Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mario.jost
04-10-2019
mario.jost
Member since
04-22-2015
Beginner
Created by
mario.jost
in Wireless Security and Network Management
in Wireless Security and Network Management
04-09-2019
11:48 PM
04-09-2019
11:48 PM
Thanks for the roundup. The thing is, we still bought 2602 APs long after 2802 APs were out. We had an older firmware to keep the 1142 models running. With this firmware, the newer models weren't supported. So now, we replaced all 1142 APs. But the version 8.5 keeps us now from buying 2902 AP's when they come out. So we still have to buy 2802 APs. Until a day, we replace all 2602 APs and can upgrade to a newer version, to then maybe be blocked from upgrading because the newest firmware does not support the 2802 APs anymore. So this sadly is a story that repeats itself over and over...
... View more
04-05-2019
08:03 AM
Great input. Sadly, this does only work for downloading stuff. If you try following command: copy flash:vlan.dat http://someserver.company.local/vlan.txt It will still try to use the global routing instance instead of using the VRF where GigabitEthernet0 resides in. But nevertheless, your answer is closest to a solution, so i marked it. Thanks for sharing your wisdom with the human race.
... View more
Created by
mario.jost
in Wireless Security and Network Management
in Wireless Security and Network Management
04-04-2019
06:19 AM
04-04-2019
06:19 AM
We wanted to upgrade our WLC Software, but some of our hardware AP's are not supported anymore. We do have several 2600er models. Firmware 8.5.140.0 Released June, 2018 -> supports 2600 models Firmware 8.6.101.0 Released December 2017 -> does not support 2600 models So we checked the production date on all our 2600 APs. The most recent one was produced in July 2015 (serial FCW1930NKZW). So today, this AP is 3 years and 8 months old. Looking at the time, when firmware 8.6.101.0 was released, this AP was only 2 years and 4 months old. So this is a very short support time for a business oriented model. I was expecting something like 5 years from the production stop. Keep in mind that the AP wasn't delivered directly after production. It was sitting in a warehouse and maybe multiple distributors before we got our hands on. How is the general rules of thumb in the support time for AP models from Cisco?
... View more
- Tags:
- ap support time
- wlc
Labels:
03-22-2019
04:58 AM
So as far as i understand this post, you have connected two switches with 1 cable. But based on the error messages, it seems that these switches have an additional connection between them. SwitchA Gi1/0/12 - - - - - - - - - - Gi1/0/25 SwitchB
SwtichA Gi1/0/9 - - - - - - - - - - Gi1/0/26 SwitchB They dont have to be directly connected. It could be that there is another switch in between SwitchA Gi1/0/9 and SwitchB Gi1/0/26. So if you have 2 connections between a switch either you have to use a bundling technology like etherchannel or you one port should block traffic with spanning-tree. Can you do a show spanning-tree vlan1 to check if one of these ports are beeing blocked due to redundancy.
... View more
03-22-2019
02:14 AM
Dear network people We did have some issues with Dect stations that have a very high requirement in regards of delay. Communication between 2 devices should not exceed 500ns (0.5ms). With lots of different QoS configuration, we decided to make test the configuration with some ping statistics. So our setup is like this: DeviceA - - - - SwitchA - - - - SwitchB - - - - SwitchC - - - - SwitchD - - - - DeviceB We just did a 1h ping from DeviceA, that is a Windows 2016 Server on a ESXi, to DeviceB that is just a Windows 10 PC. First, we did a test without any QoS active, as a reference. Then, we put the ICMP traffic into DSCP18, so it has its own queue to use. This is the policy configuration on SwitchA and SwitchD: ip access-list extended QOS_ICMP_COLORING
permit icmp host 172.16.144.35 any
permit icmp any host 172.16.144.35
class-map match-any QOS_ICMP_COLORING
match access-group name QOS_ICMP_COLORING
policy-map QOS
class QOS_ICMP_COLORING
set dscp af21 SwitchA interface GigabitEthernet1/0/37 description DeviceA with IP 172.16.144.35 switchport trunk native vlan 10 switchport mode trunk power inline port 2x-mode mls qos trust dscp mls qos dscp-mutation HIDE spanning-tree portfast trunk service-policy input QOS end SwitchD interface GigabitEthernet1/0/5 description DeviceB with IP 172.16.144.243 switchport access vlan 10 switchport mode access power inline port 2x-mode mls qos trust dscp mls qos dscp-mutation HIDE spanning-tree portfast service-policy input QOS end Example uplink interface (same on all switches) interface GigabitEthernet1/0/47 description uplink switchport trunk native vlan 10 switchport mode trunk power inline port 2x-mode mls qos trust dscp mls qos dscp-mutation HIDE end Since, there is a fixed DSCP to Queue mapping on 2960X, we use a dscp-mutation map to overwrite all unwanted markings in the network, only allowing desired markings. So here is the mls qos part of the configuration: mls qos
mls qos map dscp-mutation HIDE 1 2 3 4 5 6 7 8 to 0
mls qos map dscp-mutation HIDE 9 10 11 12 13 14 15 16 to 0
mls qos map dscp-mutation HIDE 17 19 20 21 22 23 25 26 to 0
mls qos map dscp-mutation HIDE 27 28 29 30 31 33 34 35 to 0
mls qos map dscp-mutation HIDE 36 37 38 39 40 41 42 43 to 0
mls qos map dscp-mutation HIDE 44 45 47 48 49 50 51 52 to 0
mls qos map dscp-mutation HIDE 53 54 55 56 57 58 59 60 to 0
mls qos map dscp-mutation HIDE 61 62 63 to 0
SwitchA#show mls qos maps dscp-mutation HIDE
Dscp-dscp mutation map:
HIDE:
d1 : d2 0 1 2 3 4 5 6 7 8 9
---------------------------------------
0 : 00 00 00 00 00 00 00 00 00 00
1 : 00 00 00 00 00 00 00 00 18 00
2 : 00 00 00 00 24 00 00 00 00 00
3 : 00 00 32 00 00 00 00 00 00 00
4 : 00 00 00 00 00 00 46 00 00 00
5 : 00 00 00 00 00 00 00 00 00 00
6 : 00 00 00 00 We did not change any DSCP to Queue maping so this remains the default on all ports which is: queue 0: DSCP 40–47 Voice RTP
queue 1: DSCP 00–15 Class-default
queue 2: DSCP 16–31 Voice Signaling
queue 3: DSCP 32–39,48–63 Citrix & STP Since we do not use voice signaling (DSCP24) in this location, the ICMP traffic (DSCP18) can use the otherwise unused queue2. In the show mls qos statistics, we can see the DSCP18 markings. I verified the whole path, everything looks good so far. We use the default queue set settings. SwitchA#show mls qos interface gigabitEthernet 1/0/37 statistics GigabitEthernet1/0/37 (All statistics are in packets)
dscp: incoming
-------------------------------
0 - 4 : 1066030 0 0 0 0
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 0 0 0 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0
dscp: outgoing
-------------------------------
0 - 4 : 2038575 0 0 0 0
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 68618 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 679380 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 974219 0 0 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0 output queues enqueued: queue: threshold1 threshold2 threshold3 ----------------------------------------------- queue 0: 974219 0 0 queue 1: 6166478 1226 544798 queue 2: 72375 0 0 queue 3: 679900 0 0 output queues dropped: queue: threshold1 threshold2 threshold3 ----------------------------------------------- queue 0: 0 0 0 queue 1: 8 0 0 queue 2: 0 0 0 queue 3: 0 0 0 SwitchA#show mls qos queue-set 1 Queueset: 1 Queue : 1 2 3 4 ---------------------------------------------- buffers : 25 25 25 25 threshold1: 100 200 100 100 threshold2: 100 200 100 100 reserved : 50 50 50 50 maximum : 400 400 400 400 The thing that seems strange to me is, that the DSCP18 count on the mls qos statistics DSCP outgoing, do not match the output queues enqueued for queue2. But maybe this is normal. Saldy, our ping statistics haven't improved. So we changed the policy-map to set DSCP46 and activated priority-queue: policy-map QOS
class QOS_ICMP_COLORING
set dscp ef
interface GigabitEthernet1/0/5
description DeviceB with IP 172.16.144.243 switchport access vlan 10 switchport mode access
power inline port 2x-mode
priority-queue out
mls qos trust dscp
mls qos dscp-mutation HIDE
service-policy input QOS
end The service-policies have only been applied to the interfaces where the end devices are attached. The priority-queue has been enabled on all interfaces along the path (uplinks included). But this did not affect the ping statistics. This is a network with 21 switches, most of them in a star configuration. We did the test from the same server to 3 PC's simultaneously to get more reliable data. But we had the same picture everywhere. Here are the results: TC0686CQ swDAI15 no QoS TC0686CQ swDAI15 QoS (18) TC0686CQ swDAI15 QoS (46) Priority
More then 1ms 2872 More then 1ms 4872 More then 1ms 1870
More then 2ms 1012 More then 2ms 2080 More then 2ms 735
More then 3ms 123 More then 3ms 160 More then 3ms 449
More then 4ms 75 More then 4ms 246 More then 4ms 39
More then 5ms 64 More then 5ms 59 More then 5ms 29
Average (ms) 0.768 Average (ms) 0.935 Average (ms) 0.873
Maximum (ms) 26.5 Maximum (ms) 23 Maximum (ms) 26.3
Timeouts 0 Timeouts 0 Timeouts 0
TC0686JZ swDAI12 no QoS TC0686JZ swDAI12 QoS (18) TC0686JZ swDAI12 QoS (46) Priority
More then 1ms 2507 More then 1ms 2891 More then 1ms 746
More then 2ms 865 More then 2ms 1012 More then 2ms 385
More then 3ms 150 More then 3ms 894 More then 3ms 41
More then 4ms 106 More then 4ms 64 More then 4ms 19
More then 5ms 87 More then 5ms 73 More then 5ms 34
Average (ms) 0.866 Average (ms) 0.736 Average (ms) 0.679
Maximum (ms) 48.5 Maximum (ms) 59.3 Maximum (ms) 27.9
Timeouts 1 Timeouts 0 Timeouts 1
TC0868KD swDAI08 no QoS TC0868KD swDAI08 QoS (18) TC0868KD swDAI08 QoS (46) Priority
More then 1ms 3145 More then 1ms 1010 More then 1ms 406
More then 2ms 1095 More then 2ms 171 More then 2ms 154
More then 3ms 145 More then 3ms 134 More then 3ms 27
More then 4ms 63 More then 4ms 62 More then 4ms 11
More then 5ms 70 More then 5ms 43 More then 5ms 27
Average (ms) 0.737 Average (ms) 0.717 Average (ms) 0.703
Maximum (ms) 43.7 Maximum (ms) 40.3 Maximum (ms) 55.7
Timeouts 1 Timeouts 1 Timeouts 2 We always did 1 hour of testing with a ping every 50ms, thats 20 pings/second thats 72'000 pings/hour. The average is fine for me all the way thru, maybe this cannot be improved any more. But what bugs me are the maximums we can't get rid of even with priority-queue activated. Is there something we missed in our configuration? Only explanation for me is, that the delay is coming from the end devices. We cross referenced the values to see, if maybe the server was having some load, causing all the pings to be delayed at the same time, but this was not the case. Thanks for having a look into this long post.
... View more
Labels:
02-22-2019
06:16 AM
Had the same problem. you have to connect the uplink port to the WAN interface of the router to get it to work. It seems counter intuitive, as all routed ports are admin down per default. But this only happens after you negate the initial configuration dialog question:
Would you like to enter the initial configuration dialog? [yes/no]: no
Only switchports remain admin up after you selected no:
Router#show interfaces description
Interface Status Protocol Description
AT0 admin down down
BR0 admin down down
BR0:1 admin down down
BR0:2 admin down down
Et0 admin down down
Gi0 down down
Gi1 down down
Gi2 down down
Gi3 down down
Gi4 down down
Gi5 down down
Gi6 down down
Gi7 down down
Gi8 admin down down
Vl1 down down
But if you connect the uplink to the WAN port (Gi8) and be patient, you will see the router is trying to load the configuration files from the TFTP server that has been provided by DHCP option:
Installed image archive
Cisco C897VA-K9 (revision 1.0) with 488524K/35763K bytes of memory.
Processor board ID FCZ220510DX
1 DSL controller
1 Ethernet interface
9 Gigabit Ethernet interfaces
1 ISDN Basic Rate interface
1 ATM interface
1 Virtual Private Network (VPN) Module
DRAM configuration is 32 bits wide
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash (Read/Write)
--- System Configuration Dialog ---
Would you like to enter the initial configuration dialog? [yes/no]:
%Error opening tftp://172.16.20.89/network-confg (Timed out)
%Error opening tftp://172.16.20.89/cisconet.cfg (Timed out)
Loading roTST01-confg from 172.16.20.89 (via GigabitEthernet8): ! [OK - 4189 bytes] Domain server mapped address 172.16.20.89 to SRVMWTFT01.company.local
And there your configuration will be applied like you are used to from AutoInstall. Strangely, the assigned IP information is displayed just after the configuration has been applied:
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface VoIP-Null0, changed state to up
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface ATM0, changed state to down
*Feb 22 13:59:20.259: %LINK-3-UPDOWN: Interface Ethernet0, changed state to up
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0, changed state to down
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to down
*Feb 22 13:59:20.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:2, changed state to down
*Feb 22 13:59:20.259: %LINK-3-UPDOWN: Interface GigabitEthernet8, changed state to up
*Feb 22 13:59:21.071: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
*Feb 22 13:59:21.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0, changed state to down
*Feb 22 13:59:21.259: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet8, changed state to up
*Feb 22 13:59:35.263: Setting system hostname to roTST01
*Feb 22 13:59:38.383: AUTOINSTALL: GigabitEthernet8 is assigned 172.16.22.8
*Feb 22 13:59:38.383: AUTOINSTALL: Obtain tftp server address (opt 150) 172.16.20.89
Hope im not too late with this information.
... View more
02-20-2019
10:52 AM
I tested an ugly but working approach, where i configure a kronjob within the initial configuration file:
kron policy-list CLEANUP
cli tclsh tftp://TFTPserver/cleanup.tcl
exit
kron occurrence CLEANUP in 1 oneshot
policy-list CLEANUP
exit
This, then runs the TCL script after 1 Minute. Within the script, i cleanup the kron configuration:
ios_config "no kron policy-list CLEANUP"
exec "write"
Since the kron occurence is oneshot, it cleans itself from the running-config after execution automagically.
... View more
02-20-2019
09:33 AM
Dear Leo
This is a great input. I actually created a TCL script that does what i want. I tested it manually with success, but when i try to call it in from within the configuration (do tclsh tftp://TFTPserver/cleanup.tcl) file, i get following error:
Launching Tcl shell is not allowed from the config mode.
Exit to exec mode and try again.
If i let go of the "do" and exit out of config mode, the script stops altogether without even trying to run the TCL script. So how am i supposed to start this post install script? is there another DHCP Option that i need to use for this? I couldn't find anything specific searching for this.
... View more
02-18-2019
06:38 AM
So far i couldn't manage to get the custom TAR file going. I tried, creating a TAR file with a switch, so it would create all necessary files itself. But it expects a folder to create an archive:
swTST01#archive tar /create flash1:c2960x-universalk9-mz.152-2.E7.tar flash1:c2960x-universalk9-mz.152-2.E7.bin
Unable to look up files and subdirs in flash1:c2960x-universalk9-mz.152-2.E7.bin
So I guess this is more "hardcoded" into the archive functionality than i thought. I will post updates here, if i found a solution for this.
... View more
02-14-2019
02:32 AM
I tested it manually. Just made the point that /imageonly does not help with the path issue. Great input.
... View more
02-14-2019
01:45 AM
We already tried the /imageonly switch. This just skips the HTML folder but still extracts the bin file to a folder:
Deleting `flash:c2960x-universalk9-mz.152-2.E6' to create required space Extracting images from archive into flash... extracting c2960x-universalk9-mz.152-2.E6/info (786 bytes) extracting c2960x-universalk9-mz.152-2.E6/c2960x-universalk9-mz.152-2.E6.bin (21279744 bytes) extracting info (109 bytes)
We use Autoinstall. We can only give the path to a TAR file. The switch then uses archive download-sw in the background. So we cant use the copy command. So the question remains. How can we modify the TAR file to get the BIN file to the root location?
... View more
02-14-2019
01:03 AM
Dear community
We would like to remove the folder from within a TAR file, so that the bin file is located at the root of the TAR archive. A typical TAR file has following structure:
Root
|c2960x-universalk9-mz.152-2.E6 |html |lots of files |c2960x-universalk9-mz.152-2.E6.bin |dc_default_profiles.txt |info
|info
Folders are in blue, files are green. So as far as i tested, i can remove the html folder and the dc_default_profiles.txt without any impact. But as soon as i remove one of the 2 info files, i get following error trying to apply the image:
ERROR: Image is not a valid IOS image archive.
So, how can i achieve to get the bin file to root, without the error when applying the image? I somehow have to merge the 2 info files im afraid. Content of the root info file:
Root/info
system_type: 0x00000000: c2960x-universalk9-mz.152-2.E6
image_family: C2960X
stacking_number: 1.56
info_end:
And the one in the folder:
Root/c2960x-universalk9-mz.152-2.E6/info
version_suffix: universalk9-152-2.E6
version_directory: c2960x-universalk9-mz.152-2.E6
image_system_type_id: 0x00000000
image_name: c2960x-universalk9-mz.152-2.E6.bin
ios_image_file_size: 21289472
total_image_file_size: 26911232
image_feature: IP|LAYER_2|SSH|3DES|MIN_DRAM_MEG=128
image_family: C2960X
stacking_number: 1.56
board_ids: 0x00008888 0x000088a2 0x000088a6 0x000088a5 0x000088a3 0x00000208 0x00000209 0x000001fa 0x000001f8 0x000001f9 0x000001f7 0x0000020a 0x000001fe 0x000001fc 0x000001fd 0x000001fb 0x00000200 0x00000201 0x00000243 0x00000244 0x00000246 0x00000245 0x00000247 0x00000248 0x00000249 0x0000024b 0x0000024a 0x0000024c 0x0000024d 0x0000024e 0x00000250 0x0000024f 0x00000251 0x00000252 0x00000253 0x00000255 0x00000254 0x00000256 0x0000025b 0x0000025a
info_end:
Has anyone ever tried to achieve something like this? I know there will be that one question: "Why u wanna do dis?"
... View more
Labels:
02-14-2019
12:50 AM
Just to sum this topic up. After we tried to get APIC-EM Working for 2 days (absolute nightmare product) we ended up using AUTOINSTALL on the switch side, and combine it with a internal Website, that generates configuration on the fly, uploads them to the TFTP server and sets corresponding DHCP options for the scopes, the switches needs to be setup. If anyone is interested in AUTOINSTALL, here is a short blog post that covers everything important: http://itblog.antik.sk/?p=3
... View more
02-11-2019
03:39 AM
OK, thank you very much for this informaiton. I just checked this and can confirm that the vstack is gone. Tested IOS version 15.2(4)E7 released in September 2018.
Knowing that, smart install isn't an option as this path sadly has no future...
... View more
02-11-2019
01:57 AM
You wrote:
" Please be aware that any IOS/IOS-XE releases after July 2018 "vstack" is permanently disabled "
Do you mean, no vstack will be in the default configuration (show running-config all) from that point on, or do you mean that vstack isn't supported at all on all IOS versions in the future?
Thanks and best regards, Mario
... View more
Created by
mario.jost
in Wireless Security and Network Management
2 weeks ago
2 weeks ago
Thanks for the roundup. The thing is, we still bought 2602 APs long
after 2802 APs were out. We had ...
3 weeks ago
Great input. Sadly, this does only work for downloading stuff. If you
try following command:copy fla...
Created by
mario.jost
in Wireless Security and Network Management
3 weeks ago
3 weeks ago
We wanted to upgrade our WLC Software, but some of our hardware AP's are
not supported anymore. We d...
03-22-2019 04:58 AM
So as far as i understand this post, you have connected two switches
with 1 cable. But based on the ...
Created by
mario.jost
in Switching
03-22-2019 02:14 AM
03-22-2019 02:14 AM
Dear network peopleWe did have some issues with Dect stations that have
a very high requirement in r...
Created by
mario.jost
in Switching
02-22-2019 06:16 AM
02-22-2019 06:16 AM
Had the same problem. you have to connect the uplink port to the WAN
interface of the router to get ...
02-20-2019 10:52 AM
I tested an ugly but working approach, where i configure a kronjob
within the initial configuration ...
02-20-2019 09:33 AM
Dear Leo This is a great input. I actually created a TCL script that
does what i want. I tested it m...
02-18-2019 06:38 AM
So far i couldn't manage to get the custom TAR file going. I tried,
creating a TAR file with a switc...
02-14-2019 02:32 AM
I tested it manually. Just made the point that /imageonly does not help
with the path issue. Great i...
02-14-2019 01:45 AM
We already tried the /imageonly switch. This just skips the HTML folder
but still extracts the bin f...
02-14-2019 01:03 AM
Dear community We would like to remove the folder from within a TAR
file, so that the bin file is lo...
02-14-2019 12:50 AM
Just to sum this topic up. After we tried to get APIC-EM Working for 2
days (absolute nightmare prod...
02-11-2019 03:39 AM
OK, thank you very much for this informaiton. I just checked this and
can confirm that the vstack is...
Public Statistics
| Date Registered | 04-22-2015 05:02 AM |
| Date Last Visited | 04-10-2019 03:11 AM |
| Total Messages Posted | 116 |
| Total Helpful Votes Received | 35 |
Helpful Votes Given To
.jpg "Hall of Fame Guru"){kind=icon}
Helpful Votes From
.jpg "VIP Advocate"){kind=icon}
