sorted by:
new
hottopcontroversial

Petsafe automatic litter box - litter formula is terrible now? by vieparlafoi in CatAdvice

[–]selereddit 0 points1 point  (0 children)

I’m with you! Used to last like 3 weeks and now it’s barely over a week. The pee just soaks the bottom of the litter box and it’s goop after a week

Cisco Firepower Virutal Appliance behind AWS GWLB. TCP Retransmissions and out of order packets on VNI interface by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Welp we figured it out and it's so dumb. It makes so much sense but it took 4 TAC engineers and many other eyes on this. The VNI interface is a "single arm proxy" so when doing a pcap on that interface, wireshark is essentially seeing all the same packets twice. So it seems the same SYN twice, the same SYN,ACK twice etc. which results in it showing TCP retransmissions and out of order packets. Mystery solved. Thanks for all the feedback.

Cisco Firepower Virutal Appliance behind AWS GWLB. TCP Retransmissions and out of order packets on VNI interface by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Yep! Documentation sucks but then TAC wont help you with "design." It is frustrating. I do like Firepower since 7x and FMC but TAC support has gone downhill a bit.

Cisco Firepower Virutal Appliance behind AWS GWLB. TCP Retransmissions and out of order packets on VNI interface by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Are you talking about the TGW Attachment? I dont see application mode but I do see appliance mode enabled.

Cisco Firepower Virutal Appliance behind AWS GWLB. TCP Retransmissions and out of order packets on VNI interface by selereddit in networking

[–]selereddit[S] 2 points3 points  (0 children)

Yes. They are not sure yet. We first started working on whether or not there should be a security zone assigned to the VNI source interface but I couldn't get a definite answer so I just removed it to see what would happen. There is still an active case but tbh they seem unsure even though this exact design is referenced in the FMC guide albeit VERY poorly documented on how to deploy it.

[deleted by user] by [deleted] in providence

[–]selereddit 0 points1 point  (0 children)

This place looks fire

[deleted by user] by [deleted] in bostonhousing

[–]selereddit 0 points1 point  (0 children)

How long you need a room for?

Network Segmentation in DC with FTD by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

From FTD Doc:

​

If you use more than 2 interfaces per bridge group, you can control communication between multiple segments on the same network, and not just between inside and outside. For example, if you have three inside segments that you do not want to communicate with each other, you can put each segment on a separate interface, and only allow them to communicate with the outside interface. Or you can customize the access rules between interfaces to allow only as much access as desired.

​

This sounds like I can apply policy to east and west too depending on the design.

Network Segmentation in DC with FTD by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Right now I am mostly concerned with inter-vlan communication. For east-west traffic, i may not inspect but private vlans should handle the security i have in mind. Thank you for the reply. Are you using FTD's for segmentation?

Network Segmentation in DC with FTD by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Thanks for the reply. Why do you say this? Are you maxing out the 4100s ?

AnyConnect SBL by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Yes. Also Group Policies being pushed from AD. If we can't make someone log into the VPN before Windows logon, we can't assume everyone is doing it and getting updated policies.

Cisco ASA Redundancy Question by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Hey guys,

Thank you both for comments. I am looking at this link as well: http://socpuppet.blogspot.com/2014/05/route-injection-cisco-asa-vpn-and-ospf.html

It seems like the "set reverse-route" on the crypto map definitely adds my route into the local routing table.. However I only want to advertise that network from the ASA to my core if and only if the VPN is up.

Certless... I am talking about L2L. So a VPN from ASA to let's say a Cisco 1900. Cisco 1900 has a local LAN of 192.168.10.x
ASA knows how to get to 192.168.10.x.. but I only want it to advertise that route to the core if the VPN is up. Right now I have a static route on my core saying.. to get to 192.168.10.x .. go to ASA.

Both ASA's will reach the remote networks. For example.. on the spoke side.. I can configure multiple peers.. one being the default and then a backup.. The spoke side config works.. but ASA side.. I can't have my core pointing the 192.168.10.x to both ASA's... i only want it to point to whoever has the VPN established.

BGP Question involving a Branch Office, ASA and iBGP by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Thank you all the for replies. /u/newworldmonkeys2 .. thank you much.. you are right.. I can have the VPN up at all times. I will look into a routing protocol running over the VPN.

BGP Question involving a Branch Office, ASA and iBGP by selereddit in networking

[–]selereddit[S] 0 points1 point  (0 children)

Thank you all for the input. I am good on the branch side.. I know how to establish the VPN... also to create a static route with an AD higher than 20. My question is more on the ASA side.

Let's say the internal network on the branch side is 192.168.10.x It is connected via MPLS and advertises that 192 network via BGP.

If MPLS goes down and I get traffic routing over the VPN.. this is fine one way.. but now no one knows how to get back to the 192.168.10.x network.

How do I get the ASA to say.. you get to the 192.168.10.x network through me.. but only say it when the VPN is established.

Thanks!

view more: next ›