Hi, I'm trying to determine whether Cisco has any equivalent (in any platform) to some of the existing firewall rules within our iptables infrastructure. Specifically these ones: -A FORWARD -i eth0 -p tcp -m tcp --dport 3389 -m state --state NEW -m recent --set --name DEFAULT --rsource -A FORWARD -i eth0 -p tcp -m tcp --dport 3389 -m state --state NEW -m recent --update --seconds 180 --hitcount 4 --name DEFAULT --rsource -j LOGDROP -A FORWARD -p tcp -m state --state NEW -m tcp --dport 3389 -j ACCEPT                    What this does, is allow port forwards on port 3389/rdp. However, if a single IP opens too many connections within a timeframe, it starts dropping new ones. This is a critical requirements for certain security scenarios, such as preventing RDP brute forcing. A similar principle can be applied to 22/ssh. I've had a look around, rate limiting searches generally land me on QoS based discussions. I've seen people ask similar questions and get referred to CBAC. Whilst I can see similarly worded functions there such as limiting "half open" connections, I don't see anything there that limits the actual number of connection attempts you can make. Any assistance appreciated. ... View more

Hey all, I posted the below in VMware's forum yesterday, now I'm cross posting here for advise. I'd like to add after a day of research though - There is a LOT of advice on the Internet around this problem, generally suggesting the CONTROL VLAN isn't talking. I also believe that using the new Layer 3 communication, this advice is redundant, as the CONTROL VLAN is only used to communicate between the Active and Standby VSMs in this new format. The irony is that "show module" indicates that the active/standby modules are talking to each other fine, and if I the standby I see event logs about it dropping a heartbeat and getting it back. Accordingly, I'm quite sure the CONTROL VLAN is working. With this said, if I understand correctly, L3 communication really amounts to "can the VSM connect to the ESXi vmkernel". Currently I can ping the vmk from VSM without any issue. So where can the issue lie? I do note one thing I appear to do different - the vmkernel I'm using for management of my ESXi host is on a standard vSwitch - I felt that - in situations like this one - it's more important I can continue to access the VM console to fix issues like this. The environment is configured with L3 connectivity on the VEM, The environment is: One server (for now). Obviously, VEM and VSM are on the same machine. vswitch0 (standard) -> pnic0 (yes I know I will need more pnics in future) vmk0 (vlan13) pg_management (vlan17) This is connected by a trunk port to a Cisco switch, with the ESXi management on VLAN 13. I do intend on locking this down once things work. There is a management VLAN 17 which all switches are on, and hence, so is the "management" port group of the Nexus. The upstream switch has VLAN 13,17 and 19 all configured and trunked to all ports (not that it should matter across the same host) vswitch1 (DVS) How about I just paste the config. Relevant parts below. What I'm seeing ultimately is that "show module vem missing" lists the local host. port-profile type vethernet n1kv-L3 capability l3control vmware port-group switchport mode access switchport access vlan 17 no shutdown system vlan 17 state enabled port-profile type ethernet system-uplink vmware port-group switchport mode trunk switchport trunk allowed vlan 1-3967,4048-4093 channel-group auto mode active no shutdown system vlan 13,17,19 state enabled port-profile type vethernet Server_VLAN vmware port-group switchport mode access switchport access vlan 13 no shutdown state enabled port-profile type vethernet CONTROL vmware port-group switchport mode access switchport access vlan 19 no shutdown system vlan 19 state enabled .... svs-domain domain id 100 control vlan 1 packet vlan 1 svs mode L3 interface mgmt0 Any assistance appreciated. ... View more

Hey all, I have a 877 modem (for reference, running c870-advipservicesk9-mz.124-15.T5.bin) which provides Internet access and routes between two VLANs. I have found recently that when the Internet link flaps repeatedly (unrelated service provider issue) the modem appears to stop passing traffic altogether. I see this message popup on the console (repeatedly): switch transmit queue full on ethernet0 I realise there's nothing the modem can do about the Internet flapping, but any advice on how it may be possible to keep the two VLANs communicating it would be appreciated (other than a power cycle, which DOES fix the issue). ... View more