Any method to renumber a FEX without causing service disruption?
1) Preprovisioning the new FEX number
2) Mirror the config
3) Change the FEX association on the FEX downlink ports on the 5548
but I'm certain this will cause a disruption to the connected hosts ports which are in production on the FEX?
How Can i Connect two switches 4505 using the trunking method,…
View 1 Replies View RelatedI´m facing to one issue with VACL. i have a network lan with 10.40.X.X/16 . in this network i have a Production v LAN 10 with 10.40.10.X/24 and i have created one vlan103 for Guest´ user as 10.40.103.X/24
My goals is to restrict the v LAN 103 to reach or access the v LAN 10, better to restrict Guest user access to the production v LAN. So i try to put this script with VACL method, but does n´t work.
Extended IP access list Restriction-Guest
10 permit ip 10.40.103.0 0.0.0.255 any
vlan access-map Guest 10
action drop match ip address Restriction-Guest
vlan filter Guest vlan-list 10
After that i still able to ping or access to the v LAN 10 form v LAN 103.
I have a Cisco 3560 running as a Level3 device in my network running 10 V LANs and routing between most of them (nothing complex with ACLs) and running spanning-tree mode pvst. The main network is run on a net gear GS748TPS stack of three switches running MSTP.
I have just bought an additional 3560 and a 2960 to plug in. I have set them up with IP addresses and then plugged them into the net gear. This brought the whole network down until I unplugged the new switches.
I have confirmed the IP addresses aren't duplicated and that DHCP is not running on the switches so I can only assume it's something to do with DHCP. I cannot afford for the network to go offline again, so is there anything I should check? Am I running incompatible spanning tree methods between the net gear and Cisco devices?
Any method of forcing a non connected switch port LED to blink for a certain number of times regardless if there is anything connected.The purpose of this is we have remote 3750 switch stacks and quite often have to tell non technical staff to patch to a certain port. It would be much easier if we could say "Connect it to the empty port which just started blinking orange" as the port numbers are difficult for them to see in these locations.A similar feature is available in the ethtool package for linux which makes it really easy for identifying ports on servers. It would be great if a similar feature is available on Cisco switches.
View 2 Replies View RelatedI have Nexus 5548UP, Version version 5.0(3)N2(2b), with a flat configured network. Customer has put several IP subnets on one Vlan. In one subnet is an Siemens SPS wich connects to a Server. This SPS is not reachable since I send a ping from the N5k, then everything works fine. Sniffering that port no arp requests from the N5k are captured. That hapens with every device (Siemens SPS) in the network. Every other clients and server are working fine and there are no problems.
View 1 Replies View RelatedI am trying to get our DCNM to discover the 5548. When I put my credentials for that appliance. I get this error .Failed Device x.x.x.x OS Version 5.1(3)N1(1) is not supported . The DCNM version we have is 5.2(1)S74.
View 1 Replies View RelatedI have a Nexus 5548 Recently restart itself for no reason I ran the command:
sh system reset-reason
----- reset reason for Supervisor-module 1 (from Supervisor in slot 1) ---
1) At 469203 usecs after Sat May 11 14:02:07 2013
Reason: Reset triggered due to HA policy of Reset
Service: eth_port_sec hap reset
Version: 5.1(3)N1(1a)
sh processes log details
Start type: SRV_OPTION_RESTART_STATELESS (23)
Death reason: SYSMGR_DEATH_REASON_FAILURE_SIGNAL (2)
Last heartbeat 6.09 secs ago
RLIMIT_AS: 189894144
System image name: n5000-uk9.5.1.3.N1.1a.bin
I've been searching in Google/Cisco about the eth_port_sec hap reset and cannot find any reason, just something about the same error but in different technology:
[URL]
CSCub36000 #SNMP polling on eth_port_security objects no longer causes an eth_port_sec hap reset.I just to want to be sure, is the same reason...Or do you know something than can cause it on a Nexus Switch?
We have just purchased and installed the L3 daughter card for our 5548UPs and have also installed the L3 Enterprise Services pkg. The problem is, I cannot enable the EIGRP feature even though we have the Ent Svc lic. After doing a little more research, I see that the Lan Base lic is required to enable the L3 card and many of the L3 features (the card is currently in an "offline" state).
From what I have read on this board, the Lan Base lic is a free license that should be included with the L3 daughter card -- however, Cisco licensing will not issue me that license without a sales order (even though a Nexus engineer said it was included, the licensing group will not issue with an official sales order). Well, our vendor ordered the card and the Ent Svcs lic but for some reason we were never sent a PAK for the LAN Base lic.
I'm attempting to create an erspan session between a Nexus 5000 and 6500 to get traffic from a FEX interface on the 5000 over to a sniffer off of the 6500. The Nexus and 6500 are directly connected with a 10G link, but I added a separate 1G link between the two for the erpsan traffic. I created a routed interface on the 6500, and and SVI on the Nexus. The Erspan session came up, and looked ok from both sides, but as soon as we got a burst of traffic this morning the CPU on the 6500 spiked to 99%. I used 'debug netdr capture rx' to determine the traffic was coming in from the erspan port and subsequently shut down the new interface on the 6500. why this caused a CPU spike? Here are the relevant configs from each device:
Nexus:
vrf context NetOps!
interface Vlan123
no shutdown
[code].....
We are trying to configure RSPAN at one of our sites in order to record voice calls using CallRex. We have it working successfully at another site using RSPAN (smaller site with 4x 3560 PoE switches), but when trying to set it up at this site, it causes "instability" for the voice network to say the least (some phones display one-way audio, UCM down message on the phone...not good). The calls are actually recording successfully on the CallRex server, but we cannot leave the RSPAN config in place due to the issues it causes. As soon as the RSPAN commands are removed, everything behaves normally. Here is the relevent config:
EDGE Switch 1 (Cisco 2960-48LPS):
vlan 210
name CALL-RECORDING
remote-span
interface GigabitEthernet1/0/1
[code]....
The config is pretty stright-forward, but as mentioned above, is causing major problems when turned up.CPU / memory levels are normal. Nothing shows up in the sh log on either the Edge or Core switches.
using the 55xx as a L3 Distribution switch or even as a Core. By enabling the L3 features does it allow you enabled L3 SVI's for VLAN interfaces or are there interfaces on the daughter card that are used for routing instead?
View 5 Replies View RelatedThe Nexus 5548 is running 5.1.3.N2.1a and has the L3 daughter card (N55-D160L3)I have the EIGRP feature enabled. By the way, when doing a 'sh feature' four EIGRP features show up like this: [code] To create the L3 SVI, I go into config mode and attempt to type 'interface vlan 10'. but this doesn't work. These are the only options under the keyword 'interface':
- ethernet
- loopback
- mgmt
- port-channel
I must be missing something simple but can't seem to see what that is. What do I need to do in order to create an L3 SVI on this 5548?
I want to configure management for some Nexus 5548's?I wanted to manage the switches via an SVI. I have read the following document which gives details about the Management SVI but doesn't answer all questions.[URL]I am not running any layer 3 functionality on the switch, no layer3 license (which it mentions in the above link) Will I still be able to create a management SVI. I know I will need to enable the feature 'interface-vlan' to setup a Management SVI, does that require a license?
View 6 Replies View RelatedI encountered problem while trying to copy file from Nexus 5548 to my ftp server (proteus - 192.168.12.220 - the Nexus switch is able to resolve name proteus correctly to 192.168.12.220). See below the working and not working scenarios. I have serached through Cisco Bug Database but unable to find any related bug associated to this problem. This Nexus is running the following NX-OS version.
n5000-uk9-kickstart.5.1.3.N1.1a.bin
n5000-uk9.5.1.3.N1.1a.bin
Working (without specifying the username and full path)
[Code].....
We have two 5548 switches connected to a pair of 6509 running in VSS mode. I am trying to understand the benefit of having bridge assurance on the uplink ports.
If we have the command spanning-tree port type network enabled we cannot do a non disruptive upgrade. If there is bridge assurance on the uplink it warns you of this. Yet if I do not run bridge assurance on the uplinks I can do a upgrade without any disruption.
Why in god would I enable bridge assurance on this VPC link if I cannot do a non disruptive upgrade?
I need to upgrade the code on our two Nexus 5548's in order to facilitate the installation of a few FEX's, but due to the fact that seemingly all of my port-channels are in the STP DESG forwarding state, an ISSU upgrade is not possible. Everything connected directly to our 5548's are utilizing VPC's, including an HP Blade chassis, and several Netapp devices. If I follow the normal upgrade route, should I experience an outage, or should the secondary switch just continue passing traffic?
View 1 Replies View RelatedI'm trying to setup SNMPv3 on a Nexus 5548. We are using SNMPv3 on 3750's without any issue, but haveing issues getting it setup on the Nexus.I have been using the following link for the setup following it line by line. [URL]The part that I'm having issues with is when I try to enforce SNMP message encryption on a per user basis. When I issue snmp-server user (username) enforcePriv, I get warning: unable to update CLI users database. reason: role does not exist grounp not found.
View 1 Replies View RelatedI am using cisco Nexus5548 and trying to enter a snmp community, but it doesn't accept it. I enter a community name that is less than 32 characters, with symbols, numbers and letters.
View 2 Replies View RelatedI am setting up a new environment with 2 5548's and some 2248TP-1GE Fex's and Im running into an issue. I have the peer link and peer-keepalive link that appear to be good. When I configure the fex and vpc for the fex manually on each switch without pre-provisioning the slot the fex comes online and everything appears to be good. I can see all the ineterfaces when doing a sh int br and the sh fex detail shows all good. When I do the exact same thing but pre-provision the slot the fex stays in an offline state. Ive tried disabling the port(s) connected to the fex while configuring everything then enabling them but same thing. [code]
View 5 Replies View RelatedI have a 2232 dual homed to 2 5548's via a port-channel/ vpc. I have one 5548A and configure the port for the 2232 with a vlan, plug into that port and it doesn't come up (inactive). I go to 5548b (Primary) and configure the port and it comes up.
View 3 Replies View Relatedregarding PVLANs and the Nexus, my understanding is that we cannot configure Private VLANs on a FEX trunk port with a NX-OS release older than 5.1(3)N2(1) for the Nexus5548... Is there any known workaround for this limitation (appart from performing a SW upgrade)?
View 2 Replies View RelatedI am working for an Air Force client and am adding a handful of 5548s into their network. My question is how Tacacs+ is configured. My hands are tied in regards to testing in an operational environment so I want to ensure the configs are correct prior to deployment/maintenance window and avoid any remote issues.
I have read the "Cisco Press - TACACS+" config guide and it was somewhat vague in regards to operational deployment.
My basic NX-OS configs are as follows:
- feature tacacs+- tacacs-server key 7 "002A52xxxxxxxxxxxxxxxx8"- tacacs-server host 128.xx.xx.xx timeout 10- tacacs-server host 128.xx.xx.xx timeout 10- tacacs-server directed-request
When I try to set the following command string, aaa authentication login default group tacacs+ local, the NX-OS asks me the input a "server group name". There are no server groups configured. Do I need them? Can I get by without configuring a group name because the client probably will not.
The Cisco IOS devices are configured with normal aaa authentication/authorization parameters. Also, do the VTY ports default to sshv2 and the correct tacacs+ parameters with the "transport input ssh" command (not available)?
I am trying to install SFP-GE-T module on Nexus 5548UP Switch, but is giving the ‘SFP validation Failed’ error. The details of the switch is given below
Model : N5K-C5548UP-FA
The interface is configured with speed 1000 before inserting the module, still we are getting the same error. PFA logs for more details We have 8 Nos of SFP-GE-T modules , all are giving same error. We tried to insert the module on onboard as well as expansion module.
The same module is working fine on Cisco 3750X-24T-L Switch As per the Hardware installation guide , SFP-GE-T transciever is supported on N5K platform. Please extend your support in configuring SFP-GE-T module on N5K platform? We tried with SFP-GE-S module on the same switch , and the same is found working fine.
We have successfully peered two 5548UP switches together and separately we have successfully peered two 5596UP switches together. Works great and is our standard going forward for data center switching. I've been casting about Google and Cisco looking for an answer to this question:
Is it possible to have more than two 5500 class Nexus switches participate in a peered vPC configuration? For instance, can I connect a single FEX to four 5500 class switches in a vPC configuration? The question is more academic than actionable. Even if the answer is yes we probably wouldn't be in a position to implement something like this for a while.
I am trying to interconnect a pair of Nexus 5548 at adjacent sites, using 2 2960-S switches at each site, the reason being that the Multimode Fiber between the sites will only support 100mb and I need this up while I finish having SMF laid.
I have attached a diagram, just debating whether to use etherchannel or vPC - would like to hear some opinions...
Assume the interconnect between the 5548's needs to be 802.1q trunk
just a simple question. Is it possible to use a nexus 5548 UP switch as a layer 3 router between different vlans on the switch without the layer 3 card ? Or is there no 5548 as a router with the layer 3 card ?
View 2 Replies View RelatedAt the core of my network I have two Nexus 5548's with the routing/L3 daughter installed. They have a default route that points to my ASA 5520 for Internet access. I have configured a VLAN that I do not want to have access to the Internet. What is the best way of preventing this access? ACL on the Nexus or Firewall rules on the ASA?
View 1 Replies View RelatedI have a Nexus 5548 installed (layer 2 device only) with several 10G ports supporting IBM P770 systems and a TSM (Tivoli Storage Manager) system on a single VLAN. All of the Nexus 5548 ports are configured for jumbo frames. I was ask to install a new server on the same VLAN as the others but as 1G port without jumbo frames to allow communications with the TSM server. I'm assuming that the 1G port for this new server without jumbo frames configured on the Nexus 5548 will not be unable to communicate with the TSM server that is on the same VLAN with it's Nexus 5548 10G port configure using jumbo frames.
View 5 Replies View RelatedMy Nexus is a 5548-UP model, NX-OS version : 5.1(3)N2(1b)
I try to debug an OSPF and an ICMP problem using the debug ip ospf command and the debug icmp command but not output appear on the terminal. As the switch is remote, I entered the terminal monitor command of course.
SG01NX01# terminal monitor
SG01NX01# debug ip ospf 1 packets
SG01NX01# show debug
[Code].....
Two 5548 switches running switch profile and it got out of sync (probably because one of the switches lost power before it has chance to save configure). Once the switch profile out of sync, you can't make any change to the switch profile any more, verification will fail.Is there any good way to get the switch profile re-sync without recreating it?
View 2 Replies View RelatedAccording to this Cisco URL jumbo frames should be put into play by changing default ethernet system class.
Recommended configuration:
!--- You can enable the Jumbo MTU
!--- for the whole switch by setting the MTU
!--- to its maximum size (9216 bytes) in
[Code].....
Current our environment is the following:
Core1 ---- Core2
| |
Nexus5k
| |
N2k, N2k, N2k (FEX)
||
Servers, hosts, etc..
We would like to add another Nexus5k to this topology. However, it has to be a zero downtime infrastructure add-on. When setting up the keep-alive, peer-link, vPC and vdc domain, will there be any upset in network traffic on the current N5k?Also, are the Nexus5k configurations synchronized or are they independent from one another? Before setting up the new 5k, should i configure it to teh 6509's, and vPC's to the Nexus2k's before setting up peer-link?