Cisco Switching/Routing :: Net-flow Not Reporting Egress Traffic On 6509 Vlan

Nov 27, 2011

We have a pair of 6509 working in a VSS configuration (IOS 12.2(33)SX5). The 6509s connect to a pair of ASAs (7.2 code) running in an Active/Standby setup. These ASAs in turn connect to routers going to remote sites. I have configured Netflow on the following VLANS,
VLAN 10 - Servers Vlan
VLAN 9 - Transit/ASA VLAN (connects ASAs to 6509s). All traffic originating from any VLAN on the 6509 crosses this VLAN in order to reach remote sites and vice versa
I configured the netflow source VLAN 11 although I am not collecing any netflow from it.Although I have been getting lots of Netflow info, I noticed that netflow for traffic originating from any user VLAN on the 6509s going to any remote site via TRANSIT/ASA VLAN(9) does not get reported, I even tested with 4 GB traffic but no result. Only reverse traffic (i.e. from remote site to user VLAN) is reported as it traverses the Transit VLAN (9).
I read somewhere that egress netflow is not supported in 6500, but isnt traffic originating from a user vlan to a remote site via the transit VLAN (9) considered ingress with respect to the transit VLAN (9)? I would like to know whether bidirectional Netflow is supported on 6500 VLANS. I have mimimum control on routers beyond the ASAs, and since these ASAs run 7.2 code netflow is not supported, and Monitoring this Transit Vlan gives me extremely useful info.
I do get netflow biderectional traffic from the Server Vlan 10, but I think it is correlated by the netflow collector from vlans 9 and 10. [code]

View 9 Replies


Cisco Switching/Routing :: Traffic Flow Catalyst 6509 With WS-X6548-GE-TX

Nov 21, 2011

I'm receiving multicast traffic (400Mbps) on port 9/38 and sending it out on port gi9/48. I'm trying to achieve that traffic will stay within the card without using the switchfabric, 

View 2 Replies View Related

Cisco :: 7204 VXR - IP Flow Not Showing Egress Traffic

Dec 6, 2011

I have a 7204VXR Router, with Neflow. The collection for all interfaces is ok, but one interface (Gigabitethernet 1/0), is not showing the egress traffic in the pictures. The configuration has "ip route-cache flow", ip flow egress, and ip flow ingress set. But, is not showing the egress traffic.

View 4 Replies View Related

Cisco WAN :: Why IP Flow Egress Is Not Functioning On 7600

Jun 2, 2012

why ip flow egress is not functioning on 7600?When I do "sho ip cach flow",  I can see only inbound flows.

View 5 Replies View Related

Cisco Switching/Routing :: 5520 Configure Traffic Flow Between Computers Inside VLANs And Routed Port

Jul 7, 2012

How to configure traffic flow between  computers inside VLANs and a routed port? Here is the setup details:
1. Switch 3750-X
2. VLAN 100 - ( SVI IP address /24)
3. VLAN 200 - ( SVI IP address /24)
4. routed port gi1/0/48 (IP address /24). Note: this port is directly connected to a firewall ASA 5520 port IP /24
Ip routing is enabled on the switch and inter vlan traffic is flowing ok. I can ping the routed port gi1/0/48 from  any computer connected in the VLAN 100 or 200. For example computer with IP can ping the routed port Switch can ping firewall port and the 'sh ip route' command shows the network /24 as directly connected network.
any computer in the two VLANs CANNOT ping firewall ASA port   Is it because inter VLAN routing does not work with a routed port on L3 switch? I looked up fallback bridging, but it is meant for non IP traffic.The goal is I am trying to set the ASA port as an internet gateway for VLANs. 

View 4 Replies View Related

Cisco Switching/Routing :: How To Backup VLAN DAT On 6509

Feb 5, 2013

We backup the running config on the 6509 does it also backup the vlan.dat as well?I tried command dir/all and just dir but did not see the vlan.dat listed

View 6 Replies View Related

Cisco Switching/Routing :: 6509 - How To Configure New VLan

Nov 1, 2011

I have a Cisco 6509 connected (gig3/17) to a Cisco 3560 G switch (Gig 0/28).  The 3560 switch Gig 0/26)is connected to a distribution switch on another network.  The ip address on my 6500 is and the ip address on my 3560 is  The ip address given to me by the other network is  How do I configure the new vlan in this situation and the ip address given to me.

View 4 Replies View Related

Cisco Switching/Routing :: 6509 ACL Block TCP Traffic One Way

Jul 14, 2010

Got servers in vlan 10 ip range and servers in vlan 20 ip range at the same layer 3 switch. (c6509 sup720)I would like to block TCP traffic initiated from Vlan 20 to Vlan 10. But the servers in Vlan 10 needs to be able to open an TCP connections to Vlan 20 did test with the ACL thats blocking (ack/established/syn) but unable to get it to work.Or it works both directions or is works non directions.

View 4 Replies View Related

Cisco Switching/Routing :: 6509 Use Policy Based Routing To Redirect Http Traffic

May 29, 2012

We have a Catalyst 6509 switch, and we hope to use policy based routing to redirect http traffic to my proxy server, where I can find the configuration example?

View 11 Replies View Related

Cisco Switching/Routing :: 6509 - Inhibit Vlan Routing

Nov 8, 2012

I would like to ask you if it's possibile to block routing between some Vlan for just once of them.
Maybe I can explain better:
I've got a Cisco 6509 with 4 configured vlan interfaces
Int Vlan 10
Int Vlan 20
Int Vlan 30
Int Vlan 40
Vlan "10" is the phone voip Vlan and it must not talk with the others Vlan. The others Vlan can comunicate normally except with Vlan "10".
Pratically Vlan "10" needs to be isolated from the others.
This equirement comes becouse Vlan 10 is wireless and has the WEP key encryption (very weak protocol). Some Phone couldn't support the WPA2 key and I need to avoid an unauthorized external client, cracking the WEP key and connecting to this WiFi, could have free access to the others Vlan.

View 5 Replies View Related

Cisco Switching/Routing :: 6509 Vlan Configuration Missing?

Jun 17, 2012

After a abrupt power cylce of 6509 switch, vlan configuration got missing. Switch has not crashed.

View 4 Replies View Related

Cisco Switching/Routing :: STP 6509-E On Vlan 1 In A Heterogeneous Network

Aug 15, 2012

we have an heterogeneous network with Cisco devices (6509-E, 3750G and 3560) and Alcatel 6850 devices. We have to enable a PTP Wifi line as a backup for the fiber line between two buildings. For this purpose, we have connected a wifi device to GigabitEthernet 0/47 of SWIHGJ1 and configured it as: [code]

View 2 Replies View Related

Cisco Switching/Routing :: View IP Traffic On NX7000 Like On 6509 OIS

Dec 8, 2011

I would like to have a view of ip traffic on NX7000 as I am used on 6509 OIS, running the above commands: [code] Finding something like on 7000 ?

View 2 Replies View Related

Cisco Switching/Routing :: 6509 / Unicast NLB High Traffic?

Apr 27, 2013

i recently identified all switch ports in my network on 6509 core were Transmitting Mail server Exchange traffic that was destined for Unicast NLB cluster. and it was impacting various HOST machines NIC cards/performance.After reading this article, i moved NLB CAS servers behind a dedicated cisco Switch.
Now My core switch can learn mac address across its trunk port where CAS servers are connected on dedicated switch. but still i can see traffic Transmitting out to my all switch ports of same VLAN ( same as NLB VLAN).

View 5 Replies View Related

Cisco Switching/Routing :: 6509 Vlan Flapping Between Port-channels

Mar 10, 2012

We have a pair Cisco 6509 switch in which 2 * 48 Port 1G line cards and 1 * 16 Port 10G line Card, FWSM and Sup 720 are installed.We have Cisco UCS and HP Blade servers.Cisco UCS servers are connected to Cisco 6509 switch using Fabric Interconnect, and HP Servers are directly connected to core switches.Recently the team made many changes in the network. Upgraded the IOS in Cisco 6509 switch, Configured Port profiling , MAC Pinning , HBA Cards to UCS / Nexus 1000V Infrastructure. After this change they lost the connectivity to UCS and HP Serers. Every tower is checking at their end.
The Network Team has reverted back the core switch with old IOS , but still the problem persisit.I could only see the following error log in the core switch. There are two port-channels one between core 1 and core 2. The other is between core switch and FWSM module. [code]

View 2 Replies View Related

Cisco Switching/Routing :: Setup VLan Between 6509 And 2621 Router?

Oct 25, 2011

I need to setup a vlan between the 6509 and 2621 router. This needs to be a VLAN (200) the runs between the devices that uses DOT1Q trunking. The end result is all the networks (vlans)  on the 6509 can talk to the LAN on the 2600 ( / 23) and visa versa.
Device 1
6509 with CatOS / IOS
Config I did on the MSFC:
Interface Vlan 200
ip address


View 13 Replies View Related

Cisco Switching/Routing :: 6509 Unable To Redirect Http Traffic

Mar 26, 2012

On a Catalyst 6509 switch I have configured wccp protocol in order to redirect the Http traffic to a Bluecoat SG8100. It was working fine until a new L3 interface implementation.Thereafter I was unable to redirect the http traffic due to an error reported from the Cat6509: [code] After some checks I supposed that the problem should be the UDP 2048 port connection between the Switch and the Bluecoat while the switch L3 port and the bluecoat are on the same Lan. A deep analysis found that the WCCP protocol seems to be as follow:

-Proxy address to Switch Port Here I Am
-Switch Port to Proxy address I See You
-Switch Port to Proxy address UDP 2048 packet (dropped by firewall)
It's strange to me that the first dialog is correctly handled by the correct Cat6509 interface while the UDP packets are flowing from another Vlan interface not configured with the WCCP and apparently not involved on the protocol.Last of all the WCCP is now disabled and unusable?

View 4 Replies View Related

Cisco Switching/Routing :: 6509 QOS To Limit Bandwidth For Internet Traffic

Nov 5, 2012

We run a workers camp here and we currently have around 2500-3000 people using our 100MB internet pipe.  We are upgrading the pipe to 200MB soon but I still would like to limit how much bandwidth everyone is using.
We allow streaming media such as Netflix, youtube, apple TV and of course .So it gets full pretty fast.  We have QOS implemented although I wasn't here when it was done so I don't know a lot about it.  I would like to limit IPs to a certain amount of bandwidth. [code]

View 1 Replies View Related

Cisco Switching/Routing :: Set Port Vlan On 6509 Running In Vtp Client Mode

Jan 14, 2013

I'm working at a company that has several 6509 switches running CatOS.  They have two of the 6509's running in vtp server mode and the rest as clients.  I set up a new vlan from one of the vtp servers and it propagated out.  The problem comes when I try to assign a port on one of the vtp clients to this new vlan.  It gives me an error that the switch must be in vtp server mode to add/delete vlans.  I'm not trying to add/or delete a vlan just trying to add a port into an existing vlan.  I'm hesitant to put the switch in vtp server mode.  Is this a CatOS thing or is there a specific command to accomplish this?             

View 5 Replies View Related

Cisco Switching/Routing :: 6509 - Can't Change Native Vlan On Trunk Port?

Jun 6, 2012

I have several closets with Cisco 3560 on the edge that I'd like to change the vlan that's used for the management vlan on each. In the core I have a Cisco 6509 with Sup720's.
I'd like to do this by changing the native vlan on the trunk port on the core 6509 interface that connects to the 3560. and leave the management vlan on the 3560 as vlan 1.
Seems trivial but what I tried didn't work and I didn't have the window to troubleshoot. I'll paste the simplified configs for  the interfaces  below
6509 configs:
interface Vlan50ip address!interface FastEthernet


View 5 Replies View Related

Cisco Switching/Routing :: Disable Administrative Native Vlan Tagging On 6509?

Dec 13, 2012

We have a problem with CDP packets on sent by our Cisco 6509's.  Unlike our other Cisco switches (4948G, 5020, etc.), the 6509 tags administrative traffic on the native vlan.  As a result the CDP packets are sent with an 802.1Q header with a tag of 1.  The other switches send the CDP packets untagged on the native vlan.  This causes problems because we have non-Cisco devices in our lab that also receive and send CDP, but they do not process the packets that are tagged by the 6509.  They see the packets from the 4948 and 5020 just fine.
How can I disable the administrative native vlan tagging on the 6509?  Here is the current setup:
nwkdev-6509-1#show vlan dot1q tag native
dot1q native vlan tagging is disabled globally
nwkdev-6509-1#show interfaces gigabitEthernet 1/9/1 switchport


View 13 Replies View Related

Cisco Switching/Routing :: Capturing Traffic Flows From 3750 To 6509 Then To Netflow

Aug 6, 2012

I am aware that the 3750 switches are not able to support Netflows, so I have created a SPAN port and spanning traffic from a specific port. I would like to create a seperate VLAN and trunk the traffic from the SPAN port down to the 6509 switch and then capture all the traffic for that VLAN on the 6509.

View 4 Replies View Related

Cisco Switching/Routing :: 6509 - Block All FTP Traffic On Port 21 From Servers In Network

Oct 3, 2012

I am attempting to block all FTP traffic on port 21 from the servers in my network, and only allow FTP from one server to go out.
I have created the following ACL
access-list 101 Permit ip any any
access-list 101 Permit 21 any
access-list 101 Deny 21 any any
and have applied it to my truck VPN that goes up to my firewall
int Vlanxxx
ip access-group 101 out
But when i test ftp is still allowed by all servers.

View 6 Replies View Related

Cisco Switching/Routing :: Slow File Transfer Speed In Same Vlan Of 6509 Switch

Mar 16, 2013

I am getting very slow window file transfer speed (4 Mbps per second) between two connecting servers in Cisco 6509 switch. I have connect the two laptops in 6509 switch in same module using the same vlan and try to copy the files from one laptop to another and vice versa and got the same speed on 4 to 5 Mbps per second. Switch utilization is not more than 10% and both the laptops are connected in 1 Gbps full duplex.
I have checked by removing the gateway in both laptop but the output is same.

View 7 Replies View Related

Cisco Switching/Routing :: 6509 - 802.1x And Voice VLAN / Enable Dot1x On User's Ports On The Switch

Sep 17, 2012

I have a Cisco 6509 with IOS "s222-ipservicesk9_wan-mz.122-18.SXF16.bin"I need to enable dot1x on user's ports on the switch. each user is connected to the switch through the IP phone.
I just found out that I can not enabled dot1x on trunk port. I have tried to use "switchport voice vlan " but I got:
Switch(config-if)#switchport voice vlan 123
Command rejected: Gi7/20 is Dot1x enabled port.
let me know what should I do to get dot1x working?
Note: I have connected a laptop directly to the port and dot1x is working fine.

View 5 Replies View Related

Cisco Switching/Routing :: 2960 / Traffic In Same VLAN Goes Up Trunk?

Feb 11, 2013

I have 2 hosts, 1 plugged in fa 0/21 in VLAN 101 and another in fa 0/22 in VLAN 101 on our L2 Cisco 2960.  If I try and transfer files from either host the gig 0/1 trunk port on the 2960 leading tot he 3750 fa 0/1 port hits 100mb (using a real time bandwidth monitor tool), but why?  This VLAN is on the same switch, why does it go one way up the trunk to the L3 3750 switch?  The L3 3750 is the VTP server and the 2960 is a client.  I would of thought the traffic stays local.  The 2 hosts don't even have a gateway set.To sum up the typology the 2960 and 3750 are trunked using a single cable.  The 3750 hangs of a ASA firewall using SVIs.Here is whatthe traffic looks like when copying a file between hosts (2gb file).
3750 L3 Switch (VTP Server)
  interface FastEthernet1/0/4
description Trunk to Cisco 2960 Gig 0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate


View 6 Replies View Related

Cisco Switching/Routing :: 3750 - Only Allow Specific Traffic To VLAN

Oct 10, 2012

Have a quick question regarding inter-vlan routing on a 3750.  Overview of network is ISP --> ASA --> 3750 (acting as my core and default gw).  I have 5 vlan interfaces on my 3750, all w/ 192.192.x.x subnets, a 6th w/ 192.168.100.x, and a 7th w/ 192.168.200.x.  I have enabled "ip routing" on the switch and can successfully ping from subnet A to subnet B as long as both devices are using the correct DG for their vlan, which is the switch.  I have a few ports that are trunked as well that go to ESX hosts which break out the vlans according to the subnet the vm should be attached to.  The ASA is set to nat internal traffic for all the vlans.
Now my question:  short of applying an ACL to each vlan interface to block traffic from other 192.192.x.x subnets is there a better way to accomplish this?  I want my 192.168.10.x subnet to be able to reach all the subnets, but don't want 192.192.10.x to be able to talk to 192.192.20.x for example.  I was thinking to create an acl like this:
access-list 120 permit ip access-list 120 deny ip 120 permit ip any
and then applying this to the interface for the appropriate vlan. 

View 4 Replies View Related

Cisco Switching/Routing :: EDS 316 / 208 - Network Don't Permit Traffic UDP In VLAN

Jul 17, 2012

I have problems in my Cisco network until I connected some Moxa devices.This Moxa are models EDS-316 and EDS-208
My principal trouble is the traffic UDP. Suddently the network don't permit the traffic UDP in VLAN where are connected Moxa devices.
During an hour the Moxa can send TCP traffic, but can't send UDP. If a Moxa device is unplugged from network, all devices connected to him can work offile from principal network, but if I plugg again the Moxa is like disable.
After one hour (more or less) the system restart all functions and work fine.I catch the logs from TXerrorsInPorts and all the ports where is connected a Moxa have errors all time.
I don't know which is the problem, but I think that problem is in negotiation from Moxa to Cisco.This is the configuration from a port where is connected a Moxa: [code]

View 1 Replies View Related

Cisco Switching/Routing :: 6500 QoS COS Egress Not Marked

Feb 15, 2012

Problem: My traffic coming inbound appears to be marked but is not marked when egressing.

Ingress from encoder G3/9->> Egress G8/1Default DSCP/COS map table (DSCP 24 is COS3) 
Cos-dscp map:
cos:   0  1  2  3  4  5  6  7
dscp:   0  8 16 24 32 40 48 56
1. Any reason COS 3 is not marked outbound on this traffic? I'm determining this by doing a wireshark off of interface g8/1. The traffic appears to be marked on the ingress correctly but does not maintain its mark on the egress. I can confirm this with equipment on other Ethernet links in produciton as well as my test port listed in the config below with wireshark.
FYI: Unfortunately with my cards in the 6509 I cannot port mirror and see outbound multicast (determined through a TAC case). Because the STB does not understand tagged traffic I setup the native vlan for it to function. To see the multicast with tags I temporarily remove the native command and do the wireshark to see the multicast. It still shows a COS setting of 0. I will try to attach a capture of a multicast packet.
interface GigabitEthernet3/9 description Mulicast Encoder
switchport access vlan 962
switchport mode access
logging event link-status
load-interval 30

View 2 Replies View Related

Cisco :: LMS 4.1 Reporting For VLAN Information

Mar 6, 2012

I'm currently running Cisco LMS 4.1. I need to see if there is a way in the LMS, either through the menu or via a report, that can give me the V LAN numbers, the description, the IP address, the Interface (SVI) the v LAN is on and the route it takes.
I've searched near and far and haven't come up with anything yet.

View 3 Replies View Related

Cisco Switching/Routing :: 4507 - Monitoring All Traffic From VLAN To Cloud

Jun 14, 2012

I have a requirement to monitor all traffic going from the internal LAN to the cloud.  The LAN is a layer 2 VLAN  which spans multiple Cisco 4507 switched and other smaller switches.
The VLAN has an IP address which the hosts use as the default gateway.
The exit port is on a Cisco 3600X switch connecrted to 4507 #1 via a 10G fiber link. 4507 #1 connects the rest of the LAN. Those switches interconnect via 10G fiber and 1G copper links.
Currently the monitor host is connected to a 1G copper port, configured as a monitor port,  on one of the backside 4507s The switch manager says he has the switches configured so that I can see all traffic on the VLAN.

View 1 Replies View Related

Cisco Switching/Routing :: GC2960 - Incoming Traffic On VLan Getting Lost?

Apr 11, 2012

We have a switch gc2960. It has ports configured on vlan 27 and vlan 29.It is connected to switch ch3550. It has presence of vlan 27 vlan 29 and also vlan 18 and several other vlans.Our internet firewall is connected to ch3550. It is a fortinet product, so this is not indicated on the diagram.
When the two switches were connected on vlan 29 access ports, pc's on vlan 29 on gc2960 worked as expected. vlan 27 clients of course did not work.When we switched the connecting ports to trunk ports, some weird stuff happened. Clients on gc2960 on vlan 29 could ping and resolve dns, but not browse the intenet. The same was true for clients on gc2960 vlan 27. We verified that packets from the web were coming in through the firewall. What we were thinking, is that they somehow were not being tagged to vlan 29 even though we were trunking.
When we set native vlan 29 on the trunk, then clients on gc2960 vlan 29 operated as expected. However, clients on gc2960 vlan 27 are still having this problem, we can ping and resolve dns but not browse.Consider the other switch ch2960-jstreet which has presence of vlan 18 and vlan 27. It is also connected on trunk to ch3550. We are not using native vlan on this trunk, and traffic works as expected.Is the lack of presence of vlan 18 a factor as to why gc2960 is not receiving the tagged packets correctly? Should the interface vlan18 on gc2960 have an ip address on the vlan 18 network?

View 5 Replies View Related

Cisco Switching/Routing :: 3560 Egress Policing And Classification

Jan 17, 2012

I have a customer who requires to identify and police traffic on egress on a 3560 trunk link.  I cannot use ingress classifications because we do not know what route the traffic will take yet.  The egress interface connects to multipoint wireless equipment with 4 different bandwidth point to point links. So the ingress traffic may be routed via any one of 4 point to point wireless links connected to the single egress interface.  Am I correct in assuming we cannot mark on the egress direction then put the traffic in a SRR shaped egress queue based on the marking ? So we would only have the option to egress queue based on markings applied or trusted on the inbound direction ? I had thought of some kind of policy map/aggregate policer configuration based on the exit VLAN but it seems we can only apply this type of config inbound. From reading the 3560 configuration guides it seems the 3560 cannot deploy the kind of requirements this customer needs.  Perhaps they should have deployed some kind of Metro switch ?

View 1 Replies View Related

Copyrights 2005-15, All rights reserved