The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›10 »

Thanks Ants: May 21, 2004; #essereFerrari

Everything in IT is the worst

# ¿ Oct 30, 2015 23:39

Adbot: ADBOT LOVES YOU

# ¿ Apr 19, 2024 00:09

Thanks Ants: May 21, 2004; #essereFerrari

Walked posted:

So networking isnt my forte (or focus area); but something I obviously interface with periodically.

We have a switch that my junior admin setup the other day and asked for assistance today while I was on-site with him..

Ports 1-23 - VLAN2 (untagged)
Ports 24, 48 - VLAN1 (native, untagged)
Ports 24-27 - VLAN3 (untagged)

He asked me to give it a look today, and I only had a minute to peek at it - not thoroughly troubleshoot with him..
Basically, hosts on VLAN2 cannot communicate; for example, plugged into port 3 and 9, on the same subnet - no dice
Similarly, hosts on VLAN3 cannot communicate, same idea.
VLAN1 for switch management works just fine on Port 24 and 48.

Resetting the VLAN configuration to have the whole switch native to VLAN1 in default config and hosts can talk as they should (but the switch isnt segregated the way he wants, obviously)

Any tips I can toss him? I am in the middle of rebuilding a portion of our virtualization environmentwith a tight deadline so I dont have a ton of time to hand-hold; I'm merely looking for thoughts or tips I can toss at him on this.

Is it a Cisco switch or not? I've seen switches from some manufacturers let you specify the untagged VLAN as well as the PVID per port for reasons I have no idea about, and if they didn't match then no traffic would pass. I would assume the guy hasn't created a private VLAN so that can probably be ruled out, but it might be worth a look.

# ¿ Nov 5, 2015 00:16

Thanks Ants: May 21, 2004; #essereFerrari

The subnet mask tells the device what it should be able to contact without having to go through a gateway. When a request is made to connect to a device in the same subnet, an ARP request is sent to get the MAC address of the destination, and the communication happens at a layer 2 level (that's a really bad explanation and I apologise).

If you ping an address you have never pinged before in IOS you will often see the first ping fail as the address isn't in the ARP cache yet. The second ping command will show 100% success.

# ¿ Nov 19, 2015 20:14

Thanks Ants: May 21, 2004; #essereFerrari

I misread your IPs.

10.0.10.0/24 is 10.0.10.1-10.0.10.255, 10.0.20.0/24 works in the same way. To get packets between those two networks they need to be routed.

The routing table on your router knows about those already because they are interfaces on the router and it's directly connected to both. If you had a second router and they only had an address in the 10.0.10.0/24 subnet in common then you would need to tell each router about the other networks available on the connected router. The most basic way to do this is with static routes.

# ¿ Nov 19, 2015 20:33

Thanks Ants: May 21, 2004; #essereFerrari

Japanese Dating Sim posted:

Okay, got it. Thanks for spending time on something that's extremely basic as far as this goes, I really do appreciate it.

Not a problem, I need to get off my arse and schedule my exam so answering questions in the meantime helps keep it all fresh.

# ¿ Nov 20, 2015 00:09

Thanks Ants: May 21, 2004; #essereFerrari

Are you just checking SNMP status or generating traps?

# ¿ Nov 23, 2015 14:42

Thanks Ants: May 21, 2004; #essereFerrari

I wouldn't have an issue using a firewall virtual appliance as long as it was being deployed into a stable environment. You can back them up with whatever you currently back VMs up with, easily deploy a fresh image and move configuration across for larger software updates, and take an exact clone for diagnostic purposes without having to work in a maintenance window or risk causing service interruptions.

On your manufacturer support point, loads of the large vendors are doing virtual appliances now - Juniper have vSRX, F5 do virtual appliances, Palo Alto do etc. It's not a choice between big vendor hardware with support contract or virtual appliance with community support.

Thanks Ants fucked around with this message at 12:35 on Nov 29, 2015

# ¿ Nov 29, 2015 12:32

Thanks Ants: May 21, 2004; #essereFerrari

Panda Time posted:

Soo I'm trying to build a smalish network for our next office move and I'm considering Ubiquiti gear. Our only budget is the difference in price we'd save versus remaining with the lovely service provided by "the building".

ISP is telling me they'd provide a Cisco 7206.

Network is a single floor space with VOIP, 100Mb internet, and an internal server (we may potentially host internet facing services in the future, sFTP or similar in the DMZ). Scaling isn't too much of a concern right now. We have about ~100 desktops, and a few dozen floating laptops and phones on a single floor space.

What I pray will be sufficient:
� UniFi Security Gateway/Firewall
��Ubiquiti ES-48-750W *or* US-48-750W
��Ubiquity Edgerouter Pro
��[2x] Aironet 1850 APs

I have rudimentary networking/IP/OSI education, and it sounds like Ubiquiti has built in auto VOIP QoS settings, so my main concern is how much of a fool I might be to try and build and configure a new network for ~150 users.
Access point configuration is a major concern, and I'm wondering if CCI is only a matter of dialing in broadcast signal strength on multiple APs or if there's enterprise APs with a built in tool for automatically adjusting multiple APs to work nice together.

It's a single office floor, with a satellite office space a couple hundred feet away, so I imagine that'd entail running a SFP(+) line between two switches?

I'm concerned there's something I may not be aware of that will lead to trainwrecks

The USGs are absolute poo poo, there's no more of a firewall/security function in them over what you can do on the EdgeRouter.

# ¿ Dec 7, 2015 20:57

Thanks Ants: May 21, 2004; #essereFerrari

Japanese Dating Sim posted:

I was about to tell you that I did already have that configured, and then I looked at R3 and nope, no routing configuration of any kind done. Christ.

Thanks for explaining the obvious to me. Working now, like you'd guess.

If you'd done show ip route on all the routers ready to paste here you'd probably have spotted that it looked off.

It's all learning

# ¿ Dec 7, 2015 20:59

Thanks Ants: May 21, 2004; #essereFerrari

Flexoptix always perform well in my experience

# ¿ Dec 9, 2015 00:40

Thanks Ants: May 21, 2004; #essereFerrari

You shouldn't be seeing MPLS LDP messages spilling out of your side of the connection.

# ¿ Dec 10, 2015 01:03

Thanks Ants: May 21, 2004; #essereFerrari

In the world of a huge number of services being hosted on public cloud providers, and those services all using HTTPS, how are people ensuring the correct QoS is applied to different services? Say I have a web application that all the company employees practically live in, it's hosted on AWS and maybe it pulls files attached to records out of S3. If the marketing department uses a file transfer service that uses S3 at the backend, how are people ensuring that the large download is treated at a lower priority than the smaller requests to the business application? Are there firewall features that can look at how much traffic has been transferred in a certain time period in one session and decide it's a download, do I need to hope that the applications work in such a way that I can identify their requests by looking at the DNS hostnames, or is the correct answer to use something like AWS Direct Connect for the business app and let everything else happen over the Internet?

# ¿ Dec 19, 2015 21:09

Thanks Ants: May 21, 2004; #essereFerrari

I'm rusty at this but I don't think you can summarise 10.1.1.0 thru 10.1.4.255. You can do 10.1.0.0/19 to get 4 /24 subnets, but that doesn't include 10.1.4.0/24

# ¿ Dec 31, 2015 20:32

Thanks Ants: May 21, 2004; #essereFerrari

Jesus I can't type. Not sure where I got the /19 from up there. Sorry if that confused anyone.

# ¿ Dec 31, 2015 21:02

Thanks Ants: May 21, 2004; #essereFerrari

Which leaves who? Cisco?

I hate their newer stuff because it feels really cheap compared to the 7962 range that I was spoiled with a while back.

Thanks Ants fucked around with this message at 23:44 on Jan 9, 2016

# ¿ Jan 9, 2016 23:41

Thanks Ants: May 21, 2004; #essereFerrari

The Newsroom started off with Cisco in season 1 and then moved to Avaya in season 2 and 3, sometimes with uncomfortably long pauses on the phones.

# ¿ Jan 11, 2016 00:31

Thanks Ants: May 21, 2004; #essereFerrari

CrazyLittle posted:

I still have poly501's in service. Kill me.

# ¿ Jan 12, 2016 01:36

Thanks Ants: May 21, 2004; #essereFerrari

Does anybody that you work for understand how "best value" and "lowest purchase cost" are not the same things?

# ¿ Jan 16, 2016 21:14

Thanks Ants: May 21, 2004; #essereFerrari

Bigass Moth posted:

I don't know if you're serious or joking

~~cisco~~enterprise_licensing.txt

# ¿ Jan 25, 2016 18:55

Thanks Ants: May 21, 2004; #essereFerrari

falz posted:

all firewaslls are the worst.

# ¿ Jan 27, 2016 00:29

Thanks Ants: May 21, 2004; #essereFerrari

If you want to do a short patch then use an SFP+ DA cable.

# ¿ Jan 28, 2016 00:16

Thanks Ants: May 21, 2004; #essereFerrari

Number19 posted:

It's time for me to do some firewall shopping. Right now I have a Juniper SRX210 that's woefully underspecced for the work it needs to do these days. I'm not really tied to a vendor and was curious what recommendations people have these days. Ideally, I need something that can do the following:

* ~100Mbps of IPsec traffic at the low end while not killing the device
* NGFW stuff would be nice but not a hard requirement
* a good remote access VPN client

I have looked at a bigger Juniper SRX, Fortigate and a Cisco ASA w/Firepower. I feel like Palo Atlo will be out of my price range.

Any suggestions? I don't want to contact a VAR yet because gently caress getting a million phone calls back.

I did this dance recently and settled on Fortigate because I wanted something point-and-click and 5.4 actually looks usable. I picked a 50E because it's only for a 20Mbps line and was dirt cheap, you might want something with a bit more poke for 100Mbps.

There aren't really any good firewalls, just pick one that pisses you off the least.

Thanks Ants fucked around with this message at 22:56 on Feb 4, 2016

# ¿ Feb 4, 2016 22:54

Thanks Ants: May 21, 2004; #essereFerrari

It sounds like you're in the same position I am in. I have a full-time job already and take care of IT for a friends company for mainly historical reasons. Day to day support is done by an MSP, I just help out with strategy and new stuff. So I needed something I can talk someone else through setting up.

I'll let you know if it's not crap when it arrives, the E range of Fortigates are quite new.

# ¿ Feb 4, 2016 23:03

Thanks Ants: May 21, 2004; #essereFerrari

Which led to this hilarity

http://www.cisco.com/c/en/us/support/docs/field-notices/636/fn63697.html

# ¿ Mar 1, 2016 09:19

Thanks Ants: May 21, 2004; #essereFerrari

Seems to be affecting the Meraki dashboard login as well

# ¿ Mar 19, 2016 09:46

Thanks Ants: May 21, 2004; #essereFerrari

I can't even reach that IP. For what it's worth I'm coming from:

code:

% Information related to '86.148.0.0 - 86.159.255.255'

% Abuse contact for '86.148.0.0 - 86.159.255.255' is 'abuse@bt.com'

inetnum:        86.148.0.0 - 86.159.255.255
remarks:        *******************************************************************
remarks:        * Report abuse via: [url]http://bt.custhelp.com/app/contact/c/346,3024[/url] *
remarks:        *******************************************************************
netname:        BT-CENTRAL-PLUS
descr:          IP pools
country:        GB
admin-c:        BTCP1-RIPE
tech-c:         BTCP1-RIPE
status:         ASSIGNED PA
remarks:        Report abuse via: [url]http://bt.custhelp.com/app/contact/c/346,3024[/url]
mnt-by:         BTNET-MNT
mnt-lower:      BTNET-MNT
mnt-routes:     BTNET-MNT
created:        2006-11-01T01:49:30Z
last-modified:  2011-02-24T14:19:29Z
source:         RIPE

role:           BT CENTRAL PLUS - OPERATIONAL SUPPORT
remarks:        *******************************************************************
remarks:        * Report abuse via: [url]http://bt.custhelp.com/app/contact/c/346,3024[/url] *
remarks:        *******************************************************************
address:        BT
address:        Wholesale
address:        UK
abuse-mailbox:  [email]abuse@bt.com[/email]
admin-c:        PC487-RIPE
tech-c:         SR401-RIPE
nic-hdl:        BTCP1-RIPE
mnt-by:         BTNET-MNT
created:        2004-06-08T09:02:16Z
last-modified:  2011-02-21T13:40:11Z
source:         RIPE # Filtered

% Information related to '86.128.0.0/11AS2856'

route:          86.128.0.0/11
descr:          BT Public Internet Service
origin:         AS2856
mnt-by:         BTNET-INFRA-MNT
created:        2010-10-19T07:40:47Z
last-modified:  2014-07-31T08:07:04Z
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.86 (DB-2)

# ¿ Mar 21, 2016 15:47

Thanks Ants: May 21, 2004; #essereFerrari

Is there anything inherently wrong with Brocade FCX-S switches that a 48 port PoE model isn't worth �300? Vendor is having a bit of a fire sale.

# ¿ Mar 23, 2016 23:18

Thanks Ants: May 21, 2004; #essereFerrari

I think he's been given a link to a bug that is viewable under whatever CCO access he has, but is looking for a way to search for known bugs rather than just opening TAC cases each time he hits a suspected bug.

# ¿ Mar 28, 2016 19:01

Thanks Ants: May 21, 2004; #essereFerrari

So they're going to spin off Xclaim or just shitcan the range I assume

# ¿ Apr 4, 2016 16:19

Thanks Ants: May 21, 2004; #essereFerrari

Can anybody explain why switches exist that let you have more than one VLAN untagged on a port and then have you set the PVID separately? Is this a hangover from stuff that didn't really support dot1q or is there a legitimate reason for it?

# ¿ May 3, 2016 23:07

Thanks Ants: May 21, 2004; #essereFerrari

I have been tearing my hair out over trying to get a fibre link up between two switches - an HP 2920 and a lovely ex-3com HP (1910) which is due to be replaced but until then is causing me problems.

Has anyone seen a fibre strand die but the link stay up and only work in one direction? The stats from the 2920 for the transceiver show:

code:

 Status
   Temperature : 44.375C
   Voltage     : 3.2984V
   Tx Bias     : 6.144mA
   Tx Power    : 0.2532mW, -5.965dBm
   Rx Power    : 0.2056mW, -6.869dBm

  Time Stamp    : Tue May 10 21:09:45 2016

and looking at the MAC addresses on the port:

code:

 Status and Counters - Port Address Table - 45

  MAC Address   VLANs
  ------------- ------------
  443192-26e3ce 100
  d4bed9-87045d 100

Top MAC address is the far-end switch interface, bottom one is a laptop connected to the switch with no connectivity going any further.

Looking at the far-end switch the only entry in the MAC table is the laptop that is directly plugged in. The only explanation I can think of for this is that the far-end switch is able to send that information to my 2920, but can't receive anything back in the other direction. But I've never seen a link do that - it's either up or down.

What the gently caress is going on?

# ¿ May 10, 2016 21:15

Thanks Ants: May 21, 2004; #essereFerrari

The far end is unfortunately poo poo and doesn't display that information. I am getting the guy on-site to make up LC loopback cable to test the SFPs out with.

Edit: Lol, took another look at the interface stats as opposed to just the SFP stats

code:

 Status and Counters - Port Counters for port 45

  Name  :
  MAC Address      : b05ada-2ac153
  Link Status      : Up
  Totals (Since boot or last clear) :
   Bytes Rx        : 12,336,225           Bytes Tx        : 266,422
   Unicast Rx      : 8                    Unicast Tx      : 238
   Bcast/Mcast Rx  : 144,741              Bcast/Mcast Tx  : 949
  Errors (Since boot or last clear) :
   FCS Rx          : 1                    Drops Tx        : 2,018,127
   Alignment Rx    : 0                    Collisions Tx   : 0
   Runts Rx        : 0                    Late Colln Tx   : 0
   Giants Rx       : 0                    Excessive Colln : 0
   Total Rx Errors : 1                    Deferred Tx     : 0
  Others (Since boot or last clear) :
   Discard Rx      : 0                    Out Queue Len   : 0
   Unknown Protos  : 0
  Rates (5 minute weighted average) :
   Total Rx (bps) : 4,942,984             Total Tx (bps) : 0
   Unicast Rx (Pkts/sec) : 0              Unicast Tx (Pkts/sec) : 0
   B/Mcast Rx (Pkts/sec) : 0              B/Mcast Tx (Pkts/sec) : 0
   Utilization Rx  : 00.49 %              Utilization Tx  :     0 %

Think the Tx side has a problem somewhere. From the photos that have been sent through all the kit is covered in dust so I assume that someone on that site has no idea how to handle fibre.

So this looks like mystery solved. Thanks for the autoconfigure suggestion, I probably wouldn't have looked at the interface stats without being nudged in that direction.

Thanks Ants fucked around with this message at 21:47 on May 10, 2016

# ¿ May 10, 2016 21:29

Thanks Ants: May 21, 2004; #essereFerrari

It was a dead port - using the shared copper port shows a ton of Tx errors as well. Moved the SFP to 46 and everything came up as it should have.

RMA time!

# ¿ May 11, 2016 14:41

Thanks Ants: May 21, 2004; #essereFerrari

It should have come with ASDM, or if you register it you can download. AFAIK the web UI for actually managing the non-Firepower stuff hasn't made it to the lower-end boxes yet.

# ¿ May 20, 2016 17:05

Thanks Ants: May 21, 2004; #essereFerrari

adorai posted:

Believe it or not, people wear multiple hats at smaller firms.

It depends on what the hats are. Like maybe the guy who does the infrastructure is expected to do desktop support. But if someone is employed as the office manager it's unlikely that they'd be tasked with plumbing.

This is before you even get to the damage to efficiency and quality of work by getting someone to do something they are not familiar with and not absorbed in day-to-day.

# ¿ May 21, 2016 14:33

Thanks Ants: May 21, 2004; #essereFerrari

You can do a router on a stick type configuration with virtual interfaces and VLANs.

# ¿ May 27, 2016 22:51

Thanks Ants: May 21, 2004; #essereFerrari

Where does a 1941 sit in the scale of worth-keeping to junk?

# ¿ Jun 1, 2016 21:48

Thanks Ants: May 21, 2004; #essereFerrari

I am more annoyed that the entire 800 range bar the 890 isn't rack mountable, and putting them on a rack shelf makes them slightly over 1U.

# ¿ Jun 4, 2016 13:15

Thanks Ants: May 21, 2004; #essereFerrari

commit confirmed needs to be stolen by every other vendor.

# ¿ Jun 15, 2016 08:02

Adbot: ADBOT LOVES YOU

# ¿ Apr 19, 2024 00:09

Thanks Ants: May 21, 2004; #essereFerrari

Is there a pattern with SFP types and not coming up?

# ¿ Jun 23, 2016 20:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›10 »