Convergence between SVI vs Routed Interface - Cisco 3548 NXOS

Convergence of SVI vs. Routed link on a Cisco 3548 Nexus running A1.1c

Link failures were simulated by “shut” on the remote interface.

SVI – L2 VLAN

 switch#  
 2014 Aug 28 10:04:06.348524 switch %ETHPORT-5-IF_DOWN_LINK_FAILURE: Interface Ethernet1/9 is down (Link failure)  
 2014 Aug 28 10:04:06.478105 urib: "direct": 1.1.1.0/24 no more next hops  
 2014 Aug 28 10:04:06.478419 urib: 1.1.1.0/24 Deleting & Freeing  
 2014 Aug 28 10:04:06.479344 urib: "local": 1.1.1.1/32 no more next hops  
 2014 Aug 28 10:04:06.479618 urib: 1.1.1.1/32 Deleting & Freeing  
 2014 Aug 28 10:04:06.479954 urib: "broadcast": 1.1.1.255/32 no more next hops  
 2014 Aug 28 10:04:06.480215 urib: 1.1.1.255/32 Deleting & Freeing  
 2014 Aug 28 10:04:06.480542 urib: "broadcast": 1.1.1.0/32 no more next hops  
 2014 Aug 28 10:04:06.480951 urib: 1.1.1.0/32 Deleting & Freeing  
 2014 Aug 28 10:04:06.696703 urib: "am": 1.1.1.2/32 no more next hops  
 2014 Aug 28 10:04:06.697117 urib: 1.1.1.2/32 Deleting & Freeing  

Route deletion = 478419 – 348524 =  129895us

Configuring Arista - VARP aka Virtual ARP

Traditional FHRP (First Hop Redundancy Protocol) such as VRRP or HSRP allows only one gateway to forward at any given point in time. There is an 'Active' forwarder while the other forwarder stays in standby mode monitoring and only to become 'Active' when there is a failure on the 'Active' node. VARP or Virtual ARP (Arista's proprietary) solves this issue elegantly by allowing all configured nodes to be forwarding traffic rather the one of the node sitting idle. In this blogtorial we will configure and verify VARP and since there is not really much to the configuration, this 'how-to' should be a quick one. If you need a primer on FHRP such HSRP/VRRP/GLBP/IRDP please see my other blogtorials here.

Consider this topology with a traditional FHRP deployed such as VRRP.

Configuring Arista MLAG - Basic setup

Layer 2 All links forwarding none blocking ... Take that Spanning Tree!! (-- no offense Radia Perlman :) --) This is what you get with Arista's proprietary MLAG -- short for Multi-Chassis Link Aggregation. Although Spanning-Tree is extremely efficient at preventing loops and keeping your network healthy, it does come with a hefty price tag -- essentially blocking half of your uplinks. In this blogtorial, we will go through brief overview of spanning-tree and then deep dive into MLAG concepts, caveats, and configurations. As of this writing, MLAG is currently supported on Arista's 75xx, 7500E, 7048, 7150, 7050, 7050X, 7250X, and 7300X. If you are familiar with Cisco's proprietary vPC (Virtual Port-Channel) then most of this should be fairly straight forward.

Consider this traditional Layer 2 design where half of your links are blocked to prevent loops in the network.

PHP - Connecting to MYSQL and running queries

TIDBIT blogtorial - Short and informational.

MYSQL connection and handling queries

 // Create connection  
 $con=mysqli_connect("localhost","username","password","dba");  
 // Check connection  
 if (mysqli_connect_errno()) {  
      echo "Failed to connect to MySQL: " . mysqli_connect_error();  
 }  

 //Query String  
 $current_query = "select test from testtable";  
 //Get the results  
  $current_query_result = mysqli_query($con,$current_query);  
 //Loop through the results  
    while ($row = mysqli_fetch_array($current_query_result, MYSQL_NUM)) {  
     echo "Row value is $row[0]\n";  
    }

Many more articles to come so ....

Please subscribe/comment/+1 if you like my posts as it keeps me motivated to write more and spread the knowledge.

Checkpoint Firewall FTP issues - 'quote password' or Account command ('ACCT')

I usually post stuff about Cisco, but recently I got exposure to Checkpoint so I am adding Checkpoint to my library. I am currently working on a 3 part series on "how-to" install virtual Checkpoint Firewalls on a Linux KVM hypervisor. A quick search on Google reveals 0 posts related to this, so mine might be the first "how-to" on this topic. Stay tuned for more Checkpoint related posts in the near future.

Here is my first post on Checkpoint regarding the FTP issue "Wrong username or password". I will try to keep it short!!  

Trying to FTP from command prompt on a windows machine.

 Command line ftp:  
 ftp ###.###.###.###  
 Connected to ###.###.###.### (###.###.###.###).  
 220 Check Point FireWall-1 Secure FTP server running on XXXXXX  
 Name (###.###.###.###:XXXXX): usernamejoe  
 331 password: you can use password@password  
 Password:  
 200 password: you can use 'quote password' or Account command ('ACCT')  
 ftp> pass  
 Passive mode off.  
 ftp> ls  
 421-Access denied - wrong user name or password   
 421 aborted  

Cisco Nexus ERROR MSG - SFP Validation Failed

I came across the other day when I was bringing up a new connection on a Cisco 3548 Nexus.

"SFP validation failed"

This happens when the speed is set on an interface and the SFP does not support it. To fix it get into interface config mode and type.

 switchport host
 shut
 no speed
 no duplex
 no shut

Many more articles to come so ....

Please subscribe/comment/+1 if you like my posts as it keeps me motivated to write more and spread the knowledge.

Cannot SSH into ASA - ssh_exchange_identification: Connection closed by remote host

I usually write quiet a bit but I figured I would keep track of these small error messages also. So here it goes .. last week I ran across an issue on one of the ASAs. Here is the error message.

"ssh_exchange_identification: Connection closed by remote host"

How to fix it?

Telnet or console into the ASA and type this in the global config mode.

ASA(config)#crypto key generate rsa modules 1024

Save the config (wr).

That should resolve your issue.

Many more articles to come so ....

Please subscribe/comment/+1 if you like my posts as it keeps me motivated to write more and spread the knowledge.

100K+ page views :)

Started this blog a few years back ... never thought I would have this many hits .. Thanks

100K+!!!

Cisco Nexus 3548 - Configuring Active Latency Monitoring Hidden Cisco commands

In my previous blogtorial 'Cisco Nexus 3548 - Configuring Active Buffer Monitoring' I demonstrated how we can monitor buffer spaces, however what if I wanted to know the latency profile of the entire switch or per port. Enter the world of Cisco hidden commands and that's where you will find 'Active Latency Monitoring' quietly lurking around. These set of commands will enable switch latency profile measurements and give you the per port latency statistics such as total frame count within a time period, the min/max/avg latency for those frames.

For some reason, Cisco decided to keep it hidden although it may be added to the next release. As of now use this command with caution, since it is hidden it is not supported in the configuration (yet). 

Here is how you configure 'Active Latency Monitoring' on a Cisco Nexus 3548. 

Cisco Nexus 3548 - Configuring Active Buffer Monitoring

It never ceases to amaze me that people value time as money. To me time is more than money. I can make money and I can make more if I worked at it, but time -- that's a different story. I cannot make time, I cannot buy more time, I cannot take it from someone else -- Once it's gone it's gone forever. As I sit here on the train (my daily hour commute) the time it's taking me to write this blogtorial is gone. I can never get it back so hopefully I am doing something worthwhile, something that will help someone, and something that I enjoy. With all that aside let's go into how to configure 'Active Buffer Monitoring' on a Cisco Nexus 3548.

When you are down to nanoseconds on port to port latency, monitoring your buffer space becomes more crucial than ever. Because whenever you buffer your switch is now store and forward for those buffered bytes instead of cut through. If you're switch is store and forward then you are not getting the ~ 230 nanoseconds port-to-port latency that you just spent $20K for.

Before we can dive into configuring buffer monitoring it would be beneficial to understand buffer blocks and how the ports are mapped. First there are 3 buffer blocks each containing 6MB worth of buffer space which gives us a total of 18MB shared buffer. Ports to these buffer blocks (3 x 6MB) are mapped as follows.

VRF Route Leaking from Global Routing Table

This blogtorial is in response to one of my reader's question "How do I use internet with VRF?". In this blogtorial we will see how we can leak routes between a VRF and the global routing table. In my opinion, route leaking between two VRFs is so much easier and straightforward than leaking between VRFs and the global routing table. However, in any case, let's get started and see one of 2 ways (perhaps there are more ways?) to leak routes between a VRF and the global routing table.

Here is the topology -- let's get started.

Entire config can be downloaded here.

BGP - Manipulating BGP communities

I like my desk to be organized..Do you? I suppose we can "desk" that conversation for another time :) Anyways if you are into being organized then BGP communities (32-bit value) are a great way to tag,organize your routes and make intelligent routing decisions. In this blogtorial I will show you briefly on how to set communities, delete communities (specific one or all of them), and appending to the existing communities.

Here is the topology we will be using.

Entire config can be downloaded here.

Configuring ASA NAT - Static 1-1 NAT

This blog will be a continuation of my previous blogtorial about NATs on ASA. One key difference to keep in mind between dynamic and static NAT is that Static NATs allow for the possibility for outside hosts to initiate connection.

Here is our base topology.

Let's get started!!!

Full configuration of the devices can be downloaded here.

Centralized log management - Syslog-ng, Phpsyslog-ng and MySQL back-end

Should I split this blogtorial in different parts and spoon feed it or are my readers man (or woman) enough to just take this blog as a whole and tear it apart? I decided my readers are hungry enough to handle the beast that centralized Syslog management really is. If you follow this blogtorial step by step you will have a fully functioning centralized Syslog management with a database back-end to store the logs, PHP web GUI front-end to view the logs and a solid Syslog server collecting all of the data.

Here is what we will cover in this blogtorial: 

• Installing and configuring MySQL - This will house the database and the necessary tables to organize the logs.  
• Installing httpd/apache and PHP libraries - This will be the webserver to house the Syslog-ng web GUI front-end (phpsyslog-ng)
• Installing phpsyslog-ng - This will be the web based GUI to view the logs.
• Installing syslog-ng - This will be the app collecting the logs and sending it to MySQL. 

Grab some chips, salsa and your favorite beer or a glass of wine because it is going to be a long one but in the end you should have a robust centralized log management system.