Hi folks   We currently have VMM integration in ACI configured and running. VMWare is on version 6.5. We recently upgraded ACI to v.4.0(2c) but we have never gone through a VMWare upgrade.   We plan to go from v.6.5 to v.6.7u2. Will this upgrade affect the VMM integration and the current DVS switch configuration?    Has anyone done a VMWare upgrade with ACI and VMM integration?   Many thanks Roy ... View more

Hi   I attempted an upgrade of a ASA 5585-X cluster from v.9.1(2) to 9.10(1). The actual upgrade was fine but then we noticed that a large number of servers behind the firewall could not be accessed. This seemed to be intermittent, as some were ok others were not, even if they were on the same vlan.   Unfortunately, I could not do much troubleshooting, as this affected some key services, so I had to back out and reboot the cluster on v.9.1(2). As soon as we downgraded, performance was immediately back to normal.   However, looking through our syslogs, I noticed that during the affected period, I have a large number, i.e. at least 500 per minute, of "%ASA-4-419002: Duplicate TCP SYN". During normal operations, before and since the upgrade, I do not see any of these messages.    I'm still researching this but a lot of articles about this error mention spoofing, possible attacks or a routing problem. The cluster is our DMZ firewall, so has internal connections only. If I had some dodgy device on our network or we had a routing issue, surely I would see these messages all the time but I don't.    Has anyone upgraded to v.9.10 yet? Has anyone seen this issue with an upgrade?    Thanks Roy ... View more

Hi   We have VMM integration set up for our ESX 6.5 environment. When this was set up, Vcenter was installed on a Windows server. We are now looking to upgrade to ESX 6.7 and apparently this will be the last version to support Vcenter on Windows. It looks like they are pushing people towards the Vcenter appliance. So, my guys are thinking, as part of our upgrade, it would make sense to replace the existing Vcenter server with the appliance.   Has anyone looked at this yet or even done it? How does it affect the VMM integration?   Even if we just upgrade the existing Windows Vcenter server to 6.7, do I need to update anything on the VMM domain? e.g. the DVS reports v.6.5 but I cannot seem to change this. Does ACI automatically get the version number from VMWare?   Many thanks Roy     ... View more

Hi   We have some ASR1004 routers and I want to upgrade them.   We currently have 3.16.05 installed with the system image as bootflash:/asr1000rp2-adventerprisek9.03.16.05.S.155-3.S5-ext.b. I want to upgrade to 16.6.5 but the documents I read about IOS XE 16, refer to licenses. Currently, we have no additional license installed, as we did not need one when we purchased these routers. There is no "show license" command to check.   If I upgrade to v.16, do we need to get a license or not?   Thanks in advance Roy ... View more

Hi   I wonder if anyone has come across this. We have an ASA cluster of 2 * 5585. There is a port-channel interface from the cluster to a Nexus 7706 switch. The port-channel is a trunk interface as there are a lot of vlan interfaces configured on the ASA. We have OSPF configured on 1 of the sub-interfaces between the cluster and switch.    We have had the MTU set to 9000 on the port-channel sub-interface on the cluster and the vlan interface on the Nexus switch. This has been in place and working without an issue for the past 18 months.   The other day, the OSPF routes on the ASA stopped being redistributed and users could not access anything behind the firewall. Upon investigation, the ASA and switch neighbor status was in EXSTART and EXCHANGE (Unfortunately, I did not take proper notes as I was under pressure to get it back up but I think it was EXSTART on the switch and EXCHANGE on the ASA).   After checking the MTU settings, everything looked correct. Removing the interface configs and re-applying did not resolve the issue. I then remove the MTU settings, which put it back to 1500 and the OSPF neighbors re-established, the routes re-distributed and users could access the servers. If I put the MTU 9000 back on both devices, nothing worked, so I have now had to leave the connection with an MTU of 1500. So far, this is not causing any issues but I will keep monitoring.    Does anyone have any idea why this would suddenly break? Has anybody seen this before? No work was being done on the ASA or switch prior to the issue, so this is a bit of a strange one.    Thanks Roy ... View more

Hi   I'm trying set up micro-segmentation and going through the ACI virtualizaton guide https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/virtualization/b_ACI_Virtualization_Guide_2_3_1/b_ACI_Virtualization_Guide_2_3_1_chapter_0100.html   This document says that uSeg using VSphere VDS is not support on the Nexus 9372TX or 8372PX switches. Can anyone confirm if this is correct? And also why? What are the limitations on these switches that prevents us from setting up uSeg using these switches?   This is a little annoying as nobody mentioned that they were not fully compatible when we purchased the switches.    Thanks Roy ... View more