Re: Verizon FiOS Distribution Switch
Not that this is a requirement, but good practice none the less with this setup... Turn off cdp on the port facing the LEC... -graham ----- Reply message ----- From: "Chris Burwell" <cburwell@gmail.com> Date: Wed, Jan 19, 2011 2:56 pm Subject: Verizon FiOS Distribution Switch To: "NANOG" <nanog@nanog.org> I have a question about a Verizon FiOS business connection with an ethernet hand off and I am hoping that someone out there has done the same thing. We have a FiOS business connection coming into our building. This includes an Ethernet hand off into the usual Actiontec router as well as a block of 13 public IP addresses. The Actiontec router needs to remain in place with its current Public IP address. We have some devices from a vendor plugged into it for Internet access, as well as numerous cable boxes across the building that get their guide information through the coax interface on the router. What we want to do is take the ethernet hand off out of the WAN (RJ-45) interface on the Actiontec router and plug it into a hardened Cisco switch such as a 2950. Our goal here is to use the Cisco switch as a Internet distribution switch since we will have numerous test devices that will need to have a direct connection to the Internet. Our preference is also not to have all of the traffic from these other devices traverse the Actiontec router. I have a few concerns with this setup: Some articles I have read indicate that the hand off from the Verizon ONT may not be a direct Ethernet hand off so the interface it connects to may require a different config (Dialer or something). I am also concerned about any issues if the ONT or some down stream Verizon device may cause if it sees multiple MAC addresses coming across our link. We're not trying to cheat the system or anything, just to modify the Verizon setup to better suit our needs. Any advice or tips would be helpful. - Chris
On 01/19/2011 01:28 PM, GP Wooden wrote:
Not that this is a requirement, but good practice none the less with this setup... Turn off cdp on the port facing the LEC...
+1 also add 'nonegotiate' and turn off spanning tree on the port while you're at it. There's a list somewhere of standard stuff when connecting to an untrusted l2 network, which is what you should treat anything (including FiOS) connecting to you that you don't own.
On 1/19/11 3:56 PM, "Chris Burwell" <cburwell@gmail.com> wrote:
Any advice or tips would be helpful.
If all you need the ActionTek for is a MoCA bridge (to make the cable boxes talk to the larger world), my experience is you can move it to the inside of your NAT if you like. One does not need to burn a routable IP for it. On 1/19/11 5:25 PM, "Mike" <mike-nanog@tiedyenetworks.com> wrote:
also add 'nonegotiate' and turn off spanning tree on the port while you're at it. There's a list somewhere of standard stuff when connecting to an untrusted l2 network, which is what you should treat anything (including FiOS) connecting to you that you don't own.
Nonegotiate doesn't touch STP. It stops the switchport from sending DTP frames, but one wouldn't be attempting to establish a trunk to a FiOS ONT. http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/1 2.1_11_ea1/command/reference/cli2.html#wpmkr3005909 To stop a port from participating in spanning tree, one would want some combination of global and interface bpduguard and bpdufilter. Which combination you want seems to vary with every Cisco Press book and document, and every engineer has a different idea of which is correct. One is best off labbing it out themselves with the equipment they intend to use. -porkchop -- Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295 Your wireless success, nothing less. http://www.tessco.com/
participants (3)
-
GP Wooden
-
Kaegler, Mike
-
Mike