My EtherealMind» Operation

Basics: Cisco VLAN Trunking Protocol – Transparent Discard and Passing VTP Packets

Greg Ferro — Wed, 11 Apr 2012 20:19:05 +0000

It's a common discussion about when Cisco VTP protocol is actually forwarded through Cisco switches and when it's isn't. I've always gotten it somewhat confused and when I stumbled across some old notes on the topic I had an ah-hah moment. I'm answering the equation about when using VTP in your network, which versions are risky - that's risky is terms of how do you prevent VTP updates from 'crossing' a switch.

My Way of Selecting a Cisco IOS Release With a Bug Scrub

Greg Ferro — Thu, 08 Mar 2012 18:39:05 +0000

Cisco is known for shipping products early to deliver new features quickly. But this leads to a reputation for buggy code which has customers report bugs (and Cisco fixing them). This means that you should never buy a newly released Cisco product unless you are willing to take this risk. This post looks a my process for analysing this risk and then selecting an IOS version by performing a bug scrub. In this case, I've been asked whether the Cisco C3750-X switches are ready for live deployment.

ASA 5520 and ASA 5540 With Only One DIMM Memory Socket – Counterfeit Hardware

Greg Ferro — Tue, 20 Dec 2011 14:54:32 +0000

There is a significant numbers of ASA5110 chassis that have been reworked to look and act like ASA5520 or ASA5540 firewalls. Refer this bug toolkit for more details.

Ethernet Jumbo Frames, Full Duplex and Why Jumbo Frames Are 9000 Bytes)

Greg Ferro — Sat, 03 Dec 2011 16:14:26 +0000

I've been doing some research into Ethernet and the use of Jumbo frames for some content I've been writing and come across something interesting. The documents state that Jumbo frames can only be used on Full Duplex Ethernet connections.

Routing Protocols and Computation in Silicon

Greg Ferro — Sun, 27 Nov 2011 08:57:42 +0000

I got this question and I guess it may not be obvious to everyone so I'll have a shot at answering it.

Technology advances in ASIC hardware have resulted in substantial improvements in switching performances of routers and switches. However, the routing processes are still dependent on CPU speeds. What are the existing limitations in router/switch models which prevent route computations from being performed in hardware?

Modular Data Centre – On the Highway

Greg Ferro — Tue, 22 Nov 2011 15:25:06 +0000

Saw this modular data centre rolling down the highway today.

HP Abolishes Software Licensing for Wired Ethernet Switches

Greg Ferro — Sun, 20 Nov 2011 14:36:07 +0000

HP Networking has announced no more software licenses on their networking kit.

Fibre Connectors

Greg Ferro — Thu, 14 Jul 2011 18:49:26 +0000

A short summary of the Fibre Cable Connectors, description and some notes on usage. This is summary notes and intended for reference.

Those Non-IOS Files on the Flash. Are They Useful ?

Greg Ferro — Wed, 08 Jun 2011 18:15:36 +0000

When you first receive a router from a Cisco warehouse, it comes with a complete collection of IOS add ons. A common question is whether these files are used for anything ?

Cisco IOS: What Is VLAN 1002 – 1005 Used for ?

Greg Ferro — Sun, 05 Jun 2011 12:54:09 +0000

Why does a Cisco IOS SX switch not let you use VLANs 1002 − 1005 ?

EIGRP Goodbye Message

Greg Ferro — Sun, 29 May 2011 17:57:06 +0000

Found this in the Cisco IOS 15.1M manuals today IP Routing: EIGRP Configuration Guide, Cisco IOS Release 15.1M&T Goodbye Message The goodbye message is a feature designed to improve EIGRP network convergence. The goodbye message is broadcast when an EIGRP routing process is shut down to inform adjacent peers about the impending topology change. This feature allows supporting EIGRP peers to synchronize and recalculate neighbor relationships more efficiently than would occur if the peers discovered the topology change after the hold timer expired.

Show Ip Eigrp Topology All

Greg Ferro — Sun, 22 May 2011 13:44:13 +0000

Once upon a time the command was "show ip eigrp topology" to show EIGRP topology, now it's "show ip eigrp topology all" and the old command show only Feasible Successors.

PacketShaper and Flow Directions

Greg Ferro — Sat, 14 May 2011 23:45:16 +0000

I stumbled across an old diagram I made a long time ago about the direction of flows on a BlueCoat PacketShaper. Since I've been looking for it for about three years, I've diagrammed it quickly so that it is here for future reference when I'm working PacketWise in the future. PacketShaper PacketWise is one of my very favourite tools for managing traffic flows, and much preferable to PHB QoS aka DiffServ for many types of use cases. An TCP flow has four possible directional attribute related to the use of a inside and outside networks, and whether the flow was initiated from the client to server which sets the "direction" of the flow relative to the Packeteer. The flow is determined by who initiated the three way handshake. For purposes here, the Client always initiates the TCP connection, and the Server terminates the connection.

TCP Session and Direction

Most people understand the three way handshake, but not many consider the direction of the session.
The connection from the client to the server is outbound, but is inbound on the server. And vice versa, the server outbound session is inbound on the client. That's not very useful for being able to define the direction of flows.

Why is direction important ?

Direction of flows is important if you want to configure asymmetric rules. That is, not all protocols require symmetic bandwidth. For example, HTTP traffic is usually a 10:1 ratio for reply to request. That is, a request for this webpage is about 10KB, but the reply with the data, images and javascript is more than 100KB. For an FTP upload server, you might have the reverse condition where the inbound traffic is far more than the outbound. To make the most of your Internet connection for this case, you could configure the inbound bandwidth on your Internet connection to be 80% FTP, 20% HTTP and the outbound bandwidth to be 20% FTP and 80% HTTP. This gives a far better utilisation, especially in regards to better TCP Windowing and overall TCP goodput.

Why Firewalls Don’t Have Telnet or SSH Clients

Greg Ferro — Fri, 13 May 2011 03:37:13 +0000

I found this on Cyber Corner blog:

Another missing ASA-feature: telnet and ssh client: " Every single decent Cisco-device on earth has the ability to make an CLI-user jump to another device with telnet or ssh. Except the ASA. I really wish that this feature could be added. Right now I am troubleshooting a firewall and from where I am right now the only way in is to SSH to the ASA. I can do whatever I want inside the firewall from my SSH-window, but I need to access a router inside of that firewall, and if this feature wasn´t missing i could simply run 'ssh ip-address' to jump to the switch´s CLI. Am I the last CLI-.guy on this planet? Please, Cisco?

Fate Sharing, Failure Domains and Why VTP Is Awesome

Greg Ferro — Wed, 20 Apr 2011 15:00:10 +0000

A lot of people regard Virtual Trunking Protocol(VTP) as nothing but trouble. Indeed, it's hard to find many people who will implement it on their network. I find this baffling - it's a great tool that dramatically reduces time, errors, and troubleshooting is something that we should all embrace and use wherever we can. Naturally, with great power comes great evil. So, lets be clever instead.

Citrix Branch Repeater : WCCP or Not to WCCP That Is the Question?

John McManus — Tue, 08 Mar 2011 21:05:13 +0000

Whether ’tis nobler in the network to suffer un-accelerated traffic during an outage or to take arms in the form of Policy Based Routing. When you decide to†deploy†Citrix Branch Repeaters (CBR) you have to†deploy†at either end of the WAN to accelerate and compress traffic between these endpoints. Therefore it would seem sensible to have some [...]

Fault Detection in Metro Ethernet

Tony Brown — Sat, 05 Mar 2011 17:08:20 +0000

Following my article on Loop-Free Alternate Routes, Michael McNamara made a good point about some of the issues detecting failure in a Metro Ethernet network. This seems to be a commonly misunderstood problem.

Verifiying IPsec and SSL Performance of ASA Firewall

Greg Ferro — Sun, 27 Feb 2011 15:37:30 +0000

It’s difficult to a get any documentation from Cisco that confirms the forwarding performance of the ASA firewall. However, once you have got a unit, the “show crypto acclerator statistics” is a handy way to verify and check the hardware performance of your ASA. I think that most of this output is self-explanatory so I’m [...]

Cisco IP Traceroute Characters

Greg Ferro — Fri, 25 Feb 2011 17:25:31 +0000

Note to self about Cisco Traceroute characters and what they mean. Directly from the Cisco IOS user documentation.

So You Want to Use a 3750-X as a Router?

John McManus — Mon, 24 Jan 2011 22:04:47 +0000

Easy peasy lemon squeezy This seems a straightforward question! Just load up with advanced IP services license, install the license file and reboot the switch and you should be good to go. Well that’s what I thought until recently when I done the very steps above and on the surface seemed okay but I wanted [...]

Personal Change Control

John McManus — Wed, 19 Jan 2011 15:09:05 +0000

Change Control In many organisations there are processes in place to manage change, depending on the size of the organisation the change control process can be very in depth and frustrating or can be non-existent. I have experienced many people talking about change management process as if it was the root of all evil. What [...]

Licensing Tips for 3750 Stacks

John McManus — Tue, 11 Jan 2011 22:23:46 +0000

Recently I had to upgrade some 3750-x Stacks to Advanced Services and the Cisco documentation was a bit short of advice, and certainly not all in the one place. So here is a quick run down of some key steps.

Cisco IOS SX Storm Control

Greg Ferro — Tue, 11 Jan 2011 13:31:38 +0000

Blurt on Cisco Storm Control

Putty – Fixing Right Click Paste

Greg Ferro — Sun, 09 Jan 2011 14:07:01 +0000

Fixing the Right Click Paste action of PuTTY to prevent mistakes when copy and pasting.

The Case for Network Emulators

Greg Ferro — Sun, 24 Oct 2010 11:04:35 +0000

It's time to start demanding that vendors make their emulators available to their customers so that we can save money, improve customer value, and increase the Networking Market.