Cisco Firewall :: ASA5580 Port Channel To 6509 VSS?
Dec 17, 2012
Anyway, here's the situation I'm trying to configure several VLANs on my ASA to uniquely allocate to contexts, the VLANs will be trunked from my VSS. Unfortunately I'm not clear on how to achieve this, the configuration guide for 8.4 talks about multiple contexts and routed setups all which don't appear to apply exactly. I've configured the port channel at both ends and I've configured sub-interfaces on the port channel and assigned VLAN IDs. These sub-interfaces are then allocated to the contexts to set 'ip address' etc. I've not been able to successfully test this configuration and I am concerned that it is incorrect..
View 1 Replies
ADVERTISEMENT
Apr 22, 2012
I have 2 Cisco 6509 switches linked together via single Fibre as a trunk.I want to change this to a port channel where I will add another 3 fibre ports to the port channel but what order do I do this to minimise any disruption.
1-Configure PortChannel and add the 3 new ports, this will bring up the Port Channel but what effect will this have on traffic currently going over the single Trunk link? Will spanning tree go mad, how will switches react?
2-Convert existing Trunk link to Portchannel then add in new ports to PortChannel, I guess in doing this there will be a small hit on traffic as it changes to a port channel.
View 2 Replies
View Related
Oct 3, 2012
We are currently designing Layer 3 to the edge EIGRP solution for our customers. The network is a hybrid of collapsed core (Core to access) as well as a three layer design (Core/Distro/Access) for connectivity to the Data Centre, Internet, Wireless Blocks etc.The core of the network contains two 6509-E switches interconnected on a Layer 3 Port channel (no VSS). Access Layer switches (3750-X series running Stackwiseplus protocol) connect to the core switches over p2p routed links and Distribution layer switches (3750X stackwiseplus) provide connectivity to the Data centre, Internet, wireless blocks etc.
The access and distribution switch stacks(Cisco 3750-X) are set up with two or three member switches with uplinks multihomed to the primary and secondary core switch with each uplink included in EIGRP. In each of the stacks, one of the switches controls the operation of the stack, which will be the stack master.As the Cisco Stackwise architecture is not SSO-capable but NSF aware, all Layer 3 fuctions must be re-established during a master switch outage. To minimize control plane impact and improve Layer3 convergence, uplinks should be diverse and originate from the member switches instead of the Master switches in the respective stack. This is as per Cisco recommended design solution.The above solution can be setup if there are more than two switches in the stack. i.e. uplinks are configured on the backup member switch modules.
1.But what about stack with two switches..Which switch should be set up as the Master for a two member stack with uplinks to the core primary and secondary from each switch(Master and Backup)
2. For Layer 3 routing, does the routing takes precedene over switch failures? Say for eg. In a two member stack, the master switch with uplink to primary fails, does EIGRP provide a fast convergence to route traffic via backup secondary and does not wait for the control plane on the switch stack to converge? All the access to core links will be set up for ECMP.
View 3 Replies
View Related
May 21, 2013
Has anyone configured Layer 3 port channel on Cisco 6509 switches which are connected over dark fiber between two buildings?
View 3 Replies
View Related
Jun 11, 2013
So everything I've read on Cisco's documentation here: URL says that I can create a port-channel on two physical interfaces that will uplink to a VSS pair. However, the command is not recognized. What am I missing? I've tried executing "channel-group #" on the physical interface and tried creating the port-channel 1st and neither commands exist. I haven't seen it listed anywhere if it is only available after a specific piece of ASA software. If it is the software what version at a minimum I need to upgrade to? Below is an output from a show version
Cisco Adaptive Security Appliance Software Version 8.0(4)
Device Manager Version 6.1(3)
Compiled on Thu 07-Aug-08 20:53 by builders
System image file is "disk0:/asa804-k8.bin"
Config file at boot was "startup-(code)
View 2 Replies
View Related
Nov 20, 2012
Create a port channel out of interface 3 and 4 of ASAConfigure 2 sub-interfaces in those Po interface (my inside vlan and the dmz)At the 4948, configure a trunked port channel out of a single interface (funny ), then do the same in the second 4948Connect ASA port 3 to the 1st 4948's single-interfaced port channel, ASA port 4 connects the same on the 2nd 4948.
View 4 Replies
View Related
Jan 22, 2012
I'm doing some L2 cleanups across mutliple 6509E environments and I've found something consistent that I can't find in documentation. On all my pairs of 6509s where I have FWSMs bundled (6509-A has FWSM-1 is Slot 1 and 6509-B has FWSM-2 in Slot 1) I also have a port channel 305. Obviously when I do a "show run" or "show int desc" I don't see anything in slot one. It's a service module. But the port channel is referencing ports 1/1-6. And it's all in service/up. I was about to delete this as I thought it was some leftover config (TEST 6509s) until I went and saw the same things on our PROD 6509s. Is it cosmetic? Necessary? Can I delete it as part of my audit cleanup? Don't want to mess with it even in TEST without some information. Nothing on google that's clear and I can't find anything on CCO.
#################################################################################
6509-1#sho etherch 305 summ
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
[code]....
View 1 Replies
View Related
Mar 24, 2011
We are in the process of building a new DC and would like to know which is the recommended version of code to run on the following:
Firewall Services Module
Cisco ASA5580, 5550, 5520
ACE module
View 4 Replies
View Related
Jan 18, 2012
I am having issues with PXE boot images for PCs cannot be loaded from remotely.The diagnosis revealed that SunRPC & TFTP were being inspected by ASA causing drop of packets.So I excluded these two inspections for the particular server behind the firewall. It seem to resolve the issue for instance but it crawled back again.
Is there a way that the inspection can be turned off for that particular server at the IP level?
View 1 Replies
View Related
Nov 7, 2011
We have an active-active pair of cisco ASA5580-20 with software version 8.4(1)9. There are 8 contexts on it (including admin and system). 1 context is active on Primary node and other 7 are active on Secondary node. User traffic is going through this 1 context (2 interfaces - inside to users, outside to internet) and there are peaks to 1.16M concurrent connections, max bandwidth is 1.25Gbps. CPU usage for this context in peak hours is 63%, but we noticed that when we run "show cpu usage context all" from system it shows that system context is using 25% of CPU and "Total CPU utilization" (form output of show cpu detailed - on system context) is 88% which is bad. In non peak hours - user context use 33.6% CPU, system use 14.5%, total CPU usage is 50.5% So, is it normal this cpu utilization on system context (system on Primary node)?
View 1 Replies
View Related
May 18, 2010
Running ASDM V6.3 connecting to a couple of ASA5580's V8.2. After initial configuration everything seemed to work great, however, as of a few days ago I can no longer view statistical information. I can attach to the devices without a problem, view and edit all configuration information but the dashboard applets do not pull or display any statistical info. Resource, Interface, and Traffic status all time out with the error "Lost Connetion to Firewall". The syslog info is not display rather the error "Syslog Lost Connection". My first thought was a java issue on the client. I have ripped out and reinstalled even back-revisioned to no avail. I'm to the point where a dumpe of the management workstation is the next step. I'd like to avoid that extreme if possible.
View 3 Replies
View Related
May 10, 2012
customer has a server which located in inside interace. and an outside interface connected to ISPA. cu config a static nat map inside server address to ISPA address, one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address. the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580. i want use route-map on static nat, but it will not satisfy customer's request.
View 3 Replies
View Related
Jul 13, 2011
i have a problem customer has a server which located in inside interace. and an outside interface connected to ISPA. cu config a static nat map inside server address to ISPA address one day customer install a new outside interface to ISPB, cu config new static nat ,map same server inside server address to ISPB address. the server will allways be vistited from outside interface and reply, custome want traffic coming from ISPA will return to ISPA, traffic coming from ISPB will return to ISPB. but i found it is difficult implement this on ASA5580. i want use route-map on static nat, but it will not satisfy customer's request.
View 6 Replies
View Related
Feb 16, 2012
I am looking for the way to define an idle timeout for specific flows on an ASA5580 by using Cisco security manager. For ex I needed to define a specific idle timeout for connections beetween specific devices (Devices in vlan1, Device2 in vlan2).To test it I did following changes by CLI and it works fine. access-list L1 extended permit ip <@IP1> <mask1> host <@IP2> class-map CM1 match access-list L1 policy-map PM1 class CM1 set connection timeout idle 02:00:00
I try do do the same configuration with CSM in order to be able to manage each changes only by using CSM.So I defined Access control list, Traffic flow and then I define timeout in CSM --> PIX/ASA/FWSM Platform --> Service Policy Rules --> IPS, QoS and Connections Rules -> connections settings -> Traffic flow idle time-out. The problem is that each time I deploy the configuration with CSM I loose the timeout config line which is the most important for my application..
View 2 Replies
View Related
Dec 1, 2011
I came across a Catalyst 6509 switch configuration and have noticed some strange thing on the ether channel configuration side, it appears that it have interface port-channel 2 and port-channel 2A, what was that mean? its the ether channel not forming and joined together?
What wrong with the below configuration that cause it to automatic created another port-channel (2A) interface in this case?
[code]...
View 3 Replies
View Related
Feb 9, 2012
I'm unable to assign port E2/1 to port channel. I get following error:
NEXUS5K(config)# int e2/1
NEXUS5K(config-if)# switchport mode trunk
NEXUS5K(config-if)# channel-group 14 mode active
[Code].....
View 2 Replies
View Related
Apr 27, 2013
There is a cisco ws-c6509,recently it appear error log “%FABRIC-SP-6-TIMEOUT_ERR: Fabric in slot 5 reported timeout error for channel 11 (Module 3, fabric connection 1)”. When I reload the device,the error log disappear.But a few days later,it appears again.I try to replace the slot 3 (WS-X6704-10GE),the error log continues.The IOS version is 's72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(18)SXF8"
View 1 Replies
View Related
Sep 2, 2012
I have Cisco 3845 with two Gigabit interfaces configured as port-channel with sub interface and with QoS. However shape does not work.
[code]...
View 8 Replies
View Related
Feb 7, 2013
what is active/passive port-channel..? and how it will do load balancing when my network traffic is flowing on both the ports.
View 5 Replies
View Related
Sep 13, 2012
I have Cisco 3845 with two Gigabit interfaces configured as port-channel with subinterface and with QoS.However shape does not work, why? [code]
View 1 Replies
View Related
Nov 2, 2012
are port-channel interfaces supported in 6500s -w- SUP-2T?
Inquiring if able to bundle a couple of 10GB ports on a 6908 via port-channeling.
12.33 IOS doesn't it, but haven't completely confirm whether 15.1 IOS does.
View 3 Replies
View Related
Mar 6, 2012
So I have a current port-channel between two 6ks that I need to upgrade. There's too much traffic and the port buffers on the SUP7203B sort of suck. Microbursts are causing overruns like mad. Im going to move the 2x1gig port-channel to a 6724 and make it a 3x1gig port-channel. The switches carry production traffic across the link to the tune of about 400 meg during the lowest load time. Initially, I thought that I couldn't move the port channel without temporarily taking down the link but I think I have a workable solution now. Has anyone done this successfully before? Im curious what others have done. Also, to make matters worse, the existing port-channel is 'mode on' and I want to migrate to 'mode active' in the new channel
View 7 Replies
View Related
Oct 30, 2012
I want to do the inter vlan routing packet tracer file url...configuration of MLS are as bellow can anyone tell me why vlan on switch0 can not ping vlan on switch1. [code]
View 12 Replies
View Related
Jan 18, 2013
I have just been setting up a WISM2 in a test lab and for some reason the Supervisor is not creating a port channel on my 6500 as suggested in the WISM2 Deployment Guide. WISM2 is installed in an appropriate slot (according to same doco) and have attempted reset to factory defaults, removing and power cycling several times.
View 1 Replies
View Related
Jan 5, 2012
Is it possible to configure a Cisco 2801 router with Multipoint Port Channeling? A service provider dropped a 4.5Mbps ( 3x T1s ) to one of our customers without any equipment. They assume the CPE responsible. If so, any links to documentation on this configuration. If not, what device will they need to buy from Cisco that can bundle these 3 T1s together then feed it into their router?
View 6 Replies
View Related
Jan 16, 2011
I have configured my Nexus 7018 and 5548 as follow (see diag attached).Both 7000 and 5500 are vPC pair(po1and po2). Now I have created port-chanel between 7018and 5548 as port channel PO3 on 5500. Would it give me 20g bandwidth as PO3?or 10g only uplink to 7018? Do I need to config all four 10g links in PO3 on both 5500 and 7000 switches to achieve max b/w and failover?
View 4 Replies
View Related
May 22, 2012
I have port-channel configured on Nexus 5K (version 5.0.3) with below configuration.
interface Ethernet1/9
switchport mode trunk
switchport trunk allowed vlan 60
speed 1000
channel-group 105 mode active
[code]....
We have added GLC-SX-LH module to E1/1 and E1/10 and speed is set to 1000 (1Gig) Now other side of E1/9 and E1/10 are not connected. Port-channel status is down
Po105 1 eth trunk down No operational members 1000(D) lacp
show interface port-channel 105 shows different bandwidth (100) MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec,question is under interface port-channel105 speed 1000 command inserted automatically.Now if we connect otherisde of interface, during port-channel comes up.what will be the port-channel interface bandwidth ? will it change to 2Gig(2000). Why speed 1000 command inserted automatically on port-channel.Since it is migration, we want to be more specific on the port-channel configuration?
View 1 Replies
View Related
Jul 17, 2011
What is the load balance method of 3750 port channel ( by source ip , or by source mac ) to diver traffic to paths? I have tried to use 10.242.104.101 and 10.242.104.102 as source ip, it will travel to the same link (G0/1) within one port channel (G0/1+G0/2). Howerver, if I later use 10.242.104.109, then this time it will traffic to G0/2 link. What's the concept behind.
View 1 Replies
View Related
Sep 12, 2012
Have 2 N2K with dual-connections to both 2 N5K, will all 4-ports of N5K will be the same port-channel. N2K as well ?
View 1 Replies
View Related
Jan 27, 2013
I need to increase the link capacity of 10GE to 20GE between two Cisco7609, so I feel the need to configure port channel between them, my little problem is that I have a SCE 8080 in the middle of both 7600 currently is configured inline. The SCE has 4 modules 1X10GE-L-V2 (currently in use 2), I was investigated and the truth is that I not found anything concrete about how to configure the SCE to "pass" etherchannel through it? What the SCE needs to support 20GE of traffic? (configuration and software)
I have two 10GE ports available on the SCE
View 1 Replies
View Related
Jan 2, 2013
I want to configure Port channel for WLC 5508 and cisco 3750 Stack Switch. What changes I need to make on WLC and where?
View 7 Replies
View Related
Nov 29, 2011
I need to configure a port channel between two sw 4507R. with port Giga, but those port are in different modules.
Sw-1
interface GigabitEthernet5/48
description **** Conexion Switch-2*****
[Code].....
View 2 Replies
View Related
Apr 9, 2012
I have a customer that would like a 40Gb port-channel between two 3750-x switch stacks. When I try to activate four 10Gb ports in the channel, they go into error-disable. However, I am able to create a 20Gb port-channel without issue. I have had my configurations verified to Cisco best practice.
Is there a limitation on the amount of throughput that the 3750-x can handle? According to the data sheet the 3750X-48T can handle 101.2mpps, based on two 10Gb uplinks so if my math is correct then a stack of two 3750X-48T should be able to handle 202.4mpps.
[URL]
View 3 Replies
View Related
