I want to connect a mid-platform (2 Web Servers , 2 Database-Servers, 1  SAN) to my enterprise network where exists three Cisco Switches. For the moment i have two main topologies to choose to implement. The first one has an inter-link between the Switches in order to provide a redundancy path. At the second topology there is not redundancy at Switch level, but  there is an additional link (upgrade bandwidth via LACP) towards upper aggregation  Switch. Which of these two topologies seems to be better according to yours opinion and experience? At the second topology is it possible to arise connectivity problems due  to two-way paths of each web-server to the two Switches? ... View more

I have the following network topology: PC1 <=> Switches L2 <=> Switch L2/L3 <=> PIX <=> Router <=> INTERNET <=> Adsl Modem/Router <=> PC2 I want from the PC2 to make RDP connection to PC1. The PC1 has a private static IP Address (10.10.10.10). Teamviewer is not a option for my implementation. According to a cisco document i found the below proposed solution: 1) Configure an access-list on the PIX access-list Outside_access_In permit tcp any host 197.197.197.197 eq 3389 2) Apply the access-list access-group Outside_access_In in interface outside 3) Configure the static NAT static (inside,outside) 197.197.197.197 10.10.10.10 netmask 255.255.255.255 Does this configuration recommend as i have (with any) all the Internet space to allow access to RDP service. If in the future it exists the necessity to add an additional private IP address for access via RDP, how it will possible to change my above configuration as i don't want to wast all my public IP Addresses. ... View more

I have the following network topology (from outside to inside): Router <=> Firewall <=> Multilayer Switch <=> L2 Switches <=> PC & Servers One of my Servers is Web-server and there is a requirement to eliminate  the access to the Web-Site (which is resides to this Web-Server) to  specific range of public IP Addresses. For instance my Web-Server  has the Private IP Address 10.10.10.10 and  via static NAT at my firewall takes place the translation to one Public  IP Address 20.20.20.20 In order to implement the requirement I have two basic options: 1)Set ACL at Router to the appropriate physical Gigabit interface In this instance I am using the internal gigabit interface towards my  Firewall. In order to construct the ACL I am using for the destination  IP Address the public IP (20.20.20.20). In this case every packet from  the internet must be inspect by this ACL before enter to my local  network. 2)Set ACL at Multilayer Switch to the appropriate Vlan Interface. In this instance I am using the corresponding Vlan interface (at the  same network of my Web servers). In order to create the ACL I utilize  for the destination Address the private IP Address (10.10.10.10) as now  there has been executed the NAT translation. In this case the I  constraint the inspection only to a specific VLAN but also at the same  time many unwanted packets come into my local network  up to the  Mutlilayer Switch. Which of these two methods could be assessed more ideal in terms of performance and security? ... View more

I have a simple standard ACL in odrer to filter the access to vty lines. I want to edit the existing acl, so i add a new record to the specifit ACL (40) with the lines info. After this action i gave the below show command and i found that the new record (with the line 83) became the first row in my ACL. Why this is happenned???  InternalRouter#show ip access-lists 40 Standard IP access list 40     83 permit 10.1.99.195     40 permit 195.251.16.252     50 permit 10.1.0.0, wildcard bits 0.0.0.255     60 permit 10.1.10.0, wildcard bits 0.0.0.255     82 permit 10.1.83.0, wildcard bits 0.0.0.255 (276 matches) line vty 0 4 access-class 40 in logging synchronous login local transport input ssh ... View more