Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Andreas Falk
Stats
Member since
12-04-2010
26
Posts
1
Helpful
0
Solutions
Created by
Andreas Falk
in Automation and Analytics
in Automation and Analytics
12-27-2017
08:30 AM
12-27-2017
08:30 AM
Hi, We are trying out CIscoPnP and it works "most of the time." But sometimes we get 'PnP Service Error 1404' on a few devices. From what I have seen so far we can get it on 48 port switches like WS-C2960X-48xxx. I can take one switch and run it and it can fail, clear and do it again, and then it works. But if I clear it and try it again, it can fail with the same error? The switch always get some part of the config, but if it is complete I don't really know, haven't done a diff with a working one yet. I cant find the PnP Error codes in the docs, my guess that there is some kind of timeout error? Any ideas? Running versions: APIC-EM 1.6.0.30151. PnP 1.6.0.200039 -- Regards Falk
... View more
Labels:
Created by
Andreas Falk
in Developer General Discussions
in Developer General Discussions
09-07-2017
01:27 AM
09-07-2017
01:27 AM
Hi jeppich, I followed the guides, but no cigar It runs on proper hw, dl380 2 xenon cpu's, 2x10Raid. Perhaps it's beq it's ubuntu at it's core and not Redhat that is the underlying kvm os, dunno really. When doing - [2] Virtual Machine Resource Check. It stops with ~ "ise exiting vm io performance test since this is not a vm"? The thing is that I get no hint of what is the problem, except this. Well, I can always use a ESXi in KVM that hosts the ISE dev env -- Regards Falk
... View more
Created by
Andreas Falk
in Developer General Discussions
in Developer General Discussions
09-04-2017
12:34 AM
09-04-2017
12:34 AM
Hi, I know that this isn't a supported config, but I'm just trying to get an ISE standalone work in my dev environment @home. I only want to have access to ERS-api, so that I have a local env to test against. I hope that it is ok to ask the question here I have enough hw, but it seems that ISE doesn't recognize my kvm as a VM? Anyone has done the same before, that have some pointers for me? I have followed the guide in ISE installation on KVM. -- Regards Falk
... View more
Labels:
Created by
Andreas Falk
in Security Discussions
in Security Discussions
09-03-2017
10:44 AM
09-03-2017
10:44 AM
Hi, When started working with a simple Flask application @work that uses ERS i found a really great module on github. But it wasn't compatible with our 2.2.x, so I updated it with json calls and 2.2.x compability. If you want to take it for a spin, and check if there are any fugly bugs or (probably) missing features GitHub - falkowich/ise: Python module to manage Cisco ISE via the ERS API Next step is to get it more test done with wiremock and nose2. -- Regards Falk
... View more
Labels:
Created by
Andreas Falk
in Network Management
in Network Management
01-27-2017
06:27 AM
01-27-2017
06:27 AM
Hi,
I am wondering if some knows if it is supported to change ciphers in sshd_config on a cisco prime 3.1? in shell.
--- /etc/ssh/sshd_config_old +++ /etc/ssh/sshd_config @@ -143,7 +143,7 @@ AllowTcpForwarding no X11Forwarding no RSAAuthentication yes -Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,cast128-cbc,aes192-cbc,aes256-cbc -MACs hmac-sha1 +Ciphers aes128-ctr,aes192-ctr,aes256-ctr +MACs hmac-sha1,hmac-ripemd160 KexAlgorithms diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
I have not done it, I just wonder if it is supported. Or if there are any other way to remove weak ciphers from the ssh server?
--
Regards Falk
... View more
- Tags:
- ssh cpi adeOS ade
Labels:
09-30-2016
08:05 AM
Hi,
tnx for the debug tips. After some debugging with dig, wireshark and lots of coffee we have located the problem (/me thinks)
We can reproduce the problem with dig and +noedns option.
The problem seems to be that we have 8 domain controller (we are migrating from 2008 to 2012) and the answer from the debug query get's "truncated" without edns. (no truncated flag in the .pcap)
For us the diagnose warning probably goes away when we only have 5 domain controllers left after the migration is done. Then the query answer should be smaller than 512 bytes, and no "truncation" should occur.
The anonymised dig's below, and the debug log is attached: vanilla:
falk@broekn ~$ dig _ldap._tcp.dc._msdcs.domain.local SRV @192.168.9.127 ; <<>> DiG 9.10.3-P4-Ubuntu <<>> _ldap._tcp.dc._msdcs.domain.local SRV @192.168.9.127 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54522 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 9 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;_ldap._tcp.dc._msdcs.domain.local. IN SRV ;; ANSWER SECTION: _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-12.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-05.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-08.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-10.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-07.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-09.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-11.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-06.domain.local. ;; ADDITIONAL SECTION: dc-12.domain.local. 3600 IN A 192.168.1.14 dc-05.domain.local. 3600 IN A 192.168.9.127 dc-08.domain.local. 3600 IN A 192.168.1.10 dc-10.domain.local. 3600 IN A 192.168.1.12 dc-07.domain.local. 3600 IN A 192.168.9.129 dc-09.domain.local. 3600 IN A 192.168.1.11 dc-11.domain.local. 3600 IN A 192.168.1.13 dc-06.domain.local. 3600 IN A 192.168.9.128 ;; Query time: 0 msec ;; SERVER: 192.168.9.127#53(192.168.9.127) ;; WHEN: Fri Sep 30 16:01:21 CEST 2016 ;; MSG SIZE rcvd: 524
+noedns:
falk@broekn ~$ dig +noedns _ldap._tcp.dc._msdcs.domain.local SRV @192.168.9.127 ; <<>> DiG 9.10.3-P4-Ubuntu <<>> +noedns _ldap._tcp.dc._msdcs.domain.local SRV @192.168.9.127 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35413 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 7 ;; QUESTION SECTION: ;_ldap._tcp.dc._msdcs.domain.local. IN SRV ;; ANSWER SECTION: _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-05.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-08.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-10.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-07.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-09.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-11.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-06.domain.local. _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 dc-12.domain.local. ;; ADDITIONAL SECTION: dc-05.domain.local. 3600 IN A 192.168.9.127 dc-08.domain.local. 3600 IN A 192.168.1.10 dc-10.domain.local. 3600 IN A 192.168.1.12 dc-07.domain.local. 3600 IN A 192.168.9.129 dc-09.domain.local. 3600 IN A 192.168.1.11 dc-11.domain.local. 3600 IN A 192.168.1.13 dc-06.domain.local. 3600 IN A 192.168.9.128 ;; Query time: 0 msec ;; SERVER: 192.168.9.127#53(192.168.9.127) ;; WHEN: Fri Sep 30 16:01:50 CEST 2016 ;; MSG SIZE rcvd: 497
So I guess that we have our usual bad luck with both the names and number of servers so this can happen :)
From my little dns knowledge the answer should be flagged as truncated and the question should be re-queried on tcp. But the answer from the dc's is flagged with "Message is not truncated".
--
Regards Falk
... View more
Created by
Andreas Falk
in Policy and Access
in Policy and Access
09-29-2016
03:02 AM
09-29-2016
03:02 AM
Hi,
Our ISE servers today uses bind dns servers, but as a test we try to use our Active Directory DNS's as ISE dns servers. In our test everything "works", but when doing a diag in Active Directory > ADM-AD > Active Directory Diagnostic Tool we get a warning from: DNS SRV record query :
Test Name :DNS SRV record query Description :Query for DNS SRV record using resolv.conf configuration and gethostbyaddr Instance :ADM-AD Status :Warning Start Time :10:46:37 29.09.2016 CEST End Time :10:46:37 29.09.2016 CEST Duration :<1 sec Result and Remedy... SRV record found.Not all SRV records have IP, will need to run additional query for get IP.
Do you guys know what that warning really does behind the ui screen? There are really not much my googlefu returns with this search..
ISE: Version: 1.4.0.253 Patch Information: 4 AD: Forest domain level 2008 On windows 2012 and 2008
BIND: Bind 9.10.3
And the only thing we see with a tcpdump differs is that the BIND dns returns AUTHORITY SECTION and the AD dns does not?
Answer from a newly setup test bind as a slave to the DC dns returns:
falk@broekn ~$ dig _ldap._tcp.dc._msdcs.domain.local. SRV @10.8.10.105 ; <<>> DiG 9.10.3-P4-Ubuntu <<>> _ldap._tcp.dc._msdcs.domain.local. SRV @10.8.10.105 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10442 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.dc._msdcs.domain.local. IN SRV ;; ANSWER SECTION: _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 WIN-QE31DOEGABT.domain.local. ;; AUTHORITY SECTION: _msdcs.domain.local. 3600 IN NS win-qe31doegabt.domain.local. ;; ADDITIONAL SECTION: win-qe31doegabt.domain.local. 3600 IN A 10.8.10.108 ;; Query time: 2 msec ;; SERVER: 10.8.10.105#53(10.8.10.105) ;; WHEN: Thu Sep 29 11:49:53 CEST 2016 ;; MSG SIZE rcvd: 156
And this is the same question directly from the newly setup AD test dns server:
falk@broekn ~$ dig _ldap._tcp.dc._msdcs.domain.local. SRV @10.8.10.108 1 ; <<>> DiG 9.10.3-P4-Ubuntu <<>> _ldap._tcp.dc._msdcs.domain.local. SRV @10.8.10.108 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44694 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;_ldap._tcp.dc._msdcs.domain.local. IN SRV ;; ANSWER SECTION: _ldap._tcp.dc._msdcs.domain.local. 600 IN SRV 0 100 389 WIN-QE31DOEGABT.domain.local. ;; ADDITIONAL SECTION: WIN-QE31DOEGABT.domain.local. 3600 IN A 10.8.10.108 ;; Query time: 1 msec ;; SERVER: 10.8.10.108#53(10.8.10.108) ;; WHEN: Thu Sep 29 11:51:40 CEST 2016 ;; MSG SIZE rcvd: 126
--
Regards Falk
... View more
Labels:
04-30-2015
06:44 AM
Hi,
I'll answer this myself after some digging in the docs :)
It wasn't that acl itself, it was the TOTAL TCAM space for that region that was full. Like the log said, "tcam region full".
The collective eracl size was 2048 and we used ~2k of that. So when we tried to apply another it just didn't fit.. :)
This can be found out by: egress router acl.
#sh platform afm info tcam 8 region eracl
eracl tcam TCAM configuration for asic id 5:
[eracl tcam]: range 0 - 2047 *
[ifacl tcam]: range 2048 - 2111
[ qos tcam]: range 2112 - 2175
[iracl tcam]: range 2176 - 3839
[ span tcam]: range 3840 - 3903
[ sup tcam]: range 3904 - 3967
TCAM [eracl tcam]: [v:1, size:2048, start:0 end:2047]
In use tcam entries: 2047
0-9,15-2047
ingress router acl
# sh platform afm info tcam 8 region iracl
iracl tcam TCAM configuration for asic id 5:
[eracl tcam]: range 0 - 2047
[ifacl tcam]: range 2048 - 2111
[ qos tcam]: range 2112 - 2175
[iracl tcam]: range 2176 - 3839 *
[ span tcam]: range 3840 - 3903
[ sup tcam]: range 3904 - 3967
TCAM [iracl tcam]: [v:1, size:1664, start:2176 end:3839]
In use tcam entries: 843
2176-2177,2999-3839
Every ACE (Access Control Entry (one line of an Access Control List)) is 1 entry in a TCAM region from what I understand.
So our next challange is to rethink our ACL's and/or checkout more information about TCAM carving.
--
Regards Falk
... View more
Created by
Andreas Falk
in Switching
in Switching
04-27-2015
09:25 AM
04-27-2015
09:25 AM
Hi,
I have two Nexus5548 with system version 5.1(3)N2(1a) that I'm having trouble with. There are one acl I try to apply, and it keeps failing with: (it's rather big so I cant paste it in this public discussion )
%ACLMGR-3-ACLMGR_VERIFY_FAIL: Verify failed: client 40000290, tcam region full
%AFM-3-AFM_VERIFY_FAIL: Access control policy modification on vlan 123 failed
And I can see that it is really long, but it's shorter than a few other acl's?
# sh access-lists summary
[snip]
IPV4 ACL vlan124-out
Total ACEs Configured:286
[snip]
IPV4 ACL vlan123-out
Total ACEs Configured:274
[snip]
I've read the http://www.cisco.com/c/en/us/products/collateral/switches/nexus-5000-series-switches/white_paper_c11-682225.html But I can't really get my head around how I can see how I can see how different acl's with less ACEs takes upp "more tcam space"?
The core problem is the long acl's but that is something that we are looking at in the log run. In Nx7000 there is "show hardware capacity | begin ACL" to get some good info about this. But I haven’t found anything like this on the Nx5k platform I'm sorta stuck how to continue troubleshooting this, any tips?
--
Regards Falk
... View more
Labels:
Hi,Did you get something out
in Wireless Security and Network Management
05-31-2014
09:38 AM
05-31-2014
09:38 AM
Hi, Did you get something out of the RESTapi to create guest accounts? I was thinking of doing the same in a python framework to create an small register kiosk mode with sms sendout of user/pass.. -- Regards Falk
... View more
10-03-2012
06:14 AM
Hi, Thanks for the share! This will really come in handy when batching switches.. -- Regards Falk
... View more
Created by
Andreas Falk
in Wireless Security and Network Management
in Wireless Security and Network Management
07-18-2012
11:38 PM
07-18-2012
11:38 PM
Hi, Thanks for the quick answer!
... View more
Created by
Andreas Falk
in Wireless Security and Network Management
in Wireless Security and Network Management
07-18-2012
05:12 AM
07-18-2012
05:12 AM
Hi, I'm messing around with snmptraps from our new NCS installation. And I get this new and interesting oid: 1.3.6.1.4.1.9.9.712.... In the SNMP Object Navigator i only find ciscoVrfMIB (711) and then ciscoTrustSecPolicyMIB (713) but no (712)? Do anyone out here know where I can find the mibs that relate to 1.3.6.1.4.1.9.9.712? -- Regards Falk
... View more
Created by
Andreas Falk
in Switching
in Switching
12-08-2010
07:25 AM
12-08-2010
07:25 AM
Well, The solution was to use (for the moment) SecureCRT on Windows. When I use a virtual terminal over ssh, it seems like the input buffer gets full? But when on Windows and SecureCRT, things works smooth? So the solution for the moment is: VmWare Workstation -> Windows XP -> SecureCRT -> Nexus 7000 = win -- Regards Falk Sweden
... View more
Created by
Andreas Falk
in Switching
in Switching
12-06-2010
02:03 AM
12-06-2010
02:03 AM
ediortiz wrote: I usually do the copy and paste routine but if you are having issues with long pasting (usually attributed to the client you are using - never had a problem with SecureCRT), you can use 'copy tftp running-config' Regards, Edison Hi, thanks for the answers. Nice tip, I didn't know that there were "problems" with buffers on different clients. I use native terminal in Ubuntu, so perhaps something goes wrong there. I will try pUtty or SecureCRT and see if the problem persists. Then only the problem to get my colleges to paste on both the N7K boxes. -- Regards Falk Sweden
... View more
11-19-2018
Hi, I understand that it could be a assist/support problem.When doing
our api development it's reall...
11-19-2018
Hi, Do you guys know if there are any ISE Sandboxes in Devnet or
dCloud?I cant find anything anymore...
12-27-2017
Hi,We are trying out CIscoPnP and it works "most of the time."But
sometimes we get 'PnP Service Erro...
Created by
Andreas Falk
in Identity Services Engine (ISE)
10-27-2017
10-27-2017
Today we use a openldap cluster with one provider and three consumers,
and haproxy/keepalived as lb ...
Created by
Andreas Falk
in Identity Services Engine (ISE)
10-27-2017
10-27-2017
Hi thanks for the fast answer.Well then that ideas flies out the window
So next up renew our ldap in...
Created by
Andreas Falk
in Identity Services Engine (ISE)
10-26-2017
10-26-2017
Hi,Today we are using LDAP to manage our mac addresses for mab auth.When
2.1 was introduced with cus...
Created by
Andreas Falk
in Identity Services Engine (ISE)
10-26-2017
10-26-2017
Hi,We are working on a webui to manage our mab endpoints.We use:
"customAttributes": { "customAttrib...
Created by
Andreas Falk
in Developer General Discussions
09-07-2017
09-07-2017
Hi jeppich,I followed the guides, but no cigar It runs on proper hw,
dl380 2 xenon cpu's, 2x10Raid.P...
09-04-2017
Hi,I know that this isn't a supported config, but I'm just trying to get
an ISE standalone work in m...
Created by
Andreas Falk
in Security Discussions
09-03-2017
09-03-2017
Hi,When started working with a simple Flask application @work that uses
ERS i found a really great m...
Created by
Andreas Falk
in Identity Services Engine (ISE)
08-31-2017
08-31-2017
Hi,Tnx for the fast answer, I'll open a TAC case and see whats up with
our env.It's an updated envir...
Created by
Andreas Falk
in Identity Services Engine (ISE)
08-31-2017
08-31-2017
Hi,I'm trying to add Endpoint customAttributes with ERS json with a
python library i've forked and u...
Created by
Andreas Falk
in Network Management
01-27-2017
01-27-2017
Hi, I am wondering if some knows if it is supported to change ciphers in
sshd_config on a cisco prim...
09-30-2016
Hi, tnx for the debug tips.After some debugging with dig, wireshark and
lots of coffee we have locat...
Public Statistics
| Date Registered | 12-04-2010 01:53 PM |
| Date Last Visited | 09-18-2019 01:01 AM |
| Total Messages Posted | 26 |
| Total Helpful Votes Received | 1 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 1 | |
| 1 | |
| 5 |
