The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›2 »

chestnut santabag: Jul 3, 2006

Xenomorph posted:

Some douche is using an IP that is supposed to belong to me.

We're both set to static.

I would like to go to this douche and tell him to stop using my IP. Unfortunately, I don't know where he's at, and there are like 300 Computers here. I'm not going to check them all!

I have his MAC address. A lookup on it tells me its from a Dell.

We have a bunch of Cisco 2950 and 2960G switches.

Is there a way for me to narrow down what port the MAC address may be on?

switch#show mac-address-table
I think.
Although with 300 pcs, you should probably do what the above post says.

chestnut santabag fucked around with this message at 22:35 on Nov 4, 2009

# ¿ Nov 4, 2009 22:31

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 01:36

chestnut santabag: Jul 3, 2006

Is it possible to set up two routers to connect to each other using frame relay without a frame relay switch?

# ¿ Dec 1, 2009 18:54

chestnut santabag: Jul 3, 2006

Cizzo posted:

Excuse my ignorance but I'm not really getting this. From what I'm reading, it shows that to get the prefix you have to basically just do (16 * the number of nibbles being used). So can the prefix be 64 or less at that point?

The prefix just shows the range of addresses and can be anything from 0 to 128.
In your previous example of 2001:0:0:AB0::/60, it means an address range of 2001:0:0:AB0:: to 2001:0:0:ABF:FFFF:FFFF:FFFF:FFFF.

If 2001:0:0:AB0::/60 is an IP address actually assigned to something then that is rather unusual but still valid.

I have no idea what you mean by this:

quote:

From what I'm reading, it shows that to get the prefix you have to basically just do (16 * the number of nibbles being used). So can the prefix be 64 or less at that point?

# ¿ Dec 17, 2010 10:45

chestnut santabag: Jul 3, 2006

Bardlebee posted:

Ah, very informative. Thank you.

I am amazed that you had people who couldn't differentiate, I would hope if they had a CCNA they just had interview jitters. That is pretty sad if you are even attempting for a network technician job. Maybe not so much a service desk, on the phone type position.

So, I have two unrelated questions here:

First, with switch CAM tables. If say I am on port 24 and I have a MAC of FFFF and the switch knows this from previous communications. What happens when I disconnect that connection. Does it wipe that MAC from the CAM table? If not, if I connect say my laptop with the MAC of DDDD on there, how does it know its not FFFF when someone sends an ARP?

Secondly, I am attempting to practice making a server face the external world. Right now my current IP configurations are:

Current router (external) IP: 222.222.222.222
Current router (internal) IP: 192.168.2.1
Current Server IP: 192.168.2.240

If I want to utilize another IP address then the one I NAT with for the internet, how do I do this? I am basically doing this for practice, to ping my server from say my house to my work environment. This is not connected to my work though, a lab setting here.

So would I need to setup an interface with one of my other external IP's allotted to me, like say 333.333.333.333 then forward traffic from that to my internal server IP? Sorry if that's confusing.

EDIT: Alternatively, do I HAVE to utilize a different external IP then the one I used for internet connectivity? Or can I just use that IP, being 222.222.222.222 to externally connect to the server?

A switch can learn multiple MAC addresses per switchport and in this case would remember both. The first address would eventually get purged due to no activity from the MAC address after something like 5 minutes.

You want a static NAT binding in addition to an existing NAT overload I think?

code:

interface inside
 ip address 192.168.2.1 255.255.255.0
 ip nat inside
!
interface outside
 ip address 222.222.222.222 255.255.255.255
 ip nat outside
!
ip nat inside source list 1 interface outside overload
ip nat inside source static 192.168.2.240 333.333.333.333
!
access-list 1 permit 192.168.2.0 0.0.0.255

as long as that 333.3333.333.333 address is routed to this router.

:argh:

333.333.333.333 :argh:

# ¿ Dec 28, 2010 23:40

chestnut santabag: Jul 3, 2006

Bardlebee posted:

Oh, excellent that makes sense now. Thanks.

This is very exciting that I am able to ping my server from outside. Small victories gentlemen.

EDIT: Do you guys know how I can block a certain internal IP address from another network from getting into my current one?

It is for the router config I posted up there, they are connected via IPSec VPN so I am not sure it is possible because won't the router just see the external IP of the router connection?

My Location External Address: 222.222.222.222
Their Location External Address: 444.444.444.444
Their Location Internal IP address: 192.168.4.150

How can I block the .150 but allow others onto my 222.222.222.222 network (Internally 192.168.2.0)

I'd say that you would have to block it at either one of the tunnel endpoints - preferably before entering the tunnel - using an extended ACL.

# ¿ Dec 29, 2010 21:19

chestnut santabag: Jul 3, 2006

Sepist posted:

Having an issue creating a port redirection nat because of an existing nat in place. We use inside outside static NAT's for the inside and outside IP's. They want to redirect port 8760 to port 80 on one web server, however when I do the following:

access-list Outside_in extended permit tcp any host OUTSIDE IP eq 8760
static (COMPANY,outside) tcp OUTSIDEIP 8760 INSIDEIP www netmask 255.255.255.255

I would, as you guess, get the error

ERROR: mapped-address conflict with existing static

Due to the existing:

static (COMPANY,outside) OUTSIDEIP INSIDEIP netmask 255.255.255.255

Is there an easy way around this on the ASA or would I be better off just creating a new inside IP on the server and creating a new static entry for that on the ASA?

My ASA is a little rusty but should not one of those netmasks be the actual netmask for the subnet?

# ¿ Feb 4, 2011 15:20

chestnut santabag: Jul 3, 2006

Here's something that's had me stumped for the past week.
I'm currently implementing port based authentication using using Microsoft NPS for the RADIUS server. Everything seems to be working fine except for trying to access the switch itself be it through SSH or the console connection where the NPS appears to be rejecting the authentication message due to "message authenticator attribute not set where one is required".
There is a checkbox for "message authenticator attribute required" in NPS and if it gets unchecked then the process works normally.
I'm wondering why it isn't working properly for switch access when the box is checked making the message authenticator attribute mandatory yet works as expected for the regular dot1x stuff on the switchports.

# ¿ Jun 13, 2011 21:29

chestnut santabag: Jul 3, 2006

geera posted:

We had a weird thing happen yesterday, hopefully someone can suggest a way to troubleshoot this.

Around 9am, roughly one-third of our switches decided to disable their uplink ports because they detected a loopback on the network. It started in one area and spread out from there across the network, but didn't affect every switch, just some of them randomly. The only way to bring them back up was to plug in to each switch with a laptop and bounce the uplink ports. I also turned off keepalives on those ports so they wouldn't disable themselves again, but that doesn't fix the root issue of having a loop somewhere on the network.

We haven't made any logical changes to the network in a long time and we inspected the switch rack closest to where the problem started and didn't find any switches plugged in to themselves or any other cabling weirdness. We haven't added any new hardware, however this is a medium-sized manufacturing plant spread across two buildings, and we have some electrical technicians that like to pretend they're IT ( ), so for all I know there may have been a hub or something plugged in somewhere.

I don't know of any other way to track down the source of the loopback issue, but I'm still getting complaints of things running slowly today, so I'm concerned that the loop is still there and causing problems. Does anybody have any suggestions?

Are these Catalyst switches running IOS 12.1?
I had the exact same issue last week with switches that were putting uplinks into error-disabled loopback state. A bit of research and I found out that 12.1 has keepalives enabled on uplinks by default whereas on 12.2, keepalives are disabled on the uplinks by default. Cisco recommends upgrading to 12.2 or newer: http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00806cd87b.shtml (scroll down to loopback)
Otherwise possibly enable bpdu-guard on the switches and see if anything gets put into an error-disabled state.

# ¿ Jan 31, 2012 17:50

chestnut santabag: Jul 3, 2006

XMalaclypseX posted:

So I have been tasked to replace 10 very old and aging 3Com switches for a basic, low utilized network.

My choices have come down to either the WS-C2960S-24TS-L or the SGE2000. Both are classified as Cisco Small Business and they seem very similar in features but the C2960S is significantly more expensive and I cant seem to tell why.

Anyone have any experience with these switches and if so, which would you choose?

The 2960s are not Cisco Small Business, but proper Catalyst switches running proper IOS.
The SGE2000 are Cisco Small Business switches which are rebranded Linksys switches.

The SGE2000s primary means of management is a web based GUI that is horribly slow and a pain to manage over a slow connection.

There is text based management but its a really basic menu based terminal accessed either through a serial port or telnet. This is also the only way to change the switch between a layer 2 and a 3 switch and between a stacked switch and a non-stacked switch.

One of the advantages of CSB switches is that they can be converted to layer 3 switches. However you can't change the VLAN interface IP address without deleting it and readding it (I had to do this remotely and it involved pushing a config file to the startup config and restarting the switch and hoping that the config didn't have a typo or something causing it to not be loaded into the running config with no way of fixing it remotely).

The 2960s have standard IOS with the standard IOS command line interface or the web browser GUI if you're one of those people.

You're paying the extra for IOS more than anything else compared to the other switch.
IOS is frequently updated with patches and features.
The SGE2000 OS has had like one update since June last year and I doubt it'll get anymore.

Both of those models can be stacked.
The 2960s require a stack module which goes into the back and can be stacked to a maximum of four switches using 10Gigabit cables that go into the modules.

The SGE2000s can be stacked to a maximum of eight switches using ports 12 and 24 on the front - the two rightmost RJ45 ports - this is especially great when you forget this and can't figure out why the gently caress poo poo isn't working when connected to these two ports. They become regular Ethernet ports though if stacking is disabled from the menu based terminal.

Neither of those switch models are PoE.

Both switches have 24 Gigabit ports and 4 Gigabit SFP ports.

In short the 2960s are far easier to setup and manage, but if its a basic, low utilised network then once you get through the pain of setting up the SGEs then there shouldn't be much managing required. I am assuming that the topology is a flat network with no VLANs and that the default gateway is some other router. How would the switches be connected to one another?

chestnut santabag fucked around with this message at 21:17 on Jun 13, 2012

# ¿ Jun 13, 2012 21:14

chestnut santabag: Jul 3, 2006

ior posted:

Actually so can the 2960 - static routing only though.

Oh right yeah, but you need 12.2(55)SE minimum and some SDM fuckery I think.
I haven't tried routing on a 2960 yet as it doesn't seem to be recommended or mentioned much. I'm not sure how well the ASICs would cope. The one quad 2960 stack that I manage has like 60% average CPU utilisation (of which 20% seems to be from the LEDs) so I'm not too enthusiastic about doing any kind of routing through them.

XMalaclypseX posted:

Thanks for your input!

This pretty much confirms my suspicions and is a giant plus in favor of the Catalyst switch. Has the overall quality of their hardware gotten any better since their takeover by Cisco?

The switches will be connected via SPF+ to a WS-C3750X-12S-S which will serve as a core switch. Right now its just a flat network but I want the ability to be as flexible as possible.

It's literally the same switch with a Cisco logo on it.
They didn't even change the model number:
https://www.google.com/search?q=sge...iw=1597&bih=941

You can't even use the Cisco Small Business SFPs on regular Catalyst switches without the port getting automatically disabled.
By SFP+ do you mean 10Gig links?
Both of those models only have regular 1Gig SFPs.

I did a similar installation to what you're doing with a 3750 as the core and CSB switches as the access switches at a simple low utilised nework. The only major difference is that those were PoE switches as the upgrade was for an IPT rollout which made things a bit more complicated but otherwise there haven't been any issues in the four or more months that it's been running.

chestnut santabag fucked around with this message at 22:01 on Jun 13, 2012

# ¿ Jun 13, 2012 21:45

chestnut santabag: Jul 3, 2006

Zuhzuhzombie!! posted:

Next morning - loving Granstream. Didn't know these little bastards had DHCP.

Time to read up on DHCP snooping/DHCP Trust.

ed

If I have a 3 3750 ring network, I need to enable DHCP snooping not on the master 3750 that serves as the edge device AND the DHCP server, but on the 3750 trunked to it that all of the users are connected to, correct? At the moment it looks as if I should have the trunk back the master 3750/dhcp server as a trusted interface and all others as untrusted.

Or can I have DHCP snooping on the master switch/dhcp server/vtp server/etc?

Yeah DHCP snooping is local to a switch so you don't have to enable it on "trusted" switches. Just be sure to configure the uplinks to trusted on whatever switches you do enable DHCP snooping.

# ¿ Jul 15, 2012 22:19

chestnut santabag: Jul 3, 2006

routenull0 posted:

That's dirty.

Anyone using Nexus 2248's for ToR?

I have a some experience with Nexus stuff - mainly 7000s, 5000s and 2000s.

# ¿ Jul 18, 2012 18:33

chestnut santabag: Jul 3, 2006

switchport trunk native vlan 731

Is there a setting in your netapp setting that recognises untagged traffic as being in vlan 731 like the above command?
If you don't then you got a native vlan mismatch and your netapp is receiving untagged traffic that it doesn't know belongs to vlan 731.

# ¿ Sep 19, 2012 17:19

chestnut santabag: Jul 3, 2006

Zuhzuhzombie!! posted:

Been asked to look into VSS.

Anything I should know/keep in mind?

If you're implementing VSS on existing equipment, be extremely sure that the kit will be supported in a VSS deployment.
If you're looking at new kit, be sure that it'll also be supported in a VSS deployment.
My first VSS deployment came to a grinding halt when I saw that the switches were refusing to power up their 6148 modules.

# ¿ Dec 10, 2012 22:45

chestnut santabag: Jul 3, 2006

Zuhzuhzombie!! posted:

Minimal IOS: 12.2(33)SXH1

We're running: 122-33.SXJ

We're running WS-SUP720-3B.

I think I'm good. TY!

ed

Sup engine: 720-10GE (VS-S720-10GE-3C and VS-S720-10GE-3CXL)

I don't know where to check in my config for a more specific designation other than the above WS SUP720 3B from Show Module. Looks like I might need to update the Supervisor.

WS-SUP720-3B is WS-SUP720-3B which doesn't support VSS: http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/product_data_sheet09186a0080159856.html
You'd need to replace the supervisor with S720-10G or a 2T.
Also yeah, VSS for 4500E (not regular 4500) with a SUP7 was just released as part of last week's IOS update. It also includes the 1U 4500X with which I'll be doing an installation soon.

# ¿ Dec 11, 2012 18:30

chestnut santabag: Jul 3, 2006

adorai posted:

with a c4900m, would I typically just use one of the 10Gbe ports on each one to the other (in a pair). I didn't see anything about a cisco stackwise port on them, but having not seen one in person I wanted to make sure a pair of them would typically just have 7 usable ports each.

I don't really intend to buy a pair, but am working on a few options for a budgetary proposal and wanted to make sure I had the necessary info first.

Yeah, they're not stackable so you'd have to use a regular Ethernet port and treat them as separate switches.
You also can't apply VSS to them like you can to 4500X's now.
You might want to use two ports per switch if you can for redundancy.

# ¿ Dec 18, 2012 17:14

chestnut santabag: Jul 3, 2006

Has anybody else heard of 5 Gigabit Ethernet?
Cisco's new small business switches - the 500 series - appear to have SFPs that can run at 5Gbps even though there isn't even an IEEE standard for it which sounds like vendor incompatibility hell. And probably incompatibility hell with Cisco's regular Catalyst switches!

# ¿ Dec 28, 2012 19:23

chestnut santabag: Jul 3, 2006

My first experience with 15.0 on 3750s led me to discover a wonderful out of the box bug where port SPAN session would just stop working and would have to be re-added to fix. Although thankfully this did get fixed pretty soon.
15.0 isn't related to Cisco's new licencing model.
You get universal images for 12.2 and you get feature specific images for 15.0.

Also 4500X VSS trip report:

Easy enough to do except then I found out that the only dual active detection mechanism implemented is the PAGP one - no fast hello or the other one.

# ¿ Jan 3, 2013 20:42

chestnut santabag: Jul 3, 2006

teh z0rg posted:

What is some pro kit for a Cisco lab?

I got rid of all the old poo poo and I'm hesitant to go 15.x because everything is licensed and I just want to load Advanced IP Services and call it a day.

Will 3825's run 12.x?

Licencing models seems to be tied to platform rather than to software version.
Of Cisco's router lineup, its only the newer x900 routers that require license files to activate features as they only have the universal IOS images.
Probably all of the x800 don't have any of the license file requirements even in their 15.x versions.
Basically if the IOS image file is not a universal image, then its not going to require license files.
Curiously the newer 3750s seem to have universal and non universal images in both their 12.2 and 15.0 versions although this might just be so that they can be compatibly stacked with older 3750s. Even then I've gotten 3750 stacks working with one 3750 with a universal image and an IP base license and the other with an IP base image.

# ¿ Jan 20, 2013 15:45

chestnut santabag: Jul 3, 2006

falz posted:

The most info I've seen so far is here:

https://puck.nether.net/pipermail/cisco-nsp/2013-January/088884.html

And you can view the images on Cisco's download page.

I had a quick look at the images available to download for the 3850s.

200+MB images for an access switch :stare:

# ¿ Jan 24, 2013 20:27

chestnut santabag: Jul 3, 2006

aquaticrabbit posted:

To whomever was asking about the 3850 switches earlier in the thread, Cisco just posted some information: http://www.cisco.com/en/US/products/ps12686/index.html

quote:

480 G stacking
built-in wireless controller capabilities with 40 G wireless throughput, support for 50 access points and 2000 wireless clients per switch or stack, and support for 802.11ac.

# ¿ Jan 29, 2013 19:30

chestnut santabag: Jul 3, 2006

Powercrazy posted:

Even the Cisco MD5 hash is extremely insecure, just not as readily reversible. It's 6 characters plus 2 characters of salt, md5 hashed. The salts are all known, so really you just have an MD5 hash of 6 characters. Hardly secure at all.

Can be brute forced on a modest GPU within 24hrs. BUT fear not, the locally stored passwords are irrelevant for the security of the device since you are using TACACS/RADIUS.

Thanks for the info, I do see the 802.1u option available, but I have no idea how to use it, or what requirements the end-devices need to support it.

I was playing around with one of the new 15.0 releases of IOS for 3750s and it looks like SHA256 (designated type 4) is replacing MD5 for secret hashing.
Pity I had to revert to a slightly older version as the TenGig interface on a non master switch wouldn't come up automatically when the switch powers up.
This is had the fun result of losing any commands that uses the new encryption method like enable secret as the older IOS doesn't recognise type 4 encryption.

# ¿ Feb 28, 2013 21:36

chestnut santabag: Jul 3, 2006

wolrah posted:

Haven't seen anything posted about this yet:

http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20130318-type4

The short version is that Cisco hosed up massively when implementing their new "type 4" password hashing in IOS 15 and rather than running PBKDF2 with 1000 runs of SHA256 and an 80 bit salt, they instead just SHA256 it once without a salt.

This obviously has a massive impact on the ability to brute force a hashed password and reopens rainbow tables as an option. Anyone who has posted a config file to the internet containing type 4 hashes should consider those passwords compromised.

It gets better, too. Any device that supports type 4 hashes will not generate type 5 hashes, so to change these passwords you'll need to generate the type 5 hash elsewhere and then you have to do that every time the password is changed until you can downgrade to an older version or Cisco releases a fix.

Yeah this cropped up at work today when a client requested to know if they were affected.

Cisco is going to deprecate type 4 encryption, and revert to type 5 being the encryption used for secret passwords in future releases but still recognize type 4 encryption for compatibility - this will probably happen within the next couple of rebuilds.
They say they'll also re-implement SHA encryption properly at some point in the future as a undecided type encryption but won't be type 4 as that will be retained as a sort of read only encryption for backwards compatibility.

I think most major version 15 releases in the past 6 months were migrated to type 4 encryption but I couldn't find any mention of type 4 encryption being introduced in the various release notes for versions that have it - I think in some instances, it was introduced in rebuilds.
I can confirm that version 15.0(2) for switches uses type 4 encryption with 15.0(1) using type 5 encryption.
IOS XE also uses type 4 encryption but I couldn't say when it was introduced.
Latest version of 15.0 on an 1841 doesn't seem to be using it but 15.1 upwards does seem to be using it although its not clear when it was introduced into those versions.

And like the above said, you can still paste in a type 5 encrypted password generated from another device - you just can't tell the switch to encrypt entered plain text passwords using type 5, it'll only encrypt using type 4.
Also if you do downgrade a device that has type 4 encypted passwords to an image that doesn't support type 4 passwords, upon rebooting, it rejects the enable secret and username secret commands from the startup configuration.

chestnut santabag fucked around with this message at 22:26 on Mar 19, 2013

# ¿ Mar 19, 2013 22:24

chestnut santabag: Jul 3, 2006

DagPenge posted:

I know this isn't the Wireless thread, but does anyone has any experience with Cisco Wireless equipment?

I work in hosting and was wondering if it could be feasble to host a Wireless controller for a customer, keep one of those in our datacenter, get a MPLS to the customer and all you had to do was plug in the access points at their various locations. If you where smart about it, maybe you could even share the controller between serveral customers.

However I don't have enough experience with Cisco Wireless to know if this can be done, I mean if all the traffic has to go over the controller this would be dumb as hell. Anyone tried anything like this?

Cisco offers a few wireless controllers made for this specific purpose, mainly the Flex 7500 controller and virtual wireless controller.
What you will have to do though is make sure all the APs are configured to be Flex APs (formerly H-REAP) so that the traffic gets locally switched at the sites rather than being tunneled to the controller to enter the network.
There's also their Meraki stuff which I don't know anything about but might be related.

# ¿ Apr 5, 2013 16:44

chestnut santabag: Jul 3, 2006

Isn't auto-MDIX a requirement for Gig ports to work?
Otherwise yeah, try using a crossover cable - preferably a Gigabit crossover where all the pairs are swapped rather than just the 2nd and 3rd pairs.

# ¿ Apr 9, 2013 16:21

chestnut santabag: Jul 3, 2006

Powercrazy posted:

Make sure you are looking at the "E" chassis.

Also whenever you look at EoL cisco hardware there is almost always an upgrade path that will be mentioned in the same announcement.

I did a quick check and it looks like they recently announced EoL for the R-E chassis' and replaced them with R+E chassis' with the original non E chassis' being announced EoL several years ago.

The R chassis' are the ones that take redundant supervisors.

Here's the announcements for if your resaler continues to push back:
End-of-Sale and End-of-Life Announcement for the Cisco Catalyst 4500 Non-E-Series Chassis
End-of-Sale and End-of-Life Announcement for the Select Cisco Catalyst 4500E Series Chassis

# ¿ Apr 13, 2013 12:06

chestnut santabag: Jul 3, 2006

Gap In The Tooth posted:

How long are the CCNP/CCIE written valid for? CCNA runs out after 3 years.

CCNA and CCNP are valid for three years and CCIE is valid for two years I think.
Although with CCIE, you only have to do the written exam to recertify.

# ¿ Apr 24, 2013 17:31

chestnut santabag: Jul 3, 2006

Gap In The Tooth posted:

Thanks Langolas and BoNNo530, I'm using two 1841's with 12.4 Adv Security.

Has anyone upgraded from 12.4 to 15? I know there are some 15 images available for my gear but I understand they include some licensing components? Is it worth the step up or should I just stick with IOS 12.4 till I get new equipment?

x800 series routers use the same licensing model for 15 as they do for 12 - since you're using an Advanced Security 12.4 image then you'll just get an Advanced Security 15 image and upgrade it as you would normally.

# ¿ May 2, 2013 20:01

chestnut santabag: Jul 3, 2006

ragzilla posted:

xr is more of a microkernel design under qnx, sounds like Marty was describing xe (used on ASR 1k) which is a Linux host OS running a monolithic IOS kernel as a processes.

Yup, Cisco is moving towards IOS XE for their upcoming switches - the newer sups for 4500s, 4500x's and 3850s are already using it.
I was told that it had something to do with single-core processors becoming less common and since regular IOS can only run on a single core, they're doing what ragzilla said above and running IOS as a process.
It's also supposed to open up the possibility of running other software on the switches like Wireshark as well.
They're also bringing out some new 2960s which will supposedly be upgradeable to IOS XE at some point - since they've got dual core processors, only one core would be usable until then.
They're even supposed to be Netflow compatible on every single port!
The next supervisors for the upcoming 6800 chassis' should also get IOS XE at some point if they don't come out with it already.

# ¿ May 28, 2013 19:18

chestnut santabag: Jul 3, 2006

Fatal posted:

Anybody else loving the wonderfully non-functional 15.0.2(SE2+)? Lets see, 15.0.2(SE2) has a memory leak (on 2960Ss) where if you have too many devices requesting DHCP you lose console access until reboot. 15.02(SE3) has a TACACS bug (on 3560/3750s) that kills all access, yaaaaayyyyy for summer deployment ie, busiest time of the year for me.

My favourite 15.0.2 bug that I found is that the TenGig interfaces connected to Nexus 7009s wouldn't come up when they boot up.

# ¿ Jun 27, 2013 17:58

chestnut santabag: Jul 3, 2006

psydude posted:

Upgraded my test 3560g to 15.0(2)SE4 from 12.2 just to see what's new. Any major changes I should be aware of? As always, Cisco's documentation is impossible to find so I'm having difficulty finding a good changelog.

Well they introduced their new SHA password encryption into the 15.0(2) code for switches after which it was soon discovered that their implementation of this new encryption method is actually less secure than the old MD5 encryption.
Also SE3 was out for like a week before being pulled due to some bug causing 100% CPU utilisation from TACACS.

# ¿ Jul 18, 2013 21:09

chestnut santabag: Jul 3, 2006

Crackbone posted:

Super simple (I think):

For a switch, the ip default-gateway command only affects the switch itself, and not attached devices, correct? Working with some CCNA dumps and one of them is claiming you can figure out where a host will route a packet based off the switch's default gateway, which makes no sense to me (especially considering you can have multiple vlans on a switch which pretty much means a single default gateway ain't gonna work anyway).

"ip default-gateway" only applies when routing is disabled - "no ip routing"
If routing is enabled, then the command does nothing, even though its in the running-config.
This is fun to realise when you remotely enable routing on a switch and lose all connectivity due to the lack of a "ip route 0.0.0.0 0.0.0.0" statement.

# ¿ Jul 29, 2013 18:58

chestnut santabag: Jul 3, 2006

Zuhzuhzombie!! posted:

Nope. 3750x not compatible with that ipbasek9 image.

A 3750g should run c3750e-universalk9-mz.150-2.SE1.bin, yes?

Nope, 3750G doesn't use universal images nor does it use the e images.
You can still stack them though - if your 3750G is running c3750-ipbasek9-mz.150-1.SE1.bin, then your 3750X should be running c3750e-universalk9-mz.150-1.SE1.bin with at least an IPbase license or just the non-universal c3750e-ipbasek9-mz.150-1.SE1.bin although the latest builds are doing away with the non-universal images.

chestnut santabag fucked around with this message at 20:08 on Nov 4, 2013

# ¿ Nov 4, 2013 20:05

chestnut santabag: Jul 3, 2006

Zuhzuhzombie!! posted:

I figured there would be some negotiation/compatibility. I know stackwise will do that. Even though I'm running c3750e-universalk9-mz.150-2.SE1.bin and not c3750e-universalk9-mz.150-1.SE1.bin, should I downgrade the 3750x to c3750e-universalk9-mz.150-1.SE1.bin?

Yeah you should have them running the same version - either downgrade the 3750X or upgrade the 3750G.

# ¿ Nov 4, 2013 23:34

chestnut santabag: Jul 3, 2006

Cisco just officially announced CCIE v5 a few days ago.
The written and lab exams will be available from 4 June 2014 with the v4 exams being retired the day before.
So if anybody else is studying for it then they should definitely take this into consideration.
Fun highlights:

quote:

1.1.a Describe basic software architecture differences between IOS and IOS XE

No more frame relay.
Potentially less basic Ethernet stuff like duplex settings.
No more ISL.
VSS concepts

quote:

2.3.c Describe WAN rate-based ethernet circuits

2.3.c (i) Metro and WAN Ethernet topologies
2.3.c (ii) Use of rate-limited WAN ethernet services

A lot more IPv6, multicast and IPv6 multicast
ISIS is back! I can only assume that this is because of its adoption in various layer 2 technologies like fabric path.
No more WCCP.

# ¿ Dec 5, 2013 20:00

chestnut santabag: Jul 3, 2006

Bob Morales posted:

Possibly dumb question about fiber. I have this media converter on one end of a link:

And then on the other end of the link I have a full-sized switch and the fiber goes into that, the connectors look the same on this end, then I use one whole RJ45 cable to connect it to a router.

In a quest to remove some poo poo from my rack, I planned on making a VLAN and using one of the fiber ports another switch but it requires a cable that looks like this:

I connected the fiber to the switch, but I don't get a link light. What gives? There's a pretty standard looking (to me) fiber patch panel that both cables go to.

That's a 100Meg media converter - if you're attempting to plug it into a gigabit SFP then the link won't come up.

# ¿ Dec 10, 2013 21:14

chestnut santabag: Jul 3, 2006

CrazyLittle posted:

Yep. That's it - you probably used a 1000-base SX fiber SFP in your switch. You probably need one of these for the switch instead:

Cisco Linksys MFEFX1 mini-GBIC SFP Transceiver Module - 1 x 100Base-FX - SFP (mini-GBIC)

Of note is that Linksys SFPs (even the Cisco SMB branded ones) don't work in Catalyst switches without doing that one hidden command that voids all your warranties.
I don't know of any regular Cisco branded 100Meg SFPs - would these work in Gig interfaces?

Turns out there are and they do work in Gig interfaces:
http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6578/product_data_sheet0900aecd801f931c.html

chestnut santabag fucked around with this message at 17:39 on Dec 11, 2013

# ¿ Dec 11, 2013 17:34

chestnut santabag: Jul 3, 2006

So I was playing around with some brand new stacked 3650s yesterday when I came across this fun little thing:
Note that one of the features being touted by the new 3850s and even newer 3650s over the 3750s is that the stacking is meant to be SSO with no interruption should the "active" (ie the master switch) fail.

code:

3650_SW(config)#vlan 10
3650_SW(config-vlan)#name Data
3650_SW(config-vlan)#vlan 20
3650_SW(config-vlan)#vlan 10
3650_SW(config-vlan)#name Management
3650_SW(config-vlan)#vlan 20
3650_SW(config-vlan)#name Data
3650_SW(config-vlan)#vlan 30
 
*Jan 15 09:37:27.251: Config Sync: Line-by-Line sync verifying failure on command:
  name Data
due to parser return error
 
*Jan 15 09:37:28.081: %RF-5-RF_RELOAD: Peer reload. Reason: Configuration mismatch
*Jan 15 09:37:28.082: %PLATFORM_HA-4-RELOAD_PEER: Reloading the Standby, due to Config-Sync (Configuration mismatch)
3650_SW(config-vlan)#name
*Jan 15 09:37:28.337: %STACKMGR-1-RELOAD_REQUEST: 1 stack-mgr:  Received reload request for switch 3, reason Configuration mismatch
*Jan 15 09:37:28.337: %STACKMGR-1-RELOAD: STANDBY:3 stack-mgr:  Reloading due to reason Configuration mismatch  (3650_SW-3)
*Jan 15 09:37:29.004: %STACKMGR-1-STACK_LINK_CHANGE: 1 stack-mgr:  Stack port 1 on switch 1 is down
*Jan 15 09:37:29.003: %STACKMGR-1-STACK_LINK_CHANGE: MEMBER: 2 stack-mgr:  Stack port 2 on switch 2 is down
*Jan 15 09:37:29.007: %STACKMGR-6-SWITCH_REMOVED: 1 stack-mgr:  Switch 3 has been removed from the stack.
*Jan 15 09:37:29.013: Starting SWITCH-DELETE sequence, switch 3
*Jan 15 09:37:29.097: SWITCH-DELETE sequence complete, switch 3
*Jan 15 09:37:29.144: SPI(FED QoS) server dead
*Jan 15 09:37:29.006: %STACKMGR-6-SWITCH_REMOVED: MEMBER: 2 stack-mgr:  Switch 3 has been removed from the stack.
*Jan 15 09:37:29.146: %REDUNDANCY-3-STANDBY_LOST: Standby processor fault (PEER_NOT_PRESENT)
*Jan 15 09:37:29.146: %REDUNDANCY-5-PEER_MONITOR_EVENT: Active detected a standby removal (raw-event=PEER_NOT_PRESENT(3))
 
*Jan 15 09:37:29.146: %REDUNDANCY-3-STANDBY_LOST: Standby processor fault (PEER_DOWN)
*Jan 15 09:37:29.146: %REDUNDANCY-5-PEER_MONITOR_EVENT: Active detected standby down or crashed (raw-event=PEER_DOWN(2))
 
*Jan 15 09:37:29.147: %REDUNDANCY-3-STANDBY_LOST: Standby processor fault (PEER_REDUNDANCY_STATE_CHANGE)
*Jan 15 09:37:29.147: %REDUNDANCY-5-PEER_MONITOR_EVENT: Active detected a standby removal (raw-event=PEER_REDUNDANCY_STATE_CHANGE(5))

# ¿ Jan 16, 2014 19:21

chestnut santabag: Jul 3, 2006

gooby pls posted:

We're looking at the 15.0 train on our 3750x stacks for 10g support. Still concerned by some of the reports of memory leakage, etc. What code revs are people happy with?

I've got a site running on 15.0(1)SE3 for a while without any issues.
I know there were some weird bugs with 15.0(2) but it looks like they've been sorted out.
15.0 isn't a requirement for 10gig though, minimum version is 12.2(53)SE2.

# ¿ Feb 20, 2014 19:27

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 01:36

chestnut santabag: Jul 3, 2006

Tremblay posted:

Been a while since I posted here. I'll try and check in more frequently. If anyone has questions about newer security products, ISE, etc. Let me know I'll do my best to answer.

So how about that Nexus 7k firewall module?

# ¿ Mar 3, 2014 18:54

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›2 »