Search the Community

Hello LTT forums, I live in France and I'm sharing with this community a project that was proposed by multiple "intervenants" (people who teach us subjects at school) to us who are in a apprenticeship school Our current state in IT infrastructure is limited, meaning only the basics are given to us (access to internet, power and school outlook) The direction has approved of this project with others of the head of our school to engange to deploy a IT infrastructure for our needs in education Since most of us are students, and we learn computer technology, we have to bring our own laptops capable to do emulation (vmware workstation, cisco packet tracer & more) Some of our tutors have been happily discarding their old IT equipement to this project (dell / HPE servers, cisco switches, etc) instead of recycling them or throwing them away. We already have an agreement where we can install a 25u rack with the servers given to us, We would like to host a primary vsphere server that would be for administration, and two secondary ones for the students and teachers to access remotely This would enable the "intervenants" / teachers to prepare in advance courses for classes on subjects of virtualisation or networking, and would also enable us students to connect on the network to discover the technology What would you recommend?

Hi, I’m a little new to all this... So, I want to upgrade my entire network setup at home and I planned to use Ubiquity’s UniFi access points, POE switch and security gateway. I’ll run the UniFi cloud key as a plug-in on my TrueNas. I thought keeping everything to one brand will make a pretty pleasant experience setting up and great for compatibility. However, I’ve come across a good deal on a few of Cisco’s Aironet access points. A few questions came to mind like; Should I consider using the Cisco access points with the Unify switch and gateway? Are they even compatible with each other? Will I need a cloud key for both Cisco and UniFi? Or should I just miss out on a great deal and just stick to a full UniFi setup? Any advice appreciated. Here’s more information about my hardware list: 1x UniFi Security Gateway - USG-EU 1x UniFi POE Switch - USW-LITE8P AND 4x UniFi Access Point - UAP-AC-LR OR 4x Cisco Access Point - AP2802I

Hello! so my friend is selling a Cisco 7609 router for $200 and I didn't know if this was overkill for a server rack that's running two dell m100e blade centers and 5 dell r710 servers along with 2 dell r610 servers. I was looking at 10gbe routers that work with fiber optics and couldn't find much that worked for my needs if anyone knows of any good 10gbe sfp+ routers that would be helpful. because the Cisco 7609 is very big but it can provide the speed for sure. please give me some feed back on what you think I should do it would be greatly appreciated.

Hi Guys, I have a stack of 3 2960-X's and am looking to start using the dedicated management ports on them for out of band management. In theory the stack has 3 management interfaces, however there is only one 'interface FastEthernet0' in the config. Does that mean I have to use the master and am not able to have management failover to the other stack members? I read in the Cisco Docs that you are meant to put all 3 into a hub and then use that, but its 2021 and I dont have easy access to a hub! Please could someone explain what I need to do here?

I'm having a couple of issues with my network, and I have been unable to find any details on how to resolve it. First, let me explain how my network is set up. It is setup fairly poorly, but it mostly works. Our default gateway is a Linksys LRT214 Gigabit VPN Router, that then connects to a unmanaged switch, which breaks it out to an old wifi router which is used as a wap. From there I then have a line that leads to my room (which is quite close). That line ends into another unmanaged switch which connects both my Cisco routers, a couple of 2911s, and my computer. Attached to my first Cisco router is a switch, on a subnet (192.168.33.0/25) that my NAS and a pi hook up to, and my second router for future use (through 192.168.33.248/30). The biggest issue I'm having is internet connectivity in the 192.168.33.0 subnet. It can access the broader internet, but it has a major problem with dropping packets. The packet loss only happens with internet packets. I haven't had issues with packets getting dropped on the local network. I have the routing tables set correctly, and I have added a clause to the Linksys router's ACL to allow packets through from 192.168.33.0. It seems to be intermittent, so I'm not sure what the problem is. The second issue I'm having is with cables. I've made some cables to do cleaner runs for my router, but my Cisco equipment will not establish links over the cables. I thought I wasn't terminating it correctly, but all of our other equipment does work with it. I've made sure auto MDIX is set on my Cisco gear, and I've tried using the correct cable (straight through and crossover) where needed. I have also made sure that my cabling can do the runs. I'm not sure what's wrong, so any help would be appreciated.

Hey guys, I am actually new to networking. I am planning to buy a switch for my home I came across a switch which is cheap by cisco but cannot find many reviews. So can you guys help me with it? I also would like to know if I can set up a VLAN with pfsense on this switch. I don't know whether it is a managed or unmanaged switch. Switch - Cisco SF95D-08-IN 8-Port Thank you

I recently came across a Cisco e1000 V2 and wanted to convert it into a switch using DD-WRT. After confirming it uses this firmware, dd-wrt.v24-44715, I downloaded the "factory flash" one and flashed the router. I then followed this guides advanced instructions but if I change the local IP address, gateway, local DNS, uncheck Use DNSMasq for DNS, check Assign WAN Port to Switch, or disable DHPC Server I lose the ability to connect to the router and configure anything. I'm connected to my network via Wi-Fi and I have the E1000 plugged directly into my PC for configuring it. Clearly I'm doing something incorrectly, if I had to guess from the IT course I'm taking changing the DHCP related settings causes the router to not be able to assign my PC an IP address therefore I cant connect to it and I have to manually configure that somehow, but I have 0 idea how to do that or how to solve my other issues. I'm semi advanced with computers and can provide additional information if needed to help diagnose the issue. UPDATE: After leaving it be after a config change for like 10 minutes it seems I can reconnect and the changes are applied, is that a normal wait time? UPDATE 2: after discovering that I applied all the needed settings in the basic setup page and waited, but it failed to let me connect after quite some time. I unplugged it and plugged it back in which caused it to revert the changes I had made and I can connect again.

GDL 1 and GDL 2 and MEX 01 are computers. It shows that I do not have the Default Gateway set on them. What is it and how do I set it up? I am also sending photos to show what it looks like for me.

Hello! I have just bought a Cisco AIR-CAP3502I-E-K9 accesspoint. I just discoverd that it is controllerbased, however you can download an autonomous version at ciscos offical site, but you need to have a contract and account to download it? Anyone that know how i can get it without a contract?

Hello everyone! I'm a networking student that's planning to redo my vlan and trunks. Currently I've got a 3750X and a 3750G. The 3750X is my "core" while my 3750G hosts my vSphere traffic. I'm looking to redo my VLAN's since only one seems to work anymore. Also, the switches aren't trunked together since they don't necessarily need to communicate with one another. *Side Note*, I may need to reset my switch, my CLI isn't letting in authenticate. I'm able to get into the WebUI however "invalid password" on CLI. My Current VLAN setup: VLAN 10: 10.1.8.0/24 - CoreLAN+WiFi VLAN 20: 10.1.9.0/25 - Active Directory Lab (has active clients) VLAN 30: 10.1.9.129/28 - Guest WiFi (captive portal + WPA2 Personal) VLAN 40: 10.1.9.145/29 - DMZ VLAN 50: 10.1.3.0/24 ? - vSphere + JumpServer traffic (Only on 3750G) *These subnets are subject to change, AD lab needs a /24.* It appears that the only VLAN for WiFi working is VLAN 10. 20 & 30 aren't working (they used to). I have AP's plugged into Gi 0/1/2, 0/1/4, 0/1/6. The trunk port from my firewall is Gi 0/1/1. WiFi SSID's *not real SSID's* Secure - VLAN 10 AD Lab - VLAN 20 Guest - VLAN 30 I need some guidance on how to set this up correctly with the correct native VLAN and trunks. I have no problem assigning the VLAN's to ports, but I don't fully understand how to configure the trunks correctly. Thanks!

I'm terribly sorry if this has been explained elsewhere but I'm kinda at my wit's end. I purchased a cisco 3750-e ws-c3750e-48pd-sf switch off eBay. The thing works absolutely fantastic! I was planning on hooking an sfp+ port into my udm pro for all my local poe cameras and the like. However the switch was flashed back to factory before it was sent out and so the ios/firmware on it won't support a sfp+ adapter that I got for it. The switch has been sunset and so I can't seem to find a way to make this thing functional! Does anyone have any ideas on how to possibly upgrade it just so if anything I could use the sfp+ adapter? (Here's what the adapter is called for reference, CISCO CVR-X2-SFP10G X2 TO SFP+ ADAPTER MODULE)...... Or do I just have a crippled 10gig capable switch?!

Hello! So basically I am setting up a topology, see screenshot: And I want the following adresses: With ground configuration and static routes so they can communicate. With a static default route from R2 to internet. But I cannot get it to work. The PC's wont ping to each other. Can someone help me? Kind regards!

Hello guys, I've got few Cisco AIR-CAP3602I-E-K9 access points from a friend and would like to set them up in autonomous mode. They currently in the lightweight mode / WLC operating system. The problem is, I can't download the image I need without having a contract / puchased APs directly from Cisco. Getting an original cisco image from the internet is nearly impossible.. soo. I was wondering if any of you with Cisco access could download this image for me ->> https://software.cisco.com/download/home/284362257/type/284180979/release/15.3.3-JF14i I know it says "Aironet 2600i Access Point" but according to the product page (https://www.cisco.com/c/en/us/support/wireless/aironet-3600i-access-point/model.html#~tab-downloads) that's the right image. I would appreciate it A LOT! Thanks!

Why can't I find my router on the Internet normally? The most popular company that makes a router is Cisco, so I looked on their website, it is not even there. Which router is right for school now? To serve the entire building 2 floors in all classrooms 1 computer for the teacher. 5 IT rooms with 20 computers each. Requirements: DSL WAN port Integrated managed switch: 8 ports 10/100 BASE-T Wireless network: 802.11ac Integrated firewall SNMP support VPN / IPSec tunnels Virtual LANs Are these requirements that I wrote up to date, or are some other technologies required now?

Hello all, I come to seek help and suggestions from you all. Currently I have an MSI B-450 A Motherboard. The latest Chipset drivers from AMD are installed as well as the latest UEFI version. Windows 10 1909 is installed as of now. (I will be updating now to eliminate this being an issue) Currently installed on the board in PCI-e slots are: NVMe drive, GTX 1070, and newly Cisco VIC 1225 Fiber Channel card in that order. The Cisco card is also installed in an R2 server I own with no issues. The latest Drives are installed from Cisco (4.2) The Card Functions as it should Only when I go into UEFI and change a setting for PCI Express, it tends to not matter what setting. For example, changing the lane size from 8x8 to 4x4x4x4 then booting to windows 10 will make the card function. Then upon restart with the same settings will get driver error and no card will show up on device manager. I have tried different settings to see if anything sticks but no luck. VEN 1137 = Cisco DEV 004E = VIC 82 PCIe Upstream Port I am also aware of this post from Cisco containing a bug, but I do not believe to be part of my issue, due to this problem occurring with these steps taken still. The only other things I can think to try are updating windows 10 to 21H2 (Idk what good that will do) or switching the physical locations of the cards. I have also tried Hack Flags in the registry, but it does not actually fix the issue. The main thing here is, what is actually causing the issue? Cisco? MSI? AMD? Windows? Meee? I know Cisco will give me a big fat L for my troubles. Thank you for any suggestions. EDIT: Windows 10 has been updated to 21H2 with no change

DMVPN is mentioned in the official CCNA guide and also in the CCNP (specifically Routing and Switching I'm talking here) but it isn't really listed to configure in the exam topics for the CCNP route. The exam blueprints state you need to 'Describe' but if you've ever attempted a Cisco exam before then you might know, that doesn't mean you might get a question related to the configuration side. We are going to be looking at a simple lab with some theory behind DMVPN without the encryption, but a basic explanation what DMVPN is: DMVPN (Dynamic Multipoint VPN) isn't a protocol within itself, but is crafted by the various protocols used together to achieve what DMVPN does. It allows us to create a hub-spoke like topology with spokes being able to dynamically form a VPN between other remote spokes and the Hub. The protocols that create DMVPN: -Multipoint GRE -NHRP -A dynamic routing protocol (common: EIGRP or OSPF) IPSec is also a common protocol used but it isn't actually a requirement (although it is preferred since running plain GRE isn't the best idea...). Technically you don't actually need to run a dynamic routing protocol and have static routes but again it is very common to see a dynamic routing protocol. Before moving onto a basic introduction to configuration and the design, DMVPN can scale very large (thousands of remote sites) and not only allows our spokes with dynamic IP addresses to participate in the design but also the configuration is very effective instead of creating static tunnels for loads of remote sites. The single hub topology design This topology will use the internet as the underlay to transport our packets, although we will create an 'overlay' using multipoint GRE to carry our site traffic (10.x.x.x) using EIGRP. In DMVPN, we use the terms 'underlay' and 'overlay' a bit similar to GRE over IPSec where IPSec is used as the protocol to transport GRE otherwise we will have no protection. GRE is normally used to transport different traffic since IPSec itself can only carry unicast traffic, it you want to take advantage of multicast and other types of traffic then you can encapsulate with GRE and then send it over the IPSec tunnel as a unicast packet. In our case, we could even just use IPSec without GRE and just define the neighbors in our routing protocol so our updates and hellos etc.. are sent via unicast instead of multicast, that bypasses the learning and fun we'll see in this post! Multipoint GRE Why not use typical GRE point to point tunnels? Firstly, this defeats the whole purpose what DMVPN achieves, it allows us to manage our design with ease and dynamically form tunnels with remote spokes and with the HUB. If we have a static tunnel configuration, think about it we need X amount of tunnels configured on the HUB depending how many spokes are in our design and then a tunnel from the spoke to the HUB, and then finally a tunnel from SpokeX to every single other spoke that exist if you need Spoke-Spoke communication without traffic traversing through the HUB. Multipoint GRE allows a single tunnel configuration to then dynamically form tunnels without the need of loads of 'interface tunnel x' in the configuration. It can take the configuration of the single interface and then use NHRP to dynamically form tunnels to other routers. NHRP Next Hop resolution protocol is the protocol in DMVPN which makes it possible for spokes to register their public IP address according to their tunnel interface IP address whether the public facing interface is static or dynamic. Everyone explains NHRP like ARP but on the internet instead of within a local LAN. The protocol works as a server-client model where clients would point to a server to register their address (more specifically their NBMA aka Non Broadcast Multi Access). We will look at NHRP in more detail not only with configuration but also verification commands and more theory when we actually see outputs. Dynamic Routing Protocol As I've mentioned, a routing protocol isn't actually a requirement for DMVPN although as you may know, a dynamic routing protocol makes routing more scalable when working with a large amount of subnets/networks. We will be using EIGRP in this example. IPSec There are many design guides and generic guides on the web which show different methods such as using an IPSec profile directly in IOS or even having a firewall which offloads the resources for IPSec tunnels and then a router performing the GRE/NHRP etc.. In our example, I won't be using IPSec since the ipsec configuration is straight forward to lab but also very easy to setup using preshared keys, it gets more interesting when you begin to introduce a PKI server for certificates and IPSec enrollment instead of using keys/shared secrets... Basic configuration Starting with the basic configuration of all the routers so you can follow along: Starting with a basic check, we can ping each spoke from the HUB: HUB#ping 1.0.0.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 1.0.0.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/6 ms HUB#ping 2.0.0.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.0.0.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/6 ms HUB#ping 3.0.0.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 3.0.0.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/6 ms Firstly, lets start with some basic tunnel configuration. What we need to configure, an overlay which will use the 192.168.254.0/24 network for the tunnels to communicate. Lets go ahead and actually configure some other important commands on our HUB which will also act as the 'Next Hop Server aka NHS' for NHRP. HUB Configuration (Phase 1) interface Tunnel0 ip address 192.168.254.1 255.255.255.0 no ip redirects ip nhrp map multicast dynamic ip nhrp network-id 10 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 1 ip nhrp map multicast dynamic On the hub, this command serves to map multicast packets to the mappings that are created within the NHRP database. ip nhrp network-id 10 This is similar to the tunnel key command, where we can identify specific NHRP networks but this must match on all routers, this is required in a NHRP configuration. tunnel key 1 The tunnel key command in a tunnel configuration mode allows us to define which tunnel specific packets belong to, this is important when we have multiple tunnels on the interface and as a best practice I like to specify this even with a single tunnel configuration. Spoke Configuration (Phase 1) interface tunnel 0 ip address 192.168.254.(x) 255.255.255.0 !Spoke-1 .10, Spoke-2 .20 and Spoke-3 as .30 no ip redirects ip nhrp map 192.168.254.1 20.0.0.1 ip nhrp network-id 10 ip nhrp nhs 192.168.254.1 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 1 Let's capture some packets! If I shut down the tunnel interface on Spoke-1 and turn it back on, this looks like the things thing that happens relating to NHRP, which also reflects the configuration we have done. Let's look into the NHRP packet itself and then see what conversation is going on. We'll look into the interesting stuff without getting into too much depth: Firstly, Spoke-1 sends a NHRP Registration request (to 20.0.0.1 which is the HUB), you can see this request holds some information which will build the NHRP database we will see shortly. Spoke-1 actually announces its own NBMA address and the protocol address (in our case its our tunnel: 192.168.254.10, destination to 192.168.254.1 the tunnel interface on the HUB). These NHRP requests will be sent every 1/3rd of the Hold timer which by default is 7200s (found under the 'Client Information Entry'). The client expects a reply and will keep sending out NHRP requests double time (from 1, 2, 4 etc.. to 32... that is the theory for those CCNP exam takers!) Next, we receive a reply from 20.0.0.1 (HUB), which looks like: If we take a quick look at RFC2332, its states that Code 0 is indeed a successful register with the NHS. The next 2 packets were actually a repeated request/successful request which we won't dive into because they look the same as the above 2 request and reply NHRP packets. With all the spokes configured, this process happens fairly quickly in our lab environment and we can now see a populated NHRP database which can be found using: HUB#show dmvpn Interface: Tunnel0, IPv4 NHRP Details Type:Hub, NHRP Peers:3, # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb ----- --------------- --------------- ----- -------- ----- 1 1.0.0.1 192.168.254.10 UP 00:16:59 D 1 2.0.0.1 192.168.254.20 UP 00:15:08 D 1 3.0.0.1 192.168.254.30 UP 00:14:54 D HUB#ping 192.168.254.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.254.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 6/6/8 ms HUB#ping 192.168.254.20 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.254.20, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 6/6/8 ms HUB#ping 192.168.254.30 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.254.30, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 6/6/7 ms Do you think we would be able to ping Spoke-1 (192.168.254.10) from Spoke-2? Spoke-2#ping 192.168.254.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.254.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 6/12/25 ms The answer is yes! Although something happens behind the scenes. How could Spoke-2 possibly know how to get to 192.168.254.10? What happened was Spoke-2 actually send an NHRP request to its NHS (192.168.254.1). Because we have mapped the public IP address 20.0.0.1 to reach the HUB/NHS we can instantly send a request for 192.168.254.10. You can see above, we sent our NBMA and the Tunnel address, but the destination is 192.168.254.10. We are going to practically be asking, what is the NMBA address for 192.168.254.10? Now this is the part where NHRP gets interesting, try to see if something looks different below: If we just explain a quick overview, we send an NHRP request for 192.168.254.10 to 20.0.0.1 (which is our NHS). When the request hits the NHS, it will actually send it to the NMBA which is registered in the NHRP database (being 1.0.0.1). Spoke-1 (1.0.0.1) actually replies with its information (NMBA and Tunnel address 192.168.254.10). If we do a traceroute from Spoke-2 when the NHRP table is cleared on Spoke-2, have a look at the results that prove this: Spoke-2#traceroute 192.168.254.10 1 192.168.254.1 9 msec 192.168.254.10 7 msec 6 msec Spoke-2#show dmvpn Interface: Tunnel0, IPv4 NHRP Details Type:Spoke, NHRP Peers:2, # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb ----- --------------- --------------- ----- -------- ----- 1 20.0.0.1 192.168.254.1 UP 00:27:00 S 1 1.0.0.1 192.168.254.10 UP 00:00:23 D Spoke-2#traceroute 192.168.254.10 1 192.168.254.10 8 msec 7 msec * If the entry is not in our NHRP database, then the first few packets/traffic will traverse through the HUB until we receive the reply with the NBMA address of Spoke-1. This is the dynamic part of DMVPN already in action, because we learn the address to send traffic to if we want to directly communicate with that Spoke. When we start advertising our networks from the spokes, this will change and then we can start talking about the different phases that can change the flow of traffic and how routes are propagated throughout this DMVPN design. We are going to configure EIGRP to setup a relationship which each neighbor but also advertise the loopbacks into EIGRP. router eigrp 1 network 10.0.0.0 0.255.255.255 network 192.168.254.0 0.0.0.255 We can put a more granular network statement to chose what participates into EIGRP but let us keep it simple and sweet. We'll look at the phases in DMVPN which can change our traffic flow and how we learn routes. Before moving on, we can come across an issue with EIGRP neighbor flapping with the tunnels, we must include a command in our tunnel configuration on each spoke which allows us to map multicast traffic to the NBMA address of the Hub. interface tunnel 0 ip nhrp map multicast 20.0.0.1 Confirming EIGRP neighbors on the HUB: HUB#sh ip eigrp ne EIGRP-IPv4 Neighbors for AS(1) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num 2 192.168.254.30 Tu0 14 00:02:02 12 1506 0 5 1 192.168.254.20 Tu0 13 00:02:07 624 3744 0 5 0 192.168.254.10 Tu0 11 00:02:16 9 1506 0 6 EIGRP issues If we have a look at the routes that the HUB has dynamically learned via EIGRP: HUB#sh ip route eigrp 10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks D 10.10.1.0/24 [90/27008000] via 192.168.254.10, 00:05:46, Tunnel0 D 10.10.2.0/24 [90/27008000] via 192.168.254.20, 00:05:38, Tunnel0 D 10.10.3.0/24 [90/27008000] via 192.168.254.30, 00:05:30, Tunnel0 There is an issue that can occur because of the default behaviour with EIGRP, if we take a look at the routing table for Spoke-3: Spoke-3#show ip route eigrp 10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks D 10.0.0.0/24 [90/27008000] via 192.168.254.1, 00:06:29, Tunnel0 D 10.0.1.0/24 [90/27008000] via 192.168.254.1, 00:06:29, Tunnel0 D 10.0.2.0/24 [90/27008000] via 192.168.254.1, 00:06:29, Tunnel0 D 10.0.3.0/24 [90/27008000] via 192.168.254.1, 00:06:29, Tunnel0 We can see routes behind the HUB (eg. loopbacks) that can successfully be reached via the Tunnel interface, the issue is with routes from other spokes. The default behaviour with EIGRP is to not advertise a route out of an interface which it was received on (eg. Tunnel 0), this is a very good example of Split Horizon which is also apart of RIP and how that protocol works. We can simply solve this with an interface command on the HUB: interface tunnel 0 no ip split-horizon eigrp 1 Looking back at the routing table for Spoke-3: Spoke-3#show ip route eigrp 10.0.0.0/8 is variably subnetted, 8 subnets, 2 masks D 10.0.0.0/24 [90/27008000] via 192.168.254.1, 00:09:07, Tunnel0 D 10.0.1.0/24 [90/27008000] via 192.168.254.1, 00:09:07, Tunnel0 D 10.0.2.0/24 [90/27008000] via 192.168.254.1, 00:09:07, Tunnel0 D 10.0.3.0/24 [90/27008000] via 192.168.254.1, 00:09:07, Tunnel0 D 10.10.1.0/24 [90/28288000] via 192.168.254.1, 00:00:12, Tunnel0 D 10.10.2.0/24 [90/28288000] via 192.168.254.1, 00:00:12, Tunnel0 DMVPN Phases The phases are kind of steps during the DMVPN process when you have: Phase 1) Only Hub-Spoke traffic Phase 2) Spokes can then dynamically form tunnels with other spokes, no need to go through the HUB (firstly initial traffic will go through HUB because of the NHRP request) Phase 3) Spokes can dynamically reply to a NHRP request and spokes can work together without the HUB to initiate traffic between them Phase 1 During phase 1, our traffic will ALWAYS go through the HUB because although we have turned off 'split horizon', the HUB will advertise the routes from other spokes via itself. The next hop IP address in the routing table will show the HUBs IP address as shown below: (Notice all routes are reachable via 192.168.254.1) Spoke-1#show ip route eigrp 10.0.0.0/8 is variably subnetted, 8 subnets, 2 masks D 10.0.0.0/24 [90/27008000] via 192.168.254.1, 00:49:16, Tunnel0 D 10.0.1.0/24 [90/27008000] via 192.168.254.1, 00:49:16, Tunnel0 D 10.0.2.0/24 [90/27008000] via 192.168.254.1, 00:49:16, Tunnel0 D 10.0.3.0/24 [90/27008000] via 192.168.254.1, 00:49:16, Tunnel0 D 10.10.2.0/24 [90/28288000] via 192.168.254.1, 00:40:05, Tunnel0 D 10.10.3.0/24 [90/28288000] via 192.168.254.1, 00:40:05, Tunnel0 If we simply use a command on the HUB, we can allow the routes to be pushed out without the HUB adding itself as the next hop to reach the network. This is also moving the DMVPN into phase 2 where direct communication between spokes don't need to transverse the HUB all the time. interface Tunnel0 no ip next-hop-self eigrp 1 Before looking into what this does, now we will take another look at the routing table: Spoke-1#show ip route eigrp 10.0.0.0/8 is variably subnetted, 8 subnets, 2 masks D 10.0.0.0/24 [90/27008000] via 192.168.254.1, 00:00:21, Tunnel0 D 10.0.1.0/24 [90/27008000] via 192.168.254.1, 00:00:21, Tunnel0 D 10.0.2.0/24 [90/27008000] via 192.168.254.1, 00:00:21, Tunnel0 D 10.0.3.0/24 [90/27008000] via 192.168.254.1, 00:00:21, Tunnel0 D 10.10.2.0/24 [90/28288000] via 192.168.254.20, 00:00:21, Tunnel0 D 10.10.3.0/24 [90/28288000] via 192.168.254.30, 00:00:21, Tunnel0 We can now see, 10.10.2.0/24 via 192.168.254.20 and 10.10.3.0/24 via 192.168.254.30. This command will not make the HUB advertise the routes via itself. Back to Phase 3, the spoke itself can reply directly to a request because currently the request is being sent to the HUB and then the HUB is forwarding that request towards the destination. Here is an example of a basic packet capture when Spoke-1 tries to ping 10.10.3.1 (Spoke-3): You can see, the original source (1.0.0.1 - Spoke-1) is sent towards 20.0.0.1(HUB) and then, 20.0.0.1(HUB) sends it to 3.0.0.1(Spoke-3). To make this into Phase 3, we can simply add 2 commands on the hub and then a command on each spoke: !HUB interface tunnel 0 ip nhrp redirect ip nhrp shortcut !SPOKES interface tunnel 0 ip nhrp shortcut Its 3:34AM and I need sleep (said this an hour ago...) so will update this when I get some time tomorrow...

I've always wanted to do a post but felt like this is more appropriate for a blog post instead of on the networking forum. I've had a few people ask me on instagram + other social sites about building a lab and decided to create this so I can point them to it. Let us begin! So, you're studying for a Cisco exam or want to get some 'real' hands on experience with Cisco equipment because either: 1) People are telling you real hardware experience is better than emulation/simulation 2) You are generally interested in learning on real hardware Let us clear up one thing before we start talking about building a lab. There are many alternatives that can provide almost all the functionality for the R&S path (if not, everything for CCNA/CCNP) which are either free or cost a tiny investment, a bit like the money you will invest into this lab of yours! Why would I want to build a lab? The first thing I want to talk about is electric. Running this hardware cost money and can vary depending on the type of models of routers/switches etc you use. My personal experience is that I use my lab when I know I am going to be spending a long time on a concept, otherwise I'll just use GNS3 or a mix of GNS3 and real hardware. My equipment is off when I'm not using it and it doesn't affect my electric bill to the point that I'm considering if I should not use hardware. Noise... Buying the most up to date models for a lab doesn't seem a good investment if you're just building a lab. While you can get routers/switches for £15 each, they can produce a LOT of noise when you populate your lab with many devices. You're probably going to go for 2nd hand equipment which could have faulty fans (still working, but they might rattle or make high pitched noises) "I want to get real hardware because I want to plug things in..."... If you are planning on getting a lab purely for the practical feeling of actually using physical cables, you will feel different about that half-way during your studies. Sure, it doesn't take a long time to plug things in but a few factors come into play: Have you got a sufficient amount of cables for your different topologies? Are you going to make a network diagram inc. labelling the interfaces incase you want to recreate your topology with config files you already have? Can you keep up with using 40+ cables in your lab and knowing what connects to what logically? (Maybe you're not doing direct connections between devices...) A fine addition to crafting your ultimate lab from my point of view is, can you obtain IOS images for the devices you buy? During my first few days of obtaining real hardware, I would normally check out the IOS version, figure out if I need any module cards, maybe do password recoveries (urghhh!).. My first experience before even configuring my first ever interface on a router is that I had to obtain an IOS image because someone had deleted it from the flash! (I was threatened because I didn't have a clue what I was dealing with) Ok, I still want to build a lab but don't have a clue what to buy and how many? You can buy sufficient equipment for your beginning CCENT/CCNA studies then invest more when you start to branch out into other areas to carry on to your CCNP. You can also be smart and buy equipment to still be used in your CCNP studies. For now, lets look at a few options CCENT/CCNA studies (2 routers, 2 switches) 2 routers can provide: Basic routing protocol concepts You could always use other technologies to logically further split the routers so it looks like you have more Integrate with GNS3 for more routers Provide more functionality with static/dynamic routing 2 switches can provide: Basic switching concepts 802.1Q labs spanning multiple switches Personally, I think you can take a better look at slicing up unicast vs multicast vs broadcast with more flexibility... You can always substitute hardware routers with GNS3 (which will allow you to emulate IOS but also provide connectivity between emulation and hardware devices). Another option is that you can also chuck in another router since you can really find some good deals on ebay for job lots etc.. Enough with the boring stuff, lets look into models for routers and switches. Wait.... I NEED DEVICES that can run IOS 15!!! Some of the older models don't run IOS 15 (like computers and operating systems), sometimes the models are too old to either store the IOS version or don't have the hardware requirements. Now lets look... Routers Cisco 1841: I started with these during my CCNA studies, they are very quite, have a little bit of room for expansion since they have 2 modules. Most of these on ebay come with a single WIC-1T with allows you bang out serial into your labs. This router does support IOS 15 (15.1) and depending on the IOS image you can experiment with a few other features. I use these quite a lot when I need routers for customer sites in my lab. 1760 Quite an old one so you should be able to get this for cheap on ebay! They take quite awhile to boot up, although they provide 2x WIC cards and the other 2 support VIC voice modules. Not 100% certain but I know this runs 12.3 and not 15. 2610/2612/2621/XM Depending on your preference, the XM series replaces the 10mbps with 100mbps fast ethernet (only a single port)... I mentioned this because you can get them on ebay for about £10-15 if you look carefully and hunt down through the listings. The XM series supports a few more features and you can upgrade it (dram etc..). Using a single ethernet port, you can use subinterfaces trunked to a switch to logically have more connections. The 2610 supports up to IOS 12.3 I believe which is still ok for almost all the concepts at the CCENT/CCNA level. 2801 If you're lucky, you can find these between £25 - £40 a piece. They support more WIC modules than your 1841/2610 etc.. and allow 4x modules, although SLOT 0 only accepts VICS, 2 slots support HWIC modules and others, and SLOT 2 only accepts WICS (not HWICS)... I like that everything is at the front of the chassis so when I rack mount these, it is easy to get to inc. the console port etc.. These also support IOS 15.1 2811 Almost looks like the 2801 with modules around the back, not going into detail with this router because you can sometimes find them cheap... I mention this model because they normally are sold with a few modules preinstalled. Switches 2950 These are extremely dirt cheap, come in many different variants (eg. just 24 x 100mbps port, 2 x gigbit uplinks, 2 x FX or SX uplinks, 12 x 100mbps port... just loads!) People literally throw these away on ebay for cheap but they can get loud! A few people recommended normally to swap these out for 2960's because they can run IOS 15 and obviously support other features. I've found 2950's on ebay with 2x gigabit links for around £12 each... or a job lot of 4x 2950's for £40-50! 2960 Lets take this opportunity to have a look at PoE. We can buy devices which support PoE that can provide power to a range of devices (most common would be IP phones). Again like the 2950, we have different variants which include 2 x gigabit ports for uplinks between switches etc.. A lot of people normally list these on ebay for around £20 3550 Now we are getting into devices known as 'Layer 3' or 'Multi-layer' switches. Unlike our 2950/2960, multilayer switches provide functionality between layer 2 and layer 3. A multilayer switch can act as a standard boring ol' switch but we can enable IP routing to practically act similar to a router. I use many multilayer switches in routing topologies to populate labs when I practiced routing protocols etc.. One key protocol that isn't support by this and another multilayer switch I'll mention is the ability to perform NAT (oh! also IPv6 & a few QoS features ) . I believe these don't support IOS 15 but can be found on ebay between £15 - 20 a piece 3560 Practically looks like the 3550 and supports more features + higher speeds (around £15-35 a piece) 3750 The 3750 is a bit more expensive, more or less a 3560 with a few more features including stackwise. Stackwise isn't really something practical you need to learn for the exam but may be good for the real world. Again, depending on the IOS image you are limited to protocols etc.. eg. the IPBASE image doesn't support BGP..) I managed to buy 4 of these (2x PoE) for around £50 which was an absolute bargin and have taken me through CCNP studies. They are capable of even bringing you to the CCIE R&S. There are plenty more other choices and combinations (eg. fully GNS3 and a few 3550/3560/3750's) but this is the gear that I've managed to use out in my own lab without breaking the bank. Another option is to also by a dedicated server to run GNS3 to allow more devices to run which is a valid option (or even looking at Cisco's virl... OR just using packet tracer for your CCENT/CCNA studies which many people have succeeded with) This post will be edited some time in the future and reviewed

CDP - Cisco discovery protocol... A protocol that runs on Layer 2 which means it doesn't give a damn which layer 3 protocol is running on the interface! The basic concept from our point of view with CDP is that it can obtain information related to device name, interface, management IP and more! A tiny bit of theory that isn't really required for the CCNP level is what CDP runs on. Medias must support Subnetwork access protocol (SNAP). Essentially this is a frame format which follows the common 802.3 ethernet frame and adds a header (with some new fields) which provides some information regarding what type of information is in our next header (similar to the old Ethernet frame format with the EtherType). The LLC header in our 802.3 frame would have 2 fields (DSAP and SSAP which are normally the same value, 0xAA in hex meaning a SNAP header will follow the LLC header in our frame. In the SNAP header below, we have 2 fields: OUI (Organizational Code) which indicate a registered hex value for Cisco (0 x 00 00 0C) and the PID Protocol ID which in our case will be CDP (0 x 20 00): SMXLL Also, notice that we have a MAC multicast address to a well known address not only for CDP but other cisco protocols such as VTP,DTP etc.. If we move more over to the CDP message itself, take a look at a capture below: SLXLM We can see information that can be advertised via CDP such as: Version, TTL (aka holdtime), the name of the device, VTP domain and more! A key thing with CDP is that it isn't a 2 way communication. Devices that originate CDP advertisements will just send them and have a care in the world what happens after that! This CDP advertisement was sent from R2 to R1 so lets have a look what we can find in R1's CDP neighbor table by using the show cdp neighbors command. SMXLL Without any topology map or someone telling us, we can now conclude that on R1, we have a device called 'R2' which sent out a CDP advertisement that we received from our Fa0/0. The problem is that a switch could actually be between our routers so we can't fully depend on CDP and come to a conclusion that we our Fa0/0 is directly connected to R1's F0/0. Now for some more theory before tweaking! CDP by default is enabled on cisco devices and has a few default parameters such as: Advertisement is every 60s Hold timer is 180s By default, v2 advertisements are enabled (v1 pretty much doesn't send VTP management domain) and finally by default, CDP is enabled globally and on every interface So these are pretty much the only tweaks we can do with CDP. We can change the advertisement/hold timers, change the version of CDP we advertise and disable it globally (or per interface) Globally enabling/disabling: cdp run no cdp run Interface level: cdp enable no cdp enable Changing the timers in global config: cdp timer 20 cdp holdtime 60 Advertise v2 / don't cdp advertise-v2 no cdp advertise-v2 Another option we can configure with CDP is to alert us if CDP detects a duplex mismatch (since the duplex parameter of the interface is sent in the CDP message) SMLXL We can enable this logging in global config by: cdp log mismatch duplex The concern with CDP is that people find it shares too much information in the message so they either: globally disable it or disable it on specific interfaces such as edge ports, ports facing ISP router/internet etc.. This is because a bit of information that people can obtain can easily do a few searches for vulnerabilities for a specific IOS version etc.. You can also perform CDP spoofing to the multicast address with different values in each message and pretty much 'overflow' the CDP table with hundreds of CDP entries, a tool is included in the Kali linux distribution to generate CDP messages as well as others such as BPDUs and more! Here is a youtube video that substitutes this post... Excuse my explanation on SNAP during the video, I was a bit over the place!

The 'wonders' of 802.1D... This is just a quick blog to discuss the CCNA level of the process of how switches in an ethernet LAN will elect the root bridge and a few other details. Firstly, Spanning Tree Protocol (STP) is? Simply, a way to create a logical 'loop free' network in our LAN by blocking specific ports that could cause a frame to loop indefinitely in our network. I'm assuming you have a basic understanding of STP because that would be required to understand the basic root bridge election. Getting straight into it, when you connect 2 or more switches together they will begin the process of the 'root bridge election' which can change the way frames are sent in the network or even in different VLAN's. Take a look at the example below: Imaging we had no such thing as STP, the basic example shown is a broadcast has been sent from PC0 to SW1. SW1 with basic switching functionality, will broadcast the frame out of all ports except the one that received the original frame, this seems very normal so far. In short story, the switches will broadcast the frame out of ports the original wasn't received on so it will be going back and fourth until someone literally comes over and literally turns the switch off, it seems extreme but remember that the switch will not broadcast that frame out of the port it was received but SW1 received a broadcast from both SW2 and SW3 (so SW1 will then broadcast the frame from SW2 out fa0/2, and the frame from SW3 to fa0/1) So in a short story, STP will block redundant links to stop these frames from looping. You could have the switches daisy chained but that defeats the whole purpose of redundancy and that if we had multiple switches (SW1 -> SW2 -> SW3 -> SW4), if SW3's link were to go down, people connected to SW1 and SW2 wouldn't be able to talk to people on SW3 or SW4. So what is this 'Root bridge election' or what is a root bridge? When I first looked at the root bridge, I thought to myself does all the traffic need to go to the root bridge before being forwarded to the destination? Because that seems impractical! Of course, it was the first time I've encountered STP and I wasn't 100% wrong sort of... (but close to it!). The path towards the root bridge from other switches are commonly the fastest (or least cost) which can be changed. The easiest way I would explain why the root bridge is needed would be along the lines of: "The root bridge allows other switches to have a destination to decide which ports to put in forwarding and which ports to block, by default the least cost (fastest path/speed) would be a preferred path to the root unless you manually configure things like costs and priority...." Traffic will not need to travel to the root bridge first, unless it needs to travel in that direction or is the only way to get to the destination. We will talk about the different port roles and types for STP a little bit later. Bridge Election Process The bridge election process begins with switches exchanging messages, the Hello BPDU (Bridge protocol data unit) formally known as a configuration BPDU (a lot of people may call it a hello, because it is being sent over and over again like most Hello's in other protocols, excuse me while I refer to it as a hello BPDU for now...). The Hello BPDU will be used to compare on each side of the link and exchange information such as: Root Bridge ID, Sender Bridge ID, Path cost to root, Port ID and Timers (MaxAge, Hello and Forward Delay). The BPDU does contain more fields, but these are the important ones for now.. (Protocol ID will be 0x000 for IEEE 802.1D) I believe the main focus in the CCNA is firstly focusing on the Bridge ID (BID) and what forms it. The BID is a field in the BPDU which is 8 bytes. Split into 2 parts: Priority = 2 bytes (divided into 2 parts: 4bit Priority + 12bit VLAN ID) (interesting fact (2^12 = 4096 VLAN's anyone?) System ID Ext (MAC Address) = 6 bytes Without no configuration, we have some default values in our BPDU that are generated on switches. Such as: Each switch will think it is a root since no root has been elected yet... Each BID priority will be 32768 (VLAN1 = 32769 etc...) Hello Timer is 2 seconds default Forward Delay is 15 seconds by default Max age is 20 seconds by default So upon BPDU messages being exchanged, what will happen since the BID priority is the same? If that ties, then it will move onto comparing the System ID (MAC Address) and will always elect the switch with the lowest MAC address as the root as shown in the example below: In this example, we see that SW3 actually has a lower BID which then tells us that it will become the root in this election process. Ok so are BPDU's still exchanging after this simple process? Yes of course! BPDU's are actually generated from the root and will be sent down the topology similar to the picture below: You can see that the path cost is added to as the basic 'BPDU' is sent down(logically) from the root but where do these numbers come from? STP (1998) has values which I believe you may need to remember for the CCNA exam such as: 10Mbps cost 100, 100Mbps costs 19, 1Gbps cost 4, 10 Gbps cost 2 Now that the root election process has finished, that is pretty much all done? You'd be wrong in not wanting to learn more! Since the previous examples don't really show STP's capabilities of making sure the network is loop free, let's add a redundant link in our switched LAN from SW1 to SW. The image has been changed slightly to make it easier to talk from the logical topology view (remember SW3 is still the root!). So a redundant link has been added and BPDU's have been exchanged but wait... It seems that we understand one of the first values compared in the BPDU is the root bridge ID. SW3 and SW2 will both send a BPDU with the same Root Bridge ID?? Is the switch going to freak out? Is STP going to break? Of course, that would be a poor design if it did but it simply moves onto the next value to compare... Sender Bridge ID - Is the Senders BID lower than mine? No.... Simply move onto the next parameter. Cost.... SW1 root path cost using gi0/1 will be 4 SW1 root path cost using fa0/1 will be 23 (because it needs to also add the cost to get to the root from the SW2 gigabit connection) Port Roles and States After the switch has completed this new election process with the new redundant link, we can move onto the next stage of the STP process. STP defines port roles and states to be used by root and nonroot switches. The root switch will simply put all ports in the designated role and states will be in forwarding mode (FWD), so lets focus on non-root switches. Every non-root switch must have a root port which essentially is the lowest cost to reach the root switch. SW1 has made g0/1 the root port since it is a STP cost of 4 rather than f0/1 which would be a cost of 23. (sorry about hostname, this was issued on SW1) Because the Root switch will generate BPDU's that are then sent down from the topology, each switch will add the cost on the BPDU before sending it out. The BPDU sent from SW3 to SW2 is 0 then SW2 will add a cost of 4 then will be resent to SW1. SW1 will receive it on port f0/1 and will add a cost of 19 creating a total of 23. The BPDU sent from SW3 to SW1 is 0 then SW1 will add a cost of 4 then will be sent to SW2. SW2 will receive it on port f0/1 and will add a cost of 19 (23) which is a worst path than g0/2 to root. As you can see in the #show spanning-tree. It also lists on SW1 that interface fa0/1's role is Desg (Designated). The designated role will be the port that advertises the lowest path cost to a LAN segment. Of course, ties will occur which will result in the BID's being compared and the lowest BID will be chosen. All other ports that are not a Root or Designated will be transitioned into the 'Blocking'(BLK) state as shown on SW2: In the next blog on STP, we will talk about STP convergence, 802.1w (RSTP), PVST+, Configuring them all and tweaking STP values such as priority, cost, also I will go into depth on STP port roles and states etc.. I will be replicating this topology with 3 Cisco 2950's instead of using Packet Tracer. (PS, I wrote this on my actual blog but thought I might aswell upload it here, sorry if any formatting issues occur!)

I have a Cisco aironet air-cap3502i-e-k9 and wonder if i can use a 58 volt PoE adapter. Will this damage the ap or will it work?

Hey There I want to configure a VPS with cisco vpn protocol to use with the cisco secure client app on all platforms but dont know where to start and there are some questions i have Do you need a license or a cisco network switvh or modem for using the cisco anyconnect VPN? currently im using ocserv on an ubuntu VPS but it lacks User Control and it doesnt support ios Devices. Can anyone help me here??

Hey There I want to configure a VPS with cisco vpn protocol to use with the cisco secure client app on all platforms but dont know where to start and there are some questions i have Do you need a license or a cisco network switvh or modem for using the cisco anyconnect VPN? currently im using ocserv on an ubuntu VPS but it lacks User Control and it doesnt support ios Devices. Can anyone help me here??

Is it just me or is TP Link as a brand severely underrated? From their Switches, to their CCTV Cameras, to their Wifi Mesh Pods, they seem to get a bad name for some reason Can anyone spread some light as to why? I've used netgear, linksys and TP link stuff in my home before, the TP Link stuff has smoked them both, from a price point, to a features point and a quality point

Dear forum, I'm back in search of wisdom. I'm encountering multiple problems in my current LAN setup, and while I have a couple of suspects, everything tells me I should be getting better results or worse results, but not the exact results I get. It makes no sense to me at this point. Let me preface with two things: 1) I know there are many ways to connect two computers, so having "a" connection could be achieved by trying a different configuration and see how it goes. However, the goal here is to get this layout to work, or alternatively, understanding why it can't (as in, shouldn't) work, and then move to something else. If I just quit I'll learn nothing. 2) This is a graph of my current setup. Each line represents a 1Gig Ethernet connection. Ellipses represent bonds of ethernet connections working as one (LACP a.k.a. 802.3ad). Wireless connections go directly to the ISP modem, and are in the same space as the modem and the PFSense WAN (say, 192.168.xx.zz). PFsense LAN and all the PCs are in 192.168.yy.zz, xx=/=yy. Dashed lines delimit rooms, connections between rooms go through the walls. The problems 1) The old: It all started after installing the PFSense router (although I remember some previous oddities preparing this post, more on that later). I made a thread about it here: In a nutshell, the connection between PFSense and Switch breaks down, triggering a "possible flapping" message on the PFSense logs. It goes back up with no user intervention. The current state of the problem is reproducible: it happens every time I turn on or turn off either of PC1, PC2 or, since Installing that, PC3 (I've checked ans it's not exactly at power up, but when the OS starts loading). If you are using any of the PC1 or PC2, you're suddenly limited to the Switch, then after waiting a bit (varies between seconds and minutes) you can go all the way to the internet again. 2) The new: I installed Ubuntu Server on another PC last week, configuring a bond as main network interface, but without connecting to the internet during the installation. Once done, I connected the cables and try connect to the outside world to no avail. Now here's the puzzle: I can reach all the way from PC3 to the PFSense box and SSH into it. That is, the path between PC3 and PFSense seems no different than the path between PC1 and PC2, and PFSense. But PC3 gets no internet. The obvious candidate was DNS, but I checked with various built-in tools (route, netplan --debug, looking at resolv.conf and whatever the netplan config files are, etc), and in all cases it is correctly set to 1.1.1.1, 8.8.8.8 (it's the same in PC1 and PC2, PFSense is set to DNS Relay). But no internet. I did some ping and web GUI / SSH tests, as follows: PC1: can ping Switch, can access Switch GUI, can ping PFSense, can access PFSense GUI, can ping PC3, can ping 1.1.1. has internet PC3: cannot ping Switch, can ping PFSense, can SSH into PFSense, can ping PC1, cannot ping 1.1.1., has no internet I checked the PFSense logs and there's no trace of PC3 trying to reach the internet, or anywhere, and being blocked. The only signs of any blocking are stuff coming from my laptop (connected through WiFI to ISP modem) towards PFSense LAN and inwards. No clue what that is, but glad to have PFSense Anyway, laptop on or off does not affect my results. So that's my puzzle: I would understand having internet on PC3, and I would understand if PC3 couldn't reach PFSense due to some misconfiguration somewhere. I would understand less if PFSense was blocking PC3 while not the others, but at least it would be a lead to follow. But right now it's as if PC3 was simply not sending the requests to, say, 1.1.1.1 correctly, or at all 3) The unresolved oddities from the past Before even having the PFSense box, everything seem to work fine (PC1 and PC2 to Switch same as now, Switch to ISP), but I remember now two issues that I overlooked: i) PC1 dual-boots Windows and Linux Mint. Windows configured the team (a.k.a. bond) in two clicks, and worked since then. In Linux Mint I never got any Ethernet connectivity whatsoever as far as I remember, and 100% sure the team does not work at all in Linux to this day. I'm limited to WiFi on PC1 when on Mint. ii) I have two available modes for the "Etherchannels" (how Cisco calls the teams/bonds) in my Switch: "Static" and "LACP". THe description of "Static" was not very informative to me, but my understanding is that the correct option for my setup is "LACP". That's how all the Linux / PFSense bonds are set, and they will not work if I change that to "Static" in the switch (while keeping the settings unchanged in the computers). This is the expected behavior, I think. However, the link between Switch and PC1 is set as "Static" in the Switch. Looking back, when first setting this up, there were instances in which it would work in Static but not LACP, it would work in LACP but not Static, neither, both, etc, until I finally got it all set. My understanding is that it shouldn't work because the team is set as LACP in PC1, but OK, I guess what does work is not my main concern So, at this point: what could be preventing PC3 to reach the internet through PFSense like the other computers? What's causing the link between PFSense and the Switch yo break down when a computer connected to the Switch initializes its NICs / powers them down? I'd blame the Switch, but then, why does a direct link between ISP and Switch not break in the same situation? I do hope it's the Switch: While it would suck not being able to use it this way, I think I could setup a similar layout with PC3 acting as both server and switch. Still, I'd want to understand first what's wrong with the damned CE500G, and salvage it if possible. Thanks in advance to anyone with 2 hours to read this post and able to provide any hint

I am trying to login into the web management utility of my TP-Link router but it doesn't let me log in. it doesn't it even show wrong username or password error when I try to log in. I tried resetting the setting to default using the reset button on the router but even default username password doesn't work.