Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About phil_carter
Stats
Member since
07-22-2006
117
Posts
0
Helpful
0
Solutions
Created by
phil_carter
in Wireless and Mobility
in Wireless and Mobility
02-05-2019
02:44 AM
02-05-2019
02:44 AM
Hello,
We have been seeing this very problem with a 8540 HA pair, running 8.5.135.0. Cisco are struggling to find a resolution or link to any known bugs - any resolution detail would be much appreciated.
Thanks
Phil
... View more
04-19-2018
04:55 PM
Hello,
I am trying to configure some IPTVs that need IGMPv2 immediate leave enabled on the LAN. The LAN core consists of 6832s, and this feature is disabled by default. Does anyone know how to enable per VLAN:
Vlan 801:
--------
IGMP snooping Admin State : Enabled
IGMP snooping Oper State : Enabled
IGMPv2 immediate leave : Disabled <<<<<
Explicit host tracking : Enabled
Report suppression : Enabled
Robustness variable : 2
Last member query count : 2
Last member query interval : 1000
EHT DB limit/count : 100000/0
Check TTL=1 : Yes
Check Router-Alert-Option : Yes
'ip igmp snooping vlan x immediate-leave' config option is not available per VLAN or globally, the only option referencing immediate-leave seems to be 'ip igmp immediate-leave group-list xx'.
PID: C6832-X-LE
IOS: c6848x-ipservicesk9-mz.SPA.152-2.SY2.bin
Thoughts welcomed.
Thanks
Phil
... View more
Labels:
06-27-2016
01:10 AM
Hello,
I have been installing some new 3850 switches and had some problems building a stack of 3 same model types, but different version levels. Stacking the same version level has no problems (all V06 or all V07), but mixing version levels doesn't seem to work.
If I add a single V07 switch to an existing working V06 stack and use the 'software auto-upgrade enable' global command, the logs show that the master switch attempts to upgrade the V07 switch, but it always reports V-Mismatch (when performing show version), and never joins the stack.
PID: WS-C3850-24P , VID: V06
PID: WS-C3850-24P , VID: V07
Switch Ports Model SW Version SW Image Mode ------ ----- ----- ---------- ---------- ---- * 1 32 WS-C3850-24P 03.07.03E cat3k_caa-universalk9 INSTALL 2 32 WS-C3850-24P 03.07.03E cat3k_caa-universalk9 INSTALL
Are these versions compatible? Are there known issues?
Any information appreciated.
Thanks
Phil
... View more
Labels:
10-09-2015
02:03 AM
Hello, Thanks for the response - I have added the lines you suggested above. Alongside this, I completed some further troubleshooting - when the phase-1 isakmp is cleared at either end, it recovers immediately with only a single packet drop. However, when the lifetime value expires at the router end, this fails to recover the session, until a manual reset is completed at the FW end. Debug output points to specific error code 32: 144897: Oct 8 20:38:49: ISAKMP:(1266):deleting SA reason "IKE SA Lifetime Exceeded" state (R) QM_IDLE (peer REMOTE.x.x.x) 144898: Oct 8 20:38:49: ISAKMP: set new node 1472531594 to QM_IDLE 144899: Oct 8 20:38:49: ISAKMP:(1266): sending packet to REMOTE.x.x.x my_port 500 peer_port 500 (R) QM_IDLE 144900: Oct 8 20:38:49: ISAKMP:(1266):Sending an IKE IPv4 Packet. 144901: Oct 8 20:38:49: ISAKMP:(1266):purging node 1472531594 144902: Oct 8 20:38:49: ISAKMP:(1266):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL 144903: Oct 8 20:38:49: ISAKMP:(1266):Old State = IKE_P1_COMPLETE New State =IKE_DEST_SA 144904: Oct 8 20:38:49: ISAKMP:(1266):deleting SA reason "IKE SA Lifetime Exceeded" state (R) QM_IDLE (peer REMOTE.x.x.x) 144905: Oct 8 20:38:49: ISAKMP: Unlocking peer struct 0x2C01D5A0 for isadb_mark_sa_deleted(), count 1 144906: Oct 8 20:38:49: ISAKMP:(1266):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH 144907: Oct 8 20:38:49: ISAKMP:(1266):Old State = IKE_DEST_SA New State = IKE_DEST_SA 144908: Oct 8 20:38:49: ISAKMP (1267): received packet from REMOTE.x.x.x dport 500 sport 500 Global (R) MM_KEY_EXCH 144909: Oct 8 20:38:49: ISAKMP:(1267):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH 144910: Oct 8 20:38:49: ISAKMP:(1267):Old State = IKE_R_MM4 New State = IKE_R_MM5 144911: Oct 8 20:38:49: ISAKMP:(1267): processing ID payload. message ID = 0 144912: Oct 8 20:38:49: ISAKMP (1267): ID payload next-payload : 8 type : 1 address : REMOTE.x.x.x protocol : 0 port : 0 length : 12 144913: Oct 8 20:38:49: ISAKMP:(0):: peer matches *none* of the profiles 144914: Oct 8 20:38:49: ISAKMP:(1267): processing HASH payload. message ID = 0 144915: Oct 8 20:38:49: ISAKMP:(1267):SA authentication status: authenticated 144916: Oct 8 20:38:49: ISAKMP:(1267):SA has been authenticated with REMOTE.x.x.x 144917: Oct 8 20:38:49: ISAKMP:(1267):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE 144918: Oct 8 20:38:49: ISAKMP:(1267):Old State = IKE_R_MM5 New State = IKE_R_MM5 144919: Oct 8 20:38:49: ISAKMP:(1267):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR 144920: Oct 8 20:38:49: ISAKMP (1267): ID payload next-payload : 8 type : 1 address : LOCAL.x.x.x protocol : 17 port : 500 length : 12 144921: Oct 8 20:38:49: ISAKMP:(1267):Total payload length: 12 144922: Oct 8 20:38:49: ISAKMP:(1267): sending packet to REMOTE.x.x.x my_port 500 peer_port 500 (R) MM_KEY_EXCH 144923: Oct 8 20:38:49: ISAKMP:(1267):Sending an IKE IPv4 Packet. 144924: Oct 8 20:38:49: ISAKMP:(1267):Returning Actual lifetime: 180 144925: Oct 8 20:38:49: ISAKMP: set new node -2129989191 to QM_IDLE 144926: Oct 8 20:38:49: ISAKMP:(1267):Sending NOTIFY RESPONDER_LIFETIME protocol 1 spi 739008696, message ID = 2164978105 144927: Oct 8 20:38:49: ISAKMP:(1267): sending packet to REMOTE.x.x.x my_port 500 peer_port 500 (R) MM_KEY_EXCH 144928: Oct 8 20:38:49: ISAKMP:(1267):Sending an IKE IPv4 Packet. 144929: Oct 8 20:38:49: ISAKMP:(1267):purging node -2129989191 144930: Oct 8 20:38:49: ISAKMP: Sending phase 1 responder lifetime 180 144931: Oct 8 20:38:49: ISAKMP:(1267):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE 144932: Oct 8 20:38:49: ISAKMP:(1267):Old State = IKE_R_MM5 New State = IKE_P1_COMPLETE 144933: Oct 8 20:38:49: ISAKMP:(1267):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE 144934: Oct 8 20:38:49: ISAKMP:(1267):Old State = IKE_P1_COMPLETE New State =IKE_P1_COMPLETE 144935: Oct 8 20:38:49: ISAKMP (1267): received packet from REMOTE.x.x.x dport 500 sport 500 Global (R) QM_IDLE 144936: Oct 8 20:38:49: ISAKMP: set new node 1584984 to QM_IDLE 144937: Oct 8 20:38:49: ISAKMP:(1267): processing HASH payload. message ID = 1584984 144938: Oct 8 20:38:49: ISAKMP:(1267): processing SA payload. message ID = 1584984 144939: Oct 8 20:38:49: ISAKMP:(1267):Checking IPSec proposal 1 144940: Oct 8 20:38:49: ISAKMP: transform 1, ESP_AES 144941: Oct 8 20:38:49: ISAKMP: attributes in transform: 144942: Oct 8 20:38:49: ISAKMP: SA life type in seconds 144943: Oct 8 20:38:49: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10 144944: Oct 8 20:38:49: ISAKMP: authenticator is HMAC-SHA 144945: Oct 8 20:38:49: ISAKMP: encaps is 1 (Tunnel) 144946: Oct 8 20:38:49: ISAKMP: key length is 256 144947: Oct 8 20:38:49: ISAKMP:(1267):atts are acceptable. 144948: Oct 8 20:38:49: ISAKMP:(1267): IPSec policy invalidated proposal with error 32 144949: Oct 8 20:38:49: ISAKMP:(1267): phase 2 SA policy not acceptable! (local LOCAL.x.x.x remote REMOTE.x.x.x) 144950: Oct 8 20:38:49: ISAKMP: set new node -355309961 to QM_IDLE 144951: Oct 8 20:38:49: ISAKMP:(1267): Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 739007736, message ID = 3939657335 144952: Oct 8 20:38:49: ISAKMP:(1267): sending packet to REMOTE.x.x.x my_port 500 peer_port 500 (R) QM_IDLE 144953: Oct 8 20:38:49: ISAKMP:(1267):Sending an IKE IPv4 Packet. 144954: Oct 8 20:38:49: ISAKMP:(1267):purging node -355309961 144955: Oct 8 20:38:49: ISAKMP:(1267):deleting node 1584984 error TRUE reason "QM rejected" Any ideas? Thanks Phil
... View more
10-07-2015
03:37 AM
Hello, I have set up an IPSEC tunnel between a CISCO1921/K9 and Checkpoint FW runing a GRE tunnel over it for local to remote site connectivity. Config below: crypto isakmp policy 10 encr aes 256 authentication pre-share group 2 crypto isakmp key <key> address FAR.x.x.x ! crypto ipsec security-association idle-time 3600 ! crypto ipsec transform-set SITE_Transform esp-aes 256 esp-sha-hmac mode tunnel ! ! crypto map Site_Map 10 ipsec-isakmp set peer FAR.x.x.x set transform-set SITE_Transform match address 160 ! ! interface GigabitEthernet0/0 description Internet Provision ip address LOCAL.x.x.1 255.255.255.252 ip access-group 161 in duplex auto speed auto no cdp enable crypto map Site_Map ! access-list 160 permit gre host 10.200.4.29 host 10.171.0.126 access-list 160 permit icmp host 10.200.4.29 host 10.171.0.126 ! access-list 161 deny gre any any access-list 161 permit esp host FAR.x.x.x host LOCAL.x.x.1 access-list 161 permit esp host LOCAL.x.x.1 host FAR.x.x.x access-list 161 permit ip host FAR.x.x.x host LOCAL.x.x.1 access-list 161 permit ip host LOCAL.x.x.1 host FAR.x.x.x ! interface Loopback0 description Used-for-GRE-IPSEC-Only ip address 10.200.4.29 255.255.255.255 no ip redirects no ip unreachables ! interface Tunnel1 description link to MRTX_R28_484 bandwidth 10000 ip address 172.16.122.93 255.255.255.252 ip mtu 1400 keepalive 10 3 tunnel source Loopback0 tunnel destination 10.171.0.126 ! ip route 10.171.0.126 255.255.255.255 LOCAL.x.x.2 ip route FAR.x.x.x 255.255.255.255 LOCAL.x.x.2 CISCO1921/K9: c1900-universalk9-mz.SPA.154-3.M2.bin NOkia IP1280 checkpoint version is R75.40 All settings and ACLs defining interesting traffic have been matched up. The keepalive value for phase-1 ISAKMP is 24-hours, but bang on this time the IPSEC tunnel drops everyday, then tries to reset itself, but takes anything up to an hour to complete. Obviously this knocks out the site until fully completed. Does anyone know of any known issues or ways to resolve? Thanks Phil
... View more
Labels:
06-30-2015
03:42 AM
mdix auto only affects whether a straight or cross-over cable is required. The same config has been applied on the 3650 that was on the 3750 with same cable and end device. Also, I believe if you turn this on, you must set speed/duplex to auto as well, which is not our company policy (introduces risk of half duplex connections to end devices that have set speed and duplex). That and not all end devices support the mdix feature anyway.
... View more
06-30-2015
01:59 AM
Hello, We have migrated some 3750s to new 3650s and seen serious connectivity issues when re-patching Windows 7 clients and servers across from old to new. The same config is applied but the ports never come up. The workaround is to default the interface configuration and then re-apply all but the 'speed 100' setting: interface GigabitEthernet1/0/20 switchport access vlan 4 switchport mode access switchport voice vlan 501 duplex full no snmp trap link-status no mdix auto storm-control broadcast level 5.00 storm-control multicast level 30.00 spanning-tree portfast YARNTN_A_CC365_01(config-if)#do sh int g1/0/20 status Port Name Status Vlan Duplex Speed Type Gi1/0/20 connected 4 half a-100 10/100/1000BaseTX The duplex setting is also mismatched on the switch - even though hard coded full, it comes up as half. By adding 'speed 100' it drops the connection altogether. Details: PID: WS-C3650-24PS , VID: V02 Switch Ports Model SW Version SW Image Mode ------ ----- ----- ---------- ---------- ---- * 1 28 WS-C3650-24PS 03.03.04SE cat3k_caa-universalk9 INSTALL Anyone seen this problem and know of a fix? Thanks Phil
... View more
Labels:
Created by
phil_carter
in Wireless and Mobility
in Wireless and Mobility
04-15-2014
06:17 AM
04-15-2014
06:17 AM
Hello, I have a wireless network using 5508 WLCs and 3600APs. We are seeing a lot of fragmented packets between controllers which are being dropped by firewalls. Looking at the settings on the APs the default size set for mtu is 1485, meaning by the time capwap & IP headers are added, this goes above he standard 1500bytes when fragmentation is seen. Is there a way to reduce this via the WLC or AP itself? FYI: Global TCP Adjust MSS is set to 1363 which effects TCP traffic... but UDP (Cisco Controller) >show ap config general IHPR11_A_AP360_011 Cisco AP Identifier.............................. 0 Cisco AP Name.................................... IHPR11_A_AP360_011 Country code..................................... GB - United Kingdom Regulatory Domain allowed by Country............. 802.11bg:-E 802.11a:-E AP Country code.................................. GB - United Kingdom AP Regulatory Domain............................. 802.11bg:-E 802.11a:-E Switch Port Number .............................. 13 MAC Address...................................... 30:f7:0d:d3:67:27 IP Address Configuration......................... DHCP IP Address....................................... 10.249.133.245 IP NetMask....................................... 255.255.255.0 Gateway IP Addr.................................. 10.249.133.254 NAT External IP Address.......................... None CAPWAP Path MTU.................................. 1485 <<<<<<<<<<<<<<<<<<<<<<<< Many thanks Phil
... View more
- Tags:
- AP_MTU WLC_5508
Labels:
08-02-2013
08:21 AM
Also - if I place the customer in cos 4 (for instance), and into another output queue, it runs at 80m fine with no drops.... seems to be a problem with queue 1 only.... Any help/advice appreciated.
... View more
08-02-2013
07:33 AM
Hello, I have a WS-C3560C-8PC-S running c3560c405-universalk9-mz.122-55.EX3 (ipbaase licence) and have the below qos configured: interface FastEthernet0/5 description Q-in-Q to <cust-network> switchport access vlan 20 switchport mode dot1q-tunnel speed 100 duplex full mls qos cos 1 mls qos cos override ! interface FastEthernet0/1 description facing eth-WAN-link-to-far-end switchport trunk encapsulation dot1q switchport mode trunk speed 100 duplex full srr-queue bandwidth share 12 5 1 2 mls qos trust cos ! mls qos srr-queue output cos-map queue 1 threshold 1 1 mls qos srr-queue output cos-map queue 2 threshold 1 2 mls qos srr-queue output cos-map queue 3 threshold 1 0 4 6 7 mls qos srr-queue output cos-map queue 4 threshold 1 5 ! mls qos queue-set output 1 buffers 60 25 5 10 ! I have marked a customer in a particular cos value for all packets coming into my switch, and then mapped that cos value to a queue and threshold within that queue-set (assigned 60% of available buffers). I have then applied SRR share output queueing on the uplink to ensure the customer gets 60% of bandwidth effectively in times of congestion (it gets served 12 times out of every 20 packets if all queues are full).Nothing else is on the switch currently, just this one end customer. Before applying QoS I could run an ethernet tester at 80m through the link to the far end with no loss of perfomance issues (80m seen at far end). Now I have applied the above QoS config however, the QoS settings kick in immediately, with the tester dropping down to 4m max. The threshold is being hit and dropping packets on the egress queue on the uplink. My questions are: 1) why is QoS kicking in anyway given the link isnt congested? 2) why is is reducing it to 4m only given the buffers/srr-queue bandwidth are set to 60%? Help much appreciated, thanks Phil
... View more
Labels:
Created by
phil_carter
in Networking Documents
in Networking Documents
10-25-2012
06:15 AM
10-25-2012
06:15 AM
Hello, We have recently seen this alarm in our 6500 nodes (using MST and exceeded 6000)... what is the actual impact to the device/network as it doeasn't actualy state anything in the above? thanks Phil
... View more
10-08-2012
03:04 AM
Hi, We have QoS configured throughout the company, but the standard config we have applied across the 3750 switches only includes the below: int f1/0/1 sw acc vlan 501 sw acc voice vla 601 priority-queue out <<<<<<< ... We have IP phones (not cisco) attached that are marking with EF, and the PC is an untrusted end device (so needs to be by default marked as zero). Is the above enough to trust VOIP DSCP EF without resetting it to DSCP 0, or do I also need to add a trust line (i.e.: mls qos trust dscp)? Thanks Phil
... View more
Labels:
Created by
phil_carter
in Network Management
in Network Management
06-28-2012
12:40 AM
06-28-2012
12:40 AM
used a MAC address from an interface on the router as the snmp engine ID - all working - thanks.
... View more
Created by
phil_carter
in Network Management
in Network Management
06-27-2012
08:22 AM
06-27-2012
08:22 AM
Hello - yes it has the same engine ID shown in sh snmp engine command - I see this can be changed using a local engine ID (see below), but what hex value should be used per device to make sure this is unique (I tried using a hex conversion of an IP on the device but it stated it needs 10 digits)? snmp-server enigne local <10-digit-hex-value> Is there a standard policy to follow? Thanks Phil
... View more
Created by
phil_carter
in Wireless and Mobility
02-05-2019
02-05-2019
Hello, We have been seeing this very problem with a 8540 HA pair,
running 8.5.135.0. Cisco are strug...
04-19-2018
Hello, I am trying to configure some IPTVs that need IGMPv2 immediate
leave enabled on the LAN. The ...
Created by
phil_carter
in Switching
06-27-2016
06-27-2016
Hello, I have been installing some new 3850 switches and had some
problems building a stack of 3 sam...
10-09-2015
Hello,Thanks for the response - I have added the lines you suggested
above.Alongside this, I complet...
Created by
phil_carter
in Routing
10-07-2015
10-07-2015
Hello,I have set up an IPSEC tunnel between a CISCO1921/K9 and
Checkpoint FW runing a GRE tunnel ove...
06-30-2015
mdix auto only affects whether a straight or cross-over cable is
required. The same config has been ...
06-30-2015
Hello,We have migrated some 3750s to new 3650s and seen serious
connectivity issues when re-patching...
Created by
phil_carter
in Wireless and Mobility
04-15-2014
04-15-2014
Hello,I have a wireless network using 5508 WLCs and 3600APs. We are
seeing a lot of fragmented packe...
08-02-2013
Also - if I place the customer in cos 4 (for instance), and into another
output queue, it runs at 80...
08-02-2013
Hello,I have a WS-C3560C-8PC-S running
c3560c405-universalk9-mz.122-55.EX3 (ipbaase licence) and hav...
10-25-2012
Hello,We have recently seen this alarm in our 6500 nodes (using MST and
exceeded 6000)... what is th...
10-08-2012
Hi,We have QoS configured throughout the company, but the standard
config we have applied across the...
Created by
phil_carter
in Network Management
06-28-2012
06-28-2012
used a MAC address from an interface on the router as the snmp engine ID
- all working - thanks.
Created by
phil_carter
in Network Management
06-27-2012
06-27-2012
Hello - yes it has the same engine ID shown in sh snmp engine command -
I see this can be changed us...
Public Statistics
| Date Registered | 07-22-2006 06:44 AM |
| Date Last Visited | 02-12-2019 02:45 AM |
| Total Messages Posted | 117 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 3 | |
| 4 | |
| 8 | |
| 4 | |
| 3 |
.jpg "Hall of Fame Guru"){kind=icon}
