Hello, Friends!   We used Native Win supplicant earlier with PEAP method. Recently we decided to install AC NAM(with EAP-FAST) on top of it. I see weird behavior after host reloaded. The PC firstly trying to Auth using PEAP, looks like Native supplicant still alive and functional. The second Auth attempt(~200msec later) going through EAP-FAST(the AC NAM wake up =) ) and completes correctly. First attempt through PEAP looks in ISE as abandoned session by supplicant.   Is it normal? I thought the AC NAM completely replace native supplicant or wee need to somehow disable it (GPO etc)   Thanks, Artyom ... View more

Hello Friends!   Please help me to understand switch behavior, sometimes I see in the auth session result an ACL policy called OPEN DIR ACL It looks like this  SW_1#sh authentication sessions interface gigabitEthernet 1/1 de Interface: GigabitEthernet1/1 MAC Address: aaaa.bbbb.cccc IPv6 Address: Unknown IPv4 Address: 1.1.1.1 User-Name: aaaabbbbcccc Status: Authorized Domain: DATA Oper host mode: multi-domain Oper control dir: both Session timeout: N/A Restart timeout: N/A Periodic Acct timeout: 36000s (local), Remaining: 35938s Session Uptime: 73s Common Session ID: AC132FC5002749CD57B94254 Acct Session ID: 0x0001672F Handle: 0x4C000148 Current Policy: POLICY_Gi1/1 Local Policies: OPEN DIR ACL: Open-Dir-ACL Service Template: GUEST_VLAN_Gi1/1 (priority 150) Vlan Group: Vlan: 999 Method status list: Method State dot1x Stopped mab Stopped Interface Config ! interface GigabitEthernet1/1 switchport access vlan 666 switchport mode access ip access-group ACL-DEFAULT in authentication event server dead action authorize authentication event server dead action authorize voice authentication event no-response action authorize vlan 999 authentication event server alive action reinitialize authentication host-mode multi-domain authentication order dot1x mab authentication priority dot1x mab authentication port-control auto authentication periodic authentication timer reauthenticate server authentication timer inactivity server dynamic authentication violation restrict mab dot1x pae authenticator dot1x timeout tx-period 3 spanning-tree portfast The port goes to guest-access I think, cause there was 3 EAPOL Req without response from Host.(I captured it) But what is this ACL applied Open-Dir-ACL?? In fact it`s a regular permit ip any any, but I can`t understand how it works, also it(Open-Dir-ACL) may disappear after some time.   Please help me, maybe it`s something easy, but not for me =)   Thanks, Artyom ... View more

Hello Friends! Please give me some advice. Is it possible to implement Transparent Failover cluster(FTD) between two VRFs on the same VPC pair(Nexus 7706)? In general I need to do inter-VRF routing on the same pair of switches participating in VPC. I use two VLANs(outside\inside) that connected to Transparent firewall. I assign SVI in both VLANs to both VPC peers and put this SVI to appropriate VRFs. Also I bound to each SVI a unique mac address. It looks like a loop for me, each switch connects to himself(through Firewall BVI) and it looks scary for me. But in the end all works. There is no loop as I can see, ping between SVI in different VRFs pass through Firewall. Maybe I need to do another tweaks for this topology? There is strange output from spanning tree where not all BPDU sent and received accordingly, and Topology change comment I see Looks like I missed something...   Logical Topology   Physical Topology   There is output from one VPC member   nx7-1_DC2-EDGE_CORE# sh spanning-tree vlan 1031 detail VLAN1031 is executing the rstp compatible Spanning Tree protocol Bridge Identifier has priority 32768, sysid 1031, address 0023.04ee.beaf Configured hello time 2, max age 20, forward delay 15 Current root has priority 33798, address 0023.04ee.beaf Root port is 5126 (port-channel1031), cost of root path is 1 Topology change flag not set, detected flag not set Number of topology changes 3 last change occurred 1:31:45 ago from port-channel1031 Times: hold 1, topology change 35, notification 2 hello 2, max age 20, forward delay 15 Timers: hello 0, topology change 0, notification 0 Port 4096 (port-channel1, vPC Peer-link) of VLAN1031 is designated forwarding Port path cost 1, Port priority 128, Port Identifier 128.4096 Designated root has priority 33798, address 0023.04ee.beaf Designated bridge has priority 0, address 00de.fb1e.9743 Designated port id is 128.4096, designated path cost 1 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port type is network Link type is point-to-point by default BPDU: sent 12294, received 12294 Port 5126 (port-channel1031, vPC) of VLAN1031 is root forwarding Port path cost 1, Port priority 128, Port Identifier 128.5126 Designated root has priority 33798, address 0023.04ee.beaf Designated bridge has priority 33798, address 0023.04ee.beaf Designated port id is 128.5126, designated path cost 0, Topology change is set Timers: message age 15, forward delay 0, hold 0 Number of transitions to forwarding state: 2 Link type is point-to-point by default BPDU: sent 4, received 5131 nx7-1_DC2-EDGE_CORE# sh spanning-tree vlan 1031 VLAN1031 Spanning tree enabled protocol rstp Root ID Priority 33798 Address 0023.04ee.beaf Cost 1 Port 5126 (port-channel1031) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 33799 (priority 32768 sys-id-ext 1031) Address 0023.04ee.beaf Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Po1 Desg FWD 1 128.4096 (vPC peer-link) Network P2p Po1031 Root FWD 1 128.5126 (vPC) P2p nx7-1_DC2-EDGE_CORE# sh spanning-tree vlan 1030 detail VLAN1030 is executing the rstp compatible Spanning Tree protocol Bridge Identifier has priority 32768, sysid 1030, address 0023.04ee.beaf Configured hello time 2, max age 20, forward delay 15 We are the root of the spanning tree Topology change flag not set, detected flag not set Number of topology changes 4 last change occurred 1:19:20 ago from port-channel1031 Times: hold 1, topology change 35, notification 2 hello 2, max age 20, forward delay 15 Timers: hello 0, topology change 0, notification 0 Port 4096 (port-channel1, vPC Peer-link) of VLAN1030 is designated forwarding Port path cost 1, Port priority 128, Port Identifier 128.4096 Designated root has priority 33798, address 0023.04ee.beaf Designated bridge has priority 0, address 00de.fb1e.9743 Designated port id is 128.4096, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 1 The port type is network Link type is point-to-point by default BPDU: sent 10262, received 10263 Port 5126 (port-channel1031, vPC) of VLAN1030 is designated forwarding Port path cost 1, Port priority 128, Port Identifier 128.5126 Designated root has priority 33798, address 0023.04ee.beaf Designated bridge has priority 33798, address 00de.fb1e.9743 Designated port id is 128.5126, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 2 Link type is point-to-point by default BPDU: sent 2382, received 4 nx7-1_DC2-EDGE_CORE# sh spanning-tree vlan 1030 VLAN1030 Spanning tree enabled protocol rstp Root ID Priority 33798 Address 0023.04ee.beaf This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 33798 (priority 32768 sys-id-ext 1030) Address 0023.04ee.beaf Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Po1 Desg FWD 1 128.4096 (vPC peer-link) Network P2p Po1031 Desg FWD 1 128.5126 (vPC) P2p   Thanks, Tom   ... View more

Hello Friends!   Does anyone have information about EVN for 3850\3650 Catalyst platform and for NX-OS? I didn`t find that this platforms support EVN... Looks like Cisco have no plans for further developing this feature, cause it introduced about 5 years ago and there still small variety of hardware platform and software.   It interesting feature that we would be happy to implement, but we use 3850 and nexus switches(7700 with F3cards), looks like we were unlucky, VRF-Lite only choice =))   Thanks, Tom ... View more

Hello Friends!   In IBNS 2.0 Deployment Guide I read that we can define IDLE timeout for our access-session in policy If we use additional "probe" parameter switch have to check availability of silent endpoint(arp probing) I defined service template for inactivity timer with probing.   service-template INACTIVITY-TIMER inactivity-timer 60 probe ...... event authentication-success match-all 10 class always do-until-failure 10 activate service-template INACTIVITY-TIMER event inactivity-timeout match-all 10 class always do-until-failure 10 unauthorize .......   If I understand correct it must instruct the switch to probe endpoint every 30 seconds of inactivity. But it doesn`t work this way. Default timer for arp-probing(device-tracking) on switch is 300 seconds and it doesn`t changed even if we applied those sevice-template. In the end after 60 seconds of inactivity host will become unauthorized because switch didn`t adjusted arp-probing timer.   Guide says Intelligent Aging When the inactivity timer is enabled, the switch monitors the activity from authenticated endpoints.  When the inactivity timer expires, the switch removes the authenticated session. ......... To counter these types of cases, an arp-probe can be enabled along with the inactivity-timer, so that the switch periodically sends ARP probes to endpoints in the IP Device Tracking table. As long as the endpoint is connected and responds to these probes, the inactivity timer is not triggered, and the endpoint is not inadvertently removed from the network. .........   Please help me to understand does the ARP_Probe timer adjustes himself accordingly to inactivity-timer settings with "probe" keyword or not.   Thanks in advance, Tom ... View more

Hello Friends!   I noticed that previuosly usefull debug commands do nothing in new code of IOS XE 16.9.1 on our 3850 switches.   Looks like there is no method to achive previous level of visibility of radius auth\authz\acc   I found that in new code Cisco introduced trace smd(session mgr) feature. show platform software trace message smd switch active r0   Is it only method that we can use for debugging radius on modern IOS XE now?   Regards, Tom ... View more

Hello Friends!   Please help me understand what does mean "show aaa servers" command output from 3850 switches I couldn`t find any information...   State: current UP, duration 177s, previous duration 219s Dead: total time 3875s, count 0 Platform State from SMD: current UP, duration 341s, previous duration 55s SMD Platform Dead: total time 3771s, count 0 Platform State from WNCD: current UP, duration 0s, previous duration 0s Platform Dead: total time 0s, count 0 Quarantined: No     What mean Actual  State? Platform State from SMD? Platform State from WNCD? What dependencies they have from configuration poin of view?   Thanks in advance) Tom ... View more

Hello Friends!   I have a simple VXLAN EVPN environment with 5672(Leafs) and 7706(BorderSpines). All Leafs paired in VPC pairs. All vlans exist on all VPC pairs and same Anycast GW with the same Anycast MAC address configured on them. So, there is nothing special :).   Recently I noticed that huge amount of problem with host reachability exist in my environment. Hosts partially lost connectivity (from some places of our network it`s reachable and from another it`s not) Also I saw that iBGP table version count tremendously big (from my environment size perspective)   After some investigations, I understood that problem arise only on "orphan-connected" hosts.(Yes, orphan hosts isn`t good idea, but unfortunately now we have to maintain this type of connections in our environment) ARP entries of this orphan hosts are continuously flapping (on Leafs from VPC pair where hosts connected to), entries lives no longer than 1-3 seconds. MAC table is stable on both VPC members at this moment, all entries pointed to right interfaces. It cause iBGP updates continuously flapping (Leafs doing withdrawal\advertising EVPN routes according arp table flapping) and increase iBGP table version count to the moon :)   So, the issue flow in the BAD case (from my perspective): Orphan-host connected to VPC Peer A Peer A complete MAC entry and ARP entry, but for some reason not synchronize ARP entry with Peer B(or partially synchronized) When packet to host landing to Peer B it has no complete ARP entry and trying to resolve it by sending ARP request via peer-link Request goes to the Peer A and reaches destination host which generate ARP reply This ARP reply refreshing ARP entry on Peer A(and absorbing here cause Anycast GW) but for some reason Peer A and Peer B still don`t synchronize ARP entry via CFSoE Every subsequent packet that landing to Peer B will reproduce this circle problem and calling ARP flapping   It`s interesting behavior, more likely a bug. This behavior independent of connection type(directly-connected or fex-connected)   Maybe this post will help for someone who faced with similar problem. ... View more