Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About MDHackett
Community Record
7
Posts
0
Kudos
0
Solutions
Badges
Jun 21 2021
7:44 AM
@ww Thanks. My Active port is WAN2, where I want all my traffic to flow. WAN1 is Ready, and is the fail over with another carrier. When I go to WAN1, I lose some of my services, based on my public IP, which is why I wanted to route Client VPN traffic through my Ready port, not the Active port.
... View more
Jun 21 2021
7:25 AM
Is it possible for the MX to respond to Client VPN on the Ready WAN port, instead of the Active one? Or is it always the Active port, never the Ready port? Currently all traffic is not load balanced, and I'd like to pass Client VPN traffic through the Ready WAN instead of the Active port to make use of that unused bandwidth. --Michael
... View more
Jun 11 2021
8:02 AM
@Bruce We're working to resolve this through attaching WAN1 from all the remote sites (big and small) to the L2 fiber connection and bringing those into the Data Center LAN port in it's own subnet, drawing an internet connection through WAN1 on the Data Center, allowing them to enable an AutoVPN connection to one another to allow them to control their own routing. I've connected WAN2 at the remote sites to a cable modem as fail-over for the AutoVPN and management if it should otherwise lose connection to the L2 fiber. We're in the midst of rolling this into place at all our locations for testing before we cut over on a weekend to live, but so far it looks very promising.
... View more
Jun 8 2021
5:27 PM
@Bruce The Layer 2 network is meant to be upstream/outside. Each MX stands between the LAN and the Layer 2 connection. Encryption isn't an issue on the Layer 2, as we're the only traffic passing on it. All the traffic that's not bound for one of the 10.1.AAA.BBB networks (we only have 10 subnets for the 9 locations), should go to our 10.1.15.254 destination to be parsed out the Firewall. The Layer 2 connecting fiber doesn't have DHCP in it. But you're suggesting I use a LAN port at the Data Center to connect to that Layer 2, assigning the WAN ports on all the other MX's on that subnet, then any non-local traffic would naturally flow up to the Data Center, which could route 0.0.0.0/32 to our internal Firewall at 10.1.15.250. The Data Center would have a configuration/maintenance connection on the WAN port. This wouldn't include the use of the Auto-VPN. I'm just trying to mentally sort out how we would get traffic passing between the MX64's under there. 10.1.2.0/24 to 10.1.3.0/24 to 10.1.3.0/24, etc.. Is that what you're thinking?
... View more
Jun 8 2021
5:01 PM
I've looked at the MPLS-AutoVPN documentation, and I'm not sure it applies, as the L2 connection doesn't have any address/routing going on inside it. The handoff is basically a connection to a switch, with no internet connection, so I can't see how we would route to it the way you would an MLPS router. The L2 link only connects our ports, and have no other traffic inside them. There are 9 sites. 6 of them are MX64's as small branch locations with between 5 and 20 users at a site, they're all flat networks (10.1.AAA.BBB) The other 3 are MX250's, that include our Data Center (with our firewall connection out), and our main site with about 50-60 users (who has a 2nd subnet for VoIP phones, 10.1.1AA.BBB and 10.1.2AA.BBB), and our backup site with a small set of hosts and about 25 users. Let me make sure I'm hearing your suggestion: Setup WAN1 for internet/maintenance (cable modem/DHCP) connection, WAN2 to the Layer 2 connection and assign all the WAN2's in the same subnet (10.2.11.xxx). Then static routes like 10.1.AAA.0/24 (next hop) 10.2.11.xxx? I don't think it'll let me drop in that static route, because it doesn't see the WAN2's 10.2.11.xxx address. (Yeah, it wouldn't let me.. "..invalid next hop IP. The IP address 10.2.11.xxx is not on a configured subnet." )
... View more
Jun 8 2021
3:02 PM
A local vendor has provided us with a private, Layer 2 connection, handing off copper to our 100Mbps sites (MX64's), and fiber to our 1Gbps sites (MX250's). The connections we're getting are completely un-routed, of course, and effectively just a big switch that connects the sites. Without that connection having internet access, we're struggling with how we should configure the MX's to pass traffic. Since it's not an MPLS, there's no router to talk over. My gut tells me we'll need to have the provider re-jigger the connection to a straight internet and AutoVPN the connection, but we're still looking for options to make this worth without having to do that, and let a cable modem connection be the backup and management. Has anyone done this, and what should the configuration look like on the MX's? (The sites we're connecting are VERY flat, and have only 1 subnet, except 1 (MX250) site that has 2.)
... View more
Jun 2 2021
8:31 AM
We're upgrading our SD-WAN with a new fiber vendor whose giving us a private fiber network connection. They're connecting up to MX64's at our small sites, MX100's at our 2 larger sites and the Data Center. We're planning to auto-VPN them to connect, use the Data Center as the exit hub. However, there's a catch. We have existing firewalls we want to route through instead of letting the MXs do that lifting (because it's already in place and heavily ruled.) The fiber company is about ready to hand off their gear and let us plug in to test before we spend a Saturday afternoon going live. Clearly the current issue we're struggling with is how to tell the DC MX100 to route outbound traffic to the internal xxx.xxx.15.254 address, opposed to the typical default route of 0.0.0.0 to the WAN uplink. If we put in a static route of 0.0.0.0/32 going to xxx.xxx.15.254, then it comes up below the 0.0.0.0/0 route to the WAN uplink, so I'm not sure that's going to accomplish what we're looking for. Should we try to set a default route on all the MX's to simply point to xxx.xxx.15.254 instead of the WAN uplink, and let the auto-VPN get the traffic over to the DC and pass it to the firewall that way?
... View more
© 2024 Cisco Systems, Inc.
