What's the best way to setup Cisco 3850 switches by copying configs over the new one. 2 identicals are already in place.  
The additional will server same functions as access switches.

Hi,

I’m hoping to get some ideas on this one. I’m having some intermittent latency and sometimes dropouts on the network, which consists of mostly Cisco SX300 switches.

When the latency or dropout happens, the CPU utilisation of the core SG300 Switch would be over 40%. I have been told the issue is caused by spanning tree and turning global spanning tree off on the core switch does help, however, I think it is not the spanning tree or it is more that just the spanning tree.

What other things could I look into in finding the cause?

Any help appreciated!

Jonathan

I'm drafting an SOP doc & need to spell out the specific roles/duties of
Firewall admins vs IT Security (governance) :

I'm not sure if RBAC (Role Based Access Control) comes into play here
but my view is:

a) all Firewall rules requests as well as proxy requests (say to whitelist
    a URL or permit certain file types to be saved/downloaded) are to
    be reviewed & approved by the IT Security governance as well as
    requestor's managers  while Firewall admins implement them:
    is this what's generally practised?

b) reviews of Firewall logs/events are jointly done by a network admin
     or lead or manager who is not an implementer of firewall rules &
     counter-reviewed by IT Security gov : certainly we hope to automate
     this by SIEM with UEBA but Audit still requires such events/logs reviews
     to be signed off by 2 parties

c) What about firewall rules review : which parties should review them?
    Certainly not firewall admins as they're the creator of the rules so
     they'll just sign off as "No issue" : it's a conflict of interest.  We had
     run into case where a critical & sensitive Prod server was permitted
     for access to entire organization.  Tools like Tuffin only review for
     "dormant" rules but not such rules created for "testing" but forgot
     to be removed.   Any tools could help with such detection?

What are some free proxies out there that could do blacklisting (& possibly greylisting)
as well as auto-block by know malicious sources (eg: get updates from SpamHaus,
AlienVault, bad Reputation sites & known sources of malwares).

Ideally the free proxies could also stop users from downloading executables or
a specified file types.  No plan to go for commercial ones like Bluecoat.

Configuring NAT

in the LAB configuration below:
I have R1 and R2 in subnet 192.168.12.0/24 ----R3 in subnet 10.10.13.0/16  and R4 in subnet 10.10.24.0/16

I would like to have R3 be able to ping R4

The NAT configuration does not seem to work as it is supposed to.
Any Help ?

Thank you

R1#sh run 
Building configuration...

Current configuration : 2199 bytes
!
! Last configuration change at 02:39:42 CET Sun Sep 2 2018
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
!
no aaa new-model
clock timezone CET 1 0
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
!


!
!
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!         
!
!
redundancy
!
!
! 
!
!
!
!
crypto isakmp policy 5
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco@123 address 192.168.12.2   
!
!
crypto ipsec transform-set MY-SET esp-aes esp-md5-hmac 
 mode tunnel
!
!
!
crypto map IPSEC-SITE-TO-SITE-VPN 10 ipsec-isakmp 
 ! Incomplete
 set transform-set MY-SET 
 match address VPN-TRAFFIC
!
!
!
!
!
interface Ethernet0/0
 ip address 192.168.12.1 255.255.255.0
 crypto map IPSEC-SITE-TO-SITE-VPN
!
interface Ethernet0/1
 ip address 10.10.13.1 255.255.0.0
!
interface Ethernet0/2
 no ip address
 shutdown
!
interface Ethernet0/3
 no ip address
 shutdown

Select all Open in new window

…

Is it Enough to configure DHCP Snooping without ARP Inspection

I would like to know if it is efficient to configure just DHCP Snooping and do not configure ARP Inspection.
 I thought DHCP snooping is enough to avoid having Rogue DHCP in the Network. So what  else that ARP Inspection adds to the DHCP Snooping ?

Thank you

What are the best fiber cable manufacturers?  There're so many online and price varies and lot.
Looking for LC/LC SM and MPO MM cables.  
Please advice.  I normally buy on Amazon.

Have anyone used multi-mode to single mode fiber converters?  Are they reliable?  
I need to run 40G optics between the floors in the three building floors (floors 1,2,and3).  MM fiber is already in place.  To support 40G between these three floors we need single mode duplex LC fiber.  
Instead of doing new SM runs, can we install converters to achieve that?  Would that work reliably?

I have created new 26 vlan in cisco switch. But when i checked spanning tree instance for those vlan i see spanning tree instance only for 4 vlan for rest of vlan i did not see any instance.

Below is the message#

INND-S-D-01-AUS#sh spanning-tree vlan 626

Spanning tree instance(s) for vlan 626 does not exist


Note: All vlan are up,At present no port assign to these Vlan.

In the groups of apartment that I stay, there's  a free Wifi for the community
which I could access from my phone/laptop when I move around the vicinity.
However, a reading room right in the centre of this area, the Wifi signal is
often cut off (or intermittently at 1 bar).

Is there anything I can get/install so that I could get the signal in the reading
room (which is a 5m x 3.5m room with glazed glass panels in front, a thick
wooden door & concrete walls on the roof & other sides of walls)?  Even if
I open the wooden door, the Wifi signal strength did not improve.

Until I shift my chair & laptop & sit just 1m outside the wooden door, then
I get 3-4 bar signal.

I don't mind a USB dongle with a 4m USB extender cable (which could be
slipped under the door but do recommend specific eBay/Amazon links
to the items that could be shipped to Singapore.

Btw, I don't have access to the AP and I can't get the management/admin
of this community to boost the signal so this is not an option.