- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-21-2019 06:05 PM
We have this setup for one site
------Dis sw--------------Edge switch stack of 3 ----------40 users
we need to move few users behind the PA .
what can be best design for this as we only need to have 5 to 10 users behind the PA 850.?
Should we connect small switch to the existing stack of switch ?
03-22-2019 01:44 PM
If you only have a single connection to use on the PA you would be looking at doing a network TAP, which has limited capabilities, so I would really recommend the vwire setup if you want to do that.
03-24-2019 10:22 AM - edited 03-24-2019 10:26 AM
Seems best way to do is
create vwire for both uplink connections.
here we will have 2 pair of vwires- Vwire INT and Vwire EXT
Two Zones trust and untrust
PA will pass all the LAG traffic to dis switch from both zone trust zones.
As PA is passing traffic from both source interfaces of trust Zone and allowing return traffic from 2 dis switches we need to enable the option where PA allows asymm traffic
set deviceconfig setting tcp asymmetric-path bypass
# set deviceconfig setting session tcp-reject-non-syn no
03-21-2019 07:30 PM
Hello,
How about a vlan and/or a subnet that routes via the PAN?
I'm sure there are many different options. I would also love to hear what the community has to say.
Regards,
03-22-2019 11:52 AM
@MP18 ,
A dedicated VLAN that routes through the PA would be what I would do, as it doesn't require any additional hardware and should be easy to maintain and update. It also doesn't require that you have someone on-site to migrate connections over to the new switch, you simply update the port configuration and assign it to the new VLAN.
03-22-2019 12:23 PM
can we put this PA in vwire mode between the switches?
curently edge switch has 2 upliks that go to dis switch.
for the vwire to work it work in pairs
can i work with single connection for send and receive traffic?
03-22-2019 01:33 PM
Hello,
Can you provide a basic diagram? Somthing like:
switch-->router-->PAN
Please advise,
03-22-2019 01:44 PM
If you only have a single connection to use on the PA you would be looking at doing a network TAP, which has limited capabilities, so I would really recommend the vwire setup if you want to do that.
03-22-2019 02:04 PM
But for Vwire I will need to set of cables right but in current setup it is not possible right?
here is diagram attached
03-22-2019 02:06 PM
how can i add visio or pdf diagram ?
system does not allow me
03-22-2019 02:10 PM
scrren shot of diagram
03-22-2019 03:01 PM
Hello,
Where is the PAN located in the diagram or is that your question?
Please advies,
03-23-2019 07:59 AM
PAN will come between the edge switches and Dis switch.
03-23-2019 09:12 AM
I have attached the diagram.
PA will be in between edge and dis switch.
Currenly edge switch only has 1 layer 3 interface which is for sw management access.
config on switch
ip static-route 0.0.0.0/0 gateway 10.10.230.50-------------------------management network
10.10.230.x has vlan interface 3100
Edge switch has trunk interface with link agg to dis switch carrying below vlans
show 802.1q 1
Tagged VLANS Internal Description
-------------+------------------------------------------+
851 Raw 192.168.200.0
3100 mgmt-subnet 10.10.230.0
3203 corp-data-subnet 10.63.24.0
3303 voice-subnet 10.63.26.0
3403 corp-video-subnet 10.63.25.0
what config i will need on PA to allow traffic from edge switch to dis switch carrying trunk port with lacp?
03-24-2019 01:08 AM
I have same problems. Who can help me?
03-24-2019 10:22 AM - edited 03-24-2019 10:26 AM
Seems best way to do is
create vwire for both uplink connections.
here we will have 2 pair of vwires- Vwire INT and Vwire EXT
Two Zones trust and untrust
PA will pass all the LAG traffic to dis switch from both zone trust zones.
As PA is passing traffic from both source interfaces of trust Zone and allowing return traffic from 2 dis switches we need to enable the option where PA allows asymm traffic
set deviceconfig setting tcp asymmetric-path bypass
# set deviceconfig setting session tcp-reject-non-syn no
04-06-2019 02:45 PM
did the vwire setup and it worked great.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!