when you issue any command your pc opens a connection to the server on the command port and sends the command. The server then opens a connection back to your pc on the data port to send the response to the command. In other words, in normal ftp you have to be able to open connections both directions. The passive mode described earlier tells the server to tell the pc what source ports the pc should use so that it can open both connections, the command and data connections. Passive mode is the normal way to get ftp working through firewalls and edge routers. It doesnt soun d like your test with passive mode was done correctly. Try opening one more hole in the access list to allow inbound connections to (or from, not sure which) port 20. If it works then your passive test wasn't correct. ... View more

No. As ios's change new commands are added and occasionally some are removed. Including to the global mode. Since global is a mode B cannot be correct. To understand why C is correct you have to think of it in terms of WHAT you are configuring. GLOBAL commands turn things on or off or set parameters for the whole router, not just for an interface or routing process or some other sub level of commands. Global is the top level of the command set. You turn IP routing on or off. You turn multicast on or off. You enter interface configuration mode from global mode by entering interface x/x. At that point your prompt changes to show that you are in interface config mode. If you enter exit you dont exit config mode because you are not at the top. You go up one level to Global mode. Now you enter the global command ROUTER OSPF # and go into "router config mode". You are down one level from global and you are configuring a router process. Type exit and you leave the router process config mode and go up one level to global mode again. If you type exit at global mode you will exit config mode because you are at the top. ... View more

When you created the new vlan you also created a new ip network on a router (I hope). Make sure you advertise that network to the rest of your routers so they can reach that network. ... View more

Yeah, I guess I never considered he was trying to talk to the sniffing pc. I have done this before for a websense hosts that was monitoring internet traffic and needed to be accessed remotely through the same interface. Seems like the key was inpkts enable. ... View more

show us the acl. It sounds like he might have the wildcard backwards. ... View more

I dont see any way to eliminate all single points of failure. To eliminate the switches you could put two routers between the switches and the internet router. Run hot standby on the routers and track the connections to the switches so the hsrp will fail over if sw1 dies. But you still have a single point of failure in the internet router unless you have two internet links. How to make that work is a whole nother can of worms. ... View more

Couple of years ago we had a problem with 3548XL trunks bouncing. It was a bug in the IOS. You might see how old your IOS is. ... View more

The way you descibe this it sounds like the only way this works is with proxy-arp. ARPs are not forwarded between vlans. The router runs proxy arp which means that when it sees arps for hosts that it knows are not on that network it answers them. When it then receives data for that host it forwards it. When the data reaches the destination network the router on that network (in your case the same router) performs the arp to send the data. I cannot find anything documented but it sounds like proxy arp is being disabled on the vlan of the destination port in the span. Try making a new vlan and putting the sniffer monitor port in it. ... View more

You are just talking to the router through the AUX port. You can still tell it to send the config to a tftp server on your pc through the network. It doesn't matter whether you are telnet'd , on the cons port or the aux port. If the pc can reach the router through the network you can save the config with tftp to the pc or any tftp server that the router can reach. The is more viable than copy and paste if its a long config and eliminates having to edit out the more---- statements. ... View more

whatever device is sending out the runts is not working properly. It is not necessarily a router. Many applications hand large packets to TCP that IP has to fragment before the host sends them out. See if the runt packets are from a particular host or application. (hint: Watch out for Oracle/TNS). ... View more