Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Ivan Shirshin
09-21-2018
Ivan Shirshin
Member since
09-24-2007
Cisco Employee
04-28-2016
09:09 AM
Hello Nicholas,
Are you interested in something specific? There are certain things to be taken into account when you deploy security in N5k network, e.g.:
1. Features implementation can not exist in older release, such as Login Block Per User was added to Dynamic ARP Inspection only starting with .3(0)N1(1), or 5.1(3)N1(1) added information to configure the Cisco TrustSec feature.
2. There are limitations and guidelines for specific security areas, such vPC security or ACLs which you can see in corresponding guides:
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/security/513_n1_1/b_Cisco_n5k_security_config_gd_513_n1_1/b_Cisco_n5k_security_config_gd_513_n1_1_chapter_01001.html#concept_22FB5A78C7A94A028979AFF30B34FDF8
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/security/521_n1_1/b_5k_Security_Config_521N11/b_5k_Security_Config_521N11_chapter_01000.html#concept_C4D43EE804DE433790286B93867E5EC1
3. Platform specific limitations, such as the fact Nexus 5000 switches do not support all numeric usernames, whether created with TACACS+ or RADIUS, or created locally, and do not create local users with all numeric names. If an all numeric username exists on an AAA server and is entered during login, the Nexus 5000 Series switch will log in the user.
The recommended approach to this is to verify the guidelines and limitation of security features you need in the corresponding guides at cisco.com.
Kind Regards,
Ivan
... View more
04-25-2016
08:16 AM
Hi,
You can find CUBE (SP edition) configuration examples in the following guides:
http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-border-element/116415-configure-product-00.html
http://www.cisco.com/c/en/us/td/docs/routers/asr1000/profiles/SBC_Config_Examplebook.html
Kind Regards,
Ivan
... View more
04-25-2016
07:24 AM
Great, I am glad the issue is resolved! You are welcome!
Kind Regards,
Ivan
... View more
04-25-2016
12:22 AM
Hi,
Nexus 9000 (exluding 9200) has support of sFlow starting 7.0(3)I2(1) NX-OS release. Therefore, you need SW upgrade for this feature.
Make sure to check prerequisites and guidelines for sFlow in the following document:
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/system_management/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide_7x_chapter_011000.html#concept_8B2D96201AD24907BC28726B03B83CFD
Kind Regards,
Ivan
... View more
04-22-2016
05:46 AM
Hi,
Is there a reason you are using single link? It is strongly recommended to connect ASA to vPC domain using vPC link. You may encounters issue in case of link failures otherwise.
The ingress vlan in your case would be vlan 100 but you also need egress vlan, e.g. vlan 200. Since it is transparent mode, they have to be in the same subnet 10.10.100.0/24.
As for routed interfaces, for such setup you need SVI for egress vlan on Nexus (default gateway) and BVI interface bridging ingress and egress vlans on ASA.
Static routes are not needed in this case, since it is transparent mode and servers are in the same subnet with default gateway.
Kind Regards,
Ivan
... View more
04-21-2016
04:06 AM
Hi,
Please see reply to your another post above.
Kind Regards,
Ivan
... View more
04-21-2016
04:05 AM
Hi,
The problem indeed seems to be caused by a packet loss in one direction from your description.
I do not see anything wrong related to the design, and I recommend to narrow down the point of failure to proceed with the issue analysis.
As the first step, I would trace the packets that are getting lost and try to find where they are getting lost, and in which direction. You can do it using several methods: ACL on the interfaces iin the traffic path for this specific traffic, SPAN and/or ELAM on the switches that support it (6500 support ELAM). You know the source, destination, type of traffic, so you specify all required filters for this flow specifically.
When the point of failure is identified, you can research in more details the reason packets are getting dropped there (due to software issue, or configuration, or vlan connectivity, etc.).
Also, with this symptoms and complex investigation needed I recommend to open a TAC case to have dedicated Cisco engineer assist you with troubleshooting.
Kind Regards,
Ivan
... View more
04-20-2016
02:00 AM
Hi,
Do you mean you do not have netflow feature? Which switch model do you have?
Please send "show ver" from your switch.
Kind Regards,
Ivan
... View more
04-19-2016
12:42 AM
Hi,
N5K does not support sFlow, only sampled Netflow. You can check the following guide for more details:
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5600/sw/system_management/7x/b_5600_System_Mgmt_Config_7x/b_6k_System_Mgmt_Config_7x_chapter_010011.html
Kind Regards,
Ivan
... View more
10-16-2015
01:11 AM
Hi Pani, We are going to check that in the lab on our 3560 shortly. Kind Regards, Ivan
... View more
10-15-2015
08:51 PM
Hello Eric, This expert session is for Switch and IOS Architecture questions. You would need to contact Unified Contact Center experts for solution to your problem. Kind Regards, Ivan
... View more
10-13-2015
10:02 PM
Hello Pani, portAdditionalOperStatus is not supported on the 3560 devices. To check the errdisabled status of the ports, you would need to use cErrDisableIfStatusCause. CISCO-STACK-MIB was primarily implemented for the CatOS and is not fully supported in 3560 and 3750. You can see this issue explained in DDTS for IOS devices: CSCdv75076 portAdditionalOperStatus support for Native IOS To get information about err-disabled ports, you should use OID 1.3.6.1.4.1.9.9.548.1.3.1.1.2 (cErrDisableIfStatusCause) in CISCO-ERR-DISABLE-MIB on 3560 switch. The result is the table with reasons why the port is disabled, as described here: http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&translate=Translate&objectInput=1.3.6.1.4.1.9.9.548.1.3.1.1.2 When the system doesn't has ports in error disabled state this table is empty and doesn't contain any data. I see this OID was tested with 12.2(50)SE5 in our lab and worked fine. Can you double check it on your switch? If it does not work, I suggest to test with 12.2(50)SE5 and open a service request with Cisco TAC if there is a discrepancy. CISCO-ERR-DISABLE-MIB should be supported in your image. Note that it also has some traps like cErrDisableInterfaceEvent. I want to additionally mention that for the cErrDisableInterfaceEventRev1 [1.3.6.1.4.1.9.9.548.0.2], from the description, you can see that interface identifiers are not contained in this notification but they are meant to be polled from the OIDs cErrDisableIfStatusCause [1.3.6.1.4.1.9.9.548.1.3.1.1.2] and cErrDisableIfStatusEntry [1.3.6.1.4.1.9.9.548.1.3.1.1], which correlates to the ifIndex and therefore identifies the interface that triggered the alarm. Kind Regards, Ivan
... View more
10-12-2015
04:34 AM
I recommend to open a case with Mikrotik support team. They should be able to check if router is having some issue.
... View more
04-28-2016 09:09 AM
Hello Nicholas, Are you interested in something specific? There are
certain things to be taken into ...
04-25-2016 08:16 AM
Hi, You can find CUBE (SP edition) configuration examples in the
following guides:
http://www.cisco....
04-25-2016 12:22 AM
Hi, Nexus 9000 (exluding 9200) has support of sFlow starting 7.0(3)I2(1)
NX-OS release. Therefore, y...
04-22-2016 05:46 AM
Hi, Is there a reason you are using single link? It is strongly
recommended to connect ASA to vPC do...
04-21-2016 04:05 AM
Hi, The problem indeed seems to be caused by a packet loss in one
direction from your description. I...
04-20-2016 02:00 AM
Hi, Do you mean you do not have netflow feature? Which switch model do
you have? Please send "show v...
04-19-2016 12:42 AM
Hi, N5K does not support sFlow, only sampled Netflow. You can check the
following guide for more det...
10-16-2015 01:11 AM
Hi Pani, We are going to check that in the lab on our 3560 shortly. Kind
Regards, Ivan
10-15-2015 08:51 PM
Hello Eric, This expert session is for Switch and IOS Architecture
questions. You would need to cont...
10-13-2015 10:02 PM
Hello Pani, portAdditionalOperStatus is not supported on the 3560
devices. To check the errdisabled ...
10-12-2015 04:34 AM
I recommend to open a case with Mikrotik support team. They should be
able to check if router is hav...
Public Statistics
| Date Registered | 09-24-2007 01:30 AM |
| Date Last Visited | 09-21-2018 04:32 AM |
| Total Messages Posted | 623 |
| Total Helpful Votes Received | 918 |
Helpful Votes Given To
.jpg "Hall of Fame Guru"){kind=icon}
Helpful Votes From
