Cisco Nexus 3548 - Configuring Active Latency Monitoring Hidden Cisco commands

In my previous blogtorial 'Cisco Nexus 3548 - Configuring Active Buffer Monitoring' I demonstrated how we can monitor buffer spaces, however what if I wanted to know the latency profile of the entire switch or per port. Enter the world of Cisco hidden commands and that's where you will find 'Active Latency Monitoring' quietly lurking around. These set of commands will enable switch latency profile measurements and give you the per port latency statistics such as total frame count within a time period, the min/max/avg latency for those frames.

For some reason, Cisco decided to keep it hidden although it may be added to the next release. As of now use this command with caution, since it is hidden it is not supported in the configuration (yet). 

Here is how you configure 'Active Latency Monitoring' on a Cisco Nexus 3548. 

Cisco Nexus 3548 - Configuring Active Buffer Monitoring

It never ceases to amaze me that people value time as money. To me time is more than money. I can make money and I can make more if I worked at it, but time -- that's a different story. I cannot make time, I cannot buy more time, I cannot take it from someone else -- Once it's gone it's gone forever. As I sit here on the train (my daily hour commute) the time it's taking me to write this blogtorial is gone. I can never get it back so hopefully I am doing something worthwhile, something that will help someone, and something that I enjoy. With all that aside let's go into how to configure 'Active Buffer Monitoring' on a Cisco Nexus 3548.

When you are down to nanoseconds on port to port latency, monitoring your buffer space becomes more crucial than ever. Because whenever you buffer your switch is now store and forward for those buffered bytes instead of cut through. If you're switch is store and forward then you are not getting the ~ 230 nanoseconds port-to-port latency that you just spent $20K for.

Before we can dive into configuring buffer monitoring it would be beneficial to understand buffer blocks and how the ports are mapped. First there are 3 buffer blocks each containing 6MB worth of buffer space which gives us a total of 18MB shared buffer. Ports to these buffer blocks (3 x 6MB) are mapped as follows.

VRF Route Leaking from Global Routing Table

This blogtorial is in response to one of my reader's question "How do I use internet with VRF?". In this blogtorial we will see how we can leak routes between a VRF and the global routing table. In my opinion, route leaking between two VRFs is so much easier and straightforward than leaking between VRFs and the global routing table. However, in any case, let's get started and see one of 2 ways (perhaps there are more ways?) to leak routes between a VRF and the global routing table.

Here is the topology -- let's get started.

Entire config can be downloaded here.

BGP - Manipulating BGP communities

I like my desk to be organized..Do you? I suppose we can "desk" that conversation for another time :) Anyways if you are into being organized then BGP communities (32-bit value) are a great way to tag,organize your routes and make intelligent routing decisions. In this blogtorial I will show you briefly on how to set communities, delete communities (specific one or all of them), and appending to the existing communities.

Here is the topology we will be using.

Entire config can be downloaded here.

Configuring ASA NAT - Static 1-1 NAT

This blog will be a continuation of my previous blogtorial about NATs on ASA. One key difference to keep in mind between dynamic and static NAT is that Static NATs allow for the possibility for outside hosts to initiate connection.

Here is our base topology.

Let's get started!!!

Full configuration of the devices can be downloaded here.

Centralized log management - Syslog-ng, Phpsyslog-ng and MySQL back-end

Should I split this blogtorial in different parts and spoon feed it or are my readers man (or woman) enough to just take this blog as a whole and tear it apart? I decided my readers are hungry enough to handle the beast that centralized Syslog management really is. If you follow this blogtorial step by step you will have a fully functioning centralized Syslog management with a database back-end to store the logs, PHP web GUI front-end to view the logs and a solid Syslog server collecting all of the data.

Here is what we will cover in this blogtorial: 

• Installing and configuring MySQL - This will house the database and the necessary tables to organize the logs.  
• Installing httpd/apache and PHP libraries - This will be the webserver to house the Syslog-ng web GUI front-end (phpsyslog-ng)
• Installing phpsyslog-ng - This will be the web based GUI to view the logs.
• Installing syslog-ng - This will be the app collecting the logs and sending it to MySQL. 

Grab some chips, salsa and your favorite beer or a glass of wine because it is going to be a long one but in the end you should have a robust centralized log management system.

Configuring ASA NAT - Dynamic NAT - Object Network NAT

In this blogtorial we will see how we can take an inside LAN subnet and dynamically NAT using a POOL of addresses. Make sure the pool of addresses being used is reachable from the destination.

Here is the topology and the entire config can be downloaded here.

Objective:

Inside LAN (10.1.1.0/24) subnet should be dynamically translated to one of the IP addresses from the POOL (204.11.72.0/24). 

Configuring ASA Active/Standby failvover - ASA High Availability

When will this fail? How can we increase resiliency? How can we achieve close to 100% up-time? Questions one should be asking when designing any system. One way to answer these critical design questions -- redundancy!!. So in this blogtorial we will see how we can deploy two ASAs in a redundant design. When it comes to ASA high availability there are two modes: Active/Active where both ASAs are forwarding traffic and the other is Active/Standby where only the primary ASA is responsible for forwarding traffic and the other is in a hot-standby state waiting to forward traffic soon as the primary one fails. Each mode has its own set of pros and cons. Please review the Cisco website for a full list of Guidelines and Limitations.

Full configurations are located here so you can lab this up in GNS3.

With this in mind, let's get started on this topology.

TCP - TCP small window size causing latency

If you need a primer on window size and scaling you can check out my previous blogtorial that I posted a while ago. Today a client called and complained about latency. The basic premise was that they sent a New Order Single (FIX) and they didn't see the execution report for about 11 seconds. Application logs however showed that it was executed within sub microseconds and so why this 11 second delay? Obviously network equipment is not going to buffer the packets for multiple seconds. In order to troubleshoot this I turn to man's best friend (not dogs) -- but rather sniffers / packet captures ... perhaps I should have said nerd's best friend. :-) Once I started looking at the packet captures it all came together. I won't post the packet capture however a screen shot cant hurt.

Configuring ASDM for ASA on GNS3

ASDM is a GUI tool that you can use to configure ASAs. Although I prefer to use CLI, ASDM does come in handy from time to time. In this blogtorial we will see how to configure ASDM so that we can use it to configure ASAs running on GNS3. If you need a primer on how to get ASAs working on GNS3 then see my previous blogtorial.

Overview: 

• Download ASDM image
• Create a Loopback interface
• Connect it to the ASA
• Assign IP addresses
• Download TFTP server
• Copy ASDM image to the ASA
• Install ASA on the computer
• Connect to the ASA using ASDM 

GNS3 - Configuring ASA on GNS3

I generally use GNS3 to emulate routers but recently I have been using it to do some ASA labs. So here is how I emulate ASAs on GNS3.

First thing to take care of is acquiring the ASA images needed to emulate an ASA. Files needed can be downloaded here.

Once you've downloaded the files it is time to configure GNS3 to run the ASA. Follow the screenshots.

Dot1Q Tunnel / q-in-q Tunneling

Dot1Q tunnel or q-in-q tunneling is a technique generally used by service providers to extend customer's VLANs to different locations. It is done by encapsulating the customer VLAN inside another 802.1q encapsulation and because of this we must increase the system mtu on the service provider switches to something greater than 1500. In this blogtorial, we will take a look at a very simple topology with easy to follow configurations.

Here is the topology. 

Our objective: 

VLAN 10 in a Customer Site in California (SW1) needs to be extended to a Customer Site in Illinois (SW4).

BGP - Unicast NLRI to Multicast NLRI - translate-update cisco

I have been extremely busy with work, school and CCIE studies so I have not been able to post as much as I want to. There are numerous drafts ready to be posted so hopefully I'll have sometime to share it on here. Alright, enough with the excuses and let's get started. In this blogtorial we will see how we can take a unicast route received from a unicast BGP neighbor and install it in the multicast routing table and advertise it to MBGP peers using translate-update feature. Usually this is done for in-congruent BGP topology where a MBGP capable router peers with router that is incapable of MBGP.

Here is the topology.

The entire configs can be downloaded here so you can lab it up in GNS3.

BGP - Troubleshooting Lab 2

Objective

• R3 and R4 must have 5.5.5.5/32 and 6.6.6.6/32 in their BGP/routing table. 

Sounds simple..? Well how about you figure it out then :) .. Here is the topology. 

Restrictions

• Static routes should not be added anywhere!! In other words, get BGP to work properly. 

You should be able to figure out the issues with the following show commands below.