About jkeeffe

jkeeffe · ‎09-28-2015

This is on a Nexus 7700 version 6.2(10) For security reasons we have some L3 OSPF SVIs configured as passive interfaces. However, I have a network tool (it maps and analyzes the OSPF routing world) that must form an OSPF neighbor adjacency with another local OSFP router so it can participate in the OSPF world to do its mapping and analysis. This tool is in the same vlan as the L3 SVI. So I need to make that particular SVI OSPF active (send out OSPF Hello pkts) instead of passive. Is there a way to use an ACL, route-map, policy-map, etc. to allow for only one IP address to form an OSPF adjacency with that SVI? In other words, send out the Hello pkts but only form an adjacency with the IP address specified in some sort of ACL? Or is it all or nothing? Here is the SVI config today: interface Vlan1147 description nmm-3 no shutdown mtu 9000 vrf member nmm no ip redirects ip address 10.88.80.2/24 ip ospf passive-interface ip router ospf 1 area 0.0.0.0 hsrp version 2 hsrp 1147 preempt priority 110 ip 10.88.80.1 Say for example I want this interface to form an OSPF adjacency with only the network tool, which is 10.88.80.100, and no other devices that may respond to the Hello pkts?

jkeeffe · ‎08-26-2015

I have an old ACS 4.2 running on an old Windows 2003 Server. I have to move it off the Windows 2003 Server due to security reasons. I know that 4.2 is not supported any longer. Unfortunately, I don't have the time right now to migrate from 4.2 to 5.x - and the 4.2 documentation states that it can not run on any 64-bit OS. Does anyone know if ACS 4.2 will, or will not, run on the 32-bit version of Windows 2008 Server?

jkeeffe · ‎01-20-2015

We have some 6880 VSS pairs that have several 6800IA-48FPDRs and 6880IA-48TDs connected to them and I'm getting ready to upgrade the IOS using ISSU. I want to upgrade the 6880 VSS pairs first and not have the 6800IAs automatically upgrade all at once. But I read somewhere that when a 6800IA notices that there is a difference between its code version and that of the parent 6880 it will automatically upgrade its code. This I don't want to have happen as there are many 6800IAs attached to the 6880s and I don't want them to all to reboot at the same time. Three questions: 1. Can I upgrade just the 6880 VSS pair without the 6800IAs automatically detecting the IOS change and upgrading themselves? 2. If so, what are the steps? 3. In the release notes http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.html ; it states that ISSU is NOT supported with the 6800IA-48FPDR. If that is truly the case, how does one upgrade those IAs after the parent 6880s are upgraded?

jkeeffe · ‎10-23-2014

I was under the impression the you can only have one isolated vlan in a primary vlan.

jkeeffe · ‎09-16-2014

.... as show in the entries below: *Feb 28 16:00:45: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/2, changed state to up .Sep 16 06:28:01: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 164.72.58.198 Port 514 started - CLI initiated .Sep 16 06:28:02: %LINK-3-UPDOWN: Interface Port-channel14, changed state to up Sep 16 06:28:03: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel14, changed state to up

jkeeffe · ‎07-30-2014

Unfortunately it seems that no one answers questions pertaining to FCIP and QOS here.

jkeeffe · ‎07-30-2014

Our storage group is implementing an MDS 9000 FCIP environment. The person configuring the Nexus equipment is asking what QOS markings and bandwidth requirements should be used for the FCIP traffic. Is there a document that describes the QOS recommendations for MDS FCIP?

jkeeffe · ‎07-15-2014

DHCP Snooping best practice states to store the snooping database remotely in case of a catastrophic failure of the access switch. We are getting ready to implement L2 security on our access switches (about 100 of them) and it seems that if we have each switch send its snooping database to a remote server we would have an administrative headache with all the files that are sent to the remote server. So my questions is: If we ignore the best practice to send the database file off the switch and instead store it in flash (I know flash is limited) and we have a failure of the switch thus losing the database file, won't the file get rebuilt when the switch is either powered back on or a new switch is installed - just like it got built when initially configured and activated? If that is the case, then is the possibility of running out of flash memory the only reason to store the file off switch?

jkeeffe · ‎06-03-2014

I figured out why the GE port doesn't allow for 'ip dhcp snooping trust'. Only an L2 port can have dhcp snooping trust on it - an L3 port doesn't have that option. I had an IP address configured on the GE port, therefore no snooping trust option was available.

jkeeffe · ‎06-03-2014

I have a 3750 switch (c3750-ipservicesk9-mz.122-55.SE3) that I am configuring DHCP snooping on. I can configure dhcp snooing trust on a FE port, but can't on a GE uplink port - there is no snooping option under that interface as you can see below. VoIP-MDF-RS3750(config)#int f1/0/47 VoIP-MDF-RS3750(config-if)#ip dhcp ? client DHCP client configuration limit Limit DHCP Lease relay DHCP relay configuration parameters server Configure DHCP server behavior snooping DHCP Snooping VoIP-MDF-RS3750(config-if)#int g1/0/1 VoIP-MDF-RS3750(config-if)#ip dhcp ? client DHCP client configuration limit Limit DHCP Lease relay DHCP relay configuration parameters server Configure DHCP server behavior VoIP-MDF-RS3750(config-if)#ip dhcp How do I trust the GE uplink of the switch for DHCP snooping?

jkeeffe · ‎06-02-2014

IOS = 15.1(2)SY1 When I do a "show platform qos" everything looks good except for this: ----- Switch [1], Module [3] ----- Counter IFE Pkts IFE Bytes OFE Pkts OFE Bytes ---------------------------------------------------------------------------------------------------------------------------- Policing Drops 0 0 216304 16888896 Policing Forwards 2935238201 5068976519092 2949830653 5069751062945 Police-hi Actions (Lvl3) 0 0 0 0 Police-lo Actions (Lvl2) 0 0 0 0 Aggregate Drops 0 0 263889 16888896 Aggregate Forwards 2935238198 5068976518864 2949830650 5069751062717 Any idea if these drops are QOS related and/or how to get more information about them in order to troubleshoot? OFE means 'Output Forwarding Engine'. There are no input or output queue drops on any of the interfaces doing a "show interface gx/x/x." Thanks.

jkeeffe · ‎10-10-2013

Starting with version 15.0(2)SG, the 4500 catalyst is able to do private vlans over etherchannel. The configuration guide for that gives an example of how to configure the etherchannel interface, but has no reference to how to configure the individual interfaces in the channel. For instance I want to configure port-channel 15 as a promiscuous port and have ports g1/47 & 48 in the channel. Here is the config for the pvlans and port-channel: vlan 800 private-vlan primary private-vlan association 850 vlan 850 private-vlan community int p15 switchport mode private-vlan promiscuous switchport private-vlan mapping 800 850 Now I want to add g1/47 & g1/48 as interfaces in the port-channel. int g1/47 switchport channel-group 15 mode xxxx Do I leave that as is, or do I add pvlan mode and mapping statements like that of int p15?

jkeeffe · ‎07-30-2013

What would cause the code 'Q' when doing an MPLS ping? I'm doing a pilot project in our enterprise, using mBGP and MPLS, to segment/isolate a small portion of our network. All seems to be working well, except that I get intermittant pings in the vrf. Even when the pings do work, I can't get an MPLS ping to work. Here are the outputs of both ping and mpls ping: SRC-RT3845-MDF#ping vrf VRF-test 10.40.5.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.40.5.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms SRC-RT3845-MDF#ping mpls ipv4 10.40.5.1 255.255.255.255 Sending 5, 100-byte MPLS Echos to 10.40.5.1/32, timeout is 2 seconds, send interval is 0 msec: Codes: '!' - success, 'Q' - request not sent, '.' - timeout, 'L' - labeled output interface, 'B' - unlabeled output interface, 'D' - DS Map mismatch, 'F' - no FEC mapping, 'f' - FEC mismatch, 'M' - malformed request, 'm' - unsupported tlvs, 'N' - no label entry, 'P' - no rx intf label prot, 'p' - premature termination of LSP, 'R' - transit router, 'I' - unknown upstream index, 'X' - unknown return code, 'x' - return code 0 Type escape sequence to abort. QQQQQ Success rate is 0 percent (0/5) SRC-RT3845-MDF# Also, here is the output of traceroute: SRC-RT3845-MDF#trace vrf VRF-test 10.40.5.1 Type escape sequence to abort. Tracing the route to 10.40.5.1 VRF info: (vrf in name/id, vrf out name/id) 1 10.40.1.14 [MPLS: Label 806 Exp 0] 0 msec 10.40.1.6 [MPLS: Label 806 Exp 0] 0 msec 10.40.1.14 [MPLS: Label 806 Exp 0] 4 msec 2 10.40.1.5 4 msec * 0 msec SRC-RT3845-MDF# SRC-RT3845-MDF# I don't know if there is a broken LSP, but I was hoping the the mpls ping would help. What would cause the 'Q' when doing the MPLS ping?

jkeeffe · ‎07-17-2013

The ASR1006 doesn't have the command 'show controller ethernet-controller....'. I did find this command though: TSC-ASR1006-A#sh platform hardware port 0/2/0 plim statistics Interface 0/2/0 RX Low Priority RX Drop Pkts 0 Bytes 0 RX Err Pkts 0 Bytes 0 TX Low Priority TX Drop Pkts 0 Bytes 0 RX High Priority RX Drop Pkts 0 Bytes 0 RX Err Pkts 0 Bytes 0 TX High Priority TX Drop Pkts 0 Bytes 0 Also, here is the output of 'show hw-module subslot 0/2 transceiver 0 status': TSC-ASR1006-A#sh hw-module subslot 0/2 transceiver 0 status The Transceiver in slot 0 subslot 2 port 0 is enabled. Module temperature = +19.617 C Transceiver Tx supply voltage = 3173.0 mVolts Transceiver Tx bias current = 8680 uAmps Transceiver Tx power = 2.7 dBm Transceiver Rx optical power = -14.0 dBm Reading the specs for the ZX the RX light levels should fall between -23db and 0db, which it does in the above output. I'll get with the carrier and make sure we have the correct transceiver, although we did change out the ZX with an LX earlier and were still getting frame errors.

jkeeffe · ‎07-17-2013

Here is the output of 'show interface' you requested. I did it again a couple seconds later to show the input frame errors increasing. TSC-ASR1006-A#sh int g0/2/0 GigabitEthernet0/2/0 is up, line protocol is up Hardware is SPA-2X1GE-V2, address is c464.13f2.7820 (bia c464.13f2.7820) Description: To LLT-RT7604B-g2/0/1- Century Link ID:ETH1000-15143283 Internet address is xx.xx.xx.xx/30 MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, reliability 128/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive not supported Full Duplex, 1000Mbps, link type is force-up, media type is ZX output flow-control is on, input flow-control is on ARP type: ARPA, ARP Timeout 04:00:00 Last input 1d19h, output 00:00:54, output hang never Last clearing of "show interface" counters 8w1d Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: Class-based queueing Output queue: 0/40 (size/max) 30 second input rate 0 bits/sec, 0 packets/sec 30 second output rate 0 bits/sec, 0 packets/sec 452439794 packets input, 37589912464 bytes, 0 no buffer Received 91 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 307192 input errors, 0 CRC, 307192 frame, 0 overrun, 0 ignored 0 watchdog, 3701 multicast, 0 pause input 256328 packets output, 35869710 bytes, 0 underruns 0 output errors, 0 collisions, 33 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out TSC-ASR1006-A#sh int g0/2/0 GigabitEthernet0/2/0 is up, line protocol is up Hardware is SPA-2X1GE-V2, address is c464.13f2.7820 (bia c464.13f2.7820) Description: To LLT-RT7604B-g2/0/1- Century Link ID:ETH1000-15143283 Internet address is xx.xx.xx.xx/30 MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, reliability 128/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive not supported Full Duplex, 1000Mbps, link type is force-up, media type is ZX output flow-control is on, input flow-control is on ARP type: ARPA, ARP Timeout 04:00:00 Last input 1d19h, output 00:00:10, output hang never Last clearing of "show interface" counters 8w1d Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: Class-based queueing Output queue: 0/40 (size/max) 30 second input rate 0 bits/sec, 0 packets/sec 30 second output rate 0 bits/sec, 0 packets/sec 452439794 packets input, 37589912464 bytes, 0 no buffer Received 91 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 307196 input errors, 0 CRC, 307196 frame, 0 overrun, 0 ignored 0 watchdog, 3701 multicast, 0 pause input 256331 packets output, 35870224 bytes, 0 underruns 0 output errors, 0 collisions, 33 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out

Date Registered	‎11-08-2000 09:03 AM
Date Last Visited	‎08-18-2017 04:03 AM
Total Messages Posted	685
Total Helpful Votes Received	28

Can I make an SVI OSPF active, yet via ...

ACS 4.2 running on Windows 2008 Server ...

6880 VSS ISSU upgrade with 6800IAs?

I was under the impression

What does the '*' and '.' mean at the b...

Unfortunately it seems that

What is the best practice for QOS in an...

DHCP snooping and the snooping database...

I figured out why the GE port

DHCP snooping on 3750 FE port but not o...

How do I track down QOS "Aggregate Drop...

Cat 4500 private vlan and etherchannel

MPLS ping returns 'Q' - request not sen...

Inpurt frames errors on gigabit connect...

Inpurt frames errors on gigabit connect...