Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mario.jost
08-27-2019
Stats
Member since
04-22-2015
120
Posts
40
Helpful
6
Solutions
08-16-2019
02:06 AM
Thanks for your post. I was more interested in how to interpret the results like: Aug 12 17:17:16 CEST: 0x08 0xF6 0x00 0x00 0x0F 0x0F 0x00 0x00 (STACK_USER-3)
Aug 12 17:17:16 CEST: 0x00 0x00 0x00 0x00 0x03 0x07 0x06 0x06 (STACK_USER-3)
Aug 12 17:17:16 CEST: 0x00 0x20 0xAA 0x0F 0xFF 0x00 0x00 0x80 (STACK_USER-3)
Aug 12 17:17:16 CEST: 0x00 0x00 0x00 0x43 (STACK_USER-3)
Aug 12 17:17:16 CEST: (STACK_USER-3)
Aug 12 17:17:16 CEST: next reg: (STACK_USER-3)
Aug 12 17:17:16 CEST: 0x80 0xE4 0x00 0x00 0x00 0x00 0x52 0x00 (STACK_USER-3)
Aug 12 17:17:16 CEST: 0xC4 0x37 0x00 0x00 0x00 0x00 0x00 0x00 (STACK_USER-3)
Aug 12 17:17:16 CEST: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 (STACK_USER-3) What does 0x08 at which location exactly stand for? Do you have any table or tool for that?
... View more
07-08-2019
08:36 AM
We have similar issues and try to find out how we can recognize the ports affected. I very much appreciate you posting the hidden stuff about this command: test frontend-controller read-poe But we get a very different output on our devices than you do. Is there a chart somewhere on what these Hex codes (0xF6 and so on) represent? I googled alot but wasnt successful in finding any documentation from Cisco for that matter. Only other command i found was this: show controllers power inline module 1 But this does not show the defective PoE Ports. We have a switch in our lab that has port 1-8 (Power controller 0 and 1) defective and we want to test commands that could point these ports out on the CLI. We can then write a script that tests all ports in every country, rather than driving out each brach offices and testing the ports ourselfes. Your answer is very much appreciated. Thanks and best regards. Mario
... View more
05-16-2019
12:37 AM
So the bandwidth command is a QoS measure to guarantee the minimum bandwidth. But this wont limit the max bandwidth. Not sure if these switches support shaping. Try it with a policer: policy-map VDI_20M_OUT
class CLASS_VDI_OUT
police cir 20000000 conform-action transmit exceed-action drop The bandwidth is in bit/s so 20Mbit/s x 1000 gives you 20'000Kbit/s x 1000 gives you 20'000'000bit/s Cheers
... View more
05-13-2019
02:18 AM
On these switches, you can only prioritize based on a marking. So you have to do this in 2 steps: Step1: mark traffic based on classification Step2: prioritize based on marking So your configuration would look something like this: access-list 101 permit ip any host 192.168.211.101
class-map match-all CLASS_VDI_IN
match access-group 101
policy-map VDI_IN
class CLASS_VDI_IN
set dscp 32
class-map match-all CLASS_VDI_OUT
match ip dscp 32
policy-map VDI_20M_OUT
class CLASS_VDI_OUT
bandwidth 2
interface GigabitEthernet1/48
description all other interfaces
service-policy input VDI_IN
interface GigabitEthernet2/48
service-policy output VDI_20M_OUT So if course based on your setup you'd have to assign the incoming service policy to every interface where VDI traffic could come in. So most of the time it is pretty common to assign the incoming service-policy to every interface on your switch in order to catch and mark all traffic. Hope I could help out a little.
... View more
Created by
mario.jost
in Wireless Security and Network Management
in Wireless Security and Network Management
04-09-2019
11:48 PM
04-09-2019
11:48 PM
Thanks for the roundup. The thing is, we still bought 2602 APs long after 2802 APs were out. We had an older firmware to keep the 1142 models running. With this firmware, the newer models weren't supported. So now, we replaced all 1142 APs. But the version 8.5 keeps us now from buying 2902 AP's when they come out. So we still have to buy 2802 APs. Until a day, we replace all 2602 APs and can upgrade to a newer version, to then maybe be blocked from upgrading because the newest firmware does not support the 2802 APs anymore. So this sadly is a story that repeats itself over and over...
... View more
04-05-2019
08:03 AM
Great input. Sadly, this does only work for downloading stuff. If you try to upload something with following command: copy flash:vlan.dat http://someserver.company.local/vlan.txt It will still try to use the global routing instance instead of using the VRF where GigabitEthernet0 resides in. But nevertheless, your answer is closest to a solution, so i marked it. Thanks for sharing your wisdom with the human race.
... View more
Created by
mario.jost
in Wireless Security and Network Management
in Wireless Security and Network Management
04-04-2019
06:19 AM
04-04-2019
06:19 AM
We wanted to upgrade our WLC Software, but some of our hardware AP's are not supported anymore. We do have several 2600er models. Firmware 8.5.140.0 Released June, 2018 -> supports 2600 models Firmware 8.6.101.0 Released December 2017 -> does not support 2600 models So we checked the production date on all our 2600 APs. The most recent one was produced in July 2015 (serial FCW1930NKZW). So today, this AP is 3 years and 8 months old. Looking at the time, when firmware 8.6.101.0 was released, this AP was only 2 years and 4 months old. So this is a very short support time for a business oriented model. I was expecting something like 5 years from the production stop. Keep in mind that the AP wasn't delivered directly after production. It was sitting in a warehouse and maybe multiple distributors before we got our hands on. How is the general rules of thumb in the support time for AP models from Cisco?
... View more
- Tags:
- ap support time
- wlc
Labels:
03-22-2019
04:58 AM
So as far as i understand this post, you have connected two switches with 1 cable. But based on the error messages, it seems that these switches have an additional connection between them. SwitchA Gi1/0/12 - - - - - - - - - - Gi1/0/25 SwitchB
SwtichA Gi1/0/9 - - - - - - - - - - Gi1/0/26 SwitchB They dont have to be directly connected. It could be that there is another switch in between SwitchA Gi1/0/9 and SwitchB Gi1/0/26. So if you have 2 connections between a switch either you have to use a bundling technology like etherchannel or you one port should block traffic with spanning-tree. Can you do a show spanning-tree vlan1 to check if one of these ports are beeing blocked due to redundancy.
... View more
03-22-2019
02:14 AM
Dear network people We did have some issues with Dect stations that have a very high requirement in regards of delay. Communication between 2 devices should not exceed 500ns (0.5ms). With lots of different QoS configuration, we decided to make test the configuration with some ping statistics. So our setup is like this: DeviceA - - - - SwitchA - - - - SwitchB - - - - SwitchC - - - - SwitchD - - - - DeviceB We just did a 1h ping from DeviceA, that is a Windows 2016 Server on a ESXi, to DeviceB that is just a Windows 10 PC. First, we did a test without any QoS active, as a reference. Then, we put the ICMP traffic into DSCP18, so it has its own queue to use. This is the policy configuration on SwitchA and SwitchD: ip access-list extended QOS_ICMP_COLORING
permit icmp host 172.16.144.35 any
permit icmp any host 172.16.144.35
class-map match-any QOS_ICMP_COLORING
match access-group name QOS_ICMP_COLORING
policy-map QOS
class QOS_ICMP_COLORING
set dscp af21 SwitchA interface GigabitEthernet1/0/37 description DeviceA with IP 172.16.144.35 switchport trunk native vlan 10 switchport mode trunk power inline port 2x-mode mls qos trust dscp mls qos dscp-mutation HIDE spanning-tree portfast trunk service-policy input QOS end SwitchD interface GigabitEthernet1/0/5 description DeviceB with IP 172.16.144.243 switchport access vlan 10 switchport mode access power inline port 2x-mode mls qos trust dscp mls qos dscp-mutation HIDE spanning-tree portfast service-policy input QOS end Example uplink interface (same on all switches) interface GigabitEthernet1/0/47 description uplink switchport trunk native vlan 10 switchport mode trunk power inline port 2x-mode mls qos trust dscp mls qos dscp-mutation HIDE end Since, there is a fixed DSCP to Queue mapping on 2960X, we use a dscp-mutation map to overwrite all unwanted markings in the network, only allowing desired markings. So here is the mls qos part of the configuration: mls qos
mls qos map dscp-mutation HIDE 1 2 3 4 5 6 7 8 to 0
mls qos map dscp-mutation HIDE 9 10 11 12 13 14 15 16 to 0
mls qos map dscp-mutation HIDE 17 19 20 21 22 23 25 26 to 0
mls qos map dscp-mutation HIDE 27 28 29 30 31 33 34 35 to 0
mls qos map dscp-mutation HIDE 36 37 38 39 40 41 42 43 to 0
mls qos map dscp-mutation HIDE 44 45 47 48 49 50 51 52 to 0
mls qos map dscp-mutation HIDE 53 54 55 56 57 58 59 60 to 0
mls qos map dscp-mutation HIDE 61 62 63 to 0
SwitchA#show mls qos maps dscp-mutation HIDE
Dscp-dscp mutation map:
HIDE:
d1 : d2 0 1 2 3 4 5 6 7 8 9
---------------------------------------
0 : 00 00 00 00 00 00 00 00 00 00
1 : 00 00 00 00 00 00 00 00 18 00
2 : 00 00 00 00 24 00 00 00 00 00
3 : 00 00 32 00 00 00 00 00 00 00
4 : 00 00 00 00 00 00 46 00 00 00
5 : 00 00 00 00 00 00 00 00 00 00
6 : 00 00 00 00 We did not change any DSCP to Queue maping so this remains the default on all ports which is: queue 0: DSCP 40–47 Voice RTP
queue 1: DSCP 00–15 Class-default
queue 2: DSCP 16–31 Voice Signaling
queue 3: DSCP 32–39,48–63 Citrix & STP Since we do not use voice signaling (DSCP24) in this location, the ICMP traffic (DSCP18) can use the otherwise unused queue2. In the show mls qos statistics, we can see the DSCP18 markings. I verified the whole path, everything looks good so far. We use the default queue set settings. SwitchA#show mls qos interface gigabitEthernet 1/0/37 statistics GigabitEthernet1/0/37 (All statistics are in packets)
dscp: incoming
-------------------------------
0 - 4 : 1066030 0 0 0 0
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 0 0 0 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0
dscp: outgoing
-------------------------------
0 - 4 : 2038575 0 0 0 0
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 68618 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 679380 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 974219 0 0 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0 output queues enqueued: queue: threshold1 threshold2 threshold3 ----------------------------------------------- queue 0: 974219 0 0 queue 1: 6166478 1226 544798 queue 2: 72375 0 0 queue 3: 679900 0 0 output queues dropped: queue: threshold1 threshold2 threshold3 ----------------------------------------------- queue 0: 0 0 0 queue 1: 8 0 0 queue 2: 0 0 0 queue 3: 0 0 0 SwitchA#show mls qos queue-set 1 Queueset: 1 Queue : 1 2 3 4 ---------------------------------------------- buffers : 25 25 25 25 threshold1: 100 200 100 100 threshold2: 100 200 100 100 reserved : 50 50 50 50 maximum : 400 400 400 400 The thing that seems strange to me is, that the DSCP18 count on the mls qos statistics DSCP outgoing, do not match the output queues enqueued for queue2. But maybe this is normal. Saldy, our ping statistics haven't improved. So we changed the policy-map to set DSCP46 and activated priority-queue: policy-map QOS
class QOS_ICMP_COLORING
set dscp ef
interface GigabitEthernet1/0/5
description DeviceB with IP 172.16.144.243 switchport access vlan 10 switchport mode access
power inline port 2x-mode
priority-queue out
mls qos trust dscp
mls qos dscp-mutation HIDE
service-policy input QOS
end The service-policies have only been applied to the interfaces where the end devices are attached. The priority-queue has been enabled on all interfaces along the path (uplinks included). But this did not affect the ping statistics. This is a network with 21 switches, most of them in a star configuration. We did the test from the same server to 3 PC's simultaneously to get more reliable data. But we had the same picture everywhere. Here are the results: TC0686CQ swDAI15 no QoS TC0686CQ swDAI15 QoS (18) TC0686CQ swDAI15 QoS (46) Priority
More then 1ms 2872 More then 1ms 4872 More then 1ms 1870
More then 2ms 1012 More then 2ms 2080 More then 2ms 735
More then 3ms 123 More then 3ms 160 More then 3ms 449
More then 4ms 75 More then 4ms 246 More then 4ms 39
More then 5ms 64 More then 5ms 59 More then 5ms 29
Average (ms) 0.768 Average (ms) 0.935 Average (ms) 0.873
Maximum (ms) 26.5 Maximum (ms) 23 Maximum (ms) 26.3
Timeouts 0 Timeouts 0 Timeouts 0
TC0686JZ swDAI12 no QoS TC0686JZ swDAI12 QoS (18) TC0686JZ swDAI12 QoS (46) Priority
More then 1ms 2507 More then 1ms 2891 More then 1ms 746
More then 2ms 865 More then 2ms 1012 More then 2ms 385
More then 3ms 150 More then 3ms 894 More then 3ms 41
More then 4ms 106 More then 4ms 64 More then 4ms 19
More then 5ms 87 More then 5ms 73 More then 5ms 34
Average (ms) 0.866 Average (ms) 0.736 Average (ms) 0.679
Maximum (ms) 48.5 Maximum (ms) 59.3 Maximum (ms) 27.9
Timeouts 1 Timeouts 0 Timeouts 1
TC0868KD swDAI08 no QoS TC0868KD swDAI08 QoS (18) TC0868KD swDAI08 QoS (46) Priority
More then 1ms 3145 More then 1ms 1010 More then 1ms 406
More then 2ms 1095 More then 2ms 171 More then 2ms 154
More then 3ms 145 More then 3ms 134 More then 3ms 27
More then 4ms 63 More then 4ms 62 More then 4ms 11
More then 5ms 70 More then 5ms 43 More then 5ms 27
Average (ms) 0.737 Average (ms) 0.717 Average (ms) 0.703
Maximum (ms) 43.7 Maximum (ms) 40.3 Maximum (ms) 55.7
Timeouts 1 Timeouts 1 Timeouts 2 We always did 1 hour of testing with a ping every 50ms, thats 20 pings/second thats 72'000 pings/hour. The average is fine for me all the way thru, maybe this cannot be improved any more. But what bugs me are the maximums we can't get rid of even with priority-queue activated. Is there something we missed in our configuration? Only explanation for me is, that the delay is coming from the end devices. We cross referenced the values to see, if maybe the server was having some load, causing all the pings to be delayed at the same time, but this was not the case. Thanks for having a look into this long post.
... View more
Labels:
02-22-2019
06:16 AM
Had the same problem. you have to connect the uplink port to the WAN interface of the router to get it to work. It seems counter intuitive, as all routed ports are admin down per default. But this only happens after you negate the initial configuration dialog question:
Would you like to enter the initial configuration dialog? [yes/no]: no
Only switchports remain admin up after you selected no:
Router#show interfaces description
Interface Status Protocol Description
AT0 admin down down
BR0 admin down down
BR0:1 admin down down
BR0:2 admin down down
Et0 admin down down
Gi0 down down
Gi1 down down
Gi2 down down
Gi3 down down
Gi4 down down
Gi5 down down
Gi6 down down
Gi7 down down
Gi8 admin down down
Vl1 down down
But if you connect the uplink to the WAN port (Gi8) and be patient, you will see the router is trying to load the configuration files from the TFTP server that has been provided by DHCP option:
Installed image archive
Cisco C897VA-K9 (revision 1.0) with 488524K/35763K bytes of memory.
Processor board ID FCZ220510DX
1 DSL controller
1 Ethernet interface
9 Gigabit Ethernet interfaces
1 ISDN Basic Rate interface
1 ATM interface
1 Virtual Private Network (VPN) Module
DRAM configuration is 32 bits wide
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash (Read/Write)
--- System Configuration Dialog ---
Would you like to enter the initial configuration dialog? [yes/no]:
%Error opening tftp://172.16.20.89/network-confg (Timed out)
%Error opening tftp://172.16.20.89/cisconet.cfg (Timed out)
Loading roTST01-confg from 172.16.20.89 (via GigabitEthernet8): ! [OK - 4189 bytes] Domain server mapped address 172.16.20.89 to SRVMWTFT01.company.local
And there your configuration will be applied like you are used to from AutoInstall. Strangely, the assigned IP information is displayed just after the configuration has been applied:
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface VoIP-Null0, changed state to up
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface ATM0, changed state to down
*Feb 22 13:59:20.259: %LINK-3-UPDOWN: Interface Ethernet0, changed state to up
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0, changed state to down
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to down
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:2, changed state to down
*Feb 22 13:59:20.259: %LINK-3-UPDOWN: Interface GigabitEthernet8, changed state to up
*Feb 22 13:59:21.071: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
*Feb 22 13:59:21.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0, changed state to down
*Feb 22 13:59:21.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet8, changed state to up
*Feb 22 13:59:35.263: Setting system hostname to roTST01
*Feb 22 13:59:38.383: AUTOINSTALL: GigabitEthernet8 is assigned 172.16.22.8
*Feb 22 13:59:38.383: AUTOINSTALL: Obtain tftp server address (opt 150) 172.16.20.89
Hope im not too late with this information.
... View more
02-20-2019
10:52 AM
I tested an ugly but working approach, where i configure a kronjob within the initial configuration file:
kron policy-list CLEANUP
cli tclsh tftp://TFTPserver/cleanup.tcl
exit
kron occurrence CLEANUP in 1 oneshot
policy-list CLEANUP
exit
This, then runs the TCL script after 1 Minute. Within the script, i cleanup the kron configuration:
ios_config "no kron policy-list CLEANUP"
exec "write"
Since the kron occurence is oneshot, it cleans itself from the running-config after execution automagically.
... View more
02-20-2019
09:33 AM
Dear Leo
This is a great input. I actually created a TCL script that does what i want. I tested it manually with success, but when i try to call it in from within the configuration (do tclsh tftp://TFTPserver/cleanup.tcl) file, i get following error:
Launching Tcl shell is not allowed from the config mode.
Exit to exec mode and try again.
If i let go of the "do" and exit out of config mode, the script stops altogether without even trying to run the TCL script. So how am i supposed to start this post install script? is there another DHCP Option that i need to use for this? I couldn't find anything specific searching for this.
... View more
02-18-2019
06:38 AM
So far i couldn't manage to get the custom TAR file going. I tried, creating a TAR file with a switch, so it would create all necessary files itself. But it expects a folder to create an archive:
swTST01#archive tar /create flash1:c2960x-universalk9-mz.152-2.E7.tar flash1:c2960x-universalk9-mz.152-2.E7.bin
Unable to look up files and subdirs in flash1:c2960x-universalk9-mz.152-2.E7.bin
So I guess this is more "hardcoded" into the archive functionality than i thought. I will post updates here, if i found a solution for this.
... View more
02-14-2019
02:32 AM
I tested it manually. Just made the point that /imageonly does not help with the path issue. Great input.
... View more
02-14-2019
01:45 AM
We already tried the /imageonly switch. This just skips the HTML folder but still extracts the bin file to a folder:
Deleting `flash:c2960x-universalk9-mz.152-2.E6' to create required space Extracting images from archive into flash... extracting c2960x-universalk9-mz.152-2.E6/info (786 bytes) extracting c2960x-universalk9-mz.152-2.E6/c2960x-universalk9-mz.152-2.E6.bin (21279744 bytes) extracting info (109 bytes)
We use Autoinstall. We can only give the path to a TAR file. The switch then uses archive download-sw in the background. So we cant use the copy command. So the question remains. How can we modify the TAR file to get the BIN file to the root location?
... View more
08-16-2019
Thanks for your post. I was more interested in how to interpret the
results like:Aug 12 17:17:16 CES...
07-08-2019
We have similar issues and try to find out how we can recognize the
ports affected. I very much appr...
05-16-2019
So the bandwidth command is a QoS measure to guarantee the minimum
bandwidth. But this wont limit th...
05-13-2019
On these switches, you can only prioritize based on a marking. So you
have to do this in 2 steps:Ste...
Created by
mario.jost
in Wireless Security and Network Management
04-09-2019
04-09-2019
Thanks for the roundup. The thing is, we still bought 2602 APs long
after 2802 APs were out. We had ...
04-05-2019
Great input. Sadly, this does only work for downloading stuff. If you
try to upload something with f...
Created by
mario.jost
in Wireless Security and Network Management
04-04-2019
04-04-2019
We wanted to upgrade our WLC Software, but some of our hardware AP's are
not supported anymore. We d...
03-22-2019
So as far as i understand this post, you have connected two switches
with 1 cable. But based on the ...
03-22-2019
Dear network peopleWe did have some issues with Dect stations that have
a very high requirement in r...
02-22-2019
Had the same problem. you have to connect the uplink port to the WAN
interface of the router to get ...
02-20-2019
I tested an ugly but working approach, where i configure a kronjob
within the initial configuration ...
02-20-2019
Dear Leo This is a great input. I actually created a TCL script that
does what i want. I tested it m...
02-18-2019
So far i couldn't manage to get the custom TAR file going. I tried,
creating a TAR file with a switc...
02-14-2019
I tested it manually. Just made the point that /imageonly does not help
with the path issue. Great i...
Public Statistics
| Date Registered | 04-22-2015 05:02 AM |
| Date Last Visited | 08-27-2019 06:58 AM |
| Total Messages Posted | 120 |
| Total Helpful Votes Received | 40 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
.jpg "Hall of Fame Guru"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
