Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About dukenuk96
06-19-2019
dukenuk96
Member since
09-11-2014
Participant
Detailed answer requires detailed question.
12-28-2018
04:32 AM
I have a question regarding ASR 1000-HX series GRE performance - what is maximum bandwidth on let's say ASR 1001-HX router? Line rate? Did not find exact numbers in data sheets.
... View more
Labels:
12-20-2018
06:07 AM
So, only virtualized behavior, native ASA code running is impossible, right?
... View more
12-20-2018
04:11 AM
We are going to order FPR4120 and selected in CCW:
FIREPOWER HARDWARE
FPR4120-ASA-K9
Cisco Firepower 4120 ASA Appliance, 1U, 2 x NetMod Bays
Some articles and forums say that FPR box running ASA code have no difference compared to ASA5000 series regarding to management, CLI, features (virtual device contexts, clustering, dynamic routing, etc). firepower asa code
However on cisco.com site I found this document https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/fp4100/asa-firepower4100-qsg.html#pgfId-142917 stating some weird steps to get ASA code working on this box.
Please clarify where it the truth?
... View more
Created by
dukenuk96
in Other Data Center Subjects
in Other Data Center Subjects
07-06-2018
07:19 AM
07-06-2018
07:19 AM
Hi all!
I am testing N9k in virtual environment:
NX-OSv9K is a demo version of the Nexus Operating System
Software
BIOS: version
NXOS: version 7.0(3)I5(2)
BIOS compile time:
NXOS image file is: bootflash:///nxos.7.0.3.I5.2.bin
NXOS compile time: 2/16/2017 8:00:00 [02/16/2017 17:03:27]
Hardware
cisco NX-OSv Chassis
with 8160556 kB of memory.
Processor Board ID 9DOV2BAZYKE
Device name: NX2
bootflash: 3509454 kB
Kernel uptime is 0 day(s), 5 hour(s), 18 minute(s), 9 second(s)
And try to establish BFD session:
interface Vlan99
bfd interval 500 min_rx 500 multiplier 3
no bfd echo
bfd authentication Keyed-SHA1 key-id 1 hex-key 123
bfd ipv4 interval 500 min_rx 500 multiplier 3
ip ospf bfd
router ospf 1
bfd
But session does not come up due to lack of resources:
NX2# sh bfd neighbors det
OurAddr NeighAddr LD/RD RH/RS Holdown(mu
lt) State Int Vrf
11.11.11.1 11.11.11.2 1090519041/0 Down N/A(3)
Down Vlan99 default
Session state is Down and not using echo function
Local Diag: 0, Demand mode: 0, Poll bit: 0, Authentication: Keyed-SHA1
MinTxInt: 0 us, MinRxInt: 0 us, Multiplier: 0
Received MinRxInt: 0 us, Received Multiplier: 0
Holdown (hits): 0 ms (0), Hello (hits): 0 ms (0)
Rx Count: 0, Rx Interval (ms) min/max/avg: 0/0/0 last: 0 ms ago
Tx Count: 0, Tx Interval (ms) min/max/avg: 0/0/0 last: 0 ms ago
Registered protocols: ospf
Downtime: 0 days 0 hrs 17 mins 19 secs
Last packet: Version: 0 - Diagnostic: 0
State bit: AdminDown - Demand bit: 0
Poll bit: 0 - Final bit: 0
Multiplier: 0 - Length: 24
My Discr.: 0 - Your Discr.: 0
Min tx interval: 0 - Min rx interval: 0
Min Echo interval: 0 - Authentication bit: 0
Hosting LC: 0, Down reason: No Diagnostic, Reason not-hosted: Req-resp status: n
o resource
NX2# sh logg last 5
2018 Jul 6 14:12:33 NX2 %BFD-5-SESSION_NO_RESOURCES: No resource for session to
neighbor 11.11.11.2 on interface Vlan99
2018 Jul 6 14:13:19 NX2 last message repeated 1 time
2018 Jul 6 14:14:44 NX2 last message repeated 2 times
2018 Jul 6 14:16:20 NX2 last message repeated 2 times
2018 Jul 6 14:17:34 NX2 last message repeated 2 times
Please help, I do not want to test this on production network.
... View more
Labels:
07-03-2018
12:04 AM
Hi all!
I am facing strange behavior with NTP client behind NAT. Using network scanners I saw that NTP client sitting behind NAT can be NTP amplifier. I used nmap and several other tools, results are the same:
d@d:~/Downloads$ sudo nmap -sU -pU:123 -Pn -n --script=ntp-monlist 66.66.66.185
Starting Nmap 7.01 ( https://nmap.org ) at 2018-07-03 10:31 +05
Nmap scan report for 66.66.66.185
Host is up (0.035s latency).
PORT STATE SERVICE
123/udp open ntp
| ntp-monlist:
| Target is synchronised with 85.114.26.194
| Alternative Target Interfaces:
| 10.217.12.43
| Public Servers (4)
| 78.140.251.2 85.114.26.194 94.247.111.10 213.108.248.178
| Private Clients (1)
| 192.168.65.37
| Public Clients (1)
|_ 77.77.77.12
Nmap done: 1 IP address (1 host up) scanned in 0.57 seconds
66.66.66.185 is one of the IP addresses that ASA uses for NAT, 77.77.77.12 - is my PC's public IP address. So using nmap I do scan of this address and see responce from NTP client behind NAT, which is strange - why traffic from another IP address is permitted into the xlate?
ASA version:
Cisco Adaptive Security Appliance Software Version 9.1(6)11 <context>
Compiled on Mon 15-Feb-16 14:45 by builders
XXX up 25 days 20 hours
failover cluster up 1 year 235 days
Hardware: ASA5520
NAT rule:
Manual NAT Policies (Section 3)
1 (inside) to (outside) source dynamic OGN-Internal-Hosts pat-pool ON-PAT-to-Addrs flat include-reserve round-robin description "Internal hosts PAT to Internet"
translate_hits = 553746355, untranslate_hits = 6848003
Source - Origin: 10.216.0.0/15, 192.168.224.0/24, Translated (PAT): 66.66.66.186/32, 66.66.66.184/32, 66.66.66.183/32, 66.66.66.182/32
66.66.66.185/32
Translations table:
XXX/vdc-xxx/act# show xlate | include /123 flags
UDP PAT from inside:10.217.7.24/123 to outside:66.66.66.185/123 flags ri idle 0:00:22 timeout 0:00:30
UDP PAT from inside:10.217.10.139/123 to outside:66.66.66.184/123 flags ri idle 0:00:04 timeout 0:00:30
UDP PAT from inside:10.217.11.188/123 to outside:66.66.66.186/123 flags ri idle 0:01:42 timeout 0:00:30
UDP PAT from inside:10.217.6.72/123 to outside:66.66.66.182/123 flags ri idle 0:02:04 timeout 0:00:30
UDP PAT from inside:10.217.12.157/123 to outside:66.66.66.183/123 flags ri idle 0:32:38 timeout 0:00:30
Connections table:
XXX/vdc-xxx/act# show conn | i :123
UDP outside 89.109.251.21:123 inside 10.217.12.43:123, idle 0:01:38, bytes 96, flags -
UDP outside 89.109.251.21:123 inside 10.217.7.107:123, idle 0:00:15, bytes 96, flags -
UDP outside 80.93.50.95:123 inside 10.217.7.157:123, idle 0:00:43, bytes 96, flags -
UDP outside 80.93.50.95:123 inside 10.217.7.143:123, idle 0:01:10, bytes 96, flags -
UDP outside 80.93.50.95:123 inside 10.217.10.153:123, idle 0:01:44, bytes 96, flags -
UDP outside 80.93.50.95:123 inside 10.217.9.244:123, idle 0:01:48, bytes 96, flags -
Totally we see:
NTP client behind ASA with internal address of 10.217.12.43:123 connected to 89.109.251.21:123, ASA translated client's intrenal IP to external IP 66.66.66.185. Another host with IP address 77.77.77.12 issued nmap NTP scan to ASA external address 66.66.66.185 and ASA let this traffic pass through, and client responded to this host.
So I have these questions:
1. Is it normal for ASA to let traffic from host that is not part of the translation to pass? Or it is special case for UDP or only NTP?
2. Is it possible to tune ASA's cfg so that such situation would not be possible?
3. Is this normal operation of NTP protocol?
Thanks.
... View more
Labels:
Created by
dukenuk96
in Other Network Architecture Subjects
in Other Network Architecture Subjects
01-30-2018
10:01 PM
01-30-2018
10:01 PM
Hi all!
We have router Cisco ASR 1001-x. Now we need additional 10Gbit/s interface (at least one) on this platform with SFP+ form-factor port. We have found variants with part numbers SPA-1X10GE-L-V2 and SPA-1X10GE-WL-V2, but both of then are XFP-based, not SFP+.
So we have questions:
What difference between SPA-1X10GE-L-V2 and SPA-1X10GE-WL-V2?
Are there SFP+ based shared port adapters exist?
If there is no SFP+ based shared port adapters, is it Okay to have XFP on one end of the link and SFP+ on the other end of the link (with corresponding wavelengths for sure).
Is there shared port adapters with two or more 10Gbit/s ports for this platform?
... View more
Labels:
11-22-2017
09:28 PM
Okay, here it is:
sw#sh run Building configuration...
Current configuration : 1167 bytes ! ! Last configuration change at 19:35:37 +05 Wed Nov 22 2017 ! version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption service compress-config ! hostname sw ! boot-start-marker boot-end-marker ! ! ! no aaa new-model clock timezone +05 5 0 no ipv6 cef ipv6 multicast rpf use-bgp ! ip cef ! ! ! ! spanning-tree mode pvst spanning-tree extend system-id ! ! ! ! vlan internal allocation policy ascending ! ! ! ! ! ! ! ! ! ! interface Ethernet0/0 switchport access vlan 1000 duplex auto spanning-tree portfast ! interface Ethernet0/1 switchport access vlan 1000 duplex auto spanning-tree portfast ! interface Ethernet0/2 switchport access vlan 1000 duplex auto spanning-tree portfast ! interface Ethernet0/3 switchport access vlan 1000 duplex auto spanning-tree portfast ! interface Ethernet1/0 shutdown duplex auto ! interface Ethernet1/1 shutdown duplex auto ! interface Ethernet1/2 shutdown duplex auto ! interface Ethernet1/3 shutdown duplex auto ! ! no ip http server ! ! ! ! ! control-plane ! ! line con 0 logging synchronous line aux 0 line vty 0 4 login ! end
sw#sh ip igmp snooping Global IGMP Snooping configuration: ------------------------------------------- IGMP snooping : Enabled IGMPv3 snooping : Not supported Report suppression : Enabled TCN solicit query : Disabled TCN flood query count : 2 Robustness variable : 2 Last member query count : 2 Last member query interval : 1000
Vlan 1: -------- IGMP snooping : Enabled CAPWAP enabled : Disabled IGMPv2 immediate leave : Disabled Multicast router learning mode : pim-dvmrp CGMP interoperability mode : IGMP_ONLY Robustness variable : 2 Last member query count : 2 Last member query interval : 1000 Vlan 1000: -------- IGMP snooping : Enabled CAPWAP enabled : Disabled IGMPv2 immediate leave : Disabled Multicast router learning mode : pim-dvmrp CGMP interoperability mode : IGMP_ONLY Robustness variable : 2 Last member query count : 2 Last member query interval : 1000
... View more
11-22-2017
06:23 AM
Hi all!
I have a simple lab:
Configs are:
R6:
ip multicast-routing
interface Loopback0 ip address 1.1.1.1 255.255.255.255 ip pim sparse-mode ! interface Ethernet0/0 ip address 10.0.0.254 255.0.0.0 ip pim sparse-mode ! interface Ethernet0/1 ip address 192.168.0.254 255.255.255.0 ip pim sparse-mode ! interface Ethernet0/2 no ip address shutdown ! interface Ethernet0/3 no ip address shutdown ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ip pim rp-address 1.1.1.1
sw:
interface Ethernet0/0 switchport access vlan 1000 duplex auto spanning-tree portfast ! interface Ethernet0/1 switchport access vlan 1000 duplex auto spanning-tree portfast ! interface Ethernet0/2 switchport access vlan 1000 duplex auto spanning-tree portfast ! interface Ethernet0/3 switchport access vlan 1000 duplex auto spanning-tree portfast
!
With 'no ip igmp snooping' on sw everything works fine, I see multicast video on the client. But when I enable 'ip igmp snooping' on sw, everything is broken and I can't get why. Next some diagnostics and debugs:
sw#sh ip igmp snooping groups Vlan Group Version Port List --------------------------------------------------------- 1000 239.0.1.1 v2 Et0/1
sw#sh ip igmp snooping mrouter Vlan ports ---- ----- 1000 Et0/0(dynamic)
sw#sh ip igmp snooping querier Vlan IP Address IGMP Version Port ------------------------------------------------------------- 1000 10.0.0.254 v2 Et0/0
sw#debug ip igmp snooping group IP address debugging is on redundancy debugging is on timer debugging is on management debugging is on ancp debugging is on router debugging is on querier debugging is on group debugging is on sw#
*Nov 22 14:19:35.893: IGMPSN: router: Received non igmp pak on Vlan 1000, port Et0/0 *Nov 22 14:19:35.893: IGMPSN: router: PIMV2 Hello packet received in 1000 *Nov 22 14:19:35.893: IGMPSN: router: Is a router port on Vlan 1000, port Et0/0 *Nov 22 14:19:35.893: IGMPSN: router: Learning port: Et0/0 as rport on Vlan 1000 sw# *Nov 22 14:19:42.855: IGMPSN: Received IGMPv2 Report for group 239.0.1.1 received on Vlan 1000, port Et0/1 *Nov 22 14:19:42.855: IGMPSN: group: Received IGMPv2 report for group 239.0.1.1 received on Vlan 1000, port Et0/1 *Nov 22 14:19:42.855: IGMPSN: group: Skip client info adding - ip 10.0.0.2, port_id Et0/1, on vlan 1000 *Nov 22 14:19:42.855: IGMPSN: MCAST IP address 239.0.1.1, MAC address 0100.5e00.0101 *Nov 22 14:19:42.855: IGMPSN: Can not Locate gce 0100.5e00.0101, on Vlan 1000 *Nov 22 14:19:42.855: IGMPSN: MCAST IP address 239.0.1.1, MAC address 0100.5e00.0101 *Nov 22 14:19:42.855: IGMPSN: Can not Locate gce 0100.5e00.0101, on Vlan 1000 *Nov 22 14:19:42.855: IGMPSN: mgt: created gce 0100.5e00.0101, on Vlan 1000 *Nov 22 14:19:42.855: l2mcm_group_create: creating a group 239.0.1.1 on vlan 1000, dummy NO *Nov 22 14:19:42.855: l2mcm_group_create: timer stop: vlan 1000, group 239.0.1.1 *Nov 22 14:19:42.855: IGMPSN: mgt: created group 239.0.1.1, on Vlan 1000 *Nov 22 14:19:42.855: IGMPSN: mgt: Vlan 1000 gce 0100.5e00.0101 add port Et0/0 *Nov 22 14:19:42.855: L2MM: setting Et0/0 in gce->mbr_blist *Nov 22 14:19:42.855: IGMPSN: group: Created group 239.0.1.1 *Nov 22 14:19:42.855: IGMPSN: Add v2 group 239.0.1.1 member port Et0/1, on Vlan 1000 *Nov 22 14:19:42.855: IGMPSN: mgt: Vlan 1000 gce 0100.5e00.0101 add port Et0/1 *Nov 22 14:19:42.855: L2MM: setting Et0/1 in gce->mbr_blist *Nov 22 14:19:42.855: IGMPSN: group: Added port Et0/1 to group 239.0.1.1 *Nov 22 14:19:42.855: l2mcsn_process_report: TIMER_START for group 188.82.91.232 for time 10000 * 100 *Nov 22 14:19:42.855: IGMPSN: group: Forwarding 239.0.1.1 report to router ports sw# *Nov 22 14:19:45.491: IGMPSN: Received IGMPv2 Report for group 239.0.1.1 received on Vlan 1000, port Et0/1 *Nov 22 14:19:45.491: IGMPSN: group: Received IGMPv2 report for group 239.0.1.1 received on Vlan 1000, port Et0/1 *Nov 22 14:19:45.491: IGMPSN: group: Skip client info adding - ip 10.0.0.2, port_id Et0/1, on vlan 1000 *Nov 22 14:19:45.491: IGMPSN: MCAST IP address 239.0.1.1, MAC address 0100.5e00.0101 *Nov 22 14:19:45.491: IGMPSN: Locate gce 0100.5e00.0101, on Vlan 1000 *Nov 22 14:19:45.491: IGMPSN: locate group 239.0.1.1, on Vlan 1000 *Nov 22 14:19:45.491: IGMPSN: Add v2 group 239.0.1.1 member port Et0/1, on Vlan 1000 sw# *Nov 22 14:19:45.491: IGMPSN: group: Added port Et0/1 to group 239.0.1.1 *Nov 22 14:19:45.491: l2mcsn_process_report: TIMER_RUNNING for group 239.0.1.1 sw# *Nov 22 14:19:48.307: IGMPSN: Received IGMPv2 Report for group 239.0.1.1 received on Vlan 1000, port Et0/1 *Nov 22 14:19:48.307: IGMPSN: group: Received IGMPv2 report for group 239.0.1.1 received on Vlan 1000, port Et0/1 *Nov 22 14:19:48.307: IGMPSN: group: Skip client info adding - ip 10.0.0.2, port_id Et0/1, on vlan 1000 *Nov 22 14:19:48.307: IGMPSN: MCAST IP address 239.0.1.1, MAC address 0100.5e00.0101 *Nov 22 14:19:48.307: IGMPSN: Locate gce 0100.5e00.0101, on Vlan 1000 *Nov 22 14:19:48.307: IGMPSN: locate group 239.0.1.1, on Vlan 1000 *Nov 22 14:19:48.307: IGMPSN: Add v2 group 239.0.1.1 member port Et0/1, on Vlan 1000 sw# *Nov 22 14:19:48.307: IGMPSN: group: Added port Et0/1 to group 239.0.1.1 *Nov 22 14:19:48.307: l2mcsn_process_report: TIMER_RUNNING for group 239.0.1.1 sw# *Nov 22 14:20:01.413: IGMPSN: Received IGMP Query for group 0.0.0.0 received on Vlan 1000, port Et0/0 *Nov 22 14:20:01.413: IGMPSN: IGMPv2 General Query received on Vlan 1000, port Et0/0 Resp time 10000 (100 100) msecs, LLQ interval 2000 (2, 1000) *Nov 22 14:20:01.413: IGMPSN: IGMP general queries received on Vlan 1000 updates all groups *Nov 22 14:20:01.413: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:20:01.413: IGMPSN: timer: start report_timer 10000 msecs of vlan 1000 *Nov 22 14:20:01.413: IGMPSN: router: Received IGMP pak on Vlan 1000, port Et0/0 *Nov 22 14:20:01.413: IGMPSN: router: Is a router port on Vlan 1000, port Et0/0 sw# *Nov 22 14:20:01.413: IGMPSN: router: Learning port: Et0/0 as rport on Vlan 1000 sw# *Nov 22 14:20:03.155: IGMPSN: Received IGMPv2 Report for group 224.0.0.251 received on Vlan 1000, port Et0/1 *Nov 22 14:20:03.155: IGMPSN: 224.0.0.251 is a Reserved MCAST address *Nov 22 14:20:03.155: IGMPSN: group: Received IGMPv2 report for group 224.0.0.251 received on Vlan 1000, port Et0/1 with invalid group address sw# *Nov 22 14:20:05.791: IGMPSN: router: Received non igmp pak on Vlan 1000, port Et0/0 *Nov 22 14:20:05.791: IGMPSN: router: PIMV2 Hello packet received in 1000 *Nov 22 14:20:05.791: IGMPSN: router: Is a router port on Vlan 1000, port Et0/0 *Nov 22 14:20:05.791: IGMPSN: router: Learning port: Et0/0 as rport on Vlan 1000 sw# *Nov 22 14:20:07.507: IGMPSN: Received IGMPv2 Report for group 239.0.1.1 received on Vlan 1000, port Et0/1 *Nov 22 14:20:07.507: IGMPSN: group: Received IGMPv2 report for group 239.0.1.1 received on Vlan 1000, port Et0/1 *Nov 22 14:20:07.507: IGMPSN: group: Skip client info adding - ip 10.0.0.2, port_id Et0/1, on vlan 1000 *Nov 22 14:20:07.507: IGMPSN: MCAST IP address 239.0.1.1, MAC address 0100.5e00.0101 *Nov 22 14:20:07.507: IGMPSN: Locate gce 0100.5e00.0101, on Vlan 1000 *Nov 22 14:20:07.507: IGMPSN: locate group 239.0.1.1, on Vlan 1000 *Nov 22 14:20:07.507: IGMPSN: Add v2 group 239.0.1.1 member port Et0/1, on Vlan 1000 sw# *Nov 22 14:20:07.507: IGMPSN: group: Added port Et0/1 to group 239.0.1.1 *Nov 22 14:20:07.507: l2mcsn_process_report: TIMER_START for group 188.82.91.232 for time 10000 * 100 *Nov 22 14:20:07.507: IGMPSN: group: Forwarding 239.0.1.1 report to router ports sw#und *Nov 22 14:20:11.419: IGMPSN: timer: Vlan 1000 report timer expired *Nov 22 14:20:11.419: IGMPSN: sync group for Vlan 1000 robustness variable 2 *Nov 22 14:20:11.419: IGMPSN: sync group for Vlan 1000 GCE 0100.5e00.0101 *Nov 22 14:20:11.419: IGMPSN: sync group for group (239.0.1.1) blist (0) *Nov 22 14:20:11.419: IGMPSN: group (239.0.1.1): has v2 Hosts *Nov 22 14:20:11.419: IGMPSN: group (239.0.1.1): [0]GQ-miss-list members are: *Nov 22 14:20:11.419: IGMPSN: group (239.0.1.1): [1]GQ-miss-list members are: *Nov 22 14:20:11.419: IGMPSN: group (239.0.1.1): [2]GQ-miss-list members are:
I can not understand what mean these msgs: IGMPSN: group: Skip client info adding - ip 10.0.0.2, port_id Et0/1, on vlan 1000 l2mcm_group_create: timer stop: vlan 1000, group 239.0.1.1
l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1
I waited a bit more time and filtered l2mcsn messages:
*Nov 22 14:19:42.855: l2mcm_group_create: creating a group 239.0.1.1 on vlan 1000, dummy NO *Nov 22 14:19:42.855: l2mcm_group_create: timer stop: vlan 1000, group 239.0.1.1 *Nov 22 14:19:45.491: l2mcsn_process_report: TIMER_RUNNING for group 239.0.1.1 *Nov 22 14:19:48.307: l2mcsn_process_report: TIMER_RUNNING for group 239.0.1.1 *Nov 22 14:20:01.413: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:21:01.419: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:22:01.425: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:23:01.428: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:24:01.433: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:25:01.439: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:26:01.443: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:27:01.443: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1 *Nov 22 14:15:01.395: l2mcsn_gquery_gce_walk: TIMER_STOP for group 239.0.1.1
Did I configure something wrong or IOS behaves wrong?
... View more
Labels:
11-08-2017
01:04 AM
Hi, @Rajeshkumar Gatti!
Is there some news about " Hardware-capable local flow redirect " feature? Is it now implemented and if so, in which software version?
... View more
Created by
dukenuk96
in Networking Documents
in Networking Documents
08-28-2017
03:15 AM
08-28-2017
03:15 AM
We opened a case in TAC and th response is as follows: We had a discussion with our engineering regarding this behaviour of EEM. Using EEM on the Nexus, we can only execute commands that are not “session dependent / interactive ssh”. The “show cli history” that we want to run using the EEM will always return an empty string because the event manager initiates a new vsh session and the output of this command for a new session is always null. The only feasible option we have right now is to configure a scheduler at the beginning of the day and capture the “show accounting log” for the previous day, then push it to the syslog using the EEM. There are multiple filters we can have to achieve a clean result – “show accounting log” – All the configuration changes done by any user. “show accounting log all” – All the CLI executed by any user including show commands “show accounting log all | in update” – Clears all clutter and shows up only relevant things This output can be filtered by the day and sent to syslog. And this seems to be the only feasible option at this point on the Nexus platform. Let me know how you would like to proceed further. So, currently there is no way to make NX-OS replicate entered commands to syslog in real-time, only on sheduled basis. And I think this is still a bug, since ".. the event manager initiates a new vsh session and the output of this command for a new session is always null "and actually after applying configs of EEM from previous messages we got 100% CPU load on our Nexus box and hundreds of VSH pocesses that lived forever until we killed them using debug plugin via Linux shell.
... View more
08-03-2017
10:54 PM
Now command is accepted, but not syslogged, even more, without variable also does not work:
event manager applet EMA-CLI-cmds event cli match "*" action 1.0 event-default action 2.0 syslog msg AKHTUNG
Produces only this in log:
2017 Aug 4 08:51:22 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29366 2017 Aug 4 08:51:23 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29398 2017 Aug 4 08:51:23 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29377 2017 Aug 4 08:51:24 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29396 2017 Aug 4 08:51:24 SD2-5-7-20-L3SW-160 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by admin on vsh.29379
Seems like cosmetic bug :(
... View more
08-03-2017
06:43 AM
Our version is 7.0(5)N1(1), but _cli_result variable does not work:
SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $_cli_result ^ % Invalid command at '^' marker.
Also I tried to view which variables are supported:
show event manager event-types
Name : cli Description : EEM CLI command filter Event Parameters : command Publisher : CLI events publisher Default Action :
Well, $command should work, but it does not:
SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $command ^ % Invalid command at '^' marker.
I've found on some examples that variable format should be $(VARIABLE), but the only thing that works, and works strange is a timestamp:
SD2-5-7-20-L3SW-160(config-applet)# action 1.0 syslog msg $(TIMESTAMP) SD2-5-7-20-L3SW-160(config-applet)# sh run eem
event manager applet EMA-CLI-cmds action 1.0 syslog msg 2017-08-03-16.36.20
So it translates to real value immediately after entering action command.
... View more
08-02-2017
10:42 PM
Is there same document for NX-OS EEM? There are variables too, but use another syntax.
... View more
07-24-2017
03:34 AM
Hi all!
I have following simple network:
So my router connects to several ISPs using BGP. L2 transit switch is being used to aggregate all ISP's links. The question is - do I need to configure QoS on this transit switch to define separate queues for routing protocol traffic (BGP for example) so that user traffic would not affect neighbor relationships and routing updates? I have read many materials about QoS and there is written "Network control protocols such as STP, BGP, OSPF and so on traffic directed to CPU is handled by QoS engine on switches and routers automatically and this behavior can not be modified". Ok, I see, but what about this case - when routing protocol traffic is not directed to switch's CPU and actually a transit traffic?
... View more
Labels:
Created by
dukenuk96
in Data Center Switches
05-27-2019 01:48 AM
05-27-2019 01:48 AM
I am looking at Nexus 9300 White paper an wonder why traffic buffers are
small - at best 40MB and sh...
Created by
dukenuk96
in Data Center Switches
05-22-2019 02:31 AM
05-22-2019 02:31 AM
Let's assume that I have fully working VXLAN fabric based on n9k
switches and legacy network based o...
Created by
dukenuk96
in Data Center Switches
05-20-2019 02:03 AM
05-20-2019 02:03 AM
Let's assume that I want to build VXLAN fabric from scratch based on
Nexus 9000 switches in standalo...
12-28-2018 04:32 AM
I have a question regarding ASR 1000-HX series GRE performance - what is
maximum bandwidth on let's ...
12-20-2018 04:11 AM
We are going to order FPR4120 and selected in CCW: FIREPOWER HARDWARE
FPR4120-ASA-K9 Cisco Firepower...
Created by
dukenuk96
in Other Data Center Subjects
07-06-2018 07:19 AM
07-06-2018 07:19 AM
Hi all! I am testing N9k in virtual environment: NX-OSv9K is a demo
version of the Nexus Operating S...
Created by
dukenuk96
in Other Network Architecture Subjects
01-30-2018 10:01 PM
01-30-2018 10:01 PM
Hi all! We have router Cisco ASR 1001-x. Now we need additional 10Gbit/s
interface (at least one) on...
11-22-2017 09:28 PM
Okay, here it is: sw#sh runBuilding configuration... Current
configuration : 1167 bytes!! Last confi...
11-22-2017 06:23 AM
Hi all! I have a simple lab: Configs are: R6: ip multicast-routing
interface Loopback0 ip address 1....
11-08-2017 01:04 AM
Hi, @Rajeshkumar Gatti! Is there some news about "Hardware-capable local
flow redirect" feature? Is ...
Created by
dukenuk96
in Networking Documents
08-28-2017 03:15 AM
08-28-2017 03:15 AM
We opened a case in TAC and th response is as follows:We had a
discussion with our engineering regar...
08-03-2017 10:54 PM
Now command is accepted, but not syslogged, even more, without variable
also does not work: event ma...
Public Statistics
| Date Registered | 09-11-2014 01:22 AM |
| Date Last Visited | 06-19-2019 12:35 AM |
| Total Messages Posted | 162 |
| Total Helpful Votes Received | 43 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 10 | |
| 5 | |
| 4 |
.jpg "VIP Advocate"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 7 | |
| 5 | |
| 2 | |
| 5 |
