/r/Cisco
Ask questions, create discussions or post news! This subreddit is for all things Cisco related!
New user accounts are moderated.
This subreddit is not affiliated with Cisco Systems.
The Reddit Cisco Ring
- Cisco
- CCNA
- CCDA
- CCNP
- CCDP
- CCIE
Useful Links
Rules
NOTE: The "Reddit Cisco Ring", its associates, subreddits, and creator "mechman991" are not endorsed, sponsored, or officially associated with Cisco Systems Inc. All opinions stated are those of the poster only, and do not reflect the opinion of Cisco Systems Inc., or its affiliates.
/r/Cisco
I have a 10 tenant office building that I want to provide wifi to. All on separate vlans. I don't want to babysit and administer these tenants(like managing user accounts or MAC addresses for wireless printers, etc) -I just want to hand out 10 unique pre shared keys, tell them what the ssid is and let them go-and they're secure on their own vlans. What's Meraki’s best solution for this? I can probably get away with 2 AP's for the whole building. It's all wood construction. I've done some tests on existing wifi and can connect 2 floor east to 1st floor west with decent receptions-and that's with residential grade router.
I have a single layer 3 switch with SVI vlan 10 and 50.
VLAN 10 is for data and vlan 50 is where my streaming server lives.
Do i need to configure PIM sparse mode and RP ?
Hello, I have a bunch of windows servers on the WAN network. They all have a second NIC on a private isolated RFC 1918 switch in a 192.168.1.X and they all have dozens of devices on the pro switch. Is there anyway that I can remote monitor those Cisco switches, especially from a central point? Was considering grafana we’re trying to figure out more options. Thanks very much in advance for any input or advice or help on this. I appreciate it.
Hi Everybody!
I'm in trouble with these new AP's bridge settings.
In fact i have to tune the radio settings.
I have a bridge system with one root and 4 mesh aps.
All of them are connected to the WLC (9800), mesh tree is fine.
The issue is with there is lov signal strength in the area...
Backhaul is on slot 1 5GHz with custom channel settings on root side.
I've installed antennas to slot 5,6 and tri band / dual radio mode is enabled on all APs.
Client access on backhaul is disabled (it wasn't working well...)
So on the slot 2's radio i can't change the channels and width bc it always says that "Slot-id 1 - Dual 5G channel 100MHz spacing and UNII-2 Extended Channels(100-144) violation on channel".
Why can't i set the second 5gig radio individually for access??
What is the right parameters for mesh APs to provide good quality access wifi network for clients?
Thanks in advance!
Network
Modem(DHCP for 192.168.0)>Router(10ports)(DHCP for 10.0.10.0-10.0.80.0)>Switch(8ports Unmanaged)
Modem IP:192.168.0.1
Router Gigbit9(Connected to modem): MAC Bridged to PUBLIC_STATIC_IP
GiG1-7: Vlans 10.0.10.1-10.0.70.1
I want to change GigabitEthernet1 so it has access to the 192.168.0.0 network
###############################################################
Current configuration : 7427 bytes
!
! Last configuration change at 20:09:46 UTC Sun Feb 2 2025
!
version 15.7
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname AvatarRT01
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
ip dhcp excluded-address 10.0.10.1 10.0.10.10
ip dhcp excluded-address 10.0.20.1 10.0.20.10
ip dhcp excluded-address 10.0.30.1 10.0.30.10
ip dhcp excluded-address 10.0.40.1 10.0.40.10
ip dhcp excluded-address 10.0.50.1 10.0.50.10
ip dhcp excluded-address 10.0.60.1 10.0.60.10
ip dhcp excluded-address 10.0.70.1 10.0.70.10
ip dhcp excluded-address 10.0.80.1 10.0.80.10
ip dhcp excluded-address 10.0.10.100 10.0.10.254
ip dhcp excluded-address 10.0.20.100 10.0.20.254
ip dhcp excluded-address 10.0.30.100 10.0.30.254
ip dhcp excluded-address 10.0.40.100 10.0.40.254
ip dhcp excluded-address 10.0.50.100 10.0.50.254
ip dhcp excluded-address 10.0.60.100 10.0.60.254
ip dhcp excluded-address 10.0.70.100 10.0.70.254
ip dhcp excluded-address 10.0.80.100 10.0.80.254
!
ip dhcp pool Vlan1
import all
network 10.0.10.0 255.255.255.0
domain-name Avatar.Local
dns-server 8.8.8.8 8.8.4.4
default-router 10.0.10.1
lease 0 2
!
ip dhcp pool Vlan3
import all
network 10.0.30.0 255.255.255.0
domain-name Avatar.Local
dns-server 8.8.8.8 8.8.4.4
default-router 10.0.30.1
!
ip dhcp pool Vlan4
import all
network 10.0.40.0 255.255.255.0
domain-name Avatar.Local
dns-server 8.8.8.8 8.8.4.4
default-router 10.0.40.1
!
ip dhcp pool Vlan5
import all
network 10.0.50.0 255.255.255.0
domain-name Avatar.Local
dns-server 8.8.8.8 8.8.4.4
default-router 10.0.50.1
!
ip dhcp pool Vlan6
import all
network 10.0.60.0 255.255.255.0
domain-name Avatar.Local
dns-server 8.8.8.8 8.8.4.4
default-router 10.0.60.1
!
ip dhcp pool Vlan7
import all
network 10.0.70.0 255.255.255.0
domain-name Avatar.Local
dns-server 8.8.8.8 8.8.4.4
default-router 10.0.70.1
!
ip dhcp pool Vlan8
import all
network 10.0.80.0 255.255.255.0
domain-name Avatar.Local
dns-server 8.8.8.8 8.8.4.4
default-router 10.0.80.1
!
!
!
no ip domain lookup
ip domain name Avatar.Local
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
domain Avatar.Local
!
redundancy
!
no cdp advertise-v2
no cdp log mismatch duplex
no cdp run
!
interface GigabitEthernet0
description Vlan 1
no ip address
spanning-tree portfast
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
description Vlan 3
switchport access vlan 3
no ip address
spanning-tree portfast
!
interface GigabitEthernet3
description Vlan 4
switchport access vlan 4
no ip address
spanning-tree portfast
!
interface GigabitEthernet4
description Vlan 5
switchport access vlan 5
no ip address
spanning-tree portfast
!
interface GigabitEthernet5
description Vlan 6
switchport access vlan 6
no ip address
spanning-tree portfast
!
interface GigabitEthernet6
description Vlan 7
switchport access vlan 7
no ip address
spanning-tree portfast
!
interface GigabitEthernet7
description Vlan 8
switchport access vlan 8
no ip address
spanning-tree portfast
!
interface GigabitEthernet8
description Vlan 9
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet9
description $ETH-WAN$
ip address PUBLIC_IP 255.255.254.0
ip access-group ICMP in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly in
ip tcp adjust-mss 1452
duplex auto
speed auto
no cdp enable
arp timeout 180
!
interface Vlan1
description Vlan1
ip address 10.0.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan2
description Vlan2
ip address 192.168.0.3 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan3
description Vlan3
ip address 10.0.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan4
description Vlan4
ip address 10.0.40.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan5
description Vlan5
ip address 10.0.50.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan6
description Vlan6
ip address 10.0.60.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan7
description Vlan7
ip address 10.0.70.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan8
description Vlan8
ip address 10.0.80.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat pool NAT_HOST 10.0.80.252 10.0.80.252 netmask 255.255.255.0 type rotary
ip nat inside source list 1 interface GigabitEthernet9 overload
ip nat inside source list 100 interface GigabitEthernet9 overload
ip nat inside source static tcp 10.0.80.252 25565 interface GigabitEthernet9 25565
ip nat inside source static tcp 10.0.80.252 80 interface GigabitEthernet9 80
ip nat inside source static tcp 10.0.80.252 443 interface GigabitEthernet9 443
ip nat inside source static tcp 10.0.80.252 5998 interface GigabitEthernet9 5998
ip nat inside source static udp 10.0.80.252 5998 interface GigabitEthernet9 5998
ip nat inside source static udp 10.0.80.252 5999 interface GigabitEthernet9 5999
ip nat inside source static tcp 10.0.80.252 5999 interface GigabitEthernet9 5999
ip nat inside source static udp 10.0.80.252 9901 interface GigabitEthernet9 9901
ip nat inside source static tcp 10.0.80.252 9901 interface GigabitEthernet9 9901
ip nat inside source static tcp 10.0.80.252 9900 interface GigabitEthernet9 9900
ip nat inside source static udp 10.0.80.252 9900 interface GigabitEthernet9 9900
ip nat inside source static tcp 10.0.80.252 54230 interface GigabitEthernet9 54230
ip nat inside source static tcp 10.0.80.252 54231 interface GigabitEthernet9 54231
ip nat inside source static tcp 10.0.80.252 54001 interface GigabitEthernet9 54001
ip nat inside source static tcp 10.0.80.252 54002 interface GigabitEthernet9 54002
ip nat inside source static udp 10.0.80.252 54230 interface GigabitEthernet9 54230
ip nat inside destination list PORT_RANGE pool NAT_HOST
ip route 0.0.0.0 0.0.0.0 24.49.12.1
ip route 192.0.0.0 255.0.0.0 192.168.0.1
!
ip access-list extended PORT_RANGE
permit tcp any any range 7000 7500
permit tcp any any range 9000 9012
permit udp any any range 7000 7500
permit udp any any range 9000 9012
!
ipv6 ioam timestamp
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 10.0.10.0 0.0.0.255
access-list 1 permit 10.0.20.0 0.0.0.255
access-list 1 permit 10.0.30.0 0.0.0.255
access-list 1 permit 10.0.40.0 0.0.0.255
access-list 1 permit any
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
vstack
!
line con 0
logging synchronous
no modem enable
line aux 0
line vty 0 4
login
transport input none
!
scheduler allocate 20000 1000
ntp server 34.208.249.133
ntp server pool.ntp.org
!
!
!
!
!
!
end
AvatarRT01#
I do practice after watching the video of the concepts but after sometimes i barley remember it or how can i implement it
Hi there, looking for a bit of a hand here. I managed to bag a few server grade devices ( ucs c200, catalyst 3500, cisco 2180s, a couple of dell poweredge and other stuff) for free and I've been hopefully looking to deploying one as a personal could server. I currently can get the Dell poweredge r720 to do what I like but I'd much rather use the cisco ucs c200 m2. I've done some uni work with the cisco networking academy but cannot get this to respond whatsoever.
I believe this server to contain a mezzanine card for raid. For whatever reason when I press ctrl+r to go to the raid config the raid properties are greyed out. I've been into the bios to check if the raid controller has been disabled (which it hasn't) and have no control other than viewing the disks in the server. I also have tried the cimc to help but give so more control than using the bios itself.
And help would be greatly appreciated
I have a Cisco SG350-24MP and two AP2802i running on Mobility Express 8.10.151.
I want to set up one AP as the master and two VLANS, which will lead to two separate WiFi networks (home and guests).
I configured my switch like this:
-VLAN:
-Management 99, PrivateHome: 30, Guests: 20.
-Port membership: GE25 Trunk, allow all VLANs, Native VLAN: 1. This one goes from the switch to my router, which will in the future only provide the internet connection.
-GE11, GE12: Trink, Native VLAN: 99 (Management), Tagged VLANs: 20 and 30 (my two AP will be connected here, and they will be send out two ssid's).
-IP Config:
-VLAN 20: 192.168.20.1, Mask: 255.255.255.0
-VLAN 30: 192.168.30.1, Mask same as above
-VLAN 99: 192.168.99.1, Mask same as above
DHCP Server Enabled
-Network Pools:
-Home: Network Mask: 255.255.255.0, Pool start and stop: 192.168.30.10 - 192.168.30.254, Default Router IP(Gateway): 192.168.30.1
-Guest: Network Mask: 255.255.255.0, Pool start and stop: 192.168.20.10 - 192.168.20.254, Default Router IP(Gateway): 192.168.20.1
-Management: Network Mask: 255.255.255.0, Pool start and stop: 192.168.99.20 - 192.168.99.200, Default Router IP(Gateway): 192.168.99.1
Access Control:
-ACL List Guests (Binded to VLAN 20 Guests, default action deny any): Guests have no access to the internal management network running on 99 or any other internal networks.
Source IP: Deny 192.168.20.0
Source Mask: 0.0.0.255
Destination IP: 192.168.0.0
Destination Mask: 0.0.255.255
Action Deny.
Internet Access:
Source IP: Deny 192.168.20.0
Source Mask: 0.0.0.255
Destination IP: 0.0.0.0
Destination Mask: 255.255.255.255
Action: Permit
-ACL List Private Home (Binded to VLAN 30, default action deny any): Full internet Access and no restriction.
Only one rule, Internet access from above with IP 192.168.30.0
I Setup my AP with the following Settings:
Management IP Address
192.168.99.2
Management IP Subnet 255.255.255.0
Management IP Gateway 192.168.99.1
I create an SSID and under 'VLAN & Firewall' I setup Native VLAN ID to 99, Use VLAN Tagging Yes, DHCP Scope None (it is grey) and VLAN ID 30 (for my home net) and another ssid with VLAN ID 20 for my Guest net).
The problem is that the connection takes forever from my devices and my AP stays blue after I connected for example my tablet. Also Internet is not working.
Did I miss something during the setup configuration? Oversee anything? I am kind of at a loss here (note I am new to cisco stuff).
Is it possible to change email?
I have my certs tied to my Gmail account and want to abandon Gmail and switch to a different email provider.
Hello could anyone help me on this question...
Design a network topology diagram for a small business with four departments: IT (49 employees), Sales (50 employees), Marketing (25 employees), and Administration (23 employees). Each department requires access to the company's internal servers. Prepare a three-tier network architecture (core, distribution, and access layers) using appropriate networking devices. Justify your choice of devices. (10 marks)
Given the IP address block 192.168.0.0/24, design subnets for the four departments im the network topology you created earlier. Develop a subnetting plan that efficiently uses IP addresses while providing sufficient addresses for each department. Include a detailed subnetting table showing the network address, subnet mask, first and last usable IP addresses, and broadcast address for each subnet. Justify your subnetting decisions. (10 marks)
Configure the network devices required for the topology in Question 1 to ensure that each department can communicate with others and access the company's internal servers. Choose and configure a suitable protocol for efficient inter-department communication. Create VLANs to segregate network traffic between departments and optimize network performance. Additionally, configure DHCP for dynamic IP address assignment and DNS for name resolution. Clearly document your configurations. (10 marks)
I have submission on tomorrow please anyone....???
What's the magic fix hear? Tried SLA monitors on both the public IP of the AWS public IP from the ASA and interesting traffic from an AWS remote IP and the VPN tunnel continues to drop after 60 mins of no activity. DPD detection on the AWS side is none and tried to disable vpn-idletimeout on the ASA group policy.
Recently came across an issue where an interface was showing a down status and it was resolved by shutting and then no shutting the port. I was just curious why that would resolve the issue? Is this common?
Cisco if you're reading this, please hire some people that have actual lateral thinking skills. I was on hold for 30 minutes to report an issue with ASA Firewall in CML, and the girl kept asking me what business impact it was having. Ultimately I had to hang up the phone because she couldn't "find me" in your system ::rolling eyes:: so I couldn't even open a case with you guys. She kept asking me what the 'serial number' of the ASA device was WHAT? I kept explaining CML is a lab environment and she didn't seem to get that. How are you guys hiring these low quality people? WTF!?
Edit: My main gripe is the girl kept me on hold for 30 minutes. If she simply said there's no support, then I would have hung up and found another way. When I say the support people need lateral thinking skills, its meant to convey basic common sense principles. "We don't offer support for CML." "Okay, thanks, bye." Not "Der, I can't find you. What's the serial #? What business impact is it having?"
Hi All. New Cisco VOIP user. Slowly have learned and configured my voip system. im trying to configure some 7926 phones and 8821 phones to transfer they can just fine by manually entering the number but theres 10 common extensions they send to and they cant have paper on the phones or memorize it so i tried phonebook/speed dial to transfer other extensions but cant figure it out can you help. It says when I try to transfer from the phonebook handle current call first. I just want to click transfer and a list of extensions to popup to send to. Worked on it all day and gave up. Thanks in advanced for your help.
Ok so all PC's from 1 to 5 can ping each other and the router, even the coffe machine, but for some ungodly reason I can ping pc 6 from all pc's but pc 6 can only ping pc 5 and router nothing else, and for some reason when I ping pc 6 from pc 1 I get reply from 192.168.4.2. Please help :(
Hey everyone - I need help with a cisco c9300 L3 Switch ACL configuration.
I want to be able to do the following:
In the end, the following should be the result:
Thanks Everyone!
As part of a discovery job, someone has added a global netconf port rather than just for the specific discovery job. This port now appears as an option under netconf for every discovery job. I can't for the life of me find anywhere to delete this. Please tell me it's possible and where to do it.
Ill try and keep this short and simple and sorry for probably a very simple question.
Our Principal Network Engineer passed away suddenly and never was able to pass down this probably simply knowledge to me.
I need to update our Catalyst 9200L-48PXG-4X switch stacks. They are currently running on version 17.06.06a and was wondering if there is an update path that needs to be followed or if they can be updated to any version that is released without issues? I understand issues can be encountered due to updates, but just wanted to know if there is a path to be followed.
I believe the released mature version is 17.12, but this is kind of new to me and navigating Cisco sites is already a beast of its own.
Thank you for any help you can give.
Hi everyone
on our ISE we have a few Guest users types, depending on the timespan of the account.
But all of a sudden we have started experiencing a strange issue: only if the duration of the account is set to be more than a day, the users will log into the guest portal, it will work for a few minutes and then it gets disconnected. and again and again if they will try logging in again.
only if an operator changes its duration to less than one day, everything works fine.
Never experienced anything like it. What could it be?
thanks everyone.
Network gangsters, i'm labbing a real world scenario im dealing with and wondering if this is possible.
I need to SPAN the circled interfaces to the 'SPAN-COLLECTOR' destination. RSPAN from remote vlan 99 on LAB_DC02SWT01 sends it across the trunk to LAB_DC01SWT01 to the collector just fine. The problem comes with sourcing ports on the switch directly connected to the collector. I can't create another monitor session since an interface can only be the destination of one session. If I try to source the ports, g0/3 and g1/0 on LAB_DC01SWT01 and send to remote vlan 99 destination it doesn't work, like this:
#LAB_DC01SWT01
monitor session 10 source interface Gi0/3 , g1/0
monitor session 10 destination remote vlan 99
Can this be done?
I have an EOL router which is being replaced. But recently the IPSec tunnel has been limited to 1 way traffic. Normally this tells me there is a mismatch in ACL rules. Randomly, the 1-way traffic will reverse and go the opposite way. The tunnel seems to rotate direction every 4-12 hours.
This tunnel was functional for about 7 years until about a month ago when this started. I moved my config to my backup router and same results.
ACL rules look good on both ends, as with the encryption settings. We rolled IKEv2 back to IKEv1 and are experiencing the same result.
The engineer on the other end can't seem to find any issues either looking at our configs.
Running "show crypto ipsec sa" will show encaps increasing when I try to send traffic, but 0 decaps on the direction that's not working. The other end will show 0 and 0.
Wondering if anyone has seen anything like this. Thanks in advance!
I'm noticing a couple of users who move around a lot throughout the day with their laptops having this same issue with their Webex call logs. Previously the issue was just that after a person called them on Webex, their caller ID everything showed correctly- but later the call logs showed that same person as "unknown".
What I learned was that any time these users saw "unknown" in the call logs it was because they weren't signed into "Phone Services" within Webex.
What I'm trying to confirm now (because in our 500+ user environment, no one else is reporting this) - is why the user's Webex "Phone Services" seems to be signing out and back in automatically.
Could it be because the Webex app is coming off a wired connection in their office from a docking station onto a Wifi subnet? Could changing between subnets in general cause Webex to sign "Phone Services" out for brief periods of time? Thanks in advance to anyone who might have some insight on this.
A cheeky request I appreciate, but I’m messing around with an ASA 5516-X in a home lab. I really could do with upgrading its firmware and getting ASDM working on it. This is a second hand device and has no associated service/support contract, so I’m unable to download the software I need through official channels. I need ASA Version 9.16(4) and the latest compatible ASDM image. Is there anyone on here that has access to these and would be prepared to help?
Support is being slow, wanted to see if anyone had experienced this.
Domain has a trust with another domain. Conditional DNS forwarding in place to resolve internally. With Umbrella enabled, DNS resolves via public instead of internally.
Outside of adding the domain via Domain Management (which doesn't seem to fix it unless it takes time), does anyone have any experience with how to allow Umbrella to resolve this internally instead of externally.
Hello,
I have this message on my 9200L with dual power supplies:
Jan 30 2025 08:02:14: %PLATFORM_FEP-1-FRU_PS_INCOMPATIBLE: Switch 1: power supply A is incompatible and will be turned off
Jan 30 2025 08:02:16: %PLATFORM_FEP-1-FRU_PS_SIGNAL_FAULTY: Switch 1: signal on power supply A is faulty
Simple question, which power supply is A? Green or Red. Thanks!
I have problems with the poe of a switch cisco Catalyst 9200L-48P-4X, when I connect an ap unifi model u7 pro max us, does not turn on, but immediately I connect another of the same model if I can turn on but restarts every 2 minutes.
Cisco Catalyst 9200L-48P-4X
Power per port: Up to 60W per port
Total PoE power: 740W
U7-Pro-Max-US
imput 48v
I have a copper SFP Module with an RJ-45 connector. The model is GLC-T and is made by Cisco. I was under the assumption that it should work with my router, but maybe that isn't the case.
When I insert it into my router it gives me the output:
Jan 30 12:05:56.346: %MAINBOARD_SFP-6-INSERTED: Transceiver module unknown SFP is inserted in GigabitEthernet0/1 port.
Jan 30 12:05:56.346: %MAINBOARD_SFP-3-NOT_IDENTIFIED: Unidentified transceiver module in GigabitEthernet0/1 port.
I have tried both "no errdisable detect cause gbic-invalid" and "service unsupported-transceiver". After that I went into its interface and changed the media type to SFP. I get the enabled light LED on my chasis, but the speed LED indicates no activity and I cannot get a successful ping through the port.
Any ideas? Is the module just incompatible? Could someone point me in the direction of one that is? Thank you.
Hi,
I want to get some feedback from people adding Cisco APs through the PnP process.
We have a lot of buildings and sometimes the amount of AP per building can be quite high (eg. 80).
Our current process to make it faster was to develop a script allowing us to scan all S/N using a barcode scanner. That script would then use CCC's REST API to plan AP in the PnP section.
How do you all manage to import a large amount of equipment into PnP ?