Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About roger perkin
05-09-2019
roger perkin
Beginner
Roger has been in the networking field for over 10 years and currently works for a Gold Partner in the UK. Primarily a Routing & Switching guy but learning more about Wireless every day.
He is CCIE #50038 in R&S and is considering going for CCIE Wireless.
When not designing and installing networks he enjoys Kite Surfing, Cycling and spending time with his family
Roger has been in the networking field for over 10 years and currently works for a Gold Partner in the UK. Primarily a Routing & Switching guy but learning more about Wireless every day.
He is CCIE #50038 in R&S and is considering going for CCIE Wireless.
When not designing and installing networks he enjoys Kite Surfing, Cycling and spending time with his
Recent Badges
Stats
Member since
02-24-2011
254
Posts
11
Helpful
0
Solutions
05-03-2019
08:50 AM
I am trying to make MACSec work between a pair of Nexus 7702's running 8.3.1 I have configured the macsec policy and key chain But when I go to apply to the interface I get an error key chain K1 macsec key 01 key-octet-string 7 075f701e1d5d4c53404a520d052829272b63647040534355560e00595 2560c001b cryptographic-algorithm AES_128_CMAC macsec policy TEST cipher-suite GCM-AES-128 key-server-priority 200 conf-offset CONF-OFFSET-30 VDC_CORE_01(config-if)# macsec keychain K1 ERROR: Interface Ethernet1/47 does not support MKA MACSec. VDC_CORE_01(config-if)# sh run int e1/47 Any ideas?
... View more
Labels:
02-18-2019
01:55 AM
Great, but I now typically have the creds in either a group_vars or host_vars file
Starting also to use Ansible Vault for production playbooks.
... View more
05-23-2018
01:44 AM
If you can SSH to your device from the command line of your Ansible host, then this is most likely being caused by the way you are passing your credentials into the playbook?
if you run your playbook with -u <your username> -k
This will then prompt you for your password
Try that and see if you get any better results
... View more
Created by
roger perkin
in Switching
in Switching
04-04-2018
02:08 AM
04-04-2018
02:08 AM
Thank you for your reply
they are set as Network
interface port-channel100 description VPC_PEER_LINK switchport mode trunk spanning-tree port type network vpc peer-link
... View more
Created by
roger perkin
in Switching
in Switching
04-03-2018
10:03 AM
04-03-2018
10:03 AM
I have configured a VPC between a pair of Nexux 9Ks 93120TX Have enabled MST on both switches and now getting an inconsistency check error with global port type
Both switches are configured the same
spanning-tree port type edge bpduguard default
Still getting mis-match on consistency check?
Name Type Local Value Peer Value
------------- ---- ---------------------- -----------------------
Vlan to Vn-segment Map 1 No Relevant Maps No Relevant Maps
STP Mode 1 MST MST
STP Disabled 1 None None
STP MST Region Name 1 REGION-R REGION-R
STP MST Region Revision 1 31 31
STP MST Region Instance to 1
VLAN Mapping
STP Loopguard 1 Disabled Disabled
STP Bridge Assurance 1 Enabled Enabled
STP Port Type, Edge 1 Normal, Disabled, Normal, Disabled,
BPDUFilter, Edge BPDUGuard Enabled Disable << One side enabled one side disabled? Where
... View more
Labels:
Created by
roger perkin
in Other Data Center Subjects
in Other Data Center Subjects
03-28-2018
03:09 PM
03-28-2018
03:09 PM
I have an interesting challenge in connecting a VXLAN EVPN Fabric into a pair of 6509s running EIGRP
The connectivity I want to achieve is one core switch into VPC Leaf pair 1 (which are all in room 1) and core 2 and VPC Leaf pair 2 (which are in room 2) but aware I am facing some routing loops if not controlled
I know the recommended solution is to just peer to the left pair of Leafs, but I need this fabric to survive the failure of Spine 1 and Leaf1-1 and 1-2
Looking into possibly using Border Spines, but not sure if this will aid my routing problem or not
Any thoughts?
... View more
Labels:
Created by
roger perkin
in Cisco Bug Discussions
in Cisco Bug Discussions
03-21-2018
02:14 PM
03-21-2018
02:14 PM
I am facing an issue where a client is using 2 Microsoft Load Balancers running on VMs connected to a pair of Nexus 3548's
Previously the L3 gateway for the NLB VLAN was on an HP switch and we migrated this onto the Nexus
Since then the NLB have stopped functioning.
I see there is a bug report stating that NLB is not supported on the Nexus 3k platform.
Is there anything we can do apart from getting a new load balancer?
... View more
Labels:
Created by
roger perkin
in Policy and Access
in Policy and Access
02-21-2018
07:50 AM
02-21-2018
07:50 AM
Perfect, this is the solution, checking the built in Super Admin User - it's all there to see!
... View more
Created by
roger perkin
in Policy and Access
in Policy and Access
02-21-2018
07:18 AM
02-21-2018
07:18 AM
Thanks, this was actually the issue, a misconfigured port on one of the Radius servers - changed to 1812 and warning goes away.
Thanks
... View more
Created by
roger perkin
in Policy and Access
in Policy and Access
02-21-2018
02:37 AM
02-21-2018
02:37 AM
I am configuring an ISE 2.3 environment with 2 nodes
When debugging the dot1x authentications in a 2960x switch I get the following
157525: Feb 21 10:36:10.562: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.0.10.20:18112,1813 is not responding. 157526: Feb 21 10:36:10.562: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.0.10.20:18112,1813 is being marked alive. 157527: Feb 21 10:36:13.582: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.0.10.20:18112,1813 is not responding. 157528: Feb 21 10:36:13.582: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.0.10.20:18112,1813 is being marked alive. 157529: Feb 21 10:36:16.633: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.0.10.20:18112,1813 is not responding. 157530: Feb 21 10:36:16.633: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.0.10.20:18112,1813 is being marked alive. 157531: Feb 21 10:36:19.667: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.0.10.20:18112,1813 is not responding. 157532: Feb 21 10:36:19.667: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.0.10.20:18112,1813 is being marked alive. 157533: Feb 21 10:36:22.715: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.0.10.20:18112,1813 is not responding. 157534: Feb 21 10:36:22.715: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.0.10.20:18112,1813 is being marked alive. 157535: Feb 21 10:36:25.756: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.0.10.20:18112,1813 is not responding. 157536: Feb 21 10:36:25.756: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.0.10.20:18112,1813 is being marked alive. 157537: Feb 21 10:36:28.787: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.0.10.20:18112,1813 is not responding. 157538: Feb 21 10:36:28.787: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.0.10.20:18112,1813 is being marked alive.
Is this an issue?
... View more
Labels:
Created by
roger perkin
in Policy and Access
in Policy and Access
02-20-2018
02:07 PM
02-20-2018
02:07 PM
Hi braham, Thanks for your reply however I am not exactly sure what you mean about a duplicated copy of the default Super Admin group?
within RBAC policies I created a new line and added the following
IT-ISE-ADMINS maps to an AD group with the same name.
However when logging in with an AD user in this group you cannot see any network devices, and also all the dashboards show zero Total Endpoints and zero Active endpoints.
... View more
Created by
roger perkin
in Policy and Access
in Policy and Access
02-16-2018
06:24 AM
02-16-2018
06:24 AM
I have setup login access on ISE 2.3 to use AD
Under Authentication - Password Based > Identity Source AD
Under Authorisation / Policy I have created a new Rule saying IT Admins - mapped to AD IT Admin group gets Super admin Menu Access
However when logged in I cannot see any network devices? It shows Total 6 but they are not visible?
If I log in as local Admin locally they are there.
Any ideas?
... View more
Labels:
Created by
roger perkin
in Policy and Access
in Policy and Access
02-15-2018
01:17 PM
02-15-2018
01:17 PM
Can anyone provide me a sample 2.3 policy for a wired 802.1x policy.
First I would like to allow access based on the fact the computer is a domain joined machine.
Secondly i would like to allow access based on prescence of a certificate.
Question:
Am I able to have separate policies on different devices?
i.e start to deploy with AD domain joined machine status and then gradually migrate to certificate based auth.
Or do I need to decide on one or the other?
Thanks
... View more
Labels:
Created by
roger perkin
in Policy and Access
in Policy and Access
02-15-2018
01:03 PM
02-15-2018
01:03 PM
Thanks,
So to be clear
global command
radius-server dead-criteria time 3 tries 2
Wait 2 x 3 seconds before marking Radius Server as dead
Interface command
authentication event server dead action reinitialize vlan X
If Radius server is dead reinitialise the port into vlan X (Could be another VLAN or could be same access VLAN)
authentication event server dead action authorize voice
If Radius server is dead - allow voice vlan
authentication event server alive action reinitialize
When the Radius server comes online - reinitialize authentications
So if I have 2 Radius Servers with the above configuration it would try ISE 1 for 6 seconds and then ISE 2 for 6 seconds and then reinitialize port into specified VLAN
Thanks
... View more
Created by
roger perkin
in Policy and Access
in Policy and Access
02-15-2018
11:08 AM
02-15-2018
11:08 AM
I want to understand the switchport or ISE config required that if switch cannot contact ISE server that the authentication fails open
I believe it's called Fail Open, but I want to make sure if the ISE server is unreachable that user still connects to VLAN configured on port
Thanks
... View more
Labels:
05-03-2019
I am trying to make MACSec work between a pair of Nexus 7702's running
8.3.1 I have configured the m...
Created by
roger perkin
in Data Center Switches
03-20-2019
03-20-2019
I am deploying a pair of Nexus 7702 switches with Nexus 7700 F3-Series
48 Port 1/10GbE (SFP/SFP+) in...
02-18-2019
Great, but I now typically have the creds in either a group_vars or
host_vars file Starting also to ...
05-23-2018
If you can SSH to your device from the command line of your Ansible
host, then this is most likely b...
04-04-2018
Thank you for your reply they are set as Network interface
port-channel100 description VPC_PEER_LINK...
04-03-2018
I have configured a VPC between a pair of Nexux 9Ks 93120TX Have enabled
MST on both switches and no...
Created by
roger perkin
in Other Data Center Subjects
03-28-2018
03-28-2018
I have an interesting challenge in connecting a VXLAN EVPN Fabric into a
pair of 6509s running EIGRP...
03-21-2018
I am facing an issue where a client is using 2 Microsoft Load Balancers
running on VMs connected to ...
Created by
roger perkin
in Policy and Access
02-21-2018
02-21-2018
Perfect, this is the solution, checking the built in Super Admin User -
it's all there to see!
Created by
roger perkin
in Policy and Access
02-21-2018
02-21-2018
Thanks, this was actually the issue, a misconfigured port on one of the
Radius servers - changed to ...
02-21-2018
I am configuring an ISE 2.3 environment with 2 nodes When debugging the
dot1x authentications in a 2...
Created by
roger perkin
in Policy and Access
02-20-2018
02-20-2018
Hi braham, Thanks for your reply however I am not exactly sure what you
mean about a duplicated copy...
Created by
roger perkin
in Policy and Access
02-16-2018
02-16-2018
I have setup login access on ISE 2.3 to use AD Under Authentication -
Password Based > Identity Sour...
Created by
roger perkin
in Policy and Access
02-15-2018
02-15-2018
Can anyone provide me a sample 2.3 policy for a wired 802.1x policy.
First I would like to allow acc...
Created by
roger perkin
in Policy and Access
02-15-2018
02-15-2018
Thanks, So to be clear global command radius-server dead-criteria time 3
tries 2 Wait 2 x 3 seconds ...
Public Statistics
| Date Registered | 02-24-2011 07:14 AM |
| Date Last Visited | 05-09-2019 12:56 PM |
| Total Messages Posted | 254 |
| Total Helpful Votes Received | 11 |
Helpful Votes Given To
.jpg "VIP Advocate"){kind=icon}
