Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About from88
08-15-2019
Stats
Member since
04-29-2010
222
Posts
5
Helpful
0
Solutions
08-07-2019
01:45 AM
my last question: As Northstar interfaces is 40GB ones. do change'ing this hardware qos ns-buffer-profile ultra-burst changes something when my traffic is passing only on 10GB interfaces ? Or it's works only when 40GB interfaces is used ?
... View more
- Tags:
- 40gb
08-04-2019
12:59 PM
Thank you, i will dig about flow control thing. Ok, I could understand that FEX is overwhelmed with traffic. But the output discards are occurring on N9K downlink which points to FEX Uplink. Also, about TCP thing. If 0.01 is acceptable for TCP , what is for UDP ? It's hard to say for service Owners to switch from UDP to TCP. I dont know if't even possible.. i think it;s 2 different problems. 1. Nexus Output discards (which is really impacting UDP services like DNS) 2) FEXes TX-PAUSEs.. i see we have it on every fex interface, even where're no discards present. Could you give any advice on Nexus output discards ?
... View more
08-04-2019
07:33 AM
thank you, im wondering how that supposed to help. That port where the discards are occuring is FEX port. So, that interface will start to listening to pause frames ? Btw I tried to check thing related to flow control i see lots of TX pause frames on FEX ports. Nexus3A# show interface flowcontrol fex 124
--------------------------------------------------------------------------------
Port Send FlowControl Receive FlowControl RxPause TxPause
admin oper admin oper
--------------------------------------------------------------------------------
Eth124/1/1 on on off off 0 242193068
Eth124/1/2 on on off off 0 266813791
Eth124/1/3 on on off off 0 272267423
Eth124/1/4 on on off off 0 246887448
Eth124/1/5 on on off off 0 251238116
Eth124/1/6 on on off off 0 248983081
Eth124/1/7 on on off off 0 254025228
Eth124/1/8 on on off off 0 245693038
Eth124/1/9 on on off off 0 257724327
Eth124/1/10 on on off off 0 232567506
Eth124/1/11 on on off off 0 176434018
Eth124/1/12 on on off off 0 405106259
Eth124/1/13 on on off off 0 240322964
Eth124/1/14 on on off off 0 227890549 As i presume FEX is sending pause frames to the servers, but why ? Is it directly related to discards im seeing ?
... View more
08-03-2019
11:51 AM
someone ? its 0.03% of traffic. Quite high in terms of lost packets.
... View more
08-02-2019
06:58 AM
Hello, We're experiencing output discards in couple of our N9K-C9372PXs. Seems like egress queues fills and it ends up in a lots of discarded packets. All interfaces where discards occur are FEX ports. show interface ethernet 1/21 | inc "output discard"
0 lost carrier 0 no carrier 0 babble 32043410 output discard Bandwidth wise they're OK. I think it's due to bursty traffic from multiple uplinks So, things like DNS queries - which're using UDP packets are really damaged by that. Could you say how to check the size of the buffer and how they're filling up ? I'm wondering: is there are any workaround for this type of behavior ? Now we're using: show hardware qos ns-buffer-profile
NS Buffer Profile: Burst optimized i see there are commands like these: hardware qos ns-buffer-profile ultra-burst Maybe you know, would ultra-burst mode help in our situation ? And what is requirements on entering that command ? do it requires reboot ? or maybe it's possible to make some type of queuing where we'd treat UDP packets differently ? also we have few older N5K-C5672UP, N5K-C5548UP and them are not experiencing it. Maybe they have 'bigger hardware' buffers ? Thanks for any input.
... View more
- Tags:
- nexus
Labels:
07-25-2019
02:15 AM
Thank you, I just want to clarify: on which case the fragmentation occurs 1) If the router receives a bigger packet than it's interface configured. Do it will fragment or drop the packet ? 2)If the router gets the packet in ingress interface where MTU is OK, but the egress interface MTU is smaller ? Thank you.
... View more
07-24-2019
03:53 AM
thank you, So as I understood the most problems occurs when the bigger packets enters the device which is not capable of supporting it so the device should fragment the packets. Which is CPU intensive job. And this is not related to router buffers. And i'm interested how bigger packets affects router performance when it's need to be fragmented ?
... View more
07-24-2019
12:53 AM
Hello, In our DC we've 1500MTU, we're thinking of increasing it to ~9000. I was wondering do it have any disadvantages ? Especially heard something like it could cause router buffers to overfill ? But it's hard for me understood why it'd happen ? Maybe you can provide any explanation ? Thank you. Talking mostly about ISR Routers.
... View more
Labels:
Created by
from88
in Network Management
in Network Management
07-01-2019
11:07 PM
07-01-2019
11:07 PM
any help ? I tried to do the google search, bug search with that SNMP FILL keywords, no results is found. I can't believe that only me have this problem.
... View more
Created by
from88
in Network Management
in Network Management
07-01-2019
06:47 AM
07-01-2019
06:47 AM
Hello, I've a problem with Nexus 9000 SNMP stack. We've topology where are 4 SNMP servers (Prometheus model) tries to pull interface data every 30 seconds. Seems like for these type of Nexuses 9000 C9372PX (NXOS: version 7.0(3)I2(1a)) this is too much to process and im starting to get SNMP timeouts. I tried to do debug snmp errors: i saw these kinds of messages: 2019 Jul 1 12:50:33.842322 snmpd: pm_cache_fill_phy_ethernet_entry_from_local_data: snmp filled up if_counter for if_index = 0x1a006400 num_phy_ethernet_cache_hits = 6151671
2019 Jul 1 12:50:33.842521 snmpd: pm_cache_get_phy_ethernet_port_stats: cache is valid for if_index = 0x1a006600 node_time = 45216597306123477, sys_time = 45216613650973431 eth_cache_hits = 6151670, cache_misses = 0, num_lc_errors = 0, po_cache_hits = 0 eth_port_channel_dstat_errors = 0 seems like SNMP catche is filling up and SNMP stack gets unresponsive. Is there any way to improve SNMP buffer or etc. to make that 4x30secs requests doable for nexus ? Firstly i thought there could be an issue with control-policy, but seems like management class dropped packets counter doesnt increase when situation happens. Also, i've newer Nexuses in my topology (cisco Nexus9000 93180YC-EX chassis ). This one runs OK without any problem. Any help ? Thanks
... View more
Labels:
06-10-2019
02:07 AM
sorry, here is correct info of versions: Software
BIOS: version 07.34
NXOS: version 7.0(3)I2(2a) yes, i know that there're different timeouts of ARP and mac-address-table. The strange reason is that I even ping the host and getting reply, still i dont see the mac in address table. Same goes if im clearing the arp catche. Arp renews but the mac address is not seen in table.
... View more
06-10-2019
12:47 AM
hello, What could be the case when Nexus5548 version 3.6.0 doesnt show some mac-addresses in theirs mac address table. Even though i see the arp and i can ping them. sho mac address-table count
MAC Entries for all vlans:
Dynamic Address Count: 1941
Static Address (User-defined) Count: 202
Multicast MAC Address Count: 1
Total MAC Addresses in Use: 2144 sho ip arp 10.2.80.223 vrf lan
IP ARP Table
Total number of entries: 1
Address Age MAC Address Interface
10.2.80.223 00:09:42 5cb9.0189.b5ac Vlan280
Device1a# show mac address-table address 5cb9.0189.b5ac What could the tshooting process ? Thank you
... View more
Labels:
Created by
from88
in Network Management
in Network Management
06-03-2019
01:33 AM
06-03-2019
01:33 AM
Hello, I've a case where i'm trying to poll SNMP information every 10 seconds from a Cisco IOS-XR devices (interfaces mib). Seems like CISCO IOS-XR updates SNMP information every 15secs, so sometimes management platfortm (in this sitaution - prometheus) reads the same information twice. I know that one of the ways would be increase SNMP polling time from 10S to at least 15s. But we can't do that. Is there any workaround to make a Cisco IOS-XR refresh SNMP information more frequently than 15secs ? Thanks Device version: "Cisco IOS XR Software, Version 5.1.3[Default] "
... View more
Labels:
Created by
from88
in VPN and AnyConnect
in VPN and AnyConnect
05-17-2019
08:28 AM
05-17-2019
08:28 AM
Thank you again. Sad, but i didin't had any time for deeper thsooting. I workarounded the problem using new source tunnel termination IP, with it - everything working OK. Thank you again.
... View more
Created by
from88
in VPN and AnyConnect
in VPN and AnyConnect
05-15-2019
03:50 AM
05-15-2019
03:50 AM
thanks, very strange,, im trying to ping underlying external IP with the tunnel source, and no packet timeout occurs when the tunnel flaps. Here is the log at the same second when the tunnel interface goes down: May 15 10:44:48.540: ISAKMP-PAK: (0):received packet from 37.157.yyy.yyy dport 500 sport 500 Global (N) NEW SA
May 15 10:44:48.540: ISAKMP: (0):Found a peer struct for 37.157.yyy.yyy, peer port 500
May 15 10:44:48.540: ISAKMP: (0):Locking peer struct 0x80007F35AEE14C30, refcount 1 for crypto_isakmp_process_block
May 15 10:44:48.540: ISAKMP: (0):local port 500, remote port 500
May 15 10:44:48.540: ISAKMP: (0):Find a dup sa in the avl tree during calling isadb_insert sa = 80007F35AF96A4E0
May 15 10:44:48.540: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
May 15 10:44:48.540: ISAKMP: (0):Old State = IKE_READY New State = IKE_R_MM1
May 15 10:44:48.541: ISAKMP: (0):processing SA payload. message ID = 0
May 15 10:44:48.541: ISAKMP: (0):processing vendor id payload
May 15 10:44:48.541: ISAKMP: (0):vendor ID seems Unity/DPD but major 69 mismatch
May 15 10:44:48.541: ISAKMP: (0):vendor ID is NAT-T RFC 3947
May 15 10:44:48.541: ISAKMP: (0):processing vendor id payload
May 15 10:44:48.541: ISAKMP: (0):vendor ID seems Unity/DPD but major 245 mismatch
May 15 10:44:48.541: ISAKMP: (0):vendor ID is NAT-T v7
May 15 10:44:48.541: ISAKMP: (0):processing vendor id payload
May 15 10:44:48.541: ISAKMP: (0):vendor ID seems Unity/DPD but major 157 mismatch
May 15 10:44:48.541: ISAKMP: (0):vendor ID is NAT-T v3
May 15 10:44:48.541: ISAKMP: (0):processing vendor id payload
May 15 10:44:48.541: ISAKMP: (0):vendor ID seems Unity/DPD but major 123 mismatch
May 15 10:44:48.541: ISAKMP: (0):vendor ID is NAT-T v2
May 15 10:44:48.541: ISAKMP: (0):found peer pre-shared key matching 37.157.yyy.yyy
May 15 10:44:48.541: ISAKMP: (0):local preshared key found
May 15 10:44:48.541: ISAKMP: (0):Checking ISAKMP transform 1 against priority 10 policy
May 15 10:44:48.541: ISAKMP: (0): encryption AES-CBC
May 15 10:44:48.541: ISAKMP: (0): keylength of 128
May 15 10:44:48.541: ISAKMP: (0): hash SHA
May 15 10:44:48.541: ISAKMP: (0): default group 1
May 15 10:44:48.541: ISAKMP: (0): auth pre-share
May 15 10:44:48.541: ISAKMP: (0): life type in seconds
May 15 10:44:48.541: ISAKMP: (0): life duration (basic) of 28800
May 15 10:44:48.541: ISAKMP-ERROR: (0):Diffie-Hellman group offered does not match policy!
May 15 10:44:48.541: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
May 15 10:44:48.541: ISAKMP: (0):Checking ISAKMP transform 2 against priority 10 policy
May 15 10:44:48.541: ISAKMP: (0): encryption AES-CBC
May 15 10:44:48.541: ISAKMP: (0): keylength of 128
May 15 10:44:48.541: ISAKMP: (0): hash SHA
May 15 10:44:48.541: ISAKMP: (0): default group 2
May 15 10:44:48.541: ISAKMP: (0): auth pre-share
May 15 10:44:48.541: ISAKMP: (0): life type in seconds
May 15 10:44:48.541: ISAKMP: (0): life duration (basic) of 28800
May 15 10:44:48.541: ISAKMP: (0):atts are acceptable. Next payload is 0
May 15 10:44:48.541: ISAKMP: (0):Acceptable atts:actual life: 28800
May 15 10:44:48.541: ISAKMP: (0):Acceptable atts:life: 0
May 15 10:44:48.541: ISAKMP: (0):Basic life_in_seconds:28800
May 15 10:44:48.541: ISAKMP: (0):Returning Actual lifetime: 28800
May 15 10:44:48.541: ISAKMP: (0):Started lifetime timer: 28800.
May 15 10:44:48.542: ISAKMP: (0):processing vendor id payload
May 15 10:44:48.542: ISAKMP: (0):vendor ID seems Unity/DPD but major 69 mismatch
May 15 10:44:48.542: ISAKMP: (0):vendor ID is NAT-T RFC 3947
May 15 10:44:48.542: ISAKMP: (0):processing vendor id payload
May 15 10:44:48.542: ISAKMP: (0):vendor ID seems Unity/DPD but major 245 mismatch
May 15 10:44:48.542: ISAKMP: (0):vendor ID is NAT-T v7
May 15 10:44:48.542: ISAKMP: (0):processing vendor id payload
May 15 10:44:48.542: ISAKMP: (0):vendor ID seems Unity/DPD but major 157 mismatch
May 15 10:44:48.542: ISAKMP: (0):vendor ID is NAT-T v3
May 15 10:44:48.542: ISAKMP: (0):processing vendor id payload
May 15 10:44:48.542: ISAKMP: (0):vendor ID seems Unity/DPD but major 123 mismatch
May 15 10:44:48.542: ISAKMP: (0):vendor ID is NAT-T v2
May 15 10:44:48.542: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
May 15 10:44:48.542: ISAKMP: (0):Old State = IKE_R_MM1 New State = IKE_R_MM1
May 15 10:44:48.542: ISAKMP: (0):constructed NAT-T vendor-rfc3947 ID
May 15 10:44:48.542: ISAKMP-PAK: (0):sending packet to 37.157.yyy.yyy my_port 500 peer_port 500 (R) MM_SA_SETUP
May 15 10:44:48.542: ISAKMP: (0):Sending an IKE IPv4 Packet.
May 15 10:44:48.542: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
May 15 10:44:48.542: ISAKMP: (0):Old State = IKE_R_MM1 New State = IKE_R_MM2
May 15 10:44:48.638: ISAKMP-PAK: (0):received packet from 37.157.yyy.yyy dport 500 sport 500 Global (R) MM_SA_SETUP
May 15 10:44:48.638: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
May 15 10:44:48.638: ISAKMP: (0):Old State = IKE_R_MM2 New State = IKE_R_MM3
May 15 10:44:48.638: ISAKMP: (0):processing KE payload. message ID = 0
May 15 10:44:48.640: ISAKMP: (0):processing NONCE payload. message ID = 0
May 15 10:44:48.640: ISAKMP: (0):found peer pre-shared key matching 37.157.yyy.yyy
May 15 10:44:48.640: ISAKMP: (1710):processing vendor id payload
May 15 10:44:48.640: ISAKMP: (1710):vendor ID is DPD
May 15 10:44:48.640: ISAKMP: (1710):processing vendor id payload
May 15 10:44:48.640: ISAKMP: (1710):speaking to another IOS box!
May 15 10:44:48.640: ISAKMP: (1710):processing vendor id payload
May 15 10:44:48.640: ISAKMP: (1710):vendor ID seems Unity/DPD but major 103 mismatch
May 15 10:44:48.641: ISAKMP: (1710):vendor ID is XAUTH
May 15 10:44:48.641: ISAKMP: (1710):received payload type 20
May 15 10:44:48.641: ISAKMP: (1710):His hash no match - this node outside NAT
May 15 10:44:48.641: ISAKMP: (1710):received payload type 20
May 15 10:44:48.641: ISAKMP: (1710):No NAT Found for self or peer
May 15 10:44:48.641: ISAKMP: (1710):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
May 15 10:44:48.641: ISAKMP: (1710):Old State = IKE_R_MM3 New State = IKE_R_MM3
May 15 10:44:48.641: ISAKMP-PAK: (1710):sending packet to 37.157.yyy.yyy my_port 500 peer_port 500 (R) MM_KEY_EXCH
May 15 10:44:48.641: ISAKMP: (1710):Sending an IKE IPv4 Packet.
May 15 10:44:48.641: ISAKMP: (1710):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
May 15 10:44:48.641: ISAKMP: (1710):Old State = IKE_R_MM3 New State = IKE_R_MM4
May 15 10:44:48.738: ISAKMP-PAK: (1710):received packet from 37.157.yyy.yyy dport 500 sport 500 Global (R) MM_KEY_EXCH
May 15 10:44:48.738: ISAKMP: (1710):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
May 15 10:44:48.738: ISAKMP: (1710):Old State = IKE_R_MM4 New State = IKE_R_MM5
May 15 10:44:48.738: ISAKMP: (1710):processing ID payload. message ID = 0
May 15 10:44:48.738: ISAKMP: (1710):ID payload
next-payload : 8
type : 1
May 15 10:44:48.738: ISAKMP: (1710): address : 37.157.yyy.yyy
May 15 10:44:48.738: ISAKMP: (1710): protocol : 17
port : 500
length : 12
May 15 10:44:48.738: ISAKMP: (1710):processing HASH payload. message ID = 0
May 15 10:44:48.738: ISAKMP: (1710):received payload type 17
May 15 10:44:48.738: ISAKMP: (1710):processing NOTIFY INITIAL_CONTACT protocol 1
spi 0, message ID = 0, sa = 0x80007F35AF96A4E0
May 15 10:44:48.738: ISAKMP: (1710):SA authentication status:
authenticated
May 15 10:44:48.738: ISAKMP: (1710):SA has been authenticated with 37.157.yyy.yyy
May 15 10:44:48.738: ISAKMP: (1710):SA authentication status:
authenticated
May 15 10:44:48.738: ISAKMP: (1710):Process initial contact,
bring down existing phase 1 and 2 SA's with local 185.167.xxx.xxx remote 37.157.yyy.yyy remote port 500
May 15 10:44:48.739: ISAKMP: (1710):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
May 15 10:44:48.739: ISAKMP: (1710):Old State = IKE_R_MM5 New State = IKE_R_MM5
May 15 10:44:48.739: Delete IPsec SA by IC, local 185.167.xxx.xxx remote 37.157.yyy.yyy peer port 500
May 15 10:44:48.739: IPSEC(delete_sa): SA found saving DEL kmi
May 15 10:44:48.740: ISAKMP-ERROR: (0):Failed to find peer index node to update peer_info_list
May 15 10:44:48.740: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel286, changed state to down the only keepalive enabled i see, is this: "crypto isakmp keepalive 10 10" Thank you.. The strange thing is that i tried to make everything but with the other source loopback IP. and it worked, i dont understand where is the issue.. P.S it seems something could be with this: ay 15 10:44:48.542: ISAKMP: (0):constructed NAT-T vendor-rfc3947 ID
May 15 10:44:48.542: ISAKMP-PAK: (0):sending packet to 37.157.yyy.yyy my_port 500 peer_port 500 (R) MM_SA_SETUP
May 15 10:44:48.542: ISAKMP: (0):Sending an IKE IPv4 Packet.
May 15 10:44:48.542: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
May 15 10:44:48.542: ISAKMP: (0):Old State = IKE_R_MM1 New State = IKE_R_MM2
May 15 10:44:48.638: ISAKMP-PAK: (0):received packet from 37.157.yyy.yyy dport 500 sport 500 Global (R) MM_SA_SETUP
May 15 10:44:48.638: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
May 15 10:44:48.638: ISAKMP: (0):Old State = IKE_R_MM2 New State = IKE_R_MM3 like it gets some new information and overwrites the tunnel session by bringing it up/down..
... View more
08-07-2019
my last question: As Northstar interfaces is 40GB ones.do change'ing
this hardware qos ns-buffer-pro...
08-04-2019
Thank you, i will dig about flow control thing. Ok, I could understand
that FEX is overwhelmed with ...
08-04-2019
thank you, im wondering how that supposed to help. That port where the
discards are occuring is FEX ...
08-03-2019
and maybe you can say - how to check the buffer interface has allocated
? to see if hardware burst p...
08-02-2019
Hello,We're experiencing output discards in couple of our N9K-C9372PXs.
Seems like egress queues fil...
07-31-2019
Thanks again,Strange thing is that these discards mainly occurs on
N9K-C9372-PX-E devices. We also h...
07-30-2019
thank you, so much. I want to try this: hardware qos ns-buffer-profile
ultra-burst.Maybe you know, i...
07-25-2019
Thank you, I just want to clarify: on which case the fragmentation
occurs1) If the router receives a...
07-24-2019
sorry, this is the output: show queuing interface ethernet 1/23 slot 1
======= Egress Queuing for Et...
07-24-2019
thank you, So as I understood the most problems occurs when the bigger
packets enters the device whi...
07-24-2019
Hello, In our DC we've 1500MTU, we're thinking of increasing it to
~9000. I was wondering do it have...
07-24-2019
hello, Here you are: show interface e1/23 Ethernet1/23 is up admin state
is up, Dedicated Interface ...
07-23-2019
Hello, I've got a DC topology where i get ingress traffic from 3x10GB
lagged interface which are egr...
Created by
from88
in Network Management
07-01-2019
07-01-2019
any help ? I tried to do the google search, bug search with that SNMP
FILL keywords, no results is f...
Public Statistics
| Date Registered | 04-29-2010 12:47 PM |
| Date Last Visited | 08-15-2019 11:36 PM |
| Total Messages Posted | 222 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 13 | |
| 21 | |
| 10 | |
| 64 | |
| 15 |
.jpg "Hall of Fame Expert"){kind=icon}
.jpg "VIP Mentor"){kind=icon}
