Search Amazon.com:
Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us $3,400 per month for bandwidth bills alone, and since we don't believe in shoving popup ads to our registered users, we try to make the money back through forum registrations.
«302 »
  • Post
  • Reply
Arkady
Jun 18, 2004

Off to work!


Girdle Wax posted:

From the 2950 QoS FAQ.

The way I'm reading that, you need to issue 2 commands:
code:
mls qos cos 0
mls qos cos override
Why do you feel dot1p tagging is bad though?

I've read that FAQ, but from my understanding all it does is override the COS with a different value, not strip it. Meaning I'd still be left with a COS value, be it 0, or something else. Am I wrong in this?

The problem I'm having is one of the propriety devices on the network, a router of sorts, dropping all packets tagged with COS. This problem is being worked on a system level, but I was hoping to find an networking solution in the meanwhile.

Adbot
ADBOT LOVES YOU

jwh
Jun 12, 2002



Arkady posted:

I've read that FAQ, but from my understanding all it does is override the COS with a different value, not strip it. Meaning I'd still be left with a COS value, be it 0, or something else. Am I wrong in this?

The problem I'm having is one of the propriety devices on the network, a router of sorts, dropping all packets tagged with COS. This problem is being worked on a system level, but I was hoping to find an networking solution in the meanwhile.

You can't strip the 802.1p bits out of the frame- it's either there as part of the 802.1q header, or not there at all. At least, that's my understanding.

What if you connect the router-like device to a port configured as static access?

delslo
Sep 20, 2003



Tremblay posted:

There is a bug that was fixed in ASA code. Basically PPTP + PAT == no no in 7.x code. It does work in 6.x but it turned the nat tables into spaghetti. What version of code is on the PIX and what is the ASA running?
Both the Pix and the ASA are running 7.2.

behold, my running config:
code:
: Saved
:
ASA Version 7.2(2) 
!
hostname ciscoasa
domain-name coronabeach.local
enable password <LOLPASSWORD> encrypted
names
name 68.34.60.30 comcast1 description comcast1
ddns update method coronab.dyndns.org
 ddns both
!
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.0.1.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ddns update hostname coronab.dyndns.org
 ddns update coronab.dyndns.org
 dhcp client update dns
 ip address dhcp setroute 
!
interface Vlan3
 no nameif
 security-level 50
 no ip address
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd <LOLPASSWORD> encrypted
ftp mode passive
dns server-group DefaultDNS
 domain-name coronabeach.local
same-security-traffic permit inter-interface
object-group network VPN-Group
 description VPN Group
 network-object 10.0.2.0 255.255.255.0
access-list coronabeach_splitTunnelAcl standard permit 10.0.1.0 255.255.255.0 
access-list corona_beach_splitTunnelAcl standard permit any 
access-list inside_nat0_outbound extended permit ip any 10.0.2.96 255.255.255.224 
access-list inside_nat0_outbound extended permit ip any 10.0.1.192 255.255.255.224 
access-list C_B_splitTunnelAcl standard permit 10.0.1.0 255.255.255.0 
access-list CB_splitTunnelAcl standard permit any 
access-list cbeach_splitTunnelAcl standard permit any 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpnpool 10.0.2.100-10.0.2.120 mask 255.255.255.0
ip local pool VPN_Pool 10.0.1.200-10.0.1.210 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
asdm history enable
arp timeout 14400
global (inside) 1 10.0.1.99 netmask 255.0.0.0
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
nat (outside) 1 comcast1 255.255.255.255 outside
static (outside,inside) tcp 10.0.1.22 www comcast1 www netmask 255.255.255.255  dns 
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy cbeach internal
group-policy cbeach attributes
 dns-server value 10.0.1.22 4.2.2.1
 vpn-tunnel-protocol IPSec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value cbeach_splitTunnelAcl
 default-domain value coronabeach.local
username darwin password <LOLPASSWORD> encrypted privilege 0
username darwin attributes
 vpn-group-policy cbeach
http server enable
http 10.0.1.0 255.255.255.255 inside
http 10.0.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto dynamic-map outside_dyn_map 20 set pfs 
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set pfs 
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 60 set pfs 
crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 80 set pfs 
crypto dynamic-map outside_dyn_map 80 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 100 set pfs 
crypto dynamic-map outside_dyn_map 100 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
tunnel-group cbeach type ipsec-ra
tunnel-group cbeach general-attributes
 address-pool VPN_Pool
 default-group-policy cbeach
tunnel-group cbeach ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcp-client update dns server both
dhcpd address 10.0.1.100-10.0.1.130 inside
dhcpd dns 4.2.2.1 interface inside
dhcpd domain coronabeach.local interface inside
dhcpd enable inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
prompt hostname context 
Cryptochecksum:fb00efaf8c0b2658eccdd31c80cff091
: end
asdm image disk0:/asdm-522.bin
asdm history enable
Now I ask you: I am currently on comcrap internets w/ DHCP. I would like to forward ports from outside to inside, for instance:
3389 to 10.0.1.99
32767 to 10.0.1.99 (lol files)
22 to 10.0.1.22

What commands or changes would need to be run to make this happen?

- Is there any way to also punch 1723 through for PPTP VPN? I have a few devices (iPhone) that I can't install the cisco vpn client on? If so, what changes would need to be made?

- I still have the problem accessing devices over the VPN ONLY if I am behind a Pix 515 (also running 7.2). Based on this config, can you guys make any suggestions?

- Anything else that should be cleaned out of this config? I know extra crap got added in troubleshooting.

Thanks!

Boner Buffet
Feb 16, 2006


I need to do a "show tech" on about 40 devices ranging from Catalyst 2950s to a 4506. What's the best tool to use for logging the enormous output? I figured I'd give putty a go. In the past, I used hyper terminal with logging getting the techs off of a couple of routers and the output was too much and some was chopped off in the output file.

Boner Buffet
Feb 16, 2006


Sorry, lame question. Putty works fine, nothing was cut off.

ragzilla
Sep 9, 2005
don't ask me, i only work here




Arkady posted:

I've read that FAQ, but from my understanding all it does is override the COS with a different value, not strip it. Meaning I'd still be left with a COS value, be it 0, or something else. Am I wrong in this?

The problem I'm having is one of the propriety devices on the network, a router of sorts, dropping all packets tagged with COS. This problem is being worked on a system level, but I was hoping to find an networking solution in the meanwhile.

If that doesn't work, you could try using the dscp-to-cos map, assuming the device doesn't also set DSCP bits?

http://www.cisco.com/en/US/docs/swi...ml#wpmkr1026216

Powercrazy
Feb 15, 2004

*~I'm Back Boyz~*

If you can read this your style sheet is a PoS.


delslo posted:

Now I ask you: I am currently on comcrap internets w/ DHCP. I would like to forward ports from outside to inside, for instance:
3389 to 10.0.1.99
32767 to 10.0.1.99 (lol files)
22 to 10.0.1.22

What commands or changes would need to be run to make this happen?

- Is there any way to also punch 1723 through for PPTP VPN? I have a few devices (iPhone) that I can't install the cisco vpn client on? If so, what changes would need to be made?

- I still have the problem accessing devices over the VPN ONLY if I am behind a Pix 515 (also running 7.2). Based on this config, can you guys make any suggestions?

- Anything else that should be cleaned out of this config? I know extra crap got added in troubleshooting.

Thanks!

I can't help you with the specific PIX questions, as I hate PIX and wish they would die...

But I believe for your port forwarding needs you'd need to do something like this:
code:
ip nat inside source list 102 interface FastEthernet4 overload
ip nat inside source static tcp 10.10.10.3 27015 interface FastEthernet4 27015
ip nat inside source static tcp 10.10.10.7 6667 interface FastEthernet4 6667
access-list 102 permit ip 10.10.10.0 0.0.0.255 any
Obviously updating the ports and IPs to your equivalent ones.

wither
Jun 23, 2004

I have a turn both for observation and for deduction.

I'm looking for a 100mbit cheapish Cisco that can hook up a cable modem. I'm looking at the 804's(edit those are ISDN, i mean the 831's) the 1720s (i think thats the model at least), and the 2500's with a CSU/DSU, or WAN or what have you (would that even work?).

I see the 2500's going for like 30 bucks shipped on ebay with a CSU/DSU (but not a DSU/WAN card, which is what i need for a cable modem, right?) From what I gather the 804's/1720s can do that out of the box? Does the 851w have a little brother that's cheap used perhaps. Doesn't really need to have wifi.

I'm not looking for anything complicated as hell, just something that'd be rock solid stable for AIM and the like. My linksys regularly craps the bed, especially in the summer heat (I turn off the AC when I go to work.) and it's a huge pain in the rear end to come back to AIM dead. I used to get like 25 days online time easy before I started torrenting so I think (read: probably is, since this didnt happen before i used torrents regularly) that might be the cause.

So primarily i want stability. My friend suggested I route with my bsd box, but 1) it's an old machine and any power variance (even a tenth of a second) ends up rebooting it and loving it up. Yeah, I could get a UPS, but hey. He also suggested a buffalo hp-54, but all those firmware hacks make me uncomfortable, and it's also not guaranteed stability. I'm not sure if I'll find my perfect router fit though it in this price range.

Next up, I'd like QoS I'd like to limit torrents to say, 90 percent of the total bandwidth. Is there a way for Cisco's to assess maximum bandwidth on a cable modem? Say, 'within the last 24 hours, the max throughput on WAN was 9mbit down/1mbit up, so QoS everything but AIM to 8.5 mbit down/800kbit up), Sometimes my ISP bumps me up, so I'd like it to auto adjust, but that's probably asking too much. I pretty much want to limit all but AIM traffic to X percent (80/90) of the total bandwidth. Worse comes to worse I can manually adjust it.

Sometimes I transfer big files across the network, I'd like to get speed, but I don't want the router to crash because of it. Once again I want WAN traffic to remain untouched and guaranteed, if theres a way to guarantee processing power on WAN if necessary (i.e., if a 1720 will crash on WAN if both torrenting/AIM/transfering files across the network at 100mbit)

SNMP or something like FreeBSD's "bmon" in command prompt to realtime monitor bandwidth usage per port and maybe based on connection, would be nice but not necessary. Also VPN would be nice to gently caress around with (do those old cisco's even let you use the VPN client/how stable would it be. I read earlier in this thread that the ASA5510 is the most solid router for VPN some dudes ever used, but that's far out of my price range, as is the 851W or what have you.) None of these are even remotely necessary but would be nice.

Wow, that was long. Sorry if this was just one big rant, or if these are entirely noob questions. There's a cheap 831 that I'd like to get if you guys think it'd be satisfactory for the criteria i outlined.

wither fucked around with this message at Aug 25, 2007 around 00:10

Ray_
Sep 15, 2005

It was like the Colosseum in Rome and we were the Christians." - Bobby Dodd, on playing at LSU's Tiger Stadium


wither posted:

I'm looking for a 100mbit cheapish Cisco that can hook up a cable modem. I'm looking at the 804's(edit those are ISDN, i mean the 831's) the 1720s (i think thats the model at least), and the 2500's with a CSU/DSU, or WAN or what have you (would that even work?).

I think a ASA 5505 would fit perfectly for you, but it is probably out of your price range at $450 or so. It does have a few 10/100 ports (that you can VLAN!) and a shitload of pretty cool firewall stuff.

With a cable modem, you need a WIC-1ENET= for a 1700 series. Here's one at PCConnection:
http://www.pcconnection.com/ProductDetail?Sku=223326

You can probably get one for under $100 off ebay, or get a 1700 with one already in for $200 or so.

Ninja Rope
Oct 22, 2005

Wee.


What is everyone's favourite netflow graphing/display software? I've been using nfsen, but I was really hoping for something a little less complicated. Ideally, something that would provide users with a graph that says "this host send X bytes today", or even better "traffic between this network and that network averages X bytes/second". It seems like nfsen can do this, but it's too complicated for most clients I work with and even then the numbers aren't exactly what I'm looking for.

It seems like all the data I need is being collected. Do I need to write a front end to the rrd data files to generate the graphs I want? Or is there a better (ideally free) netflow display application I should be suggesting to clients?

CrazyLittle
Sep 11, 2001




wither posted:


1) Don't get a 2500 for any reason unless you really feel like learning old versions of IOS
2) Don't get a 1720 for routing ethernet WAN. Get a 2621 instead, which has two fast ethernet ports built in.
3) ASA's are a pain in the butt to configure for QoS, and PIX 501's simply don't support it. 2621's aren't that great for NAT unless you get a good amount of RAM in them.
4) Your router should never be routing LOCAL traffic, so the port speed of the LAN interface shouldn't matter as long as you have a switch that's not pure poo poo on the inside.

5) of the 8xx series, isn't the 871 the one that has 2-3 fast ethernet interfaces?

delslo
Sep 20, 2003



Ray_ posted:

I think a ASA 5505 would fit perfectly for you, but it is probably out of your price range at $450 or so. It does have a few 10/100 ports (that you can VLAN!) and a shitload of pretty cool firewall stuff.

With a cable modem, you need a WIC-1ENET= for a 1700 series. Here's one at PCConnection:
http://www.pcconnection.com/ProductDetail?Sku=223326

You can probably get one for under $100 off ebay, or get a 1700 with one already in for $200 or so.

the ASA 5505 "base package" (10 users, 3DES, etc. etc.) is $391 from newegg... shipped, it comes out to ~$400

Sneaksie
Feb 13, 2003


Ninja Rope posted:

What is everyone's favourite netflow graphing/display software? I've been using nfsen, but I was really hoping for something a little less complicated. Ideally, something that would provide users with a graph that says "this host send X bytes today", or even better "traffic between this network and that network averages X bytes/second". It seems like nfsen can do this, but it's too complicated for most clients I work with and even then the numbers aren't exactly what I'm looking for.

It seems like all the data I need is being collected. Do I need to write a front end to the rrd data files to generate the graphs I want? Or is there a better (ideally free) netflow display application I should be suggesting to clients?

Most of the networks I work with are monitored with either cricket or cacti.
For core networks we also use weathermap, this runs off the cacti/cricket graphs and produces a network diagram with coloured lines showing how much bandwidth has been used.

ragzilla
Sep 9, 2005
don't ask me, i only work here




I can't think of anywhere better to ask this, and don't want to make a new thread

Has anyone here ever terminated/scoped 50micron multimode before? We typically stick to 62.5 but our 10GbE xenpaks won't shoot far enough over it. The terminate/polish on our 50 micron looks good but when we scope it the edge of the core looks 'fuzzy'. Just wondering it that's normal...

bj2001holt
Apr 6, 2003



Sorry to cross-post but I figured this thread would be the most appropriate. The company I look for is looking to hire a couple of network engineers. If any of you are interested check out http://forums.somethingawful.com/sh...readid=2603757. I have received multiple responses from the thread and have one interview set up for later this week, hoping to hear from more people.

Thanks!

Analog LED
Oct 23, 2003

Light Emitting Diode

I'm curious, who here has dealt with TAC and how are they with solving your issues?

Analog LED
Oct 23, 2003

Light Emitting Diode

CrazyLittle posted:


5) of the 8xx series, isn't the 871 the one that has 2-3 fast ethernet interfaces?


I believe it has 4 FE ports plus the WAN port.

Analog LED fucked around with this message at Aug 31, 2007 around 00:49

jwh
Jun 12, 2002



Analog LED posted:

I'm curious, who here has dealt with TAC and how are they with solving your issues?

I deal with the TAC pretty often, as I'm sure most everybody else here does. I thought we even had a few people here that work in TAC.

I'd say they're good at solving issues overall; there's occasionally problems relating to where your case is being worked from, versus where you are, which can lead to some delays in communicating, but on the whole they're a good group to work with. They've always been top-notch smart once you get your issue routed to the right group, at least in my experience.

CrazyLittle
Sep 11, 2001




jwh posted:

I deal with the TAC pretty often, as I'm sure most everybody else here does. I thought we even had a few people here that work in TAC.

I'd say they're good at solving issues overall; there's occasionally problems relating to where your case is being worked from, versus where you are, which can lead to some delays in communicating, but on the whole they're a good group to work with. They've always been top-notch smart once you get your issue routed to the right group, at least in my experience.

I'm going on month 3 regarding OER. I just want a generic loving config I can hack GIVE IT TO ME YOU FUCKHEADS

inignot
Aug 31, 2003

WWBCD?

Analog LED posted:

I'm curious, who here has dealt with TAC and how are they with solving your issues?

TACs usefulness is inversely proportional to your level of experience. When you're first starting out & need to know how to get OSPF up on your point to point T1, TAC is seemingly god-like. When you have 10 years of experience and you ask them why your redistribution route map isn't applying tags to all the networks in your prefix list, and all you get from TAC is a blank stare, then you tend to think they suck.

jbusbysack
Sep 6, 2002
i heart syd

What do you guys think is a good second step on CCNP after BCMSN? I'm set to take that in a week or so and I'm completely indecisive on where to go after it.

Cidrick
Jun 10, 2001

Praise the siamese


I'm working on a really old Pix that I'm having trouble figuring out. I have a device inside the network with a static IP which is making an outbound VPN connection to a data center using OpenVPN. It's a rather standard setup - T1 goes into Pix, Pix feeds switches which feed the internal network. The box making the VPN connection works fine - it connects and traffic routes all over the place just fine. However, the issue is with routing.

Here's the setup:

Pix: 192.168.41.1
VPN Box: 192.168.41.4
Remote Network: 192.168.208.x

Now, everything on the .41.x subnet has the Pix as its default gateway. I have set up routes on the Pix to point traffic to the .208.x subnet to use .41.4 as the gateway. The VPN box forwards all traffic to .208.x to go over the VPN interface. If I set up static routes on individual machines inside the .41.x subnet to use .41.4 as the gateway for all .208.x traffic, it works. Of course, this is a horrible way to do things and I want the Pix to handle it all.

The kicker is, I added the routes on the Pix to go to the .208.x subnet and it works just fine from the Pix. If I'm logged into the Pix I can ping anything on the .208.x subnet just fine. However, it doesn't seem to be properly routing traffic from anything on the inside network to use .41.4 as its gateway.

Here's the routes
code:
pix# sh route
        outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1 OTHER static
        inside 192.168.41.0 255.255.255.0 192.168.41.1 1 CONNECT static
        inside 192.168.208.0 255.255.255.0 192.168.41.4 1 OTHER static
        outside xxx.xxx.xxx.xxx 255.255.255.248 xxx.xxx.xxx.xxx 1 CONNECT static
Do I need an access list or something? Is there a better way to go about this? I'd rather have the Pix handle the VPN but almost all our stuff uses Linux-based networking tools like Quagga and OpenVPN which would most likely be a nightmare to get it working on the Pix.

Thanks. I rather suck at Cisco stuff so this is probably a pretty easy question.

dwarftosser
Sep 3, 2002

PLEASE LET ME SUCK YOUR COCK, BRETT!


Cidrick posted:

I'm working on a really old Pix that I'm having trouble figuring out. I have a device inside the network with a static IP which is making an outbound VPN connection to a data center using OpenVPN. It's a rather standard setup - T1 goes into Pix, Pix feeds switches which feed the internal network. The box making the VPN connection works fine - it connects and traffic routes all over the place just fine. However, the issue is with routing.

Here's the setup:

Pix: 192.168.41.1
VPN Box: 192.168.41.4
Remote Network: 192.168.208.x

Now, everything on the .41.x subnet has the Pix as its default gateway. I have set up routes on the Pix to point traffic to the .208.x subnet to use .41.4 as the gateway. The VPN box forwards all traffic to .208.x to go over the VPN interface. If I set up static routes on individual machines inside the .41.x subnet to use .41.4 as the gateway for all .208.x traffic, it works. Of course, this is a horrible way to do things and I want the Pix to handle it all.

The kicker is, I added the routes on the Pix to go to the .208.x subnet and it works just fine from the Pix. If I'm logged into the Pix I can ping anything on the .208.x subnet just fine. However, it doesn't seem to be properly routing traffic from anything on the inside network to use .41.4 as its gateway.

Here's the routes
code:
pix# sh route
        outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1 OTHER static
        inside 192.168.41.0 255.255.255.0 192.168.41.1 1 CONNECT static
        inside 192.168.208.0 255.255.255.0 192.168.41.4 1 OTHER static
        outside xxx.xxx.xxx.xxx 255.255.255.248 xxx.xxx.xxx.xxx 1 CONNECT static
Do I need an access list or something? Is there a better way to go about this? I'd rather have the Pix handle the VPN but almost all our stuff uses Linux-based networking tools like Quagga and OpenVPN which would most likely be a nightmare to get it working on the Pix.

Thanks. I rather suck at Cisco stuff so this is probably a pretty easy question.

The PIX is not a router, it will only forward traffic through it or deny traffic on the same virtual interface. It is not possible to reroute traffic out of the same virtual interface on a PIX.

dwarftosser fucked around with this message at Aug 31, 2007 around 16:40

Cidrick
Jun 10, 2001

Praise the siamese


dwarftosser posted:

The PIX is not a router, it will only forward on deny traffic on the same virtual interface. It is not possible to reroute traffic out of the same virtual interface on a PIX.

Crap.

Guess I'll have to figure out how to make the Pix the VPN endpoint then.

dwarftosser
Sep 3, 2002

PLEASE LET ME SUCK YOUR COCK, BRETT!


Cidrick posted:

Crap.

Guess I'll have to figure out how to make the Pix the VPN endpoint then.

Yup, I found that out the hard way the first time I ever installed a Cisco VPN Concentrator. If you've got another device that can act as a router for your local network that might be the easiest solution, and then it can redirect traffic to the PIX or VPN from there.

Cidrick
Jun 10, 2001

Praise the siamese


dwarftosser posted:

Yup, I found that out the hard way the first time I ever installed a Cisco VPN Concentrator. If you've got another device that can act as a router for your local network that might be the easiest solution, and then it can redirect traffic to the PIX or VPN from there.

Yeah, I could do that, but if I did I'd probably just end up tossing the Pix since there's not a whole lot it can do that my Linux firewall can't.

Actually, now that I think about it, the easiest way to do this would probably be to make the VPN box the default gateway in DHCP, so that all traffic from the internal network has to hit it before going to the Pix without having to physically put it between the switches and the Pix. The only downside to this is that I'm introducing one extra point of failure. If I have a single point of failure, I'd rather it be a Cisco product than a Supermicro 1U server.

Thanks for your help!

gregday
May 23, 2003


If anyone wants to buy some Cisco Catalyst 2950 24-port switches, I have 3 available in perfect condition.

SA Mart thread:

http://forums.somethingawful.com/sh...hreadid=2610569

inignot
Aug 31, 2003

WWBCD?

Cidrick posted:

Pix feeds switches...

What kind of switch do you have? If it does layer 3 you could do your routing there. Even if it's only layer 2 you (I think) can form a trunk with the pix & set up sub interfaces for more 'routing' on the pix.

RabidFox
Jul 20, 2007


CrazyLittle posted:

3) ASA's are a pain in the butt to configure for QoS, and PIX 501's simply don't support it. 2621's aren't that great for NAT unless you get a good amount of RAM in them.
4) Your router should never be routing LOCAL traffic, so the port speed of the LAN interface shouldn't matter as long as you have a switch that's not pure poo poo on the inside.

These are the two most important facts. Slow lovely routers are terrible for vlan routing and acl's. If I had a nickel for every time I saw a 28XX or 26XX peg at %100 cpu time and stop responding because some dipshit thought it'd be a good "router on a stick" for vlan routing over fa speeds. FFS, it's a 200mhz proc. When the hardware based packet router gets overloaded it goes to the software based one, which blows balls, btw. I've gotten some very confused emails starting with, "well it worked XX months ago, what's different now?" "Have you added more users?" "uh, yeah"

moral of the story is, routing at fa speeds through a 2XXX series router with any sort of acl's/policy based routing is a NO!

jwh
Jun 12, 2002



RabidFox posted:

When the hardware based packet router gets overloaded it goes to the software based one, which blows balls, btw.
Aren't 2600 and 2800 series software CEF only? What hardware are you talking about?

mezoth
Aug 6, 2006


inignot posted:

TACs usefulness is inversely proportional to your level of experience. When you're first starting out & need to know how to get OSPF up on your point to point T1, TAC is seemingly god-like. When you have 10 years of experience and you ask them why your redistribution route map isn't applying tags to all the networks in your prefix list, and all you get from TAC is a blank stare, then you tend to think they suck.

Having worked for them, and then worked for a major internet provider and dealing with them (and the AS group at Cisco) this statement is 100% accurate. Seriously, for advanced routing issues, or getting them to admit to a bug (and internally getting the DEs to admit to a bug) was just a real pain in the rear end without overwhelming evidence. I am tracking multiple bugs with DSCP marking on the 7600 sup720 platform right now, and Cisco will not even try to help anymore. Grr.

For basic/mid-level support, however? They seriously rock. And if they do not, escalate internally and get somebody that does - it shows up in the metrics pretty fast when somebody has a ton of requeues for bad service and action is taken.

RabidFox
Jul 20, 2007


jwh posted:

Aren't 2600 and 2800 series software CEF only? What hardware are you talking about?

oh balls, you're right. This was a cat 3XXX something, layer 3 switch, I had a 2XXX as a router on a stick with the same problem, ACL's with intervlan routing. The Cat was doing the same thing but it had policy based routing. NVM, then.

XakEp
Dec 20, 2002
Amor est vitae essentia

Just wanted to share this - I passed my 642-552 SND exam today. 975/1000. With any luck I can get CCSP out of the way by the end of the year and move on to CCIE Security.

CrazyLittle
Sep 11, 2001




This thread's getting lonely. I have a fun bit of news:

I managed to get OER working on a 3640 with a T1 and DSL interface.

R1CH
Apr 7, 2002

The Ron Jeremy of the coding world

Is there any way to adjust DHCP client retries / timeouts on a Cisco 871W? It runs IOS, c870-advsecurityk9-mz.124-11.T1.bin to be specific. My braindead ISP only gives me an IP after the 4th or 5th DHCP REQUEST or after a certain time period has elapsed, but my 871W only issues 3 requests with a 5 sec timeout on each one before giving up for a minute.

Windows and Mac both continue issuing requests with the same xid until they get a lease whereas the 871w picks a new xid after 3 failed attempts. The only timeout settings I could find seemed to be for the dhcp server. My router is acting as nothing more than a glorified switch at the moment until I can fix this. Any ideas?

ragzilla
Sep 9, 2005
don't ask me, i only work here




CrazyLittle posted:

This thread's getting lonely. I have a fun bit of news:

I managed to get OER working on a 3640 with a T1 and DSL interface.

I just saved a bunch of money on my car insurance.

No wait, Cisco pushed the SRB2 release back to late september (28th I think?). And the PM team will not be providing interim builds even though it's been stable for 'a couple of weeks'.

Oh, and the devices I need to put it on go live this weekend, so I guess I need yet another maint window in early oct to do the code upgrade and apply dcef-only switching mode...

jwh
Jun 12, 2002



CrazyLittle posted:

I managed to get OER working on a 3640 with a T1 and DSL interface.

Can you share sanitized configs, as well as which IOS image you're using? I'd love to see what you came up with.

CrazyLittle
Sep 11, 2001




jwh posted:

Can you share sanitized configs, as well as which IOS image you're using? I'd love to see what you came up with.

No! YOU MUST PAY ME FOR IT!!! MUA HAH AH AHHAHAHHA...

(yeah - just gotta grab it from the router some how, and I seem to have locked myself out of telnet over the DSL interface :P )

jwh
Jun 12, 2002



R1CH posted:

Is there any way to adjust DHCP client retries / timeouts on a Cisco 871W?

Can you hard code the ID? I think there's an option for that. There's an option for hard-coding some client identifier, although it might not be the one you need.

I haven't seen any options to tune the dhcp client, sadly.

For that matter, why is your ISP so slow to reply to your request? Fifteen seconds is a long time.

Adbot
ADBOT LOVES YOU

jwh
Jun 12, 2002



CrazyLittle posted:

No! YOU MUST PAY ME FOR IT!!! MUA HAH AH AHHAHAHHA...

(yeah - just gotta grab it from the router some how, and I seem to have locked myself out of telnet over the DSL interface :P )

I'm prepared to offer you all of my returnable beer bottles, shipped at your expense, plus a cat. You can choose a grey cat, or an orange one. That is my final offer.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply
«302 »