the wheelhouse for CSPC is inventory tracking, not real time monitoring. As long as you run periodic collections/uploads, you will know just by going to the SNTC portal what the status of your contracts is, the status of your hardware, software, etc. As long as you keep the inventory updated and do the periodic collections, the portal does all the hard work.  For me, I like the LDoS reports, as well as the contract coverage, but I also track the PSIRT reports pretty closely.  chris   ... View more

do you have snmp write strings configured on these? If you do, you can push a config file and restore your vtys ... View more

locked = hard coded   now, as for the MTU, the most likely place you would see a problem is with TCP based traffic that traverses the firewall. Or at least that's where I usually see a mismatch manifest. I'm not saying it is or is not the cause of the errors/drops, but it is a difference that you may want to consider making equal. It's probably nothing, but you never know. At L2, probably nothing. But if the switchport is in, say, vlan 10, and the SVI for vlan 10 is also set for 1998, then that could cause your problem.   ... View more

ok, fair enough. It could be cabling. I also see there is an MTU mismatch, the switchport is 1998 and the ASA is 1500.   another question, how are your interfaces set, are they locked or are they running auto?   ... View more

classic sign of a duplex mismatch, if you check the other side of this connection you will see it at half duplex. ... View more

please post the output of "sho flow interf"     ... View more

well, that's a bit subjective, and you'd get many different answers especially from someone who has more of a security focus. But I guess the main thing is, how far down the rabbit hole do you want to go, and how full is the wallet?   I mean, you can use private vlans, you can use multiple vlans based on device type (IE- one vlan for power/UPS, one for HVAC, etc). If ASAs are in play, just routed mode, or L2 (transparent)? Single context or multi context?   There are many ways and many designs to get to where you want to go. I usually try to keep it as simple as possible while still meeting the security needs. You don't want to make things so complex that you can't manage it. So those are a few things to keep in mind. ... View more

in my experience, topology for devices like this is pretty simple, they usually have not been high bandwidth devices so what you suggest might be overkill depending on how large this will be.   the other thing with environmental devices, UPSs, PDUs, etc. is they are usually not very secure devices, so I'd suggest thinking about good segmentation and security (think the Target breach from a few years ago). If you keep things segmented in good fashion then implementing security, even if it is just acls, is much easier.   that's my $.02. ... View more