Hi is there any way to find out if N7K7 is really redirecting traffic to a WAAS-Device WAAS-Devices are located in a seperate VLAN, and a C6K5 and N7K7 are redirecting traffic to the WAAS. On the WAAS there is no way to see how many traffic is redirected from which router, on the N7K7 I also cannot find out if this box is really redirecting traffic to the WAAS ?   any ideas Thx  ... View more

Hi all out there. I have to build up connection between two pairs of Nexus7K (M3-Linecards running 8.1) via vPC I have to have L2 trunk over the vPC and dynamic-routing (OSPF) as well. (Transfer VLANs enabled on vPC and SVIs on the vPC-Peers) So far so good , dynamic routing over vPC is supported since 7.2 whith configuring "layer3 peer-router" under vPC. Unfortunately I need also PIM Adjacency over these L3-Transfer-VLANs for MC-routing. I found out now that PIM adjacency via a vPC-VLAN is not supported.. I do not have the chance to have seperate L3-Links between the vPC-Pairs, I have only the fiber-links for building the vPC between them. So my idea was to build up the vPC as I palnned it before, but I do not create SVIs for the L3-Transfer-VLANs. I want to configure a routerd interface (with routed Subinterfaces for all the needed Transfer-VLANs) and connect this L3-Interfae locally on every Box to a L2-trunk which carries only these "Transfer-VLANs". With this trick can I go arround the PIM adjacency Limitation ver vPC. Would this be a valid Option ?? Thx in Advance for discussing this Hubert ... View more

Hi all, I am searching for a way to have the communication between VOIP-Gateway (ISR4000) and IP-Phone, between VOIP-Gateway and CUCM in the global-Routing-table, and the communication between VOIP-Gateway and SIP-provider in a VRF for security-reasons. Is that supported in any way ?   Config looks like following :   interface Loopback1 description Loopback-Interface for Voice-Applications ip address 10.224.255.5 255.255.255.252 ip pim sparse-mode h323-gateway voip interface   ! interface GigabitEthernet0/0.751 description IP-Phones_Vlan751 encapsulation dot1Q 751 ip address 10.224.51.1 255.255.255.0 ip access-group ip-traffic-voice-in in no ip redirects no ip proxy-arp ip accounting output-packets ip pim sparse-mode ip verify unicast source reachable-via rx ip tcp adjust-mss 1320 service-policy input xQOS-MARK-POLICY !   interface GigabitEthernet0/2 description SIP-Connect !#### ip vrf forwarding FVRF-SIP-TRUNK         ->>>> this Interface should be  in VRF  ip address 192.168.1.254 255.255.255.0 ip access-group SIP-ACL-TOLL-Fraud in no ip redirects no ip unreachables no ip proxy-arp ip flow monitor FLOW_MONITOR input ip flow monitor FLOW_MONITOR output load-interval 30 duplex auto speed auto no cdp enable ! ip route 162.218.251.159 255.255.255.255 192.168.1.1 !#### ip route FVRF-SIP-TRUNK 162.218.251.159 255.255.255.255 GigabitEthernet0/2 192.168.1.1 ! ip access-list extended SIP-ACL-TOLL-Fraud permit ip host 192.168.1.1 host 192.168.1.254 permit ip host 162.218.251.159 host 192.168.1.254 deny   ip any any ! dial-peer voice 1001 voip description *SIP Trunk from CUCM* session protocol sipv2 voice-class codec 7000 voice-class sip bind control source-interface Loopback1 voice-class sip bind media source-interface Loopback1 dtmf-relay rtp-nte no vad ! dial-peer voice 1000 voip description *SIP Trunk to CUCM* destination-pattern T session protocol sipv2 session server-group 1 voice-class codec 7000 no voice-class sip outbound-proxy   voice-class sip bind control source-interface Loopback1 voice-class sip bind media source-interface Loopback1 dtmf-relay rtp-nte no vad ! dial-peer voice 3001 voip description incoming from SIP_PROVIDER translation-profile incoming TELE2SIPIN service auto_att_flash session protocol sipv2  session target ipv4:162.218.251.159:5083 incoming called-number +43723485085T incoming uri from 1 no voice-class sip outbound-proxy   voice-class sip profiles 1 voice-class sip options-keepalive voice-class sip copy-list 1 dtmf-relay rtp-nte codec g711ulaw no vad ! dial-peer voice 3000 voip description to SIP_PROVIDER translation-profile outgoing TELE2SIPOUT destination-pattern T session protocol sipv2  session target ipv4:162.218.251.159:5083 voice-class codec 7000 no voice-class sip associate registered-number no voice-class sip outbound-proxy   voice-class sip profiles 1 voice-class sip copy-list 1 dtmf-relay rtp-nte no vad ! sip-ua credentials .... authentication .... retry invite 3 retry register 3 timers trying 1000  registrar ipv4:162.218.251.159:5083 expires 3600 connection-reuse ! ! ... View more

Hi I try to protect the Mgmt Interface of Cat4500E and 4900M,   unfortunately it seems we cannot assigne a ingress service-policy on the managementinterface because its no HW switched Interface. Next try was to use CoPP, but it seems packets which arrive on the Managementinterface seems not to be handled by CoPP, is this a known issue, does it work as desiged or is it a Maybe a Bug.   Thx in Advance Hubert ... View more

Hi all out there, in the past on our 2650,3560 we configured on the Client/Phone ports just "trust cos", so we achieved that only tagged traffic is trusted and mapped to the particular DSCP-value . all untagged traffic should be marked with COS 0 and DSCP 0.   Now I try to achieve this with new 3650. According to the documentation in following way   table-map COS-2-DSCP-DEFAULT  default copy   policy-map MARKING-TRUST-COS     Class class-default       set cos dscp table COS-2-DSCP-DEFAULT   interface GigabitEthernet 1/0/1  switchport mode access  switchport access vlan 851  switchport voice vlan 751  service-policy input MARKING-TRUST-COS   So in my opinion the COS field should be copy to the corresponding DSCP-bits, which also means untagged traffic has no COS value , so DSCP ist set to 0. Unfortunately with this config also tagged traffic from the ip-phone (COS 5, DSCP EF) is marked down to DSCP 0, to be honest no idea why ??? Has anybody an Explanation for this behaviour.   So I tried second way to achive that with following config:   class-map match-any COS-CLASS-0  match cos  0 class-map match-any COS-CLASS-1  match cos  1 class-map match-any COS-CLASS-2  match cos  2 class-map match-any COS-CLASS-3  match cos  3 class-map match-any COS-CLASS-4  match cos  4 class-map match-any COS-CLASS-5  match cos  5 class-map match-any COS-CLASS-6  match cos  6 class-map match-any COS-CLASS-7  match cos  7   policy-map MARKING-TRUST-COS  class COS-CLASS-7   set dscp cs7  class COS-CLASS-6   set dscp cs6  class COS-CLASS-5   set dscp ef  class COS-CLASS-4   set dscp cs4  class COS-CLASS-3   set dscp cs3  class COS-CLASS-2   set dscp cs2  class COS-CLASS-1   set dscp cs1  class COS-CLASS-0   set dscp default     interface GigabitEthernet 1/0/1  switchport mode access  switchport access vlan 851  switchport voice vlan 751  service-policy input MARKING-TRUST-COS   the third way is following:   table-map COS-2-DSCP  map from  0 to 0  map from  1 to 8  map from  2 to 16  map from  3 to 24  map from  4 to 32  map from  5 to 46  map from  6 to 48  map from  7 to 56  default copy     policy-map MARKING-TRUST-COS     Class class-default       set cos dscp table COS-2-DSCP   interface GigabitEthernet 1/0/1   switchport mode access  switchport access vlan 851  switchport voice vlan 751  service-policy input MARKING-TRUST-COS       As far as I understand all three configurations should end up in the same behaviour, but only the second way works as expected. Could anybody explain me whats wrong in my considerations.     Thanks Hubert   ... View more

Hi all, we are using 802.1x machine-authentication with EAP-TLS and dynamic VLAN-assignment. lets say a device is successful authenticated and VLAN DATA is assigned. After a time the Device is sending EAPOL logoff for any reason, and is silent from this moment on ( does not send any packet). So the auth Session is cleared and the VLAN Assigment is removed ( looks like Port is assigned to VLAN0) So the problem is if the MAC is unauthenticated and POrt has no VLAN assigment it is impossible to send WOL Magig packet or similar staff ( INtel AMT) What will happen from here on? Does the Switch to try to initiate Authentication by sending an EAP Request periodic for ever until it receives EAP Response or EAPOL Start, or do we have to wait that Client ist starting EAP process       thxin Advance Hubert ... View more

Hi together out there, I am doing a little bit troubleshooting with QOS and shaping. It s always a little bit difficult to find out how our Provider is calculating the BW they are offering to us and how we are calculating our shaping target rate. Normally we are using config like following. Now the question is what is used for calculating the shaping-rate:   Is it the whole packet including L2-Header Is it just the packet with L3-Header and GETVPN-Header, without L2-Header Is it just the packet only with original L3 Header   This Info is important so we can shape to the correct BW we agreed with ISP   Thanks in Advance Hubert     policy-map xQOS-QUEUE-POLICY  class xQOS-CLASS-EF_Realtime_Voice     priority percent 20  class xQOS-CLASS-CS6_Network_Control     bandwidth remaining percent 5  class xQOS-CLASS-CS5  class xQOS-CLASS-AF41     bandwidth remaining percent 10  class xQOS-CLASS-CS4_Realtime_Video     bandwidth remaining percent 35     queue-limit 256 packets  class xQOS-CLASS-AF31_Video_Streaming     bandwidth remaining percent 8  class xQOS-CLASS-CS3_Realtime_Signalling     bandwidth remaining percent 3  class xQOS-CLASS-AF21_Transactional_Data     bandwidth remaining percent 10  class xQOS-CLASS-CS2_Management_OAM     bandwidth remaining percent 3  class xQOS-CLASS-AF11_Bulk_Data     bandwidth remaining percent 5     queue-limit 512 packets  class xQOS-CLASS-CS1_Scavanger_Data     bandwidth remaining percent 1  class xQOS-CLASS-BE_Best_Effort     bandwidth remaining percent 15     queue-limit 128 packets   policy-map xQOS-SHAPED-10000-QUEUE-POLICY  class class-default     shape average 10000000 100000 0   service-policy xQOS-QUEUE-POLICY       interface GigabitEthernet0/3  description Provider Etherlink  bandwidth 100000  no ip address  load-interval 30  duplex full  speed 100  media-type rj45 no shut   interface GigabitEthernet0/3.1111  description 10Mbit/s-EthMP to Branch  bandwidth 10000  encapsulation dot1Q 1111  ip address 10.200.111.1 255.255.255.252 ip tcp adjust-mss 1320 ip ospf network point-to-point  bfd interval 200 min_rx 200 multiplier 3  crypto map MAP-SECURE-WAN service-policy output xQOS-SHAPED-10000-QUEUE-POLICY               ... View more

Hi out there, have a few questions about HSRP in vPC environment 1. in a vPC deployment where both peers have SVIs for a VLAN we can use peer-gateway command to achive that both peers are forwarding traffic which has as destination the HSRP-VMAC. I know thats true for the active and standbay HSRP peer. Is that also true if one of the peers, or both are in HSRP listening mode ( cause by other devices which are HSRP active and Standby in this VLAN)   2. Assuming we are configuring anycast HSRP feature , this results in advertising the HSRP vMAC with the FabricPath Switch ID of the Anycast HSRP Bundle. Thats clear for me in the Case we have the SVIs on pure Spine-Switches with no End-Device L2 attached there What happens if we configure Anycast HSRP Bundle accross 2 VPC+ Bundles? For local L2attached Devices is it necessary to configure Peer-Gateway command in the vPC configuration in order that both vPC peers are forwarding traffic which has destination the HSRP vMAC coming in on CE-Ports? The configuration of Anycast HSRP Bundle will also end up in ona Active, one standby and 2Boxes in listening state from HSRP perspective. This leads me to the same Question that unde point 1, do Boxes with HSRP listening State forward traffic which has destination HSRP vMAC?   3 does anybody know if its a really TAC supported design to configure HSRP Localisation by configuring the same HSRP group on every VPC+ Pair with using different authentication string for HSRP on each Pair? Thanks a lot   Hubert ... View more

Hi out there, as I learned Nexus5600 Does Support just 2 Fabric-Path-topologies, the Default topology 0 and one additional.   customer wants to use these two topologies for traffic Engineering to sepperate traffic from some vlans on the fabri-path-links   eq. VLAN 100-150 Topology 0 VLAN 200-250 Topology 1     fabricpath topology 0  member vlan 100-150   fabricpath topology 1  member vlan 200-250     no between the Switches we always have 2 FP-Interfaces, so we want to assign one Interface to topology 0 and one to topology 1   would this be possible, it seems every FP-Interface belongs to Topology 0 and Topology 0 cannot removed ? any idea how to achive that.     Thx Hubert   ... View more

Hi all our WS-C3650-48FQ running IOS-XE 3.3.3SE are shown as WS-C3650-48PQ with show inventory output and also in LMS. The only way to dedect if its WS-C3650-48PQ or WS-C3650-48FQ is a closer look to the used Power-Supplies.   This should be a Bug ? Isnt it ? Hubert   ... View more

We operate some VSS-Bundles with SUP2T (the VSL Link consists of 2 to 4 10GE-Interfaces) Now we plan to change the VSL-Link to 2 40GE Interfaces.   The VSL-Link Portchannel is configured in mode on. Because we do not have a real Maintenance-window I am looking for a method how to achive this with any significant Service-Interruption. So my plan would be to disconnect all 10GE-Links of the VSL-Port-Channel except one. Then I would add at least one 40GE Interface to the Port-channel, of cource the 40GE Interface will no be bundeled to The Port-channel it will remain suspended because of different speed. After disconnecting the last 10GE-Link in the Portchannel the 40GE interface will not be longer suspended because now it’s the only Interface in the Portchannel and the Portchannel would be up and running after a very short downtime (I assume less than 1 second)   Could this work like I planned, is this a recommended/supported way to migrate ?   Thanks in Advance Hubert ... View more