topic Re: Moving some connections to the New PA in General Topics

Moving some connections to the New PA

MP18 — Fri, 22 Mar 2019 01:05:49 GMT

We have this setup for one site

------Dis sw--------------Edge switch stack of 3 ----------40 users

we need to move few users behind the PA .

what can be best design for this as we only need to have 5 to 10 users behind the PA 850.?

Should we connect small switch to the existing stack of switch ?

Re: Moving some connections to the New PA

OtakarKlier — Fri, 22 Mar 2019 02:30:42 GMT

Hello,

How about a vlan and/or a subnet that routes via the PAN?

I'm sure there are many different options. I would also love to hear what the community has to say.

Regards,

Re: Moving some connections to the New PA

BPry — Fri, 22 Mar 2019 18:52:33 GMT

@MP18 ,

A dedicated VLAN that routes through the PA would be what I would do, as it doesn't require any additional hardware and should be easy to maintain and update. It also doesn't require that you have someone on-site to migrate connections over to the new switch, you simply update the port configuration and assign it to the new VLAN.

Re: Moving some connections to the New PA

MP18 — Fri, 22 Mar 2019 19:23:16 GMT

can we put this PA in vwire mode between the switches?

curently edge switch has 2 upliks that go to dis switch.

for the vwire to work it work in pairs

can i work with single connection for send and receive traffic?

Re: Moving some connections to the New PA

OtakarKlier — Fri, 22 Mar 2019 20:33:25 GMT

Hello,

Can you provide a basic diagram? Somthing like:

switch-->router-->PAN

Please advise,

Re: Moving some connections to the New PA

BPry — Fri, 22 Mar 2019 20:44:15 GMT

@MP18,

If you only have a single connection to use on the PA you would be looking at doing a network TAP, which has limited capabilities, so I would really recommend the vwire setup if you want to do that.

Re: Moving some connections to the New PA

MP18 — Fri, 22 Mar 2019 21:04:49 GMT

But for Vwire I will need to set of cables right but in current setup it is not possible right?

here is diagram attached

Re: Moving some connections to the New PA

MP18 — Fri, 22 Mar 2019 21:06:58 GMT

how can i add visio or pdf diagram ?

system does not allow me

Re: Moving some connections to the New PA

MP18 — Fri, 22 Mar 2019 21:10:28 GMT

scrren shot of diagram

Re: Moving some connections to the New PA

OtakarKlier — Fri, 22 Mar 2019 22:01:31 GMT

Hello,

Where is the PAN located in the diagram or is that your question?

Please advies,

Re: Moving some connections to the New PA

MP18 — Sat, 23 Mar 2019 14:59:25 GMT

PAN will come between the edge switches and Dis switch.

Re: Moving some connections to the New PA

MP18 — Sat, 23 Mar 2019 16:12:26 GMT

I have attached the diagram.

PA will be in between edge and dis switch.

Currenly edge switch only has 1 layer 3 interface which is for sw management access.

config on switch

ip static-route 0.0.0.0/0 gateway 10.10.230.50-------------------------management network

10.10.230.x has vlan interface 3100

Edge switch has trunk interface with link agg to dis switch carrying below vlans

show 802.1q 1

Tagged VLANS Internal Description
-------------+------------------------------------------+
851 Raw 192.168.200.0
3100 mgmt-subnet 10.10.230.0
3203 corp-data-subnet 10.63.24.0
3303 voice-subnet 10.63.26.0
3403 corp-video-subnet 10.63.25.0

what config i will need on PA to allow traffic from edge switch to dis switch carrying trunk port with lacp?

Re: Moving some connections to the New PA

BorisJones — Sun, 24 Mar 2019 08:08:54 GMT

I have same problems. Who can help me?

Re: Moving some connections to the New PA

MP18 — Sun, 24 Mar 2019 17:26:43 GMT

Seems best way to do is

create vwire for both uplink connections.

here we will have 2 pair of vwires- Vwire INT and Vwire EXT

Two Zones trust and untrust

PA will pass all the LAG traffic to dis switch from both zone trust zones.

As PA is passing traffic from both source interfaces of trust Zone and allowing return traffic from 2 dis switches we need to enable the option where PA allows asymm traffic

set deviceconfig setting tcp asymmetric-path bypass
# set deviceconfig setting session tcp-reject-non-syn no

Re: Moving some connections to the New PA

MP18 — Sat, 06 Apr 2019 21:45:22 GMT

did the vwire setup and it worked great.

Re: Moving some connections to the New PA

PravinSingi — Mon, 10 Jul 2023 06:53:06 GMT

set deviceconfig setting tcp asymmetric-path bypass

This helped me with a similar setup today. Thanks for sharing this!