Best practice for integrating a 3 point metro-e in to our network.

Hello,
We have just started to integrate a new 3 point metro-e wan connection to our main school office. We are moving from point to point T-1?s to 10 MB metro-e. At the main office we have a 50 MB going out to 3 other sites at 10 MB each. For two of the remote sites we have purchase new routers ? which should be straight up configurations. We are having an issue connecting the main office with the 3rd site.
At the main office we have a Catalyst 4006 and at the 3rd site we are trying to connect to a catalyst 4503.
I have attached configurations from both the main office and 3rd remote site as well as a basic diagram of how everything physically connects. These configurations are not working ? we feel that it is a gateway type problem ? but have reached no great solutions. We have tried posting to a different forum ? but so far unable to find the a solution that helps.
The problem I am having is on the remote side. I can reach the remote catalyst from the main site, but I cannot reach the devices on the other side of the remote catalyst however the remote catalyst can see devices on it's side as well as devices at the main site.
We have also tried trunking the ports on both sides and using encapsulation dot10q ? but when we do this the 3rd site is able to pick up a DHCP address from the main office ? and we do not feel that is correct. But it works ? is this not causing a large broad cast domain?
If you have any questions or need further configuration data please let me know.
The previous connection was a T1 connection through a 2620 but this is not compatible with metro-e so we are trying to connect directly through the catalysts.
The other two connection points will be connecting through cisco routers that are compatible with metro-e so i don't think I'll have problems with those sites.
Any and all help is greatly welcome ? as this is our 1st metro e project and want to make sure we are following best practices for this type of integration.
Thank you in advance for your help.
Jeff

Jeff, form your config it seems you main site and remote site are not adjacent in eigrp.
Try adding a network statement for the 171.0 link and form a neighbourship between main and remote site for the L3 routing to work.
Upon this you should be able to reach the remote site hosts.
HTH-Cheers,
Swaroop

Similar Messages

Best practice for integrating oracle atg with external web service

Hi All
What is the best practice for integrating oracle atg with external web service? Is it using integration repository or calling the web service directly from the java class using a WS client?
With Thanks & Regards
Abhishek

Using Integration Repository might cause performance overhead based on the operation you are doing, I have never used Integration Repository for 3rd Party integration therefore I am not able to make any comment on this.
Calling directly as a Java Client is an easy approach and you can use ATG component framework to support that by making the endpoint, security credentials etc as configurable properties.
Cheers
R
Edited by: Rajeev_R on Apr 29, 2013 3:49 AM

Tips n Tricks/Best Practices for integrating iPhone, iPad and MacBook Pro

My wife just purchased an iPhone, iPad and Macbook Pro for her non profit consulting business and I was wondering if a tips and tricks or best practices for efficiently and productively integrating these devices exists?

http://www.apple.com/icloud/

What is best practice for integration with freight forwarders?

Hello,
We are looking into the possibilities for automatically exchanging data with one of our freight forwarders. We will send them our shipment information and they will send back shipment status and date information including some additional information like the house bill. Sending the shipment data from our SAP (ECC 6) system is no issue, we have done that before. What is new to us is receiving back the status updates from the forwarder. Is there a kind of best practice of where to store this information on the shipment (or in a separate tabel) and what standard function module or BADI to use for this?
We are using ECC 6.0 sales and distribution, but no transportation management or SCM modules.
Would, like to hear the experiences of people who have done this type of intergration with their forwarders.
Regards,
Ed

SAP have added SAP TM 8.10 as a separate package which is also integrated with R/3 which means, a separate server is required if SAP TM needs to be implemented which will take care of your expectations. For more information on this, search in Google so that you will get couple of documentations on this topic.
G. Lakshmipathi

Best Practices for Integrating UC-5x0's with SBS 2003/8?

Almost all of Cisco's SBCS market is the small and medium business space. Most, if not all of these SMB's have a Microsoft Small Business Server 2003 or 2008. It will be critical, In order for Cisco to be considered as a purchase option, that the UC-5x0 integrates well into these networks.
To that end, I see a lot of talk here about how to implement parts and pieces of this, but no guidance from Cisco, no labs and no best practices or other documentation. If I am wrong, please correct me.
I am currently stumbling through and validating these configurations myself, Once complete, I will post detailed recommendations. However, it would have been nice to have a lab to follow instead of having to learn from each mistake.
Some of the challanges include;
1. Where should the UC-540 be placed: As the gateway for QOS or behind a validated UC-5x0 router/security appliance combination
2. Should the Microsoft Windows Small Business Server handle DCHP (as Microsoft's documentation says it must), or must the UC-540 handle DHCP to prevent loss of features? What about a DHCP relay scheme?
3. Which device should handle DNS?
My documentation (and I recommend that any Cisco Lab/Best Practice guidence include it as well) will assume the following real-world scenario, the same which applies to a majority of my SMB clients;
1. A UC-540 device utilizing SIP for the cost savings
2. High Speed Internet with 5 static routable IP addresses
3. An existing Microsoft Small Business Server 2003/8
4. An additional Line of Business Application or Terminal Server that utilizes the same ports (i.e. TCP 80/443/3389) as the UC-540 and the SBS, but on seperate routable IP's (Making up crazy non-standard port redirections is not an option).
5. A employee who teleworks from various places that provide a seat and a network jack, which is not under our control (i.e. a employees home, a clients' office, or a telework center). This teleworker should use the built in VPN feature within the SPA or 7925G phones because we will not have administrative access to any third party's VPN/firewall.
Your thoughs appreciated.

Progress Report;
The following changes have been made to the router in support of the previously detailed scenario. Everything appears to be working as intended.
DHCP is still on the UC540 for now. DNS is being performed by the SBS 2008.
Interestingly, the CCA still works. The NAT module even shows all the private mapped IP's, but no the corresponding public IP's. I wouldnt recommend trying to make any changes via the CCA in the NAT module.
To review, this configuration assumes the following;
1. The UC540 has a public IP address of 4.2.2.2
2. A Microsoft Small Business Server 2008 using an internal IP of 192.168.10.10 has an external IP of 4.2.2.3.
3. A third line of business application server with www, https and RDP that has an internal IP of 192.168.10.11 and an external IP of 4.2.2.4
First, backup your current configuration via the CCA,
Next, telent into the UC540, login, edit, cut and paste the following to 1:1 NAT the 2 additional public IP addresses;
ip nat inside source static tcp 192.168.10.10 25 4.2.2.3 25 extendable
ip nat inside source static tcp 192.168.10.10 80 4.2.2.3 80 extendable
ip nat inside source static tcp 192.168.10.10 443 4.2.2.3 443 extendable
ip nat inside source static tcp 192.168.10.10 987 4.2.2.3 987 extendable
ip nat inside source static tcp 192.168.10.10 1723 4.2.2.3 1723 extendable
ip nat inside source static tcp 192.168.10.10 3389 4.2.2.3 3389 extendable
ip nat inside source static tcp 192.168.10.11 80 4.2.2.4 80 extendable
ip nat inside source static tcp 192.168.10.11 443 4.2.2.4 443 extendable
ip nat inside source static tcp 192.168.10.11 3389 4.2.2.4 3389 extendable
Next, you will need to amend your UC540's default ACL.
First, copy what you have existing as I have done below (in bold), and paste them into a notepad.
Then, im told the best practice is to delete the entire existing list first, finally adding the new rules back, along with the addition of rules for your SBS an LOB server (mine in bold) as follows;
int fas 0/0
no ip access-group 104 in
no access-list 104
access-list 104 remark auto generated by SDM firewall configuration##NO_ACES_24##
access-list 104 remark SDM_ACL Category=1
access-list 104 permit tcp any host 4.2.2.3 eq 25 log
access-list 104 permit tcp any host 4.2.2.3 eq 80 log
access-list 104 permit tcp any host 4.2.2.3 eq 443 log
access-list 104 permit tcp any host 4.2.2.3 eq 987 log
access-list 104 permit tcp any host 4.2.2.3 eq 1723 log
access-list 104 permit tcp any host 4.2.2.3.35 eq 3389 log
access-list 104 permit tcp any host 4.2.2.4 eq 80 log
access-list 104 permit tcp any host 4.2.2.4 eq 443 log
access-list 104 permit tcp any host 4.2.2.4 eq 3389 log
access-list 104 permit udp host 116.170.98.142 eq 5060 any
access-list 104 permit udp host 116.170.98.143 any eq 5060
access-list 104 deny   ip 10.1.10.0 0.0.0.3 any
access-list 104 deny   ip 10.1.1.0 0.0.0.255 any
access-list 104 deny   ip 192.168.10.0 0.0.0.255 any
access-list 104 permit udp host 116.170.98.142 eq domain any
access-list 104 permit udp host 116.170.98.143 eq domain any
access-list 104 permit icmp any host 4.2.2.2 echo-reply
access-list 104 permit icmp any host 4.2.2.2 time-exceeded
access-list 104 permit icmp any host 4.2.2.2 unreachable
access-list 104 permit udp host 192.168.10.1 eq 5060 any
access-list 104 permit udp host 192.168.10.1 any eq 5060
access-list 104 permit udp any any range 16384 32767
access-list 104 deny   ip 10.0.0.0 0.255.255.255 any
access-list 104 deny   ip 172.16.0.0 0.15.255.255 any
access-list 104 deny   ip 192.168.0.0 0.0.255.255 any
access-list 104 deny   ip 127.0.0.0 0.255.255.255 any
access-list 104 deny   ip host 255.255.255.255 any
access-list 104 deny   ip host 0.0.0.0 any
access-list 104 deny   ip any any log
int fas 0/0
ip access-group 104 in
Lastly, save to memory
wr mem
One final note - if you need to use the Microsoft Windows VPN client from a workstation behind the UC540 to connect to a VPN server outside your network, and you were getting Error 721 and/or Error 800...you will need to use the following commands to add to ACL 104;
(config)#ip access-list extended 104
(config-ext-nacl)#7 permit gre any any
Im hoping there may be a better way to allowing VPN clients on the LAN with a much more specific and limited rule. I will update this post with that info when and if I discover one.
Thanks to Vijay in Cisco Tac for the guidence.

Best practice for having an access point giving out only a specific range

Hey All,
I have an access point which is currently set to relay all dhcp request to the server DC-01, However the range that has been setup is becoming low on available IP addresses so I have been asked if it is possible to setup another range for the AP only.
Is there a way to set the DHCP up with a new range and say anything from that access point it will then give out a 192.168.2 subnet address as apposed to the standard 192.168.1 subnet?
Or would it be easier / better to create a superscope? and slowly migrate the users to a new subnet with a larger range?
Any help suggestions would be appreciated
thanks
Anthony

Hi,
Maybe we could configure a DHCP superscope to achieve your target.
For details, please refer to the following articles.
Configuring a DHCP Superscope
http://technet.microsoft.com/en-us/library/dd759168.aspx
Create a superscope to solve the problem of dwindling IP addresses
http://www.techrepublic.com/article/create-a-superscope-to-solve-the-problem-of-dwindling-ip-addresses/
Best Regards,
Andy Qi
Andy Qi
TechNet Community Support

Best Practice for Updating Administrative Installation Point for Reader 9.4.1 Security Update?

I deployed adobe reader 9.4 using an administrative installation point with group policy when it was released. This deployment included a transform file. It's now time to update reader with the 9.4.1 security msp.
My question is, can I simply patch the existing AIP in place with the 9.4.1 security update and redeploy it, or do I need to create a brand new AIP and GPO?
Any help in answering this would be appreciated.
Thanks in advance.

I wouldn't update your AIP in place. I end up keeping multiple AIPs on hand. Each time a security update comes out I make a copy and apply the updates to that. One reason is this: when creating the AIPs, you need to apply the MSPs in the correct order; you cannot simply apply a new MSP to the previous AIP.
Adobe's support patch order is documented here: http://kb2.adobe.com/cps/498/cpsid_49880.html.
That link covers Adode Acrobat and Reader, versions 7.x through 9.x. A quarterly update MSP can only be applied to the previous quarterly. Should Adobe Reader 9.4.2 come out tomorrow as a quarterly update, you will not be able to apply it to the 9.4.1 AIP; you must apply it to the previous quarterly AIP - 9.4.0. At a minimum I keep the previous 2 or 3 quarterly AIPs around, as well as the MSPs to update them. The only time I delete my old AIPs is when I am 1000% certain they are not longer needed.
Also, when Adobe's developers author the MSPs they don't include the correct metadata entries for in place upgrades of AIPs - any AIP based on the original 9.4.0 MSI will not in-place upgrade any installtion that is based on the 9.4.0 MSI and AIP - you must uninstall Adobe Reader, then re-install. This deficiency affects all versions of Adobe Reader 7.x through 9.x. Oddly, Adobe Acrobat AIPs will correctly in-place upgrade.
Ultimately, the in-place upgrade issue and the patch order requirements are why I say to make a copy, then update and deploy the copy.
As for creating the AIPs:
This is what my directory structure looks like for my Reader AIPs:
F:\Applications\Adobe\Reader\9.3.0
F:\Applications\Adobe\Reader\9.3.1
F:\Applications\Adobe\Reader\9.3.2
F:\Applications\Adobe\Reader\9.3.3
F:\Applications\Adobe\Reader\9.3.4
F:\Applications\Adobe\Reader\9.4.0
F:\Applications\Adobe\Reader\9.4.1
The 9.4.0 -> 9.4.1 MSP is F:\Applications\Adobe\Reader\AdbeRdrUpd941_all_incr.msp
When I created my 9.4.1 AIP, I entered these at a cmd.exe prompt - if you don't have robocopy on your machine you can get it from the Server 2003 Resouce Kit:
F:
cd \Applications\Adobe\Reader\
robocopy /s /e 9.4.0 9.4.1
cd 9.4.1
rename AdbeRdr940_en_US.msi AdbeRdr941_en_US.msi
msiexec /a AdbeRdr941_en_US.msi /update F:\Applications\Adobe\Reader\AdbeRdrUpd941_all_incr.msp /qb

Best practice for Wireless ap vlan

Is there a best practice for grouping lightweight access points in one vlan or allowing them to be spread across several ??

Whether you have multiple sites or not, it's good practice to put your APs in a separate and dedicated VLAN.
If your sites are routed sites, then you can re-use the same VLAN numbers but make sure they are on separate subnets and/or VRF instance.

IOS Update Best Practices for Business Devices

We're trying to figure out some best practices for doing iOS software updates to business devices. Our devices are scattered across 24 hospitals and parts of two states. Going forward there might be hundreds of iOS devices at each facility. Apple has tools for doing this in a smaller setting with a limited network, but to my knowledge, nothing (yet) for a larger implementation. I know configurator can be used to do iOS updates. I found this online:
https://www.youtube.com/watch?v=6QPbZG3e-Uc
I'm thinking the approach to take for the time being would be to have a mobile sync station setup with configurator for use at each facility. The station would be moved throughout the facility to perform updates to the various devices. Thought I'd see if anyone has tried this approach, or has any other ideas for dealing with device software updates. Thanks in advance.

Hi Bonesaw1962,
We've had our staff and students run iOS updates OTA via Settings -> Software Update. In the past, we put a DNS block on Apple's update servers to prevent users from updating iOS (like last fall when iOS 7 was first released). By blocking mesu.apple com, the iPads weren't able to check for or install any iOS software updates. We waited until iOS 7.0.3 was released before we removed the block to mesu.apple.com at which point we told users if they wanted to update to iOS 7 they could do so OTA. We used our MDM to run reports periodically to see how many people updated to iOS 7 and how many stayed on iOS 6. As time went on, just about everyone updated on their own.
If you go this route (depending on the number of devices you have), you may want to take a look at Caching Server 2 to help with the network load https://www.apple.com/osx/server/features/#caching-server . From Apple's website, "When a user on your network downloads new software from Apple, a copy is automatically stored on your server. So the next time other users on your network update or download that same software, they actually access it from inside the network."
I wish there was a way for MDMs to manage iOS updates, but unfortunately Apple hasn't made this feature available to MDM providers. I've given this feedback to our Apple SE, but haven't heard if it is being considered or not. Keeping fingers crossed.
Hope this helps. Let us know what you decide on and keep us posted on the progress. Good luck!!
~Joe

Best practice for Global Address?

Good Morning,
I am new to Cisco firewalls and would like to know what is the best practice for creating an external ip address and port into my network and then redirecting that to a specific machine. I am thinking of using a global ip address and then only allowing this type of traffic to talk to the specific destnation and on that specific port. Is this the correct course of action? Or os there a better or more effecient way of allowing this process using ADSM.
Troy
Message was edited by: Troy Currence

Hi,
Basically when you are attempting to allow traffic from the external public network to some of your servers/hosts you will either use Static NAT or Static PAT
Static NAT is when you bind a single public IP address to be used by only one internal host. This is usually the preferred option if you can spare a single public IP address for your server, meaning you probably have a small public subnet from your ISP.
Static PAT is when you only allocate certain ports on your public IP address and map them to a local port on the host. This is usually the option when you only have a single public IP address that is configured on your ASAs external interface. Or perhaps in a situation when you just want to conserver your public IP addresses even though you might have a few of them.
In Static NAT case you configure the Static NAT and use the interface ACL to allow the services you require.
In Static PAT you only create a translation for a specific port/service so only connections to that port are possible. Naturally you will also have to allow those services/ports in the interface ACL just like with Static NAT.
Again if you can spare the public IP addresses then I would go with Static NAT or if you only have a single or few IP addresses you can consider Static PAT (Port Forward) also.
I dont personally use ASDM for configurations but can help you with the required CLI format configurations. These can actually be done through ASDM also from the Tools -> Command Line Interface menus at the top.
Hope this helps
- Jouni

Best Practice for Security Point-Multipoint 802.11a Bridge Connection

I am trying to get the best practice for securing a point to multi-point wireless bridge link. Link point A to B, C, & D; and B, C, & D back to A. What authenication is the best and configuration is best that is included in the Aironet 1410 IOS. Thanks for your assistance.
Greg

The following document on the types of authentication available on 1400 should help you
http://www.cisco.com/univercd/cc/td/doc/product/wireless/aero1400/br1410/brscg/p11auth.htm

Best practices for apps integration with third party systems ?

Hi all
I would like to know if there is any document from oracle or from your own regarding best practices for apps integration with third party systems.
For example, in particular, let's say we need customization in a given module(ex:payables) need to provide data to a third party system, consider following:
outbound interface:
1)should third party system should be given with direct access to oracle database to access a particular payments data information table/view to look for data ?
2) should oracle create a file to third party system, so that it can read and do what it need to do?
inbound:
1) should third party should directly login and insert data into tables which holds response data?
2) again, should third party create file and oralce apps will pick up for further processing?
again, there could be lot of company specific scenarios like it has to be real time or not... etc...
How does companies make sure third party systems are not directly dipping into other systems (oracle apps/others), so that it will follow certain integration best practices.
how does enterprise architectute will play a role in this? can we apply SOA standards? should use request/reply using Tibco etc?
Many oracle apps implementations customizations are more or less directly interacting with third party systems by including code to login into respective third party systems and vice versa.
Let me your know if you have done differently and that would help oracle apps community.
thanks
rrb.

you want to send idoc to third party system (NONSAP).
what kind of system is it? can it handle http requests
or
can it handle webservice?
which version of R/3 you are using?
what is the mechanism the receiving system has, to receive data?
Regards
Raja

Best practice for creating a new email address to Exchange Server 2010 for share point Library

Hi,
Please advise if there is any best practice for the above issue?
Thanks
srabon

Hi Srabon,
Hope these are what you want.
Use a cmdlet to Create a User account and Mailbox in Exchange 2010
http://technet.microsoft.com/en-us/magazine/ff381465.aspx
Create a Mailbox for an Existing User
http://technet.microsoft.com/en-us/library/aa998319(v=exchg.141).aspx
Thanks
Mavis
Mavis Huang
TechNet Community Support

Kernel: PANIC! -- best practice for backup and recovery when modifying system?

I installed NVidia drivers on my OL6.6 system at home and something went bad with one of the libraries. On reboot, the kernel would panic and I couldn't get back into the system to fix anything. I ended up re-installing the OS to recovery my system.
What would be some best practices for backing up the system when making a change and then recovering if this happens again?
Would LVM snapshots be a good option? Can I recovery a snapshot from a rescue boot?
EX: File system snapshots with LVM | Ars Technica -- scroll down to the section discussing LVM.
Any pointers to documentation would be welcome as well. I'm just not sure what to do to revert the kernel or the system when installing something goes bad like this.
Thanks for your attention.

There is often a common misconception: A snapshot is not a backup. A snapshot and the original it was taken from initially share the same data blocks. LVM snapshot is a general purpose solution which can be used, for example, to quickly create a snapshot prior to a system upgrade, then if you are satisfied with the result, you would delete the snapshot.
The advantage of a snapshot is that it can be used for a live filesystem or volume while changes are written to the snapshot volume. Hence it's called "copy on write (COW), or copy on change if you want. This is necessary for system integrity to have a consistent data status of all data at a certain point in time and to allow changes happening, for example to perform a filesystem backup. A snapshot is no substitute for a disaster recovery in case you loose your storage media. A snapshot only takes seconds, and initially does not copy or backup any data, unless data changes. It is therefore important to delete the snapshot if no longer required, in order to prevent duplication of data and restore file system performance.
LVM was never a great thing under Linux and can cause serious I/O performance bottlenecks. If snapshot or COW technology suits your purpose, I suggest you look into Btrfs, which is a modern filesystem built into the latest Oracle UEK kernel. Btrfs employs the idea of subvolumes and is much more efficient that LVM because it can operate on files or directories while LVM is doing the whole logical volume.
Keep in mind however, you cannot use LVM or Btrfs with the boot partition, because the Grub boot loader, which loads the Linux kernel, cannot deal with LVM or BTRFS before loading the Linux kernel (catch22).
I think the following is an interesting and fun to read introduction explaining basic concepts:
http://events.linuxfoundation.org/sites/events/files/slides/Btrfs_1.pdf

PI best practice and integration design ...

Im currently on a site that has multiple PI instance's for each region and the question of inter-region integration has been raised my initial impression is that each PI will be in charge of integration of communications for its reginal landscape and inter-region communications will be conducted through PI - PI interface . I havent come across any best practice in this regard and have never been involved with a multiple PI landscape ...
Any thoughts ? or links to best practice for this kind of landscape ?...
to Summaries
I think this is the best way to set it up, although numerous other combinations are possible, this seems to be the best way to avoid any signifcant system coupling. When talking about ECC - ECC inter-region communications
AUS ECC -
> AUS PI -
> USA PI -
> USA ECC

abhishek salvi wrote:
I need to get data from my local ECC to USA ECC, do i send the data to their PI/my PI/directly to their ECC, all will work, all are
valid
If LocalECC --> onePI --> USA ECC is valid, then you dont have to go for other PI in between...why to increase the processing time....and it seems to be a good option to bet on.
The issue is
1. Which PI system should any given peice of data be routed through and how do you manage the subsequent spider web of interfaces resulting from PI AUS talking to ECC US, ECC AU, BI US, BI AU and the reverse for the PI USA system.
2. Increased processing time Integration Engine - Integration Engine should be minimal and it will mean a consistent set of interfaces for support and debug, not to mention the simplification of SLD contents in each PI system.
I tend to think of like network routing, the PI system is the default gateway for any data not bound for a local systems you send and let PI figure out what the next step is.
abhishek salvi wrote:
But then what about this statement (is it a restriction or business requirement)
Presently the directive is that each PI will manage communications with its own landscape only respectively
When talking multiple landscapes dev / test / qa / prod, each landscape has its own PI system generally, this is an extention of the same idea except that both systems are productive, from a interface and customisation point of view given the geographical remotness of each system local interface development for local systems and support makes sense, whilst not limited to this kind of interaction typically interfaces for a given business function for a given location (location specific logic) would be developed in concert with the interface and as such has no real place on the remote system (PI).
To answer your question there is no rule, it just makes sense.

Best practice for integrating a 3 point metro-e in to our network.

Similar Messages

Maybe you are looking for