Disabling ACK randomisation on the ASA resolves this issue (this scenario matches Example B - Multiple Internet Paths):
access-list tcp_bypass extended permit tcp 192.168.161.0 255.255.255.0 any
class-map tcp_bypass
match access-list tcp_bypass
policy-map tcp_bypass_policy
class tcp_bypass
set c...
Now I wait while the DFS roots go nuts re-syncing several gigs of changed data
OK - i was just wondering why you had to go through the ASA and then through the vpn device seeing as how they are on the same VLAN (so there's no routing involved).
but if its the default gateway then fair enough i suppose
@Fitzroy Well the targets for the request is a different subnet; so it hits the GW, the GW sends it to the VPN gateway. The setup was working for years on our previous firewall, which was Microsoft TMG but we're removing them because TMG is EOL and unsupported and has no IPv6 support and replacing them with ASA's. This particular site has a few oddities though, and we have to keep this VPN gateway because they're PPTP cough
but theres no reason as such for the traffic to go through both the asa and the vpn appliance is there? But as the ASA is the default gateway - you dont have much choice unless you start setting up static routes on all the clients (a bit ugly).
@Fitzroy Yeah, I don't want to push out a GPO for these static routes. The solution so far is acceptable. The script I posted as an answer is a bit of a sledgehammer; the one I deployed is more restrictive and appropriate
But disabling ACK randomisation seems to have fixed this
@MarkHenderson is the environment small enough to nominate something else as the gateway. maybe a layer 3 switch. then you can setup the static route on that instead...
The Avaya is a 48-port PoE 10/100 switch for the phones, and the office is a Netgear "Smart" (lolwtfbbq) switch for office traffic with basic 802.1q capabilities
@Fitzroy Not really. It's just not all stuff from the same brand. We buy whichever one was the best value at the time. The netgear stuff was free. The Siemens system is very versatile and we got it for almost-free. The Avaya switch was EOL and incredibly cheap, and even better we ordered a basic one and they delivered a top spec one by mistake
The Cisco ASA is the first Cisco device on the network
@Fitzroy I've come to hate that Netgear switch once we started adding VLANs
Layer 2, so no routing, and tiny buffers, and a stupid interface
And if you want to do LACP, make sure your devices are adjacent to eachother, but don't cross a byte boundary (so ports 0-7,8-15 etc) because you can't LACP outside of a single byte
well - does anyone really make much use of layer 3 switches anyway? in my environment all traffic between vlans has to go through firewall interfaces anyway...
@Fitzroy hrm, I don't know. I would like it because our old gateway was gigabit so could do internal routing at gigabit speeds. This ASA is 10/100 (I knew this going in though, so no biggie) so inter-vlan routing is now 100Mbps. Which is fine at the moment.
@JoelESalas Negative. Netgear.
@ewwhite This is why I'm a jack of all trades and a master of none
i do have layer 3 switches and i need a few new vlans setting up. we usually go out through a firewall interface for every vlan though - but we've run out of firewall interfaces now...
i know you don't have to have one physical fwall interface dedicated for one purpose - but its the way we've always done it.
problem is - if we go with inter-vlan option then we have ACLs established in two separate places (the switch and the firewall). Something tells me its nicer if we can stick to one...
i have an interesting routing related task on my agenda. not exactly sure how im going to tackle it. i want to setup a test environment that duplicates our production environment - and i'm wondering whether i want to do it to the point where the ip range is the same.
i actually already have this setup - but the test environment is all virtualised and the physical host the hyper visor is not connected to our network in anway. i just have a terminal plugged into it in the sever room that i use to administer it.
anyhow - thats not something i really expect any answers to, just something i need to give some thought to at some point...
Oh wait do you mean Job Security, as in do I thnik I will have a job in 6 months, or Security as in we run everythign on public ip addresses with no firewalls?
In this shop, for instance, they didn't feel the need to change the root password of everything (which was the usual way to log in) in about 7 years. When I first knew that, I wanted to LOL and cry at the same time. Now they use nominal accounts and sudo when needed
I have two boards
PcEngines Alix (500MHz, 256MB RAM, no VGA out, 1 serial, 1 ethernet (100 Mbps) VIA rhine)
Intel Atom E640 cpu board (1GHz, 1GB RAM, VGA, LVDS, 2 serial, 1 CAN, 2 Ethernet (Intel 1Gbps NIC))
Its obvious that the 2nd one is better in terms of numbers and may be even in terms o...
Short version: You set delegation options for a security principal (i.e. user or computer) you've just configured an SPN for on the Delegation tab of that principal in AD Users and Computers.
Longer version: No, no, no!
You don't want to set up Kerberos Authentication and therefore delegation. ...
I am trying to make a few changes on a firewall by connecting remotely to a desktop at work. I need to do a change that I think may reset and change the LAN interface.... I am worried about being kicked out and having to travel to work to reset it.
The wan interface doesn't need any change, so, ...
@Chopper3: IIRC, you can set your steam library to a directory on another drive these days - with mine, I set it to a storage drive, reinstalled, and pointed to that directory - steam immediately picked that up
assuming I did get that right, and I'm not chasing my own tail ;p
@JourneymanGeek but my boot drive (and app drive including steam) is a 500GB SSD - so it'd mean me moving steam to a spinning disk or buying another SSD
I cannot ping6 the network interface "tun0" on the host computer from a virtual machine.
Using vmware, I installed a Ubuntu 12.04 virtual machine, that is connected to the host machine with NAT. Typing
Virtual Machine $ping6 aaaa::1
on the virtual machine results in
PING aaaa::1(aaaa::1) ...
I am new to networking, and I have a very fundamental question about router, switch and hub. I Know the router can perform the switch and hub's functions from my networking class. I am always wondering why we still need the switch and hubs in our network design? Why not replace all switch and hub...
In the CPU computing world, you have giant cloud providers like Microsoft Azure, Amazon EC2 and Rackspace. You have also smaller companies that provide dedicated hosting services.
Amazon EC2 has limited support for GPU computing with Tesla, as:
They are using an old Tesla
They only support tha...
@freiheit It's bike to work week and it's probably going to rain a lot so I have to get used to riding in the rain.
It's impossible to tell if we're winning because people at some other companies are entering all their trips for the week. The leader seems to have 34 trips today with only 5 employees...
@freiheit They do bike to work week a couple times a year. There are categories for distance and for # of trips. The place I started at this year has won for most trips for the past three years. You've gotta have fenders here... it's nuts not to. When I started at this place, I dropped a bunch of $$ getting some decent rain gear. It kinda sucks getting ready to go out in the rain, but I've gotten used to it.
@Ward The SF Bay Area contest is for May. 1 point for using a bike for transportation in a day, 2 points for 10-20 miles, 3 points for over 20 miles in a day. Leaderboard links seem to redirect to login/register page if you're not logged in, though.
@freiheit Yeah, some lanes I haven't been up in a couple of years in there. Not easy but not as hard as I remember, perhaps improved fitness, being lighter and new wheels all contributed there
Had been about a year since I'd done that particular climb. Was a lot easier than I remembered it. (definitely easier than 2 years ago when I first did it)
@ewwhite I've been out of town with pretty spotty reception over the weekend. I just read through it. I'm not really seeing anything worth stepping in about. Looks like a pretty reasonable conversation to me. No bickering, no rude comments, no nudity.
I asked a question and it got a negative vote also got closed, whereas there is a similar question with +1 vote and it's not closed, there's just minor difference,
my question http://serverfault.com/questions/510940/what-should-my-ip-address-be-for-my-dns-or-how-can-i-set-it-up
other question http://serverfault.com/questions/2557/how-do-you-set-up-dns-in-window-server-2008-in-a-hyper-v-environment
yup, I entered host's DNS server ip address to my VM too but it was giving me some errors as I stated on my question :), anyway thanks for looking at it, I will catch you later, bye
@MuhammadRaja Sorry, but the way you're setting up that DC VM isn't even close to "correct". You should pickup a book or at least a read a few articles or something on setting up a Domain Controller.
If he doesn't install DNS on that VM, he still needs a site local DNS server that he can administer. It's "best" to just make every DC a DNS server as well
It's possible to have a Linux server with BIND as DNS for your whole Active Directory Domain - It's not a great idea, and will involve lots of work and more troubleshooting than you'd imagine.
Root Cause - An insufficiently designed calculation in the CPU accelerator in the previous kernel caused an arithmetic overflow in the sched_clock() function. This overflow led to a kernel panic or any other unpredictable trouble on the systems using the Time Stamp Counter (TSC) clock source. - This problem will occur only when system uptime becomes 208.5 days or exceeds 208.5 days.
Getting timeouts from NetApp's site, made me think of you: « Failure of server APACHE bridge: No backend server available for connection: timed out after 10 seconds or idempotent set to OFF.
Question: Why do the Adaptec and LSI RAID cards we have fail so often? In HP-land, batteries used to last 3-5 years. Is this common? Are we doing something wrong? Is there a configuration that can help? Is this a function of Supermicro, temperature and poor chassis cooling?
I'd flower the question up a bit, but that's the jizz.
No, it's jizz... that's the gesture I make every time I see an email that says, "We've detected a failed battery on brazzers-db2. We're going to schedule downtime to replace the battery."
At work, we even have cache battery charging stations so that the new battery can be swapped in with no charging cycle.
So it seems like a good practice, but then again, it's a process built around faulty logic.
but in MY experience, the battery failures should be rare... and the big thing is: I stopped using cache batteries in HP systems in 2009. Ever since, flash-backed super-capacitors have been the norm. No charge cycles, no replacement, no short lifecycle.
@MichaelHampton but to me, this comes from the mentality that it's okay to hand-build your servers... you miss innovations like super cap-backed cache.
I accidentally dropped a MySQL database on my server. Are there any ways to recover a dropped database?
Assuming I want to ping from Server 1 to router
router
-LAN ethernet cable -
fiber to ethernet converter
- Fiber Cable-
Server 1
I have two boards
PcEngines Alix (500MHz, 256MB RAM, no VGA out, 1 serial, 1 ethernet (100 Mbps) VIA rhine)
Intel Atom E640 cpu board (1GHz, 1GB RAM, VGA, LVDS, 2 serial, 1 CAN, 2 Ethernet (Intel 1Gbps NIC))
Its obvious that the 2nd one is better in terms of numbers and may be even in terms o...
Short version: You set delegation options for a security principal (i.e. user or computer) you've just configured an SPN for on the Delegation tab of that principal in AD Users and Computers.
Longer version: No, no, no!
You don't want to set up Kerberos Authentication and therefore delegation. ...
I cannot ping6 the network interface "tun0" on the host computer from a virtual machine.
Using vmware, I installed a Ubuntu 12.04 virtual machine, that is connected to the host machine with NAT. Typing
Virtual Machine $ping6 aaaa::1
on the virtual machine results in
PING aaaa::1(aaaa::1) ...
In the CPU computing world, you have giant cloud providers like Microsoft Azure, Amazon EC2 and Rackspace. You have also smaller companies that provide dedicated hosting services.
Amazon EC2 has limited support for GPU computing with Tesla, as:
They are using an old Tesla
They only support tha...
