Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About katerina.dardoufa
07-10-2019
Stats
Member since
10-18-2009
404
Posts
98
Helpful
1
Solution
Created by
katerina.dardou
in Other Data Center Subjects
in Other Data Center Subjects
06-11-2019
02:49 AM
06-11-2019
02:49 AM
I also found the following post (https://community.cisco.com/t5/server-networking/nexus-5600-hsrp-design-question-for-stretched-vlans-between-2/td-p/2964094) that states: "Due to the HW architecture on the Nexus 5600, control plane multicast packets are punted to the CPU ignoring any PACL or MAC-ACL. So with a PACL, you will not be able to filter HSRP Hellos, ARP, BPDUs, etc. which need to go to the CPU, because there is a pre-defined ACL to redirect control traffic to CPU and this ACL that takes precedence over the user-configured ACL.
... View more
Created by
katerina.dardou
in Other Data Center Subjects
06-11-2019
01:06 AM
06-11-2019
01:06 AM
Hello all! I know this is an old post, but I was wondering if the configuration performed on N7K to isolate HSRP in two DC via DCI (Port ACL and VLAN ACL) can now be performed on N5K running 7.3(3)N1(1). Thank you in advance, Katerina
... View more
05-27-2019
11:45 PM
The affected switches run IOS c2950-i6q4l2-mz.121-22.EA1.bin, as do most of the 2950 still in our environment. They are VTP clients with maximum supported vlans 250. The number of existing vlans is 54. I logged in to the switch in site A with console while it had lost connectivity and I noticed that it had no root port!!!! Ports were up. For the switch in site B the logs are totally different! Site B: strata_remove_vtable_entry : vlan entry not found strata_remove_vtable_entry : vlan entry not found strata_remove_vtable_entry : vlan entry not found strata_remove_vtable_entry : vlan entry not found May 23 15:34:17.854: %SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port GigabitEthernet0/1 on VLAN0051. May 23 15:34:59.074: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down May 23 15:35:00.082: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down May 23 15:38:33.170: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up May 23 15:38:35.206: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up May 23 15:38:38.006: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down May 23 15:38:39.014: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down May 23 15:39:34.118: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up May 23 15:39:36.154: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up May 23 15:40:07.606: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down May 23 15:40:08.618: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down May 23 15:40:11.274: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up May 23 15:40:13.306: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up May 23 15:42:33.338: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down May 23 15:42:34.350: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down May 23 15:44:17.422: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up May 23 15:44:19.454: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up As can be seen from the logs a loop is created for vlan 51, but that brings the whole Gi0/1 (connection to 6509) down! The connection is up after 5 minutes, which could be the VTP update as you stated, but even then the connectivity is not restored. From the 6509 we flapped the link at 15:42 and connectivity was restored briefly after that. The behavior is indeed weird. What surprised us it we had the same impact in two different sites with 2950 connected on ports Gi1/1 on different 6509, even though the logs and the output of show commands on the two switches is totally different. I blame old hardware!!!! I don't think there is much more to use for investigation. I was just wondering if anyone had seen such behavior before, and what the meaning of the log message was (I could not much it to any thing I knew). Thanks!
... View more
Created by
katerina.dardou
in Network Management
05-27-2019
03:31 AM
05-27-2019
03:31 AM
Hi! Thank you for the info. It works perfectly Thanks!
... View more
05-27-2019
02:51 AM
Hi Giuseppe, the switches are configured as VTP clients and already have allowed vlans on their trunk links. We faced the issue on two different 2950 switches. These switches were connected via redundant links to Gi1/1 of 6509. The first switch is located in site A and connects to 6509-A1 and 6509-A2. The second switch is located in site B and connects to 6509-B1 and 6509-B2. Vlan deletion on site A caused the behavior already described on the previous post for switch-A and vlan deletion on site B caused the behavior for switch-B. No other 2950 switches were affected in either case. The switches started functioning as normal after some period of time (more than STP timers!!! About 15 minutes or so). So my understanding is that there is something going on with Gi1/1 connecting to old switches (???). My main concern is the meaning of the message: strata_remove_vtable_entry : vlan entry not found Thank you in advance, Katerina
... View more
05-27-2019
01:07 AM
Hello community, we have some pretty old WS-C2950G-48-EI switches in our environment which are vtp clients in the Domain. These connect with two redundant links to two 6509, which are the VTP servers in the environment. The two uplinks are either designated/root ports, since rapid-pvst is used. After performing some changes in the vlans on the VTP servers, these 2950 switches, stopped forwarding packets and lost all connectivity. Via the console we noticed that the uplinks were both designtated ports! No root port was present on the switch. In the switch log we also noticed this message, for which I cannot find an explanation: "strata_remove_vtable_entry : vlan entry not found" In both cases where we faced the issue, the switches were connected to port Gi1/1 of 6509 WS-X6724-SFP line cards. Has anyone seen this behavior before? What does the message in the syslog mean? Thank you in advance, Katerina
... View more
Labels:
Created by
katerina.dardou
in Network Management
04-24-2019
03:53 AM
04-24-2019
03:53 AM
Hello community, We have installed Cisco Prime 3.5 on our premises, with critical fix 2.0.0. On two 3945 routers we created some tunnel interfaces which we wanted to monitor. We navigate to Inventory -> Group Management -> Port Groups, to find these tunnel interfaces, and place them in a group in order to monitor them, but the tunnels are not there! The other weird thing is that when "synchronizing" these devices I always get a "Collection Failure" message, for no apparent reason. This used to work!!! Any help would be highly appreciated. Katerina
... View more
Labels:
Created by
katerina.dardou
in Other Data Center Subjects
04-04-2019
12:24 AM
04-04-2019
12:24 AM
Hello Guardi, we have not yet implemented the solution, because we wanted to first try it in a lab, but we have not yet found a chance. My understanding is that mac sec should be implemented on the physical interfaces and not on the port-channel. An idea would be to remove the physical interfaces from the port-channel, apply the configuration on one link (both sides, with the interface shut). Open then interface, check it works, apply the configuration on the second link and then add them to the port-channel. Good luck with what you are doing! It would be great if you update the discussion whenever you get this working. thanks!
... View more
Created by
katerina.dardou
in Routing
01-11-2019
01:51 AM
01-11-2019
01:51 AM
Hi,
This knowledge was tucked away somewhere in the back of my brain! Thanks for helping bring it forth!
... View more
Created by
katerina.dardou
in Routing
01-10-2019
05:19 AM
01-10-2019
05:19 AM
Hello community,
I have a question that has been puzzling me for a while and I was hoping to find some answers.
In our environment we are running OSPF. On the network devices pointing towards the internet we have "default-information originate", so that all routers know how to reach the internet.
Running the command "sh ip ospf database external 0.0.0.0" on one of our backbone routers we get:
"sh ip ospf database external 0.0.0.0 OSPF Router with ID (x.x.x.x) (Process ID 1) Type-5 AS External Link States Routing Bit Set on this LSA LS age: 653 Options: (No TOS-capability, No DC) LS Type: AS External Link Link State ID: 0.0.0.0 (External Network Number ) Advertising Router: 1.1.1.1 LS Seq Number: 80000A01 Checksum: 0x3AB2 Length: 36 Network Mask: /0 Metric Type: 1 (Comparable directly to link state metric) TOS: 0 Metric: 1 Forward Address: 0.0.0.0 External Route Tag: 0 Routing Bit Set on this LSA LS age: 631 Options: (No TOS-capability, No DC) LS Type: AS External Link Link State ID: 0.0.0.0 (External Network Number ) Advertising Router: 1.1.1.2 LS Seq Number: 80000A01 Checksum: 0x34B7 Length: 36 Network Mask: /0 Metric Type: 1 (Comparable directly to link state metric) TOS: 0 Metric: 1 Forward Address: 0.0.0.0 External Route Tag: 0 LS age: 888 Options: (No TOS-capability, No DC) LS Type: AS External Link Link State ID: 0.0.0.0 (External Network Number ) Advertising Router: 2.2.2.1 LS Seq Number: 8000AFDC Checksum: 0x7462 Length: 36 Network Mask: /0 Metric Type: 2 (Larger than any link state path) TOS: 0 Metric: 1 Forward Address: 0.0.0.0 External Route Tag: 0 LS age: 927 Options: (No TOS-capability, No DC) LS Type: AS External Link Link State ID: 0.0.0.0 (External Network Number ) Advertising Router: 2.2.2.3 LS Seq Number: 80000EE2 Checksum: 0x472A Length: 36 Network Mask: /0 Metric Type: 2 (Larger than any link state path) TOS: 0 Metric: 1 Forward Address: 0.0.0.0 External Route Tag: 0 LS age: 814 Options: (No TOS-capability, DC) LS Type: AS External Link Link State ID: 0.0.0.0 (External Network Number ) Advertising Router: 3.3.3.1 LS Seq Number: 80000234 Checksum: 0xBBA5 Length: 36 Network Mask: /0 Metric Type: 2 (Larger than any link state path) TOS: 0 Metric: 1 Forward Address: 0.0.0.0 External Route Tag: 3489667727
As you can see routers 1.1.1.1 and 1.1.1.2 advertise 0.0.0.0 as E1 type links. Routers 2.2.2.1, 2.2.2.2 and 3.3.3.1 advertise 0.0.0.0 as E2 type links. In normal operation 0.0.0.0 shows up in the routing table either via 1.1.1.1 or 1.1.1.2. My question involves the failure of 1.1.1.1 and 1.1.1.2. In practice we have seen that if both 1.1.1.1 and 1.1.1.2 fail, then 0.0.0.0 is advertised via 2.2.2.1 or 2.2.2.2 (which is what we want!). But why are these routes preferred in contrast to 3.3.3.1, since all have the same metric-type E2 ????
We do not with 0.0.0.0 to be learnt via 3.3.3.1, so just to be on the safe side, I will change the metric-type of 2.2.2.1 and 2.2.2.2 to E1 with a metric of 20, so that the network prefers 1.1.1.x first and in case of a double failure, 2.2.2.x will advertise the default route.
I would be grateful if someone could shed some light!
... View more
Labels:
Created by
katerina.dardou
in Switching
12-13-2018
03:24 AM
12-13-2018
03:24 AM
No change...
The interesting thing is that the problem occurs only when the console is connected to the second member of the stack. The master functions as expected. That is why I am starting to believe that there is something wrong with the way the stack is implemented by Cisco...
... View more
Created by
katerina.dardou
in Switching
12-12-2018
12:20 AM
12-12-2018
12:20 AM
Hi!
I checked the behavior again. When I connect to the console of the second switch and use local database credentials to login, the message I get is "Authorization Failed". When I try to authenticate using the ISE credentials (AAA authentication), I get the message "Authentication Failed".
Thanks!
... View more
Created by
katerina.dardou
in Switching
12-11-2018
06:55 AM
12-11-2018
06:55 AM
As i recall the message stated “authorization failed”. I will test with the lab and update the post. What exactly is the config you recommend? The problem is only with the console port of the second member. Authentication and authorization of the master function properly, without changes to the initial config.
... View more
Created by
katerina.dardou
in Switching
12-11-2018
05:42 AM
12-11-2018
05:42 AM
Hello Marce,
I found the command on another post, but it does not seem to be supported.
I am running IOS Version 12.2(55r)SE.
Thanks!
... View more
Created by
katerina.dardou
in Switching
12-11-2018
02:00 AM
12-11-2018
02:00 AM
Hello all,
we have a number of 2960S switches, connected in pairs, forming different stacks. We have enabled AAA. When using the console, we want to login using the local database. What we noticed is that when we connect through the console of the master switch we are able to login to the switch. When we try to connect through the console of the standby switch, authorization fails.
Bellow is the configuration
aaa authentication login AUTHISE group TACACS-ISE local aaa authentication login CON local aaa authorization console aaa authorization config-commands aaa authorization exec AUTHISE group TACACS-ISE if-authenticated aaa authorization exec CON none aaa authorization commands 1 AUTHISE group TACACS-ISE local if-authenticated aaa authorization commands 5 AUTHISE group TACACS-ISE local if-authenticated aaa authorization commands 15 AUTHISE group TACACS-ISE local if-authenticated aaa accounting exec AUTHISE start-stop group TACACS-ISE aaa accounting commands 5 AUTHISE start-stop group TACACS-ISE aaa accounting commands 15 AUTHISE start-stop group TACACS-ISE
line con 0 authorization exec CON logging synchronous login authentication CON
The workaround we have found is using the AAA server as the first option and if that fails, to revert to the local database.
aaa authentication login CON group TACACS-ISE local
In this case we connect to the standby console port, via authentication through the ISE server. If the ISE server is unavailable, we authenticate via the local database.
So, what is the issue that prevents us from connecting through the standby console when only using the local database?
Could anyone please help solve this issue?
Thanks in advance,
Katerina
... View more
Labels:
06-11-2019
I also found the following post
(https://community.cisco.com/t5/server-networking/nexus-5600-hsrp-de...
06-11-2019
Hello all!I know this is an old post, but I was wondering if the
configuration performed on N7K to i...
05-27-2019
The affected switches run IOS c2950-i6q4l2-mz.121-22.EA1.bin, as do most
of the 2950 still in our en...
Created by
katerina.dardoufa
in Network Management
05-27-2019
05-27-2019
Hi! Thank you for the info. It works perfectly Thanks!
05-27-2019
Hi Giuseppe, the switches are configured as VTP clients and already have
allowed vlans on their trun...
05-27-2019
Hello community, we have some pretty old WS-C2950G-48-EI switches in our
environment which are vtp c...
Created by
katerina.dardoufa
in Data Center Switches
05-07-2019
05-07-2019
Apparently the issue is with the client we use to login (secure crt).
When we use putty, everything ...
04-24-2019
Hello community, We have installed Cisco Prime 3.5 on our premises, with
critical fix 2.0.0. On two ...
04-24-2019
Hello community, we have recently deployed 4 x 7710 with 5 VDCs each. We
have enabled AAA on VDCs, s...
Created by
katerina.dardoufa
in Identity Services Engine (ISE)
04-19-2019
04-19-2019
Hello Tim, I was able to find what is causing the issue. The problem is
with Nexus 7K with 7 VDCs. I...
Created by
katerina.dardoufa
in Identity Services Engine (ISE)
04-11-2019
04-11-2019
Hello all, we are running ISE 2.3 with patch 6. I tried to add some new
devices to authenticate via ...
Created by
katerina.dardoufa
in Other Data Center Subjects
04-04-2019
04-04-2019
Hello Guardi, we have not yet implemented the solution, because we
wanted to first try it in a lab, ...
Created by
katerina.dardoufa
in Data Center Switches
01-18-2019
01-18-2019
Hello to all, we have a topology with two legacy 6509 connecting to
Nexus5672UP as shown in the atta...
01-11-2019
Hi, This knowledge was tucked away somewhere in the back of my brain!
Thanks for helping bring it fo...
Public Statistics
| Date Registered | 10-18-2009 05:55 AM |
| Date Last Visited | 07-10-2019 04:29 AM |
| Total Messages Posted | 404 |
| Total Helpful Votes Received | 98 |
Helpful Votes Given To
Helpful Votes From
