We have a similar setup as above where, a) Server Farm switch is Nexus 5K/FEX, b) Core Switches are a pair of Nexus 7K, c) Distribution Switches are a pair of 4500X d) and Access Switches are 3650. Routing is only implemented on the Core Nexus 7K, the links between Core/Distribution and Distribution/Access are all Layer 2. Does similar configs apply in this scenario and does Nexus 7K support forwarding of directed broadcast packets on 6.2 release. Thanks and Regards, Mohan ... View more

Hi Marcin, Thank you very much for your response and actually, we did open a TAC and the problem was resolved using Crypto Map dynamic configurations for both Standard and IPSec aware VPN's. Some specific policies on ZBF were tweaked (for example echo-reply packet inspection was deleted(configured for Pass) and also some access-lists which had unwanted entries  were cleaned up. Thanks again for your help. Best Regards, Mohan ... View more

Thanks Reza. I have put a post on this issue on the Cisco developer forum as well and will update if i get any feedback. But i am really disappointed that despite Cisco announcing full support for SDN on 3850, still unable to support it, which really is very very misleading information as i have requested some customers to purchase this device for wired,wireless and OnePk enabling! ... View more

Hi Reza, Thanks for this and to the best of my knowledge Cisco have announced full SDN support( meaning OnePK support) on the 3850 platform but i am not sure if this is the correct code level or not. The OnePK Guide states that this support is available on ISR G2 platforms installed with 15.3-2.T (Universal K9) image. Is it possible to check if any special license is required to enable this feature or do we have to wait until the right code level is released..and this 3850 platform runs  IOS-XE as well as IOSd combined isnt' it? I have checked the release notes and cannot find any information..As you have the equipment is it possible to raise a TAC case and check directly with Cisco? Thanks and Regards, Mohan ... View more

Hi Reza, Thanks very much indeed. It would be great if you can try the following: This is the enabling commands for the ISR G2 routers 29xx, 39xx for One PK. and the requirement is to run cxxxx-universalk9-mz.SPA.153-2.T.bin on the ISR G2 platforms for OnePK support. Here are the steps: Enable onePK on your router. The onePK infrastructure is disabled by default on your router. To enable it, you must choose a communication method and then connect to the router console and issue a set of commands through the IOS CLI. Choose one of the following options: Option 1 – Unencrypted communication between the router and onePK applications Using the onep transport socket communication option means that all communication between the onePK application and the router, including router userids and passwords used to authenticate the onePK application to the router will be sent unencrypted or “in the clear.” Note: onep socket communication is very similar to using telnet to administer a router. Therefore, great care must be taken to ensure the communication path between the onePK application and the router cannot be intercepted and the socket communication traffic to the router is allowed only from the specific hosts running the onePK applications. See the Cisco Guide to Harden Cisco IOS Devices for more information on restricting traffic to/from your router. If you accept the security risks of unencrypted communication, enable onep transport socket as follows: router> enable router# configure terminal router(config)# onep router (config-onep)# transport socket router(config-onep)# start router(config-onep)# exit Option 2 – Encrypted communication between the router and onePK applications The onep transport TLS communication option enables the onePK application to communicate with the router over an encrypted link. TLS communication is similar to using SSH for router administration and therefore should be used for production deployments of onePK or in any development or test environment where traffic between the onePK application and the router may be intercepted. Note: TLS communication should be used with onePK applications whenever possible. In addition to enabling encrypted communications, TLS supports an additional layer of security by providing the option for the onePK application to use certificates to authenticate to the router (i.e., client authentication). See the Configuring onePK Application Authentication using Transport Layer Security (TLS) section below for more information. NOTE: Before entering the following commands, make sure the clock on your router is set to the correct time. If the clock is not set, issue the command clock set e.g., clock set <21:10:00> <1 apr 2013> or configure NTP on the router – see http://www.cisco.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf012.html#wp1001170 for more information. router> enable router# configure terminal router(config)# ip http server router(config)# onep router(config-onep)# transport tls disable-remotecert-validation router(config-onep)# start router(config-onep)# exit router(config)# crypto pki server onepkCA router(cs-server)# database level minimum router(cs-server)# grant auto router(cs-server)# no shut %Some server settings cannot be changed after CA certificate generation % Please enter a passphrase to protect the private key % or type return to exit ... View more