Shared Firewall in MPLS cloud

Hi. I have an MPLS cloud on which i want to provide basic Internet connectivity for customers in the cloud. This will not be for VPN services, simply http, ftp etc (possibly some inbound NAT for webservers). I have a 7200VXR for the job. My plan is to set this up as an effective PE in the cloud and use 'NAT VRF AWARE' features to NAT networks in each VRF to Single public IP (currently this is 1 per VRF from a large pool). I cant see a reason for this not working but i wanted to get advice on this. I am also unsure as to how the public facing interface will be seen by the customer VRF since it will not be statically labeled with any VRF.
Any thoughts on this?
Thanks in advance.

Hi Swaroop, I'm trying to follow your advice regarding the global default. I have 2 vrf's I'll be using called CUST1 and CUST2. Traffic will come into the e2/0.1 sub interface and should then be NATed to 210.10.10.17 (global interface not VRF). If i use static translations inside they work fine. Dynamic however translations do not seem to work. I have really tried to follow Cisco's documentation, but I'm not having much luck. Do you notice anything incorrect with the following.
interface Ethernet2/0.1
description "CUST1 Interface"
encapsulation dot1Q 10
ip vrf forwarding CUST1
ip address 172.16.1.10 255.255.255.252
ip nat inside
ip virtual-reassembly
interface FastEthernet0/0
description "OUTSIDE INT"
ip address 210.10.10.17 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex full
ip nat pool CUST1_POOL 210.10.10.17 210.10.10.17 netmask 255.255.255.0
ip nat inside source list 1 pool CUST1_POOL vrf CUST1 overload
access-list 1 permit 172.16.0.0 0.0.255.255 log
ip route vrf CUST1 0.0.0.0 0.0.0.0 FastEthernet0/0 210.10.10.254 global
Any help you can give me would be very appreciated.
Thanks
Dan.

Similar Messages

Can't set port for IRC in Sharing/Firewall preferences...

I turned on the firewall and was able to specify ports for Bittorrent, but I want to use IRC (it keeps getting blocked, which I'm assuming has something to do with the firewall which I just activated), so I went into System Preferences-->Sharing-->Firewall, scrolled down to IRC and then Edit, for TCP number it has 194 (but grayed out) and UDP it's blank, but I can't alter either entry box.
It's my computer and I have whatever access privileges I need (I think) so at a loss here. Can anyone point me in the right direction?
P.S. Some of the IRC servers I wanted to set up accounts with had port listings of 6667 and the like, that's also why I wanted to specify the number.

Create a new entry with a name such as IRC #2 and add the desired ports to that entry. You cannot alter the ports assigned to the default entries; you need to create new ones to specify additional ports.
(15661)

I have 2 phones sharing the same i cloud account. Can i delete the account on one phone and set up a separate account. ?

I have 2 phones sharing the same i cloud account. Can i delete the account on one of the phones and set up a separate account, will this stop the contacts being shared ?

Wade...
This support article may help you > Apple IDs and iCloud

Monitoring flap in MPLS cloud

Hi,
I'm having 2 MPLS links over 2 different service provider. BGP is configured. Sometimes we get disconnection for few mins in 2 or 3 days, it's not consistent. The logs did not show any flapping on the interface. What can i do now to help the situation? Or even gather some prove that the flap is within the MPLS cloud?
Thanks,
Steven

Hi,
what do you mean by disconnected? does that simply mean no connectivity, but still all routing info in place?
Then it sounds like a MPLS LSP problem in the provider backbone. MPLS VPN packets can only be delivered when a LSP exists. Routing packets however can be delivered through IP in the provider backbone without LSP. This is because VPN routing information is transported by BGP from PE to PE (loopbacks).
So a failed LSP disrupts your data plane (IP packets sent) but not the control plane (BGP).
Unfortunately for you, there is no way to detect that from a CE control plane perspective. So even the typical backup scenarios fail here like floating static, dialer watch and the like.
Hope this helps
Martin

Sharing files with Creative cloud for teams

HI,
I am looking at getting creative cloud for teams, but I want to keep our existing CS suite users who are already on maintenance plans.
Can I share files on the creative cloud between these two types of users?
Does Adobe Bridge see these files ?
Is there any way of doing version control ?
We are also worried about this
"If a team member leaves the company, what happens to their files stored in Creative Cloud?
The IP is associated with the individual, not the company. The individual will have a 90-day grace period to delete their files."
Also we are in Australia and we are concerned about the speed. Can anyone advise what the speed is like ?
rgds Renovator

Anyone who signs up for the Creative Cloud can share files. You do not need to be a Creative Cloud member to view a shared file, only to do the sharing.
Adobe Bridge does not see the files unless you use Creative Cloud Connection to sync the files to your local computer.
There is no version control yet. It is on our road map.
Being in Australia should not be an issue, but I will let other customers from Australia comment.

Web Sharing, Firewall, & Security Issue

I recently turned on/activated Web Sharing, but I forgot to turn on the Firewall. Now I think I may have gotten malware, or some other sort of bad stuff on my machine.
Am I right in this thinking? If so, what steps might I take to offset the damage? Thanks.
Quick background note: I was experimenting with the using the Apache server that comes built in with Mac (because I'm learning mysql, php, etc.) And this tutorial mentions the importance of activating the Firewall if the user turns on Web Sharing http://www.macinstruct.com/node/112
Specs:

I didn't know about Quarantine being included in the Leopard OS ("Quarantine is a feature of Mac OS X introduced in version 10.5 (aka Leopard)) Thanks for pointing that out.
More generally, I've been using Macs for several years and really like them, but this was the first time I activated/enabled Web Sharing for using the Apache server software and so I was just a little worried about that. And also, it seems as though my system has been working more slowly than it usually does.
BTW: I did some of the most commonly suggested steps for improving performance.
1. Check to see I have latest OS updates. [Done]
2. Run/verify/repair disk permissions via Disk Utility [Done]
3. Clear browser caches [Done]
Thanks again.

EIGRP Routing across MPLS Cloud

I appologize if this has been covered but I dont see any exact hits...
We are working with our Service Provider to implement MPLS between our remote sites and main campus. We are currently using PtoP T1 in a hub and spoke model. We are running EIGRP in our entire environment.
We would like to continue to run EIGRP in our environment but the SP does not support this protocol through the cloud. I would prefer not to introduce any new routing protocols into our environment such as BGP. (I believe SP is running BGP).
I have read snippits that I can us e GRE tunnel between sites and send EIGRP routing updates via this tunnel.
Can anyone support this method or are there better alternatives? If I implement GRE, I will still need to configure static routes so GRE knows how to reach the remote sites. I also cannot find any literature on how to configure GRE tunnels and use them ONLY for routing updates. I would think sending all traffic via GRE would cause additional overhead.
I will also have a need to send Multicast traffic between sites. I have read that GRE is the way to do this. To me it seems GRE will serve dual purposes.. first to allowing Dynamic routing updates between sites and also to allow Multicast traffic.
I appreciate any comments or suggestions!

Hello Phil,
using GRE tunnels to build an overlay would deny one of the greatest benefits of MPLS L3 VPN: the peer model where each CE talks only with local PE node.
unless you have a small number of sites this approach is not recommended.
What if a new site is added in the future? you would need to configure a tunnel GRE to the new site in each of the existing sites.
You could run a DMVPN ( that is to use mGRE) to solve this but it has some complexity.
You can run BGP without using mutual redistribution: BGP allows to advertise internal networks using the network command even if they are not directly connected to the CE router but learned via EIGRP.
So it is enough to redistribute only BGP into EIGRP by setting a default seed metric (it requires five values in EIGRP and it is necessary or redistribution will not occur)
router bgp 65001
neigh PE-address remote-as SP-AS-number
network 10.10.10.0 mask 255.255.255.0
network 10.10.20.0 mask 255.255.254.0
no auto-summary
! note:if auto-summary is disabled you need to provide the exact mask / prefix length
router eigrp 100
redistribute bgp 65001
default-metric 10000 1000 255 1 1500
! BW delay reliabilty load MTU
Hope to help
Giuseppe

An MPLS Cloud

Hi,
I'm looking at a topology where a number of collapsed PE/P nodes (50>100) access a L2 cloud in a full-mesh topology. The underlying cloud architecture could be something like VPLS from an external provider with the MPLS domain mapped on top. The attached shows the nodes on the periphery of the cloud and these could be spread globally. What I'm looking for are pros and cons and whether there is a case study or CVD for this type of topoolgy. Particular interest is on scalability around IGP, LSP's, sub-optimal routing conditions, IGP/LSP synchronisation, IGP link/domain costs etc... The network will provision L2/L3 VPN's and other standard MPLS features.
Thanks, Wayne

Hi,
You'd need to implement QOS for sure. What many people do is to have data traffic use precedence/EXP 0 and Voice precedence/EXP 5. You could make the video traffic precedence/EXP 4, for example. This also maps to certain DSCP values.
You could also consider MPLS Traffic Engineering (TE). There is point-to-point TE for your data traffic, but you could also deploy (check platform and IOS support) point-to-multipoint (p2mp) TE to carry the IP multicast (video) traffic. With TE, you could steer traffic through the network and have fast protection (FRR). You'd still need to use QOS, because MPLS TE does not automatically hook into QOS.
Regards,
Luc

Home sharing firewall problem

I'm trying to set up home sharing between a macbook pro running 10.4.11 and a powermac G4 running 10.5.8.
On the G4 I've set iTunes sharing to allow incoming connections in System Preferences/Security/Firewall, but a look at the log show that the G4's firewall is denying the connection attempt from the Macbook. Going the other way (playing and sharing from the Macbook to the G4) works fine.
I can get it all to work if I turn off the firewall, but obviously I'd rather have the firewall on.
In System Preferences/Sharing on the G4 the computer name was empty. I changed it to Leo to see if it made a difference with the firewall and it didn't. I continued messing around a bit and later I saw an entry in the console (which unfortunately is now overwritten so I don't know exactly what it said) saying something about the computer name and it reassigned a name instead of Leo, "PowerMac-0003938D88-2".
I continued messing around with settings and then when turned the firewall back on it started working properly and allowing the Macbook to connect to iTunes.
After thinking about this overnight, I started thinking this may be connected to another problem I've been having with the G4. I've had ongoing issues with DHCP assigning 169 address. As this machine isn't used as my main computer, everytime I shut it down I've just been deleting the SystemConfiguration folder so when I boot back up I get the correct IP address assigned to be able to be online. This works and is easy so I haven't bothered to investigate it further. I'm assuming this is why the G4 computer name is blank.
I've since trashed the System Configuration folder again, so I'm back to where I started with the firewall denying connection attempts to iTunes even though it is set to allow. I've tried to follow my previous steps (giving the computer a name in System Preferences/Sharing) to get it to work but haven't had any luck.
Is there a way to force the system to assign a name to my computer? Or any other insights into what may be the problem would be much appreciated!

I was having the same problem. Simple solution that worked for me:
1. Under Security/Firewall, remove iTunes access allowance (-).
2. Set it to allow all incoming connections.
3. Restart computer.
4. Open Settings/Security/Firewall
5. Set access for specific services and applications.
6. Add ( + ) iTunes access and allow incoming connections.
For me, it seemed the firewall was just getting stuck. Don't know how it will hold up long term.
Good luck.

File sharing Firewalled since last security update

Hi there:
I (also) use Azureus as a file sharing program. I have my firewall on, with some ports marked as open to allow incoming connections. After installing the last security update, suddenly I am firewalled, even though nothing else has changed as far as my settings. I used to have ports 6881-6999 open for listening, tried changing to a different (higher) port - used 50001 - nothing is different.
I hope I'm explaining this correctly - and I hope someone can offer a suggestion! Proper etiquette for file sharing is to upload as much as you download, and I can't get connections through to "keep up my end of the bargain!"
Thanks in advance,
kris

Hi Tim:
I am connected using a cable modem (motorola, if it matters). I remember vaguely doing terminal commands once upon a time, so I'll pull out the book and try your reset.
If I start a torrent, some peers can upload but most can not, and the Azureus reads that I have DHT firewalled and have "NAT problems."
I tried turning off the firewall in the system preferences altogether, and that didn't change the Azureus problems, either.
Sorry if my explanations don't make enough sense!
kris

Home Sharing - Firewall

I am trying to get my sister's Apple TV set up at her house. I am having no luck getting her home sharing set up (everything else seems to work OK).
I checked her firewall settings and they're set to "on" - she's an Apple employee and this is not a setting that can be changed.
Are we out of luck on this?

I was having the same problem. Simple solution that worked for me:
1. Under Security/Firewall, remove iTunes access allowance (-).
2. Set it to allow all incoming connections.
3. Restart computer.
4. Open Settings/Security/Firewall
5. Set access for specific services and applications.
6. Add ( + ) iTunes access and allow incoming connections.
For me, it seemed the firewall was just getting stuck. Don't know how it will hold up long term.
Good luck.

Sharing Files on Creative Cloud

I want to put out files for several design projects to be shared by other designers. I can't put folders out on the cloud, only the InDesign file itself. How do I put the fonts, images, etc. out there?

Hi ChrisM-NH,
I am sorry but as of now Folder sharing is not available. Our Engineering teams are working on it day and night to get it online for all the Creative Cloud Users.
Regards,
Abhijit

Sharing folders on my cloud with other members of my team

i recently applied for and was given early access to Creative Cloud file and Typekit font syncing. The syncing part works fine, but I am only able to send links to individual files and not folders. the other members of my team are able to send links to actual folders.

Right now, only sharing of public links to individual files is supported. Folder sharing is not supported at this time.
And while we're talking about file and folder sharing, can you give us more details on the sharing features that would be valuable to you? Can you describe them in the context of your team's current workflow?
Thanks,
Elba

There are 2 names sharing the same I cloud account how can I delete one of them, I can not download a paid app it shows a different name in I tunes

How to remove Apple ID and password from a shared account for I can download from I Tunes to have separate accounts?

OK, but in my ipad, the apple id i have in itues is already the one iwant to have, but th one i used to sin in for i-coud is the other one. Any tip as to how to change the apple id for icloud and any idea how to know what apps i bought with the other apple id so as to delete them from my ipad to avoid being asked to enter another apple id every time they get updated? thanks!

Ad-hoc internet sharing firewall

I have an ad-hoc wireless network set up with internet sharing on a Mac mini running OSX 10.6. I have several machines connected to it, all of which can ping the mini and can access the internet in general. I can also ping each of these machines from the mini. However, none of these machines seem to be able to see each other - I can't ping them across the mini's ad-hoc network, and when I ping the broadcast IP (10.0.2.255 in this case), I only get a response from the mini. What secret configuration options do I need to alter to get the machines on the network to see each other? I'm a Linux guy, btw, so if the answer involves messing with things at the command line, I'm cool with that.

To elaborate a bit, a more Mac kinda guy than I am confirmed that internet sharing makes the mini act as a gateway, but not a router, which is obviously what I need. Is there a convenient way to get it to act as a router, or do I need to spend some quality time with ipfw?

Shared Firewall in MPLS cloud

Similar Messages

Maybe you are looking for