Real Scenario (NXOS not ACI) :- New: 4 x 9504's to act as a L3 SVI core, with 93180's acting as L2 access. All L2 VLAN's on all links. Each 93180 has uplinks to two 9504's. (9504's meshed) Server estate running MS NLB in multicast mode, currently VLAN SVI's on 6509 core and access L2 3750's. Same all L2 everywhere. Multicast 03:bf mac's for NLB configured in the global 6500 config  (Also Old kit to new kit is L2 bridged) Luckily we caught before the migration to new that NXOS 9504's dont support multicast NLB, but does unicast. 2 questions about potential mitigations. Yes the server estate could move to unicast NLB. But this estate could end up spread across multiple 9300s/links in relation to the 9500's. Would what i read that  "Unicast NLB is only supported on the N9K when all NLB cluster members must be reachable via the same port-channel/physical interface"  mean that even unicast NLB is still unworkable  ?? Also Would/if only for the specific (half dozen) NLB VLAN's, we were to make the 95's and 93's L2 only, and put a couple of ASR's .1q'd into the 95's and put the L3 interfaces of these half dozen VLAN's on the ASR's with the NLB mac's config'd on those int's, be an workable option to support unicast NLB (but still not multicast ..) ?? thnks Martyn ... View more

I have 4 x 9504s on order, and am considering options for racking them. I see varying measurements for the depth of a 9504 chassis from the hardware install & datasheet and other docs, but none say if the depths quoted include, or dont include, any cable management. Would be nice to get a 9504 into a 800 x 800 rack (with doors closed...) if possible, can anyone advise me of any info stating how deep a 9504 is without cable management ?? thnks Martyn ... View more

I'm interested to hear from people with experience of engineering high numbers of PBR configs on 4500x (or perhaps any..?) cat switches. I'm being queried from other (non-network...) technical departments to the possibility of manually PBR'ing 1300 different source subnets with a " set ip default next-hop X.X.X.X"  on a VSS'd 4500x pair we have.   Unscalable/unmanageble as far as i am concerned, but i am interested, has anyone deployed high numbers of manual PBR configs on 4500x's/other Cat's similarly and if so what was any impact/experience/limits reached ?? thnks Martyn ... View more

I suspect the mediashuttleplugin is causing some grief of some sort for my download attempts at the EM GA image from devnet (multiple browsers failing, corp firewall/security/content systems in way, hmmmmmmmmm.....) 1st step, c an anyone advise of any alternative (old-fashioned??) HTTP/FTP/SFTP/other protocol EM image hosting sites ??? thnks Martyn ... View more

I have a number of very remote sites that cost-effectively only PSTN can be provisioned to for land-line comms, these dial land lines providing back-up to low-bandwidth satellite comms services. With the end-of-sale of the PVDM modules for routers, i see dial/PSTN remote access functionality that Cisco offered with the these as now completely unavailable in the whole Cisco product set. Is there any dial/PSTN Remote Access concentrator functionality hidden away in any of the Cisco products, or is it truly Cisco cannot supply a device to service my dial requirements ?? Alternatives ?? thnks Martyn ... View more

Running NCS appliances on 1.3.0.20 December last year configured a rogue WAP report and scheduled it to run daily. Its now suddenly 'expired', and it does not seem possible to unexpire it, you can change date and other properties within it but it remains in expired state. Configuring a new replacement rogue report there is no option for an end date, only a start date/time. Previous WCS/NCS support postings here infer there is a 'last' date but certainly it is not available from what i see. Others reports seem to have similar start date/time fields but no end date option Do reports have a default/hard-coded length of days to run ?? Is there some global NCS setting i can flip to offer the end date option on reports ?? thnks martyn ... View more

We're rolling out 5508's/3600's/ISE's/MSE's, using existing NCS's. using dot1x (machine certs EAP/TLS MS laptops) on one SSID, 2 x other SSID's have open auth. MSE is flagging Association Table Overflows on loads of WAPS, reseller TAC case tells me its .1x and misconfigured clients half authing causing this (not uncommon problem apparently), however my desktop support colleagues ideally need at least a mac address to identify a misconfigured device (if not more) Been debugging dot1x on the 5508's and looking at MSE/WAP forensic wireshark files created on the Association Table overflow rule, but nothing leaps out immediately for the offending devices What would be the quickest way to individually identify these devices that are filling the WAP association tables ?? (Can specific WAP Association tables be viewed with controller based WAPS's ???? ) Anyone solved similar ?? thanks Martyn ... View more

In our enterprise a project is driving more bandwidth usage and is making us consider deploy of MPLS on proposed core gig e WAN links that would link South England and Scottish datacentres We are considering upgrading existing North and South sited core 6500's to terminate these new MPLS links. Or alternatively purchase new north and south ASR platforms as termination. Are there any 6500-platform-specific MPLS dependencies/restrictions to consider that would not be encountered if we used ASR's ?? thnks martyn ... View more

Hi We are just on the cusp of deploying Guest wireless for external non-employee visitors to our organisation, using WLC's and the lobby admin functionality. However the issue of support procedures for these guest devices is sticking. Our Desktop support dept will not support potential technically challenged guest user and his mis configured end device (for want of a better phrase......) Ourselves in networks by policy do not support end devices as such. We need a completely remote 'no-remote-human-presence' way to test a user attaching to a SSID, firing up a browser and authing thru the re-directed to web interface. Remoting to a PC attached to the remote secure wired network is NOT ideal as we will then be bridging secure wired corp and non-secure guest wireless (altho it may have to end up being a variation of that.) I would be interested to hear how people here troubleshoot their guest wireless service availability. thnks martyn ... View more

I'm looking to recommend to deploy pairs of aironet 1300's as point to point bridges in multiple sites, but need some assistance on the limits of the security functionality. I need an absolutely/uncrackable secure way for the 1300's to authenticate/encrypt to each other and disallow all other radio connections. All the examples I found so far dont address the point to point model in necessary depth security wise. Any pointers here ?? thanks Martyn Beck ... View more

Im running a lab combined with production test where we have desktop device traffic travelling over a pix to pix ipsec tunnel, itself which is tunnelled over a pix to pix ipsec tunnel, transiting over a provided MPLS segment (the MPLS which i have no vision of). There are issues with packet MTU, with all the kit at default 1500 mtu, pings drop at 1375 bytes. Forcing a lower MTU of 800, and the pings start droping at 661 bytes. Needless to say the desktop applications have issues... Before I start to look at changing DF bits/TCP MSS, I am wondering if anyone has worked this scenario previously, and found a resolve ?? Thanks Martyn ... View more