Starred posts

Mike Pennington

Nov 15, 2013 11:51

@StephaneChazelas, what lock in? Seriously... $200 USD is too much for an enterprise-grade switch? You'll learn far more about switches once you can see what's happening inside them. BTW, the argument is not based on brand... it's based on superior design and hardware. The point is not to get you to buy from XYZ vendor... the point is that you can get a serious upgrade very cheaply. If you bought brocade or juniper that cheaply, I wouldn't blame you...

5

Ron Trunk

Jun 22, 2018 20:25

@RonMaupin . I have to disagree with you on this. This is the way AWS does it. Thousands on customers can't be all wrong.

2

Ron Trunk

Nov 13, 2020 19:55

@Arkan I'd like to help you, but I can't if you're unable to provide any information. If you don't know much about your network, I'd start there and gather information about your topology, hardware, circuits, etc.

Ron Maupin

Oct 22, 2020 00:33

@uhoh He told us an interesting story at a Global IPv6 Conference about putting IoT devices on all his wine bottles in his wine cellar so that he could tell if someone snagged a bottle.

Mina Michael

Sep 30, 2020 21:45

@TimCanning I kind of worked around it. I'm curious to know the reason for the splitting. Wiresharking it would be a good exercise but I don't have much time unfortunately.

Ron Trunk

Sep 28, 2020 11:56

@TimCanning Routers come in all shapes and sizes, so yes you can get one router to interconnect your four networks. I can give you more detailed information if you can provide more information about your network -- perhaps a diagram or at least a description of the network components.

JukEboX

Aug 6, 2019 22:18

@RonMaupin I am confused

Ron Maupin

Mar 31, 2019 10:31

@PeterMetz It is unlikely that your ISP is going to peer with you via BGP. You are probably losing your default route when you select BGP. Remember that routing protocols, like BGP, don not actually route, they exchange routing information with peer routers running the same routing protocol. BGP requires some configuration and cooperation with peer routers.

Cown

Feb 8, 2019 06:45

@Zac67 you are misunderstanding or i'm very bad at explaining myself in english. I'm not trying to police mgmt via VRFs, rather trying to police mgmt via access lists or control plane. All networks from all locations should be able to logon to loopback or mgmt vlan, but SSH access should be restricted to any other SVI.

Cown

Feb 7, 2019 18:46

0

Q: Restrict VTY SSH access to only MGMT VLAN and loopback

For the sake of the fact that i'm not allowed to share actual configuration, every posted config below is made up or altered. We have more than 250 locations spread over our country. All locations have a fiber optic connection and the minimal speed is 100 Mbit up/down. Everything is connected vi...

jonathanjo

Dec 30, 2018 12:06

@RonMaupin as far as I understand the argument, main site removes please/thanks/hi etc on the grounds that it's supposed to be formally about the question, not the questioner, and though there are strong views on both sides of this, the No-Thankers appear to outnumber the Thankers. I'm asking about whether the same applies on Meta.

jonathanjo

Nov 28, 2018 11:48

@forest ... you have some very interesting and well-written posts over at security

Cown

Aug 5, 2018 16:23

@RonMaupin damnit missed the following part

Ron Maupin

Jul 12, 2018 14:48

@IñigoGarcía I know that people really hate to spend money, but it could well be worth it to hire a consultant to walk you through this the first time. You could then try to do it on your own the next time, but you would have a fallback position of the consultant who is already familiar with your network. Some vendors, e.g. Cisco, have such a service, but part of that would be to try to sell you on new equipment.

Ron Maupin

Jun 12, 2018 18:29

@Satish Don't confuse ethernet (layer-1) auto-negotiation with DTP, CDP, LLDP, PAgP, LACP, etc. layer-2 negotiation. Cisco's recommendation is about ethernet (layer-1) negotiation.

Ron Trunk

May 31, 2018 17:56

QoS is not a solution for ddos

Ron Trunk

Jan 28, 2018 03:56

@RonMaupin No tacos. She's Jamaican-American, so it's more likely akees with salt fish. But the truth is I do most of the cooking at home.

Eddie

Apr 25, 2016 16:28

@BeachSamurai To a degree, you don't even need routers and switches, you can do it all with a linux server. But there is a benefit of having them -- reliability, consistent management, dedicated hardware, higher bandwidth/throughput, etc. It works the same way, yes you can do some Firewall tasks with a Linux server, and if those are all the tasks you care about then go for it. But without knowing what tasks you do care about, we are shooting for a moving target.

Eddie

Apr 25, 2016 15:41

@BeachSamurai There is much more to it than that. IP Tables works fine for a L3/L4 Firewall, and if that is all you need, and your traffic levels allow for it, then using IPTables or a Hardware firewall will be the same.

JFL

Mar 1, 2016 18:27

The fact is "education, certification, or homework;" is explicitely off topic on this site, but welcome in chat

Teun Vink

Jun 26, 2015 08:20

I doubt there is one perfect answer, since there's not a single formal definition, but the approved answer quoting the IPv6 RFC seems to be a good one. Other people seem to think so as well since it got upvoted a lot.

Eddie

Jan 2, 2015 00:51

What I've found best is to set up some sort of large "class" network, networking all the gear in the classroom. Have the students set up DHCP pools for each network, and pick the IP space at random (you can organize it by team if you like, so team 1 has 10.1.x.x, where .x.x can be whatever they pick).

Mike Pennington

Oct 23, 2014 15:13

2

Q: Why have a single, "core", router

quick bit of context so my question makes sense: I've been asked to plan out some subnets and routing for a new IP range we've just been allocated. The range will be used to customer's equipment (on IPs allocated out of this range) to peering providers. </context> Every routing example I've see...

routing router subnet

YLearn

Jun 13, 2014 21:11

@gh0st, if you are looking for alternatives to Cisco, take a look at Palo Alto and Fortinet. While I can't speak to them personally, I have heard others speak well of them (especially the Palo Alto firewalls).

Mike Pennington

May 6, 2014 10:42

515

A: Why is Stack Overflow so negative of late?

Why is Stack Overflow so negative of late? I hate to pile on, but I couldn't resist summarizing the problem. And I apologize ahead of time for any potentially offensive language that I might use. Basically there are 4 camps of users on Stack Overflow: The "caretakers" who want to keep the...

Stacey Anne

Mar 28, 2014 04:45

he wants JSON responses to http verbs

radicetrentasei

Mar 19, 2014 13:28

I know ... it's because you are in your LAN, port translation it's not supposed to work in this scenario

Mike Pennington

Mar 19, 2014 10:22

my concern is that you may ground this with wire that's too small... in the event of a lightning strike, that wire could burn up (if too small)...

A L

Mar 18, 2014 17:35

Well if they're stacked, it should logically see all of the members of the stack as one device. There may be other options to stacking you're using vs what we do with it, but if I have two 3750's stacked on our end, I see each chassis as Gi1/0/X and Gi2/0/X etc all from the same CLI

Mike Pennington

Mar 2, 2014 01:33

@Fizzle That's fine... we disagree about the security risks of file transfers with tftp and use of CDP in my enterprise network environment. As I mentioned previously, we agree that people should take reasonable security measures; however, many security measures can be circumvented with a $5 tool and some drugs. Live and let live ;-)

Mike Pennington

Jan 31, 2014 18:12

@Jim, unsolicited tip: Cisco 2600 and 2800 series routers, as well as Catalyst 3550 / 3650 switches are extremely cheap on eBay. IMHO, GNS3 (another way to simulate Cisco devices) is not fast enough, and in this case seemed to aggrevate your problems. Buy some real hardware; you won't be sorry.

YLearn

Dec 13, 2013 04:51

However, the main point is that prolonged discussion in comments is highly discouraged.

Mike Pennington

Dec 3, 2013 16:37

I like Jeff Doyle's Routing TCP/IP Volume 2 and Wendell Odom's CCIE Study Guide for recent multicast guides

Mike Pennington

Nov 12, 2013 11:21

hi sch, help me understand why you're not posting the output of mtr, and how you're so sure it's worth focusing on the graph instead of looking for which piece is causing the problem?

General Network Engineering recommendations

General Network Engineering recommend…