Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mocnikr
Online
Stats
Member since
01-03-2019
52
Posts
20
Helpful
3
Solutions
Created by
mocnikr
in Wireless and Mobility
in Wireless and Mobility
09-02-2019
05:01 AM
09-02-2019
05:01 AM
Yeah multiple APs. I opened TAC issue. Waiting.
... View more
Created by
mocnikr
in Wireless and Mobility
in Wireless and Mobility
09-02-2019
12:44 AM
09-02-2019
12:44 AM
Hello I noticed a radio issue with IW3702 APs running version 8.5.140.0 and FC mode. Looking at the logs on the APs I noticed a bunch of radio reset codes similar to those below. I did some searching online and I found a bug with the same issue for a different model AP and mode described here CSCvn56211. So I upgraded APs to the suggested version 8.5.151.0 however, the issue still remains. *Sep 1 10:05:43.651: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio0 due to the reason code 42
*Sep 1 10:05:43.659: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio0 due to the reason code 56
*Sep 1 10:05:43.659: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio0 due to the reason code 21
*Sep 1 10:05:43.663: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Sep 1 10:05:43.671: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio1 due to the reason code 42
*Sep 1 10:05:43.675: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio1 due to the reason code 27
*Sep 1 10:05:43.675: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Sep 1 10:05:43.679: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to administratively down
*Sep 1 10:05:44.291: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio1 due to the reason code 56
*Sep 1 10:05:44.291: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio1 due to the reason code 21
*Sep 1 10:05:44.291: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio0 due to the reason code 10
*Sep 1 10:05:44.291: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio1 due to the reason code 10 Does anyone have a similar issue? Rudi
... View more
Labels:
08-28-2019
10:44 AM
Hmm this is kinda confusing the "Traps" term being used in regards to syslog as well as SNMP. By just doing the "logging host" command I believe it enabled Informational level by default and the syslog was already being sent to the remote server. If you want to limit the level you can use the command you suggested "logging trap". When looking at the output of "show logging" it says "Trap logging: level informational ...." and after the "logging trap 3" command it now says "Trap logging: errors ..."
... View more
08-28-2019
06:02 AM
Hi I have a Cisco 2960X switch and I want to send syslog to external server. I configured it with logging host {ip_address} What level logs are sent to the host by default? Is there a way to change this level? I cannot find any info on this online. Is this the log level set on console or the buffer perhaps?
... View more
- Tags:
- syslog
Labels:
08-08-2019
11:58 PM
I understand that license levels can be upgraded, say from LAN Base to IP Base, however I cannot find any useful info on the web for downgrades. I don't need IP base features and I already have 2x 3850-24XU-L stacked as mentioned. The problem I have is that optical switches in 3850 series do not come in LAN Base. I again went through data sheet and found this ... " The 12-port and 24-port SFP+- and SFP-based models as well as the 48-port SFP+ model can only be ordered with IP Base or IP Services licenses. Therefore, in order to stack with LAN Base models, they need to be configured in LAN Base mode from the CLI." Has anyone tried the downgrade to LAN base on 3850-12S-S or 3850-12XS-S switch and stack with other -L switches? I guess the above command will do the job. Can anyone confirm?
... View more
08-08-2019
11:56 PM
Hey I have a similar situation. I am thinking of ordering 3850-12XS-S to add to an existing stack of 2x 3850-24XU-L switches. Will I be able to add XS to the stack with the downgrade command? Thanks
... View more
08-08-2019
06:40 AM
Hi I am planning on expanding a current stack of 2x WS-C3850-24XU-L with a 1x WS-C3850-12XS-S and 2x WS-C3850-24T-L. I've read through the stacking guides and it says: ".. all switches in one stack must have the same version of IOS XE and the same feature set license. A mixed stack of LAN base switches with IP base or IP services is not supported. Since the 12XS-S is not available in LAN Base version (-L) how can I make this work. I've read something about downgrading from IP Base to LAN Base with license boot level lanbase Can anyone confirm this stacking will work if I use the above command on 12XS-S?
... View more
Labels:
Created by
mocnikr
in Networking Documents
in Networking Documents
07-30-2019
02:15 AM
07-30-2019
02:15 AM
I have another connection issue but this time I am trying to join vEdgeCloud 19.1.0 to controllers running 18.4.1. According to compatibility matrix that should not be an issue. I've done the following that worked on 18.4.1 vedges: Do the initial config on vedge (org, system-ip, vbond, site-id) and set ip on vpn0 and vpn 512 and next hop for vpn0 I've installed Enterprise CA root cert on the vedge Activated vedge with a chassis-id and token already imported on vManage At this point it showed up as "Autorized by vBond" and moved on to making connections to vManage I signed the CSR on my CA and installed the cert At this point the vedge went back to vBond and is stuck there with REMOTE ERROR: BIDNTVRFD I went onto vManage and sent serial number to controllers manually multiple times and the proccess succeded but the vEdge was still stuck. I've also made sure the time on all devices is synced. Moreover I went through deleteing all certs (root and vedge') and reinstalled them with no luck of getting any further. I went on and did the debug on vedge: local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: create_ssl_conn_to_peer[5721]: %VDAEMON_DBG_MISC-3: SSL : Connecting to peer from ge0_0 to 10.0.0.3:12346
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: create_ssl_conn_to_peer[5727]: %VDAEMON_DBG_MISC-3: SSL_connect ERR_WANT (server 10.0.0.3:12346) ... retrying
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vdaemon_verify_callback[409]: %VDAEMON_DBG_MISC-1: Verify failed: self signed certificate! No need to panic!!
local7.debug: Jul 30 09:28:24 vEdge30 last message repeated 2 times
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: ssl_connect_timer_cb[408]: %VDAEMON_DBG_MISC-3: SSL_connect succeeded from ge0_0 to 10.0.0.3:12346
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vbond_parse_msg[2146]: %VDAEMON_DBG_MISC-3: Received a Challenge request from the Server
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vbond_parse_challenge[6480]: %VDAEMON_DBG_MISC-3: Parsing CHALLENGE ..
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vbond_proc_challenge[4298]: %VDAEMON_DBG_MISC-3: Received CHALLENGE on ge0_0..
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vdaemon_dtls_verify_vbond_cert[798]: %VDAEMON_DBG_MISC-3: Certificate validation Successful
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vdaemon_dtls_verify_vbond_cert[812]: %VDAEMON_DBG_MISC-3: O-name vIPtela Inc, OU name SRC Internal (in cfg SRC Internal)
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vdaemon_mark_n_sweep_vmanage_serial_numbers[4227]: %VDAEMON_DBG_MISC-3: vManage serial file DB does not exist yet. Add all.
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vdaemon_send_challenge_ack[4624]: %VDAEMON_DBG_MISC-3: Send Challenge ACK ... (board_id_present No)
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vbond_parse_msg[2166]: %VDAEMON_DBG_MISC-3: Received a TEAR DOWN from the peer
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vbond_parse_tear_down[6912]: %VDAEMON_DBG_MISC-3: Parsing TEAR DOWN..
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vbond_proc_msg[5801]: %VDAEMON_DBG_MISC-3: Received a TEAR DOWN (dev type 4) (teardown Just this peer) on ge0_0
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vdaemon_find_next_active_wan_intf[1465]: %VDAEMON_DBG_MISC-1: Next wan interface to connect to vmanage = none
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vdaemon_cleanup_peer_frag[1777]: %VDAEMON_DBG_MISC-3: Cleanup Fragments ..
local7.debug: Jul 30 09:28:24 vEdge30 VDAEMON[880]: vdaemon_ftm_send_ctrl_tun[242]: %VDAEMON_DBG_MISC-3: Local-TLOC 10.0.0.30:12346 Remote-TLOC 10.0.0.3:12346 msg-type Delete I found some clues (red marked) but I am not sure what exactly those mean. vBond is supposed to authenticate vEdge via valid-vedge list and tell the vEdge the ip of valid vManage right? So I went onto the vBond and did this: As you can see there are valid vSmarts and vEdges (including the one stuck - serial number 12) but the vManage list is empty. Is that expected? Note that I have other vEdges joined but the fact that the list is empty is a bit strange. Why is vEdge not sending its board_id (is this chassis-id?)? I assume due to this vBond doesn't know who is trying to autehnticate and tears down the connection. Any hint on what should I do next?
... View more
Created by
mocnikr
in Networking Documents
in Networking Documents
07-28-2019
09:31 PM
07-28-2019
09:31 PM
Ok great. Thanks for confirmation. I've sucessfully joined vEdges the manual way.
... View more
Created by
mocnikr
in Networking Documents
in Networking Documents
07-25-2019
01:59 AM
07-25-2019
01:59 AM
Thank you for this excellent post. I have another problem not mention in the post. I built a test lab on ESXi and I am using my own CA (tinyCA) for signing CSRs and issue certificates. I was able to onboard vmanage, vbond and vsmart with signed certificates from tinyCA. Next I performed initial config on vEdge and installed root cert from my CA. It has been successfully authorized by vBond however in the vManage it shows with "Certificate installation failed" status. I am aware that there is an option "WAN Edge Cloud Certificate Authorization" which is currently set to Automated. My question: Is Automated option supported when using private CA? Can you describe what goes on in the vManage when Automated option is enabled or please point me to an article. Note that I was able to onboard vEdge when switching "WAN Edge Cloud Certificate Authorization" to Manual and signing the CSR on my CA but I want it to happen automatically. Rudi
... View more
Created by
mocnikr
in Wireless Security and Network Management
in Wireless Security and Network Management
06-30-2019
12:16 AM
06-30-2019
12:16 AM
Hi all I am studying for the CCNP Wireless exam and I am trying to figure out some things that seem very similar and I want to verify my understanding of the topics. I've done quite a bit of reading already and I am suspecting that some terms are being used interchangeably so here I am asking you guys to clarify. I am aware that security features mentioned are available on wired side however, note that this is for a Wireless certification so I am really interested on wlc/ap configuration and features. I see two issues when it comes to DHCP address assignment. #1 Where DHCP offers comes from (port) - sort of L2 protection #2 What IP DHCP offers come from (source IP) - sort of L3 protection I relate these things to DHCP snooping and IP source guard on the wired side and am searching for Wireless options. I wonder if it is even possible to set up or logical to talk about L2 protection on the wireless side. Is ensuring that DHCP offers are coming from a valid DHCP server IP address good enough? Let me know some thoughts on these before me move to the actual features. There are these two topics related to DHCP security features (I noticed one is general IPv4 I suppose and the other is IPv6. However, I assume we can generalise things for the sake of understanding and be more specific when discussing configuration options): DHCP Server Guard DHCPv6 Source Guard - In the Cisco documentation: "... feature prevents wireless clients from handing out IPv6 addresses to other wireless clients or wired clients upstream." Which setting on the WLC is related to this on WLC? No configuration found. It seems to me that DHCP Server Guard and DHCP Source guard are the same things used interchangeably. I am still not sure what setting on the WLC controls these. I wonder if the DHCP Address Assignment Required solves both of the problems mentioned. And if DHCP Source Guard and DHCP Server Guard exist for both IPv4 and IPv6 on WLC. Thank you!
... View more
06-18-2019
03:37 AM
I finally found some info on this here: https://www.cisco.com/c/dam/en/us/products/collateral/switches/catalyst-9000/nb-06-cat-9k-stack-wp-cte-en.pdf I see that 100G are supported for my 9500-24Y4C on fixed uplinks.
... View more
06-18-2019
01:38 AM
I picked 2x C9500-24Y4C (24x 1/10/25G Gigabit Ethernet + 4x 40/100G Uplink). The switches will be in the same rack. Looking at the StackWise Virtual guide it says "The stack can be formed over a redundant 40-G or 10-G fiber links...". I was thinking of using 100G ( QSFP-100G-CU1M) for SVL. I assume SVL can be configured on any interface including 100G. Can someone confirm this?
... View more
06-12-2019
04:44 AM
I actually consume 24 copper and 27 optics. So I planned for 2x 24 copper ports. Preferrably MGig for "investment protection". And 2x24 optical ports preferably with 10/25G support again for future proofing. Currently the most homogeneous build is to use 3850 stack 2x 3850-24XU-L - 24x MGig with Network Module 8x 10G SFP+ 2x 3850-12XS-S - 12x 10G SFP+ I am also considering 9300/9500 build 2x 9300-24UX 24x Multigigabit Cisco UPOE (100M, 1G, 2.5G, 5G, or 10 Gbps) no uplink module 2x C9500-24Y4C 24x 1/10/25G Gigabit Ethernet + 4x 40/100G Uplink (fixed uplink) Total GPL is basically the same. The only thing that "bothers" me with 9000 series is that they are not stackable. On the other hand 9000 series build offers very high throughput optics uplink, higher speed optics (25G) and more optic ports. 9400 is not an option since price is so much bigger.
... View more
06-10-2019
02:17 AM
Yeah I see now they use different stack technologies. The thing is I need copper interfaces and I cannot seem to find anything in 9500 series. Ideally 2x24 port switches.
... View more
Public Statistics
| Date Registered | 01-03-2019 06:58 AM |
| Date Last Visited | 09-17-2019 01:14 AM |
| Total Messages Posted | 52 |
| Total Helpful Votes Received | 20 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 10 | |
| 10 | |
| 5 |
.jpg "Hall of Fame Community Legend"){kind=icon}
.jpg "VIP Mentor"){kind=icon}
