Darrell Root
  • Member for 2 years, 11 months
  • Last seen more than a month ago
Usage of 192.168.xxx, 172.xxx and 10.xxx in private networks
Accepted answer
45 votes

RFC 1918 allocates the following for private address space: 10.0.0.0/8 172.16.0.0/12 (not 172.0.0.0/8!!!) 192.168.0.0/16 While those are private, network engineers often use NAT to allow users on ...

View answer
packet routing between subnets on same vlan
Accepted answer
6 votes

Generally you need a router to route between the subnets. One common configuration is to have one router interface with two IP addresses on it in two different subnets (Cisco calls the second one a “...

View answer
VLAN Filtering not working
Accepted answer
5 votes

Your access-map is doing exactly what you told it to do. The 2nd entry matches all traffic to or from RFC1918 address space (including your vlan110!) and drops it. The first thing you need to do is ...

View answer
Reccomended set up for wifi in dense apartment block?
Accepted answer
5 votes

This level of install requires professionals, or at least experience. 1) 87 apartments means deploying dozens of access points (at least 1 per 3 apartments, possibly 1 per apartment, to be sure you ...

View answer
Why the network switch drop the frame acording to ethertype/length?
5 votes

There are multiple types of Ethernet frames. The common ones today are Ethernet-II and 802.3 ethernet. They both start the same but diverge when they get to the ethertype/length field. From ...

View answer
Unknown EtherType
5 votes

Destination MAC address 01:80:c2:00:00:00 is used by spanning tree protocol and is the old 802.3 Ethernet format as Ron answered. Wireshark does a good decode. Logical link control field 0x42 comes ...

View answer
Can a single subnet work across several switches?
Accepted answer
5 votes

Yes. You don’t even need a trunk. If all ports on both switches are access ports on Vlan 3, then the port connecting the two switches are on Vlan 3 and both switches form one broadcast domain on that ...

View answer
Cisco Nexus 9300 TCAM carving
Accepted answer
5 votes

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX-...

View answer
Why ICMP Destination Port Unreachable error messeage is generated for unreliable UDP packets?
Accepted answer
5 votes

From ICMP RFC 792: If, in the destination host, the IP module cannot deliver the datagram because the indicated protocol module or process port is not active, the destination host may send a ...

View answer
How can I legally get a software upgrade for my Cisco Wireless controller without a service contract so it supports my more recent access-point?
Accepted answer
4 votes

Cisco's policy is to offer free software upgrades for security vulnerabilities. They only let you get the feature set you already have, and they give you the smallest "feature version" ...

View answer
What does a VPN Tunnel offers other than encryption?
Accepted answer
4 votes

Tunnels change the network topology. They let routers A and B be logically adjacent even if they don’t have a physical connection. They also let you run one type of network over another type of ...

View answer
Cisco ASA and a Router?
Accepted answer
4 votes

It is good to use devices for what they are designed for. Routers are good at routing protocols and using one where you connect to the ISP (and perhaps run BGP) is correct. Switches are good and ...

View answer
CDP neighbor discovery
Accepted answer
4 votes

Ricky Beam's comment is the answer. The Cisco originates CDP (Cisco Discovery Protocol) because it is Cisco. HP and Aruba do not originate Cisco Discovery Protocol because they are not Cisco. They ...

View answer
Unexpected bytes in AS_PATH BGP attribute
Accepted answer
3 votes

Answering #2: Why are ASN 56779 and ASN 8905 repeated. The number of AS hops is a key factor in determining which path traffic takes. Lets say you are running a dual-homed enterprise with a 10-gig ...

View answer
ASA shows Action:Drop on packet-tracer, no reason or phase
Accepted answer
3 votes

It is because you are dealing with ICMP which terminates at an interface on the Asa. In addition to your ACL, you need to permit to the interface with this command “icmp permit 100.0.10.0 255.255.255....

View answer
Switch Stacking and Redundancy
3 votes

In theory, a hardware failure on one member of a switch stack will only cause the physical interfaces of that member switch to go down. Uplinks and access ports on other switches will remain online. ...

View answer
Why not put unicast address in IPv6 packet containing NDP neighbor solicitation instead of solicited-node multicast address?
Accepted answer
3 votes

The purpose of IPv6 neighbor discovery is to take a known IPv6 address on an attached subnet and obtain the corresponding MAC address. That enables you to encapsulate a L3 IPv6 packet in a L2 frame ...

View answer
Filter tagged route to downstream routers
Accepted answer
3 votes

You are correct to attempt your filtering on a ABR router ospf 1 ... distribute-list route-map RMAPDENYEIGRP in The distribute-list command above does not stop the propagation of OSPF LSA's in ...

View answer
Which port determines the protocol?
3 votes

+1 to Ron’s answer. “Protocol” has a very precise meaning to network engineers because that’s a specific field in the TCP/IP network stack. More generally, software engineers refer to a “protocol” ...

View answer
Why are session states synchronized with high availability?
3 votes

Consider a network device with an “outside” interface which has both ingress and egress access lists applied. If the device is a stateless router, ingress traffic is evaluated against the ingress acl ...

View answer
OSPF between Cisco & PFsense
Accepted answer
3 votes

Insufficient reputation to comment but I think I've got a good observation here. You said this: Cisco OSPF has area 0 with 10.0.0.0/24. PFsense OSPF has area 0 with 10.0.0.0/24 But take a look at ...

View answer
What my traceroute only list one hop?
Accepted answer
2 votes

Based on your diagram, it looks like the "gateway switch" is one device (a router) with multiple IP addresses: 172.18.32.254 and 102.10.10.254. Your server 102.10.10.1 originates the first traceroute ...

View answer
Egress filtering by blocking unused ports
Accepted answer
2 votes

The first thing you need to do is categorize the hosts/networks inside your company: Desktop hosts (used by employees for web surfing) Datacenter hosts (used by specific applications for specific ...

View answer
When a packet is received, how does it know which internal machine to send it to?
2 votes

Clarifying your question here, you have a network device which is performing NAT (Network Address Translation) or possibly PAT (Port Address Translation). When the reply packet comes in, how does the ...

View answer
Permit ping and traceroute and deny all other services using an ACL
2 votes

First, I'd prefer to apply the ACL inbound on Hermes rather than outbound on Bono. That way "the network protects itself" rather than "I depend on the upstream network to defend this network". But ...

View answer
Cisco ASA5585-X replace SSP-20 with SSP-60
Accepted answer
2 votes

Per this document Cisco ASA 5585-X Hardware Installation Guide https://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/5585guide/5585Xhw/overview.html dated December 14 2017: Note Online ...

View answer
Tx and Rx network metrics
2 votes

You cannot calculate bandwidth utilization from that data. It is showing you number of packets received or transmitted since the last time the counters were reset. It does not show you: The average ...

View answer
How does a Hub work when sending broadcast packages?
2 votes

Hubs are layer 1 devices. As they receive electrical impulses constituting a frame, they forward them out all ports other than the receiving port. This is regardless of whether the l2 destination is ...

View answer
Why ip nat {in,out}side?
2 votes

“ip nat inside” and “ip nat outside” on the interface is what triggers NAT processing. Once NAT processing is triggered you look for your “IP nat inside source list LAN_ACL...” command to identify ...

View answer
How does a computer know IP address of a computer on another network
2 votes

In the old days, all hostname -> IP address mappings were listed in a local file /etc/hosts. But as the Internet grew (we're talking 1970's/1980's here) that didn't scale and the domain name system ...

View answer