Packets with destination IP and MAC address of the SVI on a vPC peer switch are not forwarded over the Peer-link when received on the other switch on a Nexus 5600 running NX/OS 7.0(2)N1(1). Regardless of the "peer-gateway" setting in the VPC domain. Since the new 5600 platform only has two NX/OS releases available: 7.0(1)N1(1) and 7.0(2)N1(1), down-grading is not an option. Two Nexus 5600 switches with layer-3 configuration as a vPC cluster using two 40G interfaces as peer-link vPC and peer-keepalive via dedicated isolated 1G cross-link. There is no out-of-bound management network available. Management needs to be in-band. Uplink to the core network is a Layer-2 (dot1x trunk) vPC with one link per Nexus connected to two ports on a catalyst core switch that acts as a Layer-2+3 core router/switch. The catalyst is the gateway and HSRP active router in all VLANs. All VLANs are trunked on the vPC peer link and the virtual port-channel to the catalyst. Both Nexus 5600 have a Layer-3 config with SVI in some of the VLAN. Problem: SVI addresses of the Nexus are not reachable when the packet is forwarded to the peer Nexus due to port-channel load-balancing (src-dst-ip on the catalyst). This can be verified by shutting down one of the uplink vPC ports to force all traffic to one Nexus: All SVI addresses on the Nexus with the active link work while all addresses on the peer Nexus switch are dropped. The Packets are not forwarded over the Peer-link. The "peer-gatway" setting in the vpc domain has no effect on this behaviour! This bug is quite severe because it makes in-band management of Nexus 5600 series switches impossible. As a workaround we have connected the mgmt0 ports to the front side, but that is not an acceptable solution (both by design and due to the high port-costs per SFP+ port on the Nexus 5600 and all SVI addresses must be reachable for monitoring). ... View more

Hello, Having a Cat6500-E with SUP720/MSFC3 and a 7600-SSC-400 with two SPA-IPSEC-2G crypto cards. The old IOS (12.2(18)SXF8, old but stable) was working for years with crypto transform set of AH and ESP      crypto ipsec transform-set myts ah-sha-hmac esp-aes 256 perfectly well with HW acceleration (tested thouroughly, over several years). (Note that 15.2 does not support the SSC and SPA at all.) The Safe Harbor IOS12.2(33)SXI12 claims (and refuses to accept) the combination of AH with ESP is not supported by the Hardware: router(config)#crypto ipsec transform-set myts ah-sha-hmac esp-aes 256 Any combination of ESP and AH transform-set is not supported by current hardware crypto engine. The transform-set configuration will not be saved. Please configure a valid transform-set. which is false since the same hardware was doing just that for years. This is a bit of a problem since AH with HMAC is the only way to detect tampering of the IPSEC packets transport headers! Using ESP with HMAC (transform set ... esp-aes 256 esp-sha-hmac) is not a sufficient alternative because the HMAC only protects the payload (content of the EPS packet) - not the transport packet. The crypto engine hardware does support AH+ESP, as proven with the old IOS and >1 GBps IPSEC throughput for real-life traffic. ... View more

There is very little and quite diverse Information regarding the if, where and how of a Nexus 5000 or 5500 series Switch and support for IEEE 802.1AE Link Layer Encryption (also called MACsec). For example: the official FAQ denies that the Nexus 5500-series supports 802.1AE at all, while the data sheet says that only "downlink ports" are supported (host access). On the Nexus 7000 platform the 802.1AE link layer encryption is part of TrustSec (feature cts) and much better documented. The Question is: If and under which circumstances (configuration, L3 modules, license, NX/OS version) does a Nexus 5k or 5500 series Switch support 802.1AE on 1G or 10G interfaces that are directly connected to a Nexus 7000 (with the necessary cts feature licensed/configured)? ... View more

A Nexus 5010 running NX/OS 5.0(2)N2(1) with the following features n o feature telnet no telnet server enable no feature http-server feature tacacs+ cfs eth distribute feature udld feature interface-vlan feature lacp feature lldp feature fex and an active NTP and SNMP-Server v2c and v3 config as well as one VLAN1 interface configured for inband-mgmt: interface Vlan1    no shutdown    no ip redirects    ip address 10.1.2.3/24 Shows an unexpected unknown open or filtered UDP port in a Portscan: # nmap -sU -v -P0 10.1.2.3 -p 0-65535 ... Not shown: 65531 closed ports PORT      STATE         SERVICE 67/udp    open|filtered dhcps 68/udp    open|filtered dhcpc 123/udp   open|filtered ntp 161/udp   open|filtered snmp 11297/udp open|filtered unknown How can i find out what caused this port to be either open (what service?) or filtered (what ACL/implied filter?) Juergen ... View more