I am working on an upgrade from Nexus 7010 running NX-OS version 5.1(4) to Nexus 9500 running version 9.2(3) and am looking to minimize downtime for the client.   My question: is is possible to create a vPC between the N7K and the N9K temporarily as we transition to the new hardware.  I know you can have minor version differences in the vPC peers while upgrading one of the devices, but this is a major difference.  Since everything is dual connected the idea is to remove the existing N7K secondary switch, add the N9K secondary and wait for it to come online and synchronize, move the connections from the powered down N7k to the online N9K secondary.  Then follow the same procedure for the configured primary switches.  Is this a workable plan or should we take the 15 minute outage a move all connections to the new N9K pair?   Looking for your guidance and recommendations. Thanks, Bill ... View more

Looking for the process to upgrade ACI mode Switches (leafs or spine) without an APIC.  Client is adding switches to an existing environment and wants us to stage the switches in our facility.  I found the following: https://community.cisco.com/t5/data-center-documents/totd-how-do-you-perform-a-firmware-upgrade-on-spine-switches/ta-p/3162792 but it is a couple of years old and I am hoping for a current process to upgrade the switches including the BIOS if necessary.   Thanks, Bill ... View more

Is it possible to configure two factor authentication for the APIC?  If so can someone provide me a link to the documentation. ... View more

I am dealing with a 3560G with QoS enabled and I see significant output drops on one particular interface.  This interface carries approximately 260Mbps received from several interfaces.  It appears the traffic is being dropped only from Queue 1: (snippet of sh mls qos int g1/1 stat)  output queues dropped:   queue:    threshold1   threshold2   threshold3 -----------------------------------------------  queue 0:           0           0           0   queue 1:   181734385           0           0   queue 2:           0           0           0   queue 3:           0           0           0  I have tried increasing the processing of Queue 1: srr-queue bandwidth share 1 75 25 5 srr-queue bandwidth shape 0 3  0  0 But nothing I have done seems to have any impact on the output drops from Queue 1. I almost feel like turning QoS off altogether, but would prefer to leave QoS enabled and get the setup corrected. Recommendations?  (And yes I have recommended the 3560G be replaced, so that is off the table)  Is my configuration correct or should I be doing something different.? Thank you for your time. Bill ... View more

I am looking for more detailed qos statistics on the Nexus switches. Here is what I have found: "qos statistics" used to enable statistics, this is enabled by default.  What I don't find is the display of any detailed statistics showing total packets matched in each queue.  Is this information available somewhere and I simply am not using the correct command to display? "show interface ex/y" shows the normal input and output "show policy-map interface ex/y" shows:   Service-policy (queuing) input:   default-4q-8e-in-policy     Class-map (queuing):   2q4t-8e-in-q1 (match-any)       queue-limit percent 10       bandwidth percent 50       queue dropped pkts : 3883     Class-map (queuing):   2q4t-8e-in-q-default (match-any)       queue-limit percent 90       bandwidth percent 50       queue dropped pkts : 16194   Service-policy (queuing) output:   default-4q-8e-out-policy     Class-map (queuing):   1p3q1t-8e-out-pq1 (match-any)       priority level 1       queue dropped pkts : 158844     Class-map (queuing):   1p3q1t-8e-out-q2 (match-any)       bandwidth remaining percent 33       queue dropped pkts : 0     Class-map (queuing):   1p3q1t-8e-out-q3 (match-any)       bandwidth remaining percent 33       queue dropped pkts : 0     Class-map (queuing):   1p3q1t-8e-out-q-default (match-any)       bandwidth remaining percent 33       queue dropped pkts : 856611 It is good to know that some packets are being dropped, but out of how many total packets?  Is the drop percentage 50% or 1%, if i want to change the policy it would be good information have as to how many packets are being matched in each queue.  What am I missing? "show queuing interface ex/y" shows: Egress Queuing for Ethernet1/1 [System] ------------------------------------------- Template: 4Q8E ------------------------------------------------- Que# Group Bandwidth% PrioLevel Shape%     CoSMap -------------------------------------------------    0     0          -      High      -        5-7    1     1         33         -      -        3-4    2     2         33         -      -          2    3     3         33         -      -        0-1 Ingress Queuing for Ethernet1/1 [System] ------------------------------------------- Trust: Trusted DSCP to Ingress Queue : Disabled ----------------------------------- Que# Group Qlimit% IVL      CoSMap -----------------------------------    0     1      90   0         0-4    1     0      10   5         5-7 Nothing that I didn't already discover from the show policy-map command. Thanks for any information you can provide. Bill ... View more

Question on VSM at multiple sites.. We have a pair (active/passive) of VSMs at a regional data center to manage the 1000v in our cluster at that site. If we wanted to deploy a 1000v on a cluster at another physical site would we use the same VSM or would we need a new one? Assume both clusters are managed by the same vCenter. If a single pair of VSMs can be used between the two sites; would one VSM be physically located at each site ( I would assume so)? What is the impact of a WAN failure? Are there limitation on the distances between the DCs? Thanks for your responses. Bill Sent from Cisco Technical Support iPad App ... View more

I need to confirm that the 4510R+E switch with the SUB7-E/2 running version 15 IOS will not support NAT.  I am 99% convinced that it does not but i am looking for confirmation, as i am a bit surprised by the lack of NAT support on this platform. Thanks, Bill    ... View more

I am using DMVPN with EIGRP to provide mostly a backup path to an MPLS network using BGP. However the network is a mixture of sites that are connected to both the MPLS and Internet based DMVPN network and sites that are only connected to the DMVPN network (no MPLS connection). This is where the problem becomes apparent; the DMVPN only sites do not get a direct route to other remote sites that have both DMVPN and MPLS connections. At the headend the better route will be through the MPLS network. The DMVPN head end is on the same device that terminates the MPLS network and due to this will not sent the direct route via EIGRP so traffic from the DMVPN only site routs traffic to the headend across the MPLS network to the remote site. While the remote site sends it return traffic directly across the DMVPN as there is no MPLS route so the DMVPN headend sends the direct route. I have been able to overcome the problem of the headend not sending the direct EIGRP routes when it has a BGP (MPLS) route by configuring neighbor statements under EIGRP allowing the remote sites to learn to direct route across the DMVPN. My concern is two fold; one this doesn't scale very well as all sites need a neighbor statement for all other remote sites and two the impact of the unicast neighbor communication to all other remote sites. My question: is there another way to solve the problem of the remote site not receiving the direct route from the headend? It is not possible to separate the headend DMVPN from the MPLS. A secondary question is what other problems can this create. Thanks for your input. Sent from Cisco Technical Support iPad App ... View more

How do you handle overlapping vlans when using OTV between Data Centers.  i.e. in Data Center 1 i have vlan 100 with ip address 10.10.100.0/24 and in Data Center 2 I have vlan 100 with ip address 10.20.100.0/24.  I don't want to combine these into one network but keep them seperate when extending them between Data Centers..  Can OTV re-assign the vlans?  or do i have to ensure the vlan tags are unique between the data centers? Thanks. Bill ... View more

I have use case for mobile IP, but am unsure it is the right solution.  the problem is setting up a wireless network with roaming IP phone users.  There are two options; one is to span a vlan to be used by phones or use mobile IP to allow roaming between APs.  The APs are using H Reap, (local hop off) with the controllers at a remote site.  The wireless network supports IP Phone and roaming users.  The SVIs for the site networks are all on the core switch, so the delay related to Mobile IP will be non-existent.  The easy solution is to span a single vlan across the site for the phones, but that goes against the architecture which doesn’t span VLANs between closets.  However I haven't heard of mobile IP in years, until today.  Can anybody provide some guidance? Thanks, Bill ... View more