New answers tagged

0

Simple answer is you can do Layer 2 Encryption. Layer 2 encryption is more flexible than layer 3. In addition to that, you can create site site vpn over internet as well.


0

With a VMware standard vSwitch you can't separate the VMs/vNICs in the same port group from each other. The only way would be a separate port group for each VM. I'm not 100% sure but AFAIK, a distributed vSwitch can't do that either. On a physical switch you could use a private VLAN/port separation/port isolation/uplink port (depending on vendor and series) ...


1

It's all depends upon network connectivity bandwidth and server NIC card bandwidth threshold . If excess of traffic come on physical links then packets are queued resulting in congestion of physical links leads to packet drops and applications will experience latency in accessing . Traffic is even get queued when server nic cards exceed its handling ...


3

If the bandwidth limit is a physical link capacity, excess traffic is dropped. A very small amount might get queued and dequeued again when the bandwidth has decreased below the physical limit, but anything seriously exceeding the link capacity cannot be forwarded and is lost. If it's a software limit, the exact handling depends on the configuration and the ...


1

Depending on the usage profiles, you can support between 10 (serious) and 100 (very light) users per WAP. Since that means 200 to 2000 access points, you'll likely want a managed, controller-based solution with central RADIUS authentication. The WAPs need to be uplinked by a sufficiently fast switch fabric, again depending on the expected overall load.


1

If yes then why do we have to know programming if we can just use a GUI? Documenting what you clicked in a GUI is very hard and time consuming. Even with documentation it is sometimes hard to remember how you accomplished something a couple of month before. Writing a script (and would not consider this programming) is more work in the beginning but you even ...


2

If that's the case then since Ubiquiti has Unifi Controller is that already a network automation? Essentially, yes. You could also consider it a form of Software Defined Networking (SDN). If yes then why do we have to know programming if we can just use a GUI? For one product from a single manufacturer, you probably don't. But large networks can have ...


1

Network automation is word we are frequently hearing nowadays, and companies are even looking forward to automating their network infrastructure operation. For example, big organizations like banks will have their own data centers and end to end infrastructure that is maintained by the bank only. Every day lots of changes will happen in they network ...


0

You're already on the right track. "Network automation" is any way you manage multiple network devices at once. You might use a proprietary tool that only works with one vendor's devices or just a single series, or you might use a more powerful tool that works with different devices and even different vendors. Since configuration logic may ...


0

You summed it all up. A redundant network requires more hardware to build and more qualified staff to maintain. Obviously, a simpler network is easier to maintain. By scalability, there isn't much difference, but a very large network that has hundreds of SPOF would be a nightmare. At the same time, a large, entirely redundant network would also be quite a ...


0

Then what is the situation for firewalls already deployed and working in production? Most professional devices seem already to support IPv6. And the manufacturers of home equipment will tell you to buy a new device. (Unfortunately, equipment not supporting IPv6 is still sold!) And can we NAT IPv6 public IP with IPv4 private IP ranges? There is one major ...


3

I came to know recently ipv4 public ip address pools are going to exhausted soon. Depending on your definition of "exhausted" they already are. It's not like you can't get IPv4 though, just that the price is going up. Realistically what will happen is that as prices rise companies will reevaluate where they are using their IPv4. Connections that ...


-6

NAT between IP4 and IP6 is pointless. NAT always changes only destination address (as in destination-NAT) or source address (as in source-NAT or masquerading). You will end up with a connection between an IP4 and an IP6 address. Neither of them supports such connection. Well, you can do both (SNAT + DNAT) in a single host and even encode IP4 addresses in an ...


9

And can we NAT IPv6 public ip with ipv4 private ip ranges. Since IPv6 addresses are abundant and allocated as /56 even for private access, there's absolutely no need for NAT (which is a kludge to deal with IPv4 public address scarcity). NAT64 for IPv6 was defined but there's little support - and that's a good thing.


21

You're late to the game: IPv4 addresses are already exhausted, and have been for a number of years. All the major manufacturers have included IPv6 capability (in varying degrees) in their product for quite some time.


5

There are a few points to consider when attempting load balancing. For Cisco routers at least, you have the option of per-flow load balancing, where the first stream of data will use only one link and the next stream will use the next link, with streams alternating between the two; and per-packet load balancing where each ip packet uses a different link. Per-...


2

As explained by Ron Maupin in comment, doing Equal Cost Multipath Routing (ECMP), especially with different bandwidth, may cause issue. (But it is supported by some OSPF implementation, including Cisco one.) What you could do is use Policy Based Routing (PBR) to have some kind of traffic routed over a link and other traffic routed over the second link, with ...


-1

The optimized way to accomplished this task is by redistribution of route please check restribution of route concept . We have fesabilty to export and import route in different routing protocols for example if ospf and static routing to communication redistribution has to be configured in border switch Assuming you are having cisco layer3 switch ...


3

Unless you have multiple paths to the other organization, you don't need to run a routing protocol with them. You can use a static route to route traffic over the point to point link, and the other organization can do the same. One of the assumptions of OSPF is that all routers are trusted. In your case, the routers of the other organization should NOT be ...


2

Generally, BGP is an appropriate routing protocol for inter-domain / inter-network signaling. It has features intended for networks which are under different administrative controls. OSPF is not appropriate for your intended use. Don't do that. OSPF is categorized as an Interior Routing Protocol specialized at distributing routing information within one ...


1

STP blocks redundant links in a network. Generally, an Ethernet network is required to form a tree (of arbitrary breadth and depth). Any additional link between nodes in that tree creates a bridge loop, making broadcast frames circulate infinitely: A forwards to B forwards to C forwards to A forwards to B ... (plus causing other problems). The STP algorithm ...


1

PVLAN represents an entirely different model of enforcement than ACL's (which, themselves, are potentially several different models - ex VACL vs PACL vs RACL). PVLAN can even potentially coexist with ACL's. To recap - there are three different types of ports with PVLAN- Isolated Ports: Receives any traffic transmitted on the primary VLAN. Any traffic ...


1

While you can use ACLs to restrict IP packet traffic within a VLAN, a private VLAN works on the frame and port level, regardless of which network-layer protocol is used. So, private VLANs are somewhat more restrictive, but let you control the switched path within a VLAN (L2) only. You cannot use a private VLAN to filter routed traffic across VLANs, over an ...


-1

Both SSL & IPsec site-site have they own significants coming to SSL vpn provides confidentiality, authentication , intigrety of data traversing through this tunnel.. It use both symenttric and asymmetric key alogarithams (both private and public public key infrastructure).; Digital certificate is used to authenticate both Peers a secure tunnel is ...


3

Those two have nothing to do with each other. Site-to-site refers to what you are connecting. In this case, you are connecting two networks. The opposite of site-to-site would be "mobile access" or sometimes called "road warrior": connecting a single device to a network. It doesn't make sense to talk about security, because this simply ...


1

There's IPsec and there are many VPN protocols based on SSL/TLS. The former is more popular for site-to-site and the latter for mobile access - but you can use them either way, SSL VPN and site-to-site are not at all mutually exclusive. Since there's no one SSL VPN, you can't say which is more secure. Any decent encryption using AES-128 CGM with SHA128 or ...


0

The native vlan is the vlan to which untagged traffic belongs. When transmitted, the frame may or may not have a tag. Most switches default to untagged, but there are exceptions. (e.g. the 40G ports on the "ALE" expansion module of a nexus 9300 series switch.) The default vlan is the vlan to which a port belongs absent explicit configuration. In ...


2

What you want to do will not work the way you envision. You cannot have overlapping networks separated by layer-3 without an ugly workaround, e.g. NAT. The problem with that is NAT will break OSPF, among other things. To use the same network and OSPF, you would need to bridge the two sites at layer-2, and that can cause other problems, such as creating ...


2

This is known as the ANDing process Not really. A host does check that the destination address is on the same network or not, and, yes, it performs a bitwise AND with its mask and the destination address to check that, but I'm not sure where you see such a name for that. In any case, The decision of whether or not the destination is on the same network as ...


2

Yes, MSTP and RSTP interoperate. Practically, RSTP works like unconfigured MSTP with a single instance and region.


1

To optimise network connectivity for this requirement can be even accomplished by Router : 1 (example 1800 series) or any high end router, Switch 1: layer3 switch (example Cisco 3850) or any other vendors Switch 2: layer2 switches depends upon number of end users and servers hosted Configurations overview Configuration SVI in layer3 switch number of SVI ...


3

My question is very simple, is there a universally recognized standard for NEWTORK design CAD symbols which will cover all possible or frequent components ( firewall, switch, router, wifi antenna, DB, Backup disk, fiber/Ethernet cables, Rj45 socket etc etc .. ) and can be used in a plan for example ? Your question is not as simply as it may appear. There ...


2

Is there a universally recognized standard for NETWORK design CAD symbols which will cover all possible or frequent components ( firewall, switch, router, wifi antenna, DB, Backup disk, fiber/Ethernet cables, Rj45 socket etc etc .. ) and can be used in a plan for example ? In a word, No. Network engineering is not a formal discipline like electrical ...


1

The requirement for OpenVPN connections is the biggest constraint. Yes, you should be able to do all that using one Linux box. You'll want to configure multiple routing tables, or use ip route 2 source-routing features, to help you achieve the desired behavior. I think the Super User section of Stack Overflow will be a better place for a detailed ...


1

You should note that CSMA/CD is all but obsolete. It was used with (repeater) hubs and half-duplex links and only for 10 and 100 Mbit/s. Modern networks are switched throughout and use full duplex. Gigabit speed is practically considered a given. In packet-switched networks, all data is broken down into packets which are then transferred from source to ...


1

It's basically depend upon how your network design and implemented . Assuming and consider for below options if both buildings are connected with layer2 switches and one switch is connected with router in this case you don't required any routing protocols on switches . Just enable default route in router for internet connectivity and configuration sub-...


1

Assuming that if your are using layer 3 switch connected as main core switch and all VLANS are configured in that switch then you can have fiber connectivity from core switch if you switch don't have SFP port compatibility use media converters and connect as access port and allow specific VLAN and connect to another layer 2 switch in another building if ...


2

Router-on-a-stick means you trunk all VLANs to Router-PT and route between them there. Assuming the router or its downlink is a bottleneck, the easiest way to improve performance is to replace the L2 switch by an L3 switch. Configure VLAN interfaces at the switch and activate routing between them. Point the switch's default route to Router-PT. The advantages ...


1

For this network implemention devices required 1) cisco2901/K9 router 2) C2960 24 port switch Use cat 6e cables for this connectivity Router costs 13000 inr+ switch costs 25000 Important Configuration: Router(config)# int f0/0 #no ip address #no shutdown Router(config)#intf0/0.10 #encapsulation dot1q 10 Ip address 192.168.10.1 255.25&.255.0 #no ...


2

When computers sends packets to the server, how the wifi AP manages the paquets? It really does not. A WAP is a bridge, like a switch, and it bridges frames. Unlike an ethernet switch, which is a transparent bridge (all interfaces are the same layer-2 protocol), a WAP is a translating bridge that translates Wi-Fi frames to ethernet frames, and vice versa. ...


Top 50 recent answers are included