Can Anyone confirm if this bug is fixed in 6.2(14) version of sup1 code for Nexus 7000?  ... View more

I am going to demonstrate an easiest IPv6 migration using Location Identity Separation Protocol (LISP). LISP works by separating IP address from its location in network. This IP address(es) at LISP site is called Endpoint ID (EID) and its location which is also an IP address is called Routing Locator (RLOC). Cisco has built a LISP beta network which is a mapping database which holds all EID to RLOC mapping. LISP router registers its RLOC address with EID space to a map server (MS). Whenever LISP router receives a packet from this EID space it tries to queries Map Resolver (MR) to get EID to RLOC mapping. Once this mapping information is available it will start encapsulating packets to destination EID RLOC address. Note that this tunnel is not static but instead it is dynamic tunnel based of destination RLOC address. Router that does encapsulation is Egress Tunnel Router (ETR) and router that does de-capsulation is called Ingress Tunnel Router (ITR). Normally both functionalities are implemented on same router, in such case, it is called xTR. Note that a LISP site can only accept LISP encapsulated traffic from internet for EID space. If LISP site needs to talk to non LISP site, it requires another router which can accept a LISP encapsulated packet and sends to destination using regular IP forwarding, it is called Proxy Ingress Tunnel Router (PITR). Same way, router that accepts non LISP packets and encapsulates to a LISP site towards ITR is called PETR. Normally both functionalities are implemented on same router, in such case, it is called PxTR. Proxy routers does not registers EID space to mapping database but it advertizes EID space/prefix into routing domain (internet). LISP specification allows tunnelling of IPv6 packets over IPv4 network between two IPv4 RLOC addresses. This can be used to provider IPv6 connectivity and mobility. The underlying application does not aware of this encapsulation. What I am doing in following example is providing IPv6 internet connectivity for IPv6 only server sitting in IPv4 only cloud using Cisco Cloud services router (CSR). Diagram: Consider above diagram. We have a CSR router, with Gig3 interface is connected to VXLAN segment 5002 which is IPv6 only LAN and it provides default gateway and DHCPv6 functionalities to servers in this LAN segment. Servers in this LAN segment can use SLAAC to get IPv6 address and DHCPv6 to get DNSv6 info Gig1 interface is connected to External LAN which has public IPv4 address and it can talk to IPv4 only network. Cisco has created a beta network to test LISP. I got an IPv6 prefix from this beta network to test LISP functionality for IPv6 migration use case. I assigned 2001:DB8:1142:B::1/64 to Gig3. Lets see the configuration. Configuration: ! interface GigabitEthernet1 ! RLOC address description outside interface facing IPv4 internet ip address 66.xxx.xxx.126 255.255.255.240 no ip unreachables negotiation auto ! interface GigabitEthernet3 description LISP EID space ip tcp adjust-mss 1380 ! Adjust the TCP MSS to accomodate LISP encapsulation overhead. negotiation auto ipv6 address 2610:D0:1142:B::1/64 ipv6 enable ipv6 mtu 1400 ipv6 nd other-config-flag  ! to signal End server to get DNS info issue a DHCPv6 request ipv6 nd router-preference High ipv6 dhcp server DNS_SERVER_POOL ! ! Supply DNS information of Google DNS. ip name-server 2001:4860:4860::8888 ip name-server 2001:4860:4860::8844 ip domain lookup source-interface GigabitEthernet3 ipv6 general-prefix LISP_EID 2610:D0:1142:B::/64 ipv6 unicast-routing ipv6 dhcp pool DNS_SERVER_POOL dns-server 2001:4860:4860::8888 dns-server 2001:4860:4860::8844 domain-name foo.com ip route 0.0.0.0 0.0.0.0 66.xxx.xxx.113 Now so far we have only seen regular IPv6 configuration etc. Following is LISP config which will glue IPv4 and IPv6 network. router lisp locator-set TOR01 ! We choose interface because if IP address of RLOC changes you do not need to update this info.   IPv4-interface GigabitEthernet1 priority 1 weight 100 ! alternativly you can specify which IP address to use for RLOC   66.xxx.xxx.126 priority 1 weight 100   exit ! eid-table default instance-id 0   database-mapping 2610:D0:1142::/48 locator-set TOR01   loc-reach-algorithm rloc-probing   exit ! Proxy router pXTR given by LISP beta network ipv6 use-petr 69.31.31.98 priority 1 weight 50 ipv6 use-petr 129.250.1.63 priority 1 weight 50 no ipv6 map-cache-persistent ! Map resolver where EID will be registered to. This should be reachable all the time ipv6 itr map-resolver 69.31.31.98 ipv6 itr map-resolver 129.250.1.63 ipv6 itr map-resolver 173.36.254.164 ipv6 itr map-resolver 206.223.132.89 ! define router as ITR ipv6 itr ! map server to find out EID to RLOC mapping when encapsulating using LISP ipv6 etr map-server 69.31.31.98 key ***** ipv6 etr map-server 129.250.1.63 key ***** ipv6 etr map-server 173.36.254.164 key ***** ipv6 etr map-server 206.223.132.89 key ***** ! defines router as ETR ipv6 etr exit Verification: Now so far we have only seen regular IPv6 configuration etc. Following is LISP config which will glue IPv4 and IPv6 network. CSR1000v-test#lig self ipv6 Mapping information for EID 2610:D0:1142:: from 66.xxx.xxx.126 with RTT 103 msecs 2610:D0:1142::/48, uptime: 00:00:00, expires: 23:59:59, via map-reply, self, complete   Locator         Uptime    State      Pri/Wgt   66.xxx.xxx.126  00:00:00  up, self     1/100 Ping to LISP site CSR1000v-test#ping ipv6 www.lisp6.net source gig 3 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2610:D0:1304::11, timeout is 2 seconds: Packet sent with a source address of 2610:D0:1142:B::1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 68/68/69 ms Ping to Non LISP site. CSR1000v-test#ping ipv6 www.google.com source gig 3 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2607:F8B0:4006:802::1010, timeout is 2 seconds: Packet sent with a source address of 2610:D0:1142:B::1 ..!!! Success rate is 60 percent (3/5), round-trip min/avg/max = 128/128/129 ms Note that you will see few pings loss initially because it takes few seconds to get mapping information but this is just first time only. Router will cache the maping information on memory for subsequent packets. CSR1000v-test#sh ipv6 lisp map-cache detail LISP IPv6 Mapping Cache for EID-table default (IID 0), 4 entries ::/0, uptime: 00:06:04, expires: never, via static send map-request   Sources: static send map-request   State: send-map-request, last modified: 00:06:04, map-source: local   Idle, Packets out: 2 (~ 00:00:03 ago)   Configured as EID address space   Negative cache entry, action: send-map-request 2606::/15, uptime: 00:00:41, expires: 00:14:18, via map-reply, forward-native   Sources: map-reply   State: forward-native, last modified: 00:00:41, map-source: 173.36.254.164   Active, Packets out: 8 (~ 00:00:03 ago)   Encapsulating to proxy ETR 2610:D0:1142::/48, uptime: 00:03:42, expires: 23:58:15, via map-reply, self, complete   Sources: map-reply   State: complete, last modified: 00:03:42, map-source: 66.xxx.xxx.126   Idle, Packets out: 0   Locator         Uptime    State      Pri/Wgt   66.xxx.xxx.126  00:03:42  up, self     1/100     Last up-down state change:         00:03:42, state change count: 1     Last route reachability change:    00:03:42, state change count: 1     Last priority / weight change:     never/never     RLOC-probing loc-status algorithm:       Last RLOC-probe sent:            00:01:44 (rtt 0ms)       Next RLOC-probe in:              00:00:07       Latched to ITR-RLOC:             66.xxx.xxx.126 2610:D0:1304::/48, uptime: 00:02:39, expires: 23:59:19, via map-reply, complete   Sources: map-reply   State: complete, last modified: 00:02:39, map-source: 173.36.254.162   Active, Packets out: 32 (~ 00:00:03 ago)   Locator         Uptime    State      Pri/Wgt   173.36.254.162  00:02:39  up           1/50     Last up-down state change:         00:02:39, state change count: 1     Last route reachability change:    never, state change count: 0     Last priority / weight change:     never/never     RLOC-probing loc-status algorithm:       Last RLOC-probe sent:            00:00:40 (rtt 69ms)       Next RLOC-probe in:              00:00:18       Latched to ITR-RLOC:             66.xxx.xxx.126   173.36.254.177  00:02:39  up           1/50     Last up-down state change:         00:02:39, state change count: 1     Last route reachability change:    never, state change count: 0     Last priority / weight change:     never/never     RLOC-probing loc-status algorithm:       Last RLOC-probe sent:            00:00:42 (rtt 70ms)       Next RLOC-probe in:              00:00:16       Latched to ITR-RLOC:             66.xxx.xxx.126 As you can see When pinging to google.com router does not get mapping information for it so it will start encapsulating to PxTR. But when ping to lisp6.cisco.com which is a lisp site we got two RLOC address to encapsulate to. Router chooses one of this RLOC address based to criteria like weight and start encapsulating packets towards it. Conclusion: LISP follows a network-based map-and-encapsulate scheme which is very flexible in IPv6 transition use case. In above example if interface gig 1 IP address changes LISP will register EID with new RLOC and everything continue to work. You can take snapshot of this vApp with this CSR and then run it in different cloud provider with different RLOC, without changing IP addresses on each end systems. ... View more

hi folks, Question regarding VSS with Quad sup. It looks like with one switch being down you do not get any  redundacy for remaining switch even though it has two supervisors is it  true? I have following config and I cabled 4 tengig port of supevisor with 5 to 5 and swap6 rule. GW6500-VSS#sh switch virtual redundancy mismatch No Config Mismatch between Active and Standby switches ONX-GW6500-VSS#sh switch virtual redundancy                   My Switch Id = 1                 Peer Switch Id = 2         Last switchover reason = none     Configured Redundancy Mode = sso      Operating Redundancy Mode = sso Switch 1 Slot 5 Processor Information : -----------------------------------------------         Current Software state = ACTIVE        Uptime in current state = 21 hours, 35 minutes                  Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVENTERPRISEK9-M), Version 15.1(1)SY2, RELEASE SOFTWARE (fc4) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Tue 01-Oct-13 12:54 by prod_rel_team                           BOOT = bootdisk:s2t54-adventerprisek9-mz.SPA.151-1.SY2.bin,1;                    CONFIG_FILE =                        BOOTLDR =         Configuration register = 0x2102                   Fabric State = ACTIVE            Control Plane State = ACTIVE Switch 1 Slot 6 Processor Information : -----------------------------------------------         Current Software state = STANDBY HOT (CHASSIS)        Uptime in current state = 21 hours, 34 minutes                  Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVENTERPRISEK9-M), Version 15.1(1)SY2, RELEASE SOFTWARE (fc4) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Tue 01-Oct-13 12:54 by prod_rel_team                           BOOT = bootdisk:s2t54-adventerprisek9-mz.SPA.151-1.SY2.bin,1;                    CONFIG_FILE =                        BOOTLDR =         Configuration register = 0x2102                   Fabric State = ACTIVE            Control Plane State = STANDBY Switch 2 Slot 5 Processor Information : -----------------------------------------------         Current Software state = STANDBY HOT (switchover target)        Uptime in current state = 21 hours, 32 minutes                  Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVENTERPRISEK9-M), Version 15.1(1)SY2, RELEASE SOFTWARE (fc4) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Tue 01-Oct-13 12:54 by prod_rel_team                           BOOT = bootdisk:s2t54-adventerprisek9-mz.SPA.151-1.SY2.bin,1;                    CONFIG_FILE =                        BOOTLDR =         Configuration register = 0x2102                   Fabric State = ACTIVE            Control Plane State = STANDBY Switch 2 Slot 6 Processor Information : -----------------------------------------------         Current Software state = STANDBY HOT (CHASSIS)        Uptime in current state = 21 hours, 32 minutes                  Image Version = Cisco IOS Software, s2t54 Software (s2t54-ADVENTERPRISEK9-M), Version 15.1(1)SY2, RELEASE SOFTWARE (fc4) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Tue 01-Oct-13 12:54 by prod_rel_team                           BOOT = bootdisk:s2t54-adventerprisek9-mz.SPA.151-1.SY2.bin,1;                    CONFIG_FILE =                        BOOTLDR =         Configuration register = 0x2102                   Fabric State = ACTIVE            Control Plane State = STANDBY ... View more

I am trying to do NAT64 with LISP EID space. Is it supported? Attached is my configuration. I am using a tunnel brocker service for pure IPv6 connectivity. I want to do a stateless NAT64 for connectivity with IPv4 internet. The IPv4 prefix that I am using for NAT64 to map IPv4 to IPv6 is EID space from LISP beta network. The reason why I would like to do this is for mobility and not having to run dual stack on server which servers guys are most afraid of. If I do not add a Null0 route for EID space, "lig self ipv4" fails. If I add it then NAT64 fails because I get "Destination host unreachable message" while pinging to IPv4 EID space. Any thoughts suggestions? ... View more

I am planning to implement VXLAN, I have changed the port-channel load balancing hashing to include src-dst-port on LAN switch Nexus 5500 which is in vpc then UCS FI are connected with a single uplink in virtual port-channel to both 5500. I would like to know if I need to change the port-channel hashing on on UCS and Nexus 1000v to make sure the all uplinks are properly utilized based on src-dst-port. Same time how does pinning being done on UCS and NExus 1000v based on src-mac. Folloing is my config sh run port-profile DATA-UPLINK !Command: show running-config port-profile DATA-UPLINK !Time: Mon Apr  1 10:17:28 2013 version 4.2(1)SV2(1.1a) port-profile type ethernet DATA-UPLINK   vmware port-group   switchport mode trunk   switchport trunk allowed vlan 105-106,109,115-116,121,200-210   pinning control-vlan 0   pinning packet-vlan 0   system mtu 9000   channel-group auto mode on mac-pinning   no shutdown   system vlan 105-106,109,115-116   state enabled VSM01# show port-channel load-balance Port Channel Load-Balancing Configuration: System: source-mac Port Channel Load-Balancing Addresses Used Per-Protocol: Non-IP: source-mac IP: source-mac ... View more