Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Trinh Nguyen
Trinh Nguyen
Beginner
Senior Network Engineer at Boys Town in Nebraska.
Bachelor of Science Degree in Electronic Engineer
Certified by Cisco and Aruba with a current Cisco Certified Network Associate Switching and Routing, Aruba Mobile Certified Professional, and Aruba Certified ClearPass Professional.
Recent Badges
Stats
Member since
01-21-2011
39
Posts
15
Helpful
0
Solutions
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
09-19-2018
04:13 AM
09-19-2018
04:13 AM
Changing the global TACACS and TACACS providers timeout to 30 seconds seem to help. I don't get full 30 seconds, but enough time for user to react.
Found the delay issue between NAC and DUO, not in the APIC. The NAC timeout setting was default at 10 seconds so it is not enough time. Cisco iOS in CLI works because it takes less time then APIC in GUI to complete the authentication.
Change timeout at NAC to 30 seconds solves the problem.
... View more
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
09-17-2018
12:34 PM
09-17-2018
12:34 PM
Current access to APIC, Leaves or Spines using TACACS are without any issues. We need to tighten security for ACI and many critical devices in our network by changing from normal TACACS to TACACS with MFA. I have no issue to convert all Cisco iOS devices, only with ACI. Because MFA needs more time to authenticate, a successful converting to MFA needs to extend the authentication timeout from default 10 seconds to 30 seconds or more. 60 seconds is the maximum allow for timeout in Cisco iOS and also in ACI. We deployed DUO for MFA where users must register and download DUO app to their phones to receive a “push” and response back. I changed ACI timeout to 60 seconds (Figure 1,2), but the timeout tripped at 14 seconds (Figure 3). When a user accesses the device, It takes somewhere between 8 to 10 seconds for DUO MFA to send out a push, so with 14 seconds timeout, user has only 4 seconds to react, not enough time, authentication fails. This shortage of timeout observes in both GUI and console. ACI Version 2.3(1o)
Thanks,
... View more
- Tags:
- MFA
Labels:
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
05-24-2018
01:10 PM
05-24-2018
01:10 PM
Have you ever looked for a policy in APIC 2.3, you know it is in there somewhere in the tree, but just don’t know where it is and it takes many mouse clicks to locate it.
Is it available in ACI to show something like “Site Map”, or policy hierarchy?
Thanks,
... View more
Labels:
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
05-07-2018
02:15 PM
05-07-2018
02:15 PM
I got this answer, hope it helps you: https://supportforums.cisco.com/t5/application-centric/vmware-trunk-port-group-and-dynamic-vlan/td-p/3313049
... View more
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
04-25-2018
09:01 AM
04-25-2018
09:01 AM
I am working on cleaning up errors in my ACI Fabric. The particular CRITICAL error F0532 where the ports are down but used by EPG. I have cleaned up all with the same errors in other leaves, but only one stuborn leave the error cannot be clear.
Fault Code: F0532
Severity: Critical
Description: Port is down, reason:sfpAbsent(connected), used by:EPG
ACI version 2.2(1o)
Confirm port is no longer used in EPG with moquery:
APIC1# moquery -c fvRsPathAtt -x 'query-target-filter=eq(fvRsPathAtt.tDn,"topology/pod-1/paths-114/pathep-[eth1/35]")'
No Mos found
APIC1#
Thanks for any suggestions.
Regards,
... View more
Labels:
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
03-06-2018
02:16 PM
03-06-2018
02:16 PM
From your picture, in VPC switch Pairs, do the switches that you want to VPC show in a VPC Domain Id? If not you need to create one for them.
... View more
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
01-17-2018
11:32 AM
01-17-2018
11:32 AM
The provided solution is clearly explain and works. Many thanks for the support.
... View more
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
01-17-2018
09:25 AM
01-17-2018
09:25 AM
Gabriel,
Thanks for the suggestion. My ACI is 2.2(1o)
... View more
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
01-17-2018
09:14 AM
01-17-2018
09:14 AM
I need a VM appliance in Vmware that requires multi-Vlan trunk to up-link port. I created a Trunk Port Group (TPG) in Vmware vDS that include all Vmware dynamic Vlans. VM team connects the appliance to this TPG. The appliance requires static IP addresses, and STATIC Vlans.
For instance: My EPG1 Vlan 100 mapped to VM Vlan 3000 inside ACI, so I configured my appliance IP address in interface Vlan 3000, and it works.
My problem: VM team told me Vlan 3000 is dynamic and it will change when they do maintenance. If this Vlan 3000 changes, my appliance will be disconnected.
Question: Can I make EPG1 static to Vlan 3000 inside ACI? Or any other suggestions?
Thanks,
Trinh
... View more
Labels:
12-27-2017
12:59 PM
I have this code that when execute all tenants print out line by line including 'Production' but when check for t == 'Production' it is not true tenants = Tenant.get(session) for t in tenants: print t if t == 'Production': #why this line is never true? print "TRUE"
... View more
- Tags:
- tenant
Labels:
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
12-21-2017
08:15 AM
12-21-2017
08:15 AM
Done, many thanks Chris!
... View more
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
12-21-2017
06:33 AM
12-21-2017
06:33 AM
I created a new EPG “NEW” and Vlan for VM team, adding Leaf interfaces to them. All of these port threw me error code 4067 due to Invalid Path Configuration,Invalid VLAN Configuration.
First I thought it is a piece of cake, which I have been there done that, but I could not locate this error this time.
I know they are NOT invalid VLAN because I created VLAN and checked the AAEP to make sure this VLAN is there
I know they are NOT invalid path because these ports are in production and they are working without error in another EPG named “SERVER”
These ports are NOT in port channel
These ports are in leaves, not in FEX
This CLI for one of the ports with this error
APIC1# show running-config leaf 111 int eth 1/11
# Command: show running-config leaf 111 int eth 1/11
# Time: Thu Dec 21 08:15:46 2017
leaf 111
interface ethernet 1/11
# policy-group Switch111-112_BU-DD02_PolGrp
switchport trunk allowed vlan 99 tenant Production application AP-Prod epg NEW
switchport trunk native vlan 1502 tenant Production application AP-Prod epg SERVER
exit
exit
APIC1#
I am looking for suggestions to get rid of this error. My ACI version 2.2(1o)
Best Regards,
... View more
Labels:
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
10-24-2017
08:21 AM
10-24-2017
08:21 AM
First, a fair warning: if you install ACI Toolkit successfully, in the samples folder, there are many scripts you can try. All the scripts with the name “aci-show…” are OK to run, but do not run other scripts like tutorial.py in your production environment until you understand what the script is doing.
To answer your question, if you ask those ACI developers/programmers, they will tell you sky is the limit what can you do with the script, but I am a network engineer try to learn programming so I think it is very limit and not useful.
Below is a script that can mimic the “show ip int brief”. My point is why do I have to go to all the trouble to write this script?
import json
import acitoolkit.acitoolkit as ACI
creds = ACI.Credentials('apic')
args = creds.get()
sess = ACI.Session(args.url, args.login, args.password)
sess.login()
dat = []
r = sess.get('/api/class/ipv4Addr.json')
intfs = json.loads(r.text)['imdata']
for i in intfs:
dat.append((
i['ipv4Addr']['attributes']['addr'],
#i['ipv4Addr']['attributes']['operSt'],
#i['ipv4Addr']['attributes']['operStQual'],
#i['ipv4Addr']['attributes']['dn']
))
for rec in dat:
print rec
... View more
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
10-24-2017
07:22 AM
10-24-2017
07:22 AM
I have failed when doing the Linux because my limitation of the OS itself so I use Windows. If you want to try Windows version, you need to install git-2.14.2.2-64bit, python-2.7.14.amd64, and VCForPython27 (for simplification and compatibility, use Python 2.7, not 3),
*The git installs a Git Shell where you have Linux like environment such as vim, cat...
*Python-2.7 is the compiler
*VCForPython is another Windows app to install Python.
After all three apps install, you can follow the instruction download and install ACI Toolkit
Hope that helps.
... View more
Created by
Trinh Nguyen
in Application Centric Infrastructure
in Application Centric Infrastructure
10-24-2017
06:57 AM
10-24-2017
06:57 AM
I installed and tested ACI Toolkit in Windows 10. It works, but with limit support. The document is version 0.1 at https://acitoolkit.readthedocs.io/en/latest/, it seems for programmers.
I suggest before trying the ACI Toolkit, go through all free lessons (about 10 lessons) online from this book “Learn Python the Hard Way” then if you like it, buy the book.
I wish we can have a decent forum to discuss about this tool.
... View more
09-19-2018
Changing the global TACACS and TACACS providers timeout to 30 seconds
seem to help. I don't get full...
09-17-2018
Current access to APIC, Leaves or Spines using TACACS are without any
issues. We need to tighten sec...
05-24-2018
Have you ever looked for a policy in APIC 2.3, you know it is in there
somewhere in the tree, but ju...
Created by
Trinh Nguyen
in Application Centric Infrastructure
05-07-2018
05-07-2018
I got this answer, hope it helps
you:https://supportforums.cisco.com/t5/application-centric/vmware-t...
Created by
Trinh Nguyen
in Application Centric Infrastructure
04-25-2018
04-25-2018
I am working on cleaning up errors in my ACI Fabric. The particular
CRITICAL error F0532 where the p...
Created by
Trinh Nguyen
in Application Centric Infrastructure
03-06-2018
03-06-2018
From your picture, in VPC switch Pairs, do the switches that you want to
VPC show in a VPC Domain Id...
Created by
Trinh Nguyen
in Application Centric Infrastructure
01-17-2018
01-17-2018
The provided solution is clearly explain and works. Many thanks for the
support.
Created by
Trinh Nguyen
in Application Centric Infrastructure
01-17-2018
01-17-2018
Gabriel, Thanks for the suggestion. My ACI is 2.2(1o)
Created by
Trinh Nguyen
in Application Centric Infrastructure
01-17-2018
01-17-2018
I need a VM appliance in Vmware that requires multi-Vlan trunk to
up-link port. I created a Trunk Po...
12-27-2017
I have this code that when execute all tenants print out line by line
including 'Production' but whe...
12-21-2017
I created a new EPG “NEW” and Vlan for VM team, adding Leaf interfaces
to them. All of these port th...
Created by
Trinh Nguyen
in Application Centric Infrastructure
10-24-2017
10-24-2017
First, a fair warning: if you install ACI Toolkit successfully, in the
samples folder, there are man...
Created by
Trinh Nguyen
in Application Centric Infrastructure
10-24-2017
10-24-2017
I have failed when doing the Linux because my limitation of the OS
itself so I use Windows. If you w...
Created by
Trinh Nguyen
in Application Centric Infrastructure
10-24-2017
10-24-2017
I installed and tested ACI Toolkit in Windows 10. It works, but with
limit support. The document is ...
Public Statistics
| Date Registered | 01-21-2011 08:05 PM |
| Date Last Visited | 11-05-2019 11:15 PM |
| Total Messages Posted | 39 |
| Total Helpful Votes Received | 15 |
