The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

Biggz: Dec 27, 2005

Hi goons,

I've recently purchased an 871 router to use with my cable internet. The WAN port is Ethernet and grabs ip via DHCP from the cable modem. I've got a CCNA so I can set it up as far as that knowledge goes.

However i'm wanting to implement QoS, which was not covered in CCNA as far as I remember. I'm wanting to set up a list of ports to prioritise over everything else. Can anyone point me in the right direction? Hell, helping me navigate the cisco documentation website would be a great start as i'm sure the information is buried away in there somewhere

If it's relevent i've got fa0 through to fa3 in vlan1 acting as a 4port switch, and fa4 is the WAN port.

thanks for your help.

# ¿ Jun 19, 2007 22:35

Adbot: ADBOT LOVES YOU

# ¿ Apr 25, 2024 06:11

Biggz: Dec 27, 2005

Cisco.com posted:

Q. What QoS features are supported on the Cisco 870 platforms?
A. The Cisco 870 Series supports advanced QoS features on the WAN interface to strictly prioritize different types of traffic, especially voice traffic. These advanced QoS features include Class-Based Weighted Fair Queuing (CBWFQ), Low Latency Queuing (LLQ), class-based marking, policing, Class-Based Weighted Random Early Detection (CBWRED), Network-Based Address Recognition (NBAR), QoS preclassify, prefragmentation, Resource Reservation Protocol (RSVP), Priority and Custom queuing, and LFI. Starting with Cisco IOS Software Releases 12.4(9)T2 and 12.4(11)T, DSCP and IP precedence marking are also supported on the LAN using the switched virtual interface (SVI).

Thanks for the suggestion JWF, i'll have a better read of that in the morning when i'm more awake, but from my initial read of your link I cant see how I would classify the traffic for prioritization.

I should have read the router spec before because I can at least search cisco documentation on the different types of QoS and specifically your suggestion.

# ¿ Jun 20, 2007 00:18

Biggz: Dec 27, 2005

Thanks for the help guys, I was reading more in work today, amongst other things so I couldnt really go through it that well. Here is my scenario.

It's in a house setup with three people total. Ideally, i'd like to be able to set three ACLs, one for each person. I'd reserve IPs for each device and put them in their respective owners ACL. Then, set each ACL with a minimum of 33% outgoing bandwidth. Would this let each user use all of upload if it isnt in use and 33% minimum if everyone is using it?

Then, if its possible, prioritise by protocol/port. Voip first, HTTP second etc...

Or if that isnt possible I can just handle QoS based on protocol/port.

Another question which I'm not sure if its possible. Is it possible to do UPnP on cisco routers? Or anything similar which would enable MSN to send files? I've been looking and not found anything apart from this which was posted back in 2003.

Cisco posted:

We will definitely be implementing "full" support for Messenger (and other popular IM's) however it's not obvious that UPnP is the best way to do it. We are VERY concerned about security aspects or lack there of in UPnP

To tell you the truth i've not tested the 871 with MSN as I just figured it wouldnt work without UPnP.

# ¿ Jun 20, 2007 21:14

Biggz: Dec 27, 2005

So in theory should this prioritize web traffic (or whatever matches in the 102 ACL) above everything else

code:

class-map match-all TheseGoFirst
 match access-group 102

access-list 102 permit tcp any any eq domain
access-list 102 permit tcp any any eq www

policy-map WAN
  class TheseGoFirst
  priority 512


interface FastEthernet4
 service-policy output WAN

I'm still trying to get my head around this, but in the following example should it "share" the WAN connection, upstream at least, between the three ACLs?

code:

class-map match-all Biggz
 match access-group 102

class-map match-all Housemate1
 match access-group 103

class-map match-all Housemate2
 match access-group 104

access-list 102 permit ip host 192.168.0.2 any

access-list 103 permit ip host 192.168.0.3 any

access-list 104 permit ip host 192.168.0.4 any

policy-map WAN
  class Biggz
  priority percent 33
  class Housemate1
  priority percent 33
  class Housemate2
  priority percent 33

Thanks for looking this over.

# ¿ Jun 23, 2007 17:57

Biggz: Dec 27, 2005

My WAN interface is Fast Ethernet so the percentages will split based on the speed of 100Mbit?

The command "bandwidth" in "int fa4" lets me set a value, but is this assumed to be the same in upstream and downstream? I have 10MBit down, and 512Kbit up. If i set that to "bandwidth 512" this would, I assume, limit the downstream to that as well.

In that case, could I get around this by giving the minimum bandwidth values as follows.

code:

policy-map WAN
class Biggz
bandwidth 100
class Housemate1
bandwidth 100
class Housemate2
bandwidth 100

I know "bandwidth 100" isn't a 1/3 each but this would give each person 100Kbit minimum each?

# ¿ Jun 24, 2007 19:08

Biggz: Dec 27, 2005

wolrah posted:

Is there any way I can "bridge" a T1 to Ethernet with any Cisco devices?

I have this setup with an E1 connection, done in the following fashion. This is all on a 2851. I guess this should work on any router with a T1 interface card and ethernet port.

code:

interface Serial0/1/0
 no ip address
 ip virtual-reassembly
 encapsulation frame-relay IETF
 no fair-queue
 frame-relay lmi-type ansi

interface Serial0/1/0.2 point-to-point
 ip unnumbered GigabitEthernet0/1
 ip virtual-reassembly
 frame-relay interface-dlci 16

interface GigabitEthernet0/1
 ip address 195.0.0.1 255.255.255.0

Then give your firewall box an IP in the public address block, with gateway IP of gi0/1 and connect it up to gi0/1. I am assuming you have a block of static IPs you can use. If not, i'm not too sure, sorry.

# ¿ Nov 30, 2007 20:12

Biggz: Dec 27, 2005

I have had a request from my manager to teach a couple of co-workers the CCNA material.

We are a cisco partner so can get equipment on Not for resale deals quite cheaply.

I have looked for CCNA lab suggestions and they appear to be CCNA labs "on a budget" on old equipment.

We will be buying the new equipment shortly, what *new* hardware would you recommend?

I would only need to be teaching 2 people so the one lab would do.

Also, but i'm not holding my breath about this one, is it possible to get a hold of the CCNA teaching materials? When I did my CCNA at a netacademy there were brilliant slide shows and presentations along with a Lab book.

I can probably find my old lab book but I think CCNA has been updated since mine was published and I'd much rather teach the new course.

Has anyone done anything similar to this and what approach did you take?

# ¿ Jun 18, 2008 18:49

Biggz: Dec 27, 2005

I'm having a bit of a problem getting Windows VPN client to connect to an ASA 5505.

I have got the Cisco VPN Client to connect fine by following the IPSec VPN Wizard for Remote Clients but this doesn't seem to work for me for the Windows VPN Client.

Does anyone have any articles or configuration guides about this as all I can find on Cisco's site / google is guides for ASA with the Cisco Client.

I have ASDM and CLI access.

Thanks

# ¿ Jan 26, 2009 11:14

Biggz: Dec 27, 2005

jwh posted:

What version of Windows are you using? I know that there were NAT-T problems with the Microsoft VPN client prior to XPsp2.

I'm using Vista Ultimate 32bit. The only thing i've found regarding Vista and ASAs is that more than one cant connect using Windows VPN at one time, as per http://support.microsoft.com/kb/942429

I'm the only one connecting as the ASA is currently on my colleague's desk.

# ¿ Jan 26, 2009 17:07

Biggz: Dec 27, 2005

Martytoof posted:

Also am I the only one that keeps snippets of generic config code in his dropbox?

I'm using TiddlyWiki + Dropbox :toot:

# ¿ Jul 15, 2011 19:08

Biggz: Dec 27, 2005

Zuhzuhzombie!! posted:

Anyone have any NetFlow software preferences?

I use PRTG, it's free (up to 20 nodes) and runs on Windows. I've not heard of Nfsen before so that's another for me to try.

# ¿ Jul 21, 2011 22:04

Biggz: Dec 27, 2005

Zuhzuhzombie!! posted:

In the DHCP IP Binding table, infinite lease = a statically assigned IP, correct?

If you restart the equipment you will get a new lease, with new IP. That's bit me in the arse before!

# ¿ Jan 18, 2013 19:03

Biggz: Dec 27, 2005

quote:

then if the device ever restarts, the server will have no way of knowing which MAC corresponded to which IP

Isn't this what I said? In a simplified way.

# ¿ Jan 19, 2013 00:42

Biggz: Dec 27, 2005

Powercrazy posted:

The server will store MAC to IP info. Even if the device is restarted. So you'll get the same IP. But if anything ever happens to the DHCP Server then you'll lose all your leases.

I made the assumption that this was for Cisco devices, and it could very well be different for higher end gear. I've mainly worked on 2800ISR and Catalyst switches. With the 2800s at least, if I just have a DHCP pool with an infite lease, the ISR wont remember the lease through a restart unless I create a manual binding.

pre:

ip dhcp pool whatever
  host address 192.168.1.25 255.255.255.0
  client-identifier 01b7.0813.8811.66
  default-router 192.168.1.1

# ¿ Jan 19, 2013 10:48

Biggz: Dec 27, 2005

ior posted:

nooslost(config)#ip dhcp database flash:/dhcp.db

(thanks!)

# ¿ Jan 19, 2013 16:52

Biggz: Dec 27, 2005

I've got CCNA Routing and Switching, and CCNA Voice. Will passing CCDA (640-864 DESGN) renew both CCNA Routing and Switching & CCNA Voice?

I think it does for the Routing & Switching but I'm not 100% certain for the Voice.

My longer term goal is to go for CCNP Routing and Switching and I saw CCDP was only 1 additional exam after that. If I was able to pass CCDA which renewed my current certs it would be a bonus having another 3 years to CCNP (I'll probably need longer as my motivation to study at home is :gonk:

# ¿ Nov 5, 2013 11:31

Biggz: Dec 27, 2005

any chance switchport voice vlan x is set to something other than 20? Though that one would probably be pretty obvious to spot on the interface configuration.

# ¿ Nov 12, 2013 20:40

Biggz: Dec 27, 2005

Langolas posted:

Do we have a link to one of these webinars?

https://meraki.cisco.com/freeap

They sent the AP amazingly quick as well, I was expecting to wait weeks for it.

I'm from the UK and I needed to provide them with my company's VAT number, and someone called me almost immediately after signing up to talk to me about the webinar. He wasn't pushy or anything, I just explained that we currently sold a competitors product and I'd like to check out the Meraki equipment, he was fine with that and signed me up to a webinar.

I've not have chance to set it up properly but the webinar was worth watching.

# ¿ Dec 10, 2013 19:38

Biggz: Dec 27, 2005

I'm adding 2x Catalyst 2960s to a multi tenant building with numerous c2960s & VLANs for each tenant.

On each of the switches I get output like:

code:

2960-24_2#show vtp status
VTP Version                     : 2
Configuration Revision          : 74
Maximum VLANs supported locally : 255
Number of existing VLANs        : 54
VTP Operating Mode              : Server
VTP Domain Name                 : buildingname
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Enabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x4A 0xB4 0x00 0xB8 0xCE 0xD8 0x90 0x68
Configuration last modified by 192.168.1.254 at 10-29-13 16:37:24
Local updater ID is 192.168.1.252 on interface Vl1 (lowest numbered VLAN interface found)

I cant see any configuration regarding VTP (vtp client/server) on 192.168.1.254 or any of the other switches. I figured VTP must be set somewhere for the VTP Domain Name to be what it is.

Is it safest to configure these new switches at clients and let VTP set the vlans? I'm just worried about installing them and having them wipe the existing VLAN config on all the other switches.

# ¿ Jun 11, 2014 12:18

Biggz: Dec 27, 2005

falz posted:

Set VTP to transparent mode and never look back. Yes it will require more work adding vlans to all devices but you will avoid horrendous outages due to silly operator error.

I might just do this then, set to transparent and manually create VLANs. There isn't any tenant that has the need for their VLAN to span multiple switches, other than the one directly connected to the firewall.

Thanks for the input guys, I was just really scared of wiping a load of VLANs.

# ¿ Jun 11, 2014 15:23

Biggz: Dec 27, 2005

I'm posting this as a sanity check. Am I getting switching totally wrong or should the source / desination MAC addresses always stay the same at layer2?

I'm seeing an odd problem.

RouterB can ping RouterA, with packet loss which is why I've taken a look at this.
I've set up a workstation to ping RouterB. I get 100% packet loss when I try to do this.

I've set up port mirroring on the port going from the switch to the wireless bridge and I'm seeing something odd.

Shouldn't the destination be 00:26:82:c2:1f:f6 (RouterB)?

And shouldn't this destination be 00:1c:25:db:56:f4 (Workstation)?

I don't have administrative access to the devices between the switch and RouterB. To me it looks like another device is configured with the same IP as RouterB, but that doesn't explain the wrong destination MAC in the reply.

86.30.1.189 is my home computer which does get a successful ping, the request source mac is RouterA and destination MAC is 00:10:e7:aa:5f:b1.

Thanks for your help & sorry for the paranoid censoring of IP addresses.

# ¿ Jul 6, 2014 20:03

Biggz: Dec 27, 2005

adorai posted:

Have you looked at your mac table to see what device actually has 00:10:e7:aa:5f:b1?

Yeah, this shows as coming from the port connected to the wireless bridge. The network on the RouterB side of the wireless bridge is a lot more complicated than on my diagram (numerous point to point wireless links with 200+ customers connected via WiMax) but supposedly only Layer2. I don't have any admin access to this part of the network but I'll show what I've found to that network team.

Thanks for the help.

# ¿ Jul 6, 2014 21:27

Biggz: Dec 27, 2005

beerbot posted:

Your 3750 is layer 3 and is routing between those vlans/subnets instead of needing a router to do it.

To add to this, add the SVI IP address as your default gateway on the hosts.

# ¿ Jul 11, 2014 20:09

Adbot: ADBOT LOVES YOU

# ¿ Apr 25, 2024 06:11

Biggz: Dec 27, 2005

Ginger Beer Belly posted:

After reading more carefully, I gave an 802.11 answer and I see that your wireless bridge has multiple clients and is WiMAX. Is that system using true 802.16 frames and not sending to an upstream ASN-GW?

There is an ASN-GW and I've been told it's the one causing the problem I'm seeing. The network team couldn't explain to me why the source mac address was that of my firewall rather than my workstation.

Is that how ASN-GWs are meant to work?

# ¿ Jul 14, 2014 19:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)