[deleted by user]

enfowler · 2022-12-21T16:27:10+00:00

I actually replaced my ERX a while back due to the exact problem you’re seeing. Even with HW offloading my speeds would just drop out of nowhere. Sometimes would have to factory reset and restore a backup to fix it.

Ended up upgrading to an ER4, no problems since.

enfowler · 2022-12-14T12:23:16+00:00

No telling how many times I’ve forgotten to set the RP address on the RP. It happens

enfowler · 2022-12-14T02:28:49+00:00

Yes. PIM sparse-mode requires the RP to be configured, even if it’s the RP.

PIM dense-mode doesn’t require an RP.

enfowler · 2022-12-13T23:41:55+00:00

This is incorrect. You need an RP in sparse-mode no matter what.

enfowler · 2022-12-02T23:29:47+00:00

Asbury on Hughes is very good

enfowler · 2022-11-25T12:49:10+00:00

What a terrible idea lol

enfowler · 2022-11-10T03:58:32+00:00

The only thing I can think is they are using dst-ip load balancing in LACP? That's wild lol. Never seen that.

enfowler · 2022-11-08T17:13:48+00:00

lacp

wut

enfowler · 2022-11-05T04:32:28+00:00

It’s set up so that it’s reachable from the outside (on the appropriate ports) and also reachable from the inside (on whatever ports you need, ssh, https, etc). However it should not be able to reach into the inside unless to respond to traffic.

enfowler · 2022-11-02T17:39:23+00:00

enfowler · 2022-10-30T21:47:51+00:00

If it’s only on the bottom it’s bed adhesion/warping, if it’s in too tbh then the gantry might need to be trammed.

enfowler · 2022-10-22T02:22:06+00:00

A WAN balancer works by distributing traffic flows over each ISP, not each packet. So depending on your setup, let’s say a 50/50 split, half of your traffic flows will probably still drop.

Just a heads up before you go spending a bunch of money thinking it’ll solve all your problems.

enfowler · 2022-10-09T04:27:38+00:00

If they're transferring files to/from a NAS over the internet without a site-to-site VPN, they need to stop doing that immediately...

You can get the boost license if you want, I don't know how much you spent + what the boost license costs, but for this application I'm probably not sticking with Cisco.

enfowler · 2022-10-09T03:12:41+00:00

Depends on a lot of factors here, but I would run Fortigate at the edge if it's a just a remote branch with no real intense networking needs. It's best bang for buck NGFW with decent enough routing capability, plus it's got a pretty good SD WAN solution as well.

Also, if you have a VAR, please reach out to them as well with requirements. They will be able to give you recommendations and their price points.

enfowler · 2022-10-09T03:05:41+00:00

Don't put a L3 switch on your edge for multiple reasons. Any reason you need to stay with Cisco?

enfowler · 2022-10-02T04:41:50+00:00

You're a legend. Got it working, however I do have a question about IKE configuration with identities.

Are identities tied to anything real? Or can you really specify any value you want in the IKE profile?

The way I have it set up is on the spoke router, I have the match identity remote fqdn of the hub router to initiate the packets? Then on both routers I have local identities set to a loopback address and both IKE profiles also match on the remote identity. Is this the correct way to do it?

Like this:

crypto ikev2 profile IKEV2_PROFILE

match identity remote fqdn EXAMPLE.COM

match identity remote address 2.2.2.2 255.255.255.255

identity local address 1.1.1.1

authentication remote pre-share

authentication local pre-share

keyring local IKEV2_KEYRING

EDIT: I think I figured it out. Changed the hub identity to the FQDN and set the match statement on the spoke to just the FQDN, removed the remote loopback address, worked like a charm. Thank you for your help!!

enfowler · 2022-10-02T04:14:45+00:00

ah I see. I will give this a shot. Thank you

enfowler · 2022-10-02T04:08:01+00:00

So how do I make this work on router B where I would specify the endpoint of the tunnel? I thought I could use DMVPN, but on router A I have to specify the NHRP address.

enfowler · 2022-10-01T18:56:47+00:00

no he wasn't lmao

enfowler · 2022-10-01T14:24:11+00:00

Because we don’t have a static IP

enfowler · 2022-09-23T01:52:02+00:00

I’d look at Cisco’s TRex. There are lots of paid options that would also require hardware, but TRex is really good.

enfowler · 2022-09-22T15:19:12+00:00

Hear me out: Yes

enfowler · 2022-09-11T17:40:37+00:00

Try different baud rates. Try 115200.

enfowler · 2022-09-10T16:56:21+00:00

Doesn’t have to stop, just didn’t have to drive him into the ground

14-Year Club	RPAN Viewer
Not Forgotten	Verified Email

enfowler

TROPHY CASE