Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About barnesp
05-22-2019
Stats
Member since
10-22-2003
39
Posts
4
Helpful
0
Solutions
11-07-2015
09:43 AM
You could also use CBAC - which was the precursor to ZBF - potentially easier to configure - but slightly less flexible.
In this situation you apply inbound ACL denying all traffic. CBAC support self generated traffic now. Then apply inspection outbound.
The inbound ACL is dynamically update for each inspected connection outbound. An example here
CBAC
... View more
Created by
barnesp
in Other Network Architecture Subjects
in Other Network Architecture Subjects
11-07-2015
09:36 AM
11-07-2015
09:36 AM
What information can you get from the far end - I assume it's not in your control. Ideally you want to see the configuration.
In addition you would want see their ARP cache. Is the media a cloud?
... View more
11-07-2015
06:03 AM
If you want more detail TCP/IP Illustrated Vol 1 is a good source of info.
... View more
11-07-2015
05:46 AM
Talking from someone who has taken the exam four times and failed I understand the sacrifices.
Looking back on stress is a big part of it. Particularly on the first two attempts where I was no where near ready. Something nasty happened on my forth attempt which was nothing to do with me.
3rd - put down to experience - mobile lab in London - poor nights sleep and poor environment compared to Brussels.
4th - was close - but no V4 places to retake anywhere in the world.
Anyway these are all excuses I wasn't good enough!
Family pressures and costs and the draconian retake intervals (since revoked) followed by death in the family have stopped me. Will be getting back on the bus next year after recertifying my written and my NP level qualifications.
... View more
Try this
ip access extended ACL-INTERNET-IN permit tcp 11.11.11.16 0.0.0.15 host <OUTSIDE-INTERFACE-ADDRESS> eq 22 23 deny tcp any any eq 22 23 permit ip any any
First line allows you to manage the router.
Second line denies all other telnet or SSH.
Third line permits all other Internet traffic.
BTW - you should only use SSH as telnet more vunerable to MiM attacks.
... View more
11-07-2015
04:56 AM
Hull is the bain of my life - as a provider we have no on-net connectivity with them so everything is done via public Internet with VPN technologies.
... View more
11-07-2015
04:54 AM
Do you have flash drive - copy your config over to that and then copy from the flash drive onto the flash on the router. Cisco 800 should support USB.
... View more
11-07-2015
04:44 AM
Try this for size this from a working working router - it even gets ppp to install a default route for you - BT user pvc 0/38 - unless you live in or arround Hull!
interface ATM0 mtu 1492 no ip address load-interval 30 atm vc-per-vp 256 no atm ilmi-keepalive pvc 0/38 tx-ring-limit 2 encapsulation aal5mux ppp dialer dialer pool-member 1 ! interface Dialer0 ip address negotiated encapsulation ppp load-interval 30 dialer pool 1 ppp authentication chap callin ppp chap hostname <USERNAME> ppp chap password <PASSWORD> ppp ipcp default no cdp enable
... View more
11-07-2015
04:36 AM
ip access extended ACL-INTERNET-IN deny tcp any x.x.x.x 0.0.0.15 eq 22 23 permit ip any any
Apply the ACL inbound on your Internet facing interface e.g.
int g0 ip access-group ACL-INTERNET-IN in
... View more
11-07-2015
04:10 AM
Although EIGRP is not vendor independent - even though there is RFC published! Fine for pure Cisco enviroments assuming queries are bounded :-)
... View more
11-07-2015
04:08 AM
This is quite an interesting question! OK so assuming that you have never been to www.cisco.com. ; The first thing you are likely to do as a client is to generate a DNS query in order to resolve FQDN into an IP address.
DNS uses UDP port 53. In the worst case this could be forwarded to one of the Internet's root DNS servers - but the vaguries of DNS can be quite complex. In the end a authoritative answer will be returned.
The client will then initiate a TCP connection to the IP address found above with a destination port of 80. TCP uses a three way handshake to synchronise sequence numbers. This ensures that lost segments can be recovered. This assumes of course the ARP has done it's work and we know how to encapsulate IP traffic towards our IP default gateway.
It likely that web server will provide a default.htm document which then detail other elements that need to be downloaded. For example pictures, styles sheets etc. Each element typically requires a new TCP session to be initiated to the web server.
The very best way to understand this process is to install Wireshark (free) on your computer and capture everything that goes on!
... View more
11-07-2015
03:53 AM
Using the command mentioned by Paul Driver - shut down all interfaces on connected to the subnet you want to test and then bring them up. By default all devices wait 40 seconds listening to see who should become the DR/BDR. 40 seconds is taken from the value of the OSPF hold-timer. To prevent this you would need to change the network time but this would depend on your topology - which you haven't shared.
... View more
11-07-2015
03:47 AM
Asssuming your power source is good - it looks like you a broken switch - most likely it's PSU.
... View more
11-07-2015
03:45 AM
I guess some care has to taken with these terms as they can be idealogical. For example control plane traffic, management traffic and data plane traffic will share the same physical medium between devices.
Best practice design often dictate that management plane traffic should be separate from user generated data plane traffic. An example of this segregation would be using a management VRF and potentially a differnet infrastructure for management - so that a data plane problem doesn't break your management plane.
Control plane traffic clearly need to run alongside data plane traffic as this is adjancencies are maintained between devices.
... View more
11-07-2015
You could also use CBAC - which was the precursor to ZBF - potentially
easier to configure - but sli...
11-07-2015
What information can you get from the far end - I assume it's not in
your control. Ideally you want ...
11-07-2015
Talking from someone who has taken the exam four times and failed I
understand the sacrifices. Looki...
11-07-2015
Hull is the bain of my life - as a provider we have no on-net
connectivity with them so everything i...
11-07-2015
Do you have flash drive - copy your config over to that and then copy
from the flash drive onto the ...
11-07-2015
Try this for size this from a working working router - it even gets ppp
to install a default route f...
11-07-2015
ip access extended ACL-INTERNET-IN deny tcp any x.x.x.x 0.0.0.15 eq 22
23 permit ip any any Apply th...
11-07-2015
Although EIGRP is not vendor independent - even though there is RFC
published! Fine for pure Cisco e...
11-07-2015
This is quite an interesting question! OK so assuming that you have
never been to www.cisco.com. ; T...
11-07-2015
Using the command mentioned by Paul Driver - shut down all interfaces on
connected to the subnet you...
11-07-2015
Asssuming your power source is good - it looks like you a broken switch
- most likely it's PSU.
Public Statistics
| Date Registered | 10-22-2003 02:21 AM |
| Date Last Visited | 05-22-2019 12:07 AM |
| Total Messages Posted | 39 |
| Total Helpful Votes Received | 4 |
