Moronic Monday! Networking |
- Moronic Monday!
- Recommendations on VPN Concentrator replacement
- Network Engineering Group In Los Angeles
- Advice in troubleshooting fiber not connecting from IDF to MDF
- Remote Management for HPE Switches
- Cisco ISE Functionality
- Cisco ISE & 2FA (smartcards)
- Network Topology...will this even work?
- Help Request - Network Admin and voice things
- Advice to troubleshoot my network
- Warm up Network Jack
- Done with Cisco Firewalls for branches, Suggestions for Palo Alto replacements?
- sensor to monitor Google Drive
- Wireless bridge loses connectivity
- Prime Infrastructure 3.4 - Wired Clients not populating
- 2960X Stack Upgrade Issue
- Eve-NG Wireshark Capture on Mac
- Shared internet access for multi-family housing complex
- Site to Site SSL VPN?
- IPSec VPN over Megaport to AWS VPC?
- OS1 vs OS2 fiber
- 2 dial tones (L1/L2) to 25ish phones
- GETVPN for DMVPN or GRE traffic?
- What is an acceptable error % on datacenter core?
- Progressing from network engineer role
| Posted: 30 Jun 2019 06:04 PM PDT It's Monday, you've not yet had coffee and the week ahead is gonna suck. Lets open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarassed to ask! Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected. [link] [comments]  |
| Recommendations on VPN Concentrator replacement Posted: 01 Jul 2019 09:49 AM PDT Currently using an ASA 5505 solely as a VPN Concentrator terminating a handful of L2L IPSec tunnels. This old guy is a workhorse but it just can't do some of the encryption methods some of my vendors are looking to run. I noticed that the ASA5506-X are the replacement, but I imagine EOL will be announced on those fairly soon. Any recommendations on a replacement for my 5505? [link] [comments]  |
| Network Engineering Group In Los Angeles Posted: 01 Jul 2019 08:02 AM PDT Does anyone know if there is a Network Engineering Meetup anywhere in LA? I'm looking to network a bit more (sorry for that one). And would love to meet others to build that out. I'm currently at a media company and have been for the past 4 years solving some pretty interesting Internet facing/packet/latency problems, would like to share some war stories. [link] [comments]  |
| Advice in troubleshooting fiber not connecting from IDF to MDF Posted: 01 Jul 2019 01:58 PM PDT Hi all, First time poster. Feel free to remove and/or redirect if this is against the rules or some such. We've got a site with a few IDFs (48 port cisco switch, jumper from switch to fiber patch panel). Each has a fiber run to the core switch in the main room (MDF). Issue is: Fiber ports aren't showing activity when racked in the IDF. If we physically have the switch next to the core switch in the MDF connected the same way via fiber jumper they light up. We've tried replacing the SFP connectors, the fiber jumpers, if we shine a laser/flashlight down the fiber at the IDF, it can be seen at the MDF side... If anyone can suggest some additional troubleshooting, it would be very much appreciated. Thanks in advance. [link] [comments]  |
| Remote Management for HPE Switches Posted: 01 Jul 2019 01:01 PM PDT I work for an MSP and we manage 100's of HPE switches for many clients. Currently updating firmware is a time intensive and burdensome task. I am hoping that someone in this community is facing the same issues I am. I am looking for software that I can centrally manage (HP)switches and update their firmware on a scheduled basis. I currently use WatchGuard Management Server and Forticloud for the management of firewalls. My own investigation finds that HPE intelligent Management Center has this functionality but appears to be limited to managing on-premise equipment only. Any advice or opinions would be greatly appreciated! [link] [comments]  |
| Posted: 01 Jul 2019 11:27 AM PDT Howdy, I've used and implemented Cisco ISE for different bits and bobs before - however nothing to a large scale or pushing ISE to its full capability. Has anybody got any examples of how they've implemented Cisco ISE in an enterprise environment, including: - Switches/Switchport access, - Wireless, - TACACS+ etc... [link] [comments]  |
| Posted: 01 Jul 2019 12:14 PM PDT All, Trying to find a third party solution that will work with Cisco ISE to support two factor authentication (specifically smartcard/x.509 certs). Is anyone in this sub using a ISE for smartcard authentication? I noticed the Cisco community posts (https://community.cisco.com/t5/security-documents/two-factor-authentication-on-ise-2fa-on-ise/ta-p/3636120) talks about using Pragma Fortress Client (though I assume SecureCRT will do the same now that its been updated in version 8.1 to do PKI authentication). However, that seems like a huge PITA to configure each network device to support PKI. Does anyone know of any vendor products that can act as a 2FA server that can be utilized in conjunction with ISE? I know Duo has been reported to work with smartcard authentication, though from what I've read the support or documentation is not fully fleshed out. Just wanted to pick the brains of anyone in this sub that is using ISE and also using some form of two factor authentication to gain access to network devices. [link] [comments]  |
| Network Topology...will this even work? Posted: 01 Jul 2019 02:33 PM PDT First a little about me. I've been doing sysadmin work for the past 8 years and I can handle basic networking but I'm a little out of my league on this one so any help would be appreciated! I'm trying to add SIP traffic to an existing MPLS but I'm not sure if this topology will work. Currently we have an MPLS router that routes to our primary firewall then to our core switch. We're looking at adding another physical link from the MPLS router straight to the core switch. Then we'd create sub interfaces with ips in multiple vlans on the MPLS router and trunk the port on the core switch. We have static routes on the MPLS router pointing to the firewall and also on the firewall pointing to the MPLS router. Does this topology work? Will this cause loops? Any help would be great! Link to network diagram: https://imgur.com/goWzhUV [link] [comments]  |
| Help Request - Network Admin and voice things Posted: 01 Jul 2019 04:01 PM PDT Alright, so I'll start off that right now, i'm feeling a little overwhelmed and think I need some knowledge dropped on me to help me reset myself to the right place, correct some expectations and just in general, help get started. I myself, the Network admin, feel very confident in doing anything networking wise, network is in a good place, but i also do the Voice/Security and those are maturing since i've joined last year I work for a company of about 480, domestic in the US, with about 12 remote offices and 2 more on the way this year(SD-WAN with either MPLS or public ISP). My Voice experience really is CUCM and it was basic at best, enough to say keep something running and sort of hold a conversation with a real voice engineer about CUCM. I understood enough at my last job to be dangerous and get by was about it. What my boss wants/is requesting: Voice - No more desk phones, a solution to remove desk-phones from the environment. We give almost every user a cellphone, I myself dont have a desk phone, just a cell. We have Shoretel(old) for the desk phones. Chat collaboration - Private chat, Group Chat and File sharing. Teams is the flavor, this is mostly because it just comes with our M$ licensing. It has been brought up about using this as the "soft phone". Video Collaboration - Meeting rooms that are video capable, mobile friendly and client joinable. Bluejeans is what we have now, talks about Zoom. Lets break this down further: Voice - We have a old Shortel system, the environment consists generally of users assigned DIDs and a voicemail box, we have a front desk phone at most sites that they transfer calls to the users that actually have phones(about 150). Ive setup some hunt groups that allow locations with DID's and no physical phone on site to ring to the main receptionist phones. Nothing beyond that in the system such as hunt lists for say ring to a Custom Service, helpdesk team or anything, and to boot, most phones are call forwarded to a cell phone anyways. Chat - Video Collaboration - We are using BlueJeans, this is used for internal and external customer facing meetings. We run the BlueJeans Relay to integrate our meeting rooms with BlueJeans. These rooms consist of PolyCom Trio 8800 + Collab and Cisco SX20s(one SX80). The play money here to make a solution work - about $40,000 is what in total we spend yearly on bluejeans and to maintain our Shoretel system(with is EOL), my reality sensor here says this is not even close to a realistic number to achieve the goal. So, as my brain thinks about this. Idea A. Voice - Maintain the Shoretel system, but upgrade it to be modern. I can integrate Polycom/Cisco with Voice at this point, ditch the desk phones and forward DIDs to Cells. (messy!) Chat Collab - Keep at it with Teams Video Collab - I can integrate the Polycom with Teams for Chat and Video Collaboration, but not the Cisco gear (AFAIK) *The hangup and no idea on cost* Idea B. Voice - Ditch the Shoretel system and switch to a hosted solution (I think Zoom offers something ) Chat Collab - Ditch Teams and use Zoom Video Collab -Ditch BlueJean and go with Zoom Im not very educated on this however and is more theorycrafting right now and seems like a expensive switch Idea C. Voice - Move the voice to Teams(AFAIK this is expensive and feature lacking) Chat Collab - Keep Teams Video Collab - Keep BlueJeans and my existing Gear This probably isn't enough info but i'll try and responds as I can. [link] [comments]  |
| Advice to troubleshoot my network Posted: 30 Jun 2019 10:59 PM PDT Hi All: Im the only IT person at my work, in charge of the whole IT department. It is a small / medium size network with the following network devices: ISP modem 1 NSa 3650 doing firewall and routing 2 Ubiquiti fiber distribution switches 20 Unifi APS 15 Ubiquity 32 port ethernet switches about 50 hosts 5 Vlans Besides that, we have about 20 VMS hosting various services, 2 internal DNS servers and more stuff that I dont believe its relevant to mention now. Last week, staff started to experience very slow internet transfer rates during browsing (spinning wheel). It seems that the DNS server started failing for some reason, so I went ahead and I changed the DNS preference in the sonicwall and the problem was solved (google dns first, followed by our two internal dns servers). Basically, the Sonicwall stopped syncing the license...what is weird is that it used to work just fine . [EDIT: This has been solved - Bind9 recursion issue] Now, I'm experiencing intermittent drops in my network (lan) (I.e I'm logged into some LAN resource and from one moment to another the connection gets dropped for 5-10 seconds). In order to test I started pinging several devices like the default gateway (sonicwall) and a couple of switches (Inside same subnet). I found out that every 50 packets I MIGHT get 1 or 2 dropped on the sonicwall, and in some of my tests I got about 10-15 packets dropped in 1 of my distribution switches. Apparently one of my switches is failing, so my question is how can I find which one? What software / hardware tools do you suggest to approach this issue? Feel free to ask me any questions if you need clarification. I was thinking in getting a Throwing Star LAN Tap (amazon) + wireshark and do some port mirroring. I have no clue on how to use Wireshark but this will be a good opportunity to learn. Do you think this is a good start on how to troubleshoot this? I would appreciate any suggestion on how to get this solved. My networking knowledge is alright, Im far from being a pro. Thanks! EDIT: Thank you ALL. Your advices are being taken into consideration. I will start working with your suggestions and get back to you in order to keep you informed. [link] [comments]  |
| Posted: 01 Jul 2019 07:48 AM PDT Hi Guys! tl;dr I have a -40 freezer and need a way to warm up network jacks so I can unplug the Ethernet cable without shattering the brittle network jack, the cable is fine after unplugging, it's the actual port itself that breaks I have a freezer that is -40 degrees (Celsius and Fahrenheit). We have network jacks inside where APs are plugged into. One AP went down. We have not determined yet what is bad, the AP, cable, or jack. If the problem lies with the cable I'll need to unplug it. I have unplugged a cable from a previous jack and the jack essentially "exploded" from being brittle due to the cold (the plastic and the contacts). I need some way to warm this jack up to let me unplug the cable without destroying it. If there isn't a device out there, I would need to make something, a couple thoughts I had:
If there is some other kind of heat source I can put in, it wouldn't need an opening, just need to make sure the heat source isn't able to melt the jack or the container it's going to be in. Hopefully there is something more professional or somebody has an idea that would be easier / more efficient! [link] [comments]  |
| Done with Cisco Firewalls for branches, Suggestions for Palo Alto replacements? Posted: 01 Jul 2019 11:23 AM PDT Hello again folks, I ended up going with the Firepower 2110 with an ASA image for my last branch and its been nothing but hassles with licensing. Smart licensing now requires a PO be cut for crypto services where the old licensing model only required a SN for an ASA be input into licensing manager. My trust for the Firepower NG platform is also nil. We have a Palo Alto 5520 series at our edge and so far I love it. So the question is; what do I replace the FP2110s with? I've been looking at the PA-820s as similar units. The requirements are that it be able to form an IKEv2 L2L for failover with an ASA5585 over an outside interface, provide L3 gateways for 5 or more local networks, and DHCP. Less than 100 users at the branch. Primary route to main campus will be over a Point-Point circuit where we establish OSPF. Is there a single pane of glass management solution that I can use to group the 5520 and PA820? Will I lose management access in the event of broadband outage like the Merakis if I go this way? [link] [comments]  |
| sensor to monitor Google Drive Posted: 01 Jul 2019 01:16 PM PDT Hey all, Can someone recommend a network monitoring tool that can check folder data similar to how PRTG Folder sensor works? (check age of files and/or size of folder etc) Currently using PRTG Folder sensor to monitor a network share connected to Google Drive. This works *most* of the time, but every week or two we'll see false positives that im tired of dealing with. -Sometimes the PRTG service will just need a restart and they will all check back in. -Sometimes a service restart will fix 80% of the down sensors but still some remain DOWN until restarted a second time. -Sometimes all of them will show down status, and a service restart will fix none of them but if I PAUSE/UNPAUSE they will all go back to UP status. This is all I will likely use it for, unless I fall in love with it. For that reason I would love it to be $ or $$ but not $$$$$. Thanks in advance. [link] [comments]  |
| Wireless bridge loses connectivity Posted: 01 Jul 2019 09:03 AM PDT I have a pair of Airbr1310's and I'm having a weird issue. When I change the hostname on the remote bridge I lose connectivity everytime. Has anyone else experienced this? [link] [comments]  |
| Prime Infrastructure 3.4 - Wired Clients not populating Posted: 01 Jul 2019 04:17 PM PDT All of our switches are talking via SNMP v2c to Prime. 3750 switches are sending wired client info Prime that is populated in device details of each switch. All newer switches (3850, 9300, 9500) are not populating. Sounds like it is an SNMP context that may be missing. When checking SNMP groups, it looks identical on a 3750 compared to a 3850 (only thing different is storage-type (non-volatile vs permanent (Assume Cisco renamed non-volatile to permanent). I found a forum that referenced having to add context to the group. When I tried this, it created another group instead of modifying the existing group leaving off the existing ACL. Any idea if that is what is missing to allow Prime to see the wired clients? If so, what do I need to do to allow all VLANs report wired clients to Prime for an existing group? Thanks [link] [comments]  |
| Posted: 01 Jul 2019 03:50 PM PDT BACKGROUND We have begun updating our 2960X switches from 15.2.2E7 to 15.2.4E7. The main trigger was that we wanted to be able to run test cable-diagnostic tdr on 1 Gbps ports that were running at 100 Mbps, and at the time, 15.2.4E7 was the latest TAC star release (I realize that E8 is now available, but we already had E7 tested in production and did not run into issues with it, so we opted to stick with E7 rather than re-test on E8). Using the SWIM features on Prime Infrastructure 3.4.1, Update 2, we distributed the .bin files to our standalone switches and the .tar files to our stack switches and made them the bootable image. Then over the course of several days, began activating those images (SWIM process for rebooting the switches so they load into the new image). We do it in phases over the course of 5 or so nights, with around 10-15 switches in each phase. That way, if we run into issues, we don't have a buttload of problems to take care of (there's only two of us doing Networking). That's also the reason we test the code on one of our stacks for a month or more before we deploy it to the rest of our switches. ISSUE DESCRIPTION So far, out of 18 switch stacks, we've had 3 different stacks run into the following issue: The switch stack will reboot and load the new code. The Master switch will update without issue. The member switch (each stack that has had this issue so far has been a stack of 2 switches) will update, but when it boots, it fails ACT2 Authentication during POST and spits out the following log message:
Once it finishes booting, the member switch will no longer stack with the Master. It should be noted that all of these switches are authentic Cisco switches - we only order from a Cisco-Authorized VAR (ConvergeOne, in this case). Luckily, we keep several spares available in case we need to replace a failed switch, so we haven't had any extended outages due to this issue. We've tried doing several hard resets by physically removing the power cable and plugging it back in, but still get %ILET-1-AUTHENTICATION_FAIL on boot. We tried upgrading to the very latest IOS train of 15.2.7E0a, hoping that the bootloader upgrade would fix the problem, but it did not. All of our troubleshooting was done with the stacking module removed and all cabling removed (except for the console cable). It appears to be some iteration of CSCur56395, which was supposedly fixed in 15.2.2E2. Since we were already on 15.2.2E7, and upgraded to 15.2.4E7, it was either not actually fixed, or is a different issue. So far, it has not impacted our standalone switches, only our member switches in a stack of two, but not every 2960X stack of two switches has been affected. RESOLUTION At the moment, our only option to correct this issue has been to call TAC and open a Warranty RMA on the affected switches and get them replaced. This thread appears very similar to the issue we're seeing: [link] [comments]  |
| Eve-NG Wireshark Capture on Mac Posted: 01 Jul 2019 07:20 AM PDT Has anyone figured out how to use the capture feature for Eve-NG community on Mac? I get the "capture:// is not recognized" error. I also tried following along to this article with no luck. [link] [comments]  |
| Shared internet access for multi-family housing complex Posted: 01 Jul 2019 07:26 AM PDT (Mods, please remove if not appropriate for this sub) Hi all! My dad is building a 16-unit apartment complex in an area that has gigabit residential fiber, so I floated the idea of offering free wired internet as a tenant benefit. My hope is that tenants can plug their router's WAN port into a provided cable drop in the closet, tweak some settings, then bam, free 60Mbps up/down. I myself have an electrical engineering background but I'm not a networking expert by any means, so I have a few questions for folks here. 1) Will this setup be kosher from the ISP side? If they end up insisting on us getting a business 1Gbps connection, it might not be worth the monthly cost. Or, what are the odds they'll just insist on installing an individual ONT for each unit? 2) How difficult will this be to setup and manager? I assume I will need an enterprise-grade router to enforce strict QoS. Each tenant router will have to change their WAN settings to specify their own IP address and use the building router as a gateway. How can I guarantee a tenant in Unit 3 cannot access file shares on Unit 12's LAN? Thanks! [link] [comments]  |
| Posted: 01 Jul 2019 11:28 AM PDT My org is using Cisco 8xx and 11xx series ISR routers as IPSec VPN endpoints. These go out to various locations for temporary events and bring up a tunnel back to our colo. The issue we've been experiencing lately is that a lot of local networks block IPsec passthru (we connect using whatever Internet service is already available at the location). I'm wondering if there's a product that does Site to Site VPN via SSL which would in theory work on pretty much any type of connection? A quick Google seemed to suggest Sophos and some others can do this, but I'm wondering if there's a way to leverage our existing Cisco investment? We have ASA5515X at the colo and 881/891/1111 routers at the remote sites. Since AnyConnect SSL VPN works fine (i.e. no dependency on IPsec passthru), I was wondering if there's some way to do a Site to Site VPN via AnyConnect SSL VPN or something similar. [link] [comments]  |
| IPSec VPN over Megaport to AWS VPC? Posted: 01 Jul 2019 10:49 AM PDT Hola, Has anyone had prior experience configuring an IPSec VPN from say a data center up to an AWS transit VPC using Megaport? Megaport's documentation says it's possible but doesn't seem to be very clear about how it's done. Unless I'm misreading things, they just kind of provide a high level diagram showing a tunnel across their services, and then point to AWS's VPN documentation if you have further questions. AWS's VPN documentation doesn't take into account a service like Megaport in between though. I have two Megaport drops in a data center cage connected into an SRX fw cluster and looking to do a tunnel per connection as primary and secondary. [link] [comments]  |
| Posted: 30 Jun 2019 11:42 PM PDT Hello everyone, I was asked which cable standard we should run between buildings and always knew there was OS1 and OS2, but never looked into it any further. From reading up on it, it seems like OS2 is shielded way better, sitting in a loose tube filled with absorbing gel or another protective mass. OS1 fiber seems to be a tight buffered cable. It seemed like OS2 was recommended for longer outdoor runs. But now when I checked on the plain and simple cables I usually get for within the datacenter to run between equipment and from equipment to panels, the websites state that they're OS2. That does not seem right. Also, fs.com for example has this graphic displayed on their OS2 product page: https://img-en.fs.com/images/products/550x550/32002.B.jpg This literally shows a tight buffer around the core. Am I not getting something right here? Explanations and comparisons seem way off from what is actually being sold by shops. [link] [comments]  |
| 2 dial tones (L1/L2) to 25ish phones Posted: 01 Jul 2019 09:11 AM PDT I've tried googling this one but I don't think I'm phrasing it properly. I know this is telephony not networking but the telephone/telecom subs I found were pretty low on members and when I searched 66 block in Reddit r/networking was the first result. I've got about a dozen handsets right now that are wired into jacks that are wired back to a 66-block. We're expanding and moving into a new office which is going to have roughly 25 handsets on it. Can I just punch line 1 and line 2 all the way down the block for all 25 phones? Do I need to worry about voltage drops (these particular handsets have wall warts as well)? The current incoming dial tones will be provided through an ATA but if for some reason we went back to the phone company's copper in the street is there some kind of amp or regulator or something that I should be using? Let me know if I missed a detail or there's a better sub to post this on. Thank you. [link] [comments]  |
| GETVPN for DMVPN or GRE traffic? Posted: 01 Jul 2019 04:45 AM PDT Curious, did anyone manage to get GETVPN running on an underlay network, like for example normal internet links with the KS providing SA's to encrypt traffic passing through a GRE tunnel? i tried labbing this in a virtual environment with the getvpn running on the overlay and i was able to encrypt traffic passing through the tunnel with ESP, but with the GRE header showing in clear in a wireshark capture... could this be normal? With another different config i managed to get getvpn running on the underlay, with this time the GRE header successfully being encrypted with ESP but i'd get GETVPN error messages on the GMs that something went wrong exchanging info to the KS. as far as my understanding goes GETVPN preserves the inner ip header making it useful for underlay networks that are for example private and where the underlay network devices are aware of the source and dest. networks, somehow i want the KS to provision SA's to the GM's, so that the GM's can encrypt tunnel traffic that the underlay should not be aware of for cases like an internet being used as an underlay. any info is appreciated. [link] [comments]  |
| What is an acceptable error % on datacenter core? Posted: 01 Jul 2019 04:15 AM PDT My team is pushing hard on our vendor because we are seeing input errors on out super router to our PE router. Its pushing 100gig of traffic and taking 0.000002.5% errors. [link] [comments]  |
| Progressing from network engineer role Posted: 30 Jun 2019 04:54 PM PDT Hey all.. just wanted some advice from the community.. I pretty much like designing and poc for new network setups but dislike programming to the core... don't really have the patience to get into python etc.... I've done the SDN stuff and pretty much know that.. but lack direction now into what should I pursue where I still get more architecture type roles..any advice what should I learn or focus on.. Is GCP/AWS/Azure the only way to go forward?... have done a bit on NSX but not well familiar with the whole vmware suite itself as it's quite vast... not sure where things are moving towards next and dread to think that devops is the only way forward... what are some suggestions that I could look into to move forward from here. Thanks in advance. [link] [comments]  |
| You are subscribed to email updates from Enterprise Networking news, blogs and discussion.. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
No comments:
Post a Comment