Re: [c-nsp] Catalyst Blade Switch 3012 inband management?

2009-11-09 Thread Justin C Darby
Enable protected mode on the AMM, then 'platform chassis-management protected-mode' on your switch. The switch will require a reload and sever the fastethernet management ports automatically. We do this all the time here. :) Note that this seriously breaks any existing configuration in some circu

Re: [c-nsp] Monitoring Nexus 7000 platform

2009-08-13 Thread Justin C. Darby
We use DCNM for real-time monitoring here (e.g. we use it to troubleshoot issues as they arise) - works great for this purpose, though in my opinion the configuration interface is a little over-complicated compared to just using the CLI, which is a bad sign. :) The XML interface is very, very

Re: [c-nsp] Nexus 7010 Racking

2009-05-22 Thread Justin C. Darby
These things are heavy - I know from experience. Get a mechanical lift or be prepared with 4-6 people to lift. I did not have a lift, and we got it installed safely, but in retrospect, I should have rented the lift. Justin Tim Stevenson wrote: At 06:30 AM 5/22/2009, Ash Net noted: Hi Folks,

Re: [c-nsp] GSS and ACE

2009-04-22 Thread Justin C Darby
Nick, The primary benefit to these things, AFAIK, is the ACE integration for load balancing. I'm pretty sure there are other options (mostly software) available to do the same DNS load balancing without ACE's, but - ACE's are a great way to add redundancy to a site, and GSS+ACE can handle load ba

Re: [c-nsp] Nexus 5K FCoE to FC breakout

2009-04-17 Thread Justin C Darby
-nsp-boun...@puck.nether.net wrote: - To: cisco-nsp@puck.nether.net From: Chris Hills Sent by: cisco-nsp-boun...@puck.nether.net Date: 04/17/2009 04:51AM cc: cisco-nsp@puck.nether.net Subject: Re: [c-nsp] Nexus 5K FCoE to FC breakout On 17/04/09 04:59, Justin C Darby wrote: > Step 10.5: Cu

[c-nsp] Ethernet over DWDM

2009-04-16 Thread Justin C Darby
Anyone care to share any experiences related to running Ethernet over DWDM? I'm not talking huge Carrier Ethernet deployments, more like enterprise LAN-to-LAN connectivity. Particularly, any information at all related to point-to-point DWDM circuits would be great. Examples: Are you InterLATA or

Re: [c-nsp] Nexus 5K FCoE to FC breakout

2009-04-16 Thread Justin C Darby
09 07:37PM Subject: Re: [c-nsp] Nexus 5K FCoE to FC breakout 0n Thu, Apr 16, 2009 at 11:06:48AM -0400, Justin C Darby wrote: >We're actually using in-house built ATA-over-Ethernet devices which have >similar advantages, but this isn't very 'enterpri

Re: [c-nsp] Nexus 5K FCoE to FC breakout

2009-04-16 Thread Justin C Darby
tence of HBA's means its coming - Cisco's UCS design actually counts on having FCoE 10GbE HBA's if what I'm reading about them is correct. Justin -David Hughes wrote: - To: Justin C Darby From: David Hughes Date: 04/16/2009 05:40AM cc: cisco-nsp@puck.nether.net Subj

Re: [c-nsp] Nexus 5K FCoE to FC breakout

2009-04-15 Thread Justin C Darby
Hello David, This is entirely my personal opinion and I'm sure some folks in the Nexus BU at Cisco would hit me for saying this given the chance. Unless you are using legacy FC devices, hold off on the 5K for this. The reason I say this is because a new class of storage devices and HBA's that us

Re: [c-nsp] carrier router models comparison

2009-04-14 Thread Justin C. Darby
To chime in a little bit here on the bleeding edge comments - we jumped on the Nexus 7K pretty early on (shortly after GA), as we would otherwise have spent about as much investing in new 6500's, our budget wasn't going to allow for replacing equipment for at least 5 years, and we were jumping

Re: [c-nsp] Redundant switch fabric

2009-03-31 Thread Justin C. Darby
e from and to? tv - Original Message ----- From: "Justin C. Darby" To: "Brad Hedlund" Cc: Sent: Tuesday, March 31, 2009 11:51 AM Subject: Re: [c-nsp] Redundant switch fabric Mike, Just to chime in here a bit with some experience - we've had Nexus 7K switch back

Re: [c-nsp] Redundant switch fabric

2009-03-31 Thread Justin C. Darby
Mike, Just to chime in here a bit with some experience - we've had Nexus 7K switch backplane modules fail - unless you are pushing near 100% backplane utilization you don't even notice until it emails you or your config monitoring program notices the failed module. In recent NX-OS releases, I

Re: [c-nsp] Cisco 3012 IBM Blade Switch Configurations?

2009-02-18 Thread Justin C. Darby
Hi Chris, I strongly suggest if you want to keep a simple mode of operation you use a feature on these things that configures them independently of the Bladecenter Advanced Management Module. It's hard to find in the docs, but, what you want is "platform chassis-management protected-mode". T

Re: [c-nsp] ASA doesn't like ipsec...

2008-09-25 Thread Justin C Darby
As far as I can remember you can't use VPN or do IPSEC in multiple context mode and you have many, many restrictions in transparent mode (e.g. admin VPN only). Silly, isn't it? :) (I know you can't do VPN but I think this also applies to IPSEC. Someone can feel free to correct me if I'm wrong.) J

Re: [c-nsp] Layer 2 security issue

2008-09-24 Thread Justin C. Darby
I don't know if this is possible for you to do or not, but have you considered using static assignments for MAC<->Port mappings (e.g. specify a mac address instead of sticky)? I only use port security on an N7K at the moment, and we had to use static mappings due to an outstanding bug related

Re: [c-nsp] Nexus Question

2008-07-21 Thread Justin C. Darby
I don't know about the 32-port 10GE cards, but here's a 'show env power' from the N7K I'm working with to replace our 6506 and 6509: Power Supply: Voltage: 50 Volts - PS ModelPower Power Status

Re: [c-nsp] Maximizing Router capabilities

2008-07-21 Thread Justin C. Darby
You should really shop by feature set. Advanced Enterprise IOS licenses are expensive. If you don't need all of the features present, you should only license the features you need. Expanding DRAM and Flash beyond what is required for the image you need is also sometimes expensive, depending

Re: [c-nsp] Discussion list for RADIUS?

2008-05-23 Thread Justin C. Darby
As far as I am aware (from years of working at ISP's), neither will a RADIUS server send nor most NAS devices ever check the status of any attribute post login (I don't even think they can, but it's been a long time since I've read the RFC's). Meaning, if you change the session timeout, it

Re: [c-nsp] Cisco ACE Web Application Firewall

2008-05-15 Thread Justin C. Darby
The general specifications on the device indicate it can handle DSR (we also use DSR at our site but not on ACE), but it does so by claiming it can do everything IP-SLB does. I'd check with a sales rep to insure it'll work (all of the documentation related to IP-SLB and ACE functionality is

[c-nsp] Nexus 7000

2008-05-05 Thread Justin C. Darby
any problems so far, though I realize it might not be considered generally available yet. Thanks, Justin C. Darby Note: The contents of this message are mine and do not reflect the views of the United States Federal Government. ___ cisco-nsp mai