About pnicolette

pnicolette · ‎10-15-2015

...can PBR work around a WCCP limitation? We need to exclude sites by domain name from WCCP redirection to a Websense filter. WCCP on ASA doesn't do FQDN-based ACLs. So, does PBR do domain-based ACLs? If so, does the the order of operations let you use PBR to direct traffic away from being redirected by WCCP? Any help or hints will be most appreciated! Paul

pnicolette · ‎09-03-2010

We have two parallel metro Ethernet links into the same VLAN from a critical site, but our provider doesn't support link aggregation/Etherchannel (and they're different speeds anyway), so we only have manual failover so far. Cisco Performance Routing apparently can re-route if a link is degraded or down. Is there anything comparable (or can CPR be adapted) for our Layer 2 Metro-E world? Or is there a better way? (Note: each of our dozen sites has an L3 connection into the shared metro VLAN. We run RIPv2 on a mix of switches and routers.) We like the idea of failing over if the main link is degraded, since that's happened already due to provider hardware problems. Thanks for your thoughts! Paul

pnicolette · ‎09-02-2010

Fascinating...thank you, Peter. My context (not in the original question!) makes ARP-triggered route changes impractical. The scenario involves failover between alternate WAN paths which terminate in different organizations. After some digging, I'm wondering if a closer fit would be Cisco Performance Routing, an enhanced version of Optimized Edge Routing. A big advantage might be its capacity to reroute traffic based on link degradation as well as complete failure. Paul

pnicolette · ‎09-02-2010

Switches learn which ports connect to which MAC addresses, and direct traffic to them accordingly. Is there a routing protocol/config/algorithm which learns which interface connects to a specified subnet by seeing a source IP from that subnet? And if an IP from the subnet later appears on a different interface, it redirects traffic to that subnet? Thanks! Paul

pnicolette · ‎01-10-2010

In a hub-and-spoke IPSec environment, it's not hard to set up routing from spoke to hub. But on the hub end of a tunnel, where lives the gateway of last resort for traffic from the spoke, it seems almost counter-intuitive that the crypto ACL and peer statements don't implicitly create a route for traffic from the hub into the tunnel to the far end (spoke). It could always be overridden with a static if necessary. There's probably a good reason for this, but I can't think of it. Or am I the only person who thinks it odd...or perhaps a feature opportunity?

pnicolette · ‎01-10-2010

How do the Avaya phones at the remote locations connect to the 870?

pnicolette · ‎01-10-2010

One way is to create an interface for each vlan (they don't exist automatically), and give each interface an IP on the correct subnet. My example: VLAN 2 uses 10.1.2.0/24 VLAN 3 uses 10.1.3.0/24 ip routing interface vlan 2 no shutdown ip address 10.1.2.1 255.255.255.0 interface vlan 3 no shutdown ip address 10.1.3.1 255.255.255.0 Unless I've forgotten something, hosts can now be configured to use the 3560's IP on their subnet/vlan as the default gateway. They will then be able to reach devices on the other subnet/vlan. Paul P.S. Another way (with a more complex scenario) is described at http://www.cisco.com/en/US/tech/tk389/tk815/technologies_configuration_example09186a008015f17a.shtml

pnicolette · ‎01-05-2010

Thanks for the thought. If I use route maps to set next hop, my impression is that the packet would reach the router first and then have its Next Hop changed. Seems it would be more direct if the router tells the other routers (via RIP) where to send the packet, so it skips the (wrong) router completely. Routers A, B and C share one subnet. B tells A, "send packets for host X to me (B)." But can B also be saying, "send packets for host Y to C"?

pnicolette · ‎01-04-2010

Our 1721 redistributes into our 10.25.x.x WAN via RIP several static routes to hosts in an external 10.15.x.x network. However, there's another host in 10.15 that I need to access via a different gateway on another subnet that's directly connected to another router. I understand why routers should announce directly-attached routes that they can verify are available. But it would simplify my life if I could manage all the static routes to the 10.15 network from one router. Is there any way the 1721 can redistribute in RIPv2 a static route to a destination that's attached to another router? The current config uses no auto-summary and network 10.0.0.0 Thanks!

pnicolette · ‎10-14-2009

Agreed, per-vlan STP BPDUs determine forwarding/blocking. But if the switch doesn't have a vlan configured, it will block that vlan regardless of the BPDUs, right? If the switch is on the transit path, it must know about the Vlans between the 2 Edge switches - else the traffic for those Vlans will be dropped. So the vlan management protocol VTP can influence what vlans are passed between trunk ports, by letting the switch "know about the Vlans" or not. Reasonable?

pnicolette · ‎10-14-2009

BDPU will be the protocol to be used for Vlan forwarding. Spanning tree uses BPDUs to determine whether a particular interface goes into a forwarding state, but how do BPDUs determine whether a specific vlan will be forwarded from one trunk port to another? It seems to me that VTP has more impact on this because only vlans in the database get forwarded on trunks, and VTP can change the database. When enabling a switchport as trunk, all Vlans contained on the Database will automatically be in forwarding mode, not pruned. There isn't an implicit deny any like an ACL. Ahh - we use different standard configs. If, for security, stability and/or using vlans 1025-4096, your switches run "vtp mode transparent," the vlan database will be inactive. Then you must explicitly configure a vlan to have it trunked through, and pruning will be unnecessary. That's what I was trying to say :-).

pnicolette · ‎10-14-2009

As was mentioned, first check the 2960 port counters for errors, and make sure none are running half-duplex. (Our servers and switchports are set to auto speed & duplex.) If you still have problems, consider finding the busiest server(s) and patching them directly to your 3560G so you can benefit from their Gig NICs and lighten the load on the server spoke link. We keep our servers near the hub switch (and stack 3750 hub switches if necessary) to make this easier. Also, look for output drops (more than a few) on "Show interface" at both ends of the server spoke link to see if it's oversubscribed. If so, and you don't already run multiple gig links (Etherchannel) between server spoke switch and hub, consider it.

pnicolette · ‎10-14-2009

Hi Edison, Apparently a non-default VLAN must be created/configured or activated on a switch before the switch will forward it between trunk ports, even if there's no need to access that vlan from this switch. Not necessarily obvious to everyone...it wasn't to me. I may have mistakenly assumed that "vtp mode transparent" means that the switch will transparently forward any trunked vlans which originate outside it. Maybe it should??? I may also have misunderstood the original response advocating manual pruning. If specific action must be taken to permit a vlan to be forwarded on a trunk, why prune? There's an implicit "default deny"! Best regards, Paul

pnicolette · ‎10-14-2009

If you try this, please note: Will the trunk to the MetroE from the 2960 now carry all three VLANs: native, 99 and 1099? Yes. But only if VLAN 99 is made active on the 2960. In config mode: vlan 99 set active Paul

pnicolette · ‎10-09-2009

Also, before using small-biz-class switches from ANY vendor, I'd dig into customer feedback on the specific model from places like newegg and amazon. There are excellent products in that space, but how well they work as promised, interoperate and run reliably seems to vary enormously among brands, models, versions and firmware releases. Especially on higher-end features like RSTP. Caveat emptor!

Date Registered	‎11-05-2001 05:04 PM
Date Last Visited	‎08-18-2017 03:55 AM
Total Messages Posted	104
Total Helpful Votes Received	14

Now that ASA can do Policy Based Routin...

Anything like performance routing avail...

Re: Routing somewhat like switching?

Routing somewhat like switching?

Why no implicit route for L2L IPSec tun...

Re: 870 Router with multiple VPN connec...

Re: 3560 Inter vlan

Re: Can RIP v2 announce a "foreign" hos...

Can RIP v2 announce a "foreign" host-ba...

Re: Add VLAN to MetroE passthru trunk o...

Re: Add VLAN to MetroE passthru trunk o...

Re: Throughput of 2960-48TT.

Re: Add VLAN to MetroE passthru trunk o...

Re: Add VLAN to MetroE passthru trunk o...

Re: Switch advice