The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›431 »

Fatal: Jul 29, 2004; I'm gunna kill you BITCH!!!

Post the ASA config, sanitize the external IPs and account info. Not much to go on there with the info you provided.

# ? Jan 29, 2013 22:24

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 19:15

Zuhzuhzombie!!: Apr 17, 2008; FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR

Any reason why only the lowest 24port 3850 is stackable?

# ? Jan 29, 2013 22:59

ior: Nov 21, 2003; What's a fuckass?

Zuhzuhzombie!! posted:

Any reason why only the lowest 24port 3850 is stackable?

Documentation bug, they all support both stackpower and stacking.

# ? Jan 30, 2013 00:14

ior: Nov 21, 2003; What's a fuckass?

aquaticrabbit posted:

To whomever was asking about the 3850 switches earlier in the thread, Cisco just posted some information: http://www.cisco.com/en/US/products/ps12686/index.html

Whats interesting about the platform is not that it can be a wireless controller but that it can terminate CAPWAP traffic in a wireless solution in conjunction with a wireless controller. So instead of handling your wireless traffic(backhauling to a wlc in your core) and wired traffic differently you now can decapsulate it right at the edge of your network and use the same security and qos policies on both your wired and wireless traffic.

Or in Cisco speak; One policy, one management, one network.

ior fucked around with this message at 00:28 on Jan 30, 2013

# ? Jan 30, 2013 00:18

the spyder: Feb 18, 2011

*Edit- VLAN internet issue fixed.

Site to site VPN will not come up. The other router is a twin of this.

Here is the config:

REMOVED

the spyder fucked around with this message at 09:15 on Jan 30, 2013

# ? Jan 30, 2013 00:20

inignot: Sep 1, 2003; WWBCD?

BelDin posted:

I just anticipate that the helpdesk will complain that they have to log in to the CLI in order to execute the commands.

You could use an error disable recovery time. It will revert the port to working state after some specific amount of time. It's an imperfect solution, but your setup sounds terrible.

# ? Jan 30, 2013 01:26

GOOCHY: Sep 17, 2003; In an interstellar burst I'm back to save the universe!

Normally I'd expect to see the isakmp config options in a site-to-site VPN tunnel config on an ASA. I also don't think that static route is doing what you want it to do.

Edit: This is an example of a basic site-to-site config I turned up earlier in the week with a remote peer from an ASA running 8.2, I believe. There was a NAT exemption that was necessary also but this is somewhat what the config will look like.

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_cryptomap_1
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer <remote peer public host>
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp am-disable
!
tunnel-group <remote peer public host> type ipsec-l2l
tunnel-group <remote peer public host> ipsec-attributes
pre-shared-key <pre-shared-key>
!
!
access-list outside_cryptomap_1 extended permit ip <local network/network mask> <remote network/network mask>

GOOCHY fucked around with this message at 01:36 on Jan 30, 2013

# ? Jan 30, 2013 01:30

ragzilla: Sep 9, 2005; don't ask me, i only work here

the spyder posted:

object network PATTOCOMCAST
subnet 10.20.28.0 255.255.255.0
object network PATTOCOMCAST
nat (Inside,OutsideComcast) dynamic interface

This is why traffic doesn't work from the other subnet, change PATTOCOMCAST to be 10.20.0.0/16

the spyder posted:

route OutsideComcast 0.0.0.0 0.0.0.0 50.196.x.x 1

Also this gives away your public IP range to anyone who knows how Comcast provisions "5 Static IP" customers?

And I don't see a crypto map anywhere in your config, unless they changed that in 8.6 you'll need one of those to match the "interesting traffic" as it egresses the Outside interface. Unless you're familiar with ASA CLI I'd recommend opening up ASDM and fixing your VPN from there, it might be easier to just tear it out (the VPN config) and run the wizard from scratch.

ragzilla fucked around with this message at 02:17 on Jan 30, 2013

# ? Jan 30, 2013 02:05

BelDin: Jan 29, 2001

inignot posted:

You could use an error disable recovery time. It will revert the port to working state after some specific amount of time. It's an imperfect solution, but your setup sounds terrible.

Nope. Every port security incident triggers a cyber security investigation. Welcome to the wonderful world of small business gubment contracting. At least the network is stable now... it used to be much worse.

# ? Jan 30, 2013 04:49

the spyder: Feb 18, 2011

ragzilla posted:

This is why traffic doesn't work from the other subnet, change PATTOCOMCAST to be 10.20.0.0/16

Also this gives away your public IP range to anyone who knows how Comcast provisions "5 Static IP" customers?

And I don't see a crypto map anywhere in your config, unless they changed that in 8.6 you'll need one of those to match the "interesting traffic" as it egresses the Outside interface. Unless you're familiar with ASA CLI I'd recommend opening up ASDM and fixing your VPN from there, it might be easier to just tear it out (the VPN config) and run the wizard from scratch.

I owe you a beer if your ever in Portland. Thank you. This makes complete sense, in my test lab I built the PAT- here I was going off what the contractor set it as. I swear I stared at this for a good hour today looking for anything like this. My head was exploding, haha.

I re-upped the full config. I built the VPN using the wizard and I am familiar with the CLI. It must be the route, if I login to the ASA and traceroute the router for the second site, it goes straight to my outside interface, not the Site2Site interface.

*Fixed-

Added a static route to the remote subnet via the site2site link.
route Site2site 10.10.0.0 255.255.0.0 10.15.1.100 1

the spyder fucked around with this message at 09:14 on Jan 30, 2013

# ? Jan 30, 2013 04:58

H.R. Paperstacks: May 1, 2006; This is America
My president is black
and my Lambo is blue

inignot posted:

It's an imperfect solution, but your setup sounds terrible.

It's a DoD thing; deploy 802.1x or "port-security with sticky mac, violation = shutdown"

# ? Jan 30, 2013 05:02

ate shit on live tv: Feb 15, 2004; by Azathoth

routenull0 posted:

It's a DoD thing; deploy 802.1x or "port-security with sticky mac, violation = shutdown"

yet another reason i'll never work for the government in any technical capacity.

# ? Jan 30, 2013 14:30

n0tqu1tesane: May 7, 2003; She was rubbing her ass all over my hands. They don't just do that for everyone.; Grimey Drawer

ior posted:

Whats interesting about the platform is not that it can be a wireless controller but that it can terminate CAPWAP traffic in a wireless solution in conjunction with a wireless controller. So instead of handling your wireless traffic(backhauling to a wlc in your core) and wired traffic differently you now can decapsulate it right at the edge of your network and use the same security and qos policies on both your wired and wireless traffic.

Or in Cisco speak; One policy, one management, one network.

I'm pretty sure you can do this with the newer WLCs and APs without any specific switch requirements. At least, that's what some of my coworkers have been discussing recently.

# ? Jan 30, 2013 15:18

ior: Nov 21, 2003; What's a fuckass?

n0tqu1tesane posted:

I'm pretty sure you can do this with the newer WLCs and APs without any specific switch requirements. At least, that's what some of my coworkers have been discussing recently.

That is called Flexconnect (was H-REAP) and yes it will switch out the traffic locally but you will lose a lot of functionality. (good qos, airtime fairness, avc, fast roaming etc).

Edit: also it is priced exactly the same as 3750-X so no reason not to buy it if you were a 3750-X customer. Capwap termination at the switch requires no license (other than ip base).

ior fucked around with this message at 16:18 on Jan 30, 2013

# ? Jan 30, 2013 16:15

n0tqu1tesane: May 7, 2003; She was rubbing her ass all over my hands. They don't just do that for everyone.; Grimey Drawer

Figures. I've just been halfway listening to sales and sales engineers trying to work out those sorts of solutions for customers without putting a WLC at every site.

EDIT: How many 3850s will you need at each site? One?

# ? Jan 30, 2013 16:24

ior: Nov 21, 2003; What's a fuckass?

n0tqu1tesane posted:

Figures. I've just been halfway listening to sales and sales engineers trying to work out those sorts of solutions for customers without putting a WLC at every site.

EDIT: How many 3850s will you need at each site? One?

Ouch, that hurts... I�m an SE (*SYSTEMS* Engineer) :colbert:

.
APs must be directly connected to the 3850, so depends on your cabling and AP density.

# ? Jan 30, 2013 16:35

ate shit on live tv: Feb 15, 2004; by Azathoth

Solutions Engineer.

# ? Jan 30, 2013 17:29

FatCow: Apr 22, 2002; I MAP THE FUCK OUT OF PEOPLE

Has anyone ever seen the error "Unable to switch, a similar or higher priority condition exists on peer or far-end card" when trying to force a protection switchover on a 15454?

I have a ULSR OC12 from Level 3 and it won't let me switch to the work and switches over to the protect whenever it is IS. Once the protect comes up it switches away from the work.

# ? Jan 30, 2013 22:56

ragzilla: Sep 9, 2005; don't ask me, i only work here

FatCow posted:

Has anyone ever seen the error "Unable to switch, a similar or higher priority condition exists on peer or far-end card" when trying to force a protection switchover on a 15454?

I have a ULSR OC12 from Level 3 and it won't let me switch to the work and switches over to the protect whenever it is IS. Once the protect comes up it switches away from the work.

Have you asked level3 if they're showing alarms on their end? Also what conditions do you see on the ports involved?

# ? Jan 30, 2013 23:23

FatCow: Apr 22, 2002; I MAP THE FUCK OUT OF PEOPLE

No alarms on either side, all the counters are clear as well. Only conditions are payload related.

# ? Jan 31, 2013 00:02

H.R. Paperstacks: May 1, 2006; This is America
My president is black
and my Lambo is blue

Powercrazy posted:

yet another reason i'll never work for the government in any technical capacity.

It has it's places, especially when you move up in classification levels, there has to be an audit trail for security events with manual intervention. Do I understand that sticky-mac can be defeated rather easily? Sure, but hey, they pay me 6 figures+ without a degree, so I won't argue

# ? Feb 1, 2013 00:48

BelDin: Jan 29, 2001

routenull0 posted:

It has it's places, especially when you move up in classification levels, there has to be an audit trail for security events with manual intervention. Do I understand that sticky-mac can be defeated rather easily? Sure, but hey, they pay me 6 figures+ without a degree, so I won't argue

I don't know if I should be happy or sad that most of my work comes from a NIST 800-53 checklist. The good news is that we have better security measures than stickies in place.

We have MAC filtering and WPA2/PSK on our wireless network! :rolleyes:

My proposal to use EAP-TLS was shot down as too complicated.

# ? Feb 1, 2013 05:15

evil_bunnY: Apr 2, 2003

I'm once again stumped by my Nexus'es unwillingness to do my bidding.

The problem is that I can't get my port-channels to some new ESXi hosts to get/stay up.

Config: (indentical on both switches)

code:

Nex-One# sho run

interface port-channel11
  description esx01-nfs
  switchport mode trunk
  switchport trunk allowed vlan 739
  spanning-tree port type edge trunk
  speed 10000
  vpc 11

interface Ethernet1/11
  description esx01-nfs
  switchport mode trunk
  switchport trunk allowed vlan 739
  channel-group 11 mode active
  
Nex-Two# sho run

interface port-channel11
  description esx01-nfs
  switchport mode trunk
  switchport trunk allowed vlan 739
  spanning-tree port type edge trunk
  speed 10000
  vpc 11
  
interface Ethernet1/11
  description esx01-nfs
  switchport mode trunk
  switchport trunk allowed vlan 739
  channel-group 11 mode active

Port info

code:

Nex-One# show int port-channel 11
port-channel11 is down (No operational members)
 vPC Status: Down, vPC number: 11 [packets forwarded via vPC peer-link]
  Hardware: Port-Channel, address: 547f.eea0.8532 (bia 547f.eea0.8532)
  Description: esx01-nfs
  MTU 1500 bytes, BW 10000000 Kbit, DLY 10 usec
  reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA
  Port mode is trunk
  auto-duplex, 10 Gb/s
  Input flow-control is off, output flow-control is off
  Switchport monitor is off 
  EtherType is 0x8100 
  Members in this channel: Eth1/11
  Last clearing of "show interface" counters never
  30 seconds input rate 0 bits/sec, 0 packets/sec
  30 seconds output rate 408 bits/sec, 0 packets/sec
  Load-Interval #2: 5 minute (300 seconds)
    input rate 0 bps, 0 pps; output rate 224 bps, 0 pps
  RX
    0 unicast packets  0 multicast packets  59 broadcast packets
    59 input packets  3776 bytes
    0 jumbo packets  0 storm suppression bytes
    0 runts  0 giants  0 CRC  0 no buffer
    0 input error  0 short frame  0 overrun   0 underrun  0 ignored
    0 watchdog  0 bad etype drop  0 bad proto drop  0 if down drop
    0 input with dribble  0 input discard
    0 Rx pause
  TX
    3035 unicast packets  6470472 multicast packets  36251 broadcast packets
    6509758 output packets  570220794 bytes
    0 jumbo packets
    0 output errors  0 collision  0 deferred  0 late collision
    0 lost carrier  0 no carrier  0 babble 0 output discard
    0 Tx pause
  0 interface resets

Nex-One# sh int ethernet 1/11
Ethernet1/11 is up
  Hardware: 1000/10000 Ethernet, address: 547f.eea0.8532 (bia 547f.eea0.8532)
  Description: esx01-nfs
  MTU 1500 bytes, BW 10000000 Kbit, DLY 10 usec
  reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA
  Port mode is trunk
  full-duplex, 10 Gb/s, media type is 10G
  Beacon is turned off
  Input flow-control is off, output flow-control is off
  Rate mode is dedicated
  Switchport monitor is off 
  EtherType is 0x8100 
  Last link flapped 00:11:00
  Last clearing of "show interface" counters never
  30 seconds input rate 0 bits/sec, 0 packets/sec
  30 seconds output rate 328 bits/sec, 0 packets/sec
  Load-Interval #2: 5 minute (300 seconds)
    input rate 0 bps, 0 pps; output rate 224 bps, 0 pps
  RX
    0 unicast packets  0 multicast packets  59 broadcast packets
    59 input packets  3776 bytes
    0 jumbo packets  0 storm suppression bytes
    0 runts  0 giants  0 CRC  0 no buffer
    0 input error  0 short frame  0 overrun   0 underrun  0 ignored
    0 watchdog  0 bad etype drop  0 bad proto drop  0 if down drop
    0 input with dribble  0 input discard
    0 Rx pause
  TX
    3035 unicast packets  6470122 multicast packets  36247 broadcast packets
    6509404 output packets  570186480 bytes
    0 jumbo packets
    0 output errors  0 collision  0 deferred  0 late collision
    0 lost carrier  0 no carrier  0 babble 0 output discard
    0 Tx pause
  8 interface resets
  
Nex-One# show port-channel summary 
Flags:  D - Down        P - Up in port-channel (members)
        I - Individual  H - Hot-standby (LACP only)
        s - Suspended   r - Module-removed
        S - Switched    R - Routed
        U - Up (port-channel)
        M - Not in use. Min-links not met
--------------------------------------------------------------------------------
Group Port-       Type     Protocol  Member Ports
      Channel
--------------------------------------------------------------------------------
1     Po1(SU)     Eth      LACP      Eth1/1(P)    
2     Po2(SU)     Eth      LACP      Eth1/2(P)    
3     Po3(SD)     Eth      LACP      Eth1/3(D)    
4     Po4(SD)     Eth      LACP      Eth1/4(D)    
5     Po5(SD)     Eth      LACP      Eth1/5(D)    
6     Po6(SD)     Eth      LACP      Eth1/6(D)    
7     Po7(SD)     Eth      LACP      Eth1/7(D)    
8     Po8(SD)     Eth      LACP      Eth1/8(D)    
9     Po9(SD)     Eth      LACP      Eth1/9(D)    
10    Po10(SD)    Eth      LACP      Eth1/10(D)   
11    Po11(SD)    Eth      LACP      Eth1/11(I)   
12    Po12(SD)    Eth      LACP      Eth1/12(I)   Eth1/13(I)   
13    Po13(SD)    Eth      NONE      --
14    Po14(SD)    Eth      NONE      --
15    Po15(SD)    Eth      NONE      --
100   Po100(SU)   Eth      LACP      Eth1/30(P)   Eth1/31(P)   
101   Po101(SU)   Eth      LACP      Eth1/29(P)

I'm only worried about port-channel 11 so far (two links, on port 11 of both switches).

Log file:

code:

Nex-One# 
2013 Feb  4 14:19:33 Nex-One %ETHPORT-5-IF_DOWN_LINK_FAILURE: Interface Ethernet1/12 is down (Link failure)
2013 Feb  4 14:19:33 Nex-One %ETH_PORT_CHANNEL-5-PORT_INDIVIDUAL_DOWN: individual port Ethernet1/12 is down
2013 Feb  4 14:19:33 Nex-One %ETHPORT-5-IF_DOWN_LINK_FAILURE: Interface Ethernet1/11 is down (Link failure)
2013 Feb  4 14:19:33 Nex-One %ETH_PORT_CHANNEL-5-PORT_INDIVIDUAL_DOWN: individual port Ethernet1/11 is down
2013 Feb  4 14:19:34 Nex-One %ETHPORT-5-SPEED: Interface Ethernet1/12, operational speed changed to 10 Gbps
2013 Feb  4 14:19:34 Nex-One %ETHPORT-5-IF_DUPLEX: Interface Ethernet1/12, operational duplex mode changed to Full
2013 Feb  4 14:19:34 Nex-One %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Ethernet1/12, operational Receive Flow Control state changed to off
2013 Feb  4 14:19:34 Nex-One %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Ethernet1/12, operational Transmit Flow Control state changed to off
2013 Feb  4 14:19:34 Nex-One %ETHPORT-5-SPEED: Interface port-channel12, operational speed changed to 10 Gbps
2013 Feb  4 14:19:34 Nex-One %ETHPORT-5-IF_DUPLEX: Interface port-channel12, operational duplex mode changed to Full
2013 Feb  4 14:19:34 Nex-One %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface port-channel12, operational Receive Flow Control state changed to off
2013 Feb  4 14:19:34 Nex-One %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface port-channel12, operational Transmit Flow Control state changed to off
2013 Feb  4 14:19:35 Nex-One %ETHPORT-5-SPEED: Interface Ethernet1/11, operational speed changed to 10 Gbps
2013 Feb  4 14:19:35 Nex-One %ETHPORT-5-IF_DUPLEX: Interface Ethernet1/11, operational duplex mode changed to Full
2013 Feb  4 14:19:35 Nex-One %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Ethernet1/11, operational Receive Flow Control state changed to off
2013 Feb  4 14:19:35 Nex-One %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Ethernet1/11, operational Transmit Flow Control state changed to off
2013 Feb  4 14:19:35 Nex-One %ETHPORT-5-SPEED: Interface port-channel11, operational speed changed to 10 Gbps
2013 Feb  4 14:19:35 Nex-One %ETHPORT-5-IF_DUPLEX: Interface port-channel11, operational duplex mode changed to Full
2013 Feb  4 14:19:35 Nex-One %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface port-channel11, operational Receive Flow Control state changed to off
2013 Feb  4 14:19:35 Nex-One %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface port-channel11, operational Transmit Flow Control state changed to off
2013 Feb  4 14:19:44 Nex-One %ETH_PORT_CHANNEL-4-PORT_INDIVIDUAL: port Ethernet1/12 is operationally individual
2013 Feb  4 14:19:44 Nex-One %ETHPORT-5-IF_UP: Interface Ethernet1/12 is up in mode trunk
2013 Feb  4 14:19:45 Nex-One %ETH_PORT_CHANNEL-4-PORT_INDIVIDUAL: port Ethernet1/11 is operationally individual
2013 Feb  4 14:19:45 Nex-One %ETHPORT-5-IF_UP: Interface Ethernet1/11 is up in mode trunk
2013 Feb  4 14:21:16 Nex-One %ETHPORT-5-IF_DOWN_LINK_FAILURE: Interface Ethernet1/11 is down (Link failure)
2013 Feb  4 14:21:16 Nex-One %ETH_PORT_CHANNEL-5-PORT_INDIVIDUAL_DOWN: individual port Ethernet1/11 is down
2013 Feb  4 14:21:16 Nex-One %ETHPORT-5-IF_DOWN_LINK_FAILURE: Interface Ethernet1/12 is down (Link failure)
2013 Feb  4 14:21:16 Nex-One %ETH_PORT_CHANNEL-5-PORT_INDIVIDUAL_DOWN: individual port Ethernet1/12 is down
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-SPEED: Interface Ethernet1/11, operational speed changed to 10 Gbps
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_DUPLEX: Interface Ethernet1/11, operational duplex mode changed to Full
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Ethernet1/11, operational Receive Flow Control state changed to off
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Ethernet1/11, operational Transmit Flow Control state changed to off
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-SPEED: Interface port-channel11, operational speed changed to 10 Gbps
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_DUPLEX: Interface port-channel11, operational duplex mode changed to Full
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface port-channel11, operational Receive Flow Control state changed to off
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface port-channel11, operational Transmit Flow Control state changed to off
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-SPEED: Interface Ethernet1/12, operational speed changed to 10 Gbps
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_DUPLEX: Interface Ethernet1/12, operational duplex mode changed to Full
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Ethernet1/12, operational Receive Flow Control state changed to off
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Ethernet1/12, operational Transmit Flow Control state changed to off
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-SPEED: Interface port-channel12, operational speed changed to 10 Gbps
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_DUPLEX: Interface port-channel12, operational duplex mode changed to Full
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface port-channel12, operational Receive Flow Control state changed to off
2013 Feb  4 14:21:18 Nex-One %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface port-channel12, operational Transmit Flow Control state changed to off
2013 Feb  4 14:21:28 Nex-One %ETH_PORT_CHANNEL-4-PORT_INDIVIDUAL: port Ethernet1/11 is operationally individual

Ideas?

ESXi config:

vSwitch1

vmnic5:

vmnic4:

teaming:

evil_bunnY fucked around with this message at 16:30 on Feb 4, 2013

# ? Feb 4, 2013 14:57

ragzilla: Sep 9, 2005; don't ask me, i only work here

evil_bunnY posted:

teaming:

This is the General tab, not the Teaming one?

# ? Feb 4, 2013 16:19

evil_bunnY: Apr 2, 2003

ragzilla posted:

This is the General tab, not the Teaming one?

Fixed it.

# ? Feb 4, 2013 16:30

Nitr0: Aug 17, 2005; IT'S FREE REAL ESTATE

The default port channel setting in esxi is passive. You've got your ports set to active. Either get rid of that in the switch or do this.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2034277

# ? Feb 4, 2013 17:43

1000101: May 14, 2003; BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY FRUITCAKE!

Nitr0 posted:

The default port channel setting in esxi is passive. You've got your ports set to active. Either get rid of that in the switch or do this.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2034277

If it was 'passive' it'd technically still work. The standard vSwitch just doesn't support LACP period and you'll have to statically configure any etherchannels.

# ? Feb 4, 2013 18:48

Zuhzuhzombie!!: Apr 17, 2008; FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR

I noticed you had "spanning-tree port type edge trunk" on the port channel but not the physical interface. NexusOS may be different than IOS in this regard, but on my 7609s I often have trouble getting a port channel to stay up/up if the interfaces are not provisioned exactly the same as the actual port channel.

Maybe help? Dunno. Hope so!

# ? Feb 4, 2013 19:58

evil_bunnY: Apr 2, 2003

1000101 posted:

If it was 'passive' it'd technically still work. The standard vSwitch just doesn't support LACP period and you'll have to statically configure any etherchannels.

Yeah one active endpoint should be good afaik.
This is a standard vSwitch.

Zuhzuhzombie!! posted:

Maybe help? Dunno. Hope so!

I'll give it a try.

evil_bunnY fucked around with this message at 20:18 on Feb 4, 2013

# ? Feb 4, 2013 20:11

1000101: May 14, 2003; BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY FRUITCAKE!

NX-OS should push that down to member ports. It definitely won't come up without a 'channel-group X mode on' though.

# ? Feb 4, 2013 20:40

Zuhzuhzombie!!: Apr 17, 2008; FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR

I had similar issues with setting up an etherchannel to our Fuji network and a few ESX servers as well as HP's switches.

# ? Feb 4, 2013 20:40

1000101: May 14, 2003; BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY FRUITCAKE!

Most cases I don't even bother with etherchannel and just go with an originating port ID policy in VMware. It's a simple configuration and I still get some measure of load distribution. It also fails over fairly easy as well.

# ? Feb 4, 2013 20:50

Jelmylicious: Dec 6, 2007; Buy Dr. Quack's miracle juice! Now with patented H-twenty!

1000101 posted:

Most cases I don't even bother with etherchannel and just go with an originating port ID policy in VMware. It's a simple configuration and I still get some measure of load distribution. It also fails over fairly easy as well.

I've also seen a case where one of the switches lost the etherchannel on one port (but not the link) and VMware still sees the link status as up, so it blackholed some traffic. Either use probe or originating port ID. I prefer the latter, less to go wrong.

# ? Feb 4, 2013 21:07

abigserve: Sep 13, 2009; this is a better avatar than what I had before

Zuhzuhzombie!! posted:

I noticed you had "spanning-tree port type edge trunk" on the port channel but not the physical interface. NexusOS may be different than IOS in this regard, but on my 7609s I often have trouble getting a port channel to stay up/up if the interfaces are not provisioned exactly the same as the actual port channel.

Maybe help? Dunno. Hope so!

NX-OS is different, you can't even put commands under the physical interfaces once they join the portchannel (with some exceptions like speed, duplex, etc.).

This is a catch for new players because they might set their portchannels as edge ports but not their underlying interfaces, which can be a problem for hosts that are connecting to LACP enabled ports without actually running LACP. The solution is to fully provision your physical interfaces as if they were stand-alone before adding them to a portchannel.

# ? Feb 4, 2013 22:21

evil_bunnY: Apr 2, 2003

1000101 posted:

If it was 'passive' it'd technically still work. The standard vSwitch just doesn't support LACP period and you'll have to statically configure any etherchannels.

This allowed me to bring up the channel, but I still don't have any IP connectivity.

# ? Feb 5, 2013 18:36

Zuhzuhzombie!!: Apr 17, 2008; FACTS ARE A CONSPIRACY BY THE CAPITALIST OPRESSOR

Two 3750s with IPv6 on. p2p between the two on the same subnet. Under IPv6 EIGRP we have redistribute static and connected. No default route. PC has an IPv6 p2p on one switch with corresponding IP address on it's interface. Same as the other. PCs can ping each IPv6 address but not each other. Each PC can ping their interface side of the p2p and each other's interface. Two XP machines. We put in one Windows 7 machine that can BE pinged. Put in two Windows 7 machines that could not ping each other (though I had my Firewall turned on).

Pings come back to each PC is "deliverable". Traceroutes to each PC do not even show it hitting the p2p interface for the respective PCs.

Any ideas? What am I missing? Only outlier is that one switch has a temp license for IPv6 testing, and one interface for PC does not have an IPv4 address on it. Gonna test that now.

edit

Put two Fedora boxes on the network and can ping across switches and each box under Linux. Lookin like a Windows issue.

code:

ip routing
!
ipv6 unicast-routing
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
interface GigabitEthernet1/0/1
 description test p2p with 3750x
 no switchport
 ip address 77.8.9.69 255.255.255.252
 ipv6 address 2607:F4A0:2:13::2/64
 ipv6 enable
 ipv6 eigrp 106
!
interface GigabitEthernet1/0/2
 no switchport
 ip address 77.8.9.73 255.255.255.252
 ipv6 address 2607:F4A0:2:14::2/64
 ipv6 enable
 ipv6 eigrp 106
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
!

!
interface Vlan1
 no ip address
!
ip http server
ip http secure-server
!
ip sla enable reaction-alerts
ipv6 router eigrp 106
 redistribute connected
 redistribute static
!
line con 0
 logging synchronous
line vty 0 4
 password cisco
 login local
 transport preferred ssh
line vty 5 15
 login
!
end

code:

ip routing
!
ipv6 unicast-routing
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0
 no ip address
 no ip route-cache
 shutdown
!         
interface GigabitEthernet1/0/1
 description test p2p to 3750g
 no switchport
 ip address 77.8.9.70 255.255.255.252
 ipv6 address 2607:F4A0:2:13::1/64
 ipv6 enable
 ipv6 eigrp 106
!
interface GigabitEthernet1/0/2
 no switchport
 no ip address
 ipv6 address 2607:F4A0:2:15::2/64
 ipv6 enable
 ipv6 eigrp 106
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
!

!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan2
 no ip address
 ipv6 enable
!
!
ip http server
ip http secure-server
!
!
ipv6 router eigrp 106
 redistribute connected
 redistribute static
!
!
!         
!
!
line con 0
 logging synchronous
line vty 0 4
 password cisco
 login local
 transport preferred ssh
line vty 5 15
 login
!
end

Zuhzuhzombie!! fucked around with this message at 22:12 on Feb 5, 2013

# ? Feb 5, 2013 18:45

1000101: May 14, 2003; BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY FRUITCAKE!

evil_bunnY posted:

This allowed me to bring up the channel, but I still don't have any IP connectivity.

port-channel load-balance ethernet source-destination-ip on both of your switches.

That will probably fix it assuming you're using IP hash. Make sure you do it on both sides. Also make sure your portgroups are setup to tag appropriate vlans.

# ? Feb 5, 2013 18:59

evil_bunnY: Apr 2, 2003

1000101 posted:

port-channel load-balance ethernet source-destination-ip on both of your switches.

That will probably fix it assuming you're using IP hash. Make sure you do it on both sides. Also make sure your portgroups are setup to tag appropriate vlans.

Did that already 8(

# ? Feb 5, 2013 19:51

1000101: May 14, 2003; BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY BIRTHDAY FRUITCAKE!

evil_bunnY posted:

Did that already 8(

Verify you don't have a portgroup override set to Originating port ID or MAC hash or something.

Optionally; since you're on 10GbE you may consider ditching etherchannel and going with originating port ID. Any specific reason you need IP hash?

edit: if you're testing with a management portgroup I believe by default it overrides itself to port ID but you can manually flip it.

# ? Feb 6, 2013 00:13

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 19:15

evil_bunnY: Apr 2, 2003

Fixed it. Thanks a lot 1000101 and everyone with suggestions.

# ? Feb 6, 2013 17:02

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›431 »