@Tim-OBrien,

So it depends on certain devices and standards used. The latest standard it is what is called "CU." --currently unused.

The use of ECN is an optional feature that allows for the end-to-end notification of network congestion without stoping the traffic to send a signal. The CU bits can be used for this if the devices are ECN-aware .

@Heberto-Coss,

CCNP ENCOR is the qualifying exam for you to sit for the CCIE Exam and it is 1 of 2 exams required to enter the CCNP Enterprise Certification. So it has dual purpose.

It is what is considered essential knowledge to prepare you for the CCIE lab exam but this doesn't include the expert level of skill and experience that you would want to understand before sitting for the CCIE Lab exam.

When you pass the ENCOR exam, you will have a cisco specialization certification too.

@Sherwin-Sherman,

In the 1st ping issued, it means that the device was unresponsive...usually this is from ARPing. Then the last ping had a reply which means the device responded with a message of Destination host unreachable. So here, with ARP there was no reply in the first and second responses (Request timed out)--no response from the ARP ...then post ARP...the device replied.

Then the 2nd ping issued. The device is responsive with replies. Here it tells us that the pinged device is up and replying just not with a response that we want, 100% of the time. You can see from the Ping statistics for 10.0.99.210: it is exactly as you've posted... (0% loss).

Hi Anthony,

Yes, I totally get that but I think you should specify that in order for the eBGP multihop configuration to work properly the static route to 2.2.2.2 needs to be added.

I saw the route in first place and know its purpose but maybe it doesn't do any harm to mention about it specifically.

Robert

@David-Thompson,

That is a great buy!

@Dan-Kutka,

Please do take a look at those episodes. I think that will answer the majority if not all of your questions. If not please post more questions here!

Yes - you are crushing it! You have reasons behind your design that make sense! Awesome!

We never want to be designing complexity into the network just because those options exist - and you are NOT doing that. Awesome.

Just closing the loop on this. After talking with SonicWALL and reviewing our environment, there were two changes I made that resolved this.

First, SonicWALL has asymetric route support that can be enabled on "tunnel interfaces". Who knew? I didn't.
017fc4c2-5703-45be-a960-9f8d6e7f9818-image.png

Second, I went through and manually adjusted costs on all the links so that the traffic was a bit more predictable. So instead of relying on the routers to all select the same path with the same cost info, I just forced it.

Things have been running well since the changes. Just wanted to let everyone know what I ended up with.

Regards,
Adam Tyler

@Ronnie-Wong Thank you Ronnie, yes, the video answered my quesion

@Ronnie-Wong thanks very much. I had to restart gns3 and its ok now..

@Jeff-Hubbard,

Ok...I had to go into the studio and turn on my 3750X. and here's what I had as an output:

Switch(config)#interface port-channel 5 Switch(config-if)#port-channel ? load-defer Enable Load Share deferral min-links Minimum number of bundled ports needed to bring up this port channel standalone-disable Ports will go to suspended mode if peer does not respond. Use with [no] prefix for independent mode.

when I tried the lacp max-bundle

Switch(config)#interface port-channel 5 Switch(config-if)#port-cha Switch(config-if)#port-channel min Switch(config-if)#port-channel min-links 3 Switch(config-if)# *Jan 2 00:07:46.087: %EC-5-MINLINKS_NOTMET: Port-channel Po5 is down bundled ports (0) doesn't meet min-linkslacp <This is because I only configured one switch> Switch(config-if)#lacp ? % Unrecognized command

My guess now is down to IOS version or possibly platform.
I have a 3750X. There are 3750 models. and c3750e-universalk9-mz.152-4.E10.bin

if those two are not the issue, I'm not sure.

@Brian-Keys,

Yes, within the Cisco ENCOR show, Anthony and I review each type with the definitions too. So you'll find them there.

A tip for the CCNP ENCOR exam, it's not just a memorization of the definition of LSA types but know what they are but when they are sent and why a router would send certain LSAs and not others. At the CCNA, it was enough to know what they did but at the professional level you must know why they're used too!

Thanks Ronnie,

I did add the "spanning-tree portfast trunk" command to each of the aggregated ports and it now appears in their configuration. So, I think it worked. I just haven't had the nerve to plug in another switch to test it. If I'm wrong, it will all come crashing down again and that's not fun. I may do it this weekend when no one else is around to be affected AFTER shutting down critical services such as SQL Server to be on the safe side

Regards,

Kevin .

@Yihad-Fadlallah-0,

I'm not exactly visualizing how this works. So apologies for my ignorance here. Here' is what I am visualizing:

Screen Shot 2020-08-30 at 2.11.14 PM.png

On the Firewall connected to the ISP. I would setup NAT outside For link connecting to the ISP Then setup NAT inside For link connecting to the LAN directly attached here for the link connecting to the 2nd Firewall.

You shouldn't need to configure NAT on the second firewall.

If this isn't what you're trying to do, you'll have to clarify for me.

@Saif-Yaseen said in what have i done wrong in this problem ?:

I made up a problem with the following :-
Given network for 192.168.10.0/24 for VLSM :-
IT - 27 Hosts
Sales - 59 Hosts
HR - 20 Hosts
OF - 70 Hosts

But when i go to a sub calculator to verify my VLSM, It shows that i have done the Sales wrong, So i checked by doing the AND operation and the 6th bit is not under the the Subnet mask which is the right cause of the issue.

Now did i come to the right conclusion ? and what is to be done in this case to fix the issue ?

Here's the unusual things about the way subnetting calculators work. And also logically how we subnet as well. There is an "order" to doing it. That order is start with the largest subnet to smallest subnet.

This is the proper "order?" that works.

1st OF: - 192.168.10.0/25
Range -> x.0 - x.126
BC -> x.127

2nd Sales: -192.168.10.128/26
Range -> x.129 - x.190
BC -> x.191

3rd IT: -192.168.10.192/25
Range -> x.192 - x.222
BC -> x.223

4th HR: -192.168.10.224/25
Range -> x.225 - x.253
BC -> x.254

I do not know the technical term for this...its not an order of operations per se but an "value precedence(?)" in binary math that is programmed into the subnet calculators that is correct.

Here is the output of what happens if you do a smaller subnet proceeding a larger subnet:

Router(config)#int g0/0 Router(config-if)#ip address 192.168.10.1 255.255.255.224 Router(config-if)#no shutdown Router(config-if)# *Aug 27 11:25:26.947: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up *Aug 27 11:25:27.948: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet Router(config-if)#int g0/1 Router(config-if)#ip address 192.168.10.33 255.255.255.128 % 192.168.10.0 overlaps with GigabitEthernet0/0 % 192.168.10.0 overlaps with GigabitEthernet0/0

Here is what happens when you do a smaller subnet after a larger subnet:

Router(config)#int g0/0 Router(config-if)#ip address 192.168.10.1 255.255.255.224 Router(config-if)#no shutdown Router(config-if)# *Aug 27 11:25:26.947: %LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up *Aug 27 11:25:27.948: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet Router(config-if)#int g0/1 Router(config-if)#ip address 192.168.10.33 255.255.255.128 % 192.168.10.0 overlaps with GigabitEthernet0/0 % 192.168.10.0 overlaps with GigabitEthernet0/0 Router(config-if)#ip address 192.168.10.33 255.255.255.240 Router(config-if)#no shutdown Router(config-if)# *Aug 27 11:28:20.027: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up *Aug 27 11:28:21.027: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up Router(config-if)#

@Zachary-Ott,

You can do a search for Cisco DNA Center. They have demos that are available, also you can setup a one on one demo with a Cisco DNA center professional

In Sept, I will be doing a webinar to introduce the concept of IBN--what it is and what it isn't. We will not be doing a demonstration around this but general exposure as to what it is.

@Victor-Rosa-Serrano,

It can be unidirectional routing. Can you ping from .119 to the sonic firewall, then .119 to the inside .1.0/24?

I forgot that you're running nat as well. It could be NAT...easiest way to test this out is to take nat out of the picture

Hi Anthony,

Thank you for sharing that explanation.

I see, thank you for the response