Re: [c-nsp] Debug icmp for vrf

2015-09-02 Thread Pierre Emeriaud
Hi,


> The "tail" is provided by a third party, and they are investigating from 
> there side, but Id like to exhaust all possibilities on our side also - Is 
> there any "vrf" icmp debugging options I could run on our PE..debug ip icmp ? 
> doesnt give any "vrf" options.
>
>
>
> Any suggestions/assistance is greatly appreciated.

Not sure about debugging options, but you should try to mirror the
customer traffic from your PE to an ERSPAN session and analyze the
traffic on a workstation. We do this (well, debug mirror, SR-OS
flavor) all the time to debug similar issues, and it has proven to be
a very valuable tool.


--
pierre
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Debug icmp for vrf

2015-09-02 Thread CiscoNSP List

Hi Everyone,



Had a bit of a google, but couldnt find anything useful, so hoping someone on 
the list can assist :)



We have a weird problem with a customer tail - Customer has tried connecting 2 
different Cisco 1900's (In case 1st was faulty), very basic config, no dot1q, 
no natting, no acl's, no firewalling - We can see there mac and arp(For the 
correct WAN IP), but we cant ping them, and they cant ping usIf they 
connect a laptop to the service and give it the same IP as is on the 2 x 
1900's, we can ping them, and they can ping us.



To throw another spanner in the works, if we give a Laptop the same WAN IP as 
our Core, and connect it to the 1900's we can ping the 1900's WAN (So they dont 
appear faulty)



debug ip icmp on the CE, we see nothing when pinging from CE WAN -> US, or US 
-> CE WAN.If we try pinging something on the cust LAN, we see icmp debug 
logs.So it looks like (For some bizarre reason), that when the 1900's are 
connected, we can see MAC, but cannot pass any L3 traffic, but connect a 
Laptop, we can.



The "tail" is provided by a third party, and they are investigating from there 
side, but Id like to exhaust all possibilities on our side also - Is there any 
"vrf" icmp debugging options I could run on our PE..debug ip icmp ? doesnt give 
any "vrf" options.



Any suggestions/assistance is greatly appreciated.



Cheers.


___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] BGP multipath load balancing.. broken sessions upon hash change

2015-09-02 Thread Peter Kranz
I am attempting to load balance ~100 Gbps of inbound traffic across several 
processing nodes. Each node advertising the same /32 back to the core router 
and CEF nicely divides the traffic so that 1/16th of it arrives at each node. 
The problem arises when a node is brought out of rotation, existing SSH 
sessions break since the source IP gets mapped to a new node after CEF 
re-computes. Given the large amount of traffic, it's not easily solvable with 
higher end load balancers for a reasonable cost.

-PK

-Original Message-
From: Łukasz Bromirski [mailto:luk...@bromirski.net] 
Sent: Wednesday, September 02, 2015 2:56 PM
To: Peter Kranz 
Cc: cisco-nsp@puck.nether.net
Subject: Re: [c-nsp] BGP multipath load balancing.. broken sessions upon hash 
change

Peter,

> On 02 Sep 2015, at 22:49, Peter Kranz  wrote:
> 
> I’m using bgp maximum-paths and several peers announcing the same /32 
> to create a poor man’s load balancer. This works well with up to 16 
> peers after which the CEF number of buckets is exceeded.
> 
> However, if the number of connected peers change, all sessions break, 
> which I would like to avoid.

That’s the way CEF works - it has to rebuild the hash every time new nexthop 
appears or vanishes. 

This is 6500 you’ve mentioned in different post, right? What is the overall 
architecture of the thing you’re trying to achieve here (remote terminal 
access?). 

—
Łukasz Bromirski

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] BGP multipath load balancing.. broken sessions upon hash change

2015-09-02 Thread Chase Christian
Correct, in order to have a "sticky" session, the device would have to keep
the TCP session state in a table somewhere (like a NAT table), which ECMP
and CEF do not do.

On Wed, Sep 2, 2015 at 2:55 PM, Łukasz Bromirski 
wrote:

> Peter,
>
> > On 02 Sep 2015, at 22:49, Peter Kranz  wrote:
> >
> > I’m using bgp maximum-paths and several peers announcing the same /32 to
> > create a poor man’s load balancer. This works well with up to 16 peers
> after
> > which the CEF number of buckets is exceeded.
> >
> > However, if the number of connected peers change, all sessions break,
> which
> > I would like to avoid.
>
> That’s the way CEF works - it has to rebuild the hash every
> time new nexthop appears or vanishes.
>
> This is 6500 you’ve mentioned in different post, right? What
> is the overall architecture of the thing you’re trying to
> achieve here (remote terminal access?).
>
> —
> Łukasz Bromirski
> ___
> cisco-nsp mailing list  cisco-nsp@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] BGP multipath load balancing.. broken sessions upon hash change

2015-09-02 Thread Łukasz Bromirski
Peter,

> On 02 Sep 2015, at 22:49, Peter Kranz  wrote:
> 
> I’m using bgp maximum-paths and several peers announcing the same /32 to
> create a poor man’s load balancer. This works well with up to 16 peers after
> which the CEF number of buckets is exceeded.
> 
> However, if the number of connected peers change, all sessions break, which
> I would like to avoid.

That’s the way CEF works - it has to rebuild the hash every
time new nexthop appears or vanishes. 

This is 6500 you’ve mentioned in different post, right? What
is the overall architecture of the thing you’re trying to
achieve here (remote terminal access?). 

— 
Łukasz Bromirski
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] Cisco IOS SLB performance under Supervisor 2T

2015-09-02 Thread Łukasz Bromirski

> On 02 Sep 2015, at 22:52, Peter Kranz  wrote:
> 
> This document indicates a maximum of 8G of throughput for IOS SLB under a
> Supervisor 720-3BXL
> 
> http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/persiste
> nt-storage-device-module/product_data_sheet0900aecd806b5dc9.html
> 
> Is anyone aware of what the performance limitation of this feature is under
> the newer Supervisor 2T-10G-XL?

IOS SLB is old feature that was deprecated some time ago in
the IOS. The natural migration path was Cisco CSM, then ACE
service card, but then it was itself EoSed.

Right now it’s either F5 or Citrix for large-scale load
balancing. Or our beloved L3/L4 which you mentioned in 
previous post.

While Sup720 may still support it, 15.1Y and newer versions for
Sup2T don’t. This means: some commands may be there in the parser,
trick you in entering them, and then kill you with performance,
bugs, or simply do not work at all, which sometimes is blessing.

-- 
Łukasz Bromirski
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

[c-nsp] Cisco IOS SLB performance under Supervisor 2T

2015-09-02 Thread Peter Kranz
This document indicates a maximum of 8G of throughput for IOS SLB under a
Supervisor 720-3BXL

http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/persiste
nt-storage-device-module/product_data_sheet0900aecd806b5dc9.html

Is anyone aware of what the performance limitation of this feature is under
the newer Supervisor 2T-10G-XL?

Peter Kranz
www.UnwiredLtd.com
Desk: 510-868-1614 x100
Mobile: 510-207-
pkr...@unwiredltd.com


___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] BGP multipath load balancing.. broken sessions upon hash change

2015-09-02 Thread Peter Kranz
I’m using bgp maximum-paths and several peers announcing the same /32 to
create a poor man’s load balancer. This works well with up to 16 peers after
which the CEF number of buckets is exceeded.

However, if the number of connected peers change, all sessions break, which
I would like to avoid.

For example:
- 10 machines are advertising a path to the /32
- SSH is opened to one machine via the advertised IP address
- 1 machine stops advertising, bringing the pool to 9
- SSH connection breaks a little while later

 Conversely when adding another machine to the pool, a similar experience:
- 9 machines are advertising a path to the /32
- SSH is opened to one machine via the advertised IP address
- 1 machines starts advertising, bringing the pool to 10 
- SSH connection breaks immediately

Is there a solution to keep the client session sticky to the BGP peer it was
initially started on? I am using per-destination load balancing. My
suspicion is that upon a change in the number of connected peers, the CEF
hash buckets are reset and renumbered, breaking all connections.

Peter Kranz
www.UnwiredLtd.com
Desk: 510-868-1614 x100
Mobile: 510-207-
pkr...@unwiredltd.com


___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] SNMP ifLastChange > 30 days

2015-09-02 Thread Howard Jones

On 02/09/2015 18:11, Drew Weaver wrote:

Hey all,

I've been dealing with an issue in SNMP (6500) where I need to know whether an 
interface has changed its operational status within the last 30 days.

I came across the oid ifLastChange which tracks against the 32 bit counter 
sysUptime.0, the problem obviously is that when sysUptime.0 resets ifLastChange 
becomes pretty much useless.

It seems as though there would be some way to 'math around this' by detecting 
whether or not the counter has wrapped based on the actual uptime of the device 
(which can be polled from)  snmpEngineTime.0 but before I go on this adventure 
I wondered if anyone had already come up with a solution?



From basic logic, if ifLastChange < sysUptime, then the change must 
have been (2^32 - sysUptime + ifLastChange) timeticks ago, or that plus 
some multiple of 2^32 timeticks (496 days). So if you know that 
snmpEngineTime is > sysUpTime, you can figure out a minimum time for 
ifLastChange, at least, and if you know the actual uptime, then you have 
a maximum too. Not that many devices are up for many years without reload...


Howie
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] SNMP ifLastChange > 30 days

2015-09-02 Thread Peter Rathlev
On Wed, 2015-09-02 at 17:11 +, Drew Weaver wrote:
> I came across the oid ifLastChange which tracks against the 32 bit
> counter sysUptime.0, the problem obviously is that when sysUptime.0
> resets ifLastChange becomes pretty much useless.
> 
> It seems as though there would be some way to 'math around this' by
> detecting whether or not the counter has wrapped based on the actual
> uptime of the device (which can be polled from)  snmpEngineTime.0 but
> before I go on this adventure I wondered if anyone had already come up
> with a solution?

AFAIK the only solution is what you propose: Adjust for wrapping knowing
that ifLastChange cannot be in the future and must thus always be a
smaller value than sysUpTime.0.

We use someting like this snippet in our web-based switch configuration
tool:

  $sysUpTime = $switch->snmpget("SNMPv2-MIB::sysUpTime", 0);
  $ifLastChange = $switch->snmpbulkwalk('IF-MIB::ifLastChange');
  my $secondsSinceStateChange = {};
  foreach (keys %{$ifLastChange}) {
  $secondsSinceStateChange->{$_} = $sysUpTime - 
snmp_time_to_seconds($ifLastChange->{$_});
  # SNMP timeticks might have wrapped at 2^32 jiffies
  while ($secondsSinceStateChange->{$_} < 0) {
  $secondsSinceStateChange->{$_} += int(2**32 / 100);
  }
  }

It will of course not necessarily give you the correct ifLastChange
value, but for most cases it will be correct for finding interfaces that
haven't changed for 30 days. And where it errs it will always give you a
minimum time since last change, so if it says > 30 days then the
interface will have had no status change for at least 30 days.

-- 
Peter


___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] SNMP ifLastChange > 30 days

2015-09-02 Thread Drew Weaver
Hey all,

I've been dealing with an issue in SNMP (6500) where I need to know whether an 
interface has changed its operational status within the last 30 days.

I came across the oid ifLastChange which tracks against the 32 bit counter 
sysUptime.0, the problem obviously is that when sysUptime.0 resets ifLastChange 
becomes pretty much useless.

It seems as though there would be some way to 'math around this' by detecting 
whether or not the counter has wrapped based on the actual uptime of the device 
(which can be polled from)  snmpEngineTime.0 but before I go on this adventure 
I wondered if anyone had already come up with a solution?

Thanks in advance,
-Drew

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] FW: N7K F2e Module

2015-09-02 Thread Tim Stevenson
When F2E is mixed with M, then F2E ports operate as L2 only, but in 
this case he is unable to configure the *M* ports with anything other 
than "switchport host". That's just wrong.


Probably the first step is to get on decent code, and see if the 
issue remains. Ie, 6.2.12 or 6.2.14.


Tim

At 09:49 AM 9/2/2015  Wednesday, Sandor Rozsa asserted:

I dag this issue and found out that if you mix M1 with f2e than on the f2e
you'll have only l2 features. You can try by creating an f2e only vdc and
see if the features are available.

sandor

On Wed, Sep 2, 2015 at 12:39 PM, Mohammad Khalil 
wrote:

> Please check below
>
> sh vdc
> Switchwide mode is m1 f1 m1xl f2 m2xl f2e
>
> vdc_id  vdc_name  state   mac
>   typelc
> --    -   --
>   -   --
> 1   JCBank_Core1_DR   active
> 64:a0:e7:3f:94:41
>   Ethernetm1 m1xl m2xl f2e
>
> sh vdc feature-set
> vdc JCBank_Core1_DR allowed feature-sets:
> ethernet
>
> SW(config-if)# interface Ethernet2/19
> SW(config-if)# switchport ?
>   host  Set port host
>
> sh mod
> Mod  Ports  Module-Type Model  Status
> ---  -  --- --
> --
> 148 10/100/1000 Mbps Ethernet XL Module N7K-M148GT-11L ok
> 232 10 Gbps Ethernet XL Module  N7K-M132XP-12L ok
> 50  Supervisor Module-1XN7K-SUP1   active *
> 60  Supervisor Module-1XN7K-SUP1
>  ha-standby
> 10   48 1/10 Gbps Ethernet Module   N7K-F248XP-25E ok
>
> Mod  Sw  Hw
> ---  --  --
> 16.2(2a) 1.2
> 26.2(2a) 1.3
> 56.2(2a) 2.3
> 66.2(2a) 2.3
> 10   6.2(2a) 1.2
>
> Thanks in advance
>
> BR,
> Mohammad
> Date: Wed, 2 Sep 2015 11:06:57 +0200
> Subject: Re: [c-nsp] N7K F2e Module
> From: rozsa.sandor.gy...@gmail.com
> To: eng_m...@hotmail.com
>
> Hi,
> What is the vdc type (limit resources) you are using? I recall I had
> something similar when missconfiguring the vdc type, but in my case I had
> only f2e cards, so the workaround was easy, just modify the module type to
> f2e.
>
> 
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/vdc/command/reference/vdc_cmd_ref/vdc_cmds.html

>
> I hope my comment helped you:
> sandor
> On Wed, Sep 2, 2015 at 10:52 AM, Mohammad Khalil 
> wrote:
> Hi all
>
> I have Cisco N7K with 6.2.2a  Image
>
> I brought F2e module to be installed on my system and I have already M1xl
> (30 ports fiber module ) already in place
>
> After installing the F2e module , most of the ports on the M1 module
> (which were configured as trunk ports) shows the I cannot configure the
> ports except for host mode
>
>
>
> Switchport mode  host
>
> only
>
>
>
> Anyone faced such a case?
>
>
>
> Thanks in advance
>
>
>
> BR,
>
> Mohammad
>
>
>
> ___
>
> cisco-nsp mailing list  cisco-nsp@puck.nether.net
>
> https://puck.nether.net/mailman/listinfo/cisco-nsp
>
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> ___
> cisco-nsp mailing list  cisco-nsp@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/






Tim Stevenson, tstev...@cisco.com
Routing & Switching CCIE #5561
Distinguished Engineer, Technical Marketing
Data Center Switching
Cisco - http://www.cisco.com
+1(408)526-6759


___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] FW: N7K F2e Module

2015-09-02 Thread Sandor Rozsa
I dag this issue and found out that if you mix M1 with f2e than on the f2e
you'll have only l2 features. You can try by creating an f2e only vdc and
see if the features are available.

sandor

On Wed, Sep 2, 2015 at 12:39 PM, Mohammad Khalil 
wrote:

> Please check below
>
> sh vdc
> Switchwide mode is m1 f1 m1xl f2 m2xl f2e
>
> vdc_id  vdc_name  state   mac
>   typelc
> --    -   --
>   -   --
> 1   JCBank_Core1_DR   active
> 64:a0:e7:3f:94:41
>   Ethernetm1 m1xl m2xl f2e
>
> sh vdc feature-set
> vdc JCBank_Core1_DR allowed feature-sets:
> ethernet
>
> SW(config-if)# interface Ethernet2/19
> SW(config-if)# switchport ?
>   host  Set port host
>
> sh mod
> Mod  Ports  Module-Type Model  Status
> ---  -  --- --
> --
> 148 10/100/1000 Mbps Ethernet XL Module N7K-M148GT-11L ok
> 232 10 Gbps Ethernet XL Module  N7K-M132XP-12L ok
> 50  Supervisor Module-1XN7K-SUP1   active *
> 60  Supervisor Module-1XN7K-SUP1
>  ha-standby
> 10   48 1/10 Gbps Ethernet Module   N7K-F248XP-25E ok
>
> Mod  Sw  Hw
> ---  --  --
> 16.2(2a) 1.2
> 26.2(2a) 1.3
> 56.2(2a) 2.3
> 66.2(2a) 2.3
> 10   6.2(2a) 1.2
>
> Thanks in advance
>
> BR,
> Mohammad
> Date: Wed, 2 Sep 2015 11:06:57 +0200
> Subject: Re: [c-nsp] N7K F2e Module
> From: rozsa.sandor.gy...@gmail.com
> To: eng_m...@hotmail.com
>
> Hi,
> What is the vdc type (limit resources) you are using? I recall I had
> something similar when missconfiguring the vdc type, but in my case I had
> only f2e cards, so the workaround was easy, just modify the module type to
> f2e.
>
> http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/vdc/command/reference/vdc_cmd_ref/vdc_cmds.html
>
> I hope my comment helped you:
> sandor
> On Wed, Sep 2, 2015 at 10:52 AM, Mohammad Khalil 
> wrote:
> Hi all
>
> I have Cisco N7K with 6.2.2a  Image
>
> I brought F2e module to be installed on my system and I have already M1xl
> (30 ports fiber module ) already in place
>
> After installing the F2e module , most of the ports on the M1 module
> (which were configured as trunk ports) shows the I cannot configure the
> ports except for host mode
>
>
>
> Switchport mode  host
>
> only
>
>
>
> Anyone faced such a case?
>
>
>
> Thanks in advance
>
>
>
> BR,
>
> Mohammad
>
>
>
> ___
>
> cisco-nsp mailing list  cisco-nsp@puck.nether.net
>
> https://puck.nether.net/mailman/listinfo/cisco-nsp
>
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> ___
> cisco-nsp mailing list  cisco-nsp@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Cisco Security Advisory: Cisco Integrated Management Controller Supervisor and Cisco UCS Director Remote File Overwrite Vulnerability

2015-09-02 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Cisco Security Advisory: Cisco Integrated Management Controller Supervisor and 
Cisco UCS Director Remote File Overwrite Vulnerability

Advisory ID: cisco-sa-20150902-cimcs

Revision 1.0

For Public Release 2015 September 2 16:00  UTC (GMT)

+---

Summary
===
Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director 
contain a remote file overwrite vulnerability that could allow an 
unauthenticated, remote attacker to overwrite arbitrary system files, resulting 
in system instability or a denial of service (DoS) condition.

Cisco has released software updates that address this vulnerability.

Workarounds that mitigate this vulnerability are not available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150902-cimcs

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVecfnYpI1I6i1Mx3AQJNLhAAv2JmmTi39Ct3ih17a1XmdKxZxDhb33W0
++lYBipYbO9zgH6HaRjAX/CxG09vglgv3tyeEquFtVCGvBEs0x/PC8w7wig+VzlH
nXc8OgOMJlAnCuIn81cQra2SWtmVU2oaAbcQS9p3/uDNB3op+cPvkDJFTet9UX72
HC1CItpmUDWefKW44xeGNQ+8IsMBkBxOdHiyDmucu1zLXcg9hpxr56LDpDd8i61U
kJorlCVMnWrTzbgV1jtILxQ73PE2tlKyaVZamks2ODzF1wj4E8dkfAAiOHKCPMaP
BWSztYrybAfRbAqfkA+2FpOe6Cgd8S4O+01+4CbOwWjRpoqZhkVFnQgu21AymYxe
4q3y7KWw2IKLCrmHnjFlWs3687uoxUaxIiyxXozn/7U8bU05lh1c9eZH0KY+9cBo
O9VsM/d0YN68JaI5PDpAlqXssS9qYUrEbFu3Rdus2ss87yZi27e1Q4N9hMyJ1fo0
Wu6OqiuHLD1JTv059dXPDfmgDvt+0zuilmWoGKY5i7OAbSw8GhQVJ9Q3wdBdfYeX
8cBO+tt0xvVTMOz9mpBRx5a9dJXUo/Z5L5mi7n9jtfqqvrR9iDjZR3xVTqYXh+6M
Xtj0Q0J/VZV+ZCVWz0xXJoqBvtPnw47xbMcx7n1t8jR8bgk9+MS/0/E/cV1239K/
0JdOpPTLlXM=
=1xLQ
-END PGP SIGNATURE-
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] MACSec support on Catalyst 4500-X

2015-09-02 Thread Cisco NSP
I read that MACSec inter-switch is supported between a pair of Catalyst 4500-X. 
Not Cisco TrusSec MACSec. What are the differences (standard versus 
proprietary)?

Is it right? Any limitations or pre-requisites?

Thanks for your advice,
Manu
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] FW: N7K F2e Module

2015-09-02 Thread Mohammad Khalil
Please check below

sh vdc
Switchwide mode is m1 f1 m1xl f2 m2xl f2e 

vdc_id  vdc_name  state   mac   
  typelc  
--    -   --
  -   --  
1   JCBank_Core1_DR   active  64:a0:e7:3f:94:41 
  Ethernetm1 m1xl m2xl f2e 

sh vdc feature-set 
vdc JCBank_Core1_DR allowed feature-sets:
ethernet

SW(config-if)# interface Ethernet2/19
SW(config-if)# switchport ?
  host  Set port host

sh mod
Mod  Ports  Module-Type Model  Status
---  -  --- -- --
148 10/100/1000 Mbps Ethernet XL Module N7K-M148GT-11L ok
232 10 Gbps Ethernet XL Module  N7K-M132XP-12L ok
50  Supervisor Module-1XN7K-SUP1   active *
60  Supervisor Module-1XN7K-SUP1   ha-standby
10   48 1/10 Gbps Ethernet Module   N7K-F248XP-25E ok

Mod  Sw  Hw
---  --  --
16.2(2a) 1.2 
26.2(2a) 1.3 
56.2(2a) 2.3 
66.2(2a) 2.3 
10   6.2(2a) 1.2 

Thanks in advance

BR,
Mohammad
Date: Wed, 2 Sep 2015 11:06:57 +0200
Subject: Re: [c-nsp] N7K F2e Module
From: rozsa.sandor.gy...@gmail.com
To: eng_m...@hotmail.com

Hi,
What is the vdc type (limit resources) you are using? I recall I had something 
similar when missconfiguring the vdc type, but in my case I had only f2e cards, 
so the workaround was easy, just modify the module type to f2e.
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/vdc/command/reference/vdc_cmd_ref/vdc_cmds.html

I hope my comment helped you:
sandor
On Wed, Sep 2, 2015 at 10:52 AM, Mohammad Khalil  wrote:
Hi all

I have Cisco N7K with 6.2.2a  Image

I brought F2e module to be installed on my system and I have already M1xl (30 
ports fiber module ) already in place

After installing the F2e module , most of the ports on the M1 module (which 
were configured as trunk ports) shows the I cannot configure the ports except 
for host mode



Switchport mode  host

only



Anyone faced such a case?



Thanks in advance



BR,

Mohammad



___

cisco-nsp mailing list  cisco-nsp@puck.nether.net

https://puck.nether.net/mailman/listinfo/cisco-nsp

archive at http://puck.nether.net/pipermail/cisco-nsp/



  
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] N7K F2e Module

2015-09-02 Thread Mohammad Khalil
Hi all
I have Cisco N7K with 6.2.2a  Image 
I brought F2e module to be installed on my system and I have already M1xl (30 
ports fiber module ) already in place
After installing the F2e module , most of the ports on the M1 module (which 
were configured as trunk ports) shows the I cannot configure the ports except 
for host mode 

Switchport mode  host 
only  

Anyone faced such a case?

Thanks in advance

BR,
Mohammad 
  
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/