Hey Pille, Thanks so much for your help, it's been great!  You know as simple as it is I didn't even think about the vty lines, everything kept centering around the physical interface 'mgmt0' so I just assumed the application would be on that interface.  It makes total sense now to use an access-class on them to allow only the management station. As far as the format for the original list, I tried a number of variations and I"m fairly positive I tried the one you posted.  Regardless it's good to know that the number alone is a type not the port, and to use the eq XX syntax.  For the vPC related 'stuff' you're correct I did mean the peer keep alive link, and right now it's configured based on the mgmt0 IP's to it's partner, so blocking the interface blocked the keep alives.  Thanks again for your fantastic help, closing and rating! Kindest Regards, ALAN ... View more

Awesome, thanks for your thorough response - makes a lot of sense seeing it that way.  I still like how the 7k handles encryption better, but it's nice that this is there by default now.  closing and adding ratings! Kindest Regards, ALAN ... View more

Hmm interesting.  When I look at the required field after the 'password 5' it shows as a 'WORD' type.. so I figured this would more strongly encrypt the password that I input.. Can you give an example of using 'password 5'?  Given that example how does one enter the password assuming they use the 'password 5' route?  Finally - is the 'password 5' method more secure or just another method of user account authentication? Looking forward to your responses, and pending them will award answers and ratings! Kindest Regards, Alan ... View more

Hey Reza, Awesome!  You helped me connect the dots!  When I  copied the config to tftp this time I specific the management vrf and  voila it worked.  Still lots to learn but you've put me on the right  path.  Thanks so much, marking as correct answer and rating other posts! Kindest Regards, ALAN ... View more

Hey Reza, Right on, the SVI's are defined in the 3750.  Here's something interesting, if I ping from the management vrf, I can hit my tftp server: 10.132.6.144.  If I ping from the default vrf, with the configuration as you see above, there is no response.  That's why I added that global static route that shows up the same as the default gateway for the management vrf.  I figured as much about the default route for the mgmt0 interface, good to know that assumption was correct.  Is the UCS manager served from the mgmt0 interface then?? Anywho, understanding is increasing but still I cannot ping the TFTP server..  Looking forward to getting this resolved and pending resolution I will grade and award correct answer here! Thanks so much, ALAN ... View more

Hey Reza! Absolutely - just from scratching the surface of the documentation I think it's a very intelligent OS/design and am looking forward to implementing it properly/fully. The 5k's are Layer 2 right now (I'm not 100% on this but a 'sh license usage' shows LAN_BASE_SERVICES_PKG as a 'no') afaik.  Again a bit sketchy on this.. from a logical angle, there are no layer 3 protocols running on the device so far.  Our management VRF does have a default route and shows a few directly connected entries though. So - that makes sense that default is the equivalent of global routing - my initial thought was: Ok, add the uplink port-channel/vPC to the 3750's to the default VRF (along with all the other ports save mgmt0) and set the uplinks as the default route (interface destination not IP).  What do you think? My only question in all that was: well then how can we access the UCS manager now - if there are no interfaces in the default VRF and there are no routes in the default VRF?? It just made me pause and think before changing stuff.  Very excited to hear your response!!  I'm posting the running config now: SGCN5K01# sh run !Command: show running-config !Time: Fri May 15 15:11:04 2009 version 5.2(1)N1(1b) hostname SGCN5K01 no feature telnet cfs eth distribute feature lacp feature vpc feature lldp username _____ password 5 $1$Bczq.c99$xbC4VG18Xg8M5knPFn2lG0  role network-admin banner motd #Nexus 5000 Switch # ip domain-lookup logging event link-status default ip access-list classify_COS_4   10 permit ip 10.132.13.0/24 any   20 permit ip any 10.132.13.0/24 ip access-list classify_COS_5   10 permit ip 10.132.5.128/25 any   20 permit ip any 10.132.5.128/25 class-map type qos class-fcoe class-map type qos match-all Silver_Traffic   match access-group name classify_COS_4 class-map type qos match-all Platinum_Traffic   match access-group name classify_COS_5 class-map type queuing class-fcoe   match qos-group 1 class-map type queuing class-all-flood   match qos-group 2 class-map type queuing class-ip-multicast   match qos-group 2 policy-map type qos Global_Classify   class Platinum_Traffic     set qos-group 2   class Silver_Traffic     set qos-group 4   class class-default class-map type network-qos class-fcoe   match qos-group 1 class-map type network-qos class-all-flood   match qos-group 2 class-map type network-qos Silver_Traffic_NQ   match qos-group 4 class-map type network-qos class-ip-multicast   match qos-group 2 class-map type network-qos Platinum_Traffic_NQ   match qos-group 2 policy-map type network-qos jumbo   class type network-qos class-default     mtu 9216     multicast-optimize policy-map type network-qos Setup_QOS   class type network-qos Platinum_Traffic_NQ     set cos 5     mtu 9000   class type network-qos Silver_Traffic_NQ     set cos 4     mtu 9000   class type network-qos class-default     multicast-optimize system qos   service-policy type qos input Global_Classify   service-policy type network-qos jumbo snmp-server contact Planview Infrastructure Dept. snmp-server location  SunGard Austin snmp-server user admin network-admin auth md5 0x40a021c27c5d155338065b7a16f8b0b9 priv 0x40a021c27c5d155338065b7a16f8b0b9 localizedkey snmp-server community pvcorporate group network-operator vrf context management   ip route 0.0.0.0/0 10.132.5.1 vlan 1 vlan 13   name vMotion-VLAN vlan 16,20 vlan 51   name MGMT-VLAN vlan 52   name NFS-VLAN vlan 61-67 spanning-tree port type edge bpduguard default spanning-tree port type edge bpdufilter default spanning-tree port type network default vpc domain 1   role priority 10   peer-keepalive destination 10.132.5.33 port-profile default max-ports 512 interface port-channel4   switchport mode trunk   speed 10000   vpc 4 interface port-channel10   description vPC peer-link   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   spanning-tree port type network   vpc peer-link interface port-channel11   description sgcnscnt04   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 52   spanning-tree port type edge trunk   vpc 11 interface port-channel12   description sgcnscnt05   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 52   spanning-tree port type edge trunk   vpc 12 interface port-channel13   description SGCFIC01   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   spanning-tree port type edge trunk   vpc 13 interface port-channel14   description SGCFIC02   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   spanning-tree port type edge trunk   vpc 14 interface Ethernet1/1   description itype:trunk|dtype:switch|rdevice:SGCN5K02|rport:Eth1/1|notes:cisco_5548   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   channel-group 10 mode active interface Ethernet1/2   description itype:trunk|dtype:switch|rdevice:SGCN5K02|rport:Eth1/2|notes:cisco_5548   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   channel-group 10 mode active interface Ethernet1/3   description itype:trunk|dtype:switch|rdevice:SGCN5K02|rport:Eth1/3|notes:cisco_5548   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   channel-group 10 mode active interface Ethernet1/4   description itype:access|dtype:storage_head|rdevice:SGCNSCNT04|rport:e1A|notes:netapp_3220   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 52   channel-group 11 mode active interface Ethernet1/5   description itype:access|dtype:storage_head|rdevice:SGCNSCNT05|rport:e1A|notes:netapp_3220   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 52   channel-group 12 mode active interface Ethernet1/6   description itype:trunk|dtype:fabric_iconnect|rdevice:SGCFIC01|rport:Eth1/1|notes:cisco_6248   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   channel-group 13 mode active interface Ethernet1/7   description itype:trunk|dtype:fabric_iconnect|rdevice:SGCFIC01|rport:Eth1/2|notes:cisco_6248   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   channel-group 13 mode active interface Ethernet1/8   description itype:trunk|dtype:fabric_iconnect|rdevice:SGCFIC02|rport:Eth1/1|notes:cisco_6248   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   channel-group 14 mode active interface Ethernet1/9   description itype:trunk|dtype:fabric_iconnect|rdevice:SGCFIC02|rport:Eth1/2|notes:cisco_6248   switchport mode trunk   switchport trunk native vlan 999   switchport trunk allowed vlan 13,16,20,51-52,61-67   channel-group 14 mode active interface Ethernet1/10 interface Ethernet1/11 interface Ethernet1/12 interface Ethernet1/13 interface Ethernet1/14   switchport mode trunk   channel-group 4 mode active interface Ethernet1/15   switchport mode trunk   channel-group 4 mode active interface Ethernet1/16 interface Ethernet1/17 interface Ethernet1/18 interface Ethernet1/19 interface Ethernet1/20 interface Ethernet1/21 interface Ethernet1/22 interface Ethernet1/23 interface Ethernet1/24 interface Ethernet1/25 interface Ethernet1/26 interface Ethernet1/27 interface Ethernet1/28 interface Ethernet1/29 interface Ethernet1/30 interface Ethernet1/31 interface Ethernet1/32 interface mgmt0   ip address 10.132.5.37/24 line console line vty boot kickstart bootflash:/n5000-uk9-kickstart.5.2.1.N1.1b.bin boot system bootflash:/n5000-uk9.5.2.1.N1.1b.bin ip route 0.0.0.0/0 10.132.5.1 Kindest Regards, ALAN ... View more

You're like a NAT-cyclopedia, thanks again sir - I am grading and marking these posts now! -ALAN ... View more

Haha, well despite my rather jumbled response, you did answer my question and most importantly gave me the logic behind these statements.  This is very cool because now I can see there are a ton of private networks we're connected to that I need to understand more! If you answer one more question for me I'll mark it correct - how do I clear the counters in the translate_hits and untranslate_hits.. I want to clear them and see which of these remote networks really get hit THESE DAYS over the next month or so. Thanks in advance! Sidenote: That document rocks - very comprehensive and straightforward.. keep up the fantastic, very much appreciated. Kindest Regards, ALAN ... View more

Wow, cool!! You're really helping my understanding.. gotcha So - if I did what I proposed since these are manual NAT line 1 - yeah no internet - got it. And I also see what you're saying, maybe there is site to site traffic to those private networks, that we don't want to translate, so he made the destinations like that to say: Hey ASA - I know we're doing interface PAT in section 2 - but if these internal IP's are destined for these other inside IP's out the outside interface, don't touch! Right??  I am grateful for these forums to get such great feedback so quickly - thanks again. I will definitely take a look at your document - have to read tons NAT is confusing! Kindest Regards, ALAN ... View more