Hi All, I have been debating on selling my Cisco Lab in favour of running everything in GNS3.   Until now I have retained it purly for the switching hardware and voice cards.  I have built it up over the years and it has got me through several certifications but I don't really have room for it any more, and it seems the more newer converged network technologies are not going to be compatible with some of my hardware and I will have to purchase more hardware to supplement my further learning (CCDP, CCNP Voice, CCNP Security and eventually CCIE R&S). My lab consists of the following: 1 x 8 Port 2940 switch 1 x 2509 Access Server (with Octal) 2 x 24 Port 2950 switch 3 x 3550 48 Port EMI Switches 1 x 3550 24 Port EMI PoE Switch 3 x 2811 Routers 2 x 2621 XM Routers 1 x 3640 Router 1 x c871w Integrated Services router 2 x PIX 501 Firewalls 1 x 5505 ASA Firewall 1 x c7940 IP Phone 1 x c7960 IP Phone 8 x WIC 1T 2 x VWIC2-2MFT T1/E1 + various other cisco interface cards and cables........+ 2 non cisco switches   I reckon I can get a good price for it given the spec and the condition of the kit but I don't want to find myself having to rebuy everything again down the line for future study! Any guidance would be greately apprreciated   Thanks in advance Mitchell   ... View more

Good afternoon all,   I have labbed a L2TPv3 Ethernet Pseudowire topology to try and learn more about the differences between L2TPv3 vs L2 VPN o/MPLS etc and now that I have it labbed and working I can see how it would scale from a SP point of view i.e. adding additional customers would be easy enough, but what If an existing customer using the pseudowire wanted to add another site to the mix off the same PE router? Or in the example I have used, what if there were another PE router elsewhere for the new customer which will facilitate the xconnect peering but you would have to change the IP addressing between the existing PE and CEs to make the OSPF customer network an OSPF Broadcast network.  L2TPv3 Pseudowire doesn't seem scalable at all compared to L2 VPN over MPLS using vrfs? Any clear explanaitions welcome I have attached my topology for your conveniece   Thanks in advance Mitchell ... View more

Hi all,   I have been creating a GNS3 lab for MPLS VPN and I have the whole thing working end-to-end except that I can't get the PE to redistribute OSPF into BGP As far as I can see I am doing this correctly but the only network that is redistributing across the WAN is the directly connected network between the CE and PE!   Same for both sides so if we can get PE1 side working I can just mirror the cfg for PE2 I have attached the GNS topology drawing and configs   Please let me know if you need anything more   Thanks in advance   Mitchell ... View more

Hi all,   I have been creating a GNS3 lab for MPLS VPN and I have the whole thing working end-to-end except that I can't get the PE to redistribute OSPF into BGP As far as I can see I am doing this correctly but the only network that is redistributing across the WAN is the directly connected network between the CE and PE!   Same for both sides so if we can get PE1 side working I can just mirror the cfg for PE2 I have attached the GNS topology drawing and configs   Please let me know if you need anything more   Thanks in advance   Mitchell ... View more

Hi all, Can't believe I am having to ask this but I can't seen to get my head around why this simple task is not working, please help! I have a simple physical home lab topology R1_SITEA <> ISP <> ISP <> R2_SITE_B I am trying to NAT all internal subnets from R1 to Web Hosts on the Internet via the ISP.  This works fine, however I also want to exclude the same subnets from being NAT translated when originating from the internal subnets behind R1 to the internal subnets behind R2 at the far end SITE_B.  Sounds simple enough right! Except when I source from internat subnet 192.168.1.0 /24 to remote internal subnet 192.168.2.0 /24 instead of being denied NAT and then routing down the VPN via the crypto map matched ACL the traffic is missing the deny in the NAT ACL and matching the permit statement after this and hence not hoing on to reach the crypto map but being natted and then dropped by the ISP as you would expect! I just can't see how this is possible, but the hardware labs never lie...... R1_SITE_A#show access-list Extended IP access list 101     10 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255     20 permit ip 192.168.1.0 0.0.0.255 any (4 matches) Extended IP access list VPN_ACL     10 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255     20 deny ip any any log R1_SITE_A#ping 192.168.2.1 source fa0/0 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds: Packet sent with a source address of 192.168.1.1 ..... Success rate is 0 percent (0/5) R1_SITE_A#show access-list Extended IP access list 101     10 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255     20 permit ip 192.168.1.0 0.0.0.255 any (5 matches) Extended IP access list VPN_ACL     10 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255     20 deny ip any any log R1_SITE_A# As you can see from the before and after above, I am sourcing from 192.168.1.1 /24 and going to 192.168.2.0 /24 but this is not being matched by the NAT ACL 101 Seq 10 and is instead matching Seq 20 and being NAT translated! Please note, that the Crypto Map is correct and if I remove the ip nat outside statement from the WAN Ser0/0/0 interface I can route 192.168.1.0 /24 through to 192.168.2.0 /24 via the VPN. Any help gretely appreciated on this as it's bugging the hell out of me Thanks in advance David PS. R1 Running config attached ... View more

Good afternoon all, I have a stand-alone LAN (no internet connection) and I need to create the same LAN at a new Office on a smaller scale and connect the two together securely. I can’t determine the amount of traffic that would need to traverse the WAN link between the two sites based on the current network design, as there is no such capture point available and no network monitoring or traffic analysis software to capture the traffic if there was! The only suggestion I have would be to design the network at the new office from scratch in such a way to minimize traffic traversing the WAN (which is best practice any way) and then guestimate using industry averages how much traffic will need to traverse the WAN link between the two sites using the applications/protocols identified multiplied by the number of users using those applications and then perhaps adding a percentage on top to account for peak usage. From this I should end up with the amount of BW required between the two sites which will allow me to choose my SP carrier method and determine bandwidth costs???? Any advice would be greately appreciated Many thanks, DM ... View more

Hi All, We have a L3 switch with a routed port (Fa1/0/1) configured as a default gateway using ip address x.x.200.129 /28 We have a single laptop connected to Fa1/0/1 with IP address of x.x.200.130 We have removed the laptop leaving nothing connected but now the Gateway Fa1/0/1 is flapping up and down (Line Protocol) every few minutes! The routed port is on a switch module running inside a 2811 router I am used to working with VLAN SVIs whereby the gateway (SVI) will go down when there are no active hosts within the VLAN, is this the same for a routed port i.e. once there are no hosts in the subnet would the routed port go down until a host reconnected? I am trying to estanblish what is normal behaviour I have tried mocking this up in GNS3 as I have no hardware available to me (that is not production) but when I disconnect the Host the Routed port (Gateway) remains up up which is definatley not correct so I can't trust it as a valid test! Any advice greatly appreciated as always Cheers, David ... View more