In the LAN network 4507R as core switch configured with several vlans.One vlan connects to the dual homed routers which in turn connecting to the single isp. I need to configure the HSRP for the internal vlans and the same time to use the load balancing or failover using the dual homed routers to the isp.
View 7 RepliesWe're trying to set up netflow based billing for our hosting environment. We're dual homed to two different ISPs using BGP peering with each (ASN 18817). The drawing below shows the logical setup: The routers are each Cat6506E with Sup32 and PFC3B/MFSC2A running 12.2(33)SXJ. The direct link between is layer 3 (routed ports) for iBGP peering. The dark line is a layer 2 LAN made up of multiple switches (not shown) each connected to both 6500's with spanning-tree for loop protection. These switches also provide a layer-2 path between routers but the configured BGP peering is set to the layer-3 port IP on the link. There is at least one firewall connected directly to a 6500. The firewalls are all ASAs connected to any one of the not-shown mid-span switches. The router interfaces to the layer-2 LAN is a VLAN SVI using GLBP to provde a redundant gateway. There are multiple subnets on this vlan configured as secondary IP addresses on the VLAN interface (and in the GLBP gateway configs).
The question is: how do we collect stats from all traffic to/from the internet without collecting any local traffic (firewall to firewall) and without getting duplicate flows sent to our collector?
I was hoping to just put "ip flow ingress" and "ip flow egress" on the ISP facing L3 ports but that's not actually collecting outgoing flows (appears egress netflow may not be supported on the 6500). I added "ip flow ingress" to the VLAN interface but that didn't seem to fix it so I also addes the global command "ip flow ingress layer2-switched vlan 50". However after a small change to the layer2 LAN some (but not all) of our clients saw a near doubling of bandwidth (according to netflow). We compared the netflow stats to the server port usage stats for one client and it looks like we were under reporting before the change and appear to be over-reporting now. I'm thinking the overage is either because we're counting MLS traffic flowing between subnets on the layer-2 LAN but can't verify. With GLBP moving the default gateway and MSTP blocking at least one uplink from a mid-span switch to a 6500, traffic flows can be difficult to predict. Especially when you don't know exactly when a flow gets accounted. For instance, if a packet comes into one 6500 becase that's the only layer-2 path to the gateway BUT the gateway is currently on the other 6500, does the first 6500 count that flow or does the second one count it or will both? etc etc.
what I have are 2 x 7204VXR (Gateways), 1 x 4507R-E (Coreswitch), and our ISP have 7609.Got some issues with redundancy with our ISP.
7609
I I
I I
7204-A 7204-B
| |
| vrrp |
| |
-4507R-E-
|
|
internal network
Both outside interfaces of 7204 gateways are connecting to 7609 with different public ip block.I used VRRP for my internal nework and failover have been tested working.Even tried to remove link of 7204-A and 7609, the failover works perfect.But somehow we're facing a problem:
- If I shutdown/ remove the link between my 4507R-E and 7204-A (primary gw_higher vrrp priority), vrrp redundancy/failover still works but internal network's internet connection goes down.
I asked our ISP and the route commands they put in their 7609 are as of follows:
ip route 3.8.8.0 255.255.255.0 3.4.4.4 name TO CUSTOMER LINK 1
ip route 3.8.8.0 255.255.255.0 3.3.3.3 2 name TO CUSTOMER LINK 2
And if they're trying to use Reliable Static Routing Backup Using Object Tracking, the internal network's internet connections is intermittent....alternate 4 ping reply and 4 timeout.
Note: IP used are sample only
how to upgrade firmware on 4507 6L-E Sup. There is only 1 Sup on the switch. is there any special requirement to update the firmware when switch not running on redundancy mode?
-core-1#show redundancy states my state = 13 -ACTIVE peer state = 1 -DISABLED Mode = Simplex Unit = Primary Unit ID = 3
Redundancy Mode (Operational) = Stateful Switchover Redundancy Mode (Configured) = Stateful SwitchoverRedundancy State = Non Redundant
[Code] ......
currently my organization is connected to internet through a checkpoint cluster directly connected to ISP router.I'd like to use both links, placing a brand new 2 cisco router between Checkpoint and ISP routers.
View 14 Replies View RelatedIs there any docs with step by steps on upgrading the IOS software image on 4507R+E with dual sup6L-E ?
View 3 Replies View RelatedI would just like to confirm whether dual stack hsrp is possible or not on 3750X both stack and non-stack.
The following is that I have to take care of this on the stack?
[Catalyst 3750 Software Configuration Guide, Release 12.2(55)SE]
[URL]
%FHRP group not consistent with already configured groups on the switch stack
I run 2 RV042 V1 for home and office with Gateway to Gateway VPN connection with single WAN connection in use. Everything works like a charm!
I was even able to create VPN connection with 2 WAN connection on one Router and 1 WAN connection on another with Smart link failover and VPN Tunel Backup.
I got problem though when i tried more complex connection diagram. [URL]
So basically I now have 2 ISP connections on each point with Static IPs and I'd like VPN Connection to be alive for ALL 4 options automatically with failovers (smart links) And tunel backups but i'm not sure if that's ever possible with my equipment.
DHCP configuration on CISCO core switch 4507R switch.With one vlan and multipul vlan both configuration using any ip address range.
View 3 Replies View RelatedI'm unable to pass the required vlans networks to my firewall I have different vlans configured for each floor of the building, All these floors have Nortel switches which are connected to the core switch through fiber link.
I have a Cisco 4507R-E core switch. Config for the core switch below: what else has to be done in order to pass the vlans to my firewalls.
Current configuration : 18527 bytes
hostname HQ_Prim_Core_Swt
boot-start-marker
boot-end-marker
enable secret 5 $1$xj2Z$TmV9chRtQWCuXYMsCtBVW/
enable password 7 13521317135C0729
[code]....
I'm in the process of upgrading my 4507R core to a new 4507R-E. The old switch has Sup IV engines (WS-X4515) running IOS 12.2(40)SG and the new switch has Sup 6L-E engines running 15.1(2)SG. I'm trying to "move" my configuration from the old switch to the new. Below shows the commands configured in the old switch. I'm trying to determine how to implement the same configuration on the new switch since these commands are no longer available.
View 2 Replies View RelatedI read quite a few documents on configuring SPAN on a cisco switch but none of them mention any limitations or any kind of CPU load it can have on a switch. I need to configure this on one of our switches and would like to know if there are any implications related to SPAN.
View 5 Replies View RelatedI have the following topology:
2x 877 routers, one interface from each router (port Fa0 which belongs to the router internal switch) is connected to the 2960 switch, the switch himself configured with default settings, flat with one v LAN.
I have configured HSRP in the following manner: router A is 10.0.0.2, router B is 10.0.0.3, virtual IP is 10.0.0.1, take note that the HSRP configuration along with the IP address are configured on vlan1 interface.
Now when i connect a PC to the switch with static IP (10.0.0.4) and trying to ping 10.0.0.1 I'm not getting replies. i see on the PC, using wire shark, the icmp request goes out but on the primary router (and also on the backup) i can't see the icmp request (using debug ip icmp).
this behavior happens only when the HSRP is configured on interface vlan1, when configuring the same configuration on Fa4 (which is WAN interface) everything works fine.
I want to run HSRP into my network.i am using two 4503 switch one is main and another one is standby. i configured V LAN into my switch and its running, now i want to configure HSRP. my configure is attach with this mail and my main switch gi2/22 is connect backup switch gi2/22 and all user is connect to both switch as like HSRP network.
I can use Standby ip
10.0.1.252 (vlan-1)
10.0.2.252 (vlan-2)
10.0.3.252 (vlan-3)
10.0.4.252 (vlan-4)
10.0.6.252 (vlan-6).....so on.
I looked online and I'm still a bit confused whether I should get dual or single band wifi for a laptop that I would like to purchase.
View 2 Replies View RelatedI have 3945 router using the HWIC-4ESW module.I am not able to see the HSRP configuration commands under these interface.Does this module support HSRP ? If yes , do i need upgrade the IOS of router.
View 1 Replies View RelatedI have configure multiple vlans on both the core swithces below is the example, my question is how will be my VTP server configuration on the 3560E since both the core switches will have identical vlans HSRP 2 configured on them. Do I have to configure both the cores with same DOMAIN NAME ?
The core has VTP 2 so I cannot use primary and secondary option.
CoreSwitch1
interface Vlan713
ip address 194.43.86.251 255.255.255.0
standby version 2
standby 86 ip 194.43.86.1(code)
Region : Others
Model : TL-WDR4300
Hardware Version : V1
Firmware Version : 3.13.31 Build 130319 Rel.57876n
ISP : Antel
I have a WDR4300 which works perfect with all devices in my house, but in my personal notebook (samsung 530U4B) wireless transfer speed is very slow in 2.4 GHz mode. 5.0 ghz works fine. I've tried everything, but I can not get good performance. at this moment I have to use a 741nd working with my wdr4300 in wds mode to use 2.4 ghz band properly.
Having 2 router with 2 sub interface configured with HSRP. The server sending the data have the route default gw xxx.xxx.xx.252 HSRP address. But on of the routers did got HW problem so we did shut it down, R2 with IP xxxx.xxxx.xxxx.251, problem so the traffic didn't go there correct when was using the HSRP address some packaged went there but not all of them no blocks in the logs. But then we did change the server direct to to the working router R1 xxxx.xxxx.253 everything did start working fine again. was working fine. Logs i got in the router was max tcp half-open connections.
I am wondering if something wrong in the configuration below and why the traffic didn't got there correct when using the HSRP address. Its working fine when using R1 IP address. The devices are 2 Cisco 2620 routers.
R!1
interface FastEthernet0/0.192
description Prod_Inside
encapsulation dot1Q 192
ip address xxx.xxx.xxx.253 255.255.255.192
ip access-group Inside_Outside in
ip verify unicast reverse-path
no ip redirects
[code]...
I bought a tp-link WA701ND and a netgear WGR614. i wish to pick up signal using 701 and then let 614 repeat it. no more tech support coz im already broke.
View 1 Replies View RelatedI have DS3's to two different providers. Each is hosted on its own 7206. The 7206's are connected to each other and both connections to the internet route traffic in and out just fine. Failover between the two is working as well. The issue I have is that one DS3 is used more than the other because it has the best route to most of our remote offices. I wanted to see if theres a way to make one of my routers posess a more attractive route to a given subnet. Of course, in the event of a router or provider failure, I would want the other router to start routing the traffic for that office.
View 1 Replies View RelatedI'm using cisco LMS 4.0, I've discovered the device and next plan is to collect the device configuration.I would like to know, How I can collect the configuration for single device.What configuration changes required on my LMS & Cisco device.
View 1 Replies View RelatedI am working on a network which has two ISP connections (Active/Active) terminating on router (ASR1000). From the LAN side (6500 switch) all the traffic need to be route on ISP1 but some of the specific subnets like 10.250.0.0/16 need to be route on ISP2 connection.
I am planning to use PBR and NAT with route maps. any documents or refrences are provided.
(access switches)---------(core switch)----------(routers)----------------(ISP1)
----------------------(ISP2)
We have recently aquired a remote location which has a pre-existing flat network (172.16.X.X/16). Before we are able to convert them over to our new IP scheme, they have a need to have wireless connectivity on site. We have 4 1142's which I need to configure for them. I have experience configuring WLC's and autonomous AP's for networks with multiple vlans but have never configured AP's for a flat, single subnet network. I need to configure them for either guest access (internet only) or corporate access to network resources with radius authentication. Do I configure a native vlan as I would for a typical multi vlan network? Do I configure the switch port as an access port as opposed to a trunk beacause of the lack of layer 3? I basically need a sample configuration for this situation.
View 1 Replies View RelatedThe basic setup Newly installed redundant ISP, thus setting up the 891 with dual WAN Using PFR to load balance between the two. Did initial config through CCP (not express), but I am familiar with the basics of IOS CLI (not used to the new zone based firewall yet, managed aour old Pix for too long, but that is a different subject)
I cannot seem to get anything but Gi0 to be accepted as a WAN interface. I go through the entire setup in CCP, test each connection, etc, and it all looks good until I exit out of CCP and go back in. At that point, I get squat out of Fa8. CCP won't let me test the connection, won't let me edit the connection, wont let me delete the connection. The wizard for a new WAN connection becomes available again (Wanting to set up a "second" WAN on Fa7...)
Again, I have verified connections to each ISP line independently, either one works just fine on Gi0, neither ever works on Fa8. This is my first real foray into PfR.
Building configuration...
Current configuration : 21486 bytes
Last configuration change at 18:59:43 UTC Mon Mar 26 2012 by admin
[URL]....
What I currently have is a Cisco 891W Router as well as two ISP's (both with dynamic IP's) in. I'm currently just running one of my modems into the 891 through the FE8 port and then if for some reason I have an internet failure switching the ISP modems. What I'm wondering is if there is a fairly simple way to configure (and attach) both modems to this router and then set it up to handle this failover automatically?
View 1 Replies View RelatedI have existing Sonic FW in my company we are moving from sonic FW to ASA 5510 Security plus lice. I have two ISP currently connected to sonic Firewall I am planning to implement Dual ISP configuration on ASA5510.
View 12 Replies View RelatedI've a RV082 with 2 internet connections.The idea is to permit external connections to my server and if one Internet line falls, automatically switch to the other.
We have configured the router in Smart Link backup.We try to connect with WAN1 and WAN2 enabled and all works fine.
We try to connect with WAN1 disabled and automatically WAN2 is activated.The problem start here...if WAN1 is activated while there are connections using WAN2, these connections falls!
How I must configure the router to permit that active connections are not disconnected from WAN2 even when WAN1 connection come back?
RV082 configured for Dual WAN [Code]....
(2) identical DSL connections, configured as Static IP (not PPPoE) with modems in bridged mode. Static IP's are /25 subnet and same gateway ** this may be a problem? Dual WAN set for Load Balance, network service detection is OFF
We have a 2003 terminal server running and successfully receiving connections through both WAN connections. Depending on location, half the users are connecting to WAN1 IP and the other half to WAN2 IP. We are getting sporadic disconnects of the remote users when they are idle for a couple minutes and automatic reconnection of the session takes over a minute. If they close the (locked up) session and reconnect manually it will let them in right away.
Could the handling of the Dual-WAN be the culprit? Could the same gateway for both WAN's create this issue upstream (out of my control)?I am going to move everyone to connecting through WAN1 and then change to Smart Link Backup and see if the issues persist.
Another thought is to use a secondary IP on the terminal server and use Protocol Binding to match "All traffic" for IP1 to WAN1 and IP2 to WAN2, which theoretically would stabilize the situation?
I recently configured WCCP with a Sophos Web Filter on my network it works good but the problem I am having is I have two 5520s so I am directing the device to look at 2 different IP addresses and since the devices are in an Active/Passive failover. The problem is because the second device is in a passive failover it is not responding which is throwing connection errors to my Sophos device. I know you can have a single management connection for the ASA's but is there a way to have a single IP for the ASAs for the WCCP?
View 1 Replies View RelatedI have recently implimented an RV016 device into our network. We have a bonded T1 service with Paetec/Windstream (5 static IPs) and also a cable connection with Comcast (no static IP). The T1 has been our primary connection, and our MX and A records all use this IP address. I have the rules set and using a one-to-one NAT setup with our 5 IPs. Everything is working great with the T1 in place and email is flowing with no problems, however when I connect the cable into the WAN2 port and try to send email, its using that outbound connection, rather then the T1 and our spam filter is blocking it. So the email is rejected and we get this message below.
---------------------------------------------------------------------------
Delivery has failed to these recipients or groups:
xxxx@gmail.com (xxxx@gmail.com)Your message wasn't delivered due to a permission or security issue. It may have been rejected by a moderator, the address may only accept e-mail from certain senders, or another restriction may be preventing delivery.
The following organization rejected your message: (our smtp spam relay)
-------------------------------------------------------------------------
The reason for being rejected is just because it doesn't recongnize the IP address/gateway it is coming from.
My question is, how do I define that all email is sent out through our T1 connections IP address in the router?I see options for Advanced Routing or Bandwidth Management, but not sure what one I need to configure as I am not too familiar with these settings. I have Intelligent Balancer(Auto Mode) enabled as well by default.
The reason for adding the second internet connection is strictly for load balencing and getting some more bandwidth in our location.
I'm trying to configure cisco 1811 with dual isp internet connections. Everything is working fine till i get to setting up port forwards.The port forwards for 2nd ISP do not work while connection to 1st isp is active. If if shutdown the connection to isp1 the port forwards work fine.
here's relevant section of the config
Code:
track 123 ip sla 1 reachability
delay down 15 up 10
!
track 456 ip sla 2 reachability
delay down 15 up 10
[code]....
I can access the 192.168.2.131 web server using the ISP1 ip but not ISP2 ip If i shutdown ISP1 interface the server becomes accessible through ISP2.Also while ISP1 is active I can't remote desktop to 192.168.1.210There are no acls, firewall zones or anything else.
Will 2811 Router with 4 switch port module, How to do dual ISP configuration on this router.
View 10 Replies View Related