About Johannes Luther

Johannes Luther · ‎01-07-2019

I created a TAC case and got the answer now: 1.) Reboot ACI switch 2.) During reboot - at the very beginning ("...initializing fan controller") hit CTRL-C to enter the loader 3.) In the loader set the IP and DG for the mgmt interface set ip <IPv4-ADDR> <NETMASK> set gw <IPv4-ADDR-GW> Note: It's not possible to ping the IP address. Even ARP resolution does not work for the IP. Communication is only possible if initialed by the ACI switch 4.) Boot from a remote location via TFTP. boot tftp://<IPv4-TFTP-SERVER>/[<PATH>/]<IMAGE-FILE>.bin After reboot the image is hopefull in the /bootflash folder Note: Only TFTP is possible. So bring along some games or stuff to pass the time to download the large images over a long fat link :)

Johannes Luther · ‎12-17-2018

@Yannick Vranckx wrote: Usually there is an NX-OS image and Cisco ACI image on the device, they should be both on that. Because you've paid for a switch in NX-OS mode, and you pay for the extra ACI License with image. Nope... I (and I guess most of the other ACI users) order the switch with preinstalled ACI SW. During ordering (check CCW) you either chose an NX-OS or ACI software image option for $0 (USD). Normally if you deploy ACI you want a preinstalled ACI image, because there won't be a "plug and play" experience if the switch is delivered with a NX-OS image. As a matter of fact, sometimes an ordered HW is ordered incorrectly (wrong ACI image selected) or the hardware is in stock for a long time (e.g. cold standby) with a pretty old image. @Yannick Vranckx wrote: Have you checked the flash? To see wether the image is there on the flash? I did. However I'm not quite sure which directory. I checked the /recovery and the /bootflash directory - both only contain an ACI image.

Johannes Luther · ‎12-16-2018

Hi, interesting point. One question regarding the conversion: There is the statement in the bootloader to load a specific NX-OS image ("nxos-image-name"). loader> boot nxos-image-name I guess in an ACI image delivered switch, there is no NX-OS image on the disk. At least if I check the bootflash directory of my N9k, there is no NX-OS image. So the original question remains: How to I copy an image (ACI or NX-OS) remotely (not USB) to an fabric uninitialized N9k switch?

Johannes Luther · ‎12-13-2018

Hi board, Let's assume a multi-pod environment and you cannot register your new spine switch in a remote pod to the network due to a SW bug or the SW does not support multi pod in the current version on the remote spine switch. And no - there's no APIC in the remote location :) Challenge is to manually upgrade the remote spine switch over the management network (out-of-band / management0 interface). I found the technote, which describes the process in very detail. However, one aspect is missing: How to configure an IP address on the unititialized spine switch over the CLI (console) to copy the image to the spine filesystem? Anybody has an idea? I tried Linux "ifconfig" on the eth0 interface (which is the mgmt0 port on the chassis). The command was accepted and the CLI output for ifconfig looked good. However a test ping resulted in strange error messages (hardware error etc.) - guess this is not the correct way :)

Johannes Luther · ‎12-11-2018

Hello Jayesh, thank you for your reply. All I can do is in the vSwitch configuration within the APIC is setting the port channel, CDP, LLDP and NetFlow policy. But all these settings affect the one uplink on the VDS. I want to have multiple different uplinks on the VDS See this picture from VMWare for example: In this example, ESXi host1 has three uplinks in total (vmnic0 - vmnic3). The VDS has two distributed port groups (VM network and VMkernel network.) The distributed port group "VM network" is using the uplinks vmnic0 and vmnic1. The distributed port group "VMkernel network" is using the uplink vmnic2. When I create a VDS via VMM, all the associated EPGs (distributed port groups) are using the same uplink ports (one big pipe). I can not assign EPG1 to uplink1 and EPG2 to uplink2. Question: Are multiple uplink port groups supported with ACI 3.2?

Johannes Luther · ‎12-11-2018

Hi board, anybody knows if ACI supports VMware VDS uplink port groups? Currently when I creade a VMware Distributed vSwitch using VMM, the VDS has only one logical uplink port with up to eight physical ports. Each of my ESXi servers consists of multiple dedicated port channels for different purposes (e.g. one LAG for the VM traffic, one LAG for storage and one LAG for VM console and vMotion).

Johannes Luther · ‎12-11-2018

Hi Chris, thank you for the very detailed answer. And yes, your blog was very useful when I got started. I still don't agree with some parts (like creating an interface selector for each port etc.), but I think I'll have to learn it the hard way going in a wrong direction first and finally follow your advise in a couple of month when I screwed everything up :D Back to the original question: If I got you right, you don't do an EPG to encapsulation VLAN ID mapping within the AAEP. The only purpose of the AEP is to link the domain (VLAN pool) with the leaf interface policy groups. The mapping of the EPG to the local encapsulation VLAN is done via static port mapping per port. My understanding was/is, that I have a global EPG to encap-VLAN "database" (the AEP) and don't have to handle the EPG to encap-VLAN mappings per port. Basic idea: Just assign an ESXi port to a template (leaf interface policy group) and all the EPGs and correct VLAN mappings are there. This reduces operational human faults like a missing EPG towards one ESXi host. I'm aware of the fact, that my problem is subject to VMM and DVS ... but just for fun - let's assume we have a big environment with standard vSwitches :)

Johannes Luther · ‎12-11-2018

Hi board, I'm pretty new to ACI and I'm struggling with a very basic problem: How to properly configure an leaf access port? From my point of view there are too many ways to do it and I'm interested what's the right way to go. Let's assume the following: - 2 Application EPGs: EPG-A (enc-VLAN 11) and EPG-B (enc-VLAN 12) - Access port types: -- Bare metal servers: Untagged traffic -- Non-VMM (vSwitch) hypervisors with tagged traffic When I'm following some very good documents like the link below, the strategy for the vSwitch integration is: https://rednectar.net/2015/12/28/cisco-aci-tutorial-4-all-about-access-policies-the-new-interface-range-command/ vSwitch (vPC): Create a generic AEP with a physical VLAN pool and the following mapping: EPG-A: encap-vlan11 (trunk) EPG-B: encap-vlan12 (trunk) Create a leaf access policy group, attach the AEP to it and define settings like port-channel, storm-control etc. Assign the leaf access policy group to an interface profile (which is assigned to a switch profile) ==> Done If I want to have an untagged EPG-A port to a baremetal server, I cannot follow the same rules, because the generic AEP from above consists of multiple EPGs (EPG-A und EPG-B) and the mode is trunk. Question: What is the correct way to configure an untagged access port? Option 1: - Do not create an AEP - Create a leaf access policy group for baremetal servers (without AEP)and define settings like port-channel, storm-control etc. - Assign the leaf access policy group to an interface profile (which is assigned to a switch profile) - Static port assignment under the EPG configuration (mode access) Option 2: - Create a dedicated AEP for EPG-A access ports (mode access) - Create a dedicated AEP for EPG-B access ports (mode access) - Follow the same guidelines as for the trunk server ports configuration

Johannes Luther · ‎11-16-2018

:) So the original question remains: If the setting is set to consecutive how are the vPCs built? Assuming I have five leaf nodes with the IDs 1001, 1002, 1004, 2001, 2002 Option 1: DIRECTLY consecutive (direct successors) vPC domain 1: 1001, 1002 vPC domain 2: 2001, 2002 no vPC domain for 1004 Option 2: not DIRECTLY consecutive vPC domain 1: 1001, 1002 vPC domain 2: 1004, 2001 no vPC domain for 2002

Johannes Luther · ‎11-16-2018

Hi Michael, thank you for the feedback. So until now I did everything correct - I didn't set up a peer link :) However from my understanding you have to tell the fabric which two leaf switches form a vpc peer. In your screenshot you manually (explicetely) set up the nodes 101 and 103 as a vpc group (group 101) and the nodes 204 and 206 as another group (group 204). In ACI there is the option to automatically group two leaf nodes depending on the node id (mode consecutive instead of explicit). My question was referring to the consecutive mode. For example: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2-x/L2_config/b_Cisco_APIC_Layer_2_Configuration_Guide/b_Cisco_APIC_Layer_2_Configuration_Guide_chapter_0100.html => Search for "explicit" and/or "consecutive"

Johannes Luther · ‎11-16-2018

Hi board, i'm pretty new to ACI and have a question regarding the building of vPCs between two leaf nodes. There is either the way to "bundle" two leaf nodes statically or dynamically to a vPC domain. I think the dynamic mode is cool, but I don't get quite the point. Config is: vpc domain consecutive Assuming I have five leaf nodes with the IDs 1001, 1002, 1004, 2001, 2002 How are the vPCs built? Option 1: DIRECTLY consecutive vPC domain 1: 1001, 1002 vPC domain 2: 2001, 2002 no vPC domain for 1004 Option 2: not DIRECTLY consecutive vPC domain 1: 1001, 1002 vPC domain 2: 1004, 2001 no vPC domain for 2002 Anybody got an idea?

Johannes Luther · ‎11-05-2018

Hello Hslai, thank you for the very detailed answer! I didn't know, that the newer Cisco APs supplicant support EAP-TLS (well, the 8.7 release is kinda new) :) So for now I'll disable those CA certificates. Thanks again!

Johannes Luther · ‎10-31-2018

Hey hslai, thanks for the feedback! @hslai wrote: Root: Cisco Root CA M2 / Intermediate: Cisco Manufacturing CA SHA2 This is there for your convenience to use cert-based auth for Cisco devices, such as Cisco APs and Cisco IP phones. You may disable or delete them if you have no Cisco devices performing EAP-TLS against ISE. Ok - got that. Except the point with the APs ... the lightweight APs are only capable of performing EAP-FAST using credentials if acting as an 802.1X supplicant. For the phones - I don't know. Root: DigiCert root CA / Intermediate: DigiCert SHA2 High Assurance Server CA Earlier on, this was the root CA certificate for www.cisco.com in some region and needed for ISE feed services. I might be wrong, but then the "trusted for" settings are incorrect. For feed service the "trusted for" purpose must be set to "Cisco services" - correct? Furthermore the field notice is referring to another CA....

Johannes Luther · ‎10-31-2018

Hi Freerk, true - always the same faces around here :) Just found out that the speakers do support mDNS since July this year. I haven't tested this though, so I have no idea if it can work with the mDNS gateway in the WLC and how other communication flows are affected by this new feature. Yeah ... I guess they included AirPlay in some models. But I think that does not affect the connection between the Sonos App and the actual speakers. So you could stream your music via Airplay using mDNS discovery from am i-Device to the speakers. I think they did not change the SSDP (link local multicast) behavior for the connection between the app and the speakers. At home I have a 2504 WLC and local mode APs. The Sonos speakers form their own mesh network. Some Speakers are connected to my wired network. The Sonos app runs on mobile devices in another subnet. (So my wireless is separated from my wired network). I have a Linux router in between, which does some TTL magic and static multicast routing between the subnets. To in my case it's working flawlessly.

Johannes Luther · ‎10-31-2018

Hi again Arne (obviously the ISE world is kinda' small) :) >> Might be worth deleting these certs - they serve no purpose. I'm assuming this as well, but I'm quite unsure... Before I delete them in a big production environment, I want to understand the purpose (or the itention :) ) Perhaps anyone from Cisco stumbles upon this... Otherwise I guess I'll have to open a TAC case.

Date Registered	‎07-16-2008 11:57 PM
Date Last Visited	‎01-09-2019 12:05 AM
Total Messages Posted	256
Total Helpful Votes Received	142

Re: Manual Nexus 9k software update ove...

Re: Manual Nexus 9k software update ove...

Re: Manual Nexus 9k software update ove...

Manual Nexus 9k software update over th...

Re: ACI 3.2(4) and VMware VDS uplink po...

ACI 3.2(4) and VMware VDS uplink port g...

Re: Leaf access port configuration stra...

Leaf access port configuration strategy

Re: ACI vpc domain consecutive

Re: ACI vpc domain consecutive

ACI vpc domain consecutive

Re: ISE default trusted CA certificates

Re: ISE default trusted CA certificates

Re: Sonos with vWLC 8.6

Re: ISE default trusted CA certificates