Dear Experts, I have a requirement to upgrade the WAN link to 170Mbps on below routers. I require HSEC license which will remove US export limitation for encryption and will allow me below maximum throughput for a single tunnel. Router Model Maximum throughput capability with IPSEC (HSEC) Required license CISCO3925 212 Mbps with single tunnel L-FL-39-HSEC-K9 CISCO2921/K9 82 Mbps with single tunnel L-FL-29-HSEC-K9 CISCO2951/K9 150 Mbps with single tunnel L-FL-29-HSEC-K9   I still require below clarifications. 1: I have 4 tunnels (site to site vpns) on each routers. What throughput, I will be getting. Will it be 212, 82 and 150Mbps for 3925, 2921 and 2951 for each tunnel (means 4tunnels*212 for 3925?)?   2: What if I terminate the links directly on Cisco Firewalls Or Cisco Switches (4500) and create site to site vpn. Will I get rid of encrypted bandwidth limitations.   3: What other solutions are available for connecting 3 sites with 170Mbps WAN links using 4 vpns tunnels? ... View more

I am working on wireless network design for guest (Aruba) and staff(Cisco) network with below details.   Introduction to wireless setup: The wireless network comprise of Staff network (Cisco Aps) and Guest network (Aruba Aps). Around 7 Aps per floor for guest and staff network Guest network Site survey/AP location: similar like Staff network Guest and Staff network APs are around 2 to 3 meters away from each other Risks We are concerned about the noise and channel interface Due to building regulation, it is not easy to relocate the Access Points unfortunately the equipment is already procured, cabling and AP mounting is already done and Guest/Staff APs are around 2 to 3 meter away from each other   Solution We need to find solution from configuration point of view. Please check which solution is valid and recommend another solution if needed. Solution option1 (Automatic Dynamic Channel Assignment) I assume that controllers are intelligent devices and both Aruba and Cisco controller will manage the channel interference. Controllers will change the channels if there is any interference.   Solution option2 (Distribute channels between Aruba and Cisco network): Cisco/Staff will use 3 channels 1, 6 and 11 in 2.4 GH band for wireless AP transmission. Aruba/Guest will be using other overlapping channels (from 1 to 14. except 1, 6 and 11)  Cisco/Staff will use channels in UNII1(36, 40, 44 and 48) and UNII-3(149, 153, 157 and 161) 5 GH band for wireless AP transmission. Aruba/Guest will be using UNII2 channels in 5 GH. @experts; please confirm if this is valid approach and has no drawbacks or limitations   Solution option3 (propose any other best practice solution): Please also provide other best practices that should be considered in the design.     ... View more

User Site: User’s desks are not fixed. They can move across different floors Few users are using VDI thin clients where the XenApp servers are in the DCs There are multiple floors Cisco Stack access switches VSS on Cisco Core switches Mesh connectivity wherever supported Cisco ISE with TrustSec license Contain cisco devices Access services in different datacenters across WAN links Users are accessing large numbers of destination IPs Firewall on Stick (firewall is gateway for all vlans/zones) IPs are assigned via DHCP using MAC address bindings   Data Center: Different layers of non cisco Firewalls Alot of zones, IP subnets   Diagram: A rough diagram is attached to provide you an idea about the network   Queries and Recommendations: What are the best practices of IP Schema, IP addresses and vlans assignment design for a site/Campus that contains movable/portable users? What are the possible options of handling Firewall permissions for movable users where the IP for users might be different on different floor (depends on Question#1). What are the best practices for firewall permission to be build based on users, security tags(trustSec) or IPs. The user site is proposed to be based on TrustSec technology while it may not be feasible if you don’t have end to end (from source=users site to destination=DC) Cisco Technologies. Please provide possible feasibility options considering that there are large numbers (2000 IPs) of destinations in the DC. Additionally how the firewall permissions will be handled in the Datacenter firewall incase TrustSec is used in user site. Solution Option1 : Use one large vlan/IP subnet for all floors. In such case, users will always get same IP regardless of the floor and Firewalls permissions can be granted based on IP Addresses for each users. Issue with Option1 : broadcast domain will become large and will result in slowness Solution Option2 : Use different vlan per each floor to avoid large broadcast domain and handle firewall permissions based on ISE TrustSec or usersnames. Issue with Option2 : Firewalls in the DC are not supporting firewall permissions based on Security Tags or permissions based on users ... View more

Dears, I am trying to find the part number for the Cisco SMARTnet Maintenance 8x5xNBD for the Cisco   ASA5510-SEC-BUN-K9. I browse cisco website, tried dynamic config tool, forums etc but no luck. 1: Please let me know the part number for it. 2: Which tool can be used to find smartnet or other Maintenance details/partnumbers 3: Is there any specific tool other then Dynamic Config to generate BOM BR, ABDUL MAJID KHAN ... View more

Dears, I am designing the Datacenter Network using below details; 1: Nexus 7K as Core 2: Nexus 5K, N2K for Data Center Servers 3: 6513 as Core for Users Layer 4: Multiple layers of Firewalls + IPS (Internet, WAN, Data Center) 5: Data Center Firewall is Firewall on stick act as gateway for more than 20 DC Servers vlans 6: Load Balancers, Routers, etc 7: All devices uplinks are 10G 8: Redundant network with Mesh uplinks 9: Separate VTP domain for every encircle/color layer 10: Traffic Flow is between Layers and towards Internet I have 2 design options (Diagram is attached) ; 1: Data Center Core as Layer 2 No SVI on N7K (core) Core is a an aggregation point for all layers Core is acting as hub connecting one layer to another For example: Users layer traffic flow to Internet Layer 6513 is gateway for all users vlans Create an SVI on 65K (10.1.1.254) Create an Interface on Internet Firewall (10.1.1.250) Create a vlan on N7K = vlan 2 Assign the connection interfaces of 6513 to N7K = vlan 2 Assign the connection interfaces of Internet Firewall to N7K = vlan 2 Add routes PROS: Extra SVI (L3 Hop) is avoided on Core (N7K) Your comments ?????????? CONS: Risk of Layer 2 issues Risk of Layer2 broad cost Unlike Traditional Design: I could not find any Design reference supporting such design from Cisco or other vendor Your comments?????????? 2: Data Center Core as Layer 3 Create SVI on Core (N7K) for each layers connectivity Core is a an aggregation point for all layers Core is acting as Layer 3 connecting one layer to another For example: Users layer traffic flow to Internet Layer 6513 is gateway for all users vlans Create an SVI on 65K (10.1.1.254) Create an SVI on N7K (10.1.1.250) Create an Interface on Internet Firewall (192.168.1.254) Create an SVI on N7K (192.168.1.250) Create a vlan on N7K = vlan 2 Create a vlan on N7K = vlan 3 Assign the connection interfaces of 6513 to N7K = vlan 2 Assign the connection interfaces of Internet Firewall to N7K = vlan 3 Add routes PROS: No risk of layer 2 issues Layer 3 boundaries on Core Traditional Design : supported with Cisco and other vendors reference documents Your comments ?????????? CONS: Extra/additional SVI(hop) is introduced in the Data Flow Your comments?????????? Please share your ideas to know which design is better with pros and cons of each. Also recommend if i need to create any VDC on N7K. BR, ABDUL MAJID KHAN ... View more