Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
ragzilla
Sep 9, 2005
don't ask me, i only work here


zapateria posted:

Hi, I'm pretty clueless when it comes to what has what in switches and routers, so I need a suggestion for a device.

Our network looks something like this:

code:
          WAN
           |
        FW-|
           | 
      ____(R)____
     /     |      \
    /     Site4    \
Site1             Site2
Datacenter        Backup Datacenter
We have about 10 networks on these sites and we'd like to do static vlan routing with access lists on the device (R) to separate these. We tried routing with the firewall (NSA2400) and add access rules there, but the traffic killed it. Total users is about ~400, bandwidth normally around 300-500Mb/s

L2 switching within the sites are done with HP Procurve 2910al's (does not support ACL on VLANs).
L2 switching between sites are mostly WS-C3560G's and WS-C2960G's (not ours).
What kind of switch/router should the (R) device be? I'm thinking we need 24 Gb ports. I don't care if it's a HP Procurve of Cisco as long as it can do what I need.

3560G will do line rate routing so long as your traffic isn't too bursty.

Adbot
ADBOT LOVES YOU

Zuhzuhzombie!!
Apr 17, 2008
FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR
3750 the only Cisco switch that has gig ports?

I know the 500 does but it doesn't have a CLI and I think the MTU is locked at 1500.

Basically my unix/data guys need a switch for ISCSI with gig ports and an MTU size of 9000. I'd prefer not to give them a 3750 since this will largely just be a dumb and unused switch.

Jelmylicious
Dec 6, 2007
Buy Dr. Quack's miracle juice! Now with patented H-twenty!

Zuhzuhzombie!! posted:

3750 the only Cisco switch that has gig ports?

I know the 500 does but it doesn't have a CLI and I think the MTU is locked at 1500.

Basically my unix/data guys need a switch for ISCSI with gig ports and an MTU size of 9000. I'd prefer not to give them a 3750 since this will largely just be a dumb and unused switch.

Here, this should help you:
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps10744/Cisco_Switching_Family.pdf

Zuhzuhzombie!!
Apr 17, 2008
FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR
TY

zalmoxes
Sep 30, 2009

:eurovision:
My new boss said that he uses sonicwall because cisco doesnt have good web management interface, and he doesnt use the CLI...
Now I'm figuring out the SonicOS CLI for myself. All I can say is that I feel sorry for ever complaining about Cisco's website. The documentation on cisco.com is the best.

falz
Jan 29, 2005

01100110 01100001 01101100 01111010
Be sure to check out /diag.html. You're welcome.

mezoth
Aug 7, 2006

ragzilla posted:

Still only 32 bits of ASN space. And multi homing should be easier under v6 (just have an address from each provider on your machine) if you're an eyeball.

Prefix delegation is the IPv6 solution for single homed customers that want to run more then one network segment locally, but as far as I know people are talking about doing BGP if you are trying to run to two ISPs in an active/active scenario.

The real issue comes back to DNS resolution - the second you setup a server that you want to be resolvable in global DNS, you really need to know that you can keep that IP address that you have in DNS or that it can be updated very quickly to avoid downtime. DDNS has the downside of low TTL values, so that puts more stress on your auth DNS servers - especially if you are talking about doing this with thousands or tens of thousands of endpoints.

Ninja Rope
Oct 22, 2005

Wee.
Not to mention not all recursive DNS servers obey a record's TTL, some enforce a minimum that may be higher than what you want.

ragzilla
Sep 9, 2005
don't ask me, i only work here


mezoth posted:

Prefix delegation is the IPv6 solution for single homed customers that want to run more then one network segment locally, but as far as I know people are talking about doing BGP if you are trying to run to two ISPs in an active/active scenario.

The real issue comes back to DNS resolution - the second you setup a server that you want to be resolvable in global DNS, you really need to know that you can keep that IP address that you have in DNS or that it can be updated very quickly to avoid downtime. DDNS has the downside of low TTL values, so that puts more stress on your auth DNS servers - especially if you are talking about doing this with thousands or tens of thousands of endpoints.

Neither of these affect you as an eyeball (consumer of content) - but yes if you want to make a specific prefix highly available (to publish content) you'll be using BGP, or possibly an overlay network if any of them gain wide spread acceptance (LISP, IRON).

In an eyeball network I can set up two IPv6 gateways connected to the same internal network, but with two different ISPs, which will then announce an RA for each ISPs space to the network. Machines inside the network will see the two different RAs and configure a global unicast address for each and then load balance between the two based on configuration (RFC6724 left this open for the OS to optimize if possible similar to Apple's built in happy eyeballs like algorithm for switching between v4/v6). If the gateway detects that it's ISP connection has become unavailable it sends RAs invalidating it's prefix information (or at least it's status as a candidate default router) which lets the hosts inside fail over to using the other connection exclusively. Similar to existing dual ISP NAT routers except the logic is now in the hosts instead of the router/gateway.

ToG
Feb 17, 2007
Rory Gallagher Wannabe
This might not be the best place for it but I'm not sure where is a better thread.

I'm looking at various final year (BEng Computer Science) projects and after being shot down for one of the predefined network projects I'd like to do something networking related. Typically it has to be a piece of software or a research project.

Anyone got any ideas or are there any areas I should focus?

Sir Sidney Poitier
Aug 14, 2006

My favourite actor


A colleague is in the same position so I can tell you what he's doing. I've never used ASDM, but he is writing something that works in a similar way I believe. It is essentially a telnet parser, but I think his builds in certain features like maybe a database of some sort, and is aimed at higher end stuff (bought himself a sup720 to try it on).

He asked me if I'd use a thing like that and I told him no, because the people who are doing stuff beyond what people normally use ASDM for don't need a GUI for it anyway... But I think it's a good project.

One of the guys who helped out in tutorials at university had also done a networking project - he'd made a network simulator, which may be more up your street if you don't know a lot about Cisco devices. This worked a bit like Cisco's Packet Tracer, but was much simpler - it focused on the basics of subnetting and routing and recorded all user actions. Because it recorded actions, it was actually used in practical exams to grade people.

Sir Sidney Poitier fucked around with this message at 21:19 on Oct 8, 2012

Zuhzuhzombie!!
Apr 17, 2008
FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR
Question:


We have an AS5800 that we use to handle our old dialup customers. It was accidentally shut down yesterday by Field Services and I had some difficulty getting it back up. The config was wiped and I had to copy over a config i had on file. The new config took just fine but some of the serial groups stayed admin down/down.

I tried to access them but 0 - 22 gave me this error:

% Cannot access B-channel interfaces

:23 I was able to access and no shut, however, it has stayed down. They are configured the same as the other :23s that are up (0 - 22 in all other serial groups are just down/down)

description Telica PRI #08 Priority #83
no ip address
encapsulation ppp
timeout absolute 480 0
dialer rotary-group 0
dialer-group 10
isdn switch-type primary-ni
isdn incoming-voice modem
no cdp enable


This is connected to a Lucent/Telica/something on the far end handling calls. They're getting two vague as errors as to why the calls aren't going through:


100 is a Protocol error that means Invalid information element contents – this cause indicates that one or more fields of the information element are coded in a way that has not been implemented by the equipment sending the cause to process the message
111 is a Protocol error – this cause is used to report a protocol error event only when no other cause in the protocol error class applies – an interworking class



Basically I'm grasping at straws here as I have no idea where to look/what to do/what to ask.

Any help is greatly appreciated.




ed


Also getting "Transmitter is sending remote alarm." on some of the T1s that are down/down.

The T1s that are admin down/down correspond to the Serial groups that I can not access due to the "b channel" error.

Our T3 is up/up and not giving any errors. "No code is being received".

Zuhzuhzombie!! fucked around with this message at 15:50 on Oct 9, 2012

n0tqu1tesane
May 7, 2003

She was rubbing her ass all over my hands. They don't just do that for everyone.
Grimey Drawer

Zuhzuhzombie!! posted:

Question:


We have an AS5800 that we use to handle our old dialup customers. It was accidentally shut down yesterday by Field Services and I had some difficulty getting it back up. The config was wiped and I had to copy over a config i had on file. The new config took just fine but some of the serial groups stayed admin down/down.

I tried to access them but 0 - 22 gave me this error:

% Cannot access B-channel interfaces

:23 I was able to access and no shut, however, it has stayed down. They are configured the same as the other :23s that are up (0 - 22 in all other serial groups are just down/down)

description Telica PRI #08 Priority #83
no ip address
encapsulation ppp
timeout absolute 480 0
dialer rotary-group 0
dialer-group 10
isdn switch-type primary-ni
isdn incoming-voice modem
no cdp enable


This is connected to a Lucent/Telica/something on the far end handling calls. They're getting two vague as errors as to why the calls aren't going through:


100 is a Protocol error that means Invalid information element contents – this cause indicates that one or more fields of the information element are coded in a way that has not been implemented by the equipment sending the cause to process the message
111 is a Protocol error – this cause is used to report a protocol error event only when no other cause in the protocol error class applies – an interworking class



Basically I'm grasping at straws here as I have no idea where to look/what to do/what to ask.

Any help is greatly appreciated.

Do a "show controllers T1" and a "show isdn status" for those interfaces.

Zuhzuhzombie!!
Apr 17, 2008
FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR

n0tqu1tesane posted:

Do a "show controllers T1" and a "show isdn status" for those interfaces.

Also getting "Transmitter is sending remote alarm." on some of the T1s that are down/down.

The T1s that are admin down/down correspond to the Serial groups that I can not access due to the "b channel" error.

Our T3 is up/up and not giving any errors. "No code is being received".

The "show isdn status" on those is:

ISDN Error: Illegal Interface Se0/0:16:0


show controllers t1 on the admin down ones just shows "T1 0/0:16 is administratively down."

SOme are just down/down and they all generally look:

T1 0/0:15 is down.
Applique type is Channelized T1
Description: Telica PRI #15 Priority #153
Transmitter is sending remote alarm.
Receiver is getting AIS.
alarm-trigger is not set
Framing is ESF, Clock Source is Line.
Data in current interval (820 seconds elapsed):
0 Line Code Violations, 0 Path Code Violations
0 Slip Secs, 820 Fr Loss Secs, 0 Line Err Secs, 0 Degraded Mins
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 820 Unavail Secs
Total Data (last 59 15 minute intervals):
0 Line Code Violations, 0 Path Code Violations,
37 Slip Secs, 53100 Fr Loss Secs, 0 Line Err Secs, 0 Degraded Mins,
0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 53100 Unavail Secs



The ones that are up say "alarm trigger is not set"

Zuhzuhzombie!! fucked around with this message at 15:57 on Oct 9, 2012

n0tqu1tesane
May 7, 2003

She was rubbing her ass all over my hands. They don't just do that for everyone.
Grimey Drawer

Zuhzuhzombie!! posted:

Also getting "Transmitter is sending remote alarm." on some of the T1s that are down/down.

The T1s that are admin down/down correspond to the Serial groups that I can not access due to the "b channel" error.

Our T3 is up/up and not giving any errors. "No code is being received".

The "show isdn status" on those is:

ISDN Error: Illegal Interface Se0/0:16:0

Check your config and see if you have it configured as an E1 and not a T1.

Zuhzuhzombie!!
Apr 17, 2008
FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR
I have

controller T1 0/0:1
controller T1 0/0:2
controller T1 0/0:3
controller T1 0/0:4
controller T1 0/0:5
controller T1 0/0:6
controller T1 0/0:7
controller T1 0/0:8
controller T1 0/0:9
controller T1 0/0:10
controller T1 0/0:11
controller T1 0/0:12
controller T1 0/0:13
controller T1 0/0:14
controller T1 0/0:15
controller T1 0/0:16
controller T1 0/0:17
controller T1 0/0:18
controller T1 0/0:19
controller T1 0/0:20

controller T3 0/0


If there is a specific way to check I will do so!


ed

Seeing this on the log now

16:00:05: Msg from DS slot 0 in shelf 0, cmd = 12
16:00:06: Msg from DS slot 0 in shelf 0, cmd = 14

Zuhzuhzombie!! fucked around with this message at 16:32 on Oct 9, 2012

some kinda jackal
Feb 25, 2003

 
 
Not a question or anything, but I got some time with a 7206VXR today and I was slightly amused to see that the product hasn't really changed visually from what I remember using 10+ years ago :haw:

Walked
Apr 14, 2003

I'm not a cisco guy by trade; but need to configure a site-to-site VPN connection here at work; between two 5510s with mismatched ASA versions. (7.0 and 8.4)

I'm a bit tied up with a million and one things to do and got the go-ahead to hire someone to handle the configuration for me rather than spend a ton of time to handle it.

Does anyone here do any freelance cisco work on the side?
Feel free to PM me and I can give you a better rundown; probably less than an hour of actual work and I can get you whatever access is required to configure.

jwh
Jun 12, 2002

7206 still looks like 7206, it's true.

It's pretty impressive that in the case of the 7206, or the 6509, these products have survived for as long as they have, without any significant cosmetic changes.

I can't really think of too many similar cases.

Cisco seems to operate on a ten year cycle of "black is cool," followed by, "light grey is cool."

GOOCHY
Sep 17, 2003

In an interstellar burst I'm back to save the universe!

Martytoof posted:

Not a question or anything, but I got some time with a 7206VXR today and I was slightly amused to see that the product hasn't really changed visually from what I remember using 10+ years ago :haw:

Employee of a MSP that has these scattered throughout the network, reporting for duty!

some kinda jackal
Feb 25, 2003

 
 

jwh posted:

Cisco seems to operate on a ten year cycle of "black is cool," followed by, "light grey is cool."

Teal, on the other hand, is always cool.




(it's actually not; oh god the teal)

The 7200s I was using 10 years ago weren't 7206es, but the basic 7200 box still looks the same. Made me pretty nostalgic for the days when I was a babby sysadmin trying desperately to figure out what this BEE GEE PEE thing was and why it wasn't working at 4am while on a conference call with Cisco and our provider.

Stressful as it was, that was when I first realized I wanted to do networking :)

I kind of want to buy an old 7200 just to put on my desk to remind me, whenever I get frustrated with networking.

some kinda jackal fucked around with this message at 17:07 on Oct 9, 2012

Langolas
Feb 12, 2011

My mustache makes me sexy, not the hat

Walked posted:

I'm not a cisco guy by trade; but need to configure a site-to-site VPN connection here at work; between two 5510s with mismatched ASA versions. (7.0 and 8.4)

I'm a bit tied up with a million and one things to do and got the go-ahead to hire someone to handle the configuration for me rather than spend a ton of time to handle it.

Does anyone here do any freelance cisco work on the side?
Feel free to PM me and I can give you a better rundown; probably less than an hour of actual work and I can get you whatever access is required to configure.

Would upgrading the 7.0 ASA be an option? I'm familiar with both and may be willing to help/teach depending on your time frame. I would be using you to brush up on some site to site vpn :)

Walked
Apr 14, 2003

Langolas posted:

Would upgrading the 7.0 ASA be an option? I'm familiar with both and may be willing to help/teach depending on your time frame. I would be using you to brush up on some site to site vpn :)

It is an option, however not an immediate one - we have a lot of restrictions on outage windows; and I've got one booked to upgrade the 7.0 ...at the end of November, best case.

The VPN doesnt have a specific timetable at all attached, just trying to get it a bit sooner than that if remotely possible.

Sepist
Dec 26, 2005

FUCK BITCHES, ROUTE PACKETS

Gravy Boat 2k
I PM'd you, I could knock that out quickly for you after hours

n0tqu1tesane
May 7, 2003

She was rubbing her ass all over my hands. They don't just do that for everyone.
Grimey Drawer

Zuhzuhzombie!! posted:

I have

controller T1 0/0:1
controller T1 0/0:2
controller T1 0/0:3
controller T1 0/0:4
controller T1 0/0:5
controller T1 0/0:6
controller T1 0/0:7
controller T1 0/0:8
controller T1 0/0:9
controller T1 0/0:10
controller T1 0/0:11
controller T1 0/0:12
controller T1 0/0:13
controller T1 0/0:14
controller T1 0/0:15
controller T1 0/0:16
controller T1 0/0:17
controller T1 0/0:18
controller T1 0/0:19
controller T1 0/0:20

controller T3 0/0


If there is a specific way to check I will do so!


ed

Seeing this on the log now

16:00:05: Msg from DS slot 0 in shelf 0, cmd = 12
16:00:06: Msg from DS slot 0 in shelf 0, cmd = 14

Do you have a "card type" statement in your configuration? Also, do you have any configuration under the "Controller T1 0/0"? If it's supposed to be a PRI, it should look something like this if it's a PRI:

controller T1 0/3/0
framing esf
linecode b8zs
cablelength long 0db
pri-group timeslots 1-24

Bluecobra
Sep 11, 2001

The Future's So Bright I Gotta Wear Shades

Martytoof posted:

Teal, on the other hand, is always cool.




(it's actually not; oh god the teal)
Nothing can be as bad as this:

Ninja Rope
Oct 22, 2005

Wee.
What about the F5 boxes with the cotton candy colored glowing logo on the front? Always makes me hungry.

captaingimpy
Aug 3, 2004

I luv me some pirate booty, and I'm not talkin' about the gold!
Fun Shoe

Ninja Rope posted:

What about the F5 boxes with the cotton candy colored glowing logo on the front? Always makes me hungry.

#1 - Not only does Extreme hurt the eyes, they hurt the soul.
#2 - I opened all of our F5 boxes and unplugged the power for those loving lights. One of our DC facilities has, what we refer to lovingly, zoo glass and all of the network gear is right behind it. Those lights coupled with some other devices hurt to look at.

bort
Mar 13, 2003

Ninja Rope posted:

What about the F5 boxes with the cotton candy colored glowing logo on the front? Always makes me hungry.
I totally see that, too.


CaptainGimpy posted:

Those lights coupled with some other devices hurt to look at.
I have a Cisco 2710 wireless location device at a rack unit in the high thirties. The blue "everything's ok" LED is absolutely brutal.

bort fucked around with this message at 11:45 on Oct 10, 2012

Zuhzuhzombie!!
Apr 17, 2008
FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR

n0tqu1tesane posted:

Do you have a "card type" statement in your configuration? Also, do you have any configuration under the "Controller T1 0/0"? If it's supposed to be a PRI, it should look something like this if it's a PRI:

controller T1 0/3/0
framing esf
linecode b8zs
cablelength long 0db
pri-group timeslots 1-24

We got it late yesterday. Sorry for not updating.

The guy who is way more familiar with serial/T1 took a look at it and noticed the clock rate wasn't set correctly across all of the serial interfaces. A show run and a show run int didn't show clock rate at all in the running config and I was never able to add the command.

Oh well. Documented.

Thank you guys for the response.

GOOCHY
Sep 17, 2003

In an interstellar burst I'm back to save the universe!

Zuhzuhzombie!! posted:

We got it late yesterday. Sorry for not updating.

The guy who is way more familiar with serial/T1 took a look at it and noticed the clock rate wasn't set correctly across all of the serial interfaces. A show run and a show run int didn't show clock rate at all in the running config and I was never able to add the command.

Oh well. Documented.

Thank you guys for the response.

Did he just do a "clock source line"?

some kinda jackal
Feb 25, 2003

 
 
Hey, not strictly Cisco specific, but when using GNS3 and when you have two different IOS versions for the same platform, how do you choose which you want to use when you drop it onto your canvas? :confused:

I feel like I'm missing something RIDICULOUSLY basic.

tortilla_chip
Jun 13, 2007

k-partite
There is a default IOS version box under each router type. Uncheck it. Then when you drag a router into the workspace it will prompt for which IOS version you want.

some kinda jackal
Feb 25, 2003

 
 
Oh goddamn it figures I miss a single checkbox. That did it, thanks!

Zuhzuhzombie!!
Apr 17, 2008
FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR

GOOCHY posted:

Did he just do a "clock source line"?

Nah. He had to make a few other changes as well.

atticus
Nov 7, 2002

this is how u post~
:madmax::hf::riker:

Bluecobra posted:

Nothing can be as bad as this:



check out gear from OnPath - 3900 series.

For bonus lolz look at the product sheet PDF for the 3900 series, page 3. everyone knows dudes hack in ski masks and are married

Pile Of Garbage
May 28, 2007



atticus posted:

check out gear from OnPath - 3900 series.

For bonus lolz look at the product sheet PDF for the 3900 series, page 3. everyone knows dudes hack in ski masks and are married

Those OnPath switches look ridiculous. At least they'd be easy to find in a rack I guess...

Oh and you weren't joking about their stock photo choices in the 3900 series product sheet:



That has to be a subtle goatse reference.

Tremblay
Oct 8, 2002
More dog whistles than a Petco

Bluecobra posted:

Nothing can be as bad as this:



In so many ways...

jwh
Jun 12, 2002

bort posted:

I totally see that, too.

I have a Cisco 2710 wireless location device at a rack unit in the high thirties. The blue "everything's ok" LED is absolutely brutal.

Same with the ACS appliances.

That blue LED is visible from space.

Adbot
ADBOT LOVES YOU

madsushi
Apr 19, 2009

Baller.
#essereFerrari
Extreme Networks gear is the perfect stuff for people just learning about networking. The way they handle VLANs and tagging is really simple, which of course doesn't scale well, but it's much easier to teach a newbie on Extreme than on Cisco. Once they understand the fundamentals, you can move onto the more substantial gear, but I have never worked on a switch as easy and as pleasant to configure as an Extreme.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply