Best practises for Hub and spoke Metro Etherent network

Hi there,
It is my first MAN deployment. I will use the 6513 as the core switch and the 3550 as the edge switches to the customer.
The customer has 9 locations. The customer asked for interconnection between the 9 locations and his Data center in his HQ.
Additionally his Internet connection is at the HQ too.
What is the best practice to architect this solution addressing security? How I deploy VLANs (like one vlan for the internet, one vlan for each department, one management vlan. Etc)
Any advises

Hi Sam,
Let me add my two cents here, when speaking about MAN deployments the name of the game is MPLS, so I guess you are using the same on your Cat 6500s and connecting your customers on 3550s using Vlans.
Regarding your questions:
a) Upgrading Ethernet to L3 for traffic shaping: This is basically done at 3550, so I suppose that's what you intend to do, plus you will be letting Spokes talk to only Hub site, so inter Vlan, atleast between Hub and each spoke will be required, hence inter valn routing. Other way is to configure P2P circuits between Hub site with Vlan mapping (per spoke) and Spoke sites with Port mapping, in this scenario Inter Vlan routing is not a necessity.
b) Security: This depends on what exact architecure you have deployed, in my case I have simply installed a Gateway router with BGP peering with PEs, a separate VRF alongwith redistribution does the trick.
Hope I addresses the query correctly, let me know if that helped..
Cheers
~sultan

Similar Messages

  • DNS best practices for hub and spoke AD Architecture?

    I have an Active Directory Forest with a forest root such as joe.co and the root domain of the same name, and root DNS servers (Domain Controllers) dns1.joe.co and dns2.joe.co
    I have child domains with names in the form region1.joe.com, region2.joe.co and so on, with dns servers dns1.region1.joe.co and so on.
    Each region has distribute offices that may have a DC in them, servers named in the form dns1branch1.region1.joe.co
    Over all my DNS tests out okay, but I want to get the general guidelines for setting up new DCs correct.
    Configuration:
    Root DC/DNS server dns1.joe.co adapter settings points DNS to itself, then two other root domain DNS/DCs dns2.joe.co and dns3.joe.co.
    The other root domain DNS/DCs adapter settings point to root server dns1.joe.co and then to itself dns2.joe.co, and then 127.0.0.1
    The regional domains have a root dns server dns1.region1.joe.co with adapter that that points to root server dns1.joe.co then to itself.
    The additional region domain DNS/DCs adapter settings point to dns1.region1.joe.co then to itself then to dn1.joe.co
    What would you do to correct this topology (and settings) or improve it?
    Thanks in advance
    just david

    Hi,
    According to your description, my understanding is that you need suggestion about your DNS topology.
    In theory, there is no obvious problem. Except for the namespace and server plaining for DNS, zone is also needed to consideration. If you place DNS server on each domain and subdomain, confirm that if the traffic browsed by DNS will affect the network performance.
    Besides, fault tolerance and security are also necessary.
    We usually recommend that:
    DC with DNS should point to another DNS server as primary and itself as secondary or tertiary. It should not point to self as primary due to various DNS islanding and performance issues that can occur. And when referencing a DNS server on itself, a DNS client
    should always use a loopback address and not a real IP address. detailed information you may reference:
    What is Microsoft's best practice for where and how many DNS servers exist? What about for configuring DNS client settings on DC’s and members?
    http://blogs.technet.com/b/askds/archive/2010/07/17/friday-mail-sack-saturday-edition.aspx#dnsbest
    How To Split and Migrate Child Domain DNS Records To a Dedicated DNS Zone
    http://blogs.technet.com/b/askpfeplat/archive/2013/12/02/how-to-split-and-migrate-child-domain-dns-records-to-a-dedicated-dns-zone.aspx
    Best Regards,
    Eve Wang
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • AD & DNS setting for Hub and spoke network

    Hi,
    We have multiple sites connectd through VPN (Hub and spoke network). Following is the site information
    Head Office (DC) ----- contoso.com ------ 192.168.100.2
    Site1 (ADC) ----- site1.contoso.com ------192.168.101.2
    Site2(RODC)----contoso.com ------192.168.102.2
    Site3(ADC)-----contoso.com ------- 192.168.103.2
    site4(ADC)-----site4.contoso.com-----192.168.104.2
    site5(ADC)-----contoso.com -------192.168.105.2
    i am trying to ping DC (contoso.com) from site4 & site site1 sometimes it's getting reply from site5 and site3 not from HO.
    How can i configure all request go to HO (192.168.100.2).
    for any other information please ask me.
    Regards,
    Kumar

    Hello,
    do you ping the domain name or the DC name? If domain name, what you see is normal, a DC will be chosen via DNS round robin and NOT a DC in that site.
    Also assure that you have configured AD sites and services according to
    http://technet.microsoft.com/en-us/library/cc730868.aspx
    http://technet.microsoft.com/en-us/library/cc755768.aspx
    http://blogs.technet.com/b/askds/archive/2011/04/29/sites-sites-everywhere.aspx
    Best regards
    Meinolf Weber
    MVP, MCP, MCTS
    Microsoft MVP - Directory Services
    My Blog: http://blogs.msmvps.com/MWeber
    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
    Twitter:  

  • The best solution? Hub-and-spoke, Peer-to-peer, Multi-cast?

    By the best solution, I mean in terms of price and quality (latency, minimum lag, etc)
    App type: Video conferencing
    Platforms: PC, Mobile (Android, iOS) [If mobile support would reduce performance or increase costs, I am willing to scrap it]
    Users: There will be 5 - 30 users logged into the service in the same room at a time. And a maximum of  5 - 7 users in that room will have their webcam's on at any given time.
    My main concern is performance, Since I might make it a paid service in the future, I don't think users would pay for something that has a lot of lag or trailing effects.
    So I was hoping to get some advice on how I should set it up and pros and cons in respect to LCCS

    Hi Sam,
    Let me add my two cents here, when speaking about MAN deployments the name of the game is MPLS, so I guess you are using the same on your Cat 6500s and connecting your customers on 3550s using Vlans.
    Regarding your questions:
    a) Upgrading Ethernet to L3 for traffic shaping: This is basically done at 3550, so I suppose that's what you intend to do, plus you will be letting Spokes talk to only Hub site, so inter Vlan, atleast between Hub and each spoke will be required, hence inter valn routing. Other way is to configure P2P circuits between Hub site with Vlan mapping (per spoke) and Spoke sites with Port mapping, in this scenario Inter Vlan routing is not a necessity.
    b) Security: This depends on what exact architecure you have deployed, in my case I have simply installed a Gateway router with BGP peering with PEs, a separate VRF alongwith redistribution does the trick.
    Hope I addresses the query correctly, let me know if that helped..
    Cheers
    ~sultan

  • Wats the best practise for performance

    Hi all,
    In my out line i have 15 dimensions and for one dimension i have 39000 members so wat is the best practise for performance , If we have more dimensions and more meebers is there any problem for performance
    so wat is the best practise for dimensions and members??
    Thanks in advance??

    If it is ASO application it is not a problem.
    If it is a BSO application surely it will hit the performance.
    More dimensions will create performance issues.
    If the said 39000 members dimension is a Flat dimension. It will be another issue.
    If BSO is obvious try to split into two models.
    Create intermediate groupings for the Filat dimension.

  • BPEL 10.1.2 hub-and-spoke or distributed architecture?

    Hi,
    I'm currently wrestling with the following question:BPEL 10.1.2 hub-and-spoke or distributed architecture?
    Hi,
    I'm currently wrestling with the following question:
    An ESB as per definition of e.g. Forrester should be capable of supporting a distributed bus architecture. From my understanding this distributed bus architecture is achieved by installing some sort of ESB component(s) on all machines that are participating in this infrastructure, together forming a ‘bus’.
    As I understand the BPEL 10.1.2 product basically offers two categories of functionality: orchestration and integration. Does this integration part offer ESB alike functionality and more specific allows for a distributed bus architecture? As far as I can see the BPEL 10.1.2 offers limited ESB alike functionality and only supports a hub-and-spoke architecture.
    Other threads in this forum talk about using BPEL 10.1.2 together with InterConnect in order to foresee in ESB functionality. What does InterConnect add to the BPEL 10.1.2 integration functionality?
    As of SOA suite 10.1.3 these products have been split up into a BPEL product and an ESB product. Is the ESB product in SOA suite 10.1.3 a combination of the integration from BPEL 10.1.2 and InterConnect? Is this new ESB product able to support a distributed architecture?
    I’m very much in favor of a distributed architecture compared to hub-and-spoke, as hub-and-spoke requires a very solid and redundant system that is going to handling all message traffic and other functions. When moving towards a SOA giving an ESB a back-bone role, I’m not very keen on introducing a single system that should actually make up this ESB. Distributed would mean all machines are taking care of some basic functions resulting in a fully functional ESB, even when one or more machines are down.
    Am I making sense with this? I would like to know how others are looking at these topics.
    Regards,
    Gershon Janssen

    We are struggling with this issue too. The "all-pervasive" vision of the ESB visionaries, in my opinion, means that every node in my enterprise architecture should have access to the bus and I should be able to orchestrate anything that is running on any node in my architecture. We were told to think of an ESB as the equivalent of the hardware bus in computers. From that perspective I thought that:
    (1) BPEL and ESB functions would add a marginal increment to the licensing cost of an app server - I should be able to afford an "all-pervasive" architecture.
    (2) BPEL and ESB functions would add a "marginal increment" to the memory and resource foot-print. Again, I should be able to afford an "all-pervasive" architecture.
    Are these two satisfied by Oracle's products ? Some vendors don't seem to support the above two. In that case there is a disconnect between the marketing and technology departments of the vendors. What am I missing ?
    If BPEL engines and ESBs are priced very high, based on economics we will end up with a hub-and-spoke model.
    Thanks

  • What is the best practise for setting dirty flag of a page/view?

    For a page/view, normaylly there are 2 things to do for diry data:
    1. when it's clean, Save button is disabled, when it's dirty, save button is enabled.
    2. when it's dirty and the window is closed, a popup says "you have unsaved data, close will lose the data".
    My thought is: it must be handled at client side, because not all valuechange is auto submitted. E.g., you type the 1st letter of a string in a input box, the server side does not know it, but save button should be enabled immediately.
    Is it possible to capture all valueChange events in a page or a view at client side?
    I'm not sure what is the best practise for setting dirty flag? If there is better solution? Does ADF provide facility for this?

    public void save(ActionEvent event){
    boolean formValid = isFormValid();
       if (formValid) {
      save button is enabled.
        private boolean isFormValid() {
            boolean valid = true;
            if (Check Condition 1) {
                valid = false;
               showErrorMessage1();
            if (Check Condition 2) {
                valid = false;
               showErrorMessage1();
            return valid;
        private void showErrorMessage1() {
                    when it's dirty and the window is closed, a popup says "you have unsaved data, close will lose the data".

  • Best Practise for connecting to Ethernet based device

    Hi,
    I have inherited a system where we have a cDAQ-9181 controlling an vehicle access barrier, with a LabView application on  a PC talking to it via Ethernet.
    (The application is very simple - press a button > send a value to the 9181 unit > opens the barrier )
    All works fine most of the time.
    ( We occasionally get network related errors. The LabView application sometimes thinks another PC has reserved the unit, or gives “error 89130 - device not available for routing” )
    The users would now like to be able to easily run the application from a second PC ( not at the same time ), but this seems to be a problem. If I exit the application on PC “A” and run it on PC “B” it struggles to reserve the chassis, and throws the “89130” error and I have to restart the unit via MAC.
    While I’m a “veteran” control programmer, I’m new to LabView, and would be very grateful for any pointers on “best practise” for talking to devices via Ethernet, or any specific suggestions for handling multiple PCs talking to a single device.
    Thank You.
    Tim.

    Hi Tim,
    Thank you for your post and welcome to the NI forums.
    There are lots of knowledgebase articles on our website and you should be able to find documentation for most of our hardware.
    There is a good troubleshooting guide for cDAQ Ethernet here (http://ae.natinst.com/public.nsf/web/searchinternal/e67b4e4749f378ff862577270059bd4b?OpenDocument) - it outlines the steps to take to ensure you have a stable a connection as possible. You may have already seen it, but the quick-start guide for your specific device may also be worth consulting for best practices. Are these helpful?
    As for using more than one PC - this shouldn't be too much of an issue. I would expect that the resource isn't being closed correctly - when you exit the App on PC 'A', how are you closing off the resource?
    Best regards,
    Eden S
    Applications Engineer
    National Instruments UK & Ireland

  • Best Practise for rebooting ISE Nodes?

    Hello Community,
    I administer an ISE installation with two nodes (I am not an ISE Specialist, my job is just to manage the user/mac-adresses... but now I have to move my ISE Nodes from one VMWare Cluster to another VMWare Cluster.
    (Both VMWare environments are connected to our enterprise network, but are different environments. vMotion not possible)
    I would shutdown ISE02, move it to our new VMWare environment and start it again.
    Than I would do this with our ISE01 Node...
    Are there any best practises for doing this? (Shutdown application first, stopl replikation etc)?
    Can I really simply reboot an ISE Node - or have I consider something bevor I doing this? After I doing this?
    Any tasks after reboot?
    Thank you for any answer!
    ISE01    
    Administration, Monitoring, Policy Service    
    PRI(A), SEC(M)
    ISE02    
    Administration, Monitoring, Policy Service    
    SEC(A), PRI(M)

    There is a lot to consider here.  If changing environments means changing IP Address and IP Scopes, then your policies, profiles, and dACLs would also have to change among other things.  If this is the case, create a new ISE VM in the new environment using the built in evaluation license and recreate the deployment from the old environment using the addressing scheme of the new environment.  Then spin-up a new Secondary node and register it on the Primary.  Once this is done, you can re-host the license from your old environment onto your new environment.  You can use this tool to re-host:
    https://tools.cisco.com/SWIFT/LicensingUI/loadDemoLicensee?FormId=3999
    If IP Addressing is to remain the same, it gets simpler. 
    First, and always, perform a configuration and operational backup.
    If downtime is not an issue, or if you have a maintenance window of an hour or so: Simply shut down both nodes.  Transfer them to the New Environment and turn them on, Primary Node first, of course.
    If downtime is an issue, shut down the Secondary Node and transfer it to the New Environment.  Start the Secondary Node and when it is up, shut down the Primary Node.  Once services on the primary node have stopped, promote the Secondary Node to Primary Node.
    Transfer the OLD Primary Node to the New Environment and turn it on.  It should assume the role of Secondary Node.  If it does not, assign that role through the GUI.
    Remember, the correct way to shut down an ISE node is:
    application stop ise
    halt
    By using these commands, the risk of database corruption decreases by about 90% (Remember to always backup).
    Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question.  Otherwise, feel free to post follow-up questions.
    Charles Moreton

  • EIGRP in a NBMA hub and spoke configuration ?

    Hi,
    Is there a way to configure EIGRP for a Frame Relay NBMA network using a hub and spoke topology ?
    I'm curious that I cannot find any config examples for this, whereas with OSPF in this environment there are plenty of examples.
    I'm wondering if EIGRP being a distance-vector protocol this shouldn't be attempted.
    PS: I've been at this all day and have only managed to get EIGRP to work in one cofiguration and that was using physical interfaces on all routers and switching off split horizon at the hub router. I used frame-relay map statements with broadcast enabled also.
    Any pointers would be appreciated.
    Cheers,
    Phil.

    hi phil,,,
    here is the configuration for the HUB router
    ! hostname ABC
    interface Ethernet1
    ip address 192.168.2.1 255.255.255.0
    interface Serial0
    no ip address
    encapsulation frame relay
    no ip mroute cache
    interface Serial0.1 multipoint
    ip address 192.168.1.1 255.255.255.0
    no ip split horizon eigrp 2001 Split Horizons disabled
    bandwidth 112 Bandwidth set to the sum of the remote PVCs
    frame relay map ip 192.168.1.5 110 broadcast
    frame relay map ip 192.168.1.6 130 broadcast
    router eigrp 2001 EIGRP routing process
    network 192.168.1.0 Networks running EIGRP
    you can have appropriate IP addressing as per your design...
    you can have some easy configuration at spoke side with compere to HUB router....
    regards
    Devang

  • Fram Relay hub and spoke scenario

    See the attachment please
    Requirements:
    1.Using only physical interfaces configure a Frame Relay hub-and-spoke network between RTA and RTB and RTC, RTB as the hub.
    2.Traffic from RTA destined for RTC should transit RTB, and vice versa.
    3.Use only the DLCIs specified in the diagram.
    4.Do not use any Dynamic layer 3 to layer 2 mappings over these frame Relay connections.
    5.Do not send any redundant broadcast traffic from the spokes to the hub.
    RTB (Hub):
    interface Serial0/0
    ip address 3.1.1.2 255.255.255.0
    encapsulation frame-relay
    frame-relay map ip 3.1.1.1 200 broadcast
    frame-relay map ip 3.1.1.3 300 broadcast
    no frame-relay inverse-arp
    RTA (Spoke):
    interface Serial0/0
    ip address 3.1.1.1 255.255.255.0
    encapsulation frame-relay
    frame-relay map ip 3.1.1.2 22 broadcast
    frame-relay map ip 3.1.1.3 22
    no frame-relay inverse-arp
    RTC (Spoke):
    interface Serial1/0
    ip address 3.1.1.3 255.255.255.0
    encapsulation frame-relay
    frame-relay map ip 3.1.1.2 33 broadcast
    frame-relay map ip 3.1.1.1 33
    no frame-relay inverse-arp
    My queries:
    A- Does he use these two statements because (frame-relay map ip 3.1.1.3 22 and frame-relay map ip 3.1.1.1 33 ) of requirement number 2 ?
    B- Doesn’t he use keyword “broadcast” in these two statements (frame-relay map ip 3.1.1.3 22 and frame-relay map ip 3.1.1.1 33) because of requirement 5?
    C- Does that mean if requirement 5 is not there we should have used “broadcast“ keyword ?
    D- Does not that contradict with what Cisco syas: “The broadcast keyword is commonly used with the frame relay map command” ?
    E- By using these two statements (frame-relay map ip 3.1.1.3 22 and frame-relay map ip 3.1.1.1 33) doesn’t my network become full mesh? but if you look to the diagram it is partial mesh ?

    Answers to your queries:
    A. Correct
    B. Correct
    C. That depends. In most cases, it is a good idea to have broadcasts on, especially when using routing protocols like OSPF which send traffic to multicast destinations. I would habe it on most times.
    D. The recommendation from Cisco is not contradictory. The lab scenario is making you do something quite specific so you have to follow that. You don't always have to follow requirements in order to make things work.
    E. No. Full-mesh refers to a full mesh of PVCs. If there was a PVC from A to C it would be full mesh.
    Hope that helps - pls rate the post if it does.
    Paresh

  • DMVPN Hub and Spoke behind NAT device

    Hi All,
    I have seen many documents stating about DMVPN Hub behind NAT or DMVPN Spoke behind NAT.
    But My case i involve in both situation.
    1) HUB have a Load Balancer (2 WAN Link) ISP A & B
    2) Spoke have Load Balancer (2 WAN Link) ISP A & B
    Now the requirement is Spoke ISP A Tunnel to HUB ISP A.  Spoke ISP B tunnel to HUB ISP B
    So total of two DMVPN tunnel from spoke to hub, and i will use EIGRP and PBR to select path.
    As I know at HUB site, LB must do Static NAT for HUB router IP, so spoke will point to it as tunnel destination address. At spoke LB, i will do policy route to reach HUB ISP A IP via Spoke ISP A link, HUB ISP B IP via Spoke ISP B link.
    HUB and Spoke have to create 2 tunnel with two different network ID but using same source interface.
    The Tunnel destination IP at spoke router is not directly belongs to HUB router. Its hold by HUB LB , and forwarded to HUB router by Static NAT.
    Any problem will face with this setup? Any guide?
    Sample config at HUB.
    interface Tunnel0
    bandwidth 1000
    ip address 172.16.1.1 255.255.255.0
    ip mtu 1440
    ip nhrp authentication cisco123
    ip nhrp map multicast dynamic
    ip nhrp network-id 1
    ip nhrp holdtime 600
    delay 1000
    tunnel source FastEthernet0/0
    tunnel mode gre multipoint
    tunnel key 0
    tunnel protection ipsec profile cisco
    interface Tunnel1
    bandwidth 1000
    ip address 172.17.1.1 255.255.255.0
    ip mtu 1440
    ip nhrp authentication cisco123
    ip nhrp map multicast dynamic
    ip nhrp network-id 2
    ip nhrp holdtime 600
    delay 1000
    tunnel source FastEthernet0/0
    tunnel mode gre multipoint
    tunnel key 1
    tunnel protection ipsec profile cisco
    Spoke Config
    interface Tunnel0
    bandwidth 1000
    ip address 172.16.1.2 255.255.255.0
    ip mtu 1440
    ip nhrp authentication cisco123
    ip nhrp map 172.16.1.1 199.1.1.1
    ip nhrp network-id 1
    ip nhrp holdtime 300
    ip nhrp nhs 172.16.1.1
    delay 1000
    tunnel source FastEthernet0/0
    tunnel destination 199.1.1.1
    tunnel key 0
    tunnel protection ipsec profile cisco
    interface Tunnel1
    bandwidth 1000
    ip address 172.17.1.2 255.255.255.0
    ip mtu 1440
    ip nhrp authentication cisco123
    ip nhrp map 172.17.1.1 200.1.1.1
    ip nhrp network-id 2
    ip nhrp holdtime 300
    ip nhrp nhs 172.17.1.1
    delay 1500
    tunnel source FastEthernet0/0
    tunnel destination 200.1.1.1
    tunnel key 1
    tunnel protection ipsec profile cisco

    Hi Marcin,
    thanks for your reply. The NAT was set up in a way it was/is just to simulate the spoke to be behind NAT device.
    About AH and ESP, you are correct there... this was actually my issue. I should have used pure ESP. At the end, TAC actually assisted me with this. Before I called TAC, i did notice the following. ISAKMP traffic was NATed to 3.3.3.3, as expected. Anything after that, did not work and it has to with NAT and AH. Traffic was no longer NATed so the hub, saw the traffic come from 2.2.2.2 rather than 3.3.3.3, you can also see that in the error message you have pointed out. I also saw it in my packet captures. That caught my eye and i started troubleshooting it. I did not understand that AH can't be NATed, Below  is TAC's explanation. All is good now. Thanks
    .  Essentially, it comes down to the fact that AH will encapsulate the entire IP packet (hence why it is the outermost header) with the exception of a few mutable fields, including the DSCP/ToS, ECN, flags, fragment offset, TTL, and the header checksum.  Since the source/destination IP addresses & port numbers are actually protected by the AH integrity checking, this means that a device performing a NAT operation on the packet will alter these IP header fields and effectively cause the hub router to drop the packet due to AH failure.
    Conversely, ESP traffic is able to properly traverse NAT because it doesn't include the IP header addresses & ports in its integrity check.  In addition, ESP doesn't need to be the outermost header of the packet in order to work, which is why devices will attach an outer UDP/4500 header on the traffic going over NAT."

  • VPN hub and spoke topology, hub using two interfaces

    Hi,
    I'm facing a problem with Cisco ASA 5500 running software 8.4.
    I know, i know, VPN hub and spoke was already discussed many times. But all these discussions are about a hub using only one interface, the outside/public interfcae.
    My topology is slightly different.
    LAN-A - VPN peer A <--> (Internet) <--> (outside if)-ASA-B-(inside if) <--> (corporate network) <--> (outside if)-ASA-C-(inside if) <--> LAN-C
    VPN communication should flow between LAN-A and LAN-C.
    Phase I and phase II are working on both tunnels (A-B, B-C). Therefore cryptomaps should be right.
    IPsec SA for tunnel A-B is explicit for LAN-A and LAN-C.
    IPsec SA for tunnel B-C connects any with LAN-C.
    What I can see on ASA-B is incoming traffic from LAN-A on tunnel A-B.
    That does not trigger an SA for tunnel B-C!
    Traffic initiated from LAN-C, I can see on ASA-B as incoming traffic, SA for LAN-A to LAN-C is build up on tunnel B-C.
    Traffic seems to enter tunnel A-B as I can see outgoing traffic on ASA-B.
    Of course, NAT exemption is configured for traffic between LAN-A and LAN-C.
    Why doesn't incoming traffic from LAN-A initiate SA on tunnel B-C?
    It looks like incoming traffic from LAN-A enters ASA-B and is dropped or send anywhere but the right direction.
    I admit I'm clueless.
    Any help would be appreciated.
    Thanks folks.

    Analyzing the config files you revealed the inactiv NAT exemption for traffic flow between LAN-A and LAN-C.
    Furthermore a static route fro LAN-C out the inside interface was missing.
    Fixing both communication works fine.
    Thanks for the real good support.

  • Best practises for replication

    Hi,
    I want to know what is best practise for duration of replicaation of database between two Cisco ACS.
    Regards,
    Atif.

    Hi Atif,
    The replication time interval should always be higher.
    Reason: Everytime you replicate the data it requires ACS services to restart so doing this frequently may affect your production enviroment.
    However, if you want to replicate internal user's password then there is an option to replicate password changes right awayvwithout a full replication.  You can enable this option under System Configuration -> Local Password Management.  With this enabled you could potentially set the replications to a larger interval.
    It also depend how often you do changes in your ACS. If its normal then I would say set it to every sunday 12:00 PM.
    This is how replication happens:
    The primary ACS stops its authentication and creates a copy of the ACSinternal database components that it is configured to replicate. During this
    step, if AAA clients are configured properly, those that usually use the primary ACS fail over to another ACS. The primary ACS resumes its authentication service.
    After the preceding events on the primary ACS, the database replication process continues on the secondary ACS. The secondary ACS stops its authentication service and replaces its database components with the database components that it received from the primary ACS. During this step, if AAA clients are configured properly, those that usually use the secondary ACS fail over to another ACS. The secondary ACS resumes its authentication service.
    HTH
    Regards,
    JK
    Plz rate helpful posts-

  • Best Practises for doing Master Scheduling using SNP

    Hello Gurus ,
                         Can you please suggest the best practises for doing Master Scheduling using SNP . Which engine to use , what would that mean etc
    Regards,
    Nick

    APC Back-UPS XS 1300.  $169.99 at Best Buy.
    Our power outages here are usually only a few seconds; this should give my server about 20 or 25 minutes run-time.
    I'm setting up the PowerChute software now to shut down the computer when 5 minutes of power is left.  The load with the monitor sleeping is 171 watts.
    This has surge protection and other nice features as well.
    -Noel

Maybe you are looking for