<div dir="ltr">I have, on occasion built a Windows AD server on my offline network to impersonate one of the production servers for LDAP authentication, DNS, DHCP, etc. You don't really need all of the user objects, you really just need user objects you need to test with, so I normally create a few user objects like the ldap bind account, and a few others just to test admin access, jabber login, uccx agent login via AXL. As long as an LDAP sync doesn't run, I've never run into issues doing this.<div><br></div><div>For route/switch, I normally add a new vSwitch to the ESXi host, add vNICs for the required VLANs, deploy the CSR-1000v OVA with one interface assigned to the isolated network and another assigned to an interface on another vSwitch or vNIC for production connectivity. NAT and NTP are performed on the CSR-1000v.<br><div><br></div><div>I've also done everything completely on an isolated network very minimally using Hanewin DNS server and NTP/DHCP/NAT on the CSR-1000v.</div></div><div><br></div><div>From a routing standpoint, I usually use host routes, no default route, no routing protocols and strict ACLs.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jul 19, 2017 at 1:28 PM, Lelio Fulgenzi <span dir="ltr"><<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
A while back we had a good discussion about offline network upgrade preparation. A few people mentioned using NAT/PAT in order to connect to servers that would be too difficult to replicate in the off-line network.<br>
<br>
I'm trying to get my head around this and thought I'd share this simplified plan that I want to start off with.<br>
<br>
In the offline network we have:<br>
<br>
<br>
* a layer 3 switch that does the routing for the offline network<br>
<br>
* a router which does some other tasks like NTP, DHCP, etc.<br>
<br>
* layer 3 switch is connected to router<br>
<br>
Here's what I envision:<br>
<br>
<br>
* connect the router to a public network, i.e. network 45<br>
<br>
* configure NAT/PAT on the router so that all the inside networks (on the switch) are patted using the public network address<br>
<br>
* configure static routes on the router for all inside networks (on the switch) pointing to the switch<br>
<br>
* configure static routes on the router for specific outside networks pointing network 45 gw<br>
<br>
* configure static routes on the switch for specific outside networks pointing to the router interface<br>
<br>
The biggest issue here is that we have replicated many of our public networks in this offline network and there can't be any chance of that leaking.<br>
<br>
But I'm pretty sure this would prevent that.<br>
<br>
Thoughts? Gotchas?<br>
<br>
Lelio<br>
<br>
---<br>
Lelio Fulgenzi, B.A.<br>
Senior Analyst, Network Infrastructure<br>
Computing and Communications Services (CCS)<br>
University of Guelph<br>
<br>
<a href="tel:519-824-4120%20Ext%2056354" value="+15198244120">519-824-4120 Ext 56354</a><br>
<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a><br>
<a href="http://www.uoguelph.ca/ccs" rel="noreferrer" target="_blank">www.uoguelph.ca/ccs</a><br>
Room 037, Animal Science and Nutrition Building<br>
Guelph, Ontario, N1G 2W1<br>
<br>
<br>______________________________<wbr>_________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" rel="noreferrer" target="_blank">https://puck.nether.net/<wbr>mailman/listinfo/cisco-voip</a><br>
<br></blockquote></div><br></div>