I'm having an issue with my network, where we're are experiencing random and brief network outages. They happen a couple times a day and last 5-10 seconds. when I check my two backbone switches (4506 : Supervisor: WS-X4516-10GE ,IOS : cat4500-ipbase-mz.122-31.SGA8.bin), STP remains normal and no topology change occurs.
View 16 RepliesI have a serious problem with nexus 7018, there're unicast flooding on one n7k, named n7k-1, which is the member of vPC domain combined with 2 N7Ks. [code]I had clean the mac-address-table, and all mac-address-tables had been synced fine, and the unicast flooding went away.
How could I fix the mac-address sync function between the modules ?
I've been looking for a way to detect the level of traffic caused by unknown unicast traffic on a Catalyst 6509.I have found mechanisms to mitigate it but nothing to actually detect/measure what the levels might be.
View 3 Replies View RelatedI am implementing a guest wireless network to work alongside my internal network. The guest network will use the existing switching network and will be separated by VLANs. I have the ASA set so that traffic can get to it and out to the Internet. I can set up a workstation on the same VLAN as my guest network and can route inside my network (strictly doing this for testing purposes). Where I am having problems is with the Catalyst 4506 switches and the ip routing. I had two separate "ip route" statements defined on my switches.
ip route 10.200.2.0 255.255.255.0 10.200.2.254
ip route 0.0.0.0 0.0.0.0 10.100.100.254
I have discovered that the traffic is always following the default route despite the fact that my IP address on my test workstation falls in the 10.200.2.x network. I was looking at documentation and found that it is possible to set up policy-based routing on the core switches. Can you have two "ip route" statements defined like this to segreate traffic or do I have to use PBR for routing (or a combination) in this case? If I define PBR then how does that impact my existing routing? I need to make sure that I can still route the existing traffic while I'm configuring this change.
I have three 4506 switches with vlan 4 set as the management vlan. Switch 1 is connected to switch 2 and switch 3.
I can access switch 1 and 2 using telnet from the management vlan and both switches reply to pings. But from switch 1 or 2 I cannot ping or telnet switch 3. If I plug into switch 3 and I can ping and telnet switch 3 but not switches 1 or 2.
It is as if the management vlan 4 is not being passed to/from switch 1 and 3. The configs for the uplinks from switch 1 to 2 and 3 are the same. And the configs for switches 2 and 3 look the same apart from the port settings.
I have over 40 vlans running all that work fine between all the switches.
I have a Nexus 3064 which is not recording source MAC addresses after a successful ARP. The switch is then flooding the entire vlan with unicast traffic.
The config is a boring single VLAN. One port (48) is going to a 6509. Not as a trunk, just extending the VLAN. There are SVI's on both switches. the default route for the Nexus users is the 6509's IP.The switch was basically, pulled out of the box, setup a single vlan(with jumbo frames) andan SVI, then plugged in the users. Nothing special.
I was wondering if the following scenario would work:
2 Microsoft TMG servers (could be any W2K8 R2 based server, e.g. UAG, Exchange etc.) configured for Unicast NLB. The servers are connected to separate L2 switches which are connected to a highly available central L3 switch (see attached drawing).
Unicast NLB works in such a way that it uses a shared virtual IP and a virtual MAC addres which is not used as Source MAC address when the TMG servers are respondign to requests.Basically it relies onto the fact that the switch does not learn the virtual MAC address and floods all packets destined to the virtual MAC on all ports. The L3 switch would learn the MAC through ARP. The question now is, what the L3 switch would do, if it receives a packet destined for the NLB VIP. It should do an ARP request in order to receive the virtual MAC. How would he decide on which port(s) to forward the packet as he does not know on which port the MAC is found. Can he make a decision based on Layer 3 (IP/VLAN based) therefore he knows that the VLAN for the TMGs is connected on those two uplink ports?
i recently identified all switch ports in my network on 6509 core were Transmitting Mail server Exchange traffic that was destined for Unicast NLB cluster. and it was impacting various HOST machines NIC cards/performance.After reading this article, i moved NLB CAS servers behind a dedicated cisco Switch.
[URL]
Now My core switch can learn mac address across its trunk port where CAS servers are connected on dedicated switch. but still i can see traffic Transmitting out to my all switch ports of same VLAN ( same as NLB VLAN).
I have a 2x Cisco 3750G switches (Stacked) that are part of an IP Video Surveillance System .All network is set to 1 VLAN (VLAN 1 default).The Cisco SWs ( Core ) are configured with IGMP Querier + Snooping .Connected to the Cisco SWs are 4 Fiber Rings(Loops) for redundancy . RSTP and IGMP Snooping are enabled on all the network SWs .Network Architecture Figure :
When all Fiber Rings (Loops ) are connected , the Cisco and Ring SWs spanning-tree tables show the blocked and forwarding ports properly .I am able to connect all my IP Cams + Encoders to the Ring SWs and connect my Servers + WorkStations to the Cisco SWs to record and view the multicast ip streams .All streams from Rings 1 ,3 and 4 are getting normally to the Servers + WorkStations through multicast ( IGMP Snooping are filled correctly on the Cisco and non-Cisco SWs ) . All multicast streams are joined normally except for Ring 2 .The Multicast streams passing through Ring 2 will operate normally for around 2 hours then after that the Fiber SWs begin to flood their multicast traffic causing the cams on the same switch to drop off the network .
I checked the Configuration of all the SWs on Ring 2 but all are are the same .
What is weird is that I have to set all the streams to unicast to stop the flooding just on Ring 2 (All other rings are not affected ) then after some time if I enabled a video multicast stream on one of the SWs of the Ring it will be streamed properly to the Servers + WorkStations ( All IGMP tables along the way will be filled properly ) then again after 2 hours or so , the flooding will start again suddenly and all IGMP table entries for the SW on Ring2 will be empty . No problem occurs on the other Rings which have more multicast streams .
There is a unicast flood on 3750 killing slow modem links. How to determine source MAC address of flooder? Is there a rate limit feature for it?
I know how to block it completely on port-level, but it breaks normal network operation. (when port goes down for some reason, it's learned MACs got flushed and since other hosts know MACs, they keep flooding untill their arp caches expire).
My management has tasked me to give them a high level overview of the different switching we can choose for our new building.
This is what I know so far.4 Closets, each closet has 450 ports,One MDF room that is will contain one UCS Chassis and a Nimble iSCSI SAN.
I am working on the spreadsheet and it looks like this (Not totally filled):
2960s3560x3750x45064510Approx cost (Each, 48PORT, POE+, 10G uplink, Dual PS, IP BASE)
6K7K8K45K75KMax Capacity192432432192384Backplane speed206464520520ProLeast ExpensiveStackable to 9Stackable to 9ProDual PSDual PSDual PSDual PSDual PSProLayer 3 opt
Layer 3 optDual SupsDual SupsConExpensiveExpensiveConNo Dual PSConLayer 2 OnlyCannot stack more than 4
For the MDF I would like to use 2 Nexus 5548's with FEX's, and the layer 3 daughter board. For the IDF's I was thinking of two 4010's.
We have 2 sites, each with 2 x 4506 switches which will be connected togther using an etherchannel. The switches will provide access ports for client devices and will be configured with HSRP to provide gateway redundancy. SW1 will be HSRP active.2 metro ethernet links will be installed in each site which will connect back to our HQ sites. OSPF will be used over the backbone to provide resiliency and to allow shortest path routing to each HQ and to prevent traffic over the HQ to HQ link.
The 4506 will be trunked togther with an SVI for providing OSFP adjacency.For the traffic flow from SW2 to HQ2, traffic will hit SW1 and then route back to SW2 and then to HQ2. Is this the best way to do this? Should a second link be connected between switches just for routing or should something like GLBP be used?
CiscoSwitch1(4506) has 3 VLANs(12,13,14) and Switch2(4948) has 3 different VLANs(22,23,24) and IP routing has been enabled in both switches with SVI interfaces for each vlan. intervlan routing is works fine.Now there is a requirement to connect these switches together. Vlan 12 on the Cisco switch 4506 has to be made available from vlan 22 from Switch2(4948). basically Vlan 12 is having a multicast source (225.0.0.0 & 226.0.0.0) which should be accessabile from vlan 22 of cisco switch 4948.I got 2 ideas
1) Create a trunk between these switches and configure L2 vlan(12) in cisco 4948...i know theoritically it should work but what my concern is Ip routing enabled in both switches will it create any issues? is it a gud solution to this requirement?
2) Create a separate IP network on the ports connecting to both switches and set up routes to the networks.ex- console(config)#ip route 192.168.10.10 255.255.255.0 192.168.20.1.
I am configuring multicast in a environment where I have a 4506 at each site (4 total) and a 6506 as the core. Each 4506 is connected via layer 3 to the 6506. I have a mix of 3560s, 3548s, and 2960s connected to the 4506s and the 6506 via layer 2 trunk
I have multiple multicast sources and hosts communicating at a time (multiple cameras sending video / multiple computers receiving video). So this is not a scenario where there is 1 sender and many receivers. This would be many senders (~50) and some receivers (~10)
Sample Diagram:
->3560
|
6506 --> 4506 --> 3548
| |
| --> 2960
|
4506 --> 2960
|
-->3548
I configured ip multicast-routing on each of the 4506s and on the 6506. IGMP snooping is on by default on the 3560 and 2960 switches. CGMP is on by default on the 3548 switches.
I set up PIM sparse-dense mode and IGMP version 3 on each of the layer 3 interfaces for the 4506s and 6506 where they connect and on each VLAN that is sending or receiving multicast. Multicast is working throughout the network, however I am looking to verify the configuration as I scale this out to more clients on the network.
#1 - Is it correct to us sparse-dense mode in this configuration?
#2 - Do I need to configure a rendezvous points using AUTO-RP? (ip pim send-rp-announce INTERFACE scope TTL). Not sure here if I need to designate this and what to choose. Right now I do not have this and it is working, but documentation seems to infer that I need to designate this.
#3 - Is there any other configuration settings I should be considering? I hard to find real world configurations of multicast as examples or people that know multicast routing well.
I have a Canon ScanFront 220 network scanner that seems to have a problem with our network. It's plugged into a Cisco 3560. The network is operational, just chatty.
A wireshark session for just a few seconds looks like this: (192.168.81.42 is the scanner)
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.89 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.90 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.91 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.92 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.93 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.94 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.95 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.96 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.97 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.98 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.99 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.101 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.102 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.103 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.104 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.106 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.108 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.109 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.110 Vlan81
1w4d: IP ARP: rcvd req src 192.168.81.42 0000.8583.2c43, dst 192.168.81.111 Vlan81
I can't find anything on the scanner that would cause this.
I am currently running a 4506 with a sup V engine. I have purchased a sup 7 engine. Is there a guide on how to perform this task. I am sure I need to do an IOS update as well.
View 2 Replies View RelatedWe have sup engine 6L(WS-X45-SUP6L-E) on two 4506 switch. both switches connected in LAN (HSRP primary and Secondary).
We are going to replace it with Sup7LE. What is the best procedure to get this done with minimal outage?Any other important thing to be noted ? Note : We have Lincence for SUP 7LE
We are attempting to PXE boot from clients obtaining their DHCP lease information from DHCP pools configured on our 4506. The PXE server, and the client are configured in separate VLANs. We have configured option 66 to point to the PXE server IP address, and the bootfile option to point to the PXE boot configuration filename. On the client side SVI, we also have configured the ip helper-address command to point to the PXE server (which also acts as another DHCP server for redundancy).
The PXE boot continuously fails stating it is unable to find the configuration file. If we remove the DHCP pool from the 4506, and allow the client to receive their DHCP lease info from the secondary server (Windows 2k8 - same server as PXE server), they PXE boot with no issues.
We have no problem obtaining DHCP info, just completion of the PXE process.
Does SUP 7E is comatible with IOS? It came with IOS-XE preloaded and there are no IOS software listed under downloads.
View 3 Replies View RelatedYesterday I've faced a Problem that is not letting me boot with the new IOS.
Actually I'm planning upgrade IOS which supports SSH. As part of plan I've downloaded the new IOS image and uploaded via TFTP server to the switch.
After uploading to the switch. I've verified image and MD5 hash also. Everthing is fine. Then after I set the boot variable for the newly uploaded Image.
When I'm rebooting the Device it is not taking the new IOS. It's booting with the OLD image. Even It's not showing any error message while rebooting (ACTIVITY FILE ATTACHED FOR YOUR REFERENCE) I can't take risk by deleting the old IOS.
I have 4506 with below sup, my requirement is to enable netfolw , but as i came to know that it is not supported in this sup, is there any additional option which can be explored to get the netflow working without replacing sup.
Card Type Model
-------------------------------------------------------------+-----------------------
Sup 6-E 10GE (X2), 1000BaseX (SFP) WS-X45-SUP6-E
My IPTV connection works fine so far but as soon as I start watching TV I can't use my WiFi connection anymore. My router is an "Alice Modem 1121" (SIEMENS S1621-Z220-A) with 4 LAN ports and a WiFi interface (4th LAN port provides the IPTV). It is directly connected by wire to my PC's ethernet card for the IPTV and the internet is provided via the WiFi. When I activate the LAN connection the WiFi and internet connction stays up and requests can be sent but nothing returns anymore. Another device (iPod) has no problems with accessing the internet while IPTV is in use. I also have a Netgear WNR1000v3 router which I tried to use as AP instead but it's exactly the same problem. Unlucky the Netgear router is not supported to use dd-wrt firmware yet (I've found a step by step guide to prevent multicast floods with dd-wrt/ebtables). But maybe the Alice Modem can handle this problem on its own. I read some stuff about VLANs and splitting them but I have no clue how that would look like.
The "nas_0_1_34" is for the IPTV.
We have just purchased and installed a 4506-E chassis. It contains a supervisor, two POE blades and 3 non-poe blades. Version is 12.2(53)SG1. Anyhoo, one of the ports isn't providing power to an IP phone. We can plug the phone into any of the other POE ports and it works fine. Is there a way to test an idividual port for POE problems? What could the problem be? The port works for normal data but will not provide power.
View 12 Replies View RelatedWe ordered the wrong part number for a Cisco 4506 non-E chassis, the part number is: WS-X4624-SFP-E and the device is showing "Unsupported module"; What would the part number be for the non-E? WS-X4448-GB-SFP,Catalyst 4500 48-Port 1000Base-X (SFPs Optional) ?
View 1 Replies View Relatedi'm desperately trying to get LACP working over a dot1q Tunnel. The "Service Provider" Switches are two 4506-E Switches with SUP7-E connected via a 10G Link, running on cat4500e-universalk9.SPA.03.03.00.SG.151-1.SG
sample config:
dot1q tag vlan native
interface GigabitEthernet3/1
switchport access vlan 2001
[Code].....
a 6509 and a 4506 with 2, 1gb interfaces in a portchannel. Bring it up and everything is fine. Save the config and reload either switch and the interfaces stay in Not Connected state. Either doing a No Shut or a physical unplug the SFP and plug it back in will bring it up with no issues. Interfaces do not go into Err Disabled state they stay in Not Connected like there is no fiber plugged into it. No error mesages in the log. The Just the Interface is now up.Both are running very new code,
6509 - s2t54-ipservicesk9-mz.SPA.150-1.SY1.bin ( 15.0.(1)SY1 )
4506 - Version 03.02.00.XO
I have "inherited" a Catalyst 4506 with IOS version 12.2(20)EWA1 and Supervisor IV already installed. We recently purchased a second Supervisor IV and I am looking to install this second supervisor for redundancy. Is there anything special with installing a second supervisor or so I just physically install the new supervisor and the IOS will automatically set everything up?
View 3 Replies View RelatedI have a setup with two Cat 4506E working as a HA,I used a bundle 4Gb interfaces working as ether-channel,I'm facing a problem with DHCP pools on the both SW's,There is no problem if I use the pools on one sw,But when I but the pool on both sw's then I faced a lot of conflict IP in the DHCP pools,How can setup a real DHCP redundancy on both SW's,
View 6 Replies View RelatedMy inherited network has a Cisco Catalyst 4506 with a WS-X4124FX–MT fiber card that connects to twelve Cisco 2950 switches over 62.5 micron multimode fiber at 100 Mbps. I do not know my run lengths (or even where the conduits run), but the furthest switches are well over a thousand feet from the server room. Any appropriate test equipment to provide this information soon.
We are looking at upgrading the main switch to a Catalyst WS-C4507+E with two WS-X4712-SFP+E cards and the closets to Cisco 2960S-48TD-L switches. Assuming this is a reasonable move, my question is about choosing the appropriate SFP’s for our current and future needs.
I am aware that 62.5 micron multimode fiber is the least favorable for extended lengths, but I will not be in a position to replace it for at least a year. If I purchase 10 Gbps modules, like the SFP-10G-SR or SFP-10G-LRM, can they “throttle down”, either automatically or by setting a parameter, to communicate at slower speeds over distances that exceed their 10 Gbps maximum link lengths on multimode fiber?
We want to permit certain mac addresses on the cat 4506 switch wherein only those mac addresses will get access to network.
Configuration Planned: For testing purpose we have created mac access list on cat 4506 and deny laptop mac address in this access list. The mac access group is applied to the port where the laptop is connected to cat 4506.Even after applying the mac access group on the port, the laptop is able to ping the vlan ip of cat 4506 [code]
laptop with ip address 192.168.10.2/24 connected to port 2/1 is able to ping 192.168.10.1 even after applying the mac access-group
Note-we have tested same configuration on cat 3560 and its working fine. We apply the mac access-group command on interface and clear the arp-cache and we are not able to ping vlan interface ip. The moment we remove the mac access-group,ping starts again.
I have one computer connected to the 4506 that management does not want this PC to have access to anything on our network except our DHCP server and the one printer that resides on our network. I created an extended access list as follows. Our network is the 10.10.x.x and the external addresses the PC needs to access is 11.1.x.x. Once this PC is rebooted, it is unable to access DHCP to get the needed IP address it bounces back to a 169.x.x.x address and stops working.
Extended IP access list 2000
permit tcp host 10.10.200.242 host 11.1.200.1 (gateway)
permit tcp host 10.10.200.242 host 11.1.2.151 eq smtp (access from the pc to external server for smtp)
permit tcp host 10.10.200.242 host 11.1.2.149 eq 5721 (access from the pc to external server for remote access)
[ code]...
Then I applied the access-group 2000 on the interface the PC is connected to. What am I missing for DHCP to work and for this PC to always get the ip address that is reserved?
I am running HSRP on three 4506 switches..S1(active) S2( standby) and S3(listen)..S1 is active for all the vlansRight now, I wanted to make S3 active for two vlans: vlan 10 and 19What would be the impact to the end hosts?Also, can you tell me why the arp is not syncing for all the three devices? [code]
View 4 Replies View RelatedI have two 4506 switches in my organization. Recently the office was relocated and when both the switches were booted they ignored the startup config.The config-reg was set to 0x2101. No boot system command was configured.So I changed the config-reg of SW1 to 0x2102 and gave boot system command as stated below.When reloaded the switch booted to ROMMON and I had to manually boot the IOS.I want them to boot normally with IOS.Config of SW2 is not changed since relocation. I am specifying both configs bor your consideration. [code]
View 12 Replies View Related