Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About miked
Stats
Member since
07-11-2002
59
Posts
0
Helpful
0
Solutions
07-12-2017
05:58 AM
Thanks for the replies Jon. It's not really two private LANs it would be the same LAN using the public switch for more switch ports.
And yes, the LAN in question would go through the FW for any public access/NAT.
I would do everything to keep the switch from being compromised of course since it's directly on the Internet. But in the event it was ever compromised each public Vlan could lose connectivity or some other malicious situation, but every single one of those private LANs data would be protected by their own firewalls and this one Vlan would be passing unprotected and unencrypted data across the compromised switch.
To me that seems like enough of a risk that an engineer would not design this in a customer's network. It also seems that no customer would want their unencrypted private data flowing across a public switch connected directly to the Internet.
I always ask myself if I would do that to my own network/data. In this case I would not. Would you?
... View more
07-11-2017
01:24 PM
All those VLANs are public Internet connections to tenants with their own public /30. That connects to their FW and they manage their own LAN behind it. The one tenant/Vlan in question is, VlanC and it's private side circled in red.
VlanC is the tenant public/Internet connection to their FW, then the inside LAN is behind the FW to a LAN switch, that LAN switch is connected back to the public switch, with a separate Vlan that also has another connection connecting another private LAN switch (on the same subnet/network), then on to private servers.
The whole red circled path is using the FW for any NATs.
So, that private LAN traffic transverses the WAN switch, where Publilc traffic is.
That is a crude drawing and shows none of the redundancy.
... View more
07-11-2017
11:02 AM
I have Internet connections coming into a public network switch, with NOTHING but public IPs vlan'ed out to different tenants. Essentially this install is providing Internet access to different firewalled LANs, or tenants.
I'm in a situation were I'm being directed to take one of the of those firewalled/private LAN and connected it back into my public switch via layer 2 trucking and ACLs managing traffic on those ports tying the private LAN connections together. So, a connection behind a firewall, protected by a firewall, is connected back into the public Internet switch, then trunked down to a private switch with servers.
Can it be done, obviously, and do I know how to do it, and do I understand hardening at each point, yes I do. I'm not looking for a how-to but more what other engineers thoughts are on this risk, and (I guess) my name being associated with the configuration.
Thoughts?
... View more
Labels:
06-10-2015
05:53 AM
This started years and years ago when I had to optimize for TCAM issues (I'd have to revisit my notes from back then regarding the details and commands used). Once I did that I lost the ability to add inbound limiting using the "service-policy output" command. I've tried it across FE, GE, and vlan interfaces with no luck. I don't believe it's card specific since when it started I had different SUP cards, have replaced a couple line cards, etc... Plus it seems to be a common thing from what I've found. I'm just curious if anyone has gotten around it because there aren't any clear cut answers that I've. Regardless, this is the output for this particular switch: Mod Ports Card Type Model --- ----- -------------------------------------- ------------------ 1 2 Catalyst 6000 supervisor 2 (Active) WS-X6K-S2U-MSFC2 2 2 Catalyst 6000 supervisor 2 (Warm) WS-X6K-S2U-MSFC2 3 8 8 port 1000mb ethernet WS-X6408-GBIC 4 48 48 port 10/100 mb RJ-45 ethernet WS-X6248-RJ-45 5 48 48 port 10/100 mb RJ-45 ethernet WS-X6248-RJ-45 6 48 48 port 10/100 mb RJ-45 ethernet WS-X6248-RJ-45 7 48 48 port 10/100/1000mb EtherModule WS-X6148-GE-TX 9 8 8 port 1000mb ethernet WS-X6408-GBIC Thanks for the help!
... View more
06-09-2015
11:22 AM
I can apply inbound policy-maps/service-maps to the 6509's interfaces to manage the traffic but not outbound. Every time I try I get this error: (config-if)#service-policy output serv50.0M-out MQC features are not supported in output direction for this interface The other options I found online are the common approach of creating a two-way access-list of specific IP's and "any", then pointing to it with a rate-limit statement under the interface. This is fine but for the amount of ports I want to limit (in my experience) it would eat the switch alive where TCAM's are concerned. Any thoughts on a method/way of working around that error message? This is an idea of the configuration I want in place: policy-map serv50.0M-out class ipclass3 shape average 50000000 200000 200000 random-detect ! policy-map serv50.0M-in class ipclass3 police cir 50000000 bc 1562500 be 1562500 conform-action transmit exceed-action drop violate-action drop ! interface FastEthernet6/35 service-policy input serv50.0M-in service-policy output serv50.0M-out
... View more
Labels:
06-03-2015
06:07 AM
It did act as a router and not a firewall. I guess you get what you pay for. Topology: Internet | | Router/FW | | LAN | | LAN P2P Router | (P2P T1) | Remote LAN P2P Router | | Remote LAN
... View more
06-01-2015
08:36 AM
I have a point to point connection to install in a customers LAN with a private router at each location of the circuit. This customer has an IOS firewall/gateway as opposed to an ASA or the like. Whenever I've done a configuration like this with an ASA I point the LANs default gateway to the private router and that router decides whether to find the remote LAN across the circuit or send all other traffic up to the ASA to be routed out to the internet. As well, the ASA has a route to the remote LAN pointing to the private router for inbound connections. The thing I'm not sure of is, will the router/IOS firewall act as a router or a firewall? In other words, will it function as a router where I can I still use the IOS firewall router as the default gateway with a static route back to the private P2P router and call it good? Or will it act as a true firewall where it won't route back out the interface it came in on? Which means I can't use it as my default gateway. Thanks in advance.
... View more
Labels:
09-29-2014
06:12 AM
Thank you for the reply Joseph. I swear I've ran SLA on 6500's before. This box is running IOS 12.2 so maybe that's the culprit. I found a simple way to configure both devices redundantly using administrative distanced routes pointing through a specified interface. On the 6509, the routes point to a loopback address on the 5400, on the 5400 it's configured as default routes. Like this document explains: http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/27082-ip-static-routes.html Seems to work like a champ.
... View more
09-25-2014
01:17 PM
So the 6509 supports rtr and track but the "ip route" statement doesn't support the "track" attribute??? Man, I just can't catch break!!!
... View more
09-25-2014
12:16 PM
Anyone? Does anyone know a good alternative to "ip sla" on a 6509? I can't believe the 6509 doesn't support "ip sla".
... View more
09-22-2014
01:43 PM
I have a single 5400 with two gige ports and a single 6509 with dual gige line cards. What would be the best method for running them with dual connections in case an interface or line card goes bad? Thanks in advance.
... View more
Labels:
07-12-2017
Thanks for the replies Jon. It's not really two private LANs it would be
the same LAN using the publ...
07-11-2017
All those VLANs are public Internet connections to tenants with their
own public /30. That connects ...
07-11-2017
I have Internet connections coming into a public network switch, with
NOTHING but public IPs vlan'ed...
06-10-2015
This started years and years ago when I had to optimize for TCAM issues
(I'd have to revisit my note...
06-09-2015
I can apply inbound policy-maps/service-maps to the 6509's interfaces to
manage the traffic but not ...
06-03-2015
It did act as a router and not a firewall. I guess you get what you pay
for. Topology: Internet||Rou...
06-01-2015
I have a point to point connection to install in a customers LAN with a
private router at each locat...
09-29-2014
Thank you for the reply Joseph. I swear I've ran SLA on 6500's before.
This box is running IOS 12.2 ...
09-25-2014
So the 6509 supports rtr and track but the "ip route" statement doesn't
support the "track" attribut...
09-25-2014
Anyone?Does anyone know a good alternative to "ip sla" on a 6509? I
can't believe the 6509 doesn't s...
Public Statistics
| Date Registered | 07-11-2002 07:29 AM |
| Date Last Visited | 08-18-2017 04:01 AM |
| Total Messages Posted | 59 |
