James Mason's Blog -or- The Journal of Contemporary Lunacy

After a few years without having to think about it, I decided to dip my toe back into the murky waters of Zone Based Firewalls recently. Luckily, I'd written enough notes and comments in my previous configs that only a small amount of searching and reading was needed before I got back up to speed. In that vein, here's a very basic starter ZBF config (for when I forget again in six months *derp*)... Create an ACL to hold any firewall exceptions: ip access-list extended aclFirewallExceptions  permit tcp any any eq 56881  permit tcp any any eq 10022 Then, add the ACL to a Class Map: class-map type inspect match-any cmFirewallExceptions  match access-group name aclFirewallExceptions After that, the Class Map is added to a Policy Map: policy-map type inspect pmWanToLan  class type inspect cmFirewallExceptions   inspect  class class-default   drop The policy map is then applied to the relevant Zone Pair: zone-pair security zpWanToLan source WAN de...

After putting in a new shelf and tidying up my network gear a week ago - as seen below - it was time to organize the Cisco routers I'd picked up off eBay during the week. First thing to do was add the extra WICs I'd bought (WIC-1Ts as they could be had for around $15, whereas 2Ts started at $30). The 2821 - maxed out spec-wise and already running IOS 15.1 - came with no WICs at all, while I chose one of the 2600-series to be 'piggy-in-the-middle', so to speak, and it now has two serial cards. And that was that. The 3 routers are now sitting on the trolley I picked up a couple weeks back (much cheaper than a wheeled-rack; easily movable/adjustable). Above them the switch setup is starting to take shape with the two 3550s that just came in the post. I'll add the 2950 I already have and hopefully a couple more - either more 3550s or perhaps a 2960 or two. With 4 or more I should be able to setup some decent LACP, PAgP and STP scenarios, along with L3 ro...

For a little bit of extra practice before the CCNA exam, I hooked up a small lab with a couple switches bridged to emulated routers (running under GNS3 on the laptop). The reason for the multiple trunks between the switches was to test out Spanning Tree. I was going to setup link aggregation as well, but the 3500XL didn't want to play ball. I found out later that it doesn't support PAgP or LACP , so the method for setting up aggregation is different. VTP and CDP worked properly overly the bridged link - as they should, but I was expecting something to go wrong for some reason (pessimism?). Minicom also played ball with the USB-to-serial adapter (for the console cable), which is always handy too :)