Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About dbeattie
03-14-2019
dbeattie
Member since
04-14-2004
Beginner
12-27-2018
04:36 AM
Hi Luis,
If I understand your question correctly, you have two segments that make up one sub-net. The segments exist either side of a DCI link. If these are access segments (i.e. not used for transit) and the DCI link is just used to allow servers in each segment to run sync/heartbeat (not unusual), you should be able to set all of the SVIs in the subnet to being OSPF Passive. This will prevent the switches from trying to peer with each other and will stop the logs happening. Obviously, this will not help if you actually need the switches to peer on this sub-net.
Hope this helps,
Dave
... View more
12-17-2018
05:57 AM
Hi,
I would tend to look for a smaller platform if you can support it. Depending upon how many distribution switch pairs you have, the Catalyst 9500 series might be more appropriate than the 3850 and could give you a future upgrade path to 40/100G. You might even consider the Nexus 9300 series. (I am a big fan of the N9336C-FX2)
I would tend to move away from chassis switches for core because of the issues surrounding single card failures. Chassis switches also tend to have higher latency for card-to-card forwarding. Finally, (personal opinion) I would not use VSS for core switches. I don't see that it gains you anything on a pure L3 devices.
Hope this helps.
Dave
... View more
12-12-2018
08:39 AM
Looking at your routing, you are trying to use both paths around the edge of your central routing environment on all routers. This means that for packets arriving at router 2 bound for 192.168.65.1, half will be sent to router 1 and half to router 3. Of the packets sent to router 1, half will be sent correctly to router 4 and the other half will be returned to router 2!
A quick fix would be to remove the statics that go the wrong way around the loop e.g.
Center1: 192.168.65.0/24 via 192.168.10.2
... but ultimately I recommend that you set up a simple dynamic routing protocol on all of the routers and get rid of all of the statics.
There are lots of online guides for this. I suggest that you look at EIGRP or OSPF in the first instance.
Hope this helps
Dave
... View more
12-12-2018
03:53 AM
Create a new aaa authen profile for local authentication only. Set the vty 1 line to use the aaa profile for local only. This means that the first connection (vty 0) will use the normal authentication (keep this session open) and the second connection (vty 1) will use the local only. Once complete reset the vty 1 line to use your normal authentication method
The key is to always leave yourself with a method of returning authentication to your usual method if the local password is corrupt.
Hope this helps
Dave
... View more
12-12-2018
01:14 AM
Hi Manish,
That is correct, but you will also have to change the SFPs to single-mode ones (1000BaseLX). The part code is GLC-LH-SM.
Hope this helps,
Dave
... View more
12-12-2018
01:00 AM
Yes, drops seem to be a problem. You need to align your hardware selection and either use single or multi-mode:
Multi-mode cable end-to-end and SX optics, or
Single-mode cable end-to-end and LX/LH optics
The selection is usually based on the availability of installed cable and the distance that you need to go.
Hope this helps,
Dave
... View more
12-12-2018
12:52 AM
Hi Greg,
Static routing is generally fine when there is only one valid path. So router1 and router8 can be configured with just an upstream default route to Centre4 and Centre2 respectively. Their downstream routes are connected interfaces, so should not need a route to be entered. The following static routes will be needed:
Centre2 will need a static to 192.168.55.0/24 through router8
Centre4 will need a route to 192.168.65.0/24 through router1
The four Centre routers should run a dynamic routing protocol because there are multiple valid paths. They should all peer together and connected interfaces and static routes should be redistributed in as needed. Using static routes in between the four Centre routers would leave you open to a number of nasty failure modes.
I have to say that my choice here would be to get all routers in the infrastructure into a single OSPF area include all subnets in it. To my mind this is simpler that having to think about statics.
Hope this helps
Dave
... View more
12-11-2018
04:35 AM
On the basis that a new 24-port 1GE SFP card for a 4506 is about the same list price as a 48-port 1/10/25G SFP+ switch in the 9500 series, I would opt for the latter. Even the ageing 32-port 4500X would seem a better bet than the 4506 line card. Both of these options have massively increased backplane capability compared to the chassis and give future capability to move to 10GE. In addition, they save you 9RU in your rack.
Going to 12x10GE cards would be even more expensive.
Hope this helps,
Dave
Dave
... View more
12-11-2018
03:11 AM
In theory no further packets should be allowed when the session ends because the dynamic NAT entry should be removed from the NAT table. In practice this may be HW & SW dependent. Some may keep the NAT entry in the table until an idle timeout occurs. Certainly if you run the IOS firewall, the entry should be marked as closed, preventing further traffic, but left in the table for a period of time in order to prevent re-use.
Hope this helps
Dave
... View more
12-11-2018
01:31 AM
Hi Leshkan,
Cisco Overload NAT is a dynamic NAT also known as Hide NAT. This means that it is functionally an outbound NAT with source port translation, so the only packets from external hosts that will get forwarded to the internal host are packets that are considered to be replies. In a relatively simple device like your 881, this will be a reply defined at layer 4. If you were to run an IOS firewall on the device, this gets extended to layer 7 replies, allowing protocols like FTP to work properly. This aligns to your option 3.
Hope this helps
Dave
... View more
11-29-2018
08:04 AM
Yes. This makes the relevant routers ASBRs, which is not overly a bad thing in terms of OSPF stability.
... View more
11-29-2018
07:42 AM
A few other items that I have seen contribute to the stability of OSPF designs are:
Ensuring that transit links are point-to-point
Ensuring that access links are passive (or redist from connected)
Not mixing transit and access links i.e. no hosts on transit links)
All of these will help you scale both single- and multi-area topologies.
Obviously, alternatives (e.g. point-to-multipoint) have their place, but these three guidelines promote stable scalability.
Hope this helps
Dave
... View more
11-28-2018
06:24 AM
Private VLAN config can be found here:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swpvlan.html
However, if it were me I would get a firewall for the Internet Edge, put the Nomadix on one DMZ and everything else on an Inside interface. That way everything (including the Nomadix) could use RFC1918 addresses and you would only need to NAT when going out to the Internet.
Obviously, its your call. Good luck with it.
Dave
... View more
11-28-2018
05:58 AM
I always question the multi-area requirement. Even in large deployments, OSPF is efficient enough to support high numbers of routers in a single area. In this case, with the total number of routers being less than 50, if there is no other driver for the other areas, path selection would be best achieved by the use of a single area.
Hope this helps,
Dave
... View more
11-28-2018
05:51 AM
Maintaining your current set up you could use private VLANs to segregate the two VLAN 200 ports, by putting them into isolated mode.
I would question why you need to use your Internet addressing on the hosts, when you could use a NAT-capable device at the edge, allowing you the freedom to use RFC1918 addresses inside. This would be a more normal deployment.
Hope this helps
Dave
... View more
12-27-2018 04:36 AM
Hi Luis, If I understand your question correctly, you have two segments
that make up one sub-net. Th...
12-17-2018 05:57 AM
Hi, I would tend to look for a smaller platform if you can support it.
Depending upon how many distr...
12-12-2018 08:39 AM
Looking at your routing, you are trying to use both paths around the
edge of your central routing en...
12-12-2018 03:53 AM
Create a new aaa authen profile for local authentication only. Set the
vty 1 line to use the aaa pro...
12-12-2018 12:52 AM
Hi Greg, Static routing is generally fine when there is only one valid
path. So router1 and router8 ...
12-11-2018 03:11 AM
In theory no further packets should be allowed when the session ends
because the dynamic NAT entry s...
12-11-2018 01:31 AM
Hi Leshkan, Cisco Overload NAT is a dynamic NAT also known as Hide NAT.
This means that it is functi...
11-29-2018 08:04 AM
Yes. This makes the relevant routers ASBRs, which is not overly a bad
thing in terms of OSPF stabili...
11-29-2018 07:42 AM
A few other items that I have seen contribute to the stability of OSPF
designs are: Ensuring that tr...
11-28-2018 06:24 AM
Private VLAN config can be found here:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst35...
11-28-2018 05:58 AM
I always question the multi-area requirement. Even in large deployments,
OSPF is efficient enough to...
Public Statistics
| Date Registered | 04-14-2004 03:36 AM |
| Date Last Visited | 03-14-2019 11:42 PM |
| Total Messages Posted | 129 |
| Total Helpful Votes Received | 125 |
.jpg "VIP Expert"){kind=icon}
.jpg "Hall of Fame Cisco Employee"){kind=icon}
Helpful Votes From
