HamWAN Remote Site - Revision history

Bryan: /* Operational thoughts/gotchas */

2022-11-29T21:05:49Z

Operational thoughts/gotchas

Bryan: /* Spoke */

2022-04-13T04:10:30Z

Spoke

Bryan: Fucked up a commit, editing in two places.

2022-04-10T19:10:17Z

Fucked up a commit, editing in two places.

Bryan at 19:08, 10 April 2022

2022-04-10T19:08:15Z

Bryan: /* Spoke */

2022-04-09T18:53:15Z

Spoke

Bryan at 01:10, 9 April 2022

2022-04-09T01:10:51Z

Bryan: /* Spoke */

2022-04-09T00:57:34Z

Spoke

Bryan: /* Spoke */

2022-04-09T00:53:10Z

Spoke

Bryan: /* General management */

2022-04-09T00:08:34Z

General management

Bryan: /* Thoughts on Hardware */

2022-04-09T00:07:38Z

Thoughts on Hardware

@@ Line 105: / Line 105: @@
 * ISPEC is used as a nat translation device, primarialy
 * only one spoke will work per tunnel behind a single IP, even through nat.
 We may be well served to configure an inbound VRF on the hub router only for inbound VPN clients to connect to.  Any traffic would then be on a different port out to the HamWAN.
 * IPSEC + Xauth could be added or even SSL VPN for end user access.
 = Configs =

@@ Line 76: / Line 76: @@
 [https://www.cisco.com/c/en/us/td/docs/routers/access/interfaces/software/feature/guide/eesm_sw.html For the local switch breakout there are several options]:
-  [https://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/datasheet-c78-730357.html SM-X-ES3-24-P]   - Based on a 3560X switch - "SM-X-ES3-24-P: EtherSwitch SM L3 + PoEPlus + MACSec + 24 10/100/1000"
+  [https://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/datasheet-c78-730357.html SM-X-ES3-24-P]  - Based on a 3560X switch - "SM-X-ES3-24-P: EtherSwitch SM L3 + PoEPlus + MACSec + 24 10/100/1000"
   SM-ES3G-24-P—24 - Based on a 3560e Switch - "SM-ES3G-24-P: EtherSwitch SM L3 + POE + 24 10/100/1000"
   SM-ES3-24-P—23  - Based on the 3560       - "SM-ES3G-24-P: EtherSwitch SM L2 + POE + 24 10/100/1000"

@@ Line 65: / Line 65: @@
 The decision here was made to go with the Cisco 2921 or 2951 routers.  There is not much performance difference in these, but they are limited to 85mbit/s of IPSEC unless they have the HSEC/K9 license AND the ISM-VPN-29 crypto accelerator module.  This is known as the "CISCO2951-HSEC+/K9" bundle.  Also if you intend to run the POE switch module a special power supply "PWR-2921-51-POE" is required.  This this supply supplies 48v in addition to the standard 12v and 5v voltages of the standard supply.
-In testing we found the 2921 with the HSEC/K9 license would do about 150 Mbit/s of realized throughput using http://fast.com for speed tests with out the ISM-VPN-29 module.  Without the HSEC/K9 license it would cap at 65 Mbit/s.  Bear in mind this is traffic over the VPN connection so we expect a 20% overhead or so due to encapsulation.
+In testing we found the 2921 with the HSEC/K9 license would do about 150 Mbit/s of realized throughput using http://fast.com for speed tests with out the ISM-VPN-29 module.  Without the HSEC/K9 license it would cap at 65 Mbit/s.  Bear in mind this is traffic over the VPN connection so we expect a 20% overhead or so due to encapsulation.    We also tested a 3945e as a spoke router and saw 700 mbit/s, over a 750 mbit/s PON connection, and was likely limited by it.  Considering the 100-150 dollar price for a 3945e on eBay, this is great performance.
 <gallery heights=300px widths=400px mode="packed">
-mbit.png|2921 performance prior to hsec/k9 license
+mbit.png|2921 performance prior to HSEC/K9 license
-mbit.png|2921 performance after hsec/k9 license
+mbit.png|2921 performance after HSEC/K9 license
 </gallery>
@@ Line 107: / Line 108: @@
 We may be well served to configure an inbound VRF on the hub router only for inbound VPN clients to connect to.  Any traffic would then be on a different port out to the HamWAN.
 * IPSEC + Xauth could be added or even SSL VPN for end user access.

@@ Line 65: / Line 65: @@
 The decision here was made to go with the Cisco 2921 or 2951 routers.  There is not much performance difference in these, but they are limited to 85mbit/s of IPSEC unless they have the HSEC/K9 license AND the ISM-VPN-29 crypto accelerator module.  This is known as the "CISCO2951-HSEC+/K9" bundle.  Also if you intend to run the POE switch module a special power supply "PWR-2921-51-POE" is required.  This this supply supplies 48v in addition to the standard 12v and 5v voltages of the standard supply.
-In testing we found the 2921 with the HSEC/K9 license would do about 150 Mbit/s of realized throughput using http://fast.com for speed tests with out the ISM-VPN-29 module.  Without the HSEC/K9 license it would cap at 65 Mbit/s.  Bear in mind this is traffic over the VPN connection so we expect a 20% overhead or so due to encapsulation.    We also tested a 3945e as a spoke router and saw 700 mbit/s, over a 750 mbit/s PON connection, and was likely limited by it.  Considering the 100-150 dollar price for a 3945e on eBay, this is great performance.
+In testing we found the 2921 with the HSEC/K9 license would do about 150 Mbit/s of realized throughput using http://fast.com for speed tests with out the ISM-VPN-29 module.  Without the HSEC/K9 license it would cap at 65 Mbit/s.  Bear in mind this is traffic over the VPN connection so we expect a 20% overhead or so due to encapsulation.
 <gallery heights=300px widths=400px mode="packed">
-mbit.png|2921 performance prior to HSEC/K9 license
+mbit.png|2921 performance prior to hsec/k9 license
-mbit.png|2921 performance after HSEC/K9 license
+mbit.png|2921 performance after hsec/k9 license
 </gallery>
@@ Line 98: / Line 97: @@
 [https://team-cymru.com/community-services/templates/secure-bgp-template/ Team CYMRU's Secure BGP Template] is a worth a review too.
 = Configs =

@@ Line 65: / Line 65: @@
 The decision here was made to go with the Cisco 2921 or 2951 routers.  There is not much performance difference in these, but they are limited to 85mbit/s of IPSEC unless they have the HSEC/K9 license AND the ISM-VPN-29 crypto accelerator module.  This is known as the "CISCO2951-HSEC+/K9" bundle.  Also if you intend to run the POE switch module a special power supply "PWR-2921-51-POE" is required.  This this supply supplies 48v in addition to the standard 12v and 5v voltages of the standard supply.
-In testing we found the 2921 with the HSEC/K9 license would do about 150 Mbit/s of realized throughput using http://fast.com for speed tests with out the ISM-VPN-29 module.  Without the HSEC/K9 license it would cap at 65 Mbit/s.  Bear in mind this is traffic over the VPN connection so we expect a 20% overhead or so due to encapsulation.
+In testing we found the 2921 with the HSEC/K9 license would do about 150 Mbit/s of realized throughput using http://fast.com for speed tests with out the ISM-VPN-29 module.  Without the HSEC/K9 license it would cap at 65 Mbit/s.  Bear in mind this is traffic over the VPN connection so we expect a 20% overhead or so due to encapsulation.    We also tested a 3945e as a spoke router and saw 700 mbit/s, over a 750 mbit/s PON connection, and was likely limited by it.  Considering the 100-150 dollar price for a 3945e on eBay, this is great performance.
 <gallery heights=300px widths=400px mode="packed">
-mbit.png|2921 performance prior to hsec/k9 license
+mbit.png|2921 performance prior to HSEC/K9 license
-mbit.png|2921 performance after hsec/k9 license
+mbit.png|2921 performance after HSEC/K9 license
 </gallery>

← Older revision		Revision as of 01:10, 9 April 2022
Line 1:		Line 1:
		+	[[Category:HamWAN]]
		+
	It's become a need for HamWAN to expand over existing internet links, as a backup and in areas we cannot hit with radio. This has shown a need at some of our other radio sites across the state, and in many cases where we can't get a good internet connection unless via restrictive NAT.		It's become a need for HamWAN to expand over existing internet links, as a backup and in areas we cannot hit with radio. This has shown a need at some of our other radio sites across the state, and in many cases where we can't get a good internet connection unless via restrictive NAT.

@@ Line 65: / Line 65: @@
 In testing we found the 2921 with the HSEC/K9 license would do about 150 Mbit/s of realized throughput using http://fast.com for speed tests with out the ISM-VPN-29 module.  Without the HSEC/K9 license it would cap at 65 Mbit/s.  Bear in mind this is traffic over the VPN connection so we expect a 20% overhead or so due to encapsulation.
 [https://www.cisco.com/c/en/us/td/docs/routers/access/interfaces/software/feature/guide/eesm_sw.html For the local switch breakout there are several options]:
@@ Line 73: / Line 79: @@
   SM-ES2-24-P     - L2 only 2960sm based    - "SM-ES2-24-P: EtherSwitch SM L2 + PoE + 23 10/100 + 1 10/100/1000"
 There are other switch modules, but these are the most popular.  In our case we're running the SM-ES2-24-P as we don't require layer 3 on the switch but do require POE.  These are managed on their own IP and boot their own IOS.  They have two virtual 1g interfaces which interconnect with the router via the backplane and trunk to the switch.  This way a Vlan73 on the router will correspond to vlan 73 on the switch.
 = General management =

@@ Line 87: / Line 87: @@
 This is reflected in the configuration below, but further setup is left to the implementation here.
-[[https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html|Cisco has a good document on secure configuration practices that you should review.]]
+[https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html Cisco has a good document on secure configuration practices that you should review.]
 [https://team-cymru.com/community-services/templates/secure-bgp-template/ Team CYMRU's Secure BGP Template] is a worth a review too.
 = Configs =

← Older revision		Revision as of 00:07, 9 April 2022
Line 24:		Line 24:

	[https://www.cisco.com/c/en/us/td/docs/routers/access/2900/hardware/installation/guide/Hardware_Installation_Guide/Overview.html Here is a link to the hardware overview of the routers]		[https://www.cisco.com/c/en/us/td/docs/routers/access/2900/hardware/installation/guide/Hardware_Installation_Guide/Overview.html Here is a link to the hardware overview of the routers]
		+
		+	<gallery mode=packed-hover widths=350px heights=300px>
		+	3845e in rack.jpg\| Cisco 3945e
		+	2921 in rack.jpg\|Cisco 2921
		+	3845e skinless.png\|"skinless" 3545e testing doublewide card in bottom slot.
		+	</Gallery>

	= Hub =		= Hub =