Hello,   I am doing a VTP configuration review on a site with 8 switches.   All switches are in server mode The domain and password is the same for all switches Pruning is disabled across all switches   Questions:   If the main benefit of VTP is less manual admin, is VTP even useful if all switches are in server mode?   Should pruning be enabled even if all switches are in server mode?   Would transparent mode be the best option for this scenario?   If so, which VTP features should be enabled?  How would changing the mode to transparent impact a production network?   I have read that VTP server / client mode is a risky option due to potential mistakes.  What is the best practice deployment for VTP?   Is VTP even a required feature in a network with so few switches?   Thank you for your assistance.   ... View more

Hello, I am doing a review of a network and looking for some clarity on the current switch configuration   There are 2 L2 switches – SW1 and SW2   VLANS have been configured as: Network Data – VLAN 555 DMZ 1 – VLAN 600 DMZ 2 – VLAN 700   The two switches are connected with a trunk port as below:   SW1 interface GigabitEthernet0/24  description link to switch 2  switchport trunk encapsulation dot1q  switchport trunk native vlan 555  switchport mode trunk  spanning-tree link-type point-to-point   SW2 interface GigabitEthernet0/24  description link to switch 1  switchport trunk encapsulation dot1q  switchport trunk native vlan 555  switchport mode trunk  spanning-tree link-type point-to-point   Network user data frames are carried on VLAN 555 On Switch 2 there is a configured trunk port connected to an ESX VMWARE server vswitch   SW2 Trunk port connected to VM Server:   interface GigabitEthernet0/20  description connection to VM vswitch  switchport trunk encapsulation dot1q  switchport trunk native vlan 555  switchport mode trunk  spanning-tree link-type point-to-point   On the VM vswitch there are 3 configured VLAN IDs   Network Data – VLAN ID 0 DMZ 1 – VLAN ID 600 DMZ 2 – VLAN ID 700   Based on the above configuration, I am trying to understand if the frames on VLAN 555 are being tagged or are traversing the network untagged.  From what I understand, VLAN ID 0 on a vswitch is equivalent to an untagged access port.   On the switch side, is setting switchport trunk native vlan 555 on the interface applying a tag to 555 traffic?  Or does this setting explicitly pass the frame as untagged?   It seems odd to me that the native vlan would be associated with data traffic.  I thought best practice was to use an obscure native vlan.   Any insight on this scenario would be helpful.   Thank you. ... View more

Hello, I am using an ASA 5510 ver 8.4.1 One of the interfaces is configured with a IP address of 192.168.1.1 255.255.248.0 (/21) We are looking to expand this subnet to make more hosts available. What would be the implications of changing the interface subnet mask from 255.255.248.0 to 255.255.240.0? How will the related ACLs and other config entries be impacted by making this type of netmask change on the interface? Will related entries be deleted?  Or, will I have to just modify related object-groups, ACLs, etc after the change on the interface? Any assistance would be appreciated. ... View more

Hello, I have a question regarding failover monitoring on the ASA5505 in an active/standby configuration. I understand that on the 5505 you create VLAN interfaces and then assign the VLANs to the 5505 switchports.  With failover configured on the 5505, the VLAN interface names are monitored.  For example, VLAN 100 interface named Inside is assigned to ethernet0/1, switchport mode access.  When issuing a show failover command the output will show the monitor status of interface Inside.. Does failover monitor the VLAN virtual interface only?  Does failover also monitor the link status of the ethernet0/1 switchport? What happens if the link status of ethernet0/1 fails, or the physical switchport ethernet0/1 faults?  Does failover trigger a switch from primary active to standby active? Thank you. ... View more

Hello, I am using an ASA5510 configured with redundant interface pairs and multiple VLAN sub-interfaces, having different security levels.  The VLANs and sub-interfaces will need to pass traffic between subnets.  I have added the same-security-traffic permit intra-interface command as well as necessary static NATs / ACLs From the ASA I will connect to core switches configured as trunk ports.  The primary ASA redundant interface will connect to Switch A and the secondary will connect to Switch B. Below is a brief outline of some of the subnets configured and interfaces. ASA interface GigabitEthernet0/2 speed 1000 duplex full no nameif no security-level no ip address ! interface GigabitEthernet0/3 speed 1000 duplex full no nameif no security-level no ip address interface Redundant1 description redundant interface group 1 members member-interface GigabitEthernet0/2 member-interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface Redundant1.5 vlan 5 nameif inside security-level 100 ip address 192.168.10.1 255.255.255.0 standby 192.168.10.2 !             interface Redundant1.10 vlan 10 nameif lan1 security-level 99 ip address 192.168.11.1 255.255.255.0 standby 192.168.11.2 ! interface Redundant1.15 vlan 15 nameif lan2 security-level 50 ip address 192.168.12.1 255.255.255.0 standby 192.168.12.2 My question involves properly configuring the vlans on the switch trunk ports for tagged traffic. For example, on Switch A gig0/5 will connect to gig0/2 on the ASA.  Switch A will need to accept and pass traffic from and bound for vlans 5, 10, 15. An inside client on the network behind the core switch with an IP of 192.168.10.50 will need to pass traffic to a LAN2 client with an IP of 192.168.12.50 Would the gig0/5 port on the Switch A simply need to be configured as a trunk port allowing vlan 5, 10, 15? Switchport mode trunk switchport trunk encapsulation dot1q switchport trunk allowed vlan 5, 10, 15  Are there any additional native vlan, trunking, tagging requirements on either the ASA or Switch? Thank you. ... View more

Hello, I have a L2L VPN issue with one of my third party clients. We are setting up a VPN tunnel from our PIX to their VPN gateway device. We have a single host on our Inside network that will need to access a single host on the remote network.  The problem is that by coincidence the IP address on the remote network is in the same subnet range as our existing DMZ.  So our DMZ is on 192.168.60.0 /24 and the host on the remote network we need to access has an IP of 192.168.60.25 Our Inside host IP – 192.168.100.50 Remote host IP – 192.168.60.25 I thought this would cause a conflict, so my workaround was to create a static NAT that will translate remote IP 192.168.60.25 to another private subnet IP on our network.  Then create the appropriate NAT and ACLs.  Something like: static (inside,outside) 192.168.60.25 192.168.70.25 netmask 255.255.255.255 access-list xnat extended permit ip host 192.168.100.50 host 192.168.70.25 access-list vpn1 extended permit ip host 192.168.100.50 host 192.168.70.25 crypto map vpnmap 10 match address vpn1 crypto map vpnmap 10 set peer x.x.x.x crypto map vpnmap 10 set transform-set 3des crypto map vpnmap 10 set security-association lifetime seconds 28800 crypto map vpnmap 10 set security-association lifetime kilobytes 4608000 Can I use static nat in this manner on vpn traffic to resolve this issue? Any assistance would be most helpful ... View more

Hello, I have been tasked with deploying 2 routers with HSRP and 2 ASAs in Active/Standby failover.   Please see attached layout document. The routers will each have a 4 port HWIC switch. The ASAs will have an Outside interface that connects to one of the FE switchports on the routers.   The routers with have a VLAN on the same network subnet as the outside interface of the ASA. The routers will connect to each other on 2 FE trunk ports.  R1 FE1 to R2 FE1 and R1 FE2 to R2 FE2.  The purpose of these two connections is for VLAN cross connect and HSRP hello packet exchange. The routers will have HSRP standby IPs configured on the WAN G0 interface and on the VLAN6 LAN interface. My question concerns traffic flow in the event the primary G0 port/link on the Active R1 were to fail G0 R1 Failure – HSRP on the WAN interface will make R2 G0 active. Object tracking on the R1 VLAN interface will force the VLAN interface active on R2.  R2 is now the Active router. However, ASA1 is still the Active ASA. Will traffic route properly from R2 to R1 through the HWIC switch? R2 G0 to VLAN R2 FE2 to VLAN R1 FE2 to R1 FE3 to ASA1 G0 Or, must ASA2 be the Active ASA? In addition, both routers are directly connected with 2 trunk links.  The purpose of these connections was to ensure HSRP hello packet exchange in the event one link were to fail.  Is this a feasible approach to ensuring HSRP exchange? Thank you for any valuable assistance. ... View more