Cisco Switching/Routing :: N7000 Inter-AS L3VPN Option B
Nov 29, 2012
I ran into problem with design that was prepared for Catalyst 6500, but in the meantime infrastructure got upgraded to Nexus. I have two datacenters connected with 1Gbit line (point-point), both ends of this circuit are N7K. There are few segments (like LAN, DMZ, PUBLIC) in separate VRFs in each DC and intention was to carry over these segments between locations using VPNv4 exchange via BGP. Each location have its own AS number and IPv4 BGP session is running between them (for global routing table at the moment). I tried to add VPNv4 to that peering session, but got message it is not supported in NX-OS for eBGP. Tried to find some more info about such limitation, but failed.
Before I start explore other options like Option A (creating subinterfaces per VRF and running separate IPv4 BGP session in each).
View 2 Replies
ADVERTISEMENT
Dec 18, 2011
I need a L3 conection between a VSS Cluster and 2 Nexus 7000. Is ECMP the best solution ?
View 3 Replies
View Related
May 14, 2012
Can a F2 card handle 15000 BGP ipv4 route?
View 1 Replies
View Related
Mar 13, 2012
On one of our N7K, we have some packets dropped by the COPP policy in the class-default class-map. Partial results of "show policy-map interface control-plane" not so long after clearing the counters : [code]
what traffic is dropped by the policy ? Is there any logging possible ?
View 2 Replies
View Related
Jul 24, 2007
Does Catalyst 3550 switch support inter vlan routing ?
View 12 Replies
View Related
Jun 1, 2013
I have a DC topology based on 2 layers, access and aggregation, based on 2 pairs of N5548Ps, both without L3 Daugher Cards. My intent is to use the aggregation N5K pair as L3 inter VLAN layer, so I configured all the VLAN default GWs there. The 2 layers are interconnected via vPC, in a double-sided vPC topology for some N2Ks and some vSwitches. The point is that, despite connecitivity is working fairly ok, for some applications, like file transfer via either FTP or HTTP, between hosts in different VLANs, the performance is too poor. The file transfer starts ok, but after a while it becomes lower and lower. ICMP is working, but I can see some strange random behaviour, like having some packets taking more that 20 ms (sometimes 40 or more), whilst average is 2 ms.
I read through some articles saying that until you don´t have the L3 license (the one coming with L3 Daughter Cards) you can expect some weird behaviour on L3 level. Is that true?. What can I do apart of purchasing L3 Daughter Cards?. Can I enable L3 Basic license at the moment (I don´t need dynamic routing for now).
Here some excerpts of what I´m saying:
PING results:
10000 packets transmitted, 10000 packets received, 0.00% packet loss
round-trip min/avg/max = 0.809/2.496/57.559 ms
System version: 5.0(3)N2(1)
License and features on the N5Ks:
switch# sho license usage
Feature Ins Lic Status Expiry Date Comments
Count
--------------------------------------------------------------------------------
FCOE_NPV_PKG No - Unused -
FM_SERVER_PKG No - Unused -
ENTERPRISE_PKG No - Unused -
[code]....
View 3 Replies
View Related
Dec 17, 2011
I have been looking into this for a while and I can't seem to figure out why my 2nd vlan is not able to connect properly to the net.
My switch has 12 ports where my devices connects directly, they are all on Vlan 1 and they all work perfectly. on Port 12 I have a dlink router that is connected to a cable modem. the dlink router has an Ip address of 192.168.0.20
I created a second vlan (vlan2) and enabled dhcp relay on it. then I assigned port 9 on the switch to (vlan2)my laptop which is connected to port 9 seems to get an ip address fine and able to ping only some devices on my network (vlan1) and is not able to go out to the internet. I think it has to do with the routes. [code]
View 4 Replies
View Related
Feb 15, 2013
We have two Cisco 5505 firewalls connecting to two ISP's . The two internal LAN's on the firewalls are 192.168.184.0/24 & 192.168.186.0/24. We also have a Cisco C3560x layer3 switch with vlan interfaces 184.3 & 186.3. We have two DGS-3100 Dlink layer 2 switches connecting our users to the Layer 3. Ip routing is enabled for intervlan communication & I can reach the Switch interfaces & firewall gateways from machines on both on the vlans.We have pbr enabled on the 3560 & users only on the .186 network can get to the internet. The switch is running the ipservices license & the sdm template is "desktop routing" .
Users on the .184 cannot access the internet but we can ping the layer3 interface & the firewall gateway. [code]
View 20 Replies
View Related
Jan 10, 2012
Can nexus 5010 supports inter v lan routing , as there is no core switch and router available in current network.
View 2 Replies
View Related
Mar 24, 2013
In 3750 switch,I have configured intervlan routing.I have three vlans Vlan 10,vlan 20,Vlan 30 and I have assigned IP address for that Vlan.In vlan 10,I have connected one systen gigabitethernet 0/1 interface.From my system I am able to ping vlan 10 ip address but I can't able to ping other vlan ip address (vlan 20,vlan 30).Is it possible to up the protocol for all that time.
View 2 Replies
View Related
Feb 5, 2012
I recently set up a small photography business and am trying to get a Cisco 877 and Cisco SG300-10 switch to talk to each other.
What I want is for the Cisco 877 to handle the internet and the SG300-10 to handle the local network,
I have set up 2 vlans in trunk mode on the switch and want vlan2 to manage local traffic and vlan3 to handle the internet.
I have got the 877 connecting to the internet what I dont have, traffic going to vlan2 on the switch from the 877
Look at the running configs for the switch and the router and tell me how to get the vlan on the router to pass traffic to the switch. In a nutshell I am inserting the internet into the switch but am not sure how to progress. I have the c870-advipservicesk9 image file on the router.
Switch Config
interface gi2
description connection-to-data-vlan
exit
interface gi3
description connection-to-internet-vlan
exit
vlan database (code )
View 11 Replies
View Related
Mar 28, 2013
I am working for a large campus network. The network has more than 70 VLANS in a Layer 3 Switch(Catalyst 4503). Customer wants to stop intervlan routing between all vlans except 2 vlans. How will i do that? I have also a Firewall (ASA 5520) & a Router (2811) in up of the switch. Besides this, I have run HSRP in Layer 3 Switches for redundancy.how will i stop intervlan routing between VLANS except 2, with ACL or any other process has?
View 10 Replies
View Related
May 9, 2013
I'm looking to restrict Inter-VLAN routing through L3 switch (cisco 6500) and wanted to know best possible way to do it. I used VACL and achieved success to some extent, but my config is making clients take up to 5-6 mins to authenticate IP address from the DNS (bootps).My VACL config was as follows:
Subnet to restrict is 10.100.15.0 (VLAN 15)
STEP 1: Created extended ACL to allow bootpc/bootps through DNS
ip access-list extended EACL_DNS
permit udp any eq bootps any
permit udp any eq bootpc any
STEP 2: Created standard ACLs to allow only relevant subnet, server VLANs & some IPs from other subnets for printers/scanners etc.
ip access-list standard SACL_VLAN_15
permit 10.100.15.0 0.0.0.255 (the subnet I'm restricting)
permit 10.100.50.0 0.0.0.255 (server VLANs)
permit 10.100.25.45 0.0.0.0 (printer in another VLAN which has to have access in VLAN 15)
STEP 3: Created VLAN access list
vlan access-map VACL_15 10
match ip address EACL_DNS
action forward
vlan access-map VACL_15 20
match ip address SACL_15
action forward
STEP 4: Applying VLAN Access list on VLAN 15 vlan filter VACL_15 vlan-list 15 Though the above works, below is noted:
1. I'm still able to PING 10.100.15.2 (the switch virtual interface) from outside the subnet, which I don't intend to do so. Howeve all cients in the subnet have no connectivity from outside the VLAN 15.
2. As mentioned its taking quiet some time to negotiate with the DNS server at system boot time.
View 3 Replies
View Related
Feb 16, 2011
you find attached my network architecture with 2 Nexus 7010 on core layer and 2 Nexus 5020 on distribution layer, each one with 1 N2148T fabric extender switch. PC-A1 and PC-A2 are connected to one N2148T, PC-B1 is connected to the other N2148T. Nexus-7000-1 is HSRP Active for all VLANs, Nexus-7000-2 is HSRP standby. PC-A1 and PC-A2 are connected to VLAN A, PC-B1 is connected to VLAN B. PC-A1 and PC-A2 have the same default gateway correspondent to IP HSRP on VLAN A. It happens that PC-A1 is able to ping PC-B1 while PC-A2 is unable to ping PC-B1. If I issue a traceroute from PC-A2 I see Nexus-7000-2’s physical IP address as the first hop even if Nexus-7000-2 is HSRP standby. After the first hop the traceroute is lost. If I shutdown Port-channel 20 on Nexus-5000-2, PC-A2 starts to ping PC-B1.I can’t understand what’s wrong in this architecture.
View 6 Replies
View Related
Jun 25, 2012
I have just bought myself a Cisco 2821 ISR.At present in my home I have a Cisco 2621XM. Fast Ethernet 0/0 is connected to a 3524XL as a trunk to provide my LAN with inter-vlan routing. it works great. Fast Ethernet 0/1 is connected to my ISP's cable modem and uses the command "Ip address dhcp" to get an IP and all other info from my ISP.FA 0/1 is Ip nat outside and the FA 0/0 and all sub interface like 0/0.1 .24 .168 etc all ip nat inside.I get intervlan routing and access to the internet via this router.I have this 2821 to replace the 2621XM as I plan to run CME on it and want gigabit routing on my vlans as at the moment on the 2621 routing between vlans it at half duplex or seems to be.I have configured the 2821 to ip nat outside on gig 0/0 and ip nat inside on gig 0/1 and all of the sub interfaces (same setup as my 2621 but with gig ethernet)I have no access to the internet at all but I can ping www.google.co.uk and other domain names from the terminal session when I am connected to the 2821 via the console or telnet/SSH. the gig 0/0 has an IP assigned from my ISP too but no other nodes on the network can ping outside.Am I missing something here? the version of IOS is V 15.
My access list goes someting like
access-list 1 permit 10.0.0.0 0.255.255.255
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 permit ip 10.0.0.0 0.255.255.255 any
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
and so on
I still cannot access the internet.....
View 5 Replies
View Related
Mar 18, 2013
I have a SG 300-28 switch with the latest firmware installed running in Layer 3 mode.
I configured this router with 4 VLAN's where VLAN 1 is connected to the network router. All VLAN's call all communitcate with one another. How do I go about configuring VLAN's so that they can only communicate with the router and the internet and not each other?
View 1 Replies
View Related
Nov 27, 2012
I have one cisco 3750G-48 switch, one cisco 3560G-PS switch, Cisco UC520, cisco 2851 and cisco wireless access point.i have setup up intervlan routing between the two cisco switches and the uc520 with a total of four VLANS, the problem i'm having is with the 2851 router, I have created a trunk between the 3750 switch and the 2851 router. should I create subinterfaces on the 2851 router for the four vlans by doing gigabieethernet 0/0.1, 0/0.100 and so on or should I create BVI subinterfaces.
reason I ask is I created four vlans on the vtp server switch which is the 3750 and I connected the uc520 to the 3750 switch via a trunk interface and set up vtp client on the uc520, after I setup p the vtp on the uc520 the vlans were automatically created on the uc520 with each vlan having its own BVI interface.
So I am not sure how to configure the 2851 router to interact with the four vlans. also the 2851 router have two hwic 1adsl wics installed which will have two adsl connections coming in.how to set up the 2851.
View 3 Replies
View Related
Dec 9, 2012
I am looking for a reasonable switch but it has do do inter-VLAN Routing. I know I could go with a 3560/3750 with IP Services but I am also thinking the 2960S with IP Base IOS might do?
I have looked up the IP Base IOS and it does list IP Routing but how to actually configure inter-VLAN Routing on a 2960S with IP Base?
View 2 Replies
View Related
Jun 7, 2012
I've got a requirement to do Inter-VRF routing (need MP-BGP) using a private AS Number on a stack of 7 x 3750G's, my question ultimately is the performance overhead of doing such a change.
The stack will have no more than 300-400 routes even with the duplicates invoked from doing VRF leaking so I can't see much of an issue myself, we already have 2 VRF's and OSPF running in each VRF just don't have MP-BGP to do the VRF leaking.
Ultimately there will be about 4-5 VRF's (I know there's a Software limit of 26 VRF's on a 3750G).
View 3 Replies
View Related
Sep 9, 2012
Can any share some useful links on how this works and how to configure it? Do you still need to configure FHRP or does configuring redundancy take care of active/standby relationship between the ASR's?
View 2 Replies
View Related
Aug 28, 2012
I'm trying to get a node in SVI1 on VRF1 to speak to another node in SVI2 on VRF2 to reach each other. After hours of failure, I went to outside resources. Everything I read on the internet says it's not possible on this platform and at least one TAC engineer seems to agree.
I just can't believe such a high-end data center switch is not capable of handling such a basic feature.
View 1 Replies
View Related
Apr 19, 2012
Probably an easy fix but something's weird in my config. I am setting up a new network, so this is not production, Routed environment, down to the access layer using 3560-x l3 switches.
vlan 10: data
vlan 20: wifi
vlan 30: wifi guests
vlan 40: voip
My objective is to allow all traffic OUTBOUND to certain subnets (10.10.0.0/24, 10.10.100.0/24, 10.10.110.0/24 10.10.120.0/24) and block any other 10.0.0.0/8 networks. By doing it this way, after blocking all other internal traffic, I allow everything else to ensure internet traffic can go out.
Extended IP access list VLAN10_TRAFFIC_FLOW 10 permit ip any 10.10.0.0 0.0.0.255 20 permit ip any 10.10.100.0 0.0.0.255 30 permit ip any 10.10.110.0 0.0.0.255 40 permit ip any 10.10.120.0 0.0.0.255 50 deny ip any 10.0.0.0 0.255.255.255 (5 matches) 60 deny ip any 172.16.0.0 0.0.255.255 70 permit ip any any!interface Vlan10description DATAip address 10.104.10.1 255.255.255.0ip access-group VLAN10_TRAFFIC_FLOW outendThe problem is, from the above info, when I ping 10.10.0.5 from a workstation in VLAN 10, it should match rule 10, but instead if matches rule 50 (as shown by the 5 matches)
View 13 Replies
View Related
Aug 28, 2012
I just received a Nexus 5548 to configure as the core of the Datacenter LAN. Is it true that the VRFs created cannot talk to each other??? I can't seem to find any documentation on how to do this and at least one TAC engineer half-heartedly believes it's not possible, either.
Basically, I'm trying to get an SVI in VRF1 to be able to talk to an device on another SVI in VRF2.
I can't believe this high-end switch, that is so capable in every regard, cannot handle this feature.
View 1 Replies
View Related
Jul 16, 2012
Im trying to find an affordable Cisco switch with similar capabilities and features as the WS-C3560X-48T-S (L2/L3 routing as in IP Base, dual power supply, etc.).
View 2 Replies
View Related
Nov 5, 2011
just got new hardware and decided to try the newer USB port for IOS upgrades. I could not get the switch to recognize my 2gig flash drive. Do I need a proprietary stick or special format?
I also noticed when I removed it the switches crash dump and rebooted?
View 12 Replies
View Related
Sep 23, 2012
I just got my Cisco SG300 28, but I have some problems getting the routing to work. I get the vlans to get to the router, with the default route. But not getting them to talk with each other. I can ping the IPs from the cisco, but I am not getting traffic to go from vlan 1 to vlan 2. When I try to google, it say that it should do it automatically, and I found no setting for it. It looks like it not creating any route for the interfaces.
View 2 Replies
View Related
Feb 2, 2012
I'm having an issue routing between vlans. I have vlan 1, and 2. I want to ping something on vlan 2, from vlan 1. I cannot ping from a computer on vlan 1 to a computer on vlan 2. I can ping each computer from the ASA 5505. I get an error on the ASA when I try to ping from the computers. The error is Failed to locate egress interface for UDP from voice:192.168.0.199/137 to 192.168.1.200/137. I can't understand why it even mentions IP 192.168. 1.200/ 137... I reset the unit configuring it from scratch and still no go. I have no given a static route to the out yet.. I need to get inter-vlan routing working first. [code]
View 13 Replies
View Related
Jun 25, 2012
I have 3750 series with GIBICs ports I want to create 10 vlans with its sub-net and enable all vlans to access internet.
View 4 Replies
View Related
Jan 19, 2012
I currently have 3 core switches on my campus. They are 6509 catalyst switches. They currently are not interconnected to each other.I want to interconnect them to each other. The IP addresses of each core sit on a interface Loopback500. [code] How can I interconnect each core to each other and what IP scheme could I use. I want them to be straight L3 to each other.
View 8 Replies
View Related
Dec 20, 2012
My architecture is the same as show on the link with some difference.I use the router 1841 for inetrnet connexion instead of 7200VXR, this router 1841 is connected on the catalyst 3750 port G1/0/1.I use catalyst 2960 instead of catalyst 2950 or 2948.I use ASA 5510 for conexion on remote branche(I have 5 remote site), This ASA is connected on the catalyst 3750 port G1/0/37
Result of the test:
-I can ping devices in the same Vlans
-I can ping devices in different VLANs
-I can ping all device from the catalyst 3750
I cannot ping the router 1841 or ASA 5510 from the any devices (computer)The gateway of each computer is the correpondant VLAN IP address configured on the catalyst 3750.Why I cannot ping the router 1841 or ASA 5510 from the any devices (computer)
View 19 Replies
View Related
Dec 10, 2012
I am trying to configure Cisco SG300-52 switch for the first time and stuck without CLI configuration option. The configuration can be done using GUI, however, configuring using CLI would be more comfortable (as I am used to work with CLI of other Cisco switches)..
I was able to lo gin to switch using SSH, but the CLI appears in MENU format and was not able to find any way to go to CLI mode.
As per some blogs, in SG300 switches CLI mode can be accessed using Ctrl + Z in Menu, which did not work either in my case.
Switch is running with latest firmware version Sx300 Firmware Version 1.2.7.76.
View 2 Replies
View Related
Sep 19, 2012
I am updating the iOS for a 4948 the bootflash is empty so all i can get into is the rommon. There is no option for x-modem. How can I put the iOS onto this device? [code]
View 2 Replies
View Related
Dec 11, 2012
We have a Cat2960-S Series PoE+ currently running 12.2(55) SE5 ios with SW image C2960S-UNIVERSALK9-M.We want to upgrade the ios to the lastest version but found there are 2 version: 12.2(53) SE2 and 15.0(1) SE.Which is the best & suitable for upgrade?
View 3 Replies
View Related
