Hi I have a simple setup for testing purposes. PC > Switch > Router   VLAN 1 network is 192.168.1.0/24   So by default VLAN 1 is the native VLAN. The PC is configured statically with 192.168.1.50/24 with a gateway of 192.168.1.1 The switchport for the PC is configured as an access port in VLAN 1 The uplink to the router is configured as a trunk port allowing all VLANs The switch itself is configured with a mgmt SVI in VLAN 1 of 192.168.1.10/24 The router interface is configured as a trunk allowing all VLANS with a VLAN 1 SVI (192.168.1.1/24) The router is the root bridge and all ports on the switch are in spanning tree forwarding.   So why can the PC ping the switch, but not the router? The switch can ping both the PC and the router.   The router is managed by the ISP but I have the configs and its just a trunk port with the SVI, however HSRP is configured, probably as their template config as there is not a secondary router. So it gateway IP is virtual, but I cannot ping the physical IP either.   My feeling is this is something to do with the native VLAN 1, as I also alongside this setup configured the same using VLAN 10, as the ISP router already has a VLAN 10 SVI and that works fine. It just does not work on VLAN 1.   I have done the basics, ie sh int status and all ok, sh ip int br, all are up up, spanning tree is forwarding for all interfaces and vlans and no blocked ports, sh int gig xxx, sh int gig xxx switchport etc    I can get the ISP to change the VLAN but just curious why it does not work on VLAN 1.   TIA     ... View more

Hi I have switchport security on all our switches in the DC as requested by our auditors. The issue we however have is the VM Hosts are connected to multiple switchports and so a mac addresses of a vm can move between ports.   This causes mac violations when a mac address moves and the vm does not have connectivity for 5 mins until the mac ages out on the previous port, the aging timer is set to 5 mins for inactivity   I can decrease the timer to 1 min but does port security have any command to allow mac moves like dot1x does?   Im guessing there is no such solution for port security as it may defeat its whole purpose but just trying to get some confirmation if this is the case ... View more

Hi I am using 2 routers in the DC as NTP servers which will be getting their time from the domain controllers. Then all our network devices will be using the 2 routers as a primary and secondary NTP server. I am also looking to configure NTP authentication.   I have the following configuration, is there anything I could add or remove?   NTP SERVERS ntp server x.x.x.x (Internal DC - No Authentication) ntp authentication-key 1 md5 xxx ntp max-associations 100 ntp trusted-key 1 ntp trusted-key 2 ntp peer y.y.y.y   ntp server y.y.y.y (Internal DC - No Authentication) ntp authentication-key 2 md5 xxx ntp max-associations 100 ntp trusted-key 1 ntp trusted-key 2 ntp peer x.x.x.x   CLIENT ntp authentication-key 1 md5 xxx ntp authentication-key 2 md5 xxx ntp authenticate ntp server x.x.x.x key 1 prefer ntp server y.y.y.y key 2 ntp trusted-key 1 ntp trusted-key 2 ... View more

Hi I just want to confirm my NTP configuration. I have 2 routers acting as the NTP servers. They are receiving their time from the domain controllers ( ntp server x.x.x.x) . Then all the network devices (Clients) in the business will be configured to use the 2 routers as NTP servers as primary and secondary.   Does the following configuration look correct. Is there anything I can add or remove for best practice?   SERVERS ntp server x.x.x.x ntp authentication-key 1 md5 xxx ntp max-associations 100 ntp trusted-key 1 ntp trusted-key 2   ntp server y.y.y.y ntp authentication-key 2 md5 xxx ntp max-associations 100 ntp trusted-key 1 ntp trusted-key 2   CLIENT ntp authentication-key 1 md5 xxx ntp authentication-key 2 md5 xxx ntp authenticate ntp server x.x.x.x key 1 prefer ntp server y.y.y.y key 2 ntp trusted-key 1 ntp trusted-key 2 ... View more

Hi I am planning to setup NTP with Authentication. A router R1 in the DC will get its time from the ISP, then all devices within the DC will get their time from this router. So can R1 be configured with the server command and get its time from an ISP router, but also act as a NTP server for other clients. This is with configuring authentication so R1 will need to authenticate with the ISP router but clients will authenticate with R1 to get their time?   ... View more

Hi Does anyone know how to enforce a minimum password length on a Cisco 2960x (15.2.6(E1)) current latest IOS I have tried the below but it comes as unrecognised Switch(Config)password-policy ? Switch(Config)security password ?   Currently the switches are configured with a local account and with AAA to a TACACS server and I am aware a policy can be enforced on the tacacs server but I also want it enforced locally for the local accounts for security auditing purposes   Also when enforcing locally, will it lock out any TACACS account that is already configured but does not meet the minimum length requirement?   Thanks   ... View more