We have a site (site A) which has a /26 public IP range and another site (site B) which has a different /27 public IP range. The internet links are provided by the same ISP and both sites exist in the same AS. We have asked our ISP to provide a facility whereby if Site A loses its internet connections, any traffic desitned for its /27 ip range is redirected to SIte B i.e. so that SIte B would then 'own' the /27 ip range and be able to responde to requests. We do have a layer 2 LAN extension between site A and site B but have specifically requested that this is not used as part of the failover mechanism. Also, for complete disclosure, there are 2 internet links at each site already configured for local failover so this cross-site failover scenario would only come into effect if both routers/internet links at a single site went down. The ISP has stated that this redirection of Site A's public address space to Site B is only possible by running HSRP between their router at Site A and their router at Site B across our layer 2 links. Is this correct? My experitse is mainly in Enterprise LAN switching but am surprised our ISP is saying this can not be acheived. Any opinions would be greatly appreciated. ... View more

We have a strange issue whereby some users have suddenly failed to correctly authenticate against ACS 5.1 - we cant work out why, as nothing has changed and would greatly appreciate your help. We have dot1x configured on our network with MAB fallback. We havent yet rolled out dot1x to the clients even though the network is set up for this. In the meantime, we are using Mac Authentication Bypass. We do use 802.1x for wireless though. I have set up the folowing Identity Sequence: AD1 (this is set up as our AD servers for 802.1X user and machine auth) SecurID Server (we dont use this yet either) Internal Users (this is just used to authenticate ciscoworks) Internal Hosts (this contains the list of allowed MAC addresses) Typically what we have seen today is a user initially authenticates successfully by matching the Internal Hosts identity store, but then an hour later, re-authentication fails as the MAC address matches the AD1 id store and subsequently fails due to the MAC address not being present within AD. Here is the successful connection entry (all MAC addresses substituted form the originals)... Steps 11001  Received RADIUS Access-Request 11017  RADIUS created a new session 11027  Detected Host Lookup UseCase (Service-Type = Call Check (10)) Evaluating Service Selection Policy 15004  Matched rule 15012  Selected Access Service - Network Access Evaluating Identity Policy 15006  Matched Default Rule 15013  Selected Identity Store - Internal Hosts 24432  Looking up user in Active Directory - 00-1B-78-00-33-00 24412  User not found in Active Directory 24559  Searching for user in the RSA identity store. 24556  User record was not found in the cache. 24210  Looking up User in Internal Users IDStore - 00-1B-78-00-33-00 24216  The user is not found in the internal users identity store. 24209  Looking up Host in Internal Hosts IDStore - 00-1B-78-00-33-00 24211  Found Host in Internal Hosts IDStore 22037  Authentication Passed 22023  Proceed to attribute retrieval 24432  Looking up user in Active Directory - 00-1B-78-00-33-00 24412  User not found in Active Directory 22016  Identity sequence completed iterating the IDStores Evaluating Group Mapping Policy 24423  ACS has not been able to confirm previous successful machine authentication for user in Active Directory Evaluating Exception Authorization Policy 15042  No rule was matched Evaluating Authorization Policy 15004  Matched rule 15016  Selected Authorization Profile - MAB-PC 11022  Added the dACL specified in the Authorization Profile 11002  Returned RADIUS Access-Accept Here is the failed connection entry.... Steps 11001  Received RADIUS Access-Request 11017  RADIUS created a new session 11027  Detected Host Lookup UseCase (Service-Type = Call Check (10)) Evaluating Service Selection Policy 15004  Matched rule 15012  Selected Access Service - Network Access Evaluating Identity Policy 15006  Matched Default Rule 15013  Selected Identity Store - AD1 24432  Looking up user in Active Directory - 00-1B-78-00-33-00 24416  User's Groups retrieval from Active Directory succeeded 22037  Authentication Passed 22023  Proceed to attribute retrieval 22038  Skipping the next IDStore for attribute retrieval because it is the one we authenticated against 22016  Identity sequence completed iterating the IDStores Evaluating Group Mapping Policy 24423  ACS has not been able to confirm previous successful machine authentication for user in Active Directory Evaluating Exception Authorization Policy 15042  No rule was matched Evaluating Authorization Policy 15006  Matched Default Rule 15016  Selected Authorization Profile - DenyAccess 15039  Selected Authorization Profile is DenyAccess 11003  Returned RADIUS Access-Reject Any help greatly appreciated! ... View more

I am looking at introducing a chargeback model in our business for network infrastructure. I would be interested to know if there are any resources that can assist with this or if anyone has any helpful advice?  To begin with, we will just be doing this in the form of a reportback or shown i.e. like chargeback but without the charging!. At this time, our requirements are quite basic: we just want to be able to calculate the cost per port of our data centre switching environment (predominantly Cisco 6509-E's). Its very simple to calculate the cost per port for a single chassis but I'd like to know if there are any models that take into account that each chassis may be configured differently (VSS or non-VSS, different number of supervisors, or line card types etc). Also, I presume it would need to account for upstream costs too (i.e. core switches that provide the backbone to the server switches but dont have servers directly attached etc). Any helo greatly appreciated. ... View more

We had a new network installed by a third party which, due to the wonder of VSS, is resilient but does not contain any loops. Unfortunately they did not fix the root bridges to the core switch (VSS pair). As we now have spanning tree root bridges spread all across our network (including some in some very undesirable locations), I would like to manually configure the core switch as our root bridge for all VLANs. We have tested this with some user vlans and some vlans in the data centre whilst maintaining SSH sessions and pings etc and did not notice any impact. I now need to do this for the remaining VLANs including the data centre farm VLANs and a legacy VLAN 1 whose root bridge currently lies in a different data centre across a high speed LAN extension. Based on the Root Bridges we have moved so far, I am not anticipating any impacts. However, I would like to tap the greater minds out there to see if anyone knows of any theoretical or real-world reasons why there may be some impact. This chage will be done via change control in a maintenance window but I would like to assure the 'pwers that be' that there will be no impact to live services. Thanks in advance. ... View more

I am trying to understand how the load balancing threshold is calculated but I am finding conflicting information, even withing Cisco's own documentation. I would be grateful if anyone could help. Cisco's latest Wireless LAN Controller Configuration Guide for software release 7.0.116.0 (April 2011) contains the following information for configuring Wireless > Advanced > Load Balancing Page (emphasis mine): In the Client Window Size text box, enter a value between 1 and 20. The window size becomes part of the algorithm that determines whether an access point is too heavily loaded to accept more client associations: load-balancing window + client associations on AP with highest load = load-balancing threshold In the group of access points accessible to a client device, each access point has a different number of client associations. The access point with the lowest number of clients has the lightest load. The client window size plus the number of clients on the access point with the lightest load forms the threshold. Access points with more client associations than this threshold is considered busy, and clients can associate only to access points with client counts lower than the threshold. Option 1 The formula shown is correct (load-balancing window + client associations on AP with highest load = load-balancing threshold). If so, this would mean that if you had a window size of 5 and the AP with the highest load at the time of calculation was 15, the threshold would be 18. However, as no APs have 18 associations then this threshold would never be reached. Even if an AP reach 18 associations, the next client trying to associate would trigger another calculation for the threshold which would be 21 (3 + 18) and so still, this threshold would never be hit. Option 2 The description in the paragraph below is correct (The access point with the lowest number of clients has the lightest load. The client window size plus the number of clients on the access point with the lightest load forms the threshold). This sounds much more sensible to me. In this case, the window size was 3 and the AP with the lowest number of associations already had 7 clients associated, the load balancing threshold would be 10 i.e. no load balancing would occur until a client tried to associate with an AP which already had at least 10 clients associated. Option 3 I have seen many descriptions on forums etc of the load balancing threshold being essentially the Client window size, i.e. if the client window size is 3 then load balancing will kick in when a client tries to associate to an AP with at least 3 clients already associated. This doesnt match the above documentation unless the AP with the least number of clients associated doesnt have any associated clients i.e. 0 clients. Questions I think Option 2 is the correct description of load balancing and the formula given stating use of the AP with the highest load is a typo (albeit still not corrected in the latest documentation). Am I correct? The problem with using the option 2 method of calculating the load threshold is that you will be unnecessarily performing load balancing in an environment where some of your APs do actually have zero clients associated, unless you set the window size to somehing close to 10. I read here http://www.perihel.at/wlan/wlan-wlc.html#aggressive-load-balancing that when calculating the load threshold, it only accounts for the 8 'best' APs for a given client. In other words, if you have 60 APs on your campus but only 20 are visible to the client, the controller will only perform its load threshold calculations bases on the 8 APs which have the best signal to the client. This would ,ake sense as there is no point setting a load threshold based on the lightest loaded AP which is not even within 'reach' of the client. Is this correct as I can not find any other documentation which supports this? Thanks in advance for your help with this. ... View more