configurations are still valid etc. Currently have a call open with TAC.
View 7 Replies View RelatedI am working in a environment that is classed as collapssed Layer 3 environment. We have a core 6500 with routed links to 3560's which are access switches.
We have layer 3 vlans on the access switches, one for data one for voice.On the layer 3 vlans we have ip helper addresses that are used for DHCP. The DHCP servers are located on the 6500.
I recently had a incident where someone plugged a netgear router into a desk point because they thought they could use it for a switch. This router then started to dish out IP addresses to people in the morning for those who came in and docked their laptops. 99% of people weren't affected because they have desktop PC's are their leases hadn't expired.
Now we have bpduguard, bpdufilter to prevent people from plugging in switches that send out BPDU's. However this doesn't prevent the above senario where someone plugs a router or a 'dumb' switch that doesn't send BPDU's.Because of the above senario I started looking at DHCP Snooping, but I am unsure on a couple of things.
With the topology of our network I understand that I don't need to configure IP DHCP Snooping Trust on the L3 uplinks to our core switch. From what I understand I just need to enable IP DHCP Snooping globaly and then on the VLAN's on the access switch (because of the L3 topology VLAN's are local to the access switches). Only if I had L2 uplinks to the core would I need to configure IP DHCP Snooping Trust on the trunk links.
We are in the process of switching our infrastructure of our routing/firewalls/vpns over to cisco. We are switching our first location and one of the issues I'm struggling with is windows authentication pass-through for internally hosted web pages. Meaning, user inside our network has the 2921 as their default gateway, they try to access a web page that is hosted on the internal network but is secured with windows authentication. In the past, because they are logged into the domain internally, the website authenticates and loads. After switching to the Cisco, it asks for a password even though they are logged in.
Because its the web server that actually authenticates I'm not sure why the router isn't allowing that to happen, but I can't think of anything else that could be causing this behavior.
I have the following setup:
Cisco 1921 is my core router and connected to it is a 30 Mbit fiberline
VLAN1
VLAN2
Now, the thing is that i want VLAN2 to have a 5 Mbit bandwidth limit to Internet but full speed to VLAN1.
I have played around with Rate limit without success.
I also have access to cisco switches that can limit the bandwidth.
is it possible to connect one Cisco Nexus 2000 fabric extender to two Cisco Nexus 5000 and use one link on the first side and two links on the other side?
View 3 Replies View RelatedWe have Cisco 4948 switches running in production. We want to moniter the trunk link through SNMP.If trunk link fails SNMP need to send notification to server.
View 1 Replies View RelatedI am still working on the design of my big project and always that you think that every thing is solve, appears a details.We need to deploy a fiber links to some buildings that will have access switches connected to the Core. I have been reading about ethernet ring topologies and quite differents to the hierarchical model because of the using of Ressilent Ethernet Protocol instead of STP or RSTP.My question is which of the next to scheme will be the best?
1.- Deployment an ethernet fiber ring topology with REP? Consider that the edge Switch of this ring will be my Core and this one is connected to my distribution switches in a hierarchical topology. In this situation, Acces Switch 1-A is connected to Acces switch 1-B, Access Switch 1-B to 1-C and Switch 1-C to the Core. Feel fre to recomend me wich switches and considerations are the best. We conssider 1 Catalyst 6506 Chasis for the Core and catalyst c2960s-48-TDL for acces, maybe the 3750x series. Each Acces node in the ring topology will have a maximun of 50 end devices.
2.- Deployment a Fiber ring but not connecting each switch with the next. In this case we want to ensure redundancy to the core wih equal costs path, but because of the ring each switch won´t have equal length link to the core. In this situation, Acces Switch 1-A is not connected to Acces Switch 1-B is connected directly to the core but the fiber cable will take the route to Access Switch 1-B, to Acces Switch 1-C and finnally to The Core Switch. This apply to the other to Switches. Note now that Acces Switch 1-A will have a 281 Ft link to the core and a second 1612Ft. link to the core. Here comes the question this differents lenght will negative affect RPVSTP ? or It doesn´t matter? Can i setup an etherchannel/load balance in this situation?
I've been having a debate with a colleague about QOS COS values. My colleague says I need to use COS values across layer 2 trunk links between access layer switches and core switches. My argument is if phones are marking packets with DSCP values I don't need to be concerned with Cos.The reason I ask is we're implementing a new phone system, the ip phones will mark RTP traffic wih dscp value EF and Call signaling with DSCP value of CS3. If my understanding is correct I can trust the dscp values of the phones. We are using Cisco 4507 switches which I believe automatically trust dscp values so I would just need a class-map to match the dscp values and apply the output policy map on the egress interfaces as follows? [code]
View 3 Replies View RelatedIn a site we currently have 1 BT provided ADSL link which is currently terminated using their device which I believe is some kind of 2wire device, which is extremely slow due to distance from the Exchange (4Mbps)...We have a growing number of users here and want to install a second ADSL line from BT to give them increased performance.
We have a Cisco 2800 sat not doing much so I was wondering if I could use this to load balance the link? I know BT do not support MPPP so therefore the maximum any user can get will be the speed of a single link (4Mbps)...But basically how can this be done..
Can I leave the two BT routers in place and place the Cisco 2800 behind them, or do I need to purchase two ADSL modules for the 2800 and terminate the connection there?Also once done, what do I need to do regarding actually setting up the load balancing? I have seen this:
[URL]
But am unsure as to how relevant it is? I am not sure I understand what the ACL's are being used for? I just want all users on the LAN to load balance out...
Also I am unsure of this statement:You potentially need to add policy-based routing for specific traffic to ensure that it always uses one ISP connection. Examples of traffic that require this behavior include IPSec VPN clients, VoIP handsets, and any other traffic that use only one of the ISP-connection options to prefer the same IP address, higher speed, or lower latency on the connection.I do not understand why a established session such as a VPN client, would ever traverse the second ISP connection anyway?
WE got our ESXi servers recently moved from a 6513 to nexus 2000 FEXs uplinked to a nexus 5000s basically we have enhanced vPC and nics goin to 2 different FEXs and they uplink to 2 nexus 5000.
the Vswitch for VMs is setup in a VPC. Question is do the traffic from each vm going in/out of these nics in a vpc actually use both physical links? How can i tell from the switch?
Any idea for limiting bandwidth on cisco 892F router? We have 2 VLANs through our LAN and one must be limited upto 1Mbps or 512Kbps.
View 2 Replies View RelatedI have a 4 port etherchannel configured to talk to a 4 port etherchannel on NETAPP server. The NETAPP server seems to be distributing traffic across all the links. The 4507 does not. It appears that traffic is going across only 2 of the for links. [code]
View 6 Replies View Related