Just been reminded why Virgin "super" hubs aren't ...

[Bob Eager]

I have a 2860 and four AP903s. Unfortunately the APs are on the inside of the firewall, and the 2860 is of course on the outside. The APs reguster via broadcasts, and of course the 2860 is on a different subnet. I'm sure there is a way, but...

The only problems I've had with the 2860 were faulty IPv6 support, and more seriously the internal firewall (which I turned off) was still blocking zone transfers from my primary DNS (which is on my network). But they fixed it within a week once I worked out what was going wrong.

[John Rumm]

Yup, they are normally not bad at fixing stuff once you can convince them its wrong... problem usually is that it tends to be in the slightly less commonly used functions, which can make identifying the actual problem difficult.

(e.g. I found a bug common to most of the routers that would cause them to stop handling requests for WiFi clients trying to join using EAP (rather than WPA etc) authentication with an external RADIUS server - but it was not always easy to reproduce - it might run for several days before it would basically just let the wifi device connect, then forget to authenticate it against the server, and hence never complete the login. You were then stuck like that until you restarted the router. They fixed it in all the current models, but not the 2830 or older.

[Bob Eager]

The firewall-not-turning-off problem took a while to identify. I could see the packets on my side of my firewall, and was able to set up a check between my firewall and the router. I was able to do packet tracing at my ISP (they provide that function) and the packets weren't coming out of the router on the WAN side. Without that it would have been very difficult.

It's a shame about managing the AP903s, but I can at least use the mesh root (they're in a mesh over the house) to do most of it.

[John Rumm]

If the APs have a route to the internet, then you could probably use the VigorACS management system rather than the router.

[Bob Eager]

I was under the impression that it cost money. I'm not that bothered, so I never investigated.

[Steve Walker]

A multi-million pound project that I was working on was delayed for a month due to a firewall configuration problem. Cisco only provide support for 3 months after purchase, but on this project, no-one had even tried to set it up for over 12 months. Once set up, most things were working, but a printer driver could not be installed, as it could not interrogate the printer - and every time it failed, the testing of the bare-metal build of the servers and workstations had to be abandoned and re-started from scratch. Turning off the filtering didn't help.

To get help from Cisco, the software house would have had to sign up for

12 months support and then book a visit (fully isolated system for security), which could not be done for at least a fortnight.

It was eventually found that despite the web interface configuration being changed, some items were not changing in a second location and could only be changed from the command line interface.