Data Center Configuration Guide

Data Center
Configuration Guide
Revision: H2CY10
The Purpose of this Guide
This guide is a companion document to the Cisco Smart Business • Gain additional storage capacity for their servers
Architecture (SBA) for Government Midsize Agencies—Data Center • Improve server utilization with virtual servers
Deployment Guide and should be used
as such. • Ensure availability of applications
In this document, you will find the specific configuration files from our lab to • Consolidate and virtualize storage and servers
support you during deployment. • Deploy a Business Continuance/Disaster Recovery Data Center solution
It provides engineers step-by-step instructions to deploy the solutions in the
SBA Data Center design. Because Cisco is delivering a modular architec- Related Documents
ture, you can deploy exactly what you need quickly and efficiently.
Before reviewing this guide
Who Should Read This Guide
This guide is intended for the reader who has any or all of the following: Design Overview
• Already read the SBA for Midsize Agencies— Borderless Networks
Foundation Deployment Guide
• An existing server room and is looking to solve agency problems that Data Center Deployment Guide
require technologies more typically found in a Data Center
• iSCSI and/or Fibre Channel for Storage
Advanced Server Load Balancing
The intended reader of this document will be ready to:
• Increase their compute capacity from the Server Room design
• Expand from a few dozen servers to a combination of virtual and physical Design Overview
servers up to 250 servers
Design Guides Deployment Guides Supplemental Guides
Design Overview
Data Center Advanced Server
Deployment Guide Load Balancing
Data Center You are Here

Configuration Guide
Network Management
Guides
The Purpose of this Guide

Table of Contents
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Resilient WAN Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

ISR 3845 Primary Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Ethernet Data Center Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Cisco 3750G. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 ISR 3925 Disaster Recovery Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Nexus 5K Primary Data Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 ISR 2811 Branch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Fibre Channel Data Center Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Resilient WAN Optimization Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

MDS 9124 Primary Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 WAAS WAVE 274 Central Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
MDS 9124 Disaster Recovery Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 WAAS WAVE 574 DC Application Accelerator. . . . . . . . . . . . . . . . . . . . . . . . . . 51
MDS 9134 Primary Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 NME-WAE 502 Branch Application Accelerator. . . . . . . . . . . . . . . . . . . . . . . . 62
MDS 9134 Disaster Recovery Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Resilient Server Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Application Control Engine 4710 Primary Data Center . . . . . . . . . . . . . . . . . 73
Security Data Center Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
ASA 5540 Primary Data Center (Device A). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Appendix A:
ASA 5540 Primary Data Center (Device B). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Data Center for Midsize Agencies Product List. . . . . . . . . . . . . . . . . . . . . . . . . . . 74
ASA 5580 Disaster Recovery Data Center (Device B). . . . . . . . . . . . . . . . . . 33 Appendix B:
SSM-40 Primary Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 SBA for Midsize Agencies Document System. . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
IDS/IPS 4260 Primary Data Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
IDS/IPS 4260 Disaster Recovery Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . 39
ALL DESIGNS, SPECIFICATIONS, STATEMENTS, INFORMATION, AND RECOMMENDATIONS (COLLECTIVELY, "DESIGNS") IN THIS MANUAL ARE PRESENTED "AS IS," WITH ALL FAULTS. CISCO AND ITS SUPPLIERS
DISCLAIM ALL WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITA-
TION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THE DESIGNS, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES. THE DESIGNS ARE SUBJECT TO CHANGE WITHOUT NOTICE. USERS ARE SOLELY RESPONSIBLE FOR THEIR APPLICATION OF THE DESIGNS. THE DESIGNS DO NOT CONSTITUTE THE TECHNICAL
OR OTHER PROFESSIONAL ADVICE OF CISCO, ITS SUPPLIERS OR PARTNERS. USERS SHOULD CONSULT THEIR OWN TECHNICAL ADVISORS BEFORE IMPLEMENTING THE DESIGNS. RESULTS MAY VARY
DEPENDING ON FACTORS NOT TESTED BY CISCO.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes
only. Any use of actual IP addresses in illustrative content is unintentional and coincidental. Cisco Unified Communications SRND (Based on Cisco Unified Communications Manager 7.x)
© 2010 Cisco Systems, Inc. All rights reserved.
Table of Contents
Introduction
For Cisco partners and customers whose server farm will have a combined The following configuration files are provided:
total of up to 250 physical and virtual servers, Cisco has created a network • Ethernet Data Center Design
architecture that is simple, fast to deploy, affordable, scalable, and flexible.
At the same time, it is easy to install, configure, and manage. • Fibre Channel Data Center Design
The deployment has been architected to make your life a little bit, maybe • Security Data Center Design
even a lot, easier by: • Resilient WAN Design
• Providing a solid foundation • Resilient WAN Optimization Design
• Making deployment fast and easy • Resilient Server Design
• Avoiding the need for reengineering of the core network Refer to the Appendix for a complete list of products used in the lab testing
By taking advantage of the foundation architecture you’ve already deployed, of this design.
the SBA Data Center lets you add 50 or 250 servers, or a Disaster Recovery
site, without wasting time and expense reconfiguring the existing Network
Foundation. Tech Tip
Within the Cisco SBA for Midsize Agencies—Borderless Networks
Foundation Deployment Guide, the Server Room module accommodates up
to 24 physical servers. That design provides basic computing and storage The actual settings and values will depend on your current network
capability for agency operations. This guide describes a data center that configuration. Please review all settings and configuration changes
can easily replace the server room in the SBA for Midsize Agencies founda- before submitting them.
tion architecture, for more advanced agency operations and applications.
This will provide an architecture designed to accommodate growth of the
server farm up to 250 physical or virtual servers. Figure 1 depicts the architecture that will be in place if you deploy all of the
modules in the Data Center design.
Introduction 1
Figure 1. Data Center for Midsize Agencies Design
Ethernet Data Center Design 2

Ethernet Data
!
mls qos map cos-dscp 0 8 16 24 32 46 48 56
mls qos srr-queue input bandwidth 90 10
Center Design mls qos srr-queue input threshold 1 8 16

mls qos srr-queue input threshold 2 34 66
mls qos srr-queue input buffers 67 33
mls qos srr-queue input cos-map queue 1 threshold 2 1
mls qos srr-queue input cos-map queue 2 threshold 2 4 6 7
Cisco 3750G mls qos srr-queue input cos-map queue 2 threshold 3 3 5
mls qos srr-queue input dscp-map queue 1 threshold 2 9 10 11
Current configuration : 20951 bytes
12 13 14 15
! mls qos srr-queue input dscp-map queue 1 threshold 3 0 1 2 3 4
! Last configuration change at 16:21:35 UTC Thu Oct 8 2009 5 6 7
! NVRAM config last updated at 11:11:55 UTC Thu Aug 27 2009 mls qos srr-queue input dscp-map queue 1 threshold 3 32
! mls qos srr-queue input dscp-map queue 2 threshold 1 16 17 18
version 12.2 19 20 21 22 23
no service pad mls qos srr-queue input dscp-map queue 2 threshold 2 33 34 35
service timestamps debug uptime 36 37 38 39 48
service timestamps log datetime localtime mls qos srr-queue input dscp-map queue 2 threshold 2 49 50 51
no service password-encryption 52 53 54 55 56
hostname DC3750G1 60 61 62 63
boot-start-marker 27 28 29 30 31
boot-end-marker mls qos srr-queue input dscp-map queue 2 threshold 3 40 41 42
! 43 44 45 46 47
enable secret 5 ********** mls qos srr-queue output cos-map queue 1 threshold 3 5
! mls qos srr-queue output cos-map queue 2 threshold 3 3 6 7
username ********** privilege 15 password 0 ********** mls qos srr-queue output cos-map queue 3 threshold 3 2 4
no aaa new-model mls qos srr-queue output cos-map queue 4 threshold 2 1
clock timezone UTC -8 mls qos srr-queue output cos-map queue 4 threshold 3 0
clock summer-time UTC recurring mls qos srr-queue output dscp-map queue 1 threshold 3 40 41 42
switch 1 provision ws-c3750g-24ts 43 44 45 46 47
switch 2 provision ws-c3750g-24ts mls qos srr-queue output dscp-map queue 2 threshold 3 24 25 26
switch 3 provision ws-c3750g-24ps 27 28 29 30 31
system mtu routing 1500 mls qos srr-queue output dscp-map queue 2 threshold 3 48 49 50
vtp domain CiscoMilpitas 51 52 53 54 55
vtp mode transparent mls qos srr-queue output dscp-map queue 2 threshold 3 56 57 58
udld aggressive 59 60 61 62 63
ip subnet-zero mls qos srr-queue output dscp-map queue 3 threshold 3 16 17 18
ip domain-name cisco.local 19 20 21 22 23
ip name-server 192.168.28.10 mls qos srr-queue output dscp-map queue 3 threshold 3 32 33 34
! 35 36 37 38 39
! mls qos srr-queue output dscp-map queue 4 threshold 1 8

mls qos srr-queue output dscp-map queue 4 threshold 2 9 10 11 551D1104 18301682 14444333 37353047 312E6369 73636F2E 6C6F6361
12 13 14 15 6C301F06
mls qos srr-queue output dscp-map queue 4 threshold 3 0 1 2 3 03551D23 04183016 8014B78E D77E4ADA F09EAD5C 5EEBAD56 ACD92C13
4 5 6 7 3C6A301D
mls qos queue-set output 1 threshold 1 138 138 92 138 0603551D 0E041604 14B78ED7 7E4ADAF0 9EAD5C5E EBAD56AC D92C133C
mls qos queue-set output 1 threshold 2 138 138 92 400 6A300D06
mls qos queue-set output 1 threshold 3 36 77 100 318 092A8648 86F70D01 01040500 03818100 9539CC54 6C646A9E 4A0F03BF
mls qos queue-set output 1 threshold 4 20 50 67 400 B5B3C593
mls qos queue-set output 2 threshold 1 149 149 100 149 72E4F77E 8C1A8074 1DD8C9B2 CE7B2E41 3A7B4262 BEE498E5 95CDF7AA
mls qos queue-set output 2 threshold 2 118 118 100 235 FDE72205
mls qos queue-set output 2 threshold 3 41 68 100 272 3DCD3C19 B1E4F1A5 FDEBF2EC A16F2569 97A872C5 9B8E63B1 FF6A9402
mls qos queue-set output 2 threshold 4 42 72 100 242 60E4E53D
mls qos queue-set output 1 buffers 10 10 26 54 ED8EEE31 24FAA354 C6E0A91A 110BD790 ED4CD3E9 410CE7AF 7F0F6FDE
mls qos queue-set output 2 buffers 16 6 17 61 104F4833
mls qos BA9AE7B1 39585257 1615560B 660AC6A8
! quit
crypto pki trustpoint TP-self-signed-2046566272 !
enrollment selfsigned !
subject-name cn=IOS-Self-Signed-Certificate-2046566272 !
revocation-check none errdisable recovery interval 120
rsakeypair TP-self-signed-2046566272 !
! !
! spanning-tree mode pvst
crypto pki certificate chain TP-self-signed-2046566272 spanning-tree etherchannel guard misconfig
certificate self-signed 01 spanning-tree extend system-id
3082024C 308201B5 A0030201 02020101 300D0609 2A864886 F70D0101 !
04050030 vlan internal allocation policy ascending
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D !
43657274 vlan 24-27,32-35
69666963 6174652D 32303436 35363632 3732301E 170D3039 30373239 !
31383135 ip ftp username **********
33345A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 ip ftp password **********
03132649 ip ssh version 2
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 !
30343635 !
36363237 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 !
81890281 interface Port-channel1
8100C0FD 44BE7255 0D6F9F17 90B76B85 A995BB8C 799ACE9B 1F44CF63 switchport trunk encapsulation dot1q
18969114 switchport trunk allowed vlan 1,24-27
5917DCCA CAC77CAA BEFBF6FB 5B30E129 13D1B708 33377BAB A97EB341 switchport mode trunk
8E76B181 !
914D581C 54722222 5ADE0F18 31680882 2BEE2553 47E65773 2D15C3EC interface Port-channel11
079DFDCD switchport trunk encapsulation dot1q
4B0ADB83 D209F7D6 8F263D0C 845CA298 19704925 52F59B2C 4AA95738 switchport trunk allowed vlan 24,25
2D0B8013 switchport mode trunk
49F70203 010001A3 74307230 0F060355 1D130101 FF040530 030101FF switchport nonegotiate
301F0603 !

interface Port-channel12 srr-queue bandwidth share 10 10 60 20
switchport trunk encapsulation dot1q queue-set 2
switchport trunk allowed vlan 24,25 priority-queue out
switchport mode trunk mls qos trust cos
switchport nonegotiate auto qos voip trust
! flowcontrol receive on
interface GigabitEthernet1/0/1 spanning-tree portfast
switchport trunk encapsulation dot1q spanning-tree bpduguard enable
switchport trunk allowed vlan 24,25 !
switchport mode trunk interface GigabitEthernet1/0/6
switchport nonegotiate switchport access vlan 24
load-interval 30 switchport mode access
channel-group 11 mode on srr-queue bandwidth share 10 10 60 20
spanning-tree portfast trunk queue-set 2
! priority-queue out
interface GigabitEthernet1/0/2 mls qos trust cos
switchport trunk encapsulation dot1q auto qos voip trust
switchport trunk allowed vlan 24,25 spanning-tree portfast
switchport mode trunk spanning-tree bpduguard enable
switchport nonegotiate !
load-interval 30 interface GigabitEthernet1/0/7
shutdown switchport access vlan 24
channel-group 12 mode on switchport mode access
spanning-tree portfast trunk srr-queue bandwidth share 10 10 60 20
! queue-set 2
interface GigabitEthernet1/0/3 priority-queue out
switchport trunk encapsulation dot1q mls qos trust cos
switchport trunk allowed vlan 24,25 auto qos voip trust
switchport mode trunk spanning-tree portfast
switchport nonegotiate spanning-tree bpduguard enable
load-interval 30 !
channel-group 11 mode on interface GigabitEthernet1/0/8
spanning-tree portfast trunk switchport access vlan 24
! switchport mode access
interface GigabitEthernet1/0/4 srr-queue bandwidth share 10 10 60 20
switchport trunk encapsulation dot1q queue-set 2
switchport trunk allowed vlan 24,25 priority-queue out
switchport mode trunk mls qos trust cos
switchport nonegotiate auto qos voip trust
load-interval 30 spanning-tree portfast
shutdown spanning-tree bpduguard enable
channel-group 12 mode on !
spanning-tree portfast trunk interface GigabitEthernet1/0/9
! switchport access vlan 24
interface GigabitEthernet1/0/5 switchport mode access
switchport access vlan 24 srr-queue bandwidth share 10 10 60 20
switchport mode access queue-set 2

priority-queue out spanning-tree portfast
mls qos trust cos spanning-tree bpduguard enable
auto qos voip trust !
spanning-tree portfast interface GigabitEthernet1/0/14
spanning-tree bpduguard enable switchport access vlan 25
switchport access vlan 24 queue-set 2
switchport mode access priority-queue out
srr-queue bandwidth share 10 10 60 20 mls qos trust cos
queue-set 2 auto qos voip trust

spanning-tree bpduguard enable shutdown
! !
interface GigabitEthernet1/0/21 interface GigabitEthernet1/0/26
switchport access vlan 25 shutdown
switchport mode access !
srr-queue bandwidth share 10 10 60 20 interface GigabitEthernet1/0/27
queue-set 2 switchport trunk encapsulation dot1q
priority-queue out switchport trunk allowed vlan 1,24-27
mls qos trust cos switchport mode trunk
auto qos voip trust mls qos trust dscp
spanning-tree portfast channel-group 1 mode on
spanning-tree bpduguard enable spanning-tree link-type point-to-point
! !
switchport access vlan 25 switchport trunk encapsulation dot1q
switchport mode access switchport trunk allowed vlan 1,24-27

switchport mode trunk queue-set 2
mls qos trust dscp priority-queue out
channel-group 1 mode on mls qos trust cos
spanning-tree link-type point-to-point auto qos voip trust
! spanning-tree portfast
interface GigabitEthernet2/0/1 spanning-tree bpduguard enable
switchport trunk encapsulation dot1q !
switchport trunk allowed vlan 24,25 interface GigabitEthernet2/0/6
switchport mode trunk switchport access vlan 24
switchport nonegotiate switchport mode access
load-interval 30 srr-queue bandwidth share 10 10 60 20
shutdown queue-set 2
channel-group 11 mode on priority-queue out
spanning-tree portfast trunk mls qos trust cos
! auto qos voip trust
interface GigabitEthernet2/0/2 spanning-tree portfast
switchport trunk encapsulation dot1q spanning-tree bpduguard enable
switchport trunk allowed vlan 24,25 !
switchport mode trunk interface GigabitEthernet2/0/7
switchport nonegotiate switchport access vlan 24
load-interval 30 switchport mode access
channel-group 12 mode on srr-queue bandwidth share 10 10 60 20
spanning-tree portfast trunk queue-set 2
! priority-queue out
interface GigabitEthernet2/0/3 mls qos trust cos
switchport trunk encapsulation dot1q auto qos voip trust
switchport trunk allowed vlan 24,25 spanning-tree portfast
switchport mode trunk spanning-tree bpduguard enable
switchport nonegotiate !
load-interval 30 interface GigabitEthernet2/0/8
shutdown switchport access vlan 24
channel-group 11 mode on switchport mode access
spanning-tree portfast trunk srr-queue bandwidth share 10 10 60 20
! queue-set 2
interface GigabitEthernet2/0/4 priority-queue out
switchport trunk encapsulation dot1q mls qos trust cos
switchport trunk allowed vlan 24,25 auto qos voip trust
switchport mode trunk spanning-tree portfast
switchport nonegotiate spanning-tree bpduguard enable
load-interval 30 !
channel-group 12 mode on interface GigabitEthernet2/0/9
spanning-tree portfast trunk switchport access vlan 24

auto qos voip trust interface GigabitEthernet2/0/14
spanning-tree portfast switchport access vlan 25
spanning-tree bpduguard enable switchport mode access
! srr-queue bandwidth share 10 10 60 20
interface GigabitEthernet2/0/10 queue-set 2
switchport access vlan 24 priority-queue out
switchport mode access mls qos trust cos
srr-queue bandwidth share 10 10 60 20 auto qos voip trust
queue-set 2 spanning-tree portfast
priority-queue out spanning-tree bpduguard enable
mls qos trust cos !
mls qos trust cos !
mls qos trust cos !
mls qos trust cos !

spanning-tree bpduguard enable shutdown
! !
switchport access vlan 25 shutdown
switchport mode access !
srr-queue bandwidth share 10 10 60 20 interface GigabitEthernet2/0/27
queue-set 2 switchport trunk encapsulation dot1q
priority-queue out switchport trunk allowed vlan 1,24-27
mls qos trust cos switchport mode trunk
auto qos voip trust mls qos trust dscp
spanning-tree portfast channel-group 1 mode on
spanning-tree bpduguard enable spanning-tree link-type point-to-point
! !
switchport access vlan 25 switchport trunk encapsulation dot1q
switchport mode access switchport trunk allowed vlan 1,24-27
srr-queue bandwidth share 10 10 60 20 switchport mode trunk
queue-set 2 mls qos trust dscp
priority-queue out channel-group 1 mode on
mls qos trust cos spanning-tree link-type point-to-point

! !
! switchport trunk encapsulation dot1q
interface GigabitEthernet3/0/2 switchport trunk allowed vlan 1,24-27
! switchport mode trunk
interface GigabitEthernet3/0/3 mls qos trust dscp
! channel-group 1 mode on
interface GigabitEthernet3/0/4 spanning-tree link-type point-to-point
! !
! !
! !
! !
interface GigabitEthernet3/0/17 interface Vlan1
! ip address 192.168.1.34 255.255.255.0
interface GigabitEthernet3/0/18 !
! ip default-gateway 192.168.1.1
interface GigabitEthernet3/0/19 ip classless
! ip http server
interface GigabitEthernet3/0/20 ip http secure-server
! !
! !
interface GigabitEthernet3/0/22 snmp-server community cisco RO
! snmp-server community cisco123 RW
! control-plane

! vlan 156
line con 0 name Control
line vty 0 4 vlan 157
login local name Packet
transport input all interface Ethernet1/1
line vty 5 15 switchport mode trunk
login local switchport trunk native vlan 153
transport input all switchport trunk allowed vlan 153
! speed 1000
ntp clock-period 36029191 channel-group 1 mode active
ntp server 192.168.31.2 interface Ethernet1/2
end interface Ethernet1/3
interface Ethernet1/4
interface Ethernet1/5
Nexus 5K Primary Data Center interface Ethernet1/6
version 4.1(3)N1(1) interface Ethernet1/7
feature telnet interface Ethernet1/8
cfs eth distribute interface Ethernet1/9
feature private-vlan interface Ethernet1/10
feature udld interface Ethernet1/11
feature interface-vlan interface Ethernet1/12
feature lacp interface Ethernet1/13
feature vpc switchport mode fex-fabric
vpc domain 10 fex associate 102
role priority 16000 channel-group 102
peer-keepalive destination 192.168.128.9 source 192.168.128.8 interface Ethernet1/14
feature fex interface Ethernet1/15
username ********** password 5 ********** role network-admin switchport mode fex-fabric
no password strength-check fex associate 100
ip domain-lookup channel-group 100
ip host Nexus5010A 192.168.128.8 interface Ethernet1/16
hostname Nexus5010A switchport mode fex-fabric
fex 100 fex associate 100
pinning max-links 1 channel-group 100
description FEX0100 interface Ethernet1/17
type “Nexus 2148T” switchport mode trunk
fex 102 switchport trunk native vlan 152
pinning max-links 1 switchport trunk allowed vlan 152-157
description FEX0102 channel-group 10 mode active
type “Nexus 2148T” interface Ethernet1/18
snmp-server user admin network-admin auth switchport mode trunk
md5 0xef65043f3ca28c5ca2243c7127825afb priv switchport trunk native vlan 152
0xef65043f3ca28c5ca2243c7127825afb localizedkey switchport trunk allowed vlan 152-157
snmp-server community cisco group network-operator channel-group 10 mode active
vrf context management interface Ethernet1/19
ip route 0.0.0.0/0 192.168.128.1 interface Ethernet1/20
vlan 1,152-155 switchport mode trunk

switchport trunk native vlan 152 ip address 192.168.128.8/24
switchport trunk allowed vlan 152-157 interface Ethernet100/1/1
channel-group 60 mode active description esx-12-vmnic6_system_uplink
interface Vlan1 switchport mode trunk
interface port-channel1 switchport trunk allowed vlan 153,156-157
switchport mode trunk spanning-tree port type edge
switchport trunk native vlan 153 channel-group 200
switchport trunk allowed vlan 153 interface Ethernet100/1/2
vpc 1 description esx-13-vmnic6-system-uplink
spanning-tree port type normal switchport mode trunk
speed 1000 switchport trunk allowed vlan 153,156-157
interface port-channel10 spanning-tree port type edge
switchport mode trunk channel-group 201
switchport trunk native vlan 152 interface Ethernet100/1/3
switchport trunk allowed vlan 152-157 switchport access vlan 152
vpc peer-link spanning-tree port type edge
spanning-tree port type network interface Ethernet100/1/4
interface port-channel60 switchport access vlan 152
switchport trunk native vlan 152 interface Ethernet100/1/5
switchport trunk allowed vlan 152-157 switchport access vlan 152
vpc 60 spanning-tree port type edge
spanning-tree port type network interface Ethernet100/1/6
switchport mode fex-fabric spanning-tree port type edge
fex associate 100 interface Ethernet100/1/7
switchport mode fex-fabric spanning-tree port type edge
vpc 102 interface Ethernet100/1/8
fex associate 102 switchport access vlan 152
speed 10000 spanning-tree port type edge
interface port-channel200 interface Ethernet100/1/9
switchport trunk allowed vlan 153,156-157 spanning-tree port type edge
switchport trunk allowed vlan 153,156-157 interface Ethernet100/1/11
vpc 201 switchport access vlan 152
interface port-channel202 spanning-tree port type edge
switchport mode trunk interface Ethernet100/1/12
switchport trunk allowed vlan 152 switchport access vlan 152
switchport trunk allowed vlan 152 spanning-tree port type edge
interface port-channel204 switchport mode trunk
interface mgmt0 switchport trunk allowed vlan 152

spanning-tree port type edge interface Ethernet100/1/38
channel-group 202 interface Ethernet100/1/39
interface Ethernet100/1/15 interface Ethernet100/1/40
switchport trunk allowed vlan 152 interface Ethernet100/1/42
switchport access vlan 153 interface Ethernet100/1/46
spanning-tree port type edge switchport access vlan 152
interface Ethernet100/1/18 spanning-tree port type edge
interface Ethernet100/1/27 switchport access vlan 152

switchport access vlan 153 line console
spanning-tree port type edge boot kickstart bootflash:/n5000-uk9-kickstart.4.1.3.N1.0.130a.
interface Ethernet102/1/18 bin
switchport access vlan 153 boot system bootflash:/n5000-uk9.4.0.1a.N2.1.bin
spanning-tree port type edge boot system bootflash:/n5000-uk9.4.1.3.N1.0.130a.bin
interface Ethernet102/1/19
switchport access vlan 153 Nexus 5K Disaster Recovery Data Center
spanning-tree port type edge version 4.1(3)N1(1)
interface Ethernet102/1/20 feature telnet
switchport access vlan 153 cfs eth distribute
spanning-tree port type edge feature private-vlan
interface Ethernet102/1/21 feature udld
switchport access vlan 153 feature interface-vlan
spanning-tree port type edge feature lacp
interface Ethernet102/1/22 feature vpc
switchport access vlan 153 vpc domain 10
spanning-tree port type edge role priority 24000
interface Ethernet102/1/23 peer-keepalive destination 192.168.128.8 source 192.168.128.9
switchport access vlan 153 feature fex
spanning-tree port type edge username ********** password 5 ********** role network-admin
interface Ethernet102/1/24 no password strength-check
switchport access vlan 153 ip domain-lookup
spanning-tree port type edge ip host Nexus5010B 192.168.128.9
interface Ethernet102/1/25 hostname Nexus5010B
interface Ethernet102/1/26 fex 101
interface Ethernet102/1/27 pinning max-links 1
interface Ethernet102/1/28 description FEX0101
interface Ethernet102/1/29 type “Nexus 2148T”
interface Ethernet102/1/30 fex 102
interface Ethernet102/1/31 pinning max-links 1
interface Ethernet102/1/32 description FEX0102
interface Ethernet102/1/33 type “Nexus 2148T”

snmp-server user admin network-admin auth switchport mode trunk
md5 0xec8d3637cc0ccd8f37f3d67cb66154ec priv switchport trunk native vlan 152
0xec8d3637cc0ccd8f37f3d67cb66154ec localizedkey switchport trunk allowed vlan 152-157
snmp-server community cisco group network-operator channel-group 10 mode active
vrf context management interface Ethernet1/19
ip route 0.0.0.0/0 192.168.128.1 interface Ethernet1/20
vlan 1,152-155 switchport mode trunk
vlan 156 switchport trunk native vlan 152
name Control switchport trunk allowed vlan 152-157
vlan 157 channel-group 60 mode active
name Packet interface Vlan1
interface Ethernet1/1 interface port-channel1
switchport mode trunk switchport mode trunk
switchport trunk native vlan 153 switchport trunk native vlan 153
switchport trunk allowed vlan 153 switchport trunk allowed vlan 153
speed 1000 vpc 1
channel-group 1 mode active spanning-tree port type normal
interface Ethernet1/2 speed 1000
interface Ethernet1/4 switchport mode trunk
interface Ethernet1/5 switchport trunk native vlan 152
interface Ethernet1/6 switchport trunk allowed vlan 152-157
interface Ethernet1/7 vpc peer-link
interface Ethernet1/8 spanning-tree port type network
interface Ethernet1/10 switchport mode trunk
interface Ethernet1/11 switchport trunk native vlan 152
interface Ethernet1/12 switchport trunk allowed vlan 152-157
interface Ethernet1/13 vpc 60
switchport mode fex-fabric spanning-tree port type network
fex associate 102 interface port-channel101
channel-group 102 switchport mode fex-fabric
interface Ethernet1/14 fex associate 101
switchport mode fex-fabric switchport mode fex-fabric
fex associate 101 vpc 102
channel-group 101 fex associate 102
interface Ethernet1/16 speed 10000
switchport mode fex-fabric interface port-channel200
fex associate 101 switchport mode trunk
channel-group 101 switchport trunk allowed vlan 153,156-157
interface Ethernet1/17 vpc 200
switchport mode trunk interface port-channel201
switchport trunk native vlan 152 switchport mode trunk
switchport trunk allowed vlan 152-157 switchport trunk allowed vlan 153,156-157
channel-group 10 mode active vpc 201

switchport trunk allowed vlan 152 switchport access vlan 152
switchport mode trunk switchport mode trunk
switchport trunk allowed vlan 152 switchport trunk allowed vlan 152
interface port-channel204 channel-group 202
interface mgmt0 interface Ethernet101/1/14
ip address 192.168.128.9/24 switchport access vlan 153
switchport trunk allowed vlan 153,156-157 description ESX-13-vmnic2_VM_Uplink
spanning-tree port type edge switchport mode trunk
channel-group 200 switchport trunk allowed vlan 152
description ESX-13-vmnic4_System_Uplink channel-group 203
switchport trunk allowed vlan 153,156-157 switchport access vlan 153
spanning-tree port type edge spanning-tree port type edge
switchport access vlan 152 spanning-tree port type edge


line console
boot kickstart bootflash:/n5000-uk9-kickstart.4.1.3.N1.0.130a.
bin
boot system bootflash:/n5000-uk9.4.1.3.N1.0.130a.bin
Fibre Channel Data Center Design 19

Fibre Channel Data
vsan 4 wwn 20:01:00:24:e8:64:c5:62 fcid 0x530200 dynamic
! [esx3-hba1-a]
vsan 4 wwn 20:01:00:24:e8:64:c5:d7 fcid 0x530300 dynamic
Center Design ! [esx4-hba0-a]

vsan 4 wwn 20:01:00:24:e8:64:c5:7c fcid 0x530400 dynamic
! [esx-5-hba-a]
vsan 4 wwn 20:01:00:24:e8:64:c5:6f fcid 0x530500 dynamic
! [esx4-hba1-a]
vsan database
vsan 4 interface fc1/1
MDS 9124 Primary Data Center vsan 4 interface fc1/2
MDS9124A# sh run vsan 4 interface fc1/3
version 3.3(2) vsan 4 interface fc1/4
vsan database vsan 4 interface fc1/5
vsan 4 name “finance” vsan 4 interface fc1/7
device-alias database interface fc1/1
device-alias name array1-a pwwn 50:06:01:60:3c:e0:60:e2 interface fc1/2
device-alias name esx-5-hba-a pwwn 20:01:00:24:e8:64:c5:7c interface fc1/3
device-alias name esx-6-hba-a pwwn 20:01:00:24:e8:64:c5:e4 interface fc1/4
device-alias name esx3-hba0-a pwwn 20:01:00:24:e8:64:c5:ca interface fc1/5
device-alias name esx3-hba1-a pwwn 20:01:00:24:e8:64:c5:62 interface fc1/6
device-alias name esx4-hba0-a pwwn 20:01:00:24:e8:64:c5:d7 interface fc1/7
device-alias name esx4-hba1-a pwwn 20:01:00:24:e8:64:c5:6f interface fc1/8
device-alias commit interface fc1/9
fcdomain fcid database interface fc1/10
vsan 1 wwn 50:06:01:60:3c:e0:60:e2 fcid 0x7a0000 dynamic interface fc1/11
! [array1-a] interface fc1/12
vsan 1 wwn 20:01:00:24:e8:64:c5:6f fcid 0x7a0100 dynamic interface fc1/13
! [esx4-hba1-a] interface fc1/14
vsan 1 wwn 20:01:00:24:e8:64:c5:62 fcid 0x7a0200 dynamic interface fc1/15
vsan 1 wwn 20:02:00:24:e8:64:c5:ca fcid 0x7a0300 dynamic interface fc1/17
vsan 1 wwn 20:01:00:24:e8:64:c5:d7 fcid 0x7a0400 dynamic interface fc1/18
vsan 1 wwn 20:01:00:24:e8:64:c5:7c fcid 0x7a0500 dynamic interface fc1/20
! [esx-5-hba-a] interface fc1/21
vsan 1 wwn 20:01:00:24:e8:64:c5:e4 fcid 0x7a0600 dynamic interface fc1/22
! [esx3-hba0-a] ip default-gateway 192.168.1.1
vsan 1 wwn 10:00:00:00:c9:8d:a5:26 fcid 0x7a0800 dynamic switchname MDS9124A
vsan 1 wwn 10:00:00:00:c9:8d:a5:0a fcid 0x7a0900 dynamic role name default-role
vsan 1 wwn 10:00:00:00:c9:8d:cc:30 fcid 0x7a0a00 dynamic description This is a system defined role and applies to all
vsan 4 wwn 50:06:01:60:3c:e0:60:e2 fcid 0x530000 dynamic users
! [array1-a] rule 1 permit show feature system
vsan 4 wwn 20:01:00:24:e8:64:c5:ca fcid 0x530100 dynamic rule 2 permit show feature snmp
! [esx3-hba0-a] rule 3 permit show feature module

rule 4 permit show feature hardware interface fc1/1
rule 5 permit show feature environment switchport description array1-a
username ********** password 5 ********** role network-admin port-license acquire
ssh key rsa 2048 force no shutdown
ssh server enable interface fc1/2
boot kickstart bootflash:/m9100-s2ek9-kickstart-mz.3.3.2.bin switchport description esx3-hba0-a
boot system bootflash:/m9100-s2ek9-mz.3.3.2.bin port-license acquire
kernel core target 0.0.0.0 interface fc1/3
kernel core limit 1 switchport description esx3-hba1-a
snmp-server community cisco123 group network-operator port-license acquire
snmp-server user admin network-admin auth md5 interface fc1/4
0x4e15887cba4e4755565604d9d2227d64 switchport description esx4-hba0-a
priv 0x4e15887cba4e4755565604d9d2227d64 localizedkey port-license acquire
snmp-server enable traps license interface fc1/5
callhome switchport description esx4-hba1-a
zoneset activate name ciscozoneset vsan 1 port-license acquire
!Full Zone Database Section for vsan 4 interface fc1/6
zone name esx3-array1-a vsan 4 port-license acquire
member pwwn 20:01:00:24:e8:64:c5:62 interface fc1/7
! [esx3-hba1-a] switchport description esx5-hba-a
member pwwn 20:01:00:24:e8:64:c5:ca port-license acquire
member pwwn 50:06:01:60:3c:e0:60:e2 port-license acquire
! [array1-a] no shutdown
zone name esx4-array1-a vsan 4 interface fc1/9
member pwwn 20:01:00:24:e8:64:c5:6f port-license acquire
! [esx4-hba1-a] no shutdown
member pwwn 20:01:00:24:e8:64:c5:d7 interface fc1/10
! [esx4-hba0-a] port-license acquire
member pwwn 50:06:01:60:3c:e0:60:e2 no shutdown
member pwwn 20:01:00:24:e8:64:c5:7c no shutdown
member pwwn 50:06:01:60:3c:e0:60:e2 interface fc1/14
! [array1-a] port-license acquire
member pwwn 20:01:00:24:e8:64:c5:e4 interface fc1/15
! [esx-6-hba-a] port-license acquire
zoneset name Zoneset1 vsan 4 interface fc1/16
member esx3-array1-a port-license acquire
member esx4-array1-a interface fc1/17
zoneset activate name Zoneset1 vsan 4 interface fc1/20

interface fc1/21 vsan 4 wwn 20:02:00:24:e8:64:c5:d7 fcid 0xb70300 dynamic
interface fc1/22 ! [esx4-hba0-b]
interface fc1/23 vsan 4 wwn 20:02:00:24:e8:64:c5:6f fcid 0xb70400 dynamic
interface fc1/24 ! [esx4-hba1-b]
interface mgmt0 vsan 4 wwn 20:02:00:24:e8:64:c5:7c fcid 0xb70500 dynamic
ip address 192.168.1.50 255.255.255.0 ! [esx-5-hba-b]
no system default switchport shutdown vsan database
scheduler enable vsan 4 interface fc1/1
MDS 9124 Disaster Recovery Data Center vsan 4 interface fc1/4
MDS9124B# sh run vsan 4 interface fc1/5
version 3.3(2) vsan 4 interface fc1/8
vsan database interface fc1/1
vsan 4 name “finance” interface fc1/2
device-alias name array1-b pwwn 50:06:01:68:3c:e0:60:e2 interface fc1/4
device-alias name esx-5-hba-b pwwn 20:02:00:24:e8:64:c5:7c interface fc1/5
device-alias name esx-6-hba-b pwwn 20:02:00:24:e8:64:c5:e4 interface fc1/6
device-alias name esx3-hba0-b pwwn 20:02:00:24:e8:64:c5:ca interface fc1/7
device-alias name esx3-hba1-b pwwn 20:02:00:24:e8:64:c5:62 interface fc1/8
device-alias name esx4-hba0-b pwwn 20:02:00:24:e8:64:c5:d7 interface fc1/9
device-alias name esx4-hba1-b pwwn 20:02:00:24:e8:64:c5:6f interface fc1/10
fcdomain fcid database interface fc1/12
vsan 1 wwn 50:06:01:68:3c:e0:60:e2 fcid 0x2a0000 dynamic interface fc1/13
! [array1-b] interface fc1/14
vsan 1 wwn 20:02:00:24:e8:64:c5:62 fcid 0x2a0100 dynamic interface fc1/15
! [esx3-hba1-b] interface fc1/16
vsan 1 wwn 20:02:00:24:e8:64:c5:6f fcid 0x2a0200 dynamic interface fc1/17
vsan 1 wwn 20:02:00:24:e8:64:c5:d7 fcid 0x2a0400 dynamic interface fc1/20
vsan 1 wwn 20:02:00:24:e8:64:c5:7c fcid 0x2a0500 dynamic interface fc1/22
! [esx-5-hba-b] interface fc1/23
vsan 1 wwn 20:02:00:24:e8:64:c5:e4 fcid 0x2a0600 dynamic interface fc1/24
! [esx-6-hba-b] ip default-gateway 192.168.1.1
vsan 1 wwn 20:02:00:24:e8:64:c5:ca fcid 0x2a0700 dynamic switchname MDS9124B
! [esx3-hba0-b] role name default-role
vsan 1 wwn 10:00:00:00:c9:8d:a5:0b fcid 0x2a0800 dynamic description This is a system defined role and applies to all
vsan 4 wwn 50:06:01:68:3c:e0:60:e2 fcid 0xb70000 dynamic users
! [array1-b] rule 1 permit show feature system
vsan 4 wwn 20:02:00:24:e8:64:c5:ca fcid 0xb70100 dynamic rule 2 permit show feature snmp
! [esx3-hba0-b] rule 3 permit show feature module
vsan 4 wwn 20:02:00:24:e8:64:c5:62 fcid 0xb70200 dynamic rule 4 permit show feature hardware
! [esx3-hba1-b] rule 5 permit show feature environment

username ********** password 5 ********** role network-admin interface fc1/2
ssh key rsa 2048 force switchport description esx3-hba0-b
ssh server enable port-license acquire
boot kickstart bootflash:/m9100-s2ek9-kickstart-mz.3.3.2.bin interface fc1/3
boot system bootflash:/m9100-s2ek9-mz.3.3.2.bin switchport description esx3-hba1-b
kernel core target 0.0.0.0 port-license acquire
kernel core limit 1 interface fc1/4
snmp-server community cisco123 group network-operator switchport description esx4-hba0-b
snmp-server user admin network-admin auth md5 port-license acquire
0x40cbea83c35466f15b51f626419555f6 interface fc1/5
priv 0x40cbea83c35466f15b51f626419555f6 localizedkey switchport description esx4-hba1-b
snmp-server enable traps license port-license acquire
callhome interface fc1/6
!Full Zone Database Section for vsan 4 port-license acquire
zone name esx3-array1-b vsan 4 interface fc1/7
! [array1-b] interface fc1/8
member pwwn 20:02:00:24:e8:64:c5:62 switchport description esx5-hba-b
! [esx3-hba1-b] port-license acquire
member pwwn 20:02:00:24:e8:64:c5:ca interface fc1/9
! [esx3-hba0-a] port-license acquire
zone name esx4-array1-b vsan 4 no shutdown
member pwwn 20:02:00:24:e8:64:c5:6f interface fc1/10
! [esx4-hba1-b] port-license acquire
member pwwn 20:02:00:24:e8:64:c5:d7 no shutdown
! [array1-b] no shutdown
zone name esx5-array1-b vsan 4 interface fc1/12
member pwwn 20:02:00:24:e8:64:c5:7c shutdown
! [esx-5-hba-b] port-license acquire
! [array1-b] shutdown
zone name esx6-array1-b vsan 4 port-license acquire
! [array1-b] shutdown
member pwwn 20:02:00:24:e8:64:c5:e4 port-license acquire
! [esx-6-hba-b] interface fc1/15
zoneset name Zoneset1 vsan 4 shutdown
member esx3-array1-b port-license acquire
member esx4-array1-b interface fc1/16
member esx5-array1-b shutdown
member esx6-array1-b port-license acquire
zoneset activate name Zoneset1 vsan 4 interface fc1/17
interface fc1/1 shutdown
switchport description array1-b no port-license
port-license acquire interface fc1/18

shutdown port 1163
no port-license snmp-server host 192.168.28.250 traps version 2c public udp-
interface fc1/19 port 2162
shutdown snmp-server enable traps license
no port-license snmp-server enable traps entity fru
interface fc1/20 vsan database
shutdown vsan 1 name “lab”
no port-license vsan 2 name “production”
interface fc1/21 vsan 3 name “tape”
shutdown vsan 4 name “finance”
interface fc1/22 device-alias database
shutdown device-alias name array0-a pwwn 50:0a:09:82:89:2a:df:b1
interface fc1/23 device-alias name esx-12-hba0 pwwn 10:00:00:00:c9:87:be:1c
shutdown device-alias name esx-13-hba0 pwwn 10:00:00:00:c9:87:be:2a
interface fc1/24 device-alias commit
shutdown fcdomain fcid database
interface mgmt0 vsan 1 wwn 10:00:00:00:c9:87:be:2a fcid 0xe70000 dynamic
ip address 192.168.1.51 255.255.255.0 ! [esx-13-hba0]
no system default switchport shutdown vsan 1 wwn 50:0a:09:82:89:2a:df:b1 fcid 0xe70100 dynamic
scheduler enable ! [array0-a]
vsan 1 wwn 10:00:00:00:c9:87:be:1c fcid 0xe70200 dynamic
! [esx-12-hba0]
MDS 9134 Primary Data Center vsan 4 wwn 10:00:00:00:c9:87:be:2a fcid 0x830000 dynamic
MDS9134A# sh run ! [esx-13-hba0]
version 4.1(1c) vsan 4 wwn 10:00:00:00:c9:87:be:1c fcid 0x830100 dynamic
role name default-role ! [esx-12-hba0]
description This is a system defined role and applies to all vsan 4 wwn 50:0a:09:82:89:2a:df:b1 fcid 0x830200 dynamic
users. ! [array0-a]
rule 5 permit show feature environment vsan database
rule 4 permit show feature hardware vsan 4 interface fc1/3
rule 3 permit show feature module vsan 4 interface fc1/5
rule 2 permit show feature snmp vsan 4 interface fc1/7
rule 1 permit show feature system interface fc1/1
username ********** password 5 ********** role network-admin shutdown
no password strength-check port-license acquire
feature telnet interface fc1/2
ssh key rsa 2048 shutdown
ip domain-lookup port-license acquire
aaa group server radius radius interface fc1/3
snmp-server user admin network-admin auth md5 switchport description esx-12-hba0
0xbf3d4fd841b437ef078cf5734b829459 port-license acquire
priv 0xbf3d4fd841b437ef078cf5734b829459 localizedkey interface fc1/4
snmp-server host 172.16.211.128 traps version 2c public udp- port-license acquire
port 2162 interface fc1/5
snmp-server host 192.168.152.40 traps version 2c public udp- switchport description esx-13-hba0
port 2162 port-license acquire
snmp-server host 192.168.28.250 traps version 2c public udp- interface fc1/6

interface fc1/7 interface mgmt0
switchport description array0-a ip address 192.168.128.14 255.255.255.0
port-license acquire ip default-gateway 192.168.128.1
interface fc1/8 switchname MDS9134A
port-license acquire boot kickstart bootflash:/m9100-s2ek9-kickstart-mz.4.1.1c.bin
interface fc1/9 boot system bootflash:/m9100-s2ek9-mz.4.1.1c.bin
interface fc1/10 interface fc1/2
interface fc1/28 !Full Zone Database Section for vsan 4
interface fc1/29 zone name esx-13-hba0-array0-a vsan 4
interface fc1/30 member pwwn 10:00:00:00:c9:87:be:2a
interface fc1/31 ! [esx-13-hba0]
interface fc1/32 member pwwn 50:0a:09:82:89:2a:df:b1
interface fc1/33 ! [array0-a]

zone name esx-12-hba0-array0-a vsan 4 vsan 1 wwn 50:0a:09:81:89:2a:df:b1 fcid 0x530000 dynamic
member pwwn 10:00:00:00:c9:87:be:1c ! [array0-b]
! [esx-12-hba0] vsan 1 wwn 10:00:00:00:c9:87:be:2b fcid 0x530100 dynamic
member pwwn 50:0a:09:82:89:2a:df:b1 ! [esx-13-hba1]
! [array0-a] vsan 1 wwn 10:00:00:00:c9:87:be:1d fcid 0x530200 dynamic
zoneset name Zoneset1 vsan 4 ! [esx-12-hba1]
member esx-13-hba0-array0-a vsan 4 wwn 10:00:00:00:c9:87:be:1d fcid 0x6a0000 dynamic
member esx-12-hba0-array0-a ! [esx-12-hba1]
zoneset activate name Zoneset1 vsan 4 vsan 4 wwn 10:00:00:00:c9:87:be:2b fcid 0x6a0100 dynamic
no system default switchport shutdown ! [esx-13-hba1]
vsan 4 wwn 50:0a:09:81:89:2a:df:b1 fcid 0x6a0200 dynamic
! [array0-b]
MDS 9134 Disaster Recovery Data Center vsan database
MDS9134B# sh run vsan 4 interface fc1/3
version 4.1(1c) vsan 4 interface fc1/5
role name default-role vsan 4 interface fc1/7
description This is a system defined role and applies to all interface fc1/1
users. shutdown
rule 5 permit show feature environment port-license acquire
rule 4 permit show feature hardware interface fc1/2
rule 3 permit show feature module shutdown
rule 2 permit show feature snmp port-license acquire
rule 1 permit show feature system interface fc1/3
username ********** password 5 ********** role network-admin switchport description esx-12-hba1
no password strength-check port-license acquire
feature telnet interface fc1/4
ssh key rsa 2048 port-license acquire
ip domain-lookup interface fc1/5
aaa group server radius radius switchport description esx-13-hba1
snmp-server user ********** network-admin auth md5 port-license acquire
0x01feda9c9d00458c847274f06b2ec1a3 interface fc1/6
priv 0x01feda9c9d00458c847274f06b2ec1a3 localizedkey port-license acquire
snmp-server host 192.168.152.40 traps version 2c public udp- interface fc1/7
port 2162 switchport description array0-b
snmp-server enable traps license port-license acquire
snmp-server enable traps entity fru interface fc1/8
vsan database port-license acquire
vsan 1 name “lab” interface fc1/9
vsan 2 name “production” port-license acquire
vsan 3 name “tape” interface fc1/10
vsan 4 name “finance” port-license acquire
device-alias name array0-b pwwn 50:0a:09:81:89:2a:df:b1 port-license acquire
device-alias name esx-12-hba1 pwwn 10:00:00:00:c9:87:be:1d interface fc1/12
device-alias name esx-13-hba1 pwwn 10:00:00:00:c9:87:be:2b port-license acquire
fcdomain fcid database port-license acquire

interface fc1/28 !Full Zone Database Section for vsan 4
interface fc1/29 zone name esx-13-hba0-array0-b vsan 4
interface fc1/30 member pwwn 10:00:00:00:c9:87:be:2b
interface fc1/31 ! [esx-13-hba1]
interface fc1/32 member pwwn 50:0a:09:81:89:2a:df:b1
interface fc1/33 ! [array0-b]
interface fc1/34 zone name esx-12-hba0-array0-b vsan 4
interface mgmt0 member pwwn 10:00:00:00:c9:87:be:1d
ip address 192.168.128.15 255.255.255.0 ! [esx-12-hba1]
ip default-gateway 192.168.128.1 member pwwn 50:0a:09:81:89:2a:df:b1
switchname MDS9134B ! [array0-b]
boot kickstart bootflash:/m9100-s2ek9-kickstart-mz.4.1.1c.bin zoneset name Zoneset1 vsan 4
boot system bootflash:/m9100-s2ek9-mz.4.1.1c.bin member esx-13-hba0-array0-b
interface fc1/1 member esx-12-hba0-array0-b
interface fc1/2 zoneset activate name Zoneset1 vsan 4
interface fc1/3 no system default switchport shutdown
interface fc1/4
interface fc1/5
interface fc1/6
interface fc1/7
interface fc1/8
interface fc1/9
Security Data Center Design 27

Security Data
description LAN/STATE Failover Interface
!
interface GigabitEthernet0/3
Center Design nameif outside

security-level 0
ip address 192.168.31.250 255.255.255.0 standby 192.168.31.249
!
interface Management0/0
nameif management
security-level 100
ASA 5540 Primary Data Center (Device A) management-only
ASA Version 8.0(4) !
! ftp mode passive
hostname ASA5540DC clock timezone PST -8
enable password 2y4FIGBVVyBLau0Q encrypted clock summer-time PDT recurring
passwd 2KFQnbNIdI.2KYOU encrypted object-group network Bypass-Policy
names description Open Policy for Server Access
name 192.168.26.26 BladeWeb1Secure network-object host BladeWeb1Secure
name 192.168.26.0 Secure-Subnets object-group service Mgmt-traffic
name 192.168.31.224 Mgmt-host-range description Address pool service-object tcp eq ssh
for IT users service-object udp eq snmp
! object-group network Application-Servers
interface GigabitEthernet0/0 description HTTP, HTTPS, DNS, and MSExchange
no nameif network-object host BladeWeb1Secure
no security-level network-object host BladeWeb2Secure
no ip address object-group service MS-App-Services
! service-object tcp eq domain
interface GigabitEthernet0/0.26 service-object tcp eq www
vlan 26 service-object tcp eq https
nameif DCVLAN26 service-object tcp eq netbios-ssn
security-level 100 service-object udp eq domain
ip address 192.168.26.1 255.255.255.0 standby 192.168.26.2 service-object udp eq nameserver
! service-object udp eq netbios-dgm
interface GigabitEthernet0/0.27 service-object udp eq netbios-ns
vlan 27 access-list outside_access_in remark Acces from mgmt-host pool
nameif DCVLAN27 to both secure su
security-level 100 bnets via ssh and snmp.
ip address 192.168.27.1 255.255.255.0 standby 192.168.27.2 access-list outside_access_in extended permit ip any object-
! group Bypass-Policy
interface GigabitEthernet0/1 log disable
no nameif access-list outside_access_in remark Acces from mgmt-host pool
no security-level to both secure su
no ip address bnets via ssh and snmp.
! access-list outside_access_in extended permit object-group
interface GigabitEthernet0/2 Mgmt-traffic Mgmt-hos

t-range 255.255.255.224 Secure-Subnets 255.255.254.0 no snmp-server location
access-list outside_access_in extended permit object-group MS- no snmp-server contact
App-Services any o snmp-server community cisco123
bject-group Application-Servers snmp-server enable traps snmp authentication linkup linkdown
pager lines 24 coldstart
logging asdm informational service resetoutside
mtu DCVLAN26 1500 crypto ipsec security-association lifetime seconds 28800
mtu DCVLAN27 1500 crypto ipsec security-association lifetime kilobytes 4608000
mtu outside 1500 telnet timeout 5
mtu management 1500 ssh timeout 5
failover console timeout 0
failover lan unit primary threat-detection basic-threat
failover lan interface failover GigabitEthernet0/2 threat-detection statistics access-list
failover polltime unit msec 200 holdtime msec 800 no threat-detection statistics tcp-intercept
failover polltime interface msec 500 holdtime 5 ntp server 171.68.10.150 source outside prefer
failover key [key] username ********** password ********** encrypted privilege 15
failover replication http !
failover link failover GigabitEthernet0/2 class-map inspection_default
failover interface ip failover 192.168.36.1 255.255.255.252 match default-inspection-traffic
standby 192.168.36.2 !
icmp unreachable rate-limit 1 burst-size 1 !
asdm image disk0:/asdm-615.bin policy-map type inspect dns preset_dns_map
no asdm history enable parameters
arp timeout 14400 message-length maximum 512
access-group outside_access_in in interface outside policy-map global_policy
! class inspection_default
router eigrp 1 inspect dns preset_dns_map
no auto-summary inspect ftp
network Secure-Subnets 255.255.255.0 inspect h323 h225
network 192.168.27.0 255.255.255.0 inspect h323 ras
network 192.168.31.0 255.255.255.0 inspect rsh
passive-interface DCVLAN26 inspect rtsp
passive-interface DCVLAN27 inspect esmtp
! inspect sqlnet
timeout xlate 3:00:00 inspect skinny
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp inspect sunrpc
0:00:02 inspect xdmcp
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 inspect sip
mgcp-pat 0:05:00 inspect netbios
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip- inspect tftp
disconnect 0:02:00 policy-map type inspect dcerpc MSExchange
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute description Access policy for clients to reach Exchange server
dynamic-access-policy-record DfltAccessPolicy parameters
http server enable endpoint-mapper epm-service-only
http 0.0.0.0 0.0.0.0 DCVLAN26 timeout pinhole 0:01:00
http 0.0.0.0 0.0.0.0 outside !
http 0.0.0.0 0.0.0.0 management service-policy global_policy global

prompt hostname context !
Cryptochecksum:4b4c8ccf5bb696e105e08adcfb521d9a interface Management0/0
: end nameif management
security-level 100
ASA 5540 Primary Data Center (Device B) management-only
ASA Version 8.0(4) !
! ftp mode passive
hostname ASA5540DC clock timezone PST -8
enable password 2y4FIGBVVyBLau0Q encrypted clock summer-time PDT recurring
passwd 2KFQnbNIdI.2KYOU encrypted object-group network Bypass-Policy
names description Open Policy for Server Access
name 192.168.26.0 Secure-Subnets object-group service Mgmt-traffic
name 192.168.31.224 Mgmt-host-range description Address pool service-object tcp eq ssh
for IT users service-object udp eq snmp
! object-group network Application-Servers
interface GigabitEthernet0/0 description HTTP, HTTPS, DNS, and MSExchange
no nameif network-object host BladeWeb1Secure
no security-level network-object host BladeWeb2Secure
no ip address object-group service MS-App-Services
! service-object tcp eq domain
interface GigabitEthernet0/0.26 service-object tcp eq www
vlan 26 service-object tcp eq https
nameif DCVLAN26 service-object tcp eq netbios-ssn
security-level 100 service-object udp eq domain
ip address 192.168.26.1 255.255.255.0 standby 192.168.26.2 service-object udp eq nameserver
! service-object udp eq netbios-dgm
interface GigabitEthernet0/0.27 service-object udp eq netbios-ns
vlan 27 access-list outside_access_in remark Acces from mgmt-host pool
nameif DCVLAN27 to both secure subnets via ssh and snmp.
security-level 100 access-list outside_access_in extended permit ip any object-
ip address 192.168.27.1 255.255.255.0 standby 192.168.27.2 group Bypass-Policy
! log disable
interface GigabitEthernet0/1 access-list outside_access_in remark Acces from mgmt-host pool
no nameif to both secure subnets via ssh and snmp.
no security-level access-list outside_access_in extended permit object-group
no ip address Mgmt-traffic Mgmt-host-range 255.255.255.224 Secure-Subnets
! 255.255.254.0
interface GigabitEthernet0/2 access-list outside_access_in extended permit object-group MS-
description LAN/STATE Failover Interface App-Services any object-group Application-Servers
! pager lines 24
interface GigabitEthernet0/3 logging asdm informational
nameif outside mtu DCVLAN26 1500
security-level 0 mtu DCVLAN27 1500
ip address 192.168.31.250 255.255.255.0 standby 192.168.31.249 mtu outside 1500

mtu management 1500 ssh timeout 5
failover console timeout 0
failover lan unit secondary threat-detection basic-threat
failover lan interface failover GigabitEthernet0/2 threat-detection statistics access-list
failover polltime unit msec 200 holdtime msec 800 no threat-detection statistics tcp-intercept
failover polltime interface msec 500 holdtime 5 ntp server 171.68.10.150 source outside prefer
failover key [key] username ********** password ********** encrypted privilege 15
failover replication http !
failover link failover GigabitEthernet0/2 class-map inspection_default
failover interface ip failover 192.168.36.1 255.255.255.252 match default-inspection-traffic
standby 192.168.36.2 !
icmp unreachable rate-limit 1 burst-size 1 !
asdm image disk0:/asdm-615.bin policy-map type inspect dns preset_dns_map
no asdm history enable parameters
arp timeout 14400 message-length maximum 512
access-group outside_access_in in interface outside policy-map global_policy
! class inspection_default
router eigrp 1 inspect dns preset_dns_map
no auto-summary inspect ftp
network Secure-Subnets 255.255.255.0 inspect h323 h225
network 192.168.27.0 255.255.255.0 inspect h323 ras
network 192.168.31.0 255.255.255.0 inspect rsh
passive-interface DCVLAN26 inspect rtsp
passive-interface DCVLAN27 inspect esmtp
! inspect sqlnet
timeout xlate 3:00:00 inspect skinny
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp inspect sunrpc
0:00:02 inspect xdmcp
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 inspect sip
mgcp-pat 0:05:00 inspect netbios
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip- inspect tftp
disconnect 0:02:00 policy-map type inspect dcerpc MSExchange
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute description Access policy for clients to reach Exchange server
dynamic-access-policy-record DfltAccessPolicy parameters
http server enable endpoint-mapper epm-service-only
http 0.0.0.0 0.0.0.0 management timeout pinhole 0:01:00
http 0.0.0.0 0.0.0.0 outside !
http 0.0.0.0 0.0.0.0 DCVLAN26 service-policy global_policy global
no snmp-server location prompt hostname context
no snmp-server contact Cryptochecksum:e3946a48a41ecc45fd57fdd2f466ad23
snmp-server community cisco123 : end
snmp-server enable traps snmp authentication linkup linkdown
coldstart
ASA 5580 Disaster Recovery Data Center (Device A)
service resetoutside
crypto ipsec security-association lifetime seconds 28800 ASA Version 8.1(2)
crypto ipsec security-association lifetime kilobytes 4608000 !
telnet timeout 5 hostname DCASA5580
enable password 2y4FIGBVVyBLau0Q encrypted

passwd 2y4FIGBVVyBLau0Q encrypted nameif DCVLAN155
names security-level 100
name 192.168.154.26 BladeWeb3Secure ip address 192.168.155.1 255.255.255.0 standby 192.168.155.2
name 192.168.166.27 BladeWeb4Secure !
name 192.168.154.0 Secure-Subnets interface GigabitEthernet4/2
name 192.168.31.224 Mgmt-host-range description Address pool no nameif
for IT users no security-level
! no ip address
interface Management0/0 !
shutdown interface GigabitEthernet4/3
nameif management no nameif
security-level 100 no security-level
no ip address no ip address
management-only !
! ftp mode passive
interface Management0/1 object-group network Bypass-Rule
shutdown description Open Policy for Server Access
no nameif object-group service Mgmt-traffic
no security-level service-object tcp eq ssh
no ip address service-object udp eq snmp
management-only object-group network Application-Servers
! description HTTP, HTTPS, DNS, and MSExchange
interface GigabitEthernet3/0 network-object host BladeWeb3Secure
nameif outside network-object host BladeWeb4Secure
security-level 0 object-group service MS-App-Services
ip address 192.168.159.252 255.255.255.0 standby service-object tcp eq domain
192.168.159.251 service-object tcp eq www
! service-object tcp eq https
interface GigabitEthernet3/1 service-object tcp eq netbios-ssn
no nameif service-object udp eq domain
no security-level service-object udp eq nameserver
no ip address service-object udp eq netbios-dgm
! service-object udp eq netbios-ns
interface GigabitEthernet3/2 service-object tcp eq ftp
no nameif access-list outside_access_in extended permit object-group MS-
no security-level App-Services any o
no ip address bject-group Application-Servers
! access-list outside_access_in extended permit object-group
interface GigabitEthernet3/3 Mgmt-traffic Mgmt-hos
description LAN Failover Interface t-range 255.255.255.224 Secure-Subnets 255.255.254.0
! pager lines 24
interface GigabitEthernet4/0 logging asdm informational
nameif DCVLAN154 mtu management 1500
security-level 100 mtu outside 1500
ip address 192.168.154.1 255.255.255.0 standby 192.168.154.2 mtu DCVLAN154 1500
! mtu DCVLAN155 1500
interface GigabitEthernet4/1 failover

failover lan unit primary username ********** password ********** encrypted privilege 15
failover lan interface failover GigabitEthernet3/3 !
failover polltime unit msec 200 holdtime msec 800 !
failover polltime interface msec 500 holdtime 5 prompt hostname context
failover key [key] Cryptochecksum:1a6d912b3b599b345fa05719dd3a1ed8
failover replication http : end
failover link failover GigabitEthernet3/3
failover interface ip failover 192.168.164.1 255.255.255.252
standby 192.168.164.2 ASA 5580 Disaster Recovery Data Center (Device B)
icmp unreachable rate-limit 1 burst-size 1 CASA5580# sh run
asdm image disk0:/asdm-615.bin : Saved
no asdm history enable :
arp timeout 14400 ASA Version 8.1(2)
access-group outside_access_in in interface outside !
! hostname DCASA5580
router eigrp 1 enable password 2y4FIGBVVyBLau0Q encrypted
network Secure-Subnets 255.255.255.0 passwd 2y4FIGBVVyBLau0Q encrypted
network 192.168.155.0 255.255.255.0 names
network 192.168.159.0 255.255.255.0 name 192.168.154.26 BladeWeb3Secure
! name 192.168.166.27 BladeWeb4Secure
timeout xlate 3:00:00 name 192.168.154.0 Secure-Subnets
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp name 192.168.31.224 Mgmt-host-range description Address pool
0:00:02 for IT users
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 !
mgcp-pat 0:05:00 interface Management0/0
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip- shutdown
disconnect 0:02:00 nameif management
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute security-level 100
timeout tcp-proxy-reassembly 0:01:00 no ip address
dynamic-access-policy-record DfltAccessPolicy management-only
http server enable !
http 192.168.1.0 255.255.255.0 management interface Management0/1
http 192.168.0.0 255.255.0.0 outside shutdown
no snmp-server location no nameif
no snmp-server contact no security-level
snmp-server enable traps snmp authentication linkup linkdown no ip address
coldstart management-only
service resetoutside !
crypto ipsec security-association lifetime seconds 28800 interface GigabitEthernet3/0
crypto ipsec security-association lifetime kilobytes 4608000 nameif outside
telnet timeout 5 security-level 0
ssh timeout 5 ip address 192.168.159.252 255.255.255.0 standby
console timeout 0 192.168.159.251
threat-detection basic-threat !
threat-detection statistics access-list interface GigabitEthernet3/1
no threat-detection statistics tcp-intercept no nameif
ntp server 171.68.10.150 source outside prefer no security-level

no ip address service-object udp eq netbios-dgm
! service-object udp eq netbios-ns
interface GigabitEthernet3/2 service-object tcp eq ftp
no nameif access-list outside_access_in extended permit object-group MS-
no security-level App-Services any object-group Application-Servers
no ip address access-list outside_access_in extended permit object-group
! Mgmt-traffic Mgmt-host-range 255.255.255.224 Secure-Subnets
interface GigabitEthernet3/3 255.255.254.0
description LAN Failover Interface pager lines 24
! logging asdm informational
interface GigabitEthernet4/0 mtu management 1500
nameif DCVLAN154 mtu outside 1500
security-level 100 mtu DCVLAN154 1500
ip address 192.168.154.1 255.255.255.0 standby 192.168.154.2 mtu DCVLAN155 1500
! failover
interface GigabitEthernet4/1 failover lan unit secondary
nameif DCVLAN155 failover lan interface failover GigabitEthernet3/3
security-level 100 failover polltime unit msec 200 holdtime msec 800
ip address 192.168.155.1 255.255.255.0 standby 192.168.155.2 failover polltime interface msec 500 holdtime 5
! failover key [key]
interface GigabitEthernet4/2 failover replication http
no nameif failover link failover GigabitEthernet3/3
no security-level failover interface ip failover 192.168.164.1 255.255.255.252
no ip address standby 192.168.164.2
! icmp unreachable rate-limit 1 burst-size 1
interface GigabitEthernet4/3 asdm image disk0:/asdm-615.bin
no nameif no asdm history enable
no security-level arp timeout 14400
no ip address access-group outside_access_in in interface outside
! !
ftp mode passive router eigrp 1
object-group network Bypass-Rule network Secure-Subnets 255.255.255.0
description Open Policy for Server Access network 192.168.155.0 255.255.255.0
object-group service Mgmt-traffic network 192.168.159.0 255.255.255.0
service-object tcp eq ssh !
service-object udp eq snmp timeout xlate 3:00:00
object-group network Application-Servers timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp
description HTTP, HTTPS, DNS, and MSExchange 0:00:02
network-object host BladeWeb3Secure timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
network-object host BladeWeb4Secure mgcp-pat 0:05:00
object-group service MS-App-Services timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-
service-object tcp eq domain disconnect 0:02:00
service-object tcp eq www timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
service-object tcp eq https timeout tcp-proxy-reassembly 0:01:00
service-object tcp eq netbios-ssn dynamic-access-policy-record DfltAccessPolicy
service-object udp eq domain http server enable
service-object udp eq nameserver http 192.168.1.0 255.255.255.0 management

http 192.168.0.0 255.255.0.0 outside host-name DC-SSM-a
no snmp-server location telnet-option enabled
no snmp-server contact access-list 0.0.0.0/0
snmp-server enable traps snmp authentication linkup linkdown dns-primary-server enabled
coldstart address 192.168.152.10
service resetoutside exit
crypto ipsec security-association lifetime seconds 28800 dns-secondary-server enabled
crypto ipsec security-association lifetime kilobytes 4608000 address 192.168.28.10
telnet timeout 5 exit
ssh timeout 5 dns-tertiary-server disabled
console timeout 0 exit
threat-detection basic-threat time-zone-settings
threat-detection statistics access-list offset -480
no threat-detection statistics tcp-intercept standard-time-zone-name GMT-08:00
ntp server 171.68.10.150 source outside prefer exit
username ********** password ********** encrypted privilege 15 ntp-option enabled-ntp-unauthenticated
! ntp-server 192.168.31.2
! exit
prompt hostname context summertime-option recurring
Cryptochecksum:7c9c2eaa769b04c4bc4e6319fa33fa67 summertime-zone-name GMT-08:00
: end exit
auto-upgrade
cisco-server enabled
SSM-40 Primary Data Center schedule-option calendar-schedule
DC-SSM-a# sho conf times-of-day 16:00:00
! ------------------------------ days-of-week monday
! Current configuration last modified Mon Nov 23 11:55:24 2009 days-of-week tuesday
! ------------------------------ days-of-week wednesday
! Version 7.0(2) days-of-week thursday
! Host: days-of-week friday
! Realm Keys key1.0 exit
! Signature Definition: user-name <CCO User ID>
! Signature Update S448.0 2009-11-12 cisco-url https://198.133.219.25//cgi-bin/front.x/ida/locator/
! Virus Update V1.4 2007-03-02 locator.pl
! ------------------------------ exit
service interface exit
exit exit
! ------------------------------ ! ------------------------------
service authentication service logger
exit exit
! ------------------------------ ! ------------------------------
service event-action-rules rules0 service network-access
exit exit
! ------------------------------ ! ------------------------------
service host service notification
network-settings exit
host-ip 192.168.1.61/24,192.168.1.1 ! ------------------------------

service signature-definition sig0 ! ------------------------------
exit service authentication
! ------------------------------ exit
service ssh-known-hosts ! ------------------------------
exit service event-action-rules rules0
! ------------------------------ exit
service trusted-certificates ! ------------------------------
exit service host
! ------------------------------ network-settings
service web-server host-ip 192.168.1.62/24,192.168.1.1
exit host-name DC_SSM_b
! ------------------------------ telnet-option enabled
service anomaly-detection ad0 access-list 0.0.0.0/0
exit dns-primary-server enabled
! ------------------------------ address 192.168.152.10
service external-product-interface exit
exit dns-secondary-server enabled
! ------------------------------ address 192.168.28.10
service health-monitor exit
exit dns-tertiary-server disabled
! ------------------------------ exit
service global-correlation time-zone-settings
exit offset -480
! ------------------------------ standard-time-zone-name GMT-08:00
service analysis-engine exit
virtual-sensor vs0 ntp-option enabled-ntp-unauthenticated
physical-interface GigabitEthernet0/1 ntp-server 192.168.31.2
exit exit
exit summertime-option recurring
summertime-zone-name GMT-08:00
exit
SSM-40 Disaster Recovery Data Center auto-upgrade
SSM-40 Disaster Recovery Data Center cisco-server enabled
DC_SSM_b# sho conf schedule-option calendar-schedule
! ------------------------------ times-of-day 16:00:00
! Current configuration last modified Mon Nov 23 11:57:33 2009 days-of-week monday
! ------------------------------ days-of-week tuesday
! Version 7.0(2) days-of-week wednesday
! Host: days-of-week thursday
! Realm Keys key1.0 days-of-week friday
! Signature Definition: exit
! Signature Update S450.0 2009-11-22 user-name <CCO User ID>
! Virus Update V1.4 2007-03-02 cisco-url https://198.133.219.25//cgi-bin/front.x/ida/locator/
! ------------------------------ locator.pl
service interface exit
exit exit

exit ! Version 7.0(2)
! ------------------------------ ! Host:
service logger ! Realm Keys key1.0
exit ! Signature Definition:
! ------------------------------ ! Signature Update S450.0 2009-11-22
service network-access ! Virus Update V1.4 2007-03-02
exit ! ------------------------------
! ------------------------------ service interface
service notification physical-interfaces GigabitEthernet0/1
exit admin-state disabled
! ------------------------------ subinterface-type none
service signature-definition sig0 exit
exit physical-interfaces GigabitEthernet2/0
! ------------------------------ description VLAN 155 Outside to ASA 5580a
service ssh-known-hosts admin-state enabled
exit duplex auto
! ------------------------------ speed auto
service trusted-certificates default-vlan 0
exit alt-tcp-reset-interface none
! ------------------------------ exit
service web-server physical-interfaces GigabitEthernet2/1
exit description VLAN 155 Inside to Switch
! ------------------------------ admin-state enabled
service anomaly-detection ad0 duplex auto
exit speed auto
! ------------------------------ default-vlan 0
service external-product-interface alt-tcp-reset-interface none
exit exit
! ------------------------------ physical-interfaces GigabitEthernet2/2
service health-monitor description VLAN 154 Outside to ASA 5580b
exit admin-state enabled
! ------------------------------ duplex auto
service global-correlation speed auto
exit default-vlan 0
! ------------------------------ alt-tcp-reset-interface none
service analysis-engine exit
virtual-sensor vs0 physical-interfaces GigabitEthernet2/3
physical-interface GigabitEthernet0/1 description VLAN 154 Inside to Switch
exit duplex auto
speed auto
default-vlan 0
IDS/IPS 4260 Primary Data Center alt-tcp-reset-interface none
4260_DC_a# sho conf exit
! ------------------------------ inline-interfaces InlinePair1
! Current configuration last modified Mon Nov 23 11:38:37 2009 description VLAN 155
! ------------------------------ interface1 GigabitEthernet2/1

interface2 GigabitEthernet2/0 times-of-day 16:00:00
exit days-of-week monday
inline-interfaces InlinePair2 days-of-week tuesday
description VLAN 154 days-of-week wednesday
interface1 GigabitEthernet2/3 days-of-week thursday
interface2 GigabitEthernet2/2 days-of-week friday
exit exit
bypass-mode off user-name <CCO User ID>
exit cisco-url https://198.133.219.25//cgi-bin/front.x/ida/locator/
! ------------------------------ locator.pl
service authentication exit
exit exit
! ------------------------------ exit
service event-action-rules rules0 ! ------------------------------
overrides produce-alert service logger
override-item-status Enabled exit
risk-rating-range 1-100 ! ------------------------------
exit service network-access
exit exit
! ------------------------------ ! ------------------------------
service host service notification
network-settings exit
host-ip 192.168.128.72/24,192.168.128.1 ! ------------------------------
host-name 4260_DC_a service signature-definition sig0
telnet-option enabled exit
access-list 0.0.0.0/0 ! ------------------------------
dns-primary-server enabled service ssh-known-hosts
address 192.168.152.10 exit
exit ! ------------------------------
dns-secondary-server enabled service trusted-certificates
address 192.168.28.10 exit
exit ! ------------------------------
dns-tertiary-server disabled service web-server
exit exit
time-zone-settings ! ------------------------------
offset -480 service anomaly-detection ad0
standard-time-zone-name GMT-08:00 exit
exit ! ------------------------------
ntp-option enabled-ntp-unauthenticated service external-product-interface
ntp-server 192.168.31.2 exit
exit ! ------------------------------
summertime-option recurring service health-monitor
summertime-zone-name GMT-08:00 exit
exit ! ------------------------------
auto-upgrade service global-correlation
cisco-server enabled exit
schedule-option calendar-schedule ! ------------------------------

service analysis-engine default-vlan 0
virtual-sensor vs0 alt-tcp-reset-interface none
logical-interface InlinePair1 subinterface-number 0 exit
logical-interface InlinePair2 subinterface-number 0 physical-interfaces GigabitEthernet2/3
inline-TCP-session-tracking-mode interface-and-vlan description VLAN 154 Inside to Switch
exit duplex auto
speed auto
default-vlan 0
IDS/IPS 4260 Disaster Recovery Data Center alt-tcp-reset-interface none
4260_DC_b# sho conf exit
! ------------------------------ inline-interfaces InlinePair1
! Current configuration last modified Mon Nov 23 11:37:34 2009 description VLAN 155
! ------------------------------ interface1 GigabitEthernet2/1
! Version 7.0(2) interface2 GigabitEthernet2/0
! Host: exit
! Realm Keys key1.0 inline-interfaces InlinePair2
! Signature Definition: description VLAN 154
! Signature Update S450.0 2009-11-22 interface1 GigabitEthernet2/3
! Virus Update V1.4 2007-03-02 interface2 GigabitEthernet2/2
! ------------------------------ exit
service interface bypass-mode off
physical-interfaces GigabitEthernet0/1 exit
admin-state disabled ! ------------------------------
subinterface-type none service authentication
exit exit
physical-interfaces GigabitEthernet2/0 ! ------------------------------
description VLAN 155 Outside to ASA 5580 b service event-action-rules rules0
admin-state enabled overrides produce-alert
duplex auto override-item-status Enabled
speed auto risk-rating-range 1-100
default-vlan 0 exit
alt-tcp-reset-interface none exit
exit ! ------------------------------
physical-interfaces GigabitEthernet2/1 service host
description VLAN 155 Inside to Switch network-settings
admin-state enabled host-ip 192.168.128.73/24,192.168.128.1
duplex auto host-name 4260_DC_b
speed auto telnet-option enabled
default-vlan 0 access-list 0.0.0.0/0
alt-tcp-reset-interface none dns-primary-server enabled
exit address 192.168.152.10
physical-interfaces GigabitEthernet2/2 exit
description VLAN 154 Outside to ASA 5580 b dns-secondary-server enabled
admin-state enabled address 192.168.28.10
duplex auto exit
speed auto dns-tertiary-server disabled

exit ! ------------------------------
time-zone-settings service external-product-interface
offset -480 exit
standard-time-zone-name GMT-08:00 ! ------------------------------
exit service health-monitor
ntp-option enabled-ntp-unauthenticated exit
ntp-server 192.168.31.2 ! ------------------------------
exit service global-correlation
summertime-option recurring exit
summertime-zone-name GMT-08:00 ! ------------------------------
exit service analysis-engine
auto-upgrade virtual-sensor vs0
cisco-server enabled logical-interface InlinePair1 subinterface-number 0
schedule-option periodic-schedule logical-interface InlinePair2 subinterface-number 0
start-time 11:10:00 inline-TCP-session-tracking-mode interface-and-vlan
interval 2 exit
exit exit
user-name <CCO User ID>
cisco-url https://198.133.219.25//cgi-bin/front.x/ida/locator/
locator.pl
exit
exit
exit
! ------------------------------
service logger
exit
! ------------------------------
service network-access
exit
! ------------------------------
service notification
exit
! ------------------------------
service signature-definition sig0
exit
! ------------------------------
service ssh-known-hosts
exit
! ------------------------------
service trusted-certificates
exit
! ------------------------------
service web-server
exit
! ------------------------------
service anomaly-detection ad0
exit
Resilient WAN Design 40

Resilient WAN Design
interface Port-channel1
no ip address
ip flow ingress
!
hold-queue 150 in
!
interface Port-channel1.31
ISR 3845 Primary Data Center encapsulation dot1Q 31
! ip address 192.168.31.2 255.255.255.0
version 15.0 ip wccp 62 redirect in
service timestamps debug datetime msec ip flow ingress
service timestamps log datetime msec ip pim sparse-mode
no service password-encryption !
! interface GigabitEthernet0/0
hostname HQ-ISR3845 no ip address
! ip flow ingress
boot-start-marker duplex auto
boot system flash:c3845-advipservicesk9-mz.124-24.T.bin speed auto
boot system flash: media-type rj45
boot-end-marker channel-group 1
! !
! card type command needed for slot/vwic-slot 0/0 interface GigabitEthernet0/0.31
enable password ********** ip flow ingress
! channel-group 1
no aaa new-model !
! interface GigabitEthernet0/1
dot11 syslog no ip address
ip source-route ip flow ingress
ip cef duplex auto
! speed auto
ip wccp 61 media-type rj45
ip wccp 62 channel-group 1
no ipv6 cef !
! interface GigabitEthernet0/1.31
multilink bundle-name authenticated ip flow ingress
! channel-group 1
voice-card 0 !
! interface FastEthernet0/2/0
license udi pid CISCO3845-MB sn FOC13141YBQ ip address 10.0.1.254 255.255.255.252
archive ip wccp 61 redirect in
log config ip flow ingress
hidekeys ip summary-address eigrp 1 192.168.0.0 255.255.224.0 1
username ********** privilege 15 password 0 ********** duplex auto
! speed auto
redundancy !
! no ip address

shutdown transport preferred none
duplex auto transport input all
speed auto transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
! line vty 0 4
interface Transport-Opt-Service-Engine1/0 login local
no ip address line vty 5 15
shutdown login local
! !
hold-queue 60 out scheduler allocate 20000 1000
! ntp master
interface GigabitEthernet2/0 end
no ip address
!
router eigrp 1 ISR 3925 Disaster Recovery Data Center
network 10.0.1.0 0.0.0.255 !
network 192.168.0.0 0.0.255.255 version 15.0
! service timestamps debug datetime msec
ip forward-protocol nd service timestamps log datetime msec
ip http server no service password-encryption
no ip http secure-server !
! hostname DC2ISR
ip flow-cache timeout active 1 !
ip flow-export version 5 boot-start-marker
! boot-end-marker
snmp-server community cisco RO !
snmp-server community cisco123 RW enable password ********
! !
tftp-server flash:c3845-advipservicesk9-mz.124-24.T.bin no aaa new-model
! !
control-plane no ipv6 cef
! ip source-route
mgcp fax t38 ecm ip cef
mgcp behavior g729-variants static-pt !
! ip wccp 61
line con 0 ip wccp 62
line aux 0 !
line 66 multilink bundle-name authenticated
no activation-character !
no exec voice-card 0
transport preferred none !
transport input all license udi pid C3900-SPE150/K9 sn ******************
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh license boot module c3900 technology-package securityk9
stopbits 1 license boot module c3900 technology-package uck9
speed 115200 license boot module c3900 technology-package datak9
line 130 !
no activation-character archive
no exec log config

hidekeys channel-group 1
username ******** password 0 ******** !
username ******** privilege 15 password 0 ********* interface FastEthernet0/2/0
! ip address 10.0.1.250 255.255.255.252
redundancy ip wccp 61 redirect in
! duplex auto
crypto keyring sba-keys speed auto
pre-shared-key address 0.0.0.0 0.0.0.0 key sba !
crypto isakmp policy 1 ip address 10.194.112.79 255.255.255.192
encr aes ip access-group 143 in
authentication pre-share ip access-group 143 out
group 2 ip policy route-map VPN-ROUTE
crypto isakmp profile sba-profile shutdown
keyring sba-keys duplex auto
match identity address 0.0.0.0 speed auto
virtual-template 1 !
! interface Virtual-Template1 type tunnel
crypto ipsec transform-set xform esp-aes ip unnumbered Port-channel1.159
! tunnel source Port-channel1.159
crypto ipsec profile sba tunnel mode ipsec ipv4
set transform-set xform tunnel protection ipsec profile sba
! !
interface Port-channel1 router eigrp 1
no ip address network 10.0.1.0 0.0.0.255
! network 192.168.0.0 0.0.255.255
hold-queue 150 in !
! ip forward-protocol nd
interface Port-channel1.159 !
encapsulation dot1Q 159 no ip http server
ip address 192.168.159.2 255.255.255.0 no ip http secure-server
ip wccp 62 redirect in !
! ip route 192.168.0.0 255.255.255.0 10.194.112.80
interface GigabitEthernet0/0 !
no ip address access-list 122 remark *** Default gateway for remote sites
duplex auto ***
speed auto access-list 122 permit ip 192.168.80.0 0.0.1.255 any
channel-group 1 access-list 122 permit ip 192.168.84.0 0.0.1.255 any
! access-list 143 remark *** ACL to select VPN Traffic ***
interface GigabitEthernet0/0.159 access-list 143 permit esp any any
channel-group 1 access-list 143 permit udp any any eq non500-isakmp
! access-list 143 permit udp any any eq isakmp
interface GigabitEthernet0/1 !
no ip address nls resp-timeout 1
duplex auto cpd cr-id 1
speed auto route-map VPN-ROUTE permit 10
media-type rj45 match ip address 143

set ip next-hop 10.194.112.80 ip source-route
! !
control-plane !
! ip cef
mgcp fax t38 ecm ip dhcp excluded-address 192.168.64.0 192.168.64.10
mgcp behavior g729-variants static-pt ip dhcp excluded-address 192.168.65.0 192.168.65.10
! ip dhcp excluded-address 192.168.68.0 192.168.68.10
gatekeeper ip dhcp excluded-address 192.168.69.0 192.168.69.10
shutdown !
! ip dhcp pool wired_data
line con 0 network 192.168.64.0 255.255.255.0
exec-timeout 0 0 dns-server 192.168.28.10 192.168.152.10
line aux 0 domain-name cisco.local
line vty 0 4 default-router 192.168.64.1
login !
! ip dhcp pool wired_voice
exception data-corruption buffer truncate network 192.168.65.0 255.255.255.0
scheduler allocate 20000 1000 dns-server 192.168.28.10 192.168.152.10
end default-router 192.168.65.1
domain-name cisco.local
option 150 ip 192.168.28.20 192.168.29.20
ISR 2811 Branch !
! ip dhcp pool wireless_data
! Last configuration change at 23:43:15 UTC Wed Dec 2 2009 network 192.168.68.0 255.255.255.0
! default-router 192.168.68.1
version 15.0 domain-name cisco.local
service timestamps debug datetime msec dns-server 192.168.28.10 192.168.152.10
service timestamps log datetime msec !
service password-encryption ip dhcp pool wireless_voice
! network 192.168.69.0 255.255.255.0
hostname BR1ISR default-router 192.168.69.1
! domain-name cisco.local
boot-start-marker dns-server 192.168.28.10 192.168.152.10
boot-end-marker option 150 ip 192.168.28.20 192.168.29.20
! !
card type t1 0 0 ip domain name cisco.local
logging buffered 51200 warnings ip host wwwin 171.71.181.19
enable secret 5 $1$Fjyp$scx/IdlB6.kJXiIWNyXlw. ip name-server 192.168.28.10
enable password 7 070C705F4D06485744 ip name-server 192.168.152.10
! ip multicast-routing
no aaa new-model ip wccp 61
! ip wccp 62
network-clock-participate wic 0 no ipv6 cef
network-clock-select 1 T1 0/0/0 !
network-clock-select 2 T1 0/0/1 multilink bundle-name authenticated
! !
isdn switch-type primary-ni
dot11 syslog

! 03551D23
voice service voip 04183016 80144DB4 62693B84 90B6A36F 8CD9BB94 6D87C9E8 F196301D
sip 0603551D
bind control source-interface FastEthernet0/0.65 0E041604 144DB462 693B8490 B6A36F8C D9BB946D 87C9E8F1 96300D06
bind media source-interface FastEthernet0/0.65 092A8648
! 86F70D01 01040500 03818100 6E5C0702 0A3FEACE 7D6570E6 BF2EE08C
voice class codec 1 21521519
codec preference 1 g711ulaw 689CCA83 6789E378 B544DB73 5AC560EA AC754347 02D3A37B 847C109D
codec preference 2 g711alaw 9CB95B96
codec preference 3 g729r8 2E5DD60B 9FBDFE10 02B0230E 191E97B5 7AC12D07 6717B8F4 EAC50E15
codec preference 4 ilbc 425608F6
! 00A4007C 5B246DAC D44D2A39 6BECD04A 52A5DDF0 E24B6255 A2D93739
voice-card 0 549A4983
! AD9B256A F51C8F39 A089B2A8
! quit
crypto pki trustpoint TP-self-signed-291049566 !
enrollment selfsigned !
subject-name cn=IOS-Self-Signed-Certificate-291049566 license udi pid CISCO2811 sn FTX1307A265
revocation-check none archive
rsakeypair TP-self-signed-291049566 log config
! hidekeys
! username ********** privilege 15 password 7 **********
crypto pki certificate chain TP-self-signed-291049566 !
certificate self-signed 01 redundancy
30820248 308201B1 A0030201 02020101 300D0609 2A864886 F70D0101 !
04050030 !
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D controller T1 0/0/0
43657274 cablelength short 110
69666963 6174652D 32393130 34393536 36301E17 0D303931 30303630 channel-group 0 timeslots 1-24
31333731 !
325A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 controller T1 0/0/1
1325494F cablelength short 110
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3239 channel-group 0 timeslots 1-4
31303439 !
35363630 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 !
02818100 track 123 interface Serial0/0/0:0 ip routing
9ADEA6F2 075154BD 2EC7BDAA 77707450 5A8333AA F3819DA2 235702AA !
13790EE0 !
85E2C320 40425B68 C2F83452 D2F2814F F222DBC2 83F7A844 21D3212C crypto isakmp policy 1
8CEC4820 encr aes
05024E7E 76A7B66B 98804C0C 144C8C8C 2D9A7DEC F090FE05 5EB29877 authentication pre-share
9F42E507 group 2
7A5193D2 46ACC480 19B7730B B6C14639 BC578652 8E680FA8 081D0F75 crypto isakmp key sba address 0.0.0.0 0.0.0.0
15290DE1 !
02030100 01A37230 70300F06 03551D13 0101FF04 05300301 01FF301D !
0603551D crypto ipsec transform-set xform esp-aes
11041630 14821242 52314953 522E6369 73636F2E 6C6F6361 6C301F06 !

crypto ipsec profile sba speed auto
set transform-set xform !
! !
! interface Integrated-Service-Engine1/0
interface Tunnel0 ip address 192.168.23.1 255.255.255.252
description ###### Encrypted tunnel to DC2 ISR ######## service-module ip address 192.168.23.2 255.255.255.252
ip unnumbered FastEthernet0/0.64 !Application: Restarted at Thu May 4 16:00:52 2006
shutdown service-module ip default-gateway 192.168.23.1
tunnel source Serial0/0/1:0 no keepalive
tunnel mode ipsec ipv4 !
tunnel destination 10.194.112.101 interface IDS-Sensor0/0
tunnel protection ipsec profile sba no ip address
! shutdown
! service-module fail-open
interface FastEthernet0/0 !
description Uplink to Switch hold-queue 60 out
no ip address !
duplex auto interface Serial0/0/0:0
speed auto description Primary Wide Area network
! ip address 10.0.1.2 255.255.255.252
! ip wccp 62 redirect in
interface FastEthernet0/0.64 ip pim sparse-mode
description Wired Data load-interval 30
encapsulation dot1Q 64 !
ip address 192.168.64.1 255.255.255.0 !
ip wccp 61 redirect in interface Serial0/0/1:0
ip pim sparse-mode description Backup Link (Internet)
! ip address 10.0.2.2 255.255.255.252
interface FastEthernet0/0.65 ip wccp 62 redirect in
description Wired Voice ip pim sparse-mode
encapsulation dot1Q 65 load-interval 30
ip address 192.168.65.1 255.255.255.0 !
! router eigrp 1
interface FastEthernet0/0.68 network 10.0.1.0 0.0.0.255
description Wireless Data network 192.168.0.0 0.0.255.255
encapsulation dot1Q 68 passive-interface default
ip address 192.168.68.1 255.255.255.0 no passive-interface Serial0/0/0:0
! no passive-interface Tunnel0
interface FastEthernet0/0.69 !
description Wireless Voice ip forward-protocol nd
encapsulation dot1Q 69 ip http server
ip address 192.168.69.1 255.255.255.0 ip http authentication local
! ip http secure-server
interface FastEthernet0/1 ip http timeout-policy idle 60 life 86400 requests 10000
no ip address !
shutdown !
duplex auto ip pim rp-address 192.168.31.1
Resilient WAN Optimization 46

ip route 10.194.112.101 255.255.255.255 10.0.2.1 forward-digits 11
! !
snmp-server community cisco RO dial-peer voice 9011 pots
snmp-server community cisco123 RW destination-pattern 9011T
! incoming called-number .
control-plane direct-inward-dial
! prefix 011
mgcp fax t38 ecm !
mgcp behavior g729-variants static-pt call-manager-fallback
! max-conferences 8 gain -6
! transfer-system full-consult
dial-peer voice 100 voip ip source-address 192.168.65.1 port 2000
description SIP TRUNK to CUCM1 max-ephones 20
preference 2 dialplan-pattern 1 408555.... extension-length 4
destination-pattern 1408555.... access-code pri 9 direct-inward-dial
session protocol sipv2 !
session target ipv4:192.168.28.20 !
incoming called-number . line con 0
voice-class codec 1 exec-timeout 0 0
! login local
dial-peer voice 101 voip line aux 0
description SIP TRUNK to CUCM2 line 66
preference 1 no activation-character
destination-pattern 1408555.... no exec
session protocol sipv2 transport preferred none
session target ipv4:192.168.28.21 transport input all
incoming called-number . transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
voice-class codec 1 line 194
! no activation-character
dial-peer voice 123 pots no exec
incoming called-number . transport preferred none
direct-inward-dial transport input all
! transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
dial-peer voice 911 pots stopbits 1
destination-pattern 911 speed 115200
forward-digits 3 line vty 0 4
! exec-timeout 0 0
dial-peer voice 9911 pots login local
destination-pattern 9911 transport input all
forward-digits 3 line vty 5 15
! exec-timeout 0 0
dial-peer voice 7 pots login local
destination-pattern 9[2-9]...... transport input all
forward-digits 7 !
! scheduler allocate 20000 1000
dial-peer voice 11 pots event manager applet start-tunnel
destination-pattern 91[2-9]..[2-9]...... event track 123 state down

action 1 cli command “enable” dns-server 192.168.28.10 192.168.152.10
action 2 cli command “configure terminal” domain-name cisco.local
action 3 cli command “interface tunnel0” default-router 192.168.88.1
action 4 cli command “no shut” !
action 5 cli command “end” ip dhcp pool wired _ voice
event manager applet stop-tunnel network 192.168.89.0 255.255.255.0
event track 123 state up dns-server 192.168.28.10 192.168.152.10
action 1 cli command “enable” default-router 192.168.89.1
action 2 cli command “configure terminal” domain-name cisco.local
action 3 cli command “interface tunnel0” option 150 ip 192.168.28.20 192.168.29.20
action 4 cli command “shut” !
action 5 cli command “end” ip dhcp pool wireless _ data
! network 192.168.92.0 255.255.255.0
End default-router 192.168.92.1
domain-name cisco.local
ISR 2911 Branch dns-server 192.168.28.10 192.168.152.10
version 15.0 !
service timestamps debug datetime msec ip dhcp pool wireless _ voice
service timestamps log datetime msec network 192.168.93.0 255.255.255.0
no service password-encryption default-router 192.168.93.1
! domain-name cisco.local
hostname BR4ISR dns-server 192.168.28.10 192.168.152.10
boot-start-marker option 150 ip 192.168.28.20 192.168.29.20
boot-end-marker !
! ip domain name cisco.local
card type e1 0 0 ip name-server 192.168.28.10
enable password ********* ip name-server 192.168.152.10
! ip wccp 61
no aaa new-model ip wccp 62
! !
network-clock-participate wic 0 multilink bundle-name authenticated
network-clock-select 1 E1 0/0/0 !
! cwmp agent
no ipv6 cef management server username ****************************
ip source-route !
ip cef voice-card 0
! !
! license udi pid CISCO2911/K9 sn ***************
ip multicast-routing license boot module c2900 technology-package securityk9
ip dhcp excluded-address 192.168.88.1 192.168.88.10 license boot module c2900 technology-package uck9
ip dhcp excluded-address 192.168.89.1 192.168.89.10 license boot module c2900 technology-package datak9
ip dhcp excluded-address 192.168.92.1 192.168.92.10 !
ip dhcp excluded-address 192.168.93.1 192.168.93.10 !
! archive
ip dhcp pool wired _ data log config
network 192.168.88.0 255.255.255.0 hidekeys

username ******** privilege 15 password 0 ******** ip pim sparse-dense-mode
! !
redundancy interface GigabitEthernet0/0.92
! description Wireless Data
controller E1 0/0/0 encapsulation dot1Q 92
channel-group 0 timeslots 1-31 ip address 192.168.92.1 255.255.255.0
! !
controller E1 0/1/0 interface GigabitEthernet0/0.93
channel-group 0 timeslots 1-4 description Wireless Voice
! encapsulation dot1Q 93
track 123 interface Serial0/0/0:0 ip routing ip address 192.168.93.1 255.255.255.0
! !
crypto isakmp policy 1 interface GigabitEthernet0/1
encr aes no ip address
authentication pre-share shutdown
group 2 duplex auto
crypto isakmp key sba address 0.0.0.0 0.0.0.0 speed auto
! !
crypto ipsec transform-set xform esp-aes interface GigabitEthernet0/2
! no ip address
crypto ipsec profile sba shutdown
set transform-set xform duplex auto
! speed auto
interface Tunnel0 !
ip unnumbered GigabitEthernet0/0.88 interface Serial0/0/0:0
shutdown description Primary Wide Area Network
tunnel source Serial0/1/0:0 ip address 10.0.1.14 255.255.255.252
tunnel mode ipsec ipv4 ip wccp 62 redirect in
tunnel destination 10.194.112.101 ip pim sparse-dense-mode
tunnel protection ipsec profile sba !
! interface Serial0/1/0:0
interface GigabitEthernet0/0 ip address 10.0.2.14 255.255.255.252
description Uplink to Switch !
no ip address interface Integrated-Service-Engine1/0
duplex auto ip address 192.168.23.9 255.255.255.252
speed auto service-module ip address 192.168.23.10 255.255.255.252
! !Application: Restarted at Fri May 5 00:01:02 2006
interface GigabitEthernet0/0.88 service-module ip default-gateway 192.168.23.9
description Wired Data no keepalive
encapsulation dot1Q 88 !
ip address 192.168.88.1 255.255.255.0 router eigrp 1
ip pim sparse-dense-mode network 10.0.1.0 0.0.0.255
! network 192.168.0.0 0.0.255.255
interface GigabitEthernet0/0.89 passive-interface default
description Wired Voice no passive-interface Serial0/0/0:0
encapsulation dot1Q 89 no passive-interface Tunnel0
ip address 192.168.89.1 255.255.255.0 !
Resilient Server Design 49

ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 10.194.112.101 255.255.255.255 10.0.2.13
!
snmp-server community *******
snmp-server community *******
!
control-plane
!
mgcp fax t38 ecm
mgcp behavior g729-variants static-pt
!
gatekeeper
shutdown
!
line con 0
line aux 0
line 67
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120
ssh
line vty 0 3
login local
!
exception data-corruption buffer truncate
scheduler allocate 20000 1000
event manager applet start-tunnel
event track 123 state down
action 1 cli command “enable”
action 2 cli command “configure terminal”
action 3 cli command “interface tunnel0”
action 4 cli command “no shut”
action 5 cli command “end”
event manager applet stop-tunnel
event track 123 state up
action 1 cli command “enable”
action 2 cli command “configure terminal”
action 3 cli command “interface tunnel0”
action 4 cli command “shut”
!
!
End
Resilient WAN Optimization Design 50

Resilient WAN
!
inetd enable ftp
!
Optimization Design cms enable

!
! End of WAAS configuration
WAAS WAVE 574 DC Application Accelerator

WAAS-HE#sh run
WAAS WAVE 274 Central Manager ! WAAS version 4.1.5b (build b7 Oct 27 2009)
WAAS-CM#sh run !
! WAAS version 4.1.5b (build b7 Oct 27 2009) device mode application-accelerator
! !
device mode central-manager hostname WAAS-HE
! !
hostname WAAS-CM clock timezone PST -8 0
! !
clock timezone PST -8 0 ip domain-name cisco.local
! !
! primary-interface PortChannel 1
ip domain-name cisco.local !
! interface PortChannel 1
! ip address 192.168.31.10 255.255.255.0
primary-interface GigabitEthernet 1/0 exit
! !
! interface GigabitEthernet 1/0
interface GigabitEthernet 1/0 channel-group 1
ip address 192.168.28.100 255.255.255.0 exit
exit interface GigabitEthernet 2/0
! channel-group 1
ip default-gateway 192.168.28.1 exit
! interface InlineGroup 1/1
! ip path-mtu-discovery is disabled in WAAS by default inline vlan all
! shutdown
ip name-server 192.168.28.10 exit
! !
! !
ntp server 192.168.31.2 ip default-gateway 192.168.31.1
! !
! no auto-register enable
username ****** password ************** !
username ****** privilege 15 ! ip path-mtu-discovery is disabled in WAAS by default
username ****** print-admin-password ************ !
! ip name-server 192.168.28.10
authentication login local enable primary !
authentication configuration local enable primary ntp server 192.168.31.2

! name Version-Management
wccp router-list 8 192.168.31.2 name WAFS
wccp tcp-promiscuous router-list-num 8 name SSL
wccp version 2 name Other
! classifier AFS
egress-method negotiated-return intercept-method wccp match dst port range 7000 7009
! exit
! classifier AOL
username ******* password ******* match dst port range 5190 5193
username ******* privilege 15 exit
username ******* print-admin-password ******* classifier Altiris-CarbonCopy
! match dst port eq 1680
authentication login local enable primary exit
authentication configuration local enable primary classifier Amanda
tfo tcp optimized-send-buffer 2048 exit
tfo tcp optimized-receive-buffer 2048 classifier AppSocket
! exit
virtual-blade enable classifier Apple-AFP
policy-engine application match dst port eq 548
set-dscp copy exit
name Web classifier Apple-NetAssistant
name Authentication match dst port eq 3283
name Backup exit
name CAD classifier Apple-iChat
name Call-Management match dst port eq 5297
name Conferencing match dst port eq 5298
name Console exit
name Content-Management classifier BFTP
name Directory-Services match dst port eq 152
name Email-and-Messaging exit
name Enterprise-Applications classifier BGP
name File-System match dst port eq 179
name File-Transfer exit
name Instant-Messaging classifier BMC-Patrol
name Name-Services match dst port eq 6161
name P2P match dst port eq 6162
name Printing match dst port eq 8160
name Remote-Desktop match dst port eq 8161
name Replication match dst port eq 6767
name SQL match dst port eq 6768
name SSH match dst port eq 10128
name Storage exit
name Streaming classifier BackupExpress
name Systems-Management match dst port eq 6123
name VPN exit

classifier Basic-TCP-services match dst port eq 6502
match dst port range 1 19 exit
exit classifier Documentum
classifier BitTorrent match dst port eq 1489
match dst port eq 6969 classifier Double-Take
exit match dst port eq 1100
classifier Borland-Interbase match dst port eq 1105
match dst port eq 3050 exit
exit classifier EMC-Celerra-Replicator
classifier CIFS match dst port eq 8888
match dst port eq 445 classifier EMC-SRDFA-IP
classifier CU-SeeMe exit
match dst port eq 7640 classifier FCIP
match dst port eq 7642 match dst port eq 3225
match dst port eq 7649 classifier FTP-Control
classifier CVS exit
match dst port eq 2401 classifier FTP-Data
exit match src port eq 20
classifier Cisco-CallManager exit
match dst port eq 2748 classifier FTPS
exit exit
classifier Citrix-ICA classifier FTPS-Control
match dst port eq 1494 match src port eq 989
exit classifier Filenet
classifier Clearcase match dst port range 32768 32774
exit classifier Gnutella
classifier CommVault match dst port range 6346 6349
match dst port range 8400 8403 match dst port eq 6355
classifier Connected-DataProtector exit
match dst port eq 16384 classifier Grouper
classifier ControlIT exit
match dst port eq 799 classifier HP-OpenMail
classifier DNS match dst port eq 5757
classifier Danware-NetOp match dst port eq 5768

match dst port eq 5729 match dst port range 6660 6669
exit exit
classifier HP-OpenView classifier Intel-Proshare
match dst port range 7426 7431 match dst port range 5713 5717
match dst port eq 7510 classifier InterSystems-Cache
classifier HP-Radia exit
match dst port eq 3460 classifier Internet-Mail
classifier HTTP exit
match dst port eq 80 classifier Internet-Mail-secure
exit classifier Jabber
classifier HTTPS match dst port eq 5222
exit exit
classifier HotLine classifier Kazaa
exit exit
classifier IBM-DB2 classifier Kerberos
classifier IBM-NetView match dst port eq 754
classifier IBM-TSM match dst port eq 464
classifier IBM-Tivoli exit
match dst port eq 94 classifier L2TP
match dst port eq 1580 classifier LANDesk
exit match dst port range 9593 9595
classifier IPP exit
match dst port eq 631 classifier LDAP
classifier IRC match dst port eq 8404

classifier LDAP-Global-Catalog classifier MS-Content-Replication-Service
classifier LDAP-Global-Catalog-Secure exit
match dst port eq 3269 classifier MS-EndPointMapper
classifier LDAP-secure exit
match dst port eq 636 classifier MS-Message-Queuing
classifier Laplink-Host match dst port eq 2101
classifier Laplink-PCSync exit
match dst port eq 8444 classifier MS-NetMeeting
classifier Laplink-PCSync-secure match dst port eq 1503
exit exit
classifier Laplink-ShareDirect classifier MS-NetShow
exit exit
classifier Legato-NetWorker classifier MS-SQL
match dst port eq 7939 classifier MS-Terminal-Services
classifier Legato-RepliStor exit
match dst port eq 7144 classifier MSN-Messenger
classifier Liquid-Audio exit
match dst port eq 18888 classifier MySQL
classifier Lotus-Notes exit
match dst port eq 1352 classifier NFS
classifier Lotus-Sametime-Connect exit
match dst port eq 1533 classifier NNTP
classifier MDaemon exit
match dst port eq 3000 classifier NNTP-secure
exit exit
classifier MS-Chat classifier NTP
exit classifier Napster

match dst port eq 7777 classifier Oracle
exit classifier Other-Secure
classifier NetApp-SnapMirror match dst port eq 261
classifier NetIQ match dst port eq 695
classifier Netopia-Timbuktu match dst port eq 2482
classifier Netopia-netOctopus match dst port eq 2998
classifier Novell-Groupwise match dst port eq 3191
classifier Novell-NetWare match dst port eq 3864
classifier Novell-ZenWorks match dst port eq 3897
classifier OpenVPN match dst port eq 9802

exit exit
classifier PCAnywhere classifier SAP
match dst port range 5631 5632 match dst port range 3221 3224
classifier PCMail-Server match dst port range 3284 3305
classifier PDMWorks match dst port range 3600 3659
exit classifier SASL
classifier PPTP match dst port eq 3659
exit classifier SIP-secure
classifier Pervasive-SQL match dst port eq 5061
exit classifier SOAP
classifier PostgreSQL match dst port eq 7627
exit classifier SQL-Service
classifier ProjectWise-FileTransfer match dst port eq 156
exit classifier SSH
classifier QMTP match dst port eq 22
exit classifier SSL-Shell
classifier Qnext match dst port eq 614
match dst port eq 5555 classifier SUN-Xprint
classifier RAdmin exit
match dst port eq 4899 classifier Scalable-SQL
classifier RTSP exit
match dst port eq 554 classifier Service-Location
exit exit
classifier Remote-Anything classifier Siebel
classifier Remote-Replication-Agent match dst port eq 2321
exit classifier Simple-FTP
classifier Rsync match dst port eq 115

classifier SoulSeek match dst port eq 514
exit classifier VDOLive
classifier Sun-RPC match dst port eq 7000
exit classifier VNC
classifier Sybase-SQL match dst port range 5801 5809
match dst port eq 2439 classifier Veritas-BackupExec
classifier Symantec-AntiVirus match dst port eq 6106
match dst port eq 2968 classifier Veritas-NetBackup
classifier TACACS match dst port eq 13785
exit classifier Vmware-VMConsole
classifier TFTP match dst port eq 902
exit classifier VoIP-Control
classifier TFTPS match dst port eq 1300
classifier Telnet match dst port range 1718 1720
exit classifier VocalTec
classifier Telnets match dst port eq 1490
classifier UniSQL match dst port eq 22555
match dst port eq 1979 classifier WAAS-FlowMonitor
classifier Unix-Printing exit
match dst port eq 515 classifier WASTE
exit exit
classifier Unix-Remote-Execution classifier WBEM

match dst port eq 5987 name Remote-Desktop classifier Apple-NetAssistant action pass-
match dst port eq 5988 through
exit name Instant-Messaging classifier Apple-iChat action pass-
classifier WINS through
match dst port eq 42 name File-Transfer classifier BFTP action optimize full
match dst port eq 137 name Other classifier BGP action optimize full
match dst port eq 1512 name Systems-Management classifier BMC-Patrol action pass-
exit through
classifier WinMX name Backup classifier BackupExpress action optimize DRE no
match dst port eq 6699 compression none
exit name Other classifier Basic-TCP-services action pass-through
classifier X400 name P2P classifier BitTorrent action pass-through
match dst port eq 102 name SQL classifier Borland-Interbase action optimize full
exit name WAFS classifier CIFS action optimize full accelerate cifs
classifier XWindows name Conferencing classifier CU-SeeMe action pass-through
match dst port range 6000 6063 name Version-Management classifier CVS action optimize full
exit name Call-Management classifier Cisco-CallManager action pass-
classifier Yahoo-Messenger through
match dst port range 5000 5001 name Remote-Desktop classifier Citrix-ICA action optimize full
match dst port eq 5050 name Version-Management classifier Clearcase action optimize
match dst port eq 5100 full
exit name Backup classifier CommVault action optimize DRE no
classifier eDonkey compression none
match dst port range 4661 4662 name Backup classifier Connected-DataProtector action optimize
exit DRE no compression none
classifier ezMeeting name Remote-Desktop classifier ControlIT action optimize DRE
match dst port range 10101 10103 no compression none
match dst port range 26260 26261 name Name-Services classifier DNS action pass-through
exit name Remote-Desktop classifier Danware-NetOp action optimize
classifier iFCP DRE no compression none
match dst port eq 3420 name Content-Management classifier Documentum action optimize
exit full
classifier iSCSI name Replication classifier Double-Take action optimize full
match dst port eq 3260 name Replication classifier EMC-Celerra-Replicator action
exit optimize full
classifier iSNS name Storage classifier EMC-SRDFA-IP action optimize full
match dst port eq 3205 name Storage classifier FCIP action optimize full
exit name File-Transfer classifier FTP-Control action pass-through
map basic name File-Transfer classifier FTP-Data action optimize full
name File-System classifier AFS action optimize full name File-Transfer classifier FTPS action optimize DRE no
name Instant-Messaging classifier AOL action pass-through compression none
name Remote-Desktop classifier Altiris-CarbonCopy action pass- name File-Transfer classifier FTPS-Control action pass-through
through name Content-Management classifier Filenet action optimize
name Backup classifier Amanda action optimize DRE no full
compression none name P2P classifier Gnutella action pass-through
name Printing classifier AppSocket action optimize full name P2P classifier Grouper action pass-through
name File-System classifier Apple-AFP action optimize full name Email-and-Messaging classifier HP-OpenMail action

optimize full name Backup classifier Legato-RepliStor action optimize DRE no
name Systems-Management classifier HP-OpenView action pass- compression none
through name Streaming classifier Liquid-Audio action optimize full
name Systems-Management classifier HP-Radia action optimize name Email-and-Messaging classifier Lotus-Notes action
full optimize full
name Web classifier HTTP action optimize full accelerate http name Instant-Messaging classifier Lotus-Sametime-Connect
name SSL classifier HTTPS action optimize DRE no compression action pass-through
none name Email-and-Messaging classifier MDaemon action optimize
name P2P classifier HotLine action pass-through full
name SQL classifier IBM-DB2 action optimize full name Instant-Messaging classifier MS-Chat action pass-through
name Systems-Management classifier IBM-NetView action pass- name Replication classifier MS-Content-Replication-Service
through action optimize DRE no compression none
name Backup classifier IBM-TSM action optimize full name Other classifier MS-EndPointMapper action optimize DRE no
name Systems-Management classifier IBM-Tivoli action optimize compression none accelerate MS-port-mapper
full name Other classifier MS-Message-Queuing action optimize full
name Printing classifier IPP action optimize full name Conferencing classifier MS-NetMeeting action pass-through
name Conferencing classifier Intel-Proshare action pass- name Streaming classifier MS-NetShow action optimize full
through name SQL classifier MS-SQL action optimize full
name SQL classifier InterSystems-Cache action optimize full name Remote-Desktop classifier MS-Terminal-Services action
name Email-and-Messaging classifier Internet-Mail action optimize DRE no compression none
optimize full name Instant-Messaging classifier MSN-Messenger action pass-
name Email-and-Messaging classifier Internet-Mail-secure through
action optimize DRE no compression none name SQL classifier MySQL action optimize full
name Instant-Messaging classifier Jabber action pass-through name File-System classifier NFS action optimize full
name P2P classifier Kazaa action pass-through accelerate nfs
name Authentication classifier Kerberos action pass-through name Email-and-Messaging classifier NNTP action optimize full
name VPN classifier L2TP action optimize DRE no compression name Email-and-Messaging classifier NNTP-secure action
none optimize DRE no compression none
name Systems-Management classifier LANDesk action optimize name Other classifier NTP action pass-through
full name P2P classifier Napster action pass-through
name Directory-Services classifier LDAP action optimize full name Replication classifier NetApp-SnapMirror action optimize
name Directory-Services classifier LDAP-Global-Catalog action full
optimize full name Systems-Management classifier NetIQ action pass-through
name Directory-Services classifier LDAP-Global-Catalog-Secure name Remote-Desktop classifier Netopia-Timbuktu action
action pass-through optimize DRE no compression none
name Directory-Services classifier LDAP-secure action pass- name Systems-Management classifier Netopia-netOctopus action
through pass-through
name Remote-Desktop classifier Laplink-Host action optimize name Email-and-Messaging classifier Novell-Groupwise action
DRE no compression none optimize full
name Remote-Desktop classifier Laplink-PCSync action optimize name File-System classifier Novell-NetWare action optimize
DRE no compression none full
name Remote-Desktop classifier Laplink-PCSync-secure action name Systems-Management classifier Novell-ZenWorks action
optimize DRE no compression none optimize full
name P2P classifier Laplink-ShareDirect action pass-through name VPN classifier OpenVPN action optimize DRE no compression
name Backup classifier Legato-NetWorker action optimize DRE no none
compression none name SQL classifier Oracle action optimize full
name Other classifier Other-Secure action pass-through

name Remote-Desktop classifier PCAnywhere action optimize DRE name Printing classifier Unix-Printing action optimize full
no compression none name Console classifier Unix-Remote-Execution action pass-
name Email-and-Messaging classifier PCMail-Server action through
optimize full name Streaming classifier VDOLive action optimize full
name CAD classifier PDMWorks action optimize full name Backup classifier Veritas-BackupExec action optimize DRE
name VPN classifier PPTP action optimize DRE no compression no compression none
none name Backup classifier Veritas-NetBackup action optimize DRE
name SQL classifier Pervasive-SQL action optimize full no compression none
name SQL classifier PostgreSQL action optimize full name Remote-Desktop classifier Vmware-VMConsole action
name Content-Management classifier ProjectWise-FileTransfer optimize DRE no compression none
action optimize full name Call-Management classifier VoIP-Control action pass-
name Email-and-Messaging classifier QMTP action optimize full through
name P2P classifier Qnext action pass-through name Conferencing classifier VocalTec action pass-through
name Remote-Desktop classifier RAdmin action optimize DRE no name Systems-Management classifier WAAS-FlowMonitor action
compression none optimize DRE no compression LZ
name Streaming classifier RTSP action optimize full accelerate name P2P classifier WASTE action pass-through
video name Systems-Management classifier WBEM action pass-through
name Remote-Desktop classifier Remote-Anything action optimize name Name-Services classifier WINS action pass-through
DRE no compression none name P2P classifier WinMX action pass-through
name Replication classifier Remote-Replication-Agent action name Email-and-Messaging classifier X400 action optimize full
optimize DRE no compression none name Remote-Desktop classifier XWindows action optimize DRE no
name Replication classifier Rsync action optimize full compression none
name Authentication classifier SASL action pass-through name Instant-Messaging classifier Yahoo-Messenger action pass-
name Call-Management classifier SIP-secure action pass-through through
name Other classifier SOAP action optimize full name P2P classifier eDonkey action pass-through
name SQL classifier SQL-Service action optimize full name Conferencing classifier ezMeeting action pass-through
name SSH classifier SSH action optimize DRE no compression name Storage classifier iFCP action optimize full
none name Storage classifier iSCSI action optimize full
name Console classifier SSL-Shell action pass-through name Name-Services classifier iSNS action pass-through
name Printing classifier SUN-Xprint action optimize full name Instant-Messaging classifier IRC action pass-through
name SQL classifier Scalable-SQL action optimize full map adaptor WAFS transport
name Name-Services classifier Service-Location action pass- name WAFS All action optimize full
through exit
name Enterprise-Applications classifier Siebel action optimize map adaptor EPM 1544f5e0-613c-11d1-93df-00c04fd7bd09
full name Email-and-Messaging All action pass-through
name File-Transfer classifier Simple-FTP action optimize full exit
name P2P classifier SoulSeek action pass-through map adaptor EPM ms-sql-rpc
name File-System classifier Sun-RPC action pass-through name SQL All action optimize full
name SQL classifier Sybase-SQL action optimize full exit
name Other classifier Symantec-AntiVirus action optimize full map adaptor EPM mapi
name Authentication classifier TACACS action pass-through name Email-and-Messaging All action optimize full accelerate
name File-Transfer classifier TFTP action optimize full mapi
name File-Transfer classifier TFTPS action optimize DRE no exit
compression none map adaptor EPM ms-ad-replication
name Console classifier Telnet action pass-through name Replication All action optimize full
name Console classifier Telnets action pass-through exit
name SQL classifier UniSQL action optimize full map adaptor EPM ms-frs

name Replication All action optimize full ! ip path-mtu-discovery is disabled in WAAS by default
exit !
map adaptor EPM f5cc5a18-4264-101a-8c59-08002b2f8426 ip name-server 192.168.28.10
name Email-and-Messaging All action pass-through !
exit ntp server 192.168.31.2
map other optimize full !
exit wccp router-list 8 192.168.83.1
! wccp tcp-promiscuous router-list-num 8
central-manager address 192.168.28.100 wccp version 2
cms enable !
! username ****** password *******
! username ****** privilege 15
! End of WAAS configuration username ****** print-admin-password *******
!
!
NME-WAE 502 Branch Application Accelerator !
WAAS-BR3#sh run !
! WAAS version 4.1.5b (build b7 Oct 27 2009) authentication login local enable primary
! authentication configuration local enable primary
device mode application-accelerator !
! !
! policy-engine application
hostname WAAS-BR3 set-dscp copy
! name Authentication
clock timezone PST -8 0 name Backup
! name CAD
! name Call-Management
ip domain-name cisco.local name Conferencing
! name Console
! name Content-Management
primary-interface GigabitEthernet 1/0 name Directory-Services
! name Email-and-Messaging
interface GigabitEthernet 1/0 name Enterprise-Applications
ip address 192.168.83.2 255.255.255.0 name File-System
no autosense name File-Transfer
bandwidth 1000 name Instant-Messaging
full-duplex name Name-Services
exit name P2P
interface GigabitEthernet 2/0 name Printing
shutdown name Remote-Desktop
exit name Replication
! name SQL
! name SSH
ip default-gateway 192.168.83.1 name SSL
! name Storage
no auto-register enable name Streaming
! name Systems-Management

name VPN exit
name Version-Management classifier Basic-TCP-services
name WAFS match dst port range 1 19
name Web exit
name Other classifier BitTorrent
classifier AFS match dst port range 6881 6889
exit exit
classifier AOL classifier Borland-Interbase
exit exit
classifier Altiris-CarbonCopy classifier CIFS
classifier Amanda exit
match dst port eq 10080 classifier CU-SeeMe
classifier AppSocket match dst port eq 7642
classifier Apple-AFP exit
match dst port eq 548 classifier CVS
classifier Apple-NetAssistant exit
match dst port eq 3283 classifier Cisco-CallManager
classifier Apple-iChat match dst port eq 2443
match dst port eq 5298 classifier Citrix-ICA
classifier BFTP match dst port eq 2598
exit classifier Clearcase
classifier BGP match dst port eq 371
exit classifier CommVault
classifier BMC-Patrol match dst port range 8400 8403
match dst port eq 6162 classifier Connected-DataProtector
match dst port eq 6767 classifier ControlIT
exit classifier DNS
classifier BackupExpress match dst port eq 53

classifier Danware-NetOp match dst port eq 5768
exit exit
classifier Documentum classifier HP-OpenView
classifier Double-Take match dst port eq 7510
match dst port eq 1105 classifier HP-Radia
classifier EMC-Celerra-Replicator match dst port eq 3461
classifier EMC-SRDFA-IP exit
match dst port eq 1748 classifier HTTP
classifier FCIP match dst port eq 8080
classifier FTP-Control match dst port eq 3128
exit classifier HTTPS
classifier FTP-Data match dst port eq 443
match src port eq 20 exit
exit classifier HotLine
classifier FTPS match dst port range 5500 5503
exit classifier IBM-DB2
classifier FTPS-Control match dst port eq 523
match src port eq 989 exit
exit classifier IBM-NetView
classifier Filenet match dst port range 729 731
exit classifier IBM-TSM
classifier Gnutella match dst port range 1500 1502
match dst port eq 6355 classifier IBM-Tivoli
classifier Grouper match dst port eq 1965
classifier HP-OpenMail exit
match dst port eq 5755 classifier IPP
match dst port eq 5767 classifier IRC

match dst port range 6660 6669 classifier LDAP-Global-Catalog
classifier Intel-Proshare exit
match dst port range 5713 5717 classifier LDAP-Global-Catalog-Secure
classifier InterSystems-Cache exit
match dst port eq 1972 classifier LDAP-secure
classifier Internet-Mail exit
match dst port eq 25 classifier Laplink-Host
match dst port eq 220 classifier Laplink-PCSync
classifier Internet-Mail-secure exit
match dst port eq 995 classifier Laplink-PCSync-secure
exit classifier Laplink-ShareDirect
classifier Jabber match dst port eq 2705
match dst port eq 5269 classifier Legato-NetWorker
classifier Kazaa match dst port eq 7938
exit exit
classifier Kerberos classifier Legato-RepliStor
match dst port eq 888 classifier Liquid-Audio
match dst port eq 544 classifier Lotus-Notes
exit exit
classifier L2TP classifier Lotus-Sametime-Connect
exit exit
classifier LANDesk classifier MDaemon
exit exit
classifier LDAP classifier MS-Chat

exit classifier Napster
classifier MS-Content-Replication-Service match dst port eq 8875
classifier MS-EndPointMapper match dst port eq 6677
exit exit
classifier MS-Message-Queuing classifier NetApp-SnapMirror
match dst port eq 2103 classifier NetIQ
classifier MS-NetMeeting match dst port range 10113 10116
match dst port eq 1503 classifier Netopia-Timbuktu
classifier MS-NetShow exit
match dst port eq 1755 classifier Netopia-netOctopus
classifier MS-SQL match dst port eq 1921
exit classifier Novell-Groupwise
classifier MS-Terminal-Services match dst port eq 1677
classifier MSN-Messenger match dst port eq 7205
classifier MySQL match dst port eq 7101
classifier NFS exit
match dst port eq 2049 classifier Novell-NetWare
classifier NNTP exit
match dst port eq 119 classifier Novell-ZenWorks
classifier NNTP-secure match dst port eq 517
classifier NTP match dst port eq 2037
exit classifier OpenVPN

exit exit
classifier Oracle classifier PCAnywhere
exit exit
classifier Other-Secure classifier PCMail-Server
match dst port eq 684 classifier PDMWorks
match dst port eq 2478 classifier PPTP
match dst port eq 2484 classifier Pervasive-SQL
match dst port eq 2998 classifier PostgreSQL
match dst port eq 3183 classifier ProjectWise-FileTransfer
match dst port eq 3410 classifier QMTP
match dst port eq 3496 classifier Qnext
match dst port eq 3660 classifier RAdmin
match dst port eq 3864 classifier RTSP
match dst port eq 3995 classifier Remote-Anything
match dst port eq 5989 classifier Remote-Replication-Agent
match dst port eq 9802 classifier Rsync

exit classifier SoulSeek
classifier SAP match dst port eq 2234
match dst port range 3226 3267 classifier Sun-RPC
match dst port range 3307 3388 classifier Sybase-SQL
classifier SASL exit
match dst port eq 3659 classifier Symantec-AntiVirus
classifier SIP-secure match dst port eq 2848
classifier SOAP match dst port eq 38037
exit exit
classifier SQL-Service classifier TACACS
exit exit
classifier SSH classifier TFTP
exit exit
classifier SSL-Shell classifier TFTPS
exit exit
classifier SUN-Xprint classifier Telnet
classifier Scalable-SQL match dst port eq 513
exit classifier Telnets
classifier Service-Location match dst port eq 992
exit classifier UniSQL
classifier Siebel match dst port eq 1978
match dst port eq 2321 classifier Unix-Printing
classifier Simple-FTP match dst port eq 170

classifier Unix-Remote-Execution classifier WBEM
exit exit
classifier VDOLive classifier WINS
classifier VNC match dst port eq 1512
match dst port range 6900 6909 classifier WinMX
classifier Veritas-BackupExec exit
match dst port eq 6101 classifier X400
match dst port eq 3527 classifier XWindows
exit exit
classifier Veritas-NetBackup classifier Yahoo-Messenger
exit classifier eDonkey
classifier Vmware-VMConsole match dst port range 4661 4662
exit classifier ezMeeting
classifier VoIP-Control match dst port range 10101 10103
match dst port range 2000 2002 classifier iFCP
match dst port range 11000 11999 classifier iSCSI
classifier VocalTec exit
match dst port eq 1490 classifier iSNS
match dst port eq 22555 map basic
exit name File-System classifier AFS action optimize full
classifier WAAS-FlowMonitor name Instant-Messaging classifier AOL action pass-through
match dst port eq 7878 name Remote-Desktop classifier Altiris-CarbonCopy action pass-
exit through
classifier WASTE name Backup classifier Amanda action optimize DRE no
match dst port eq 1337 compression none
exit

name Printing classifier AppSocket action optimize full name P2P classifier Gnutella action pass-through
name File-System classifier Apple-AFP action optimize full name P2P classifier Grouper action pass-through
name Remote-Desktop classifier Apple-NetAssistant action pass- name Email-and-Messaging classifier HP-OpenMail action
through optimize full
name Instant-Messaging classifier Apple-iChat action pass- name Systems-Management classifier HP-OpenView action pass-
through through
name File-Transfer classifier BFTP action optimize full name Systems-Management classifier HP-Radia action optimize
name Other classifier BGP action optimize full full
name Systems-Management classifier BMC-Patrol action pass- name Web classifier HTTP action optimize full accelerate http
through name SSL classifier HTTPS action optimize DRE no compression
name Backup classifier BackupExpress action optimize DRE no none
compression none name P2P classifier HotLine action pass-through
name Other classifier Basic-TCP-services action pass-through name SQL classifier IBM-DB2 action optimize full
name P2P classifier BitTorrent action pass-through name Systems-Management classifier IBM-NetView action pass-
name SQL classifier Borland-Interbase action optimize full through
name WAFS classifier CIFS action optimize full accelerate cifs name Backup classifier IBM-TSM action optimize full
name Conferencing classifier CU-SeeMe action pass-through name Systems-Management classifier IBM-Tivoli action optimize
name Version-Management classifier CVS action optimize full full
name Call-Management classifier Cisco-CallManager action pass- name Printing classifier IPP action optimize full
through name Conferencing classifier Intel-Proshare action pass-
name Remote-Desktop classifier Citrix-ICA action optimize full through
name Version-Management classifier Clearcase action optimize name SQL classifier InterSystems-Cache action optimize full
full name Email-and-Messaging classifier Internet-Mail action
name Backup classifier CommVault action optimize DRE no optimize full
compression none name Email-and-Messaging classifier Internet-Mail-secure
name Backup classifier Connected-DataProtector action optimize action optimize DRE no compression none
DRE no compression none name Instant-Messaging classifier Jabber action pass-through
name Remote-Desktop classifier ControlIT action optimize DRE name P2P classifier Kazaa action pass-through
no compression none name Authentication classifier Kerberos action pass-through
name Name-Services classifier DNS action pass-through name VPN classifier L2TP action optimize DRE no compression
name Remote-Desktop classifier Danware-NetOp action optimize none
DRE no compression none name Systems-Management classifier LANDesk action optimize
name Content-Management classifier Documentum action optimize full
full name Directory-Services classifier LDAP action optimize full
name Replication classifier Double-Take action optimize full name Directory-Services classifier LDAP-Global-Catalog action
name Replication classifier EMC-Celerra-Replicator action optimize full
optimize full name Directory-Services classifier LDAP-Global-Catalog-Secure
name Storage classifier EMC-SRDFA-IP action optimize full action pass-through
name Storage classifier FCIP action optimize full name Directory-Services classifier LDAP-secure action pass-
name File-Transfer classifier FTP-Control action pass-through through
name File-Transfer classifier FTP-Data action optimize full name Remote-Desktop classifier Laplink-Host action optimize
name File-Transfer classifier FTPS action optimize DRE no DRE no compression none
compression none name Remote-Desktop classifier Laplink-PCSync action optimize
name File-Transfer classifier FTPS-Control action pass-through DRE no compression none
name Content-Management classifier Filenet action optimize name Remote-Desktop classifier Laplink-PCSync-secure action
full optimize DRE no compression none

name P2P classifier Laplink-ShareDirect action pass-through name VPN classifier OpenVPN action optimize DRE no compression
name Backup classifier Legato-NetWorker action optimize DRE no none
compression none name SQL classifier Oracle action optimize full
name Backup classifier Legato-RepliStor action optimize DRE no name Other classifier Other-Secure action pass-through
compression none name Remote-Desktop classifier PCAnywhere action optimize DRE
name Streaming classifier Liquid-Audio action optimize full no compression none
name Email-and-Messaging classifier Lotus-Notes action name Email-and-Messaging classifier PCMail-Server action
optimize full optimize full
name Instant-Messaging classifier Lotus-Sametime-Connect name CAD classifier PDMWorks action optimize full
action pass-through name VPN classifier PPTP action optimize DRE no compression
name Email-and-Messaging classifier MDaemon action optimize none
full name SQL classifier Pervasive-SQL action optimize full
name Instant-Messaging classifier MS-Chat action pass-through name SQL classifier PostgreSQL action optimize full
name Replication classifier MS-Content-Replication-Service name Content-Management classifier ProjectWise-FileTransfer
action optimize DRE no compression none action optimize full
name Other classifier MS-EndPointMapper action optimize DRE no name Email-and-Messaging classifier QMTP action optimize full
compression none accelerate MS-port-mapper name P2P classifier Qnext action pass-through
name Other classifier MS-Message-Queuing action optimize full name Remote-Desktop classifier RAdmin action optimize DRE no
name Conferencing classifier MS-NetMeeting action pass-through compression none
name Streaming classifier MS-NetShow action optimize full name Streaming classifier RTSP action optimize full accelerate
name SQL classifier MS-SQL action optimize full video
name Remote-Desktop classifier MS-Terminal-Services action name Remote-Desktop classifier Remote-Anything action optimize
optimize DRE no compression none DRE no compression none
name Instant-Messaging classifier MSN-Messenger action pass- name Replication classifier Remote-Replication-Agent action
through optimize DRE no compression none
name SQL classifier MySQL action optimize full name Replication classifier Rsync action optimize full
name File-System classifier NFS action optimize full name Authentication classifier SASL action pass-through
accelerate nfs name Call-Management classifier SIP-secure action pass-through
name Email-and-Messaging classifier NNTP action optimize full name Other classifier SOAP action optimize full
name Email-and-Messaging classifier NNTP-secure action name SQL classifier SQL-Service action optimize full
optimize DRE no compression none name SSH classifier SSH action optimize DRE no compression
name Other classifier NTP action pass-through none
name P2P classifier Napster action pass-through name Console classifier SSL-Shell action pass-through
name Replication classifier NetApp-SnapMirror action optimize name Printing classifier SUN-Xprint action optimize full
full name SQL classifier Scalable-SQL action optimize full
name Systems-Management classifier NetIQ action pass-through name Name-Services classifier Service-Location action pass-
name Remote-Desktop classifier Netopia-Timbuktu action through
optimize DRE no compression none name Enterprise-Applications classifier Siebel action optimize
name Systems-Management classifier Netopia-netOctopus action full
pass-through name File-Transfer classifier Simple-FTP action optimize full
name Email-and-Messaging classifier Novell-Groupwise action name P2P classifier SoulSeek action pass-through
optimize full name File-System classifier Sun-RPC action pass-through
name File-System classifier Novell-NetWare action optimize name SQL classifier Sybase-SQL action optimize full
full name Other classifier Symantec-AntiVirus action optimize full
name Systems-Management classifier Novell-ZenWorks action name Authentication classifier TACACS action pass-through
optimize full name File-Transfer classifier TFTP action optimize full

name File-Transfer classifier TFTPS action optimize DRE no exit
compression none map adaptor EPM mapi
name Console classifier Telnet action pass-through name Email-and-Messaging All action optimize full accelerate
name Console classifier Telnets action pass-through mapi
name SQL classifier UniSQL action optimize full exit
name Printing classifier Unix-Printing action optimize full map adaptor EPM ms-ad-replication
name Console classifier Unix-Remote-Execution action pass- name Replication All action optimize full
through exit
name Streaming classifier VDOLive action optimize full map adaptor EPM ms-frs
name Backup classifier Veritas-BackupExec action optimize DRE name Replication All action optimize full
no compression none exit
name Backup classifier Veritas-NetBackup action optimize DRE map adaptor EPM f5cc5a18-4264-101a-8c59-08002b2f8426
no compression none name Email-and-Messaging All action pass-through
name Remote-Desktop classifier Vmware-VMConsole action exit
optimize DRE no compression none map other optimize full
name Call-Management classifier VoIP-Control action pass- exit
through !
name Conferencing classifier VocalTec action pass-through central-manager address 192.168.28.100
name Systems-Management classifier WAAS-FlowMonitor action cms enable
optimize DRE no compression LZ !
name P2P classifier WASTE action pass-through ! End of WAAS configuration
name Systems-Management classifier WBEM action pass-through
name Name-Services classifier WINS action pass-through
name P2P classifier WinMX action pass-through
name Email-and-Messaging classifier X400 action optimize full
name Remote-Desktop classifier XWindows action optimize DRE no
compression none
name Instant-Messaging classifier Yahoo-Messenger action pass-
through
name P2P classifier eDonkey action pass-through
name Conferencing classifier ezMeeting action pass-through
name Storage classifier iFCP action optimize full
name Storage classifier iSCSI action optimize full
name Name-Services classifier iSNS action pass-through
name Instant-Messaging classifier IRC action pass-through
name Enterprise-Applications classifier SAP action optimize
full
name Remote-Desktop classifier VNC action optimize DRE no
compression none exit
map adaptor WAFS transport
name WAFS All action optimize full
exit
map adaptor EPM 1544f5e0-613c-11d1-93df-00c04fd7bd09
name Email-and-Messaging All action pass-through
exit
map adaptor EPM ms-sql-rpc
name SQL All action optimize full
Resilient Server Design 72

Resilient Server Design
3 match protocol icmp any
4 match protocol telnet any
5 match protocol ssh any
6 match protocol http any
7 match protocol https any
8 match protocol snmp any
policy-map type management first-match remote_mgmt_allow_
Application Control Engine 4710 Primary Data Center policy
boot system image:c4710ace-mz.A3_2_2.bin class remote_access
hostname ace-4710-1 permit
interface gigabitEthernet 1/1 policy-map type loadbalance first-match http-vip-l7slb
channel-group 1 class class-default
no shutdown serverfarm webserver-farm
interface gigabitEthernet 1/2 policy-map multi-match int24
channel-group 1 class http-vip
no shutdown loadbalance vip inservice
interface gigabitEthernet 1/3 loadbalance policy http-vip-l7slb
shutdown loadbalance vip icmp-reply active
interface gigabitEthernet 1/4 nat dynamic 1 vlan 24
shutdown interface vlan 24
interface port-channel 1 ip address 192.168.24.2 255.255.255.0
switchport trunk allowed vlan 1,24 access-group input ALL
no shutdown nat-pool 1 192.168.24.99 192.168.24.99 netmask 255.255.255.0
pat
access-list ALL line 8 extended permit ip any any service-policy input remote_mgmt_allow_policy
probe http basic-http-get service-policy input int24
interval 15 no shutdown
passdetect interval 60 ip route 0.0.0.0 0.0.0.0 192.168.24.1
request method head snmp-server community public group Network-Monitor
open 1
rserver host webserver1 username ****** password 5 ******** role Admin domain
ip address 192.168.24.12 default-domain
inservice username www password 5 ******* role Admin domain default-
rserver host webserver2 domain
ip address 192.168.24.13
inservice
serverfarm host webfarm

probe basic-http-get
serverfarm host webserver-farm
rserver webserver1 80
inservice
rserver webserver2 80
class-map match-all http-vip
2 match virtual-address 192.168.24.100 tcp eq www
class-map type management match-any remote_access
2 match protocol xml-https any
Appendix A: Data Center for Midsize Agencies Product List 73

Appendix A:
Data Center for Midsize Agencies Product List
Functional Area Product Part Numbers Software Version

Virtualized Storage MDS9124 DS-C9134-K9 3.3(2)
MDS9134 DS-C9124-K9 4.1(1c)
4Gig SFP DS-SFP-FC4G-SW
DC Switching Catalyst 3750G WS-C3750G-24TS-S1U 12.2-40.SE
Nexus 5010 N5K-C5010P-BF 4.1.(3)
Nexus 2148T N2K-C2148T-1GE 4.1(3)
Application Services Application Control Engine (ACE) 4710 ACE-4710-0.5F-K9 A3.2.2
Appliance
Application Services Wide- Area HQ CM WAAS Appliance WAVE-274-K9 All use 4.1.3b
Application Services (WAAS)
HQ AA WAAS Appliance WAVE-574-K9
Remote Site WAAS Network Module NME-WAE-502-K9
Wireless Wireless LAN Controller 5508 AIR-CT5508-100-K9 AIR-CT5500- K9-6-0-188-0.aes
Wireless Access Points 1140 Fixed with Internal Antennas AIR-LAP1142N (Country-specific) Controller-Based Software
1250 Ruggedized, External Ant. AIR-LAP1252AG (Country-specific)
Security HQ Site
2x ASA5540 w/ ASA-SSM-40 ASA5540-AIP40-K8 ASA software: 8.2.2
DR Site IPS software: 7.0.2E3
2x ASA5580-20 ASA5580-20-8GE-K8
2x IPS-4260-K9 PS-4260-K9
Appendix B: SBA for Midsize Agencies Document System 74

Appendix B:
SBA for Midsize Agencies Document System
Design Guides Deployment Guides Supplemental Guides
Design Overview
Data Center Advanced Server
Deployment Guide Load Balancing
You are Here Data Center NetApp Storage

Configuration Guide Deployment Guide
Network Management Unified Computing

Guides Deployment Guide
SolarWinds Network
Management Guide
ScienceLogic Network
Management Guide
75
Americas Headquarters Asia Pacific Headquarters Europe Headquarters
Cisco Systems, Inc. Cisco Systems (USA) Pte. Ltd. Cisco Systems International BV
San Jose, CA Singapore Amsterdam, The Netherlands
Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco Website at www.cisco.com/go/offices.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of
the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
C07-641156-00 12/10

Data Center Configuration Guide

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Data Center Configuration Guide

Încărcat de

Drepturi de autor:

Formate disponibile

Data Center

Design Guides Deployment Guides Supplemental Guides

Data Center You are Here

The Purpose of this Guide

Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Resilient WAN Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Nexus 5K Primary Data Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 ISR 2811 Branch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Fibre Channel Data Center Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Resilient WAN Optimization Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

MDS 9134 Disaster Recovery Data Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Resilient Server Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Ethernet Data Center Design 2

Center Design mls qos srr-queue input threshold 1 8 16

Ethernet Data Center Design 3

Ethernet Data Center Design 4

Ethernet Data Center Design 5

Ethernet Data Center Design 6

Ethernet Data Center Design 7

Ethernet Data Center Design 8

Ethernet Data Center Design 9

Ethernet Data Center Design 10

Ethernet Data Center Design 11

Ethernet Data Center Design 12

Ethernet Data Center Design 13

Ethernet Data Center Design 14

Ethernet Data Center Design 15

Ethernet Data Center Design 16

Ethernet Data Center Design 17

Ethernet Data Center Design 18

Fibre Channel Data Center Design 19

Center Design ! [esx4-hba0-a]

Fibre Channel Data Center Design 20

Fibre Channel Data Center Design 21

Fibre Channel Data Center Design 22

Fibre Channel Data Center Design 23

Fibre Channel Data Center Design 24

Fibre Channel Data Center Design 25

Fibre Channel Data Center Design 26

Security Data Center Design 27

Center Design nameif outside

Security Data Center Design 28

Security Data Center Design 29

Security Data Center Design 30

Security Data Center Design 31

Security Data Center Design 32

Security Data Center Design 33

Security Data Center Design 34

Security Data Center Design 35

Security Data Center Design 36

Security Data Center Design 37

Security Data Center Design 38

Security Data Center Design 39

Resilient WAN Design 40

Resilient WAN Design 41

Resilient WAN Design 42

Resilient WAN Design 43

Resilient WAN Design 44

Resilient WAN Design 45

Resilient WAN Optimization 46

Resilient WAN Design 47

Resilient WAN Design 48

Resilient Server Design 49

Resilient WAN Optimization Design 50

Optimization Design cms enable

WAAS WAVE 574 DC Application Accelerator

Resilient WAN Optimization Design 51

Resilient WAN Optimization Design 52