Cisco Switches, Cisco Firewall

Saturday 21 april 2012 6 21 /04 /Apr /2012 04:05

 

Supervisor 2T engine for the Catalyst 6500E chassis. The Sup2T is a boost to keep the 6500′s legs running a little longer. I think of the 2T as a product enabling customers with a large 6500 investment to put off the inevitable migration to the Nexus platform. The 2T, by all accounts, is the end of the development roadmap for the 6500. My understanding is that the 2T takes the 6500 chassis as far as it can scale in terms of packet forwarding performance.

With the advent of the Nexus 7009, I doubt we’ll see yet another replacement 6500 chassis model (like we saw the “E” some years back). The Nexus uptake has been reasonably good for most Cisco shops, and the Nexus 7009 form factor takes away the physical space challenges faced by those previously considering the 7010 as a forklift upgrade for the widely deployed Cisco 6509. In my mind, it makes sense for Cisco to focus their Catalyst development efforts on the 4500 line for access and campus deployments, with Nexus products running NX-OS for core routing services and data center fabric. Could I be wrong? Sure. If Cisco announced a new 6500E “plus” chassis that can scale higher, than that would reflect a customer demand for the product that I personally don’t see happening. Most of the network engineering community is warming up to the Nexus gear and NX-OS.

That baseline established, Cisco is selling the Sup2T today. What does it bring to the table? Note that anything in italics is lifted directly from the Cisco architecture document referenced below in the “Links” section.

  • Two Terabit (2080 Gbps) crossbar switch fabric. That’s where the “2T” comes from. These sups are allowing for forwarding performance up to 2 Tbps. Of course, as with previous supervisor engines, the aggregate throughput of the chassis depends on what line cards you deploy in the chassis. That old WS-X6148A you bought several years ago isn’t imbued with magical forwarding powers just because you pop a 2T into the chassis.
  • The Supervisor 2T is designed to operate in any E-Series 6500 chassis. The Supervisor 2T will not be supported in any of the earlier non E-Series chassis. You know that non-E 6500 chassis running Sup720s you love so much? Gotta go if you want to upgrade to a 2T (to which I ask the question if you’re considering this…why not Nexus 7009 instead?)
  • As far as power requirements, note the following:
  •  
    • The Cisco 6503-E requires a 1400 W power supply and the 6504-E requires a 2700 W power supply, when a Supervisor 2T is used in each chassis.
    • While the 2500 W power supply is the minimum-sized power supply that must be used for a 6, 9, and 13-slot chassis supporting Supervisor 2T, the current supported minimum shipping power supply is 3000 W.
  • Line cards are going to bite you; backwards compatibility is not what it once was. There’s a lot of requirements here, so take note.
    • The Supervisor 2T provides backward compatibility with the existing WS-X6700 Series Linecards, as well as select WS-X6100 Series Linecards only.
    • All WS-X67xx Linecards equipped with the Central Forwarding Card (CFC) are supported in a Supervisor 2T system, and will function in centralized CEF720 mode.
    • Any existing WS-X67xx Linecards can be upgraded by removing their existing CFC or DFC3x and replacing it with a new DFC4 or DFC4XL. They will then be operationally equivalent to the WS-X68xx linecards but will maintain their WS-X67xx identification.
    • There is no support for the WS-X62xx, WS-X63xx, WS-X64xx, or WS-X65xx Linecards.
    • Due to compatibility issues, the WS-X6708-10GE-3C/3CXL cannot be inserted in a Supervisor 2T system, and must be upgraded to the new WS-X6908-10GE-2T/2TXL.
    • The Supervisor 2T Linecard support also introduces the new WS-X6900 Series Linecards. These support dual 40 Gbps fabric channel connections, and operate in distributed dCEF2T mode.

To summarize thus far, a legacy 6500 chassis will need to be upgraded to a 6500E. Many older series line cards are not supported at all, or will require a DFC upgrade. Power supplies are a consideration, although the base requirements are not egregious. Therefore, moving to a 2T will require a good bit of technical and budgetary planning to get into a Sup2T. I suspect that for the majority of customers, this will not be a simple supervisor engine swap.

This diagram from Cisco shows the hardware layout of the Sup2T, focusing on all the major junction points a packet or frame could crossed through depending on ingress point, required processing, and egress point.

Will-Sup2T-Stop-You-From-Buying-Nexus01.jpg

There are two main connectors here to what Cisco identifies as two distinct backplanes: the fabric connector, and the shared bus connector. The fabric connector provides the high-speed connectors for the newer line cards, such as the new 6900 series with the dual 40Gbps connections mentioned above. The shared bus connector supports legacy cards (sometimes referred to as “classic” cards), that is linecards with no fabric connection, but rather connections to a bus shared with similarly capable cards.

The crossbar switch fabric is where the throughput scaling comes from. Notice that Cisco states there are “26 x 40″ fabric channels in the diagram. That equates to the 2080Gbps Cisco’s talking about. The crossbar switch fabric on the Supervisor 2T provides 2080 Gbps of switching capacity. This capacity is based on the use of 26 fabric channels that are used to provision data paths to each slot in the chassis. Each fabric channel can operate at either 40 Gbps or 20 Gbps, depending on the inserted linecard. The capacity of the switch fabric is calculated as follows: 26 x 40 Gbps = 1040 Gbps; 1040 Gbps x 2 (full duplex) = 2080 Gbps.

“Full-duplex” means that what we’re really getting is 1Tbps in one direction, and 1Tbps in the other direction. The marketing folks are using weasel words to say that the Sup2T is providing a 2 terabit fabric. This marketing technique is neither new nor uncommon in the industry when describing speeds and feeds, but it is something to keep in mind in whiteboard sessions, especially if you’re planning a large deployment with specific data rate forwarding requirements.

Now here’s a strange bit. While the crossbar fabric throughput is described in the context of full-duplex, the 80Gbps per-slot is not. The 80 Gbps per slot nomenclature represents 2 x 40 Gbps fabric channels that are assigned to each slot providing for 80 Gbps per slot in total. If marketing math were used for this per slot capacity, one could argue that the E-Series chassis provides 160 Gbps per slot.

Moving onto the control-plane functions of the Sup2T, we run into the new MSFC5. The MSFC5 CPU handles Layer 2 and Layer 3 control plane processes, such as the routing protocols, management protocols like SNMP and SYSLOG, and Layer 2 protocols (such as Spanning Tree, Cisco Discovery Protocol, and others), the switch console, and more. The MSFC5 is not compatible with any other supervisor. The architecture is different from previous MSFC’s, in that while previous MSFC’s sported a route processor and a switch processor, the MSFC5 combines these functions into a single CPU.

Will-Sup2T-Stop-You-From-Buying-Nexus02-copy-1.jpg

The diagram also show a “CMP”, which is a feature enhancement of merit. The CMP is the “Connectivity Management Processor,” and seems to function like an iLO port. Even if the route processor is down on the Sup2T, you can still access the system remotely via the CMP. The CMP is a stand-alone CPU that the administrator can use to perform a variety of remote management services. Examples of how the CMP can be used include: system recovery of the control plane; system resets and reboots; and the copying of IOS image files should the primary IOS image be corrupted or deleted. Implicitly, you will have deployed an out-of-band network or other remote management solution to be able to access the CMP, but the CMP enhances our ability to recover a borked 6500 from far away.

The PFC4/DFC4 comprise the next major component of the Sup2T. The PFC4 rides as a daughter card on the supervisor, and is the hardware slingshot that forwards data through the switch. The DFC4 performs the same functions only it rides on a linecard, keeping forwarding functions local to the linecard, as opposed to passing it through the fabric up to the PFC4.

The majority of packets and frames transiting the switch are going to be handled by the PFC, including IPv4 unicast/multicast, IPv6 unicast/multicast, Multi-Protocol Label Switching (MPLS), and Layer 2 packets. The PFC4 also performs in hardware a number of other functions that could impact how a packet is fowarded. This includes, but is not limited to, the processing of security Access Control Lists (ACLs), applying rate limiting policies, quality of service classification and marking, NetFlow flow collection and flow statistics creation, EtherChannel load balancing, packet rewrite lookup, and packet rewrite statistics collection.

Will-Sup2T-Stop-You-From-Buying-Nexus03.jpg

The PFC performs a large array of functions in hardware, including the following list I’m lifting from Cisco’s architecture whitepaper.

  • Layer 2 functions:
  •  
    • Increased MAC Address Support – a 128 K MAC address table is standard.
    • A bridge domain is a new concept that has been introduced with PFC4. A bridge domain is used to help scale traditional VLANs, as well as to scale internal Layer 2 forwarding within the switch.
    • The PFC4 introduces the concept of a Logical Interface (LIF), which is a hardware-independent interface (or port) reference index associated with all frames entering the forwarding engine.
    • Improved EtherChannel Hash – etherchannel groups with odd numbers of members will see a better distribution across links.
    • VSS support – it appears you can build a virtual switching system right out of the box with the Sup2T. There does not seem to be a unique “VSS model” like in the Sup720 family.
    • Per Port-Per-VLAN – this feature is designed for Metro Ethernet deployments where policies based on both per-port and per- VLAN need to be deployed.
  • Layer 3 functions. There’s a lot here, and rather than try to describe them all, I’m just going to hit the feature names here, grouped by category. You can read in more detail in the architecture document I link to below.
    • Performance: Increased Layer 3 Forwarding Performance
    • IPv6: uRPF for IPv6, Tunnel Source Address Sharing, IPv6 Tunnelling
    • MPLS/WAN: VPLS, MPLS over GRE, MPLS Tunnel Modes, Increased Support for Ethernet over MPLS Tunnels, MPLS Aggregate Label Support, Layer 2 Over GRE
    • Multicast: PIM Register Encapsulation/De-Encapsulation for IPv4 and IPv6, IGMPv3/MLDv2 Snooping
    • Netflow: Increased Support for NetFlow Entries, Improved NetFlow Hash, Egress NetFlow, Sampled NetFlow, MPLS NetFlow, Layer 2 Netflow, Flexible NetFlow
    • QoS: Distributed Policing, DSCP Mutation, Aggregate Policers, Microflow Policers
    • Security: Cisco TrustSec (CTS), Role-Based ACL, Layer 2 ACL, ACL Dry Run, ACL Hitless Commit, Layer 2 + Layer 3 + Layer 4 ACL, Classification Enhancements, Per Protocol Drop (IPv4, IPv6, MPLS), Increase in ACL Label Support, Increase in ACL TCAM Capacity, Source MAC + IP Binding, Drop on Source MAC Miss, RPF Check Interfaces, RPF Checks for IP Multicast Packets

So, do you upgrade to a Sup2T? It depends. The question comes down to what you need more: speed or features. The Sup2T is extending the life of the 6500E chassis with speed and a boatload of features. That said, you can’t scale the 6500 to the sort of 10Gbps port density you can a Nexus. Besides, most of the features found on a 6500 aren’t going to be used by most customers. If your 6500 is positioned as a core switch, then what you really need is the core functionality of L2 and L3 forwarding to be performed as quickly as possible with minimal downtime. To me, the place to go next is the Nexus line if that description of “core” is your greatest need.

If instead you need a super-rich feature set, then the question is harder to answer. The Nexus has a ways to go before offering all of the features the Catalyst does. That’s not to say that all a Nexus offers is throughput. True, NX-OS lacks the maturity of IOS, but it offers stability better than IOS-SX and features that most customers need.

In some ways, I’m making an unfair comparison. Nexus7K and Cat6500 have different purposes, and solve different problems. But for most customers, I think either platform could meet the needs. So if you’re looking for a chassis you can leave in the rack for a very long time, it’s time to look seriously at Nexus, rejecting it only if there’s some specific function it lacks that you require. If the Nexus platform can’t solve all of your problems, then you probably have requirements that are different from merely “going faster”. The 6500/Sup2T may make sense for you.

---Original reading from packetpushers.net

More Cisco 6500 Notes:

Is Catalyst 6500 Supervisor 2T Your Upgrade Answer?

The Supervisor 2T provides 2-terabit system performance for 80Gbps switching capacity per slot on all Catalyst 6500 E-Series Chassis. As a result, you can:

  • Maintain investment protection through backward compatibility
  • Deliver scalability and performance improvements such as distributed forwarding (dCEF) 720Mpps with the fourth-generation Policy Feature Card (PFC4)
  • Support future 40Gbps interface and nonblocking 10Gbps modules
  • Enable new applications and services with hardware accelerated VPLS, Layer 2 over mGRE for Network Virtualization
  • Take advantage of integrated Connectivity Management Processor (CMP) for improved out-of-band management.

 

By Cisco & Cisco Router, Network Switch - Posted in: Cisco Switches, Cisco Firewall
Enter comment - View the 0 comments
Thursday 12 april 2012 4 12 /04 /Apr /2012 11:14

 

Cisco Catalyst switches equipped with the Enhanced Multilayer Image (EMI) can work as Layer 3 devices with full routing capabilities. Example switch models that support layer 3 routing are the 3550, 3750, 3560 etc.

On a Layer3-capable switch, the port interfaces work as Layer 2 access ports by default, but you can also configure them as “Routed Ports” which act as normal router interfaces. That is, you can assign an IP address directly on the routed port. Moreover, you can configure also a Switch Vlan Interface (SVI) with the “interface vlan” command which acts as a virtual layer 3 interface on the Layer3 switch.

On this post I will describe a scenario with a Layer3 switch acting as “Inter Vlan Routing” device together with two Layer2 switches acting as closet access switches. See the diagram below:

How-to-Configure-a-Cisco-Layer-3-switch-Inter-VLAN--copy-1.jpg

Interface Fa0/48 of the Layer3 switch is configured as a Routed Port with IP address 10.0.0.1. Two Vlans are configured on the L3 switch, Vlan10 and Vlan20. For Vlan10 we will create an SVI with IP address 10.10.10.10 and for Vlan20 an SVI with IP address 10.20.20.20. These two IP addresses will be the default gateway addresses for hosts belonging to Vlan10 and Vlan20 on the Layer2 switches respectively. That is, hosts connected on Vlan10 on the closet L2 switches will have as default gateway the IP address 10.10.10.10. Similarly, hosts connected on Vlan20 on the closet switches will have address 10.20.20.20 as their default gateway. Traffic between Vlan10 and Vlan20 will be routed by the L3 Switch (InterVlan Routing). Also, all interfaces connecting the three switches must be configured as Trunk Ports in order to allow Vlan10 and Vlan20 tagged frames to pass between switches. Let’s see a configuration snapshot for all switches below:

Cisco L2 Switch (same configuration for both switches)

!  Create VLANs 10 and 20 in the switch database
Layer2-Switch# configure terminal
Layer2-Switch(config)# vlan 10
Layer2-Switch(config-vlan)# end

 

Layer2-Switch(config)# vlan 20
Layer2-Switch(config-vlan)# end

 

!  Assign Port Fe0/1 in VLAN 10
Layer2-Switch(config)# interface fastethernet0/1
Layer2-Switch(config-if)# switchport mode access
Layer2-Switch(config-if)# switchport access vlan 10
Layer2-Switch(config-if)# end

 

!  Assign Port Fe0/2 in VLAN 20
Layer2-Switch(config)# interface fastethernet0/2
Layer2-Switch(config-if)# switchport mode access
Layer2-Switch(config-if)# switchport access vlan 20
Layer2-Switch(config-if)# end

 

!  Create Trunk Port Fe0/24
Layer2-Switch(config)# interface fastethernet0/24
Layer2-Switch(config-if)# switchport mode trunk
Layer2-Switch(config-if)# switchport trunk encapsulation dot1q
Layer2-Switch(config-if)# end

 

Cisco Layer 3 Switch

! Enable Layer 3 routing
Layer3-Switch(config) # ip routing

 

!  Create VLANs 10 and 20 in the switch database
Layer3-Switch# configure terminal
Layer3-Switch(config)# vlan 10
Layer3-Switch(config-vlan)# end

 

Layer3-Switch(config)# vlan 20
Layer3-Switch(config-vlan)# end

 

!  Configure a Routed Port for connecting to the ASA firewall 
Layer3-Switch(config)# interface FastEthernet0/48
Layer3-Switch(config-if)# description To Internet Firewall
Layer3-Switch(config-if)# no switchport
Layer3-Switch(config-if)# ip address 10.0.0.1 255.255.255.252

 

!  Create Trunk Ports Fe0/47 Fe0/46
Layer3-Switch(config)# interface fastethernet0/47
Layer3-Switch(config-if)# switchport mode trunk
Layer3-Switch(config-if)# switchport trunk encapsulation dot1q
Layer3-Switch(config-if)# end

 

Layer3-Switch(config)# interface fastethernet0/46
Layer3-Switch(config-if)# switchport mode trunk
Layer3-Switch(config-if)# switchport trunk encapsulation dot1q
Layer3-Switch(config-if)# end

 

!  Configure Switch Vlan Interfaces (SVI)
Layer3-Switch(config)# interface vlan10
Layer3-Switch(config-if)# ip address 10.10.10.10 255.255.255.0
Layer3-Switch(config-if)# no shut

 

Layer3-Switch(config)# interface vlan20
Layer3-Switch(config-if)# ip address 10.20.20.20 255.255.255.0
Layer3-Switch(config-if)# no shut

 

!  Configure default route towards ASA firewall
Layer3-Switch(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.2

 

NOTE: More discussion of Cisco Layer 3 switch-InterVLAN Routing Configuration from Cisco users you can visit: networkstraining.com

Discussion: Router vs. Layer 3 Switches

Layer 2 Switches & Layer 3 switches

 

By Cisco & Cisco Router, Network Switch - Posted in: Cisco Switches, Cisco Firewall
Enter comment - View the 2 comments
Wednesday 11 april 2012 3 11 /04 /Apr /2012 09:52

Cisco ASA firewall licensing used to be pretty simple, but as features were rolled out as licenses, the scheme became quite complex. The matters are further complicated since different appliances and versions change the rules. This document will help you make sense of ASA licensing, but is not intended to be used as a design guide. Make sure you work with your reseller if you are looking to deploy these features.

  Cisco-firewalls.jpg

Security Plus

Security Plus licensing exists only on 5505 and 5510. On the 5505 it has the following effects:

  • Upgrades the maximum VPN sessions from 10 to 25.
  • Upgrades the maximum connections from 10,000 to 25,000.
  • Increases the number of VLANs from 3 to 20 and enables trunking.
  • Enables optional stateless active/standby failover.

 

On the 5510 it has slightly different set of features it enables:

  • Upgrades the maximum connections from 50,000 to 130,000.
  • Moves 2 of the 5 FastEthernet ports to 10/100/1000.
  • Increases the number of VLANs from 50 to 100.
  • Enables security contexts and allows for 2. Up to 5 can be supported on the 5510.
  • Enables optional active/active and active/standby failover.
  • Enables VPN clustering and load balancing.

 

The CISCO 5520 and up do not have Security Plus licensing. They come with the Base license and need nothing more to get the most performance out of the unit. Update: As Stojan pointed out in the comments, the 5585X series does have Security Plus licenses which enables the 10GB SFP+ slots.

 

Cisco ASA 5505 User Licenses

The 5505 is the only ASA which has a restriction on the number of “users” behind a firewall. A user is considered an internal device which communicates with the external VLAN. By default the 5505 ships with a 10 user license but can be upgraded to 50 or unlimited users.

 

SSL VPN Licenses

SSL VPN debuted on the ASA when it was first released but has evolved more than any other licensed based feature on the ASA.

 

SSL licenses break into two general types: Essentials and Premium. Essentials provides AnyConnect client based connections from personal computers including Windows and Mac systems. Installing an Essentials license allows for up to the maximum number of VPN sessions on the platform to be concurrently used for SSL. For example, a 5510 would immediately allow for up to 250 SSL VPN connections from the AnyConnect client. These licenses are relatively inexpensive, currently priced around a hundred dollars with the price varying per platform. These are platform specific SKUs so make sure the one you’re buying matches the device it is going on. For example, on the 5510 make sure the license is L-ASA-AC-E-5510=. AnyConnect Essentials licenses debuted with ASA release v8.2.

Premium licenses are more complicated than Essentials. Premium licenses allow for both AnyConnect client based and clientless SSL VPN. Clientless VPN is established through a web browser. While it is typically less functional than AnyConnect client based VPN, it is adequate access for many users. Additionally, Cisco Secure Desktop (Host Scan and Vault functionality) is included. Premium licenses do not max out the unit they’re on of SSL VPN sessions as does the Essentials license. Instead, this is a per seat license that can be purchased in bulk quantities. These quantities are 10, 25, 50, 100, 250, 500, 750, 1000, 2500, 5000, 10000 with each platform being able to support only the maximum number of licenses which it supports total VPN connections (ex. 5510 supports up to 250). These tiers must be observed when adding additional licensing. For example, if an administrator needed 35 concurrent clientless connections a 50 connection pack would need to be purchased. The 10 and 25 cannot be stacked. Cisco does offer upgrade licenses to upgrade tiers. Premium licenses are significantly more expensive than Essentials. Contact your reseller for pricing on Premium licenses.

If a VPN license is activated on an ASA, it will overwrite any existing VPN license. Be careful!

 

HA Pair License Dynamics

Prior to ASA software v8.3, licenses had to be identical on a HA pair. A 5510 with SSL VPN enabled wouldn’t pair with a 5510 lacking SSL VPN. As of v8.3, most licenses are replicated on a HA pair. On a 5505 or 5510 both ASAs require Security Plus licenses since Security Plus enables the HA functionality. SSL Essentials and Premium are replicated between licenses.

In an active/active pair, license quantities (when applicable) are merged. For example, two 5510s are in an active/active pair with 100 SSL Premium seats each. The licenses will merge to have a total of 200 SSL VPNs allowed in the pair. The combined number must be below the platform limitation. If the count exceeds the platform limit (ex. 250 SSL VPN connections on a 5510) the platform limit will be used on each.

 

Flex Licenses

ASA Flex licenses are temporary SSL VPN licenses for emergencies or situations where there is a temporary peak in SSL VPN connections. Each license is valid for 60 days. Perhaps these are best explained as a scenario.

XYZ Corp. had some flooding in their corporate office which houses 600 employees. They own an ASA 5520 with 50 SSL Premium licenses. Cisco’s Flex licenses will allow them to temporarily ‘burst’ the number of licenses their 5520 is enabled for. The key for 750 users is added to the 5520, starting the 60 day timer. The 5520 is now licensed to support up to 750 SSL VPN users on client based or clientless VPN. After 60 days the key will expire.

If XYZ Corp. has their building up and running again earlier than 60 days, the administrator can disable the temporary license by reactivating the permanent license they were previously using. This will pause the timer on the Flex licenses, allowing them to use the remainder of the time in the future.

Cisco’s Flex license documentation is pretty good and explains some of the gotchas around the licenses. Be sure to read it before purchasing and using the license.

 

AnyConnect Premium Shared Licenses

Large deployments of SSL VPN may require multiple ASAs positioned in multiple geographic areas. Shared licenses allow a single purchase of SSL VPN licenses to be used on multiple ASAs, possibly over large physical areas. Starting with software v8.2, Cisco allows the shared license to ease this situation. Shared licenses are broken into two types: main and participant. The main license starts at 500 SSL Premium sessions and scales to 100,000 sessions. The main license acts as a license pool which participants pull from in 50 session increments. A secondary ASA can act as a backup in case the primary fails. There is no specific backup license, as the ASA only requires a participant license. If there is no secondary ASA, the participant ASAs may not be able to reach the main ASA in the event of a connectivity problem. The participant ASA is able to use the sessions that were last borrowed from the main for 24 hours. Beyond 24 hours, the sessions are released. Currently connected clients are not disconnected but new connections are not allowed.

In Active/Standby mode, the server ASA is actually the ASA pair. The backup ASA would be the backup pair. The standby server in a pair wouldn’t be the shared license backup. The manual explains this concept pretty well:

“For example, you have a network with 2 failover pairs. Pair #1 includes the main licensing server. Pair #2 includes the backup server. When the primary unit from Pair #1 goes down, the standby unit immediately becomes the new main licensing server. The backup server from Pair #2 never gets used. Only if both units in Pair #1 go down does the backup server in Pair #2 come into use as the shared licensing server. If Pair #1 remains down, and the primary unit in Pair #2 goes down, then the standby unit in Pair #2 comes into use as the shared licensing server.”http://www.cisco.com/en/US/docs/security/asa/asa84/license/license_management/license.html#wp1487930

 

Advanced Endpoint Assessment

Advanced Endpoint Assessment will scan a SSL VPN client using Cisco Secure Desktop for security policy compliance and attempt to remediate if the system is out of compliance. This is similar but a little less feature-rich than NAC. Licenses are simple for Advanced Endpoint Assessment. One license per ASA is required in addition to SSL Premium. If the ASA is in a HA pair, one license per pair is required if using ASA software v. 8.3(1) or later.

 

Security Contexts

Security Contexts are virtual firewalls. Each context allows for its own set of rules and default policies. Security Contexts are sold in quantities of 5, 10, 20, 50, 100 and cannot be stacked. Cisco sells incremental licensing to move between tiers. Note that two security contexts are used when in a HA pair.

 

Unified Communications Proxy Licenses

Cisco UC Proxy allows for Cisco IP phones to create a TLS tunnel between a remote phone and the ASA located at a corporate office. Typically if a secure connection between a phone and office were required, a firewall would have to sit at the user’s location. In many cases this would be a 800 series router. This deployment architecture doesn’t scale well due to management costs and cost of routers with their corresponding SMARTnet. UC Proxy bypasses the router and uses the IP phone as the VPN endpoint.

UC Proxy licenses are sold in numerous tiers ranging from 24 to 10,000 concurrent connections. The licenses cannot be stacked, but incremental licenses can be purchased.

 

AnyConnect Mobile Licenses

Out of the box, ASAs do not accept connections from mobile devices such as iOS or Android systems. The AnyConnect Mobile client must be installed on the client’s device. In addition to the client, the ASA must have AnyConnect Essentials or Premium enabled and a Mobile license used in conjunction. Only one Mobile license is required per ASA. The Mobile license inherits the number of SSL users allowed by Essentials or Premium.

 

Intercompany Media Engine

IME is a UC feature which allows for interoperability between organizations using Communications Manager. Licensing is simple, as a single IME license is required on the ASA.

 ---From http://packetpushers.net/cisco-asa-licensing-explained/

More Related: Cisco ASA 5510 Firewall Basic Configuration Tutorial

Simple Steps to Connect a Remote Office to Cisco ASA 5510

By Cisco & Cisco Router, Network Switch - Posted in: Cisco Switches, Cisco Firewall
Enter comment - View the 0 comments
Thursday 5 april 2012 4 05 /04 /Apr /2012 08:48

There is a basic configuration tutorial for the Cisco ASA 5510 security appliance. This device is the second model in the ASA series (ASA 5505, 5510, 5520 etc) and is fairly popular since is intended for small to medium enterprises. Like the smallest ASA 5505 model, the Cisco ASA 5510 comes with two license options: The Base license and the Security Plus license. The second one (security plus) provides some performance and hardware enhancements over the base license, such as 130,000 Maximum firewall connections (instead of 50,000), 100 Maximum VLANs (instead of 50), Failover Redundancy, etc. Also, the security plus license enables two of the five firewall network ports to work as 10/100/1000 instead of only 10/100.


Next we will see a simple Internet Access scenario which will help us understand the basic steps needed to setup an ASA 5510. Assume that we are assigned a static public IP address 100.100.100.1 from our ISP. Also, the internal LAN network belongs to subnet 192.168.10.0/24. Interface Ethernet0/0 will be connected on the outside (towards the ISP), and Ethernet0/1 will be connected to the Inside LAN switch.

 

The firewall will be configured to supply IP addresses dynamically (using DHCP) to the internal hosts. All outbound communication (from inside to outside) will be translated using Port Address Translation (PAT) on the outside public interface. Let's see a snippet of the required configuration steps for this basic scenario:

 

Step1: Configure a privileged level password (enable password)
By default there is no password for accessing the ASA firewall, so the first step before doing anything else is to configure a privileged level password, which will be needed to allow subsequent access to the appliance. Configure this under Configuration Mode:

ASA5510(config)# enable password mysecretpassword

 

Step2: Configure the public outside interface
ASA5510(config)# interface Ethernet0/0
ASA5510(config-if)# nameif outside
ASA5510(config-if)# security-level 0
ASA5510(config-if)# ip address 100.100.100.1 255.255.255.252
ASA5510(config-if)# no shut

 

Step3: Configure the trusted internal interface
ASA5510(config)# interface Ethernet0/1
ASA5510(config-if)# nameif inside
ASA5510(config-if)# security-level 100
ASA5510(config-if)# ip address 192.168.10.1 255.255.255.0
ASA5510(config-if)# no shut

 

Step 4: Configure PAT on the outside interface
ASA5510(config)# global (outside) 1 interface
ASA5510(config)# nat (inside) 1 0.0.0.0 0.0.0.0

 

Step 5: Configure Default Route towards the ISP (assume default gateway is 100.100.100.2)
ASA5510(config)# route outside 0.0.0.0 0.0.0.0 100.100.100.2 1

 

Step 6: Configure the firewall to assign internal IP and DNS address to hosts using DHCP
ASA5510(config)# dhcpd dns 200.200.200.10
ASA5510(config)# dhcpd address 192.168.10.10-192.168.10.200 inside
ASA5510(config)# dhcpd enable inside

 

More Related: How to Configure Cisco ASA 5505 Firewall?...

By Cisco & Cisco Router, Network Switch - Posted in: Cisco Switches, Cisco Firewall
Enter comment - View the 0 comments
Friday 23 march 2012 5 23 /03 /Mar /2012 10:37

Creating network designs for people is not an easy task, for many factors and requirements need considering. It’s the fact that most organizations do not upgrade their LAN to prepare for the future – most of them don’t touch the network as long as it is running properly and supporting the user’s applications. When starting the planning process for putting a secure voice system on the network, which takes the network requirements to another level.

Core-distribution-Access.jpg

There is a lot more to consider than QoS for putting voice on the LAN, although that is what the discussion is usually centered around. The LAN also has to have a number of other attributes:

  1. Secure - with voice on the LAN, the switches must have security features that can prevent them from getting attacked with MAC address floods, rogue DHCP servers, gratuitous ARP’s changing the default gateway, and other attacks that can be launched by malware.
  2. Fast - If voice goes through multiple switches, each hop can add latency. Instead of store and forward of the ethernet frames, switches should use cut-through to move things along. Server and uplink speeds should be gigabit, while for most organizations 10/100 Mbsp to the desktop is just fine.
  3. QoS - As discussed above. This comes into play mostly in uplinks. When remote access layer closets are connected back to the distribution layer, there is a choke point in the LAN. Any choke points require queuing to prioritize the voice.
  4. Reliable - Long Mean Time Between Failure, well tested code to limit bugs, good support from the manufacturer in case there is a software or hardware issue.
  5. Managable - The switches have to be able to be managed remotely, have SNMP information, be able to log, and be configurable. GUI interfaces are ok, but there is nothing like a solid command line interface for rapid configuration, troubleshooting, and repair.
  6. Power Density- Switches have to be able to support the power density of the planned devices. Most switches cannot power all ports at the highest levels.
  7. Power and Cooling – Since IP phones are powered from the switches, all access layer switches will require properly sized UPS’s. A basic switch consumes about 60 Watts. A 48 port switch with 15 Watt phones plugged into every port will require at least 600 Watts. Put a few of those switches in the closet an you are looking at not only a much bigger UPS, but also better cooling.
  8. Redundant Design – The only place that there should be a single point of failure is at the access layer in the closets. If a switch fails, only the devices connected to that switch should lose connectivity – all others should work around the issue. In most cases that means dual uplinks from each closet to a redundant distribution layer at the core.

An excellent reference to everything discussed above is the Cisco Campus Network for High Availability Design Guide. This drawing shows both redundant uplinks and the single points of failure that are acceptable:

redundant-uplinks-and-the-single-points-of-failure-that-are.jpg

When all the requirements for a good LAN that can support voice are evaluated, it turns out that it prepares the network for future requirements as well, like IP security cameras, wireless access points, and other devices that may hang off the LAN.

It is certainly possible to build out a LAN with non-Cisco switches, but there are so many little things that are useful with Cisco switches, and they tend to be price competitive, that it is usually best to go with them. For example, one of the most useful tools is Cisco Discovery Protocol, which lets you see what other CDP devices are connected to an individual switch. I use this all the time to work my way through a network and find out where devices are located.

Having set a baseline for what we are looking for in a LAN switch, we can overview a variety of Cisco switches that are available and largely required by small to large businesses. And most of them serve a useful purpose for different situations.

Cisco Catalyst 2960 Series – a type of useful, versatile switch. It is layer 2 only, so no routing. The 24 port 10/100 POE version is great. It includes two gigabit dual-personality uplink ports, so a stack can be linked together, and then the top and bottom of the stack can be connected by fiber to the distribution switches. This switch is good and popular.

Cisco 3560 Series Similar to the 2960, but has a few more features. This is a layer 3 switch, and has three different classes of IOS. The IP base includes static routing, EIGRP stub, but no multicast routing. IP services includes the full routing features set. IP Advanced Services includes IPV6 on top of everything else. The SFP ports have to be populated with either copper or fiber gig SFP’s to uplink.

Cisco 3750 – This is just like the 3560, but with one big difference. The 3750 includes two Stackwise connectors on the back of the switch, allowing up to nine switches to be stacked together using a 32 Gbps backplane speed. The stack is managed as a single switch, and uplink ports on different switches can be connected together with EtherChannel so that multi-gigabit closet uplinks can be obtained. For an inexpensive distribution layer, a small stack of 3750 switches is ideal. The entire stack is limited to 32 Gbps of throughput, so this is not a good server switch for more than about 20 servers.

Cisco 4500 – This is a chassis switch that is designed to be used in the access layer.  The internal design is optimized for connecting a bunch of users and uplinking out of the closet, since the internal connections the different thirds of each blade is limited to 2 Gbps in most of the linecards. The latest version of the blades and supervisor are faster, but are still oversubscribed, so this should not be used for a distribution or server switch. It is a great access layer closet switch for high density (>200 users) gigabit POE to the desktop.

Cisco 3560E Series The E version of the 3560 switches are gigabit to the desktop and 10 gigabit uplink and aggregation. They also have modular power supplies so that every port on a 48 port switch can be powered to the highes level if required.

Cisco 3750E – gigabit speed, 10 Gbps uplinks, and Stackwise+ for switch interconnection. Stackwise+ is twice the speed of Stackwise at 64 Gbps, but has a much higher comparative speed since all traffic that is on one switch can stay on the switch, whereas with Stackwise on the 3750′s all traffic traverses the Stackwise link.

Cisco Catalyst 6500 Swithces Excellent switch, very useful as a distribution and server switch. The switch has three backplanes, and it is worthwhile looking at the connection speed of the supervisor engines and blades before making a decision. The legacy backplane is still available using the Sup720; it is a 32 Gbps shared backplane. New blades use either CEF256, which is a 8 Gbps connection, or CEF720, which uses dual 20Gbps connections.

  • The Cisco 6500 blades can have distributed routing features, or dCEF. These are typically not required except for the most challenging networks.
  • The most cost-effective and reliable method for setting up a 6500 is to use a single chassis6509  with redundant power supplies, redundant supervisor engines, dual 6748 gigabit blades for server connectivity, and dual 6748 fiber uplink blades for connecting remote wiring closets.
  • The Cisco 6509 has no limitations – any blade can go into any slot. The Catalyst 6513 has more slots, but only the bottom four can accept the CEF720 blades, the top seven slots connect at CEF256 or slower.
  • My preference is to usually use this box as just a switch, and put routing, firewall, wireless control and other functions in dedicated boxes, but there are certain situations where the ability to put services modules like the ACE module, IPS modules, or Firewall services module in the 6500 solve a specific technical problem.

 

So, some examples of good designs:

  1. If there are between 500 and 2000 hosts on a LAN, then single or dual 6500′s at the core/distribution layer are appropriate. Stacks of 3750′s or 2960′s in the closet with gigabit uplinks back to the distribution layer are appropriate.
  2. For between 100 and 500 hosts on a LAN, then a stack of 3750E or 3750 switches at the core/distribution layer and a stack of 2960′s in the closets would be a good design for most organizations.
  3. For <100 hosts, a good design is dual 3750′s at the distribution layer with 2960′s for access layer. If price is the deciding factor then a stack of 2960′s is appropriate.

 

Examples of non-optimal designs that I have seen:

  1. Putting a single Cisco 3750 in an access layer closet. There is no reason for this, as the primary benefit of the 3750 is its Stackwise system. If there is only one, then no stacking is required.
  2. Adding dCEF capability to a 6500 when there is very little routing to be done in the system, and the 6500 is nowhere near hitting its performance limit with all routing being done in the supervisor engine.
  3. Having a mismatch between power draw and power supply on the switch. This can happen from having power supplies that are too small, or loading too many POE devices onto an underpowered 48 port switch.

One of the most useful devices to increase reliability of the switching infrastructure is a backup power supply. One of my rules of thumb is that moving parts break first, so the most likely item to fail in the switch is the power supply and/or cooling fans. Every Cisco switch and most of the smaller routers have a DC port in the back. That is for backup power.

The Cisco RPS675 can be used as backup power. It has dual power supplies, and can connect to six different devices. If those devices ever lose their power supply, then the RPS box will provide power via the DC power port, and everything will contine to run. The only tricky thing is ordering the correct cables. There is one set of cables for E versions of switches, and another set for all other devices.

Putting together a LAN upgrade design is a relatively straightforward process. The difference between a good design and a poor one really come down to the details. No one wants to get a cheap network that will not handle the needs of the organization in the next few years and have to be replaced, and converseley most organizations would not want to pay for an oversized network that is too expensive.

It is best to get a design done from a reseller that regularly sells deploys the products they are recommending. Good VAR’s will stay on top of the new products that are out, and will change their recommendations are based on the customer’s needs and budget. I would argue that a good VAR can put together a better design than a sales engineer from a manufacturer. The VAR is responsible for making it work within budget, whereas the manufacturer will not do the installation, and is compensated for selling as much equipment as possible.

 

More Cisco hardware guide and info you can visit: http://www.router-switch.com/Price-cisco-switches-cisco-switch-catalyst-3560_c22?page=3

By Cisco & Cisco Router, Network Switch - Posted in: Cisco Switches, Cisco Firewall
Enter comment - View the 0 comments

Présentation

  • : Cisco & Cisco Network Hardware News and Technology
  • Cisco & Cisco Network Hardware News and Technology
  • : Hardware Cisco news Cisco network technology Networking solution Cisco Internet
  • : There are all kinds of news and information related to Cisco and Cisco network equipment, such as release of Cisco equipment, news of Cisco's new networking solution, and Cisco hardware and software upgrading...
  • Share this blog
  • Back to homepage
  • Contact

Calendrier

October 2014
M T W T F S S
    1 2 3 4 5
6 7 8 9 10 11 12
13 14 15 16 17 18 19
20 21 22 23 24 25 26
27 28 29 30 31    
<< < > >>
Create your blog for free on over-blog.com - Contact - Terms of Service - Earn Royalties - Report abuse - Most commented articles