Black hole VLAN with DHCP

I'd like to create a blackhole VLAN (maybe not a good name for it) for two reason.s 1 assign it to unused ports and turn them off. 2 so when a tech goes to install a device and the port is enabled they would pull an unrouted DHCP ip address.
My questions what is the best way to create the unrouted DHCP scope for this blackhole VLAN. From my testing I have to create an SVI on the blackhole VLAN to assign it a DHCP scope. I don't want the devices that pull an address to be able to talk to anything. Is there a better way to do this? Would I have to put a ACL on the VLAN to stop all network traffic on this VLAN?

Just create a layer 2 vlan and "do not" create an SVI. It cannot be routed anywhere because there is no SVI associated with the L2 vlan. All the devices will do is eventually get a default microsoft address of 169.x.x.x . You should not even need to define any scope for the created vlan .

Similar Messages

VLANs with DHCP on SG 200-50 switches

Hello,
I have 3 Cisco SG 200-50 switches ithat I'm using for a new set up. The 3 switches plug into a SonicWall appliance for routing and Internet access. I would like each SG switch to be a separate VLAN (ie. VLAN 10, VLAN 20, VLAN 30).
So I have my main network at the SonicWall level: 10.10.0.1
Switch A (SG 200-50) would be VLAN 10: 10.10.10.1
Switch B (SG 200-50) would be VLAN 20: 10.10.20.1
Switch C (SG 200-50) would be VLAN 30: 10.10.30.1
On my "main" network I have my email, DNS, and DHCP servers which supply the IP addresses for each VLAN. I have my DHCP server configured with 3 scopes (1 per VLAN). However I can't see a way using these switches to tell these VLANs which scope to request IP addresses from?
Am I doing this wrong or should I redesign my layout?
Thanks in advance!

Everything Tom said, and depending on what FW version your sonicwall is running, you can do 802.1q trunking. Please see this tech document: http://o-www.sonicwall.com/app/projects/file_downloader/document_lib.php?t=TN&id=49
While the SG300 switches are much more robust; (you can assign an IP interface to each VLAN and use the switch as the default gateway to reach other VLANs, another router, the internet, etc) it looks like you'll be fine since sonicwall has been implementing this feature since at least 2008.

Native VLAN and the "Black Hole"

While reviewing the configuration of a network that I'm supporting, it seems that the original design of the network has the black hole VLAN as the native VLAN. At the least this seems incorrect, and possibly very dangerous, but I'm not exactly sure why or how to articulate that. Can someone confirm or deny this suspicion?
In addition, I had two further questions regarding the practice of using a black hole VLAN:
1. If you have any unused ports, it seems more practical to just admin down these ports instead of creating an unused VLAN. Is there some added advantage to ALSO putting these ports in an unused VLAN (e.g. 999)? If the port was needed, you can simply admin up the port, during which time you could also change any needed VLAN configurations. In other words, you'd have to log into the device and make changes whether you went with the admin down method, the Black Hole VLAN method, or both. So what's the point?
2. Assuming you do use the Black Hole VLAN as an added security method, I feel that including that VLAN in the "switchport trunk allowed vlan" command is counterproductive, but I'm not fully able to articulate why. Can someone help me with this?
Thanks for any information or suggestions that you may have.

Assuming you mean a vlan for unused ports when you refer to a black hole vlan. If so the key things are -
a) that vlan does not have a L3 vlan interface (SVI) for it as there is no need to route it
b) any unused ports are shutdown
if you follow the above then I can't see the danger in using the native vlan but I wouldn't do it regardless of that. I would have a dedicated native vlan and a separate vlan for unused ports.
To my mind there should be no ports allocated to the native vlan (other than trunk ports obviously).
The benefit of using a dedicated vlan for unused ports is -
a) it provides an additional level of security. People make mistakes and having to do multiple things to enable a port requires more attention than simply doing a "no shut" on the interface.
The more attention someone is paying the more likely they will get it right or at least the less likely they will make a mistake.
b) if you don't use an unused vlan you are leaving all the ports in the default vlan which is vlan 1 and this should be avoided as this vlan is overused already eg. switch control plane traffic is sent on this vlan for example and often the switch management interfaces are in this vlan.
As far as allowing the unused vlan on trunk links it is totally unnecessary and in fact you really don't want to do that. The idea of the unused vlan is for non communication so it would make no sense to allow it on trunk links.
In my last place of work we used vlan 998 as the unused vlan and vlan 999 as the native vlan.
Neither had an SVI for it.
If by black hole vlan you meant something else then please clarify.
Jon

I purchased songs via my ipod touch. when I sync'd my ipod touch with my computer, the songs I purchased disappeared into a black hole... how do I get them back without having to repurchase?

i purchased songs via my ipod touch. when I sync'd my ipod touch with my computer, the songs I purchased disappeared into a black hole... how do I get them back without having to repurchase?

On your iPod Touch, open the iTunes app. There should be tab named "purchased", which shows all your purchase history. Choose the "Not on this iPod" tab and you'll get a list of purchased products that are not on your device. Hope this helped.

TS2755 After 'upgrading' to iOS 7.0.2, I am unable to send or receive photos in iMessage. With the previous iOS, it was no problem. Is there a fix? Apple support is the usual 'black hole' that ***** up endless time.

After 'upgrading' to iOS 7.0.2, I am unable to send or receive photos in iMessage. With the previous iOS, it was no problem. Is there a fix? Apple support is the usual 'black hole' that ***** up endless time.

Apple guys are deleting posts. I have found my posts have been deleted. Apple should MUST let us downgrade at least to previous release from current which was working fine.

Policy routing and black hole filtering on 6500

I have a 6500 with many SVIs configured and every one with multiple ip addresses. The users are accessing the network through these SVIs. For access control I use the black hole filtering method by dinamically injecting static routes to Null 0 for every user that is not authenticated.
But I need these users to reach one server to authenticate.
Is there a way to do this besides putting the server inside every VLAN ? Something like policy routing all the packets to the server to exit the server interface and the response packets to reach the user bypassing the global routing table ? Maybe using a vrf for the server only ?
Thanx.

Dave Northampton UK here.
We seem to have different consumer laws to US it seems?
Here the RETAILER is wholly responsible for the goods he sells. If such a case as this arose there would be NO time limit of 15 days, if the goods were found not to be of "merchantable quality" the time factor would not matter, certainly up to a year!
Certainly a retailer can take matters up with their supplier/manfctr but the CUSTOMER must get a new, working product PDQ or a total refund..IN CASH or put on a card, no credit notes or any other such swaddling!
Of course! Many shops wriggle and tell people porkies but in the end that is da law!
Dave.

PMTU-D Black Hole Detection Missing? Cause of some conn hangs.

In looking through the kernel source, it appears that Apple has left out one of the most important parts of Path MTU Discovery (RFC1191) as suggested in RFC2923. Since Path MTU Discovery is enabled by default, this may cause some of you to have 15 minute hangs and ultimate termination of connections when large packets are sent to specific hosts.
Other than DNS and Wireless network drops, MTU settings appear to be one of the single most problematic things going on with OS X right now.
For those who are not familiar with MTU, here's a brief rundown.
10/100 Ethernet networks support a base MTU of around 1514 bytes. This is the max number of bytes that a packet is able to be in order to get put on an Ethernet network (and be within spec). Gigabit Ethernet allows for larger, but we won't go into that.
You're probably more used to hearing 1500, however, that is the MTU for IP (or the Ethernet payload) as the Ethernet header itself is 14 bytes.
In that 1500 bytes, you have to fit your IP header, ICMP/TCP/UDP header, and any higher layer protocols and data, each layering on top of the next.
|<--Ethernet (14 Bytes)--><--IP (20 Bytes)--><--TCP (20 Bytes)--><--Data (1460 Bytes)-->|
So that is how things look on a local area network.
Once the WAN comes into play, the Ethernet header is stripped off leaving only the IP packet and another header put in its place to get it over the next link. This process goes on and on and on until the packet finally reaches its destination.
But here's the problem - what if there is ANOTHER layer between the Ethernet and IP stack?
This is actually quite common and you're probably using it now. The protocol PPP over Ethernet (PPPoE) fits between the Ethernet header and the IP header and adds another 8 bytes to this packet size.
So now we end up with:
|<--Ethernet (14 Bytes)--><--PPPoE (8 Bytes)--><--IP (20 Bytes)--><--TCP (20 Bytes)--><--Data (1452 Bytes)-->|
Notice that we now can't put as much data in this packet or we'll end up with a packet that is too big to fit on the Ethernet network.
The PPPoE header will ultimately get taken off once the packet gets where it needs to go at your ISP, but there may be other 'tunnels' between you and your ultimate destination and continue to strip off space of how much data you can put into a packet.
So how do you know how much data you can put into a packet when you don't own or know anything about the network between you and the destination?
That's where Path MTU Discovery comes into play.
It used to be that IP packets would be fragmented (split up) if a packet was too big to get put on the next network. This process of fragmentation causes overhead for both the router having to split up the packets and the receiving device that has to put them all back together again (and make sure they go in the right order).
So in order to reduce this overhead and also ensure that you are always sending the largest packets possible from end to end, IP stacks started setting the 'Don't Fragment' bit in the IP header. This instructs routers to throw away the packet if it is too big when it gets there.
When the packet gets thrown away due to it being too large, the router that throws it away also sends an ICMP packet (an IP diagnostics message) back to the sender telling it what the MTU is of the interface that couldn't take the packet. The sender can then re-calculate things based on that value and resend.
This works great EXCEPT when there are firewalls in the way (or broken routers, which is less likely these days). Many firewalls will not allow these ICMP messages to go back to the sender. Therefore, your host never receives the message that it is supposed to reduce the size of the packet and keeps trying and trying for about 15 minutes until it finally dies.
This is one reason why you may be seeing long hangs that ultimately end in termination of your connection.
RFC2923 goes into some options to work past this issue.
One way that this can be done, Windows Vista for instance does this, is for the system to keep an eye on how many max sized packets get retransmitted. After a certain number (lets say 5), the system assumes that it is not getting this ICMP notification and cuts the size of that packet in half so it can now get the data through - assuming that smaller packets are better than no packets getting sent.
It may also (and does with Vista) temporarily disable the setting of the 'Don't Fragment' bit and allow the routers to just take care of things. So in Vista, you'll see the page stutter for a second, and then continue to load, where an OS X system will sit there and hang for 15 minutes.
This is where OS X goes wrong. This behavior is called PMTU-D Black Hole Detection and does not appear to be in the IP stack for Leopard (and probably not previous releases).
So what can you do.
You have a few options, some of which I've already provided to a few folks (although without the mathematics so it's just a rough guess value).
First, you can just disable PMTU-D. The command to do this is:
sudo sysctl -w net.inet.tcp.pathmtudiscovery=0
This is a 'quick fix' but does eliminate the benefits that PMTU-D provides.
Second, you can calculate out what size MTU seems to work for you by working backwards and configure that on something within your control.
If your home router supports it, that's a good place to reduce the MTU since it only comes into play when you're using your Internet connection and not when hosts within the same network talk to each other. So if you place the MTU of 1472 on your router and your host sends it a 1500 byte packet, it will send back the ICMP message telling you to reduce it down to 1472.
If your router doesn't support it, you can reduce the MTU on your macs physical interface. This isn't always the best solution since you really should then reduce the MTU on each of your local systems or you could run into issues locally.
The command to do this is:
sudo ifconfig en1 mtu 1472
To make this permanent for Ethernet, set it in the Network settings. For Airport, search the forums. I provided an update you can make to one of the preferences files manually to do this (don't remember what file right now).
I have found a couple of sites (Washington Mutual's website for instance) that appear to have configuration issues internal to their network in which a device behind a firewall (possibly the web server, load balancer, or IPSec added) that may have an MTU less than 1500 set on it AND a firewall blocking ICMP packets from coming back. These sites will throw off your math since you can no longer assume a max size of 1500 for IP packets. In this specific case, you have to assume 1480.
Third, you can adjust the MSS setting (Max Segment Size) in the kernel to a value that is 20 bytes smaller than what you would otherwise set the MTU to. This ensures that the TCP stack doesn't put more than that amount of data in any single packet (therefore, eliminating the MTU issue), however, this will not work for UDP.
Finally, you can submit a bug report to let Apple know that PMTU-D Black Hole detection is something that we need.
So what kind of impact does this have on performance?
This will depend on what solution you choose, what the performance of your home router is, and the load on the various servers that have to potentially re-assemble the packets.
That said, knocking things all the way down to 1400 bytes, I am able to still get at least 15 Mbps up and down stream over the Internet.
If you have any questions on this post, please post and i'll do my best to respond. Hopefully this will help one more person resolve their performance issues with Leopard.

Hi Karsten and thanks for the suggestion!
I have exempted internal networks and can connect them via the VPN connection. I also got connectivity to the outside world with nat (outside,outside) and 'same-security-traffic permit intra-interface'.
A question remains though. At the moment, all traffic gets out of the network through the 'outside' interface IP (.22). I'd rather use a dedicated address from the /29 on GigabitEthernet0/0. Is this possible to achieve that? To put it differently, I'd like to NAT the VPN range onto an address that is not the 'outside' interface, like I did in this statement, for instance:
nat (v200,outside) source dynamic v200_private v200_public
My other question is, whether the single NAT statement [nat (outside,outside) dynamic interface] is sufficient for VPN traffic and whether the original statement can be removed [nat (vpn,outside) source dynamic vpn_pool vpn_public].
Thanks once again for the tips!
R.

Safari 5.1 in iMac OS X 10.6.8.Adding Bookmarks to "unsorted Bookmarks" folder puts them in a black hole. I can't find the "UB" folder. Where is it? Should I add it to the folder list somewhere on the left pane? OR? Help, please!

Safari 5.1 in iMac OS X 10.6.8.Adding Bookmarks to "unsorted Bookmarks" folder puts them in a black hole. I can't find the "UB" folder. Where is it? Should I add it to the folder list somewhere on the left pane? OR? Help, please!

It looks like that the installation process of one of the applications have caused some trouble. One of them may have changed or added kext files.
For that, the Window server crashed if you try to open a non Apple application like Firefox
Start the system in safe mode by holding the shift key on power on.
If save mode is reached, perform a permissions repair with the Disk Utility.
Don't bother about upcoming warnings like "could not repair file xy" as that occur cause you use the tool on a running system and opened files can not get touched by the tool.
After repair is done reboot system to normal and try to open Firefox.
If the problem persits, please report back here.
Lupunus

Wrvs4400n vlans/ssid/dhcp issue

Hi all,
it will be great if someone will help me with my problem.
the problem is : our wrvs4400n wifi router configuration.
network description: we need 2 separated wifi networks one for guests and one for internal access, and i configured them on router, and also configured each one of them to different vlan, guests to vlan 200 and internal use default vlan 1.
vlan 1 configured as dhcp relay and its working pritty well.
vlan 200 configured as dhcp and the problem begins here.
somehow on vlan 200 i get dhcp from our externam dhcp server,
wrvs4400n conected as follow> lan port1/vlan 200 connected to firewall port(configured as vlan 200) and lan port 4/vlan1 conected to our main switch wich connected to firewall also.
i guess that my knowlege in networking its not so good......
how can i prevent from our internal dhcp to comunicate with vlan 200 ,
any help will be very appreciated.

Hi Rich,
You cannot have different L3 VLANs sharing the same subnet.
Each VLAN must have it's own subnet and then you have a routing device routing between both VLANs.
You should have a DHCP pool also for VLAN 111 configured on the DHCP server.
Even if you have ip helper address configured and this should be done on the VLAN111 interface of the switch, you still need a DHCP pool for VLAN 111 because the DHCP discovery is coming on VLAN 111.
Please take a look into this document:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080665ceb.shtml.
Here it explains how to configure 2 ssids on 2 vlans and dhcp pool (on the switch itself) for each vlan.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Inaccessible items - builder's black holes

Hi folks,
There are places in this splendid product where you just can't get what you need. The HTMLDB app itself has reports with a arbitrary maximum rows and no pagination. Hmm.
So:
1 - if you use a lot of app-level items (as I do, it's a non-trivial app), you cannot see them all in the Session popup. You CAN sort, so you can see the first few and the last few BUT you can't see the ones in the middle.
2 - you can create a stacked bar chart with many series, BUT the Chart Series report region (page 232 of app 4000) only shows 15 rows. Without noticing this problem, I created a chart (which works fine) with 20 series, and I now need to modify series 16 - and I CAN'T!
I can live with problem 1, but I don't see a workaround to problem 2 (other than hand-editing an export - v. dodgy).
Please tell me that these whoopsies will be removed in the next release, and more pressingly, tell me if there's anything I can do about problem 2.
Many thanks
John D

Sergio,
Pleased to hear of the Metalink proposal.
I can't really import my app - it's dependent on 4000+ database objects.
To investigate the 'inaccessible' global items problem, try creating an app with (say) 100 application level items. Run a page and pop up the Session window and you'll see what I mean.
It strikes me that good design principles for any app (the Builder included) would be:
- except where there's a specific reason why not, all columns of any multi-row report region should be sortable;
- except where there's a specific reason why not, any multi-row report region should be controlled by a Number Of Rows Item;
- except where there's a specific reason why not, any multi-row report region should have either a pagination scheme (preferred) or MaxRowCount set to an improbably large number;
Applying these principles to the Builder app would obviate the 'black hole' problem. Maybe they'll be applied in 2.0?
As you'll know from previous posts I think HTMLDB is excellent. A few more tweaks (see below) and I'll run out of adjectives.
Thanks,
John
Yet more wonderful:
- renumber a page, with changes cascaded through all references (tricky I agree, but feasible)
- copy a region AND its items from App A1 Page P1 to App A2 Page P2
- define multiple application-level date-picker formats
- define re-useable tree templates
- define tree queries with normal SQL: i.e. START WITH <prior> IS NULL. At the moment, an HTMLDB tree needs a singe root node, but SQL doesn't demand this and it's not real-world, so I have to create views to introduce a dummy root node.
- drag and drop on tree nodes built in to tree functionality
- define the button to be used for a File Browse item
- enable multiple file selections with a single File Browse item
- define a default template for Form items which applies itself by default to ALL form items
- application-wide search (and maybe replace, even) of LOWER(<string>)
- ... er, can't think right now...

Can not connect with dhcp - renew dhcp lease will switch directly to manuel

If have the following problem
I us apple Airport extreme to connect to internet.
I have 5 Macs, all connecting with airport . They work fine with DHCP. Since 2 weeks I have a problem that one computer – a mac book pro with 10.5.6 will not connect.
When I switch to dhcp and select renew dhcp lease it switch directly back to manuell. I have no chance to connect with dhcp.
Has anyone a suggestion?
Thanks

Wonder why Apple hasn't chimed in on this one...
Whenever you have an issue like this where it's fine, then DHCP stops working for any reason.... Reset the PRAM.
How to:
Apple Logo -> Restart.
After the screen goes black -> Hold down all 4 keys until you hear the third Bong.
"Option"+[Apple Logo OR key to the left of the space bar]"P""R"
After the third BONG or Apple Chime whatever you want to call it. The system's Parameter Ram or to the PC Crowd the CMOS has been reset. This resets your clock, brightness, volume, etc.... So things will get reset along the way but it also resets the IRQ and DMA stats on the logic board. Ala, reseting your Airport's Connection to the logic board, Controllers, etc.

Newsstand: another black hole

Start with a virgin newsstand, tap the screen or store, go to a selection of possible newspapers and journals. Pick one out, get it. Click the home button to leave the newspaper and newsstand. Click newsstand again, your newspaper is in the stand but you want to get another one. Forget it, when you click store, the store is in the background dimmed and in the middle of the screen is a square picture of the newspaper you've already got and the only thing you can do is open that. Black hole, you cannot get out of this loop. All you can do is close ipad down completely and start up again.
Cheers, Bob

Start with a virgin newsstand, tap the screen or store, go to a selection of possible newspapers and journals. Pick one out, get it. Click the home button to leave the newspaper and newsstand. Click newsstand again, your newspaper is in the stand but you want to get another one. Forget it, when you click store, the store is in the background dimmed and in the middle of the screen is a square picture of the newspaper you've already got and the only thing you can do is open that. Black hole, you cannot get out of this loop. All you can do is close ipad down completely and start up again.
Cheers, Bob

Motion Black Hole Effect

It's me again...I felt the need to separate this one from the other one for some reason. Now I want to make a black hole come out of my hand and come back into it kinda like this...http://www.youtube.com/watch?v=Or9rHlA_Pww&feature=related. Thanks again.

I suggest you spend half a day working through the particles, presets, shapes & elements that come with Motion & I'm sure you will pick up many ideas on how to achieve this effect.
Peter

Reactivation Black Hole

You are now entering the reactivation black hole! Have spent the last 6 weeks trying to get my case resolved with no success.
Summary
1. Reactivation for Master Collection CS3 prompted reactivation. Reactivation failed. Called support and still failed with them as well.
2. Sat on hold for 5 hours again and was told to de-install.
3. De-install did not work and used cleaner at level 4 which allowed me to re-enter the serial number but also removed Acrobat professional and Director 11.5. Have also Production Premium on a second system as well. New activation only allows me to enter Production Premium serial with a check mark and not Master Collection which shows and X.
4. Oh wait, where are the download installs for CS3. No longer available depending on when you purchased them.
5. Running only a few programs with Production preium serial as Master Collection serial is not recognized and does not work even though it is in my registed history with Adobe.
6. I never asked to go through this reactivation process and was happy with CS3 till software stopped working and was forced to enter the black hole.
7. From what I can tell there is no resolution possible here.
8. Guess the only way out is to find a crack that will bypass this mess Adobe has created since they are unable to resolve this after 6 weeks and many hours on my part installing and reinstalling only some of the installs as not all are still available for CS3. I only use fully purchased software, however if this is the only way out is to crack it, well that is it, I give up.

Hello Lance,
I answered a query like this I think 2 days ago...
So you want to filter traffic via the botnet feature ( you will need to make sure the ASA has access to the internet ofcourse so it can contact the Security Intelligence Servers )
The ASA will drop the packets if they are spoofed and you have the RPF check on.
If the traffic goes to nowhere the ASA ofcourse will drop it ( No route to host x.x.x.x)
And if we receive a SYN-ACK where there has not been a SYN, traffic will be drop due to the TCP inspection failure (unless u configure a TCP state bypass)
Julio
Remember to rate all of the helpful posts.
For this community that's as important as a thanks.

Black hole perspective

I was playing with the new cs5 perspective tool and I was wondering how I could make a black hole perspectiv.
where everything is going towards the center...
I cant seem to figure it out...
do I have to make seperate 1 perspective grids for each side??

oh wow!
did you make that video just for me!?
thanks. it helped a lot.
so the grid actually has to be moved around? I figured ti was just guidelines that help you. but they actually affect the art work?
So I made a few objects and there flying out from the center of this perspective.. I wanted to place a number on each object and some have 3d extrude effects on them and I mapped numbers onto my objects.
Some object dont have extrude and I am trying to match the number up with their perspective but the type tool doesnt work with the perspective tool as well I dont think...
I could use envelope but I dont know if it will look perfect. is there a way to do this?

Black hole VLAN with DHCP

Similar Messages

Maybe you are looking for