Cisco Switching/Routing :: Not Able To Assign Access List To CMP Interface Of Nexus 7K

Feb 6, 2013

I am trying to harden my Nexus box and I am not able to ACL assigment command. Following are the commands I am trying to add.

interface cmp-mgmt module 5
Ip access-group NETWORK_MANAGEMENT_ACCESS in

View 1 Replies


ADVERTISEMENT

Cisco Switching/Routing :: 4506 - Interface Access-list

Nov 14, 2011

I have one computer connected to the 4506 that management does not want this PC to have access to anything on our network except our DHCP server and the one printer that resides on our network.  I created an extended access list as follows.  Our network is the 10.10.x.x and the external addresses the PC needs to access is 11.1.x.x.  Once this PC is rebooted, it is unable to access DHCP to get the needed IP address it bounces back to a 169.x.x.x address and stops working.
 
Extended IP access list 2000
permit tcp host 10.10.200.242 host 11.1.200.1                           (gateway)
permit tcp host 10.10.200.242 host 11.1.2.151 eq smtp              (access from the pc to external server for smtp)
permit tcp host 10.10.200.242 host 11.1.2.149 eq 5721              (access from the pc to external server for remote access)
[ code]...
 
Then I applied the access-group 2000  on the interface the PC is connected to. What am I missing for DHCP to work and for this PC to always get the ip address that is reserved?

View 3 Replies View Related

Cisco Switching/Routing :: Cannot Assign Ip Address To Layer 2 Interface In 878

Apr 19, 2012

I have a cisco 878 router and I can’t assign ip address to it’s fast Ethernet interface. When I assign ip address give me this message: “you can not assign ip address to layer 2 interface”.
 
But I can not understand why give me this alert when I use a layer3 device?!

View 3 Replies View Related

Cisco Switching/Routing :: 2911 - Assign IP To Interface In Module?

Jul 25, 2012

I need to configure a Cisco 2911. I need to give an interface in this module (VWIC3 - 4MFT-T1/E1) an IP address. My question is, how to assign an IP to an interface in this module.
 
My purpose is to get connectivity via T1 line to another router.

View 16 Replies View Related

Cisco AAA/Identity/Nac :: Assign Personal Access List To User In ACS 5.1

Apr 4, 2010

Is there any way (in ACS 5.1) to assign personal access list to each user instead of assigning it to Authorization profile and Authorization profile to user?

View 5 Replies View Related

Cisco Switching/Routing :: Configure Sub Interface For Nexus 7k?

Jan 11, 2013

how do we configure sub interface for nexus 7k?do we have to issue ma-address command under physical interface and than configure subinterface? if yes than what do we have to type the mac address for "mac-address" command?I can doing and than configure subinterface but the interface/subinterface didn't come up. do we have to bounce it couple times to bringe it up?

View 1 Replies View Related

Cisco Switching/Routing :: 40G Interface On Nexus 3064?

Jun 18, 2012

I want to bring up 40G interface between two nexus 3064 over the fiber but it's not coming up. Have configured the switch for 48*10G and 4*40G. I'm using QSFP on both the switches, OM3 straight fiber cable with MPO connector. The interfaces are not coming up. Notably, it comes up with Coax 3M cable. So it's fine with coax but not with fiber.

View 2 Replies View Related

Cisco Switching/Routing :: Nexus 7K Out Of Band Management Interface?

Dec 8, 2012

regarding to the out of band Management interface , if I configured an intervace vlan to be as a managment interface for one vdc ( the default vdc ), when I connected to this vdc via telnet , can I switch to any other vdc ?  ( suppose that I have the Admin role which allows me to enter and config all the vdc's )If that is possible so that I dont have to make a dedicated managment ip for each VDC I need to do that only if I want to make vdc admin's account to allow some users to access specific vlans only , is that true ?

View 2 Replies View Related

Cisco Switching/Routing :: Nexus 5548UP - Management Interface

Apr 21, 2013

How separate is the management interface on a Nexus 5548?
 
In context - what's the risk of having a layer 2 only Nx5K in a DMZ and running the managment ports down into an internal managment VLAN, to form peer-keepalive links and software upgrades.

View 4 Replies View Related

Cisco Switching/Routing :: Management Interface On Nexus 7010?

Apr 28, 2013

We have a couple of Nexus 7010's split into Core and Distribution VDCs. MGMT0 interfaces on each of the Nexus VDC's (including the Admin VDC) are configured with different IP address, but on the same subnet i.e 10.10.10.1/24 for admin, 10.10.10.2/24 for Core and 10.10.10.3/24 for Distribution. The MGMT 0 physical port on each Nexus is connected to a physical gig port on a 3750 X switch, and the 3750X has uplinks back to the Nexus configured for vPC.
 
When i ssh to the VDC MGMT0 IPs from the 3750X, i can access each of these VDCs without any problems. But if i enable routing on each of these links(OSPF) and advertise it to the WAN, i cannot see these routes advertised and also cannot see any of these routes in the local routing table.Just wondering if i have to enable these links on a VLAN and then advertise it to the WAN..But if this the case, VLANs cannot be created  on the Admin(default VDC).

View 9 Replies View Related

Cisco Switching/Routing :: Ping Loss On Nexus 3k But No Error Under Interface?

Mar 4, 2013

I'm facing a problem regarding loss of ping packets when i do ping test from nexus3k to another nexus3k connected directly.however there is no error counters on the interfaces on both of devices.the ping failutre is occurring only whenever i do ping test with a large number of ping packets.I don't see the ping loss symptom with default ping test (default ping test is 5 packets).
 
H/W : N3K-C3548P-10G
S/W : 5.0(3)A1(1) 
nexus3k# ping 1.1.1.2
PING 1.1.1.2 (1.1.1.2): 56 data bytes
64 bytes from 1.1.1.2: icmp_seq=0 ttl=254 time=2.732 ms
64 bytes from 1.1.1.2: icmp_seq=0 ttl=254 time=2.732 ms

[code].....

View 2 Replies View Related

Cisco Switching/Routing :: Getting Nexus 5000 Command (default Interface X / X)

Jun 26, 2012

when will be the command "default interface x/x" on the Nexus 5000 platform available? Even with latest software version (5.1.3.N2.1a) it is not possible. For Nexus7000 it's working fine with 5.2 train.Is there a feature request for it? If not here it is!!It's horrible to deconfigure many interfaces especially in N5k environments with many FEXes.

View 3 Replies View Related

Cisco Switching/Routing :: Nexus 5000 Interface - Data Transfer Low

Jun 6, 2012

Customer  production environment is nexus 5000 use 1 G interface * 4 and config Port-channel  ( LACP ) uplink to C3560 , The port channel link is 802.1q trunk , but Data transfer is low , the sh int display as follow :
 
Why transfer performance pool and how to fix
 
N-5548UP# sh int ethernet 1/30Ethernet1/30 is up  Hardware: 1000/10000 Ethernet, address: 547f.ee14.ed25 (bia 547f.ee14.ed25)  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,     reliability 255/255, txload 1/255, rxload 1/255  Encapsulation ARPA  Port mode is trunk  full-duplex, 1000 Mb/s, media type is 10G  Beacon is turned off  Input flow-control is off, output flow-control is off  Rate mode is dedicated  Switchport monitor is off  EtherType is 0x8100  Last link flapped 9week(s) 6day(s)  Last clearing of "show interface" counters 20w2d  30 seconds input rate 152 bits/sec, 19 bytes/sec, 0 packets/sec  30 [Code]...

View 1 Replies View Related

Cisco :: Access-list For SNMP On Nexus 1000V?

Dec 21, 2011

Nexus1000V and I  was wondering if there is a way to limit snmp access via access-list on  the RO/RW community, as can be done on IOS.  I can't find anything relevent on the Reference Pages

View 3 Replies View Related

Cisco Switching/Routing :: Can't Assign Switch 3560G Port G0/1 To Access Vlan 10

Feb 21, 2012

cant assign cisco switch 3560G port g0/1to access vlan 10
 
main-switch(config-if)#switchport access vlan 10 Command rejected: Gi0/1 not a switching port.

View 5 Replies View Related

Cisco Switching/Routing :: Nexus 7000 Determining Jumbo MTU Size On Interface

Feb 7, 2011

I am trying to determin if Jumbo frames are enabled on out Nexus 7000, and I am getting mixed info back from the swtich.I looks like the system jumbo MTU size is 9216 by default, but the interfaces all say the MTU of the interface is 1500 bytes. According to this article, the interface MTU should read 9216 is the jumbo frames are enabled globally. Is this correct. Is there a way to verify if Jumbo frame support is turned on? [code]

View 4 Replies View Related

Cisco Switching/Routing :: 3560 - Access List On InterVLan Routing

Dec 11, 2012

I implemented access list on cisco 3560 switch but it never works. I want to block access from network B to Network A and allow from Ato B
Network A. 10.0.12.0/24
Network B 10.0.24.0/24
 
The configuration is
interface Vlan1
description Data VLAN

[Code].....

View 14 Replies View Related

Cisco Switching/Routing :: 5548 - High Current Alarm For Nexus Interface Transceiver

Dec 9, 2012

I have a Cisco 5548 Nexus switch with 10Gbase-SR interface transceiver. This interface is connected to Server chasis.
 
The show interface transceiver details output shows High ++ alarm for Current. Additionally, i am getting output errors on this interface.

View 1 Replies View Related

Cisco Switching/Routing :: Nexus 7010 IP Telnet Source-interface Command Not Working

Aug 20, 2012

I have configured the ip telnet source-interface Loopback 0 command on a Nexus7010, but when I telnet to another device and do a show users, the ip address is of the closest interface to the device I telnet to, not the ip address of the Loopback. All interfaces are in vrf default. I am running 5.1(6) NXOS.

View 6 Replies View Related

Cisco Switching/Routing :: Nexus 7010 OSPF Passive-interface Default Not Showing

Nov 6, 2011

I'm currently working on a plan to migrate our 6500's over to our new 7010's.  At the time of the migration I want to tighten up our OSPF design and configure OSPF for "passive-interface default" then allow only those interfaces that should have OSPF neighbors to send the hellos.  The issue is that the command is not showing up under the OSPF process.  What's even more interesting is that the Nexus 5.x Unicast Routing Configuration Guide shows that the "passive-interface default" command should be an option to enter.
 
I'm currently running version 5.1(4) (though looking to upgrade to 5.2 during my migration testing).  I would rather configure the passive-interface via the routing process versus having to enter it on every interface.

View 2 Replies View Related

Cisco Switching/Routing :: Interface Resets Causes Port Channel To Flap Nexus 5010?

Feb 20, 2012

Here is an example of what each switch logs when a server drops offline.  Sample logs taken between 5:32am and 5:35am on Feb 20.   This particular one was having problems all weekend.  Switch #1 encountered over 2000 interface resets.  The corresponding VPC port on Switch #2 only had 13 resets.
 
NEXUS SWITCH #1
 2012 Feb 20 05:32:09 q91-sw01-5010 %ETH_PORT_CHANNEL-5-FOP_CHANGED: port-channel10: first operational port changed
from Ethernet1/10 to none
2012 Feb 20 05:32:09 q91-sw01-5010 %ETH_PORT_CHANNEL-5-PORT_DOWN: port-channel10: Ethernet1/10 is down
2012 Feb 20 05:32:09 q91-sw01-5010 %ETH_PORT_CHANNEL-5-PORT_DOWN: port-channel10: port-channel10 is down
2012 Feb 20 05:32:09 q91-sw01-5010 %ETHPORT-5-IF_DOWN_PORT_CHANNEL_MEMBERS_DOWN: Interface port-channel10 is down (
No operational members)

[code].....

View 1 Replies View Related

Cisco Switching/Routing :: Nexus 7000 / Interface Isn't Coming After Once Telco Gave Loop

Oct 26, 2012

we are bringing up new ckt and nexus 7000's interface isn't coming up once telco gave a loop. and wee following msg when I do "sh int eth1/1".
 
(UDLD Tx Rx loop, port: error)
 
what does "(UDLD Tx Rx loop, port: error)" it mean?before loop. interface was showing as "Link not Connected".

View 2 Replies View Related

Cisco Switching/Routing :: 4500 And Mac Access List

Apr 11, 2011

I'm looking to implement a vlan filter to keep unnecessary stuff off my access-layer. Things like IPv6, IPX etc. I really only want IPv4, ARP and 802.1q on these 4500s. I know on 3750, 3560s etc, when I create the mac access-list, I can do it by ethertype, but on the 4500, I dont have that option.
 
4th_floor(config)#mac access-list extended Drop-traffic
 
4th_floor(config-ext-macl)#permit any any ?
  protocol-family  An Ethernet protocol family
  <cr>
 
4th_floor(config-ext-macl)#permit any any protocol-family ?
  appletalk
  arp-non-ipv4
  decnet
[Code]....

View 1 Replies View Related

Cisco Switching/Routing :: 1800 ISR Without Access List?

Apr 19, 2012

I have an 1800 isr that is running with port forwarding only.  It is running a series of ip nat inside source static address port address port commands.  It does not have an access list bound to the outside interface.  This is working fine, but i am wondering if this is a security concern?

View 1 Replies View Related

Cisco Switching/Routing :: 2900 - Nexus 7010 Layer 2 VLan 11 Active But Interface Shutdown

Sep 13, 2012

I understand the vlans on the catalyst side of the house on 2900 to 6500 Catalyst switches.
 
This 7010  running nx-os 5.1(3) I did not setup, but have to manage it.  Hasn't really been a proble till now.
 
My nexus 7010 has a Layer 2 only vlan 11. It is "Active" but the interface is "shutdown".  Yet, it is passing traffic across the directly connected  ports on the nexus 7010 and to other switches in my network.  Vlan 11 is being set out via VTP to all my switches and things are running fine.
 
I need to create another L2 only Vlan.  I can't seem to find any docs  that indicate that a Layer2 vlan Interface on nx-os should be in  "shutdown" mode as part of the setup. I do see in the docs where it has  to be set "Active" as part of the process.
 
Is this the correct way to seutp a L2 only vlan on nex-os? Leave the interface in "shutdown" but make it "Active"?
 
Mystery Vlan 4 and 6
The mystery deepens.  I have other L2 vlans ,Vlan4&6 that are NOT defined as "Interface Vlan4" in the nexus config, yet it is applied to GigE ports on the nexus and these Vlans 4/6is also being sent out VTP to all switches.  Even weirder is that these vlans have names associated with the numbers.  These are valid Vlans that were configured on the old 6509 before the Nexus was installed.
 
I have checked all switches, NONE are running in Server mode for VTP, all are in CLIENT. The nexus 7010 is the only device running in VTP Server mode. 

View 2 Replies View Related

Cisco Switching/Routing :: 192.168.10.10 / VLAN Access List Not Working?

Sep 5, 2012

Extended IP access list VLAN20
    10 permit tcp any any established
    11 permit icmp any any
    20 permit tcp any 192.168.20.0 0.0.0.255 eq 80
    30 permit tcp any 192.168.20.0 0.0.0.255 eq 443
    40 deny ip any any log

[code].....
 
Above is the network diagram and access list for VLAN 20 and VLAN 30, applied on incoming direction of each valn.But still able to access other port which is not on access list, tried changing the direction with no luck.Inter vlan routing is enabled on CoreSwitch default router is 192.168.10.10

View 5 Replies View Related

Cisco Switching/Routing :: 3750 How To Write Access List

Jan 15, 2012

i have one Cisco 3750, am using it as Core Switch where i have 6 more access switches are connected deirectly, and we are using VLANs in our network with the IP reange of 172.16.0.0 , now we had a new Internet connection which is dedicated to Exchange Server only.So we have TWO internet connection One for internet access to all users and another one for only Exchange Server.internet connection for the users is termiated at a Cisco 1700 Series Router and Internet for Exchage Server is terminated at a Cisco ASA Firewall.Now the problem is how can i write an access list, which says that all packets from Exchange server should be routed to ASA Firewall , and all other packets shoulde route to Cisco Router.IP address os Exchange server is 172.16.2.1, 172.16.2.2.

View 13 Replies View Related

Cisco :: Access List In Vlan Interface

Jan 12, 2013

How to apply access list on Vlans ?

my Scenario is

13 Vlans in cisco 3560 switch (Vlan 10,20,30........ 130)

vlan 10 ---- ip range 192.168.10.0/24 interface vlan 10 ip add : 192.168.10.1

vlan 20 ---- ip range 192.168.20.0/24 interface vlan 20 ip add : 192.168.20.1

here i want to block vlan 10 access to vlan 20 i created extended access list deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255

and applied in interface vlan 10 as out now i cant able to access any host in vlan 20 (host 192.168.20.1) but i can able ping vlan 20's gateway 192.168.20.1

View 3 Replies View Related

Cisco Switching/Routing :: 239 Multiple Static RPs And Access-list Behavior

Aug 14, 2012

I configure multiple static RPs and one of the ACLs denies a source will it move on to the next entry that covers it in another acl? [code] i.e. 1.1.1.1 will be used as the RP for 224 to 238 and 2.2.2.2 will be used as the RP for 239.Will that work correctly, i.e. if a source is trying to register with the router and its for the group 239.1.1.1, will it be denied against the first RP and then permitted against the second RP?

View 2 Replies View Related

Cisco Switching/Routing :: 3550 / Access List - Block One Ip Or Port

Jan 9, 2012

I have a layer 3 switch, 3550.I have several vlans on there just for playing around with. One of the vlans, has a vonage linksys box attached to it with a UK number attached. From time to time telemarketers call at 03:00 in the morning, this as I'm sure you can imagine is not much fun. The linksys box gets 192.168.3.3 as it's ip.The switch is connected to a non cisco router at 192.168.0.1
 
interface FastEthernet0/24
no switchport
ip address 192.168.0.2 255.255.255.0
 
I was thinking a time based access list would work best I have tried several variations but the phone still rings. I have tried access-list 1 deny host 192.168.3.3 permit ..... and more extensive lists but the phone still rings. I have not applied the time-range yet, so that's not the problem.I have applied the list to the vlan interface and to fa0/24 but it's not working.

View 3 Replies View Related

Cisco Switching/Routing :: Vlan Access List In 3750x Switch

Feb 6, 2013

I have a LIII Switch Cisco 3750x ,with diffrent Vlans , Some users are in Vlan 102 (10.10.2.0) and Some Users are in Vlan1 (10.10.1.0) , now i want to restrict  the Vlan102 users to access Vlan1 , i am pasting my configuration below , how to create a access list . 
 
interface Vlan1
ip address 10.10.1.36 255.255.255.0
ip helper-address 10.10.1.36

[Code].....

View 2 Replies View Related

Cisco Switching/Routing :: 2960 - Mac Access-list Time Based

Dec 11, 2011

I need to enable/disable a mac access-list on a 2960 scheduled by time. The switch has lanbasek9-mz.122-44.SE6. As the mac access-list can not support time ranges, I tried EEM but seems like it is not supported in this device.

View 1 Replies View Related

Cisco Switching/Routing :: 4948 - Configuration Of Access List For VLAN 2

May 19, 2013

In my core Switch,there are 2 v LAN(V LAN 1 & V LAN 2)my switch is Cisco 4948,so be default ip routing is enable in it. My all servers (DHCP,HTTP,HTTPS) are in v LAN 1 & internet is also in v LAN 1.

My requirement is that v LAN 1 user should not communicate with the v LAN 2 and vice versa. But the v LAN 2 users need an access of all servers and internet which is in v LAN 1. How to configure the access-list. I have try on Packet tracer which i have attached.
 
note:v LAN 2 user should get the IP from dhcp server which is in vlan1.

View 4 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved