Metadata over private network?

How can I tell if the Metadata traffic is going over the private network I have set up and not over the public one that allows my machines to get internet over. I set the machines up over the private network and they always showed up in xSan Admin as the private addresses until I plugged the second network cables into my Metadata controllers and two of my clients. Now they show up as the addresses assigned by my DHCP server on my local network.
My few clients that are not on my local internet network still seem to be communicating to my metadata controllers on the private side. I just want to make sure I am getting the best performance and Metadata isn't flying across my local network.
Thanks!

I think you can do several things to check this:
x listen on the wires with an ethernettool
x check /Library/Filesystems/Xsan/config/fsnameservers
x check /Library/Filesystems/Xsan/data/<volumename>/log/cvlog
x check /Library/Filesystems/Xsan/debug/nssdbg.out

Similar Messages

Migration over private network - Non-Cluster

Hello everyone...
I have a hyper-v cluster (3 nodes), and a second stand-alone hyper-v host; all of which is managed by SCVMM 2012 R2. The VMM server, and all hyper-v hosts are connected to a 10gbs private network.
When doing a live migration between nodes in the cluster; everything is being transferred over the 10gbs network.
When doing a live migration between one of the cluster nodes and the stand-alone host, it uses the public LAN.
All machines can ping each other on the 10gps network, so it isn't a connectivity issue. (I am using that network to do backups as well.)
On the stand-alone host, I have "use the following IP subnets" set to the subnet of the private network.
All machines are running Windows Server 2012 R2.
Any suggestions on how I can do the migration using the 10gps network?
Thanks!

Hi Sir,
>>I have a hyper-v cluster (3 nodes), and a second stand-alone hyper-v host; all of which is managed by SCVMM 2012 R2. The VMM server, and
all hyper-v hosts are connected to a 10gbs private network.
>>When doing a live migration between one of the cluster nodes and the stand-alone host, it uses the public LAN.
If I understand correctly , you may need to check the link layer between the cluster node's live migrate IP and that stand-alone host's LM IP .
I want to know the detail of the network topology between cluster and stand-alone host because you mentioned "it uses the public lan" .
Best Regards,
Elton Ji
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .

Rman backup over private network

How can I force an rman backup to use a private network instead of public network.

Hi scottnoswa,
create a net service in the tnsnames.ora which uses the private IP and use this to connect to the target.
Regards,
Lutz

ICM Router & Logger Private Network connectivity

Hi,
Can any one give me clarification on the following
Is there any private network connectivity betwen ICM router and Logger ?

No, call routers (central controller) communicates between side A and B over private network for synchronization, so do PG pairs. Loggers receive data from local call router over public traffic.
Chris

Duplicate private networks over vpn !

A customer is having the same private network as my company does, but i have to build a vpn between those 2 networks.
Our site has a ASA5510 and the customer has a PIX 515e. How should i do this ?
Many thanks for helping me.
Gerard Schurink

You could inspire yourself with this document
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800949f1.shtml

Problem with using JMF audio over a network

Hiya, I'm using IBM JMF code but I'm having problems trying to get it transmit data from the MediaTransmitter to the MediaPlayerFrame.
I'm kinda new to JMF so I assume I'm missing something basis for why this doesn't work.
Any help would be greatly appreciated.
MediaPlayerFrame
import javax.media.*;
import javax.swing.*;
import java.awt.*;
import java.awt.event.*;
import java.io.*;
* An instance of the MediaPlayerFrame may be used to display any media
* recognized * by JMF. This is intended to be a very simple GUI example,
* displaying all possible controls for the given media type.
public class MediaPlayerFrame extends JFrame {
     * The frame title.
    private static final String FRAME_TITLE = "developerWorks JMF Tutorial " +
        "Media Player";
     * The panel title of the main control panel.
    private static final String CONTROL_PANEL_TITLE = "Control Panel";
    // location and size variables for the frame.
    private static final int LOC_X = 100;
    private static final int LOC_Y = 100;
    private static final int HEIGHT = 500;
    private static final int WIDTH = 500;
     private final static long serialVersionUID = 1;
     * The current player.
    private Player player = null;
     * The tabbed pane for displaying controls.
    private JTabbedPane tabPane = null;
     * Create an instance of the media frame. No data will be displayed in the
     * frame until a player is set.
    public MediaPlayerFrame() {
        super(FRAME_TITLE);
        System.out.println("MediaPlayerFrame");
        setLocation(LOC_X, LOC_Y);
        setSize(WIDTH, HEIGHT);
        tabPane = new JTabbedPane();
        getContentPane().add(tabPane);
        /* adds a window listener so that the player may be cleaned up before
           the frame actually closes.
        addWindowListener(new WindowAdapter() {
                               * Invoked when the frame is being closed.
                              public void windowClosing(WindowEvent e) {
                                  closeCurrentPlayer();
                                  /* Closing this frame will cause the entire
                                     application to exit. When running this
                                     example as its own application, this is
                                     fine - but in general, a closing frame
                                     would not close the entire application.
                                     If this behavior is not desired, comment
                                     out the following line:
                                  System.exit(0);
     * Creates the main panel. This panel will contain the following if they
     * exist:
     * - The visual component: where any visual data is displayed, i.e. a
     * movie uses this control to display the video.
     * - The gain component:   where the gain/volume may be changed. This
     * is often * contained in the control panel component (below.)
     * - The control panel component: time and some extra info regarding
     * the media.
    private JPanel createMainPanel() {
        System.out.println("createMainPanel");
        JPanel mainPanel = new JPanel();
        GridBagLayout gbl = new GridBagLayout();
        GridBagConstraints gbc = new GridBagConstraints();
        mainPanel.setLayout(gbl);
        boolean visualComponentExists = false;
        // if the visual component exists, add it to the newly created panel.
        if (player.getVisualComponent() != null) {
            visualComponentExists = true;
            gbc.gridx = 0;
            gbc.gridy = 0;
            gbc.weightx = 1;
            gbc.weighty = 1;
            gbc.fill = GridBagConstraints.BOTH;
            mainPanel.add(player.getVisualComponent(), gbc);
        // if the gain control component exists, add it to the new panel.
        if ((player.getGainControl() != null) &&
            (player.getGainControl().getControlComponent() != null)) {
            gbc.gridx = 1;
            gbc.gridy = 0;
            gbc.weightx = 0;
            gbc.weighty = 1;
            gbc.gridheight = 2;
            gbc.fill = GridBagConstraints.VERTICAL;
            mainPanel.add(player.getGainControl().getControlComponent(), gbc);
        // Add the control panel component if it exists (it should exists in
        // all cases.)
        if (player.getControlPanelComponent() != null) {
            gbc.gridx = 0;
            gbc.gridy = 1;
            gbc.weightx = 1;
            gbc.gridheight = 1;
            if (visualComponentExists) {
                gbc.fill = GridBagConstraints.HORIZONTAL;
                gbc.weighty = 0;
            } else {
                gbc.fill = GridBagConstraints.BOTH;
                gbc.weighty = 1;
            mainPanel.add(player.getControlPanelComponent(), gbc);
        return mainPanel;
     * Sets the media locator. Setting this to a new value effectively
     * discards any Player which may have already existed.
     * @param locator the new MediaLocator object.
     * @throws IOException indicates an IO error in opening the media.
     * @throws NoPlayerException indicates no player was found for the
     * media type.
     * @throws CannotRealizeException indicates an error in realizing the
     * media file or stream.
    public void setMediaLocator(MediaLocator locator) throws IOException,
        NoPlayerException, CannotRealizeException {
          System.out.println("setMediaLocator: " +locator);
        // create a new player with the new locator. This will effectively
        // stop and discard any current player.
        setPlayer(Manager.createRealizedPlayer(locator));
     * Sets the player reference. Setting this to a new value will discard
     * any Player which already exists. It will also refresh the contents
     * of the pane with the components for the new player. A null value will
     * stop the discard the current player and clear the contents of the
     * frame.
    public void setPlayer(Player newPlayer) {
        System.out.println("setPlayer");
        // close the current player
        closeCurrentPlayer();
        player = newPlayer;
        // refresh the tabbed pane.
        tabPane.removeAll();
        if (player == null) return;
        // add the new main panel
        tabPane.add(CONTROL_PANEL_TITLE, createMainPanel());
        // add any other controls which may exist in the player. These
        // controls should already contain a name which is used in the
        // tabbed pane.
        Control[] controls = player.getControls();
        for (int i = 0; i < controls.length; i++) {
            if (controls.getControlComponent() != null) {
tabPane.add(controls[i].getControlComponent());
* Stops and closes the current player if one exists.
private void closeCurrentPlayer() {
if (player != null) {
player.stop();
player.close();
* Prints a usage message to System.out for how to use this class
* through the command line.
public static void printUsage() {
System.out.println("Usage: java MediaPlayerFrame mediaLocator");
* Allows the user to run the class through the command line.
* Only one argument is allowed, which is the media locator.
public static void main(String[] args) {
try {
if (args.length == 1) {
MediaPlayerFrame mpf = new MediaPlayerFrame();
/* The following line creates a media locator using the String
passed in through the command line. This version should
be used when receiving media streamed over a network.
mpf.setMediaLocator(new MediaLocator(args[0]));
/* the following line may be used to create and set the media
locator from a simple file name. This works fine when
playing local media. To play media streamed over a
network, you should use the previous setMediaLocator()
line and comment this one out.
//mpf.setMediaLocator(new MediaLocator(
// new File(args[0]).toURL()));
mpf.setVisible(true);
} else {
printUsage();
} catch (Throwable t) {
t.printStackTrace();
MediaTransmitter
import javax.media.*;
import javax.media.control.*;
import javax.media.protocol.*;
import javax.media.format.*;
import java.io.IOException;
import java.io.File;
* Creates a new media transmitter. The media transmitter may be used to
* transmit a data source over a network.
public class MediaTransmitter {
     * Output locator - this is the broadcast address for the media.
    private MediaLocator mediaLocator = null;
     * The data sink object used to broadcast the results from the processor
     * to the network.
    private DataSink dataSink = null;
     * The processor used to read the media from a local file, and produce an
     * output stream which will be handed to the data sink object for
     * broadcast.
    private Processor mediaProcessor = null;
     * The track formats used for all data sources in this transmitter. It is
     * assumed that this transmitter will always be associated with the same
     * RTP stream format, so this is made static.
    private static final Format[] FORMATS = new Format[] {
        new AudioFormat(AudioFormat.MPEG_RTP)};
     * The content descriptor for this transmitter. It is assumed that this
     * transmitter always handles the same type of RTP content, so this is
     * made static.
    private static final ContentDescriptor CONTENT_DESCRIPTOR =
        new ContentDescriptor(ContentDescriptor.RAW_RTP);
     * Creates a new transmitter with the given outbound locator.
    public MediaTransmitter(MediaLocator locator) {
        mediaLocator = locator;
     * Starts transmitting the media.
    public void startTransmitting() throws IOException {
        // start the processor
        mediaProcessor.start();
        // open and start the data sink
        dataSink.open();
        dataSink.start();
     * Stops transmitting the media.
    public void stopTransmitting() throws IOException {
        // stop and close the data sink
        dataSink.stop();
        dataSink.close();
        // stop and close the processor
        mediaProcessor.stop();
        mediaProcessor.close();
     * Sets the data source. This is where the transmitter will get the media
     * to transmit.
    public void setDataSource(DataSource ds) throws IOException,
        NoProcessorException, CannotRealizeException, NoDataSinkException {
        /* Create the realized processor. By calling the
           createRealizedProcessor() method on the manager, we are guaranteed
           that the processor is both configured and realized already.
           For this reason, this method will block until both of these
           conditions are true. In general, the processor is responsible
           for reading the file from a file and converting it to
           an RTP stream.
        mediaProcessor = Manager.createRealizedProcessor(
            new ProcessorModel(ds, FORMATS, CONTENT_DESCRIPTOR));
        /* Create the data sink. The data sink is used to do the actual work
           of broadcasting the RTP data over a network.
        dataSink = Manager.createDataSink(mediaProcessor.getDataOutput(),
                                          mediaLocator);
     * Prints a usage message to System.out for how to use this class
     * through the command line.
    public static void printUsage() {
        System.out.println("Usage: java MediaTransmitter mediaLocator " +
                           "mediaFile");
        System.out.println(" example: java MediaTransmitter " +
            "rtp://192.168.1.72:49150/audio mysong.mp3");
        System.out.println(" example: java MediaTransmitter " +
            "rtp://192.168.1.255:49150/audio mysong.mp3");
     * Allows the user to run the class through the command line.
     * Only two arguments are allowed; these are the output media
     * locator and the mp3 audio file which will be broadcast
     * in the order.
    public static void main(String[] args) {
        try {
            if (args.length == 2) {
                MediaLocator locator = new MediaLocator(args[0]);
                MediaTransmitter transmitter = new MediaTransmitter(locator);
                System.out.println("-> Created media locator: '" +
                                   locator + "'");
                /* Creates and uses a file reference for the audio file,
                   if a url or any other reference is desired, then this
                   line needs to change.
                File mediaFile = new File(args[1]);
                DataSource source = Manager.createDataSource(
                    new MediaLocator(mediaFile.toURL()));
                System.out.println("-> Created data source: '" +
                                   mediaFile.getAbsolutePath() + "'");
                // set the data source.
                transmitter.setDataSource(source);
                System.out.println("-> Set the data source on the transmitter");
                // start transmitting the file over the network.
                transmitter.startTransmitting();
                System.out.println("-> Transmitting...");
                System.out.println("   Press the Enter key to exit");
                // wait for the user to press Enter to proceed and exit.
                System.in.read();
                System.out.println("-> Exiting");
                transmitter.stopTransmitting();
            } else {
                printUsage();
        } catch (Throwable t) {
            t.printStackTrace();
        System.exit(0);

Okay, here's the it copied out.
Media Transmitter
C:\John\Masters Project\Java\jmf1\MediaPlayer>java MediaTransmitter rtp://127.0.
0.1:2000/audio it-came-upon.mp3
-> Created media locator: 'rtp://127.0.0.1:2000/audio'
-> Created data source: 'C:\John\Masters Project\Java\jmf1\MediaPlayer\it-came-u
pon.mp3'
streams is [Lcom.sun.media.multiplexer.RawBufferMux$RawBufferSourceStream;@1decd
ec : 1
sink: setOutputLocator rtp://127.0.0.1:2000/audio
-> Set the data source on the transmitter
-> Transmitting...
   Press the Enter key to exit
MediaPlayerFrame
C:\John\Masters Project\Java\jmf1\MediaPlayer>java MediaPlayerFrame rtp://127.0.
0.1:2000/audio
MediaPlayerFrame
setMediaLocator: rtp://127.0.0.1:2000/audioAs I said, it just kinda stops there, what it should be doing is opening the MediaPlayer.
"MediaPlayerFrame" and "setMediaLocator: rtp://127.0.0.1:2000/audio" are just print outs I used to track here the code is getting to.

Can I add a wi-fi hotspot to my private network?

I have an existing private network in our home consisting of cat5 outlets hard-wired to a Cisco 2900 Catalyst switch and wi-fi for the laptop and palm pilot is via a Linksys WRT54GX4 wired to the switch, which in turn is fed via direct bury cat5 from an exterior wireless broadband radio atop a tower. The current wi-fi is locked down with MAC address filtering, WPA-2 encryption and SSID off.
I would like to add a public wi-fi hotspot for guests without exposing our network. (We host a gathering of motorcyclists from around North America, the kids have freinds over, etc.)
I assume I will need to add a second wireless router or access point.
What type of device do I need to add?
Can I use the advanced routing features to control this, with or without isolating them by setting up a separate VLAN on the switch?
How would I configure this?

Hmmm. No responses, eh?
Ah well, I think I may have found my answer. Does anyone have experience with the WRV200 or WRV210? They appear to feature multiple SSIDs (that can be hidden or exposed independently) and VLAN support. Am I correct in assuming that I could set up one VLAN for my private network, with it's own hidden SSID and encryption key and a second VLAN with a visible SSID and possibly a separate encryption key?
Now, assuming all that works. How will the wireless get along with my existing SRX400 exquipment? Does the fact that the WRV210 only has 2 antennas compared to the 3 on my existing WRT5GX4 mean this one will be slower or have reduced range?

I am using a verizion jetpack to wireless connect to an airport express next i want to connect a Airport extreme wired from toe express to create a second private network that has internet access via the jetpack

Thanks for the help after looking over your sugesstion I did some additional troubleshooting which i should have done in the beginning and heres what i found
Airport express is joined to and existing wireless network and i have internet access....all good
I set up my Airport Extreme as follows:
                    Connect using :ethernet
              Ethernet Wan Port : automatic
              Connetion Sharing : Share a public IP address
Tcpip      Configue IPv4: Using DHCP
DHCP                   Begin address: 172.16.22.200
                           Ending address: 172.16.22.254
Wireless    Create a wireless network
                         Wireless network name Test1
                          wpa2 security
This is needed due to set ip address of device on this private network did not address NAT
Conneted Express ethernet port to Extreme wan port
All wired devices have internet access and i get a double nat status which ignore
however my wireless device will not connect.... sometimes they will they want
any suggestions

Here are sceeen shots of the Express

What is the correlation of Logger Private network to Router Private Network.

What is the correlation of Logger Private network to Router Private Network.
You have to define them in Websetup for the Router and Logger but what is communicating on the Private network path between the Logger and Router? I thought that was over the Public network. is it only Recovery from the Loggers talking over the Private network?

Hi,
you can read about the types of messages exchanged over various links in the SRND.
G.

How to setup private network in oracle rac

Hi all,
Iam trying to setup oracle 2-NODE RAC ,
now i stuck in setup private network..
how to setup private network, what i have to do for that.
please help us provide step by step process

The loop is nothing but a network cable connecting two nodes on same port with a private IP address (something like 10.0.01 and 10.0.0.2) which is not accessible by any other machine in the network (except 2 nodes obviously ).
Note that cross over cables are not supported for the Cluster Interconnect. And cross over cables limit the cluster to only 2 nodes, which may not be enough for many RAC deployments.
Cheers,
Brian

Can I edit footage, using the DV files that are saved over a network?

What I mean is, I have saved my MiniDV DV footage to a external hard drive which I connect to over ethernet, its not a NAS, its a HDD in a PC I have.
I have my iMac (intel 2GHz), can I use iMovie 08 to import,edit and save to the HDD over the network?
Its just the files are big (ie 13Gb per hour), so I save them on my external HDD, rather than my iMac
Will it cause any problems? or anything?
cheers

Ethernet is generally slower than FireWire.
You could import the files into your iMac and edit them there, then save all the edited material back onto the external hard disc. But Ethernet isn't generally fast enough for real-time editing (..across the network..) onto the external disc. So you'd (1) move the files to the internal, (2) edit them there, (3) export or Save the edited project back again to the external disc.
Note than a disc formatted for use on a PC will probably be identified by your Mac's 'Finder' as a "PC Exchange format" disc ..the file system used on the disc would probably be the DOS 'FAT 32' system.
Although Macs can read and write to this format, some of the iMovie-specific "metadata" may not be saved onto a FAT 32 disc; iMovie prefers to work with a Mac-formatted "Mac OS Extended" format ..but PCs generally can't read or write to that!
So what you may need to do is to bring in all your material onto the iMac for editing, and then 'Share' or Export the resultant movie(s) as QuickTime movies (..instead of as original 13GB-per-hour DV files..) if you want to be able to play the results on that PC itself.
But I'd avoid using an external hard disc which is actually in a PC; the format (file system) - although
it'll work with a Mac - is all wrong for iMovie.
Invest in a proper, separate external FireWire hard disc - they're cheap now: Amazon's selling 1000 gigabyte discs for £89 ..that's about $140..! - and immediately format it (..using Applications>Utilities>Disk Utility..) as 'Mac OS Extended', and then use it exclusively with your iMac.
You'll be far happier that way..

Using Bridge over a network with others

Would Bridge be a good solution to set up photo library over a network that can be updated and modified with everyone on the network?

I believe that using Bridge to share image files on a network is possible. In fact, we're just about ready to golive with our image library on a network -- using Bridge as the browser.
Here's what I've discovered over the past sevral weeks of testing:
As Ramon correctly points out on this forum trying to share a centralized cache is indeed insane. But, as it turns out, it appears that one share cache files across multiple computers; providing these are Macs using CS4 of course. This is not the bext alternative but short of going with a cataloging system -- not always an choice for some organzations -- this is perhaps the only option available.
2. I indexed our image library on my laptop, which took the better part of a day. Organizationally it consists of 56 folders, containing some 104,000 images for more than 434 gigabytes of space.
3. I then copied the cache (and all files) to an external hard drive.
What I copied was on the following path: user>library>caches>Adobe?Bridge CS4>Cache
4. I then went to a second computer -- networked to connect to the central image library drive -- and before launching Bridge I deleted the old cache file, and then copied the new cache file to the second computer. I then launched Bridge, navigated to the image library in the folders panel, clicked on several folders. One-by-one all the thumbs and previews loaded quickly and the metadata was right there as well, allowing for fairly quick and easy searching. And for us "searchability" is the KEY to having a central image library
5. To add mages -- and here's where ity gets a bit klunky -- I intend to add subsequent folders as new images come in to be catalogued. I will then inform the designers that a new folder has been uloaded to the library -- they already have the path -- and that they will need to index that folder to make the images "searchable.
Hopefully this will work on all our designers' machines as well. I'll know more by the end of next week.
BUT, there are a couple of things to consider:
1. Once a folder is indexed it cannot be moved nor can any of the files inside that folder be moved or manipulated in any way. For example, if you returned to a file to add additional metadata, then each user would have to reindex that particular folder on their local copy of Bridge. Having said that, it's not terribly difficult or challenging. In our case, since the image library is permanent once these folders are indexed and "accessed" on each machine that's it. It's the initial indexing that can take so much time.
2. Make sure that permissions are in place before you golive. In our situation just me and my director have read/write permissions. All others have read only. This allows anyone to pull an image out of the library and use it as they see fit once the copy is on their desktop of course. They simply cannot make any changes, additions or alternations in the existing folders and files ON THE LIBRARY DRIVE.
That's it for the moment.
Stay tuned.

Clustered Environment - Changing from Public Network to Private Network

I have a clustered environment where the database sits on one node and the central instance sits on the other node. We just found out that somehow the communication between the database and central instance has been changed to talk over the public network instead of the private network. We don't know who did it or why.
So, my question is what do I need to do in SAP to accomodate the changing back to using the private network? Do I need to change system names in the profiles? Are there any gotchas on doing this? Are there any documents on doing this?
Thanks for any information you can provide on this topic.
Thanks,
-- Jackie

This is most likely a name resolving problem.
If you ping <name> from one server to the other, which network is used?
Markus

Virtual Private Networking

I've tried to research this subject before I posted, but I really haven't found any good explanation - I've had an icon at the top right of my screen since I've had my computer - it's for "VPN" - which I've basically ignored until today - I'm curious as to its function. Like I said - I tried to find out more about it, but every explanation is unclear to me. Can anyone tell me, very simply, what exactly is VPN?

The name kind of says it all, but a practical example often helps.
First, think of a private network as any local area network such as that used in an office, your home, etc. Everything on that local area network (LAN) is private, and protected from the internet by firewalls, NAT devices, etc.
That's all well and good for people inside the office. However there are many cases where people outside the office would also benefit from access to the internal/private machines. For example, sales people might benefit from accessing the corporate database on product availability, client profile, etc., or maybe want access to a corporate file server or email server.
One option is to open those services to the outside world, but you then run into issues with protecting the data from unwanted users - e.g. hackers trying to crack into the corporate database, download financial information, etc.
It's possible to do using various authentication systems, encryption systems, etc., but you have to apply the same rules over and over again to every service that you want to be able to access remotely, and missing just one leaves your entire network vulnerable.
Enter the VPN.
The VPN extends the concept of the private LAN to specific remote systems. Remote users connected to the VPN (e.g. that sales guy on the road, the IT guy working from home, etc.) authenticate once to a VPN server and then appear to be in the LAN, just as if they were at a desk in the office.
As far as all the internal servers are concerned, the user is local. He can do anything he'd be able to do in the office, including printing on office printers, accessing file servers, etc., without the need to specially configure each service, and without the need to open lots of holes in the corporate firewall.
So the user on the VPN appears to be on the local network, but isn't - hence the 'Virtual' part of the equation.
VPNs can be scaled to support anywhere from one or two users to thousands of users across multiple continents - it's not uncommon, for example, for multi-national corporations to have VPN connections between offices. That way anyone in any office can connect, securely and easily, with anyone else, without having to worry (too much) about where that resource is, or whether it's available outside of the office.
Does that help?

Proper routing for lan through verizon private network (GRE) to airlink gateways

Okay, I give up, and think I have done my due diligence (I have been engrossed and fascinated spending many more hours than allotted to try and learn some of the finer details). Time for some advice. My usual trade is controls engineering which generally require only basic knowledge of networking principals. However I recently took a job to integrate 100 or so lift stations scattered around a county into a central SCADA system. I decided to use cellular technology to connect these remote sites back to the main SCADA system. Well the infrastructure is now in and it’s time to get these things talking. Basic topology description is as follows: Each remote site has an Airlink LS300 gateway. Attached to the gateway via Ethernet is a system controller that I will be polling via Modbus TCP from the main SCADA system. The Airlinks are provisioned by Verizon utilizing a private network with static IP's. This private networks address is 192.168.1.0/24. Back at the central office the SCADA computer is sitting behind a Cisco 2911. The LAN address of the central office is 192.168.11.0/24. The 2911 is utilizing GRE tunnels that terminate with Verizon. The original turn up was done with another contractor that did a basic config of the router which you will find below. As it stands now I am pretty confident the tunnels are up and working (if I change a local computers subnet to 255.255.0.0 I can surprisingly reach the airlinks in the field), but this is obviously not the right way to solve the problem, not to mention I was unable to successfully poll the end devices on the other side of the Airlinks. I think I understand just about every part of the config below and think it is just missing a few items to be complete. I would greatly appreciate anyone’s help in getting this set up correctly. I also have a few questions about the set up that still don’t make sense to me, you will find them below the config. Thanks in advance.
no aaa new-model
ip cef
ip dhcp excluded-address 10.10.10.1
ip dhcp pool ccp-pool
import all
network 10.10.10.0 255.255.255.248
default-router 10.10.10.1
lease 0 2
ip domain name yourdomain.com
no ipv6 cef
multilink bundle-name authenticated
username cisco privilege 15 one-time secret
redundancy
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key AbCdEf01294 address 99.101.15.99
crypto isakmp key AbCdEf01294 address 99.100.14.88
crypto ipsec transform-set VZW_TSET esp-3des esp-md5-hmac
mode transport
crypto map VZW_VPNTUNNEL 1 ipsec-isakmp
description Verizon Wireless Tunnel
set peer 99.101.15.99
set peer 99.100.14.88
set transform-set VZW_TSET
match address VZW_VPN
interface Tunnel1
description GRE Tunnel to Verizon Wireless
ip address 172.16.200.2 255.255.255.252
tunnel source 22.20.19.18
tunnel destination 99.101.15.99
interface Tunnel2
description GRE Tunnel 2 to Verizon Wireless
ip address 172.16.200.6 255.255.255.252
tunnel source 22.20.19.18
tunnel destination 99.100.14.88
interface Embedded-Service-Engine0/0
no ip address
shutdown
interface GigabitEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
ip address 10.10.10.1 255.255.255.248
shutdown
duplex auto
speed auto
interface GigabitEthernet0/1
ip address 192.168.11.1 255.255.255.0
duplex auto
speed auto
interface GigabitEthernet0/2
ip address 22.20.19.18 255.255.255.0
duplex full
speed 100
crypto map VZW_VPNTUNNEL
router bgp 65505
bgp log-neighbor-changes
network 0.0.0.0
network 192.168.11.0
neighbor 172.16.200.1 remote-as 6167
neighbor 172.16.200.5 remote-as 6167
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip route 0.0.0.0 0.0.0.0 22.20.19.19
ip access-list extended VZW_VPN
permit gre host 99.101.15.99 host 22.20.19.18
permit icmp host 99.101.15.99 host 22.20.19.18
permit esp host 99.101.15.99 host 22.20.19.18
permit udp host 99.101.15.99 host 22.20.19.18 eq isakmp
permit gre host 22.20.19.18 host 99.101.15.99
permit gre host 22.20.19.18 host 99.100.14.88
access-list 23 permit 10.10.10.0 0.0.0.7
control-plane
end
So after spending countless hours analyzing every portion of this, I think that adding one line to this will get it going (or at least closer).
ip route 192.168.1.0 255.255.0.0 22.20.19.19
That should allow my internal LAN to reach the Airlink gateways on the other side of the tunnel (I think)
Now for a couple of questions for those that are still actually hanging around.
#1 what is the purpose of the Ethernet address assigned to each tunnel? I only see them being used in the BGP section where they are receiving routing tables from the Verizon side (is that correct?). Why wouldn't or couldn't you just use the physical Ethernet address interface in its place (in the BGP section)?
#2 is the config above correct in pointing the default route to the physical Ethernet address? Does that force the packets into the tunnel, or shouldn’t you be pointing it towards the tunnel IP's (172.16.200.2)? If the config above is correct then I should not need to add the route I described above as if I ping out to 192.168.1.X that should catch it and force it into the tunnel where Verizon would pick it up and know how to get it to its destination??
#3 Will I need to add another permit to the VZW_VPN for TCP as in the end I need to be able to poll via Modbus which uses port 502 TCP. Or is TCP implicit in some way with the GRE permit?
I actually have alot more questions, but I will keep reading for now.
I really appreciate the time you all took to trudge through this. Also please feel free to point anything else out that I may have missed or that can be improved. Have a great day!

My first comment is that you have two posts in this forum and as far as I can tell they are exact duplicates, other than changing the title of the posts. It is better to figure what you want to ask and then to ask once.
My second comment is that you have given us information about your central site. At some point we may also need some information about what is at the remote and how that is set up. But for now we will deal with what we know about your site.
Before I deal with your specific questions I will comment that if you are able to access the remote airlinks that it is a pretty good indicator that the tunnels are probably working. But to understand the significance of this it would help if you clarify for us what address is on the local computer when you change the subnet to 255.255.0.0.
Also what you have shown us allows us to see that BGP is configured but provides no insight into whether BGP is working or now. It would provide helpful information if you would post the output of show ip bgp sum.
So to address your specific questions:
You suggest that adding a static route for 192.168.1.0 might be part of the solution. But we have no information about what that network is or its significance. So we have no way to know whether the static route would help or not. But my guess (based on very scant information and therefore based mostly on assumptions) is that if BGP is working correctly that the static route is not needed.
1) asks about an Ethernet address on the tunnel. I assume that you really meant to ask about the IP address assigned to the tunnel. The reason that the tunnel needs it own IP address is that we want a unique subnet assigned to the tunnel. If we used the address from the physical interface as you suggest then both tunnels would have the same address and that implies that they both connect to the same place, and that assumption is not correct.
2) Yes it is correct to point the default route to the IP address that is the next hop from the Ethernet interface. You might want to have a route pointing at the tunnel address for remote subnets reached via the tunnel. But in looking at the config and trying to understand what was intended it is pretty obvious that running BGP over the tunnel is intended to learn the remote addresses over the tunnel and therefore there is no need for static routes for the remote resources.
3) You should not need an additional permit for TCP 402. The TCP packet will be carried through the tunnel and the access list you are referring to will see the packet will modbus polling as GRE traffic and not as TCP traffic.
HTH
Rick

Metadata over private network?

Similar Messages

Maybe you are looking for