Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About syedumairali
07-24-2019
Stats
Member since
05-10-2005
232
Posts
14
Helpful
2
Solutions
11-04-2018
01:46 PM
Hej Paul
yes I understand your point. Actually we move default gateway to another interface that is by default-originate from the ospf peer. I have implemented PBR many times so I have a good understanding on the PBR and default routing table.
But here my question is why ZBF shows half open connections :( . WHY udp establish connection and why tcp half open.
I see the traffic traffic going outside and never returning
Again as soon as i remove PBR all TCP connection trafic work. Strange.
... View more
11-04-2018
12:32 PM
Actually as soon as i remove PBR from interface and added default route it work. but that is like going back to point zero.
conf t
ip route 0.0.0.0 0.0.0.0 x.54.23.254 no route-map internet deny 10
not understand your point if I remove stanza 10 and add default route so it would be the same thing i both ways ? i.e. sending traffic to x.54.23.254 by default gateway and PBR ?
... View more
11-03-2018
02:12 PM
thanks sbhadrav for reply.
Actually the problem i have is I cannot access APIC_IP from the browser.
... View more
11-03-2018
02:00 PM
Hi
I have ISR 4451-x router running zone base firewall and NAT.
Working setup ip route 0.0.0.0 0.0.0.0 x.54.23.254
interface GigabitEthernet0/0/0
description Internet
ip address x.54.23.210 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip verify unicast reverse-path
zone-member security OUTSIDE
negotiation auto
ip virtual-reassembly
!
interface GigabitEthernet0/0/1
description inside
ip address 172.16.4.10 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip verify unicast reverse-path
zone-member security INSIDE
negotiation auto
ip virtual-reassembly
During a change window we have to remove the default route due to some reason so I created a Policy base route to route traffic to int gi0/0/0
no ip route 0.0.0.0 0.0.0.0 x.54.23.254
route-map internet deny 10
match ip address PrivateNet-rfc1918 ! send dest.address == RFC 1918 to global route table
route-map internet permit 20
match ip address ALL-internet ! send internet trafic to int gi0/0/0
set ip next-hop x.54.23.209 interface GigabitEthernet0/0/1 ip policy route-map internet
Just after applying PBR on inter gi0/0/1, we lost all TCP connctions but not UDP session
Half-open Sessions
Session ID 0x00667A6F (10.83.32.179:54761)=>(17.248.146.42:443) https SIS_OPENING
Created 00:00:10, Last heard 00
Bytes sent (initiator:responder) [0:0]
I can see th NAT was OK & UDP trafic had establish session. So the question is what happened to ZBF when PBR ticked over to control the traffic. is there any feature in compatibity ?
... View more
Labels:
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
06-25-2018
07:43 AM
06-25-2018
07:43 AM
Yes Robert, I did that.
There comes a pop up window which says
This fabric has 6 Critical Faults and 2 Major Faults
It's recommended that these faults are resolved before performing a fabric upgrade.
Do you still want to perform an upgrade of the nodes in this Management Group?
... View more
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
06-25-2018
07:25 AM
06-25-2018
07:25 AM
Hi
We have a ACI fabric working fine and now I added to new leaf in the fabric. Leaf discovery & Inventory looks fine as the newly leaves are active and got the TEP.
Problem is when I add them to my current maintenace group, the leaf stuck at 0% with Status :
Scheduled for upgrade with pod2-even to desired version.
Can someone guide me how to resolve this upgrade problem to my new switches/leaves.
the new switch come with 13.0.(2n) while my fabric is 13.1.(2m).
/Umair
... View more
Labels:
06-07-2018
10:26 AM
Hi
We are trying to migrate N7000 (F2) to N7700 (F3). While copying configuration and reloading N77 we see following error
....Tcam will be over used, please enable bank
chaining and/or turn off atomic update.If bank-chaining is enabled on other modules
and this is a new linecard insertion,please enable bank-chaining prior to reloading
this module.
Looking further into the mater reveals that it is the atomic updates that stops it.
When we dig down further
Show hardware access-list resource entries module x
on N7000 shows total approx 8000 entries for all 4 banks having 2 vdc + admin
while N7700 shows only 4000 entries for all 4 banks having 2 vdc + admin gw01# show hardware access-list resource utilization module 1 INSTANCE 0x0 ------------- ACL Hardware Resource Utilization (Mod 1) -------------------------------------------- Used Free Percent Utilization ----------------------------------------------------- Tcam 0, Bank 0 20 4076 0.49 Tcam 0, Bank 1 20 4076 0.49 Tcam 1, Bank 0 25 4071 0.61 Tcam 1, Bank 1 440 3656 10.74 LOU 4 100 3.84 Both LOU Operands 2 Single LOU Operands 2 LOU L4 src port: 1 LOU L4 dst port: 1 LOU L3 packet len: 0 LOU IP tos: 0 LOU IP dscp: 0 LOU ip precedence: 0 LOU ip TTL: 0 TCP Flags 0 16 0.00 Protocol CAM 3 20 13.04 Mac Etype/Proto CAM 11 3 78.57 Non L4op labels, Tcam 0 0 1535 0.00 Non L4op labels, Tcam 1 1 1534 0.06 L4 op labels, Tcam 0 0 491 0.00 L4 op labels, Tcam 1 1 490 0.20 Ingress Dest info table 1 252 0.39 Egress Dest info table 0 256 0.00 ----- # sh system internal access-list globals slot 1 ======= Atomic Update : ENABLED Default ACL : DENY Bank Chaining : DISABLED Seq Feat Model : NO_DENY_ACE_SUPPORT This pltfm supports seq feat model Bank Class Model : DISABLED This pltfm supports bank class model Fabric path DNL : DISABLED Seq Feat Model : NO_DENY_ACE_SUPPORT This pltfm supports seq feat model L4 proto CAM extend : DISABLED This pltfm supports L4 proto CAM extend This pltfm does use L4 proto CAM MPLS Topmost As Pipe Mode : DISABLED This pltfm supports mpls topmost as pipe mode LOU Threshold Value : 5
I wonder what determines these resource entries and how can I set a higher resource entries for certain vdc ?
... View more
Labels:
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
05-29-2018
03:26 PM
05-29-2018
03:26 PM
Ok thanks Robert. Now I am able to catch my EP by VM.name inside the microSegment EPG. I missed following... While adding VMM Domain to Application EPG In the Add VMM Domain Association dialog box, check the Allow Micro-Segmentation check box. While adding VMM Domain to MicroSegment EPG From the Deploy Immediacy drop-down list, accept the default On Demand if you have Cisco ACI Virtual Edge, Cisco AVS, or Microsoft vSwitch; choose Immediate if you have VMware VDS.
... View more
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
05-29-2018
03:53 AM
05-29-2018
03:53 AM
Hi
I wanted to microsegment one of EP based on VM-Name but i cant. I have in my test setup with tiny server which has no VM tool installed. Is it important to install vm-tool on the virtual machine ?
//Umair
... View more
Labels:
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
05-29-2018
03:49 AM
05-29-2018
03:49 AM
I would say... All depend on your needs. I see 1 EPG = 1 BD setup in case of legacy migration scenario. You can take a look at best practice doc below https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/ACI_Best_Practices/b_ACI_Best_Practices/b_ACI_Best_Practices_chapter_010.html
... View more
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
05-22-2018
09:51 AM
05-22-2018
09:51 AM
Hi Robert, I just finish downgrading the other two APICs 1 & 3 to 3.1.1i. Now it seems they are all fully fit.
However your second option is worth a try. As downgrading other two APICs is a bit risky ?
Thanks for your kind help ! // Umair
... View more
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
05-22-2018
09:04 AM
05-22-2018
09:04 AM
I did as you stated... Now come another hassle. as APCI 1 & 3 are ver 3.1.2o and APIC 2 is 3.1.1i. APIC 2 heath is 'Data Layer Partially diverge'
F1824
critical
2018-05-22T17:54:35.607+02:00
Raised
topology/pod-1/node-1/lon/incmptblClsPeer-version_incompatible_with_cluster-2-3.1(1i)-apic-3.1(2o)
Peer controller is incompatible: Version incompatible with cluster. The controller ID is 2, its version is 3.1(1i). Cluster Version is apic-3.1(2o)
... View more
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
05-22-2018
08:39 AM
05-22-2018
08:39 AM
ok it was :)
acidiag reboot
... View more
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
05-22-2018
08:24 AM
05-22-2018
08:24 AM
just a side question... is there any way to get the CIMC address from GUI or configuration of APIC ?
... View more
Created by
syedumairali
in Application Centric Infrastructure
in Application Centric Infrastructure
05-22-2018
08:04 AM
05-22-2018
08:04 AM
This is from APIC 2 apic2# acidiag avread
Local appliance ID=2 ADDRESS=10.0.0.2 TEP ADDRESS=10.0.0.0/16 CHASSIS_ID=71fb2242-09d2-11e7-a7b7-abc87eae134c
Cluster of 3 lm(t):2(2018-03-19T07:08:23.679+02:00) appliances (out of targeted 3 lm(t):2(2018-05-17T13:52:11.471+02:00)) with FABRIC_DOMAIN name=ACI-LAB set to version=apic-3.1(2o) lm(t):1(2018-05-17T14:16:22.453+02:00); discoveryMode=PERMISSIVE lm(t):0(1970-01-01T02:00:00.003+02:00)
appliance id=1 address=10.0.0.1 lm(t):3(2018-05-16T14:48:31.356+02:00) tep address=10.0.0.0/16 lm(t):1(2017-03-16T00:55:37.049+02:00) oob address=172.19.1.20/24 lm(t):2(2018-05-17T13:52:13.521+02:00) version=3.1(2o) lm(t):1(2018-05-17T13:52:13.088+02:00) chassisId=31d1ff42-0630-11e7-aa84-058c938afcc4 lm(t):1(2018-05-17T13:52:13.088+02:00) capabilities=0X7FFFFFFFF--0X2020--0 lm(t):1(2018-05-17T14:20:30.246+02:00) rK=(stable,present,0X206173722D687373) lm(t):2(2018-05-17T13:52:13.521+02:00) aK=(stable,present,0X206173722D687373) lm(t):2(2018-05-17T13:52:13.521+02:00) cntrlSbst=(APPROVED, xx) lm(t):0(zeroTime) (targetMbSn= lm(t):0(zeroTime), failoverStatus=0 lm(t):0(zeroTime)) podId=1 lm(t):1(2018-05-16T13:03:39.793+02:00) commissioned=YES lm(t):2(2017-03-20T15:10:05.325+02:00) registered=YES lm(t):3(2017-03-20T15:10:05.325+02:00) standby=NO lm(t):1(2018-05-16T13:03:39.793+02:00) active=YES(2018-05-17T13:52:13.092+02:00) health=(applnc:255 lm(t):1(2018-05-17T13:52:15.087+02:00) svc's)
appliance id=2 address=10.0.0.2 lm(t):2(2018-03-19T07:36:36.353+02:00) tep address=10.0.0.0/16 lm(t):2(2018-03-19T07:36:36.353+02:00) oob address=172.19.1.21/24 lm(t):2(2018-05-17T13:52:11.258+02:00) version=3.1(1i) lm(t):2(2018-05-17T13:52:13.189+02:00) chassisId=71fb2242-09d2-11e7-a7b7-abc87eae134c lm(t):2(2018-05-17T13:52:13.189+02:00) capabilities=0X7FFFFFFFF--0X2020--0X7 lm(t):2(2018-03-19T07:08:24.116+02:00) rK=(stable,present,0X206173722D687373) lm(t):2(2018-05-17T13:52:11.268+02:00) aK=(stable,present,0X206173722D687373) lm(t):2(2018-05-17T13:52:11.268+02:00) cntrlSbst=(APPROVED, xx) lm(t):2(2018-05-17T13:52:13.189+02:00) (targetMbSn= lm(t):0(zeroTime), failoverStatus=0 lm(t):0(zeroTime)) podId=1 lm(t):2(2018-03-19T07:36:36.353+02:00) commissioned=YES lm(t):2(zeroTime) registered=YES lm(t):2(2018-03-19T07:36:36.353+02:00) standby=NO lm(t):2(2018-03-19T07:36:36.353+02:00) active=YES(2018-03-19T07:36:36.353+02:00) health=(applnc:255 lm(t):2(2018-05-17T13:52:59.507+02:00) svc's)
appliance id=3 address=10.0.0.3 lm(t):3(2018-05-16T14:48:24.642+02:00) tep address=10.0.0.0/16 lm(t):3(2017-03-20T15:09:59.852+02:00) oob address=172.19.1.22/24 lm(t):2(2018-05-17T13:52:13.521+02:00) version=3.1(2o) lm(t):3(2018-05-17T13:52:13.164+02:00) chassisId=6aa68208-0d6e-11e7-8534-abe884595d92 lm(t):3(2018-05-17T13:52:13.164+02:00) capabilities=0X7FFFFFFFF--0X2020--0 lm(t):3(2018-05-17T14:20:44.059+02:00) rK=(stable,present,0X206173722D687373) lm(t):2(2018-05-17T13:52:13.521+02:00) aK=(stable,present,0X206173722D687373) lm(t):2(2018-05-17T13:52:13.521+02:00) cntrlSbst=(APPROVED, xx) lm(t):0(zeroTime) (targetMbSn= lm(t):0(zeroTime), failoverStatus=0 lm(t):0(zeroTime)) podId=1 lm(t):3(2018-05-16T14:48:24.642+02:00) commissioned=YES lm(t):1(2018-05-16T12:35:29.606+02:00) registered=YES lm(t):1(2017-03-20T15:10:11.335+02:00) standby=NO lm(t):3(2018-05-16T14:48:24.642+02:00) active=YES(2018-05-17T13:52:13.163+02:00) health=(applnc:255 lm(t):3(2018-05-17T13:52:14.912+02:00) svc's)
---------------------------------------------
clusterTime=<diff=-1696892 common=2018-05-22T16:34:20.092+02:00 local=2018-05-22T17:02:36.984+02:00 pF=<displForm=0 offsSt=0 offsVlu=7200 lm(t):2(2018-05-17T13:52:11.446+02:00)>>
... View more
11-04-2018
Hej Paul yes I understand your point. Actually we move default gateway
to another interface that is ...
11-04-2018
Actually as soon as i remove PBR from interface and added default route
it work. but that is like go...
11-03-2018
thanks sbhadrav for reply. Actually the problem i have is I cannot
access APIC_IP from the browser.
11-03-2018
Hi I have ISR 4451-x router running zone base firewall and NAT. Working
setup ip route 0.0.0.0 0.0.0...
Created by
syedumairali
in Application Centric Infrastructure
06-25-2018
06-25-2018
Yes Robert, I did that. There comes a pop up window which says This
fabric has 6 Critical Faults and...
Created by
syedumairali
in Application Centric Infrastructure
06-25-2018
06-25-2018
Hi We have a ACI fabric working fine and now I added to new leaf in the
fabric. Leaf discovery & Inv...
06-07-2018
Hi We are trying to migrate N7000 (F2) to N7700 (F3). While copying
configuration and reloading N77 ...
05-29-2018
Ok thanks Robert. Now I am able to catch my EP by VM.name inside the
microSegment EPG. I missed foll...
05-29-2018
Hi I wanted to microsegment one of EP based on VM-Name but i cant. I
have in my test setup with tiny...
Created by
syedumairali
in Application Centric Infrastructure
05-29-2018
05-29-2018
I would say... All depend on your needs. I see 1 EPG = 1 BD setup in
case of legacy migration scenar...
Created by
syedumairali
in Application Centric Infrastructure
05-22-2018
05-22-2018
Hi Robert,I just finish downgrading the other two APICs 1 & 3 to 3.1.1i.
Now it seems they are all f...
Created by
syedumairali
in Application Centric Infrastructure
05-22-2018
05-22-2018
I did as you stated... Now come another hassle. as APCI 1 & 3 are ver
3.1.2o and APIC 2 is 3.1.1i. A...
Created by
syedumairali
in Application Centric Infrastructure
05-22-2018
05-22-2018
ok it was :) acidiag reboot
Created by
syedumairali
in Application Centric Infrastructure
05-22-2018
05-22-2018
just a side question... is there any way to get the CIMC address from
GUI or configuration of APIC ?
Created by
syedumairali
in Application Centric Infrastructure
05-22-2018
05-22-2018
This is from APIC 2apic2# acidiag avread Local appliance ID=2
ADDRESS=10.0.0.2 TEP ADDRESS=10.0.0.0/...
Public Statistics
| Date Registered | 05-10-2005 11:09 PM |
| Date Last Visited | 07-24-2019 02:49 AM |
| Total Messages Posted | 232 |
| Total Helpful Votes Received | 14 |
Helpful Votes Given To
.jpg "Hall of Fame Cisco Employee"){kind=icon}
.jpg "VIP Expert"){kind=icon}
