About Ivan Shirshin

Ivan Shirshin · ‎04-28-2016

Hello Nicholas, Are you interested in something specific? There are certain things to be taken into account when you deploy security in N5k network, e.g.: 1. Features implementation can not exist in older release, such as Login Block Per User was added to Dynamic ARP Inspection only starting with .3(0)N1(1), or 5.1(3)N1(1) added information to configure the Cisco TrustSec feature. 2. There are limitations and guidelines for specific security areas, such vPC security or ACLs which you can see in corresponding guides: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/security/513_n1_1/b_Cisco_n5k_security_config_gd_513_n1_1/b_Cisco_n5k_security_config_gd_513_n1_1_chapter_01001.html#concept_22FB5A78C7A94A028979AFF30B34FDF8 http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/security/521_n1_1/b_5k_Security_Config_521N11/b_5k_Security_Config_521N11_chapter_01000.html#concept_C4D43EE804DE433790286B93867E5EC1 3. Platform specific limitations, such as the fact Nexus 5000 switches do not support all numeric usernames, whether created with TACACS+ or RADIUS, or created locally, and do not create local users with all numeric names. If an all numeric username exists on an AAA server and is entered during login, the Nexus 5000 Series switch will log in the user. The recommended approach to this is to verify the guidelines and limitation of security features you need in the corresponding guides at cisco.com. Kind Regards, Ivan

Ivan Shirshin · ‎04-25-2016

Hi, You can find CUBE (SP edition) configuration examples in the following guides: http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-border-element/116415-configure-product-00.html http://www.cisco.com/c/en/us/td/docs/routers/asr1000/profiles/SBC_Config_Examplebook.html Kind Regards, Ivan

Ivan Shirshin · ‎04-25-2016

Great, I am glad the issue is resolved! You are welcome! Kind Regards, Ivan

Ivan Shirshin · ‎04-25-2016

Hi, Nexus 9000 (exluding 9200) has support of sFlow starting 7.0(3)I2(1) NX-OS release. Therefore, you need SW upgrade for this feature. Make sure to check prerequisites and guidelines for sFlow in the following document: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/system_management/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide_7x_chapter_011000.html#concept_8B2D96201AD24907BC28726B03B83CFD Kind Regards, Ivan

Ivan Shirshin · ‎04-22-2016

Hi, Is there a reason you are using single link? It is strongly recommended to connect ASA to vPC domain using vPC link. You may encounters issue in case of link failures otherwise. The ingress vlan in your case would be vlan 100 but you also need egress vlan, e.g. vlan 200. Since it is transparent mode, they have to be in the same subnet 10.10.100.0/24. As for routed interfaces, for such setup you need SVI for egress vlan on Nexus (default gateway) and BVI interface bridging ingress and egress vlans on ASA. Static routes are not needed in this case, since it is transparent mode and servers are in the same subnet with default gateway. Kind Regards, Ivan

Ivan Shirshin · ‎04-21-2016

Hi, Please see reply to your another post above. Kind Regards, Ivan

Ivan Shirshin · ‎04-21-2016

Hi, The problem indeed seems to be caused by a packet loss in one direction from your description. I do not see anything wrong related to the design, and I recommend to narrow down the point of failure to proceed with the issue analysis. As the first step, I would trace the packets that are getting lost and try to find where they are getting lost, and in which direction. You can do it using several methods: ACL on the interfaces iin the traffic path for this specific traffic, SPAN and/or ELAM on the switches that support it (6500 support ELAM). You know the source, destination, type of traffic, so you specify all required filters for this flow specifically. When the point of failure is identified, you can research in more details the reason packets are getting dropped there (due to software issue, or configuration, or vlan connectivity, etc.). Also, with this symptoms and complex investigation needed I recommend to open a TAC case to have dedicated Cisco engineer assist you with troubleshooting. Kind Regards, Ivan

Ivan Shirshin · ‎04-20-2016

Hi, Do you mean you do not have netflow feature? Which switch model do you have? Please send "show ver" from your switch. Kind Regards, Ivan

Ivan Shirshin · ‎04-19-2016

Hi, N5K does not support sFlow, only sampled Netflow. You can check the following guide for more details: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5600/sw/system_management/7x/b_5600_System_Mgmt_Config_7x/b_6k_System_Mgmt_Config_7x_chapter_010011.html Kind Regards, Ivan

Ivan Shirshin · ‎10-16-2015

Hi Pani, We are going to check that in the lab on our 3560 shortly. Kind Regards, Ivan

Ivan Shirshin · ‎10-15-2015

Hello Eric, This expert session is for Switch and IOS Architecture questions. You would need to contact Unified Contact Center experts for solution to your problem. Kind Regards, Ivan

Ivan Shirshin · ‎10-13-2015

Hello Pani, portAdditionalOperStatus is not supported on the 3560 devices. To check the errdisabled status of the ports, you would need to use cErrDisableIfStatusCause. CISCO-STACK-MIB was primarily implemented for the CatOS and is not fully supported in 3560 and 3750. You can see this issue explained in DDTS for IOS devices: CSCdv75076 portAdditionalOperStatus support for Native IOS To get information about err-disabled ports, you should use OID 1.3.6.1.4.1.9.9.548.1.3.1.1.2 (cErrDisableIfStatusCause) in CISCO-ERR-DISABLE-MIB on 3560 switch. The result is the table with reasons why the port is disabled, as described here: http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=1.3.6.1.4.1.9.9.548.1.3.1.1.2 When the system doesn't has ports in error disabled state this table is empty and doesn't contain any data. I see this OID was tested with 12.2(50)SE5 in our lab and worked fine. Can you double check it on your switch? If it does not work, I suggest to test with 12.2(50)SE5 and open a service request with Cisco TAC if there is a discrepancy. CISCO-ERR-DISABLE-MIB should be supported in your image. Note that it also has some traps like cErrDisableInterfaceEvent. I want to additionally mention that for the cErrDisableInterfaceEventRev1 [1.3.6.1.4.1.9.9.548.0.2], from the description, you can see that interface identifiers are not contained in this notification but they are meant to be polled from the OIDs cErrDisableIfStatusCause [1.3.6.1.4.1.9.9.548.1.3.1.1.2] and cErrDisableIfStatusEntry [1.3.6.1.4.1.9.9.548.1.3.1.1], which correlates to the ifIndex and therefore identifies the interface that triggered the alarm. Kind Regards, Ivan

Ivan Shirshin · ‎10-12-2015

welcome!

Ivan Shirshin · ‎10-12-2015

I recommend to open a case with Mikrotik support team. They should be able to check if router is having some issue.

Ivan Shirshin · ‎10-12-2015

What is the router model, Sara?

Date Registered	‎09-24-2007 01:30 AM
Date Last Visited	‎09-21-2018 04:32 AM
Total Messages Posted	623
Total Helpful Votes Received	868