Not to worry, there is some ambiguity in the documentation on these. In fact, I have seen what you are talking about on the older IGESM modules. In fact, the newer modules do not allow you to set the access vlan of the internal facing port which is now a layer 3 fast ethernet port that gets configured by the management modules.  This was a source of much grief for me when I migrated our entire data center from the IGESM modules to 3012s. I remember having TAC triple check then check again because of issues we had had previously with the IGESMs.  At the end of the day, I have found the 3012 & 3110G switches to be much more robust. We have had zero issues with them. ... View more

The 6120s cannot be stacked. You're going to want to configure them in end host configuration mode with vPC uplinks.  Brad Hedlund is the best source for information on this. Here is an article on best practices for uplinking UCS: http://bradhedlund.com/2010/06/22/cisco-ucs-networking-best-practices/ Specifically, this video explains what is likely your optimal configuration: http://vimeo.com/12782072 Jason ... View more

Jon, These switches do have an internal connection, but it is a management access interface only and not for data traffic.  This internal connection connects to the management modules in the IBM chassis and typically management traffic is actually routed out-of-band through the management modules to the switches while all other data traffic is directed out the external ports on the back.  The switches cannot pass data traffic with their internal connection. In order to accomplish this, he will need to connect the external ports in a trunk configuration or connect both switches to a distribution layer. ... View more

He doesn't need to stack the switches. He only needs a trunk interface between them. ... View more

Are these the only switches in your infrastructure? The ports on the back of these switches are really meant to uplink to your switching infrastructure.. If you require that you use only these switches, then, yes, what you need is a trunk port between the two switches. The external interfaces can be configured as trunk interfaces on each switch and connected to each other.  You could also bond two interfaces on each switch into an etherchannel if you wish to connect more than one interface without shutting it down with spanning tree.  The only odd magic going on with these switches is the way that the management is handled through the AMM modules. Other than that, they are just normal switches with 14 internal interfaces for the blade servers and 4 external interfaces for uplinks. I'm curious about your use case though. Are you attempting to configure each IBM bladecenter basically as an independent security zone with a pair of ASAs?  Is this a service provider scenario? Jason ... View more

The key components of the config you will need are as follows: ! Radius Config aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius radius-server host YOUR_SERVER radius-server key YOUR_KEY ! Enable dot1x globally dot1x system-auth-control ! Configure the interfaces interface range YOUR_RANGE_OF_ACCESS_PORTS switchport switchport mode access switchport access vlan YOUR_ACCESS_VLAN dot1x port-control auto no shut That is the basic config. You can also get into fancy features, like setting a guest access vlan for when 802.1x authentication fails, etc. The switch configuration is relatively simple. I actually run into more trouble with the radius configuration and configuration of clients for 802.1x pieces. ... View more

Cisco has an ADSL HWIC module that will work with the 2811 http://www.cisco.com/en/US/customer/prod/collateral/routers/ps221/product_data_sheet0900aecd8028aa5a_ps5854_Products_Data_Sheet.html It should take 4 of these out of the box and possibly 8 if you convert the NME bay.  PPP Multilink is an available feature and you certainly could set up routing for active & standby links as well. Jason ... View more

A port is actually only blocking when the switch powers up, but ports will go back through listening and learning while the spanning tree is recalculated and in both the listening and learning states data frames are discarded. Only when ports move into the forwarding state are data frames transmitted. ... View more

If I understand you correctly, you had an existing root switch with an attached edge switch. You plugged a new edge switch into the root that happened to have the same bridge priority (I'm guessing with a lower MAC ) to the root switch. If we are talking about STP and not RSTP, when you did this you forced an election of a new root bridge. In STP, all switches in a topology must agree on a root bridge. Even though your existing edge switch only had one uplink and the new root bridge was in the same direction, outages can occur because all the switches need to agree on the new root and then ensure they still have the best path to the new root. ... View more

Can you show the output from the following command on your core switch? sh spanning-tree det | i executing | last change | from ... View more

Understood. I actually did a search for patents on ERSPAN but found only the one you linked to and others that mention the technology. Again if anyone has more documentation or information on Cisco's direction and intent for this technology, I would be interested in reviewing it. There are troubleshooting techniques that can be done today with ERSPAN and Wireshark that cannot be easily accomplished otherwise. For example, by setting up several ERSPAN source sessions, each with a different ID and spanning them all to a single instance of wireshark which is capture filtering for gre you can follow a packet through the switching infrastructure. You will see multiple instances of a packet, but with a different ERSPAN ID in the metadata contained in the header so that you can confirm a packet comes in on one interface and leaves on another or does not leave the switch at all. This is useful for locating where drops are occurring, especially on the 1000v where you have many source sessions available. Using this I was able to see a packet from a virtual machine being forwarded out an incorrect port, causing the upstream infrastructure to learn the MAC on the wrong port and begin forwarding traffic to it which was subsequently dropped by the 1000v loop prevention. This kind of troubleshooting is quick & easy with ERSPAN while it can be tricky to accomplish with other tools. I understand that Cisco is using ERSPAN primarily to send to their NAM and IDS, but this secondary use is immensely valuable and should not be ignored.  More thorough documentation or even Cisco involvement in attempts of projects like Wireshark to understand the protocol only stand to benefit the community. Jason ... View more

Which 10GE card are you using? Is it a DFC? ... View more