Hello Everyone,  I am trying to filtering in VRF using import map on nexus 9000 switch. First i tried on catalyst switch and it worked perfectly but same concept not working on nexus. NX-OS version is 7.2 In switch two VRF's are created GEN_SERVER & IPT_SERVER. i am doing import and export using rt between this vrf.  But IPT_SERVER VRF has two subnet but i want to import only 1 subnet into GEN_SERVERS VRF. Below config is not working for this purpose. vrf context GEN_SERVERS address-family ipv4 unicast import map GEN_SRV ! route-map GEN_SRV permit 10 match ip address 10 ! ip access-list 10 10 deny ip 10.18.244.0/24 10.18.190.0/24 20 deny ip 10.18.190.0/24 10.18.244.0/24 30 permit ip any any Below is full configuration for two VRF's vrf context GEN_SERVERS rd 65111:212 address-family ipv4 unicast route-target import 65111:201 route-target import 65111:212 route-target export 65111:212 import map GEN_SRV ! vrf context IPT_SERVERS rd 65111:201 address-family ipv4 unicast route-target import 65111:201 route-target import 65111:212 route-target export 65111:201 ! vlan 30 vlan 990 vlan 983 ! interface Vlan30 no shutdown vrf member IPT_SERVERS ip address 192.168.30.251/24 ip router ospf 1 area 0.0.0.0 hsrp version 2 hsrp 30 preempt priority 110 ip 192.168.30.254 ! interface Vlan983 no shutdown vrf member IPT_SERVERS no ip redirects ip address 10.18.244.251/24 ip router ospf 1 area 0.0.0.0 hsrp version 2 hsrp 983 preempt priority 110 ip 10.18.244.254 ! interface Vlan990 no shutdown vrf member GEN_SERVERS no ip redirects ip address 10.18.190.251/24 ip router ospf 1 area 0.0.0.0 hsrp version 2 hsrp 990 preempt priority 110 ip 10.18.190.254 ! router bgp 1 vrf GEN_SERVERS address-family ipv4 unicast redistribute direct route-map vpn-route-leaking vrf IPT_SERVERS address-family ipv4 unicast redistribute direct route-map vpn-route-leaking ! show version output Software BIOS: version 07.45 NXOS: version 7.0(3)I4(2) BIOS compile time: 12/04/2015 NXOS image file is: bootflash:///nxos.7.0.3.I4.2.bin NXOS compile time: 7/21/2016 8:00:00 [07/21/2016 16:09:32] Kindly advise what could be the problem with this ... View more

Good Day Everyone,  I am working for one network which has no internet connectivity, only core switch is connected to some access switches.  core switch is working as NTP server (ntp master command) and access switches are sync to this core switch. I am facing problem with time, its getting decrement by 15 to 20 minutes repeatedly and i have to go and set the time again. Is this the issue with stratum 8? How can i get accurate time all the time without sync to public NTP server.  Also please advise what public NTP server (IP or domain) i should sync if i want to sync devices which has internet connectivity. CORE-SW#sh ntp status Clock is synchronized, stratum 8 , reference is 127.127.7.1 nominal freq is 250.0000 Hz, actual freq is 250.0000 Hz, precision is 2**24 reference time is DC270D78.EE2B6AE4 (12:14:32.930 Mon Jan 16 2017) clock offset is 0.0000 msec, root delay is 0.00 msec root dispersion is 0.02 msec, peer dispersion is 0.02 msec CORE-SW#sh ntp associations address ref clock st when poll reach delay offset disp *~127.127.7.1 127.127.7.1 7 61 64 377 0.0 0.00 0.0 * master (synced), # master (unsynced), + selected, - candidate, ~ configured Thanks, ... View more

Hello Everyone, Need Support for VRF based design + MP-BGP. Network have two core switches running HSRP for VLAN's and access switches are connected to each core via fiber link. Each Access switch/stack has uplinks to core switch 1 and core switch 2. There are separate VLAN's for each Department on each floor. Each Department VLANs (Example SALES, PURCHASE, HR, INTERNET etc) are mapped to its own VRF. Required Route leaking is done among VRF's to allow communication as required. For Internet Connectivity, there is INTERNET VRF and two ISP routes. Both ISP routers toward core switch side running HSRP and default route is pointed to this routers from core switches in Internet VRF (ip route vrf INTERNT 0.0.0.0 0.0.0.0 x.x.x.1). This internet VRF will be leaked into departments VRF to provide interent servcie. I prepared all the configuration ( configs attached for core switch 1 and 2 ) but i have some confusion for IGP and MP-BGP. I will be thankful if some expert put some light on it. 1. Do I need to run IGP (ospf/eigrp) per VRF instance between core swtiches? Because there will be same subnets on both sides. 2. Loopback address is used for BGP neighborship between core switches.This loopback is advertised via OSPF in global routing table. 3. One SVI is used which is in Global routing table to form ospf neighborship to advertise loopback interface. 4. What is the use of " address-family vpnv4 " neighborship. Is it mandatory to use in this scenario? 5. What is the use of " address-family mdt " neighborship. I need multicasting for IPTV so is this the purpose of mdt address family? 6. Multicasting is enable globally and on IPTV VLAN SVI's (ip pim sparse-mode). Anything else required for multicasting to work. 6. Do i need to run BGP toward ISP routers instead of putting static default route. Global OSPF Routing for Loopback Advertisement to form BGP Neighborship =========================================================== router ospf 1 router-id 192.168.1.1 exit ! interface loopback 0 ip address 192.168.1.1 255.255.255.255 ip router ospf 1 area 0 ip pim sparse-mode exit ! Require to form ospf neighborship to advertise loopback interface ======================================================= interface vlan 200 description ***Routing-Between-Core-Switches*** ip address 192.168.1.5 255.255.255.252 ip router ospf 1 area 0 ip pim sparse-mode no shutdown ! Defaut Route to ISP Router in INTERNET VRF =================================== ip route vrf INTERNET 0.0.0.0 0.0.0.0 <ISP-ROUTER-HSRP-IP> ! BGP Configuration ================ router bgp 65222 bgp router-id 192.168.1.1 no bgp default ipv4-unicast neighbor 192.168.1.2 remote-as 65222 neighbor 192.168.1.2 update-source Loopback0 ! address-family ipv4 redistribute connected exit-address-family ! !!!!!!!!!!---What is the use----!!!!!!!!!!!!!!! address-family vpnv4 neighbor 192.168.1.2 activate neighbor 192.168.1.2 send-community both neighbor 192.168.1.2 next-hop-self exit-address-family ! !!!!!!!!!!---What is the use----!!!!!!!!!!!!!!! address-family ipv4 mdt neighbor 192.168.1.2 activate neighbor 192.168.1.2 send-community both exit-address-family ! address-family ipv4 vrf SALES redistribute connected exit-address-family ! address-family ipv4 vrf PURCHASE redistribute connected exit-address-family ! !!!!!!!!!!!!!----Default static route redistributed here----!!!!!!!!!!!!!! address-family ipv4 vrf INTERNET redistribute connected redistribute static default-information originate exit-address-family ! CONNECTIVITY DIAGRAM =========================                   ACCESS SWITCHES                    |                          |                       |                          |   CORE SW1 ===========CORE SW2           |                                             |            |                                             |              |                                             |  ISP ROUTER 1                     ISP ROUTER 2                        |                        |                        |                        |                      ISP INTERNET CLOUD ... View more

Hello, I am testing access switches for one project, I notice when i telnet from core to access and instead of appropriate username if i give some junk characters like shown in below output. Its accepting that username and not asking for password and landing me to the user-exec (>) mode. CORE-SW#telnet 192.168.1.50 Trying 192.168.1.50 ... Open User Access Verification Username: aldkfjadfdslkdja ACC-SW1> I update the IOS of the switch as well as per Cisco recommended IOS but output is same. Switch Model No: WS-C2960S-48FPS-L Switch IOS Version: 15.2(2a)E1 | C2960S-UNIVERSALK9-M | flash:/c2960s-universalk9-mz.152-2a.E1/c2960s-universalk9-mz.152-2a.E1.bin" Boot Loader (C2960S-HBOOT-M) Version 12.2(53r)SE Show version Output  -SW2#show version Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 15.2(2a)E1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2014 by Cisco Systems, Inc. Compiled Wed 10-Dec-14 03:54 by prod_rel_team ROM: Bootstrap program is C2960S board boot loader BOOTLDR: C2960S Boot Loader (C2960S-HBOOT-M) Version 12.2(53r)SE, RELEASE SOFTWARE (fc3) RUHHR-G-F9C1-SW2 uptime is 2 weeks, 2 days, 3 hours, 39 minutes System returned to ROM by power-on System restarted at 09:32:47 Riyadh Tue Dec 27 2016 System image file is "flash:/c2960s-universalk9-mz.152-2a.E1/c2960s-universalk9-mz.152-2a.E1.bin" Last reload reason: Unknown reason This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately. A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html If you require further assistance please contact us by sending email to export@cisco.com. cisco WS-C2960S-48FPS-L (PowerPC) processor (revision B0) with 131072K bytes of memory. Processor board ID  Last reset from power-on 2 Virtual Ethernet interfaces 1 FastEthernet interface 52 Gigabit Ethernet interfaces The password-recovery mechanism is enabled. 512K bytes of flash-simulated non-volatile configuration memory. Base ethernet MAC Address :  Motherboard assembly number :  Power supply part number : 341-0382-02 Motherboard serial number :  Power supply serial number :  Model revision number : B0 Motherboard revision number : A0 Model number : WS-C2960S-48FPS-L Daughterboard assembly number : 73-11933-04 Daughterboard serial number : System serial number :  Top Assembly Part Number : 800-32647-02 Top Assembly Revision Number : A0 Version ID : V02 CLEI Code Number : COMGB00ARB Daughterboard revision number : A0 Hardware Board Revision Number : 0x01 Switch Ports Model SW Version SW Image ------ ----- ----- ---------- ---------- * 1 52 WS-C2960S-48FPS-L 15.2(2a)E1 C2960S-UNIVERSALK9-M Configuration register is 0xF ... View more