The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›9 »

tortilla_chip: Jun 13, 2007; k-partite

http://www.cisco.com/en/US/products/products_security_advisories_listing.html

There is a link on this page to the Product Alert Tool. You will need a CDC login to access the tool. It lets you subscribe to email notifications for specific product classes.

# ¿ Nov 27, 2007 21:59

Adbot: ADBOT LOVES YOU

# ¿ Apr 27, 2024 21:56

tortilla_chip: Jun 13, 2007; k-partite

Skip Dogg posted:

What would cause computers to take forever to get a DHCP address?

If it's a client port, enable portfast.

# ¿ Dec 10, 2007 05:38

tortilla_chip: Jun 13, 2007; k-partite

http://www.cisco.com/en/US/docs/wireless/access_point/12.3_7_JA/configuration/guide/s37frst.html

This should help with getting your initial configuration going. One caveat with the 1100s is the fixed antenna configuration, so just be aware of that.

# ¿ Mar 28, 2008 20:39

tortilla_chip: Jun 13, 2007; k-partite

XakEp posted:

What does a dir /all show?

# ¿ Apr 15, 2008 04:20

tortilla_chip: Jun 13, 2007; k-partite

Here's what we use to log ACL hits (which should catch debug since they are priority 7 messages):

logging buffered notifications
no logging console
no logging monitor
logging trap debugging
logging facility local5
logging <SYSLOG_IP_ADDR>

# ¿ May 15, 2008 16:58

tortilla_chip: Jun 13, 2007; k-partite

This is a pretty good tutorial:

http://ardenpackeer.com/qos-voip/tutorial-how-to-use-cisco-mqc-nbar-to-filter-websites-like-youtube/

# ¿ Jul 8, 2008 03:59

tortilla_chip: Jun 13, 2007; k-partite

Does anyone have experience with performing, for lack of a better term, a gender bender on a 6500 -> 7600? We have an OSM blade that is no longer supported under the 12.2SX train and we're trying to look at all our options.

# ¿ Jul 9, 2008 00:02

tortilla_chip: Jun 13, 2007; k-partite

Anjow posted:

words

You could be running into an ARP issue. I'm not very familiar with the Packet Tracer software though.

tortilla_chip fucked around with this message at 17:55 on Aug 12, 2008

# ¿ Aug 11, 2008 19:18

tortilla_chip: Jun 13, 2007; k-partite

BoNNo530 posted:

It's strange because there are things in the logs under accounting and administration- but no failed/successful attempts. I know it's hitting the server because it sends reply packets and then freaks out.

Can you post your sh tacacs output from the 2801?

Are you using a loopback address as the AAA client? If so you need to add something like:
ip tacacs source-interface Loopback0

# ¿ Aug 20, 2008 19:02

tortilla_chip: Jun 13, 2007; k-partite

You can also use a L2 traceroute (there are some caveats)

http://www.cciecandidate.com/?p=513

# ¿ Sep 1, 2008 18:49

tortilla_chip: Jun 13, 2007; k-partite

The new 1140 APs will run on regular 802.3af and support n.

# ¿ Jan 13, 2009 00:08

tortilla_chip: Jun 13, 2007; k-partite

This sounds more like someone doing ARP spoofing on your management net.

# ¿ Jun 3, 2009 19:50

tortilla_chip: Jun 13, 2007; k-partite

Is the PIX actually performing any NAT/PAT operations? If not, try "xlate-bypass"

# ¿ Jun 15, 2009 21:30

tortilla_chip: Jun 13, 2007; k-partite

This is a console speed issue. Docs usually recommend 57600 or 115200, so try those first.

# ¿ Jun 25, 2009 00:06

tortilla_chip: Jun 13, 2007; k-partite

Has anyone else run into a situation where basic ACL functionality fails on a 6500/sup720?

We had a list similar to this applied to a VLAN SVI

code:

ip access-list extended TEST
 deny ip host 192.168.1.100 any
 permit ip any any

int Vlan 100
 ip access-group TEST out

I could then still access all host in Vlan100 from 192.168.1.100, even though I saw the hit counters incrementing on the ACL.

It looked like an error in the ACL merge process or maybe some sort of TCAM corruption, as the issue went away after a reboot.

# ¿ Jun 29, 2009 23:24

tortilla_chip: Jun 13, 2007; k-partite

Is there any reason that one wouldn't have full mesh for iBGP? I've inherited a scenario where everything is meshed together with the exception of the core boxes.

code:

Border1---Border2
  |\        /|
  | \      / |
  |  \    /  |
  |   \  /   |
  |    \/    |
  |    /\    |
  |   /  \   |
  |  /    \  |
  | /      \ |
  |/        \|
 Core1     Core2

# ¿ Jul 7, 2009 20:11

tortilla_chip: Jun 13, 2007; k-partite

neroshige posted:

You might need direct peering between two border router to avoid non optimal traffic flow from one boarder to second boarder to external AS's . ( boarder1->core1->boarder2). It could be fixed by other methods.

And do you have RR ?

Nope, no reflectors in this scenario.

# ¿ Jul 13, 2009 16:30

tortilla_chip: Jun 13, 2007; k-partite

Sojourner posted:

Procurve migration stuff

Do a sh int status and make sure the Cisco ports aren't err-disabled.

# ¿ Aug 6, 2009 16:41

tortilla_chip: Jun 13, 2007; k-partite

sh dot11 associations

# ¿ Aug 18, 2009 22:29

tortilla_chip: Jun 13, 2007; k-partite

I'm trying to do policy based routing on the internal gig interface (g1/0/2) on a Etherswitch Module (NME-16ES-1G). I'm running 12.2(35)SE5 IPSERVICESK9-M which according to the CFN supports policy based routing. The feature is available on all the other physical interfaces, just not the one used for internal routing between the ISR and ES... has anyone else run into this?

# ¿ Oct 26, 2009 18:50

tortilla_chip: Jun 13, 2007; k-partite

I am under the impression that there is a difference between the ES and ESW models. The ES allows you to give an ip address to g1/0/2 on the ES and g1/0 (or whatever slot is applicable) on the ISR.

Edit: Figured it out. Forgot to issue "no switchport" to g1/0/2 after nuking the config and upgrading IOS images.

Edit 2: Also need "sdm prefer routing"

tortilla_chip fucked around with this message at 00:29 on Oct 27, 2009

# ¿ Oct 26, 2009 22:07

tortilla_chip: Jun 13, 2007; k-partite

You're not necessarily out of luck. A lot of 12.4 features are ported to the 12.2SX train.

# ¿ Nov 9, 2009 21:34

tortilla_chip: Jun 13, 2007; k-partite

Sounds like a job for CFN!
http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp

# ¿ Nov 10, 2009 17:40

tortilla_chip: Jun 13, 2007; k-partite

If you are looking at commercial products I highly recommend Splunk. I don't believe there is a Windows version though.

# ¿ Jan 13, 2010 16:33

tortilla_chip: Jun 13, 2007; k-partite

inignot posted:

Ugh. I've gone down this road recently. I'm much more of an IOS guy then a PIX/ASA guy, but I've had to do some work on a firewall switch module recently. As near as I can tell the FWSM contains none of the acl editing capabilities of IOS at all. I can't find a way to remove or insert an entry via line numbers or re-sequence the acl to insert gaps into the line numbers. It's all 1998 acl land : remove acl, no out acl, create new one with edits, re-apply. If anyone knows a better way to do this on a FWSM let me know. I haven't found anything in my FWSM book or the docs.

TO remove an entire FWSM ACL:
fwsm(config)# clear configure access-list <access-list name>

TO remove just one line:
fwsm(config)# no access-list <access-list name> line <line number> <full ACE>

TO disable just one line:
fwsm(config)# access-list <access-list name> line <line number> <full ACE> inactive

TO add just one line:

fwsm(config)# access-list <access-list name> line <line number> <full ACE>

If you omit the line number the ACE gets added to the bottom of the ACL as the last line.

If you add a line number the new ACE gets put in place of that existing line and the existing line becomes line n+1 (gets moved down).

# ¿ Jan 20, 2010 21:39

tortilla_chip: Jun 13, 2007; k-partite

Weissbier posted:

I have a troubleshooting question:

Technician calls and says they "can't connect to the network" and supply me the port.

I ssh into the switch and the port in question has a mac address entry for the computer when I do sh mac-address-table.

I ssh into the edge switch for that facility and that computer's mac address is listed there.

Beyond the obvious answer, which in my mind is, try another device on that port, what else can I do remotely to see what's going on?

*edit* All other PCs on that facility are working.

Mirror the traffic to a port you can sniff. Bonus point for doing this via EoMPLS.

# ¿ Feb 6, 2010 19:21

tortilla_chip: Jun 13, 2007; k-partite

Out of curiosity, does traffic flow as expected when you have [PC]--[5050]--[g8/45 6509] ?

Edit:
Is the IP address assigned to the physical interface or did you assign it as a sub with dot1q and vlan 12 as the native tag?

tortilla_chip fucked around with this message at 05:49 on Feb 12, 2010

# ¿ Feb 12, 2010 05:42

tortilla_chip: Jun 13, 2007; k-partite

Anyone have experience running automated TCL/EEM scripts? I have a script from Cisco's community site that I'd like to run, but can't seem to find any documentation on where to get started.

# ¿ Feb 24, 2010 22:06

tortilla_chip: Jun 13, 2007; k-partite

inignot posted:

MPLS Management

sh run vrf NAME should get you what you need. It's supported on the 7600 platform.

# ¿ Apr 28, 2010 00:03

tortilla_chip: Jun 13, 2007; k-partite

Xenomorph posted:

I don't know if there is an issue with the configuration, but once every month or two it seems to just stop letting traffic through.
We can connect, but aren't able to access the network.

clear xlate?

# ¿ May 18, 2010 21:36

tortilla_chip: Jun 13, 2007; k-partite

http://blog.ine.com/tag/tcl/

It looks like you can store them as a macro (toward the bottom of the article).

# ¿ Jul 20, 2010 21:12

tortilla_chip: Jun 13, 2007; k-partite

You can try:

service unsupported-transceiver

Note that this disables DOM (may or may not be an issue for you). There are a few good threads on optics on C-NSP/NANOG. The gist being the Cisco optics are manufactured by the same few companies and then just have Cisco serial numbers applied in the firmware. You can get non-Cisco optics for a tenth the price on memorydealers.com

# ¿ Jul 21, 2010 18:31

tortilla_chip: Jun 13, 2007; k-partite

Juniper SSG

# ¿ Nov 4, 2010 20:14

tortilla_chip: Jun 13, 2007; k-partite

Statseeker is ok for SNMP polling and visualization, a little expensive in my opinion. Manage Engine OpManager is a jack of all trades, master of none type solution. It's pretty modestly priced ($5Kish) and the support staff is pretty responsive.

# ¿ Nov 11, 2010 18:23

tortilla_chip: Jun 13, 2007; k-partite

They are full duplex in the sense that you have a dedicated send/receive pair.

# ¿ Nov 11, 2010 20:59

tortilla_chip: Jun 13, 2007; k-partite

http://en.wikipedia.org/wiki/Digital_Signal_1

Does wikipedia count

# ¿ Nov 11, 2010 21:51

tortilla_chip: Jun 13, 2007; k-partite

What multicast mode are you using? Are the links between switches layer 2 or 3?

# ¿ Nov 15, 2010 18:41

tortilla_chip: Jun 13, 2007; k-partite

The CPU utilization looks fine. If the multicast stream is responsible for all the traffic across g0/1 and you're only doing 100meg to the receiver I could see potential for a 50mbps stream to make the experience "slow".

Have you already ruled out duplex mismatch at the user end?

# ¿ Nov 15, 2010 19:51

tortilla_chip: Jun 13, 2007; k-partite

My experience with Foundry/Brocade gear has been frustrating due to the lack of uniformity on the CLI (IE platform dependent ways to configure L3 vlan interfaces etc). I found the documentation to be lacking as well.

Also their internet edge router (CER2024) doesn't support full tables out of the box. Requires some TCAM slicing ala SDM profiles.

There was a thread on NANOG about some service provider's foundry infrastructure making GBS threads the bed with regard to MPLS LSP issues.

That said, the price per port is hard to beat. Prior to the ME3600/3800 the CER2024 absolutely killed anything Cisco could offer in the same form factor with feature set.

Overall the pick two seems to be fast and cheap.

# ¿ Dec 1, 2010 18:44

Adbot: ADBOT LOVES YOU

# ¿ Apr 27, 2024 21:56

tortilla_chip: Jun 13, 2007; k-partite

ruro posted:

Before I spend a day digging through documentation, does anyone know off hand if what I want to do is possible?

I'd build a QoS policy that uses the bandwidth percentage command per class instead of trying to figure out each queue.

I believe EEM has some basic text parsing support for the output from show commands, so once you determine the bitrate the DSL connection comes up at you can apply that bandwidth to the interface. Your queues should then readjust accordingly.

# ¿ Dec 6, 2010 04:32

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›9 »