2013年10月31日星期四

Cisco 2951 Router Configuration

The Cisco C2921-VSEC Series offer unparalleled total cost of ownership savings and network agility through the intelligent integration of market leading security, unified communications, wireless, and application services. The Integrated Services Routers Generation 2 platforms are future-enabled with multi-core CPUs, support for high capacity DSPs (Digital Signal Processors) for future enhanced video capabilities, high powered service modules with improved availability, Gigabit Ethernet switching with enhanced POE, and new energy monitoring and control capabilities while enhancing overall system performance.

Current configuration : 5030 bytes
! Last configuration change at 00:03:16 UTC Wed Jan 12 2011 by cisco
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname yourname
boot-start-marker
boot-end-marker
! card type command needed for slot/vwic-slot 0/0
logging buffered 51200 warnings
no aaa new-model
no ipv6 cef
ip source-route
yourname#en
yourname#sh run
Building configuration...
Current configuration : 5030 bytes
! Last configuration change at 00:03:16 UTC Wed Jan 12 2011 by cisco
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname yourname
boot-start-marker
boot-end-marker
! card type command needed for slot/vwic-slot 0/0
logging buffered 51200 warnings
no aaa new-model
no ipv6 cef
ip source-route
ip cef
ip domain name yourdomain.com
multilink bundle-name authenticated
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-906767808
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-906767808
revocation-check none
crypto pki certificate chain TP-self-signed-906767808
certificate self-signed 01
quit
voice-card 0
license udi pid CISCO2951/K9 sn FTX1451AM0V
hw-module pvdm 0/0
username cisco privilege 15 secret 5 $1$aUqy$aOjafgL./kGg8ATVSgSqw0
redundancy
interface GigabitEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
ip address 10.10.10.1 255.255.255.248
duplex auto
speed auto
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
access-list 23 permit 10.10.10.0 0.0.0.7
nls resp-timeout 1
cpd cr-id 1
control-plane
gatekeeper
shutdown
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------
Cisco Configuration Professional (Cisco CP) is installed on this device
and it provides the default username "cisco" for one-time use. If you have
already used the username "cisco" to login to the router and your IOS image
supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit
this session.

It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
username <myuser> privilege 15 secret 0 <mypassword>
Replace <myuser> and <mypassword> with the username and password you want to
use.
-----------------------------------------------------------------------
^C
banner login ^C
-----------------------------------------------------------------------
Cisco Configuration Professional (Cisco CP) is installed on this device.
This feature requires the one-time use of the username "cisco" with the
password "cisco". These default credentials have a privilege level of 15.
YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE PUBLICLY-KNOWN
CREDENTIALS
Here are the Cisco IOS commands.
username <myuser> privilege 15 secret 0 <mypassword>
no username cisco
Replace <myuser> and <mypassword> with the username and password you want
to use.
IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL NOT BE ABLE
TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.
For more information about Cisco CP please follow the instructions in the
QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
-----------------------------------------------------------------------
^C
!
line con 0
login local
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
line vty 5 15
access-class 23 in
privilege level 15
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
end
Is my IOS image out of date? This is what I have:
yourname#dir flash0:
Directory of flash0:/
1 -rw- 57011012 Dec 17 2010 20:14:40 +00:00 c2951-universalk9_npe-mz.SPA.151-2.T2.bin
2 -rw- 2903 Dec 17 2010 20:29:30 +00:00 cpconfig-29xx.cfg
3 -rw- 2941440 Dec 17 2010 20:29:46 +00:00 cpexpress.tar
4 -rw- 1038 Dec 17 2010 20:29:56 +00:00 home.shtml
5 -rw- 115712 Dec 17 2010 20:30:02 +00:00 home.tar
6 -rw- 1697952 Dec 17 2010 20:30:18 +00:00 securedesktop-ios-3.1.1.45-k9.pkg
7 -rw- 415956 Dec 17 2010 20:30:30 +00:00 sslclient-win-1.1.4.176.pkg



For more WS-C3750X-24P-L information please click here

2013年10月29日星期二

How to configure Command-Line Access on Cisco 2911 Router?

Cisco 2900 Series Integrated Services Routers (ISR) have modular design that allows for reuse of a broad array of existing modules that meet business requirements while maximizing investment protection. Among all Cisco 2901-SEC, Cisco 2951 router, Cisco 2921 price and Cisco 2911-SEC are best selling models.
      
line [aux | console | tty | vty] line-number
Router(config)# line console 0
Router(config-line)#
Enters line configuration mode, and specifies the type of line.
This example specifies a console terminal for access.
password password
Router(config)# password 5dr4Hepw3
Router(config-line)#
Specifies a unique password for the console terminal line.
Router(config-line)# login
Router(config-line)#
Enables password checking at terminal session login.
Router(config-line)# exec-timeout 5 30
Router(config-line)#
Sets the interval that the EXEC command interpreter waits until user input is detected. The default is 10 minutes. Optionally, add seconds to the interval value.
This example shows a timeout of 5 minutes and 30 seconds. Entering a timeout of 0 0 specifies never to time out.
Router(config-line)# line vty 0 4
Router(config-line)#
Specifies a virtual terminal for remote console access.
Router(config-line)# password aldf2ad1
Router(config-line)#
Specifies a unique password for the virtual terminal line.
Router(config-line)# login
Router(config-line)#
Enables password checking at the virtual terminal session login.
Router(config-line)# end
Router#
Exits line configuration mode, and returns to privileged EXEC mode.


For more Cisco 2921-SEC information please click here

2013年10月28日星期一

How to configure Power Stack Parameters on Catalyst 3560-X Switch?

Cisco delivers a comprehensive portfolio of switching solutions for Borderless Networks, data centers, and smaller businesses. These solutions are optimized for a wide range of industries, including service providers, financial services, and the public sector. The WS-C3560X-48T-L Series Switches is an enterprise-class lines of stackable and standalone switches.

      
Command
Purpose
Step 1

configure terminal

Enter global configuration mode.

Step 2

stack-power stack power stack name

Enter the stack power stack name and enter power stack configuration mode. The name can be up to 31 characters.

Step 3

mode {power-sharing | redundant} [strict]

Set the operating mode for the power stack:

•power-sharing—The input power from all switches in the power stack can be used for loads, and the total available power appears as one huge power supply. This is the default.

•redundant—The largest power supply is removed from the power pool to be used as backup power in case one of the other power supplies fails. This is the recommended mode if enough power is available in the system.

•strict—(Optional) Configures the power stack mode to run a strict power budget. The stack power needs cannot exceed the available power. The default is non-strict.

Step 4

end

Return to privileged EXEC mode.

Step 5

show stack-power

Verify your entries.

Step 6

copy running-config startup-config

(Optional) Save your entries in the configuration file.



For more Cisco WS-C3560X-48T-S information please click here

How to configure LAN Access Layer on Cisco WS-C3750V2-24PS-S switch?

How to configure LAN Access Layer on Cisco WS-C3750V2-24PS-S switch?

Catalyst 3750V2 24 10/100 PoE + 2 SFP Standard Image

The Cisco Catalyst 3750 v2 Series Switches are next-generation energy-efficient Layer 3 Fast Ethernet stackable switches. This new series of switches supports Cisco EnergyWise technology, which enables companies to measure and manage power consumption of network infrastructure and network-attached devices, thereby reducing their energy costs and their carbon footprints. The Cisco Catalyst 3750 v2 Series consumes less power than its predecessors and is the ideal access layer for enterprise, retail, and branch-office environments, as it increases productivity and investment protection by enabling a unified network for data, voice, and video.

service password-encryption
!
hostname A3750X
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$pthq$yU30IFO1CMO61Wy03fCP40
!
username admin password 7 141443180F0B7B7977
!
!
aaa new-model
!
!
aaa authentication login default group radius local
!
!
!
aaa session-id common
clock timezone PST -8
clock summer-time UTC recurring
switch 1 provision ws-c3750x-48p
switch 2 provision ws-c3750x-48p
stack-mac persistent timer 0
system mtu routing 1500
authentication mac-move permit
ip subnet-zero
!
!
ip dhcp snooping vlan 136-137
no ip dhcp snooping information option
ip dhcp snooping
ip domain-name cisco.local
ip arp inspection vlan 136-137
vtp mode transparent
udld aggressive
!
mls qos map policed-dscp 24 26 46 to 0
mls qos map cos-dscp 0 8 16 24 32 46 48 56
mls qos srr-queue input bandwidth 90 10
mls qos srr-queue input threshold 1 8 16
mls qos srr-queue input threshold 2 34 66
mls qos srr-queue input buffers 67 33
mls qos srr-queue input cos-map queue 1 threshold 2 1
mls qos srr-queue input cos-map queue 1 threshold 3 0
mls qos srr-queue input cos-map queue 2 threshold 1 2
mls qos srr-queue input cos-map queue 2 threshold 2 4 6 7
mls qos srr-queue input cos-map queue 2 threshold 3 3 5
mls qos srr-queue input dscp-map queue 1 threshold 2 9 10 11 12 13 14 15
mls qos srr-queue input dscp-map queue 1 threshold 3 0 1 2 3 4 5 6 7
mls qos srr-queue input dscp-map queue 1 threshold 3 32
mls qos srr-queue input dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23
mls qos srr-queue input dscp-map queue 2 threshold 2 33 34 35 36 37 38 39 48
mls qos srr-queue input dscp-map queue 2 threshold 2 49 50 51 52 53 54 55 56
mls qos srr-queue input dscp-map queue 2 threshold 2 57 58 59 60 61 62 63
mls qos srr-queue input dscp-map queue 2 threshold 3 24 25 26 27 28 29 30 31
mls qos srr-queue input dscp-map queue 2 threshold 3 40 41 42 43 44 45 46 47
mls qos srr-queue output cos-map queue 1 threshold 3 5
mls qos srr-queue output cos-map queue 2 threshold 3 3 6 7
mls qos srr-queue output cos-map queue 3 threshold 3 2 4
mls qos srr-queue output cos-map queue 4 threshold 2 1
mls qos srr-queue output cos-map queue 4 threshold 3 0
mls qos srr-queue output dscp-map queue 1 threshold 3 40 41 42 43 44 45 46 47
mls qos srr-queue output dscp-map queue 2 threshold 3 24 25 26 27 28 29 30 31
mls qos srr-queue output dscp-map queue 2 threshold 3 48 49 50 51 52 53 54 55
mls qos srr-queue output dscp-map queue 2 threshold 3 56 57 58 59 60 61 62 63
mls qos srr-queue output dscp-map queue 3 threshold 3 16 17 18 19 20 21 22 23
mls qos srr-queue output dscp-map queue 3 threshold 3 32 33 34 35 36 37 38 39
mls qos srr-queue output dscp-map queue 4 threshold 1 8
mls qos srr-queue output dscp-map queue 4 threshold 2 9 10 11 12 13 14 15
mls qos srr-queue output dscp-map queue 4 threshold 3 0 1 2 3 4 5 6 7
mls qos queue-set output 1 threshold 1 138 138 92 138
mls qos queue-set output 1 threshold 2 138 138 92 400
mls qos queue-set output 1 threshold 3 36 77 100 318
mls qos queue-set output 1 threshold 4 20 50 67 400
mls qos queue-set output 2 threshold 1 149 149 100 149
mls qos queue-set output 2 threshold 2 118 118 100 235
mls qos queue-set output 2 threshold 3 41 68 100 272
mls qos queue-set output 2 threshold 4 42 72 100 242
mls qos queue-set output 1 buffers 10 10 26 54
mls qos queue-set output 2 buffers 16 6 17 61
mls qos
!


For more Cisco information please click here

2013年8月30日星期五

WAN Routing between N5K (L3-vPC) & VSS (MEC) with Link Aggregation

Question:

We want a solution for Cisco 3925 price  routing between N5K and VSS with aggregated WAN links. Here is the scenario.

DC1: It has 2 cisco 6509 with VSS. There are 4 server farm cisco4948 switches connected with VSS with redundant uplink via MEC. Server gateway is the VSS. VSS is running Eigrp routing.

DC2: This is a new datacenter we are going to establish soon. We are planning 2 N5K at core layer with L3 daughter card and 4 N2K as server farm switch. 2 N5K will have vPC peer between them. Each 4 N2K will connect with redundant uplink via vPC with this N5K. N5K will run Eigrp routing and will be the gateway of this new DC server.

WAN between DC1 & DC2: DC1 VSS will connect with DC 2XN5K with 2X10G links. we want to do MEC at VSS side and L3 vPC at DC2 side.

If we have VSS at both end it might not be a problem. Both the link will work together as 20G aggregated link. But as we are using N5K at one end, so it creates a confusion whether it will work properly is this scenerio or not. This is my 1st question.

Also I would like to know,
1) In VSS I have configured 1 VLAN interface for server gateway. But in N5K do I have to configure at 2 switch seperately?
2) In WAN routing VSS shows as 1 device. Does this 2 N5K will show as 2 seperate hops or L3 vPC will allow them to act as a single device while traceroute from one end to another end.

I am not sure if my questiones are so elementary level or not. As I am very new to this technology I would like you all to get me some suggestions or documention or links regarding this design. I am also attaching the diagram.

Answer:

You solution in step 1-3 are fine. I will use the same solution based on the following:
1. VSS is a logical switch, in the N5K's perspective, it is 1 switch. You are acutally ECMP upstream, which is good. Just let routing protocol to take care the job.
2. The cross /30 link between N5K-1 and N5K-2 is used only if one uplink failed. Please note that the L3 /30 cross link is not part of vPC peer-link. It is a dedicated interface. Please see the below diagram.
In term of HSRP, you have to understand one thing first. In vPC, HSRP behavior has modified, both switch will forward traffic (different from C6K where only one is active). Please see the below link on how HSRP works under vPC (somehow this link is broken right now, let me see if I can get someone to fix it):

http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9402/white_paper_c11-516396.html

To answer your question:
1. When N5K-1 goes down, N5K-2 will forward traffic out, and vise versa.
2. When vPC peer-link goes down. vPC secondary will shut down all vPC related interfaces and SVI. If SVI is down,Cisco 3945 routing protocol will stop the advertisement. Original comes from

http://www.kerchoonz.com/account/submit/add-blog/added_309996/

2013年8月29日星期四

IOS upload

Question:

We have a router WS-C3560X-48PF-S Price in which we dont have much memeory to keep the existing IOS and

upload the new IOS.
i have to delet the old ios and upload the new.
my question? how much time it will take to upload the new ios using the console

connection.
please help, any suggestion would be highly appreciated. Thanks in advance.          

     

Answer:

No the telnet session would not disconnect just because you deleted the old IOS.

Perhaps it would help to be clear that flash is where the code is stored that is

loaded and executed at boot time. After the code is loaded then the router will

continue to run the code no matter what happens in flash. so you can easily delete

the image in flash and load another image and that will not impact the running of the

router.

However you should be aware that there is some risk in doing this. If there is any

problem in loading the code over the network there could be a problem. And if the

router should reload (power cycle or whatever) before the new code is loaded then the

router would not be able to load code and run - and recovery over the network is more

challenging. So you should be aware of these risks as you make the decision to erase

the image from flash and then to load a new image over the network.

I do not want to be alarmist or to give too negative an impression. I frequently do

erase images and load code over the network. And you can do this also. But I just

want to be sure that you understand the possible problems as you make your decision. WS-C3560X-48PF-L 

Original comes from http://lilirouter.livejournal.com/

2013年8月28日星期三

Show Policy-Map Interface X/X output question

Question:

I am troubleshooting a Cisco 2951-SEC situation with a customer where they are getting voice quality issues over their WAN.  When I look at the policy-map applied to the WAN facing interface I see the following output:

    Class-map: REALTIME (match-any)
      5934775 packets, 547271148 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: ip dscp ef (46)
        1811301 packets, 128310242 bytes
        5 minute rate 0 bps
      Match: ip dscp af41 (34)
        167441 packets, 28756344 bytes
        5 minute rate 0 bps
      Match: access-group name AVAYAVOIP
        3956033 packets, 390204562 bytes
        5 minute rate 0 bps
      Queueing
        Strict Priority
        Output Queue: Conversation 264
        Bandwidth 30 (%)
        Bandwidth 926 (kbps) Burst 23150 (Bytes)
        (pkts matched/bytes matched) 912864/77181333
        (total drops/bytes drops) 856/1206256
    Class-map: CRITICAL (match-any)
      3837968 packets, 225767347 bytes
      5 minute offered rate 1000 bps, drop rate 0 bps
      Match: ip dscp af31 (26)
        0 packets, 0 bytes
        5 minute rate 0 bps
      Match: ip dscp cs6 (48)
        3837968 packets, 225767347 bytes
        5 minute rate 1000 bps
      Queueing
        Output Queue: Conversation 265
        Bandwidth 20 (%)
        Bandwidth 617 (kbps)
        (pkts matched/bytes matched) 3105906/180974193
        (depth/total drops/no-buffer drops) 0/0/0
         exponential weight: 9
         mean queue depth: 0
   dscp    Transmitted      Random drop      Tail drop    Minimum Maximum  Mark
           pkts/bytes       pkts/bytes       pkts/bytes    thresh  thresh  prob
   af11       0/0               0/0              0/0           32      40  1/10
   af12       0/0               0/0              0/0           28      40  1/10
   af13       0/0               0/0              0/0           24      40  1/10
   af21       0/0               0/0              0/0           32      40  1/10
   af22       0/0               0/0              0/0           28      40  1/10
   af23       0/0               0/0              0/0           24      40  1/10
   af31       0/0               0/0              0/0           32      40  1/10
   af32       0/0               0/0              0/0           28      40  1/10
   af33       0/0               0/0              0/0           24      40  1/10
   af41       0/0               0/0              0/0           32      40  1/10
   af42       0/0               0/0              0/0           28      40  1/10
   af43       0/0               0/0              0/0           24      40  1/10
    cs1       0/0               0/0              0/0           22      40  1/10
    cs2       0/0               0/0              0/0           24      40  1/10
    cs3       0/0               0/0              0/0           26      40  1/10
    cs4       0/0               0/0              0/0           28      40  1/10
    cs5       0/0               0/0              0/0           30      40  1/10
    cs6 3837968/225767347       0/0              0/0           32      40  1/10
    cs7       0/0               0/0              0/0           34      40  1/10
     ef       0/0               0/0              0/0           36      40  1/10
   rsvp       0/0               0/0              0/0           36      40  1/10
default       0/0               0/0              0/0           20      40  1/10

It looks like the policy-map is matching on the EF needed for real-time traffic but what I do not know is why down toward the bottom of the output ,where everything is broken down by DSCP value , I am not seeing transmitted packets under ef  but rather all going cs6. #I am unsure about this command and thought I would post here.  I am assuming that it has something to do with the strict priority queue just sending all traffic immediately but it seems as though you could confirm that all traffic with an EF tag is actually being sent first.    ,

Answer:

The service-policy counts packets that matches the different classes, but it doesn't kick in until there is conquestions on the outgoing interface.

For a service-policy to kick in, there must be conquestions on the output interface. That means that if there are enough room in the tx-buffers (hardware buffers), a packet will be put to the tx-queue imediatly. However if the tx-buffers fill up, the router starts to use software-buffers, and at this point the service-policy is kicked-in.

Breaking Your output down in small peaces.
Class-map REALTIME matches on EF (1811301 packets) it also matches on af41 (167441 packets) and access-group AVAYAVOIP (3956033 packets) that makes a total of 5934775 for the hole class-map REALTIME.
Most of the time there has been no conquestion, but at some point (it can be more than one) there has been conquestions and the policy-map kicks in. At this point there has been 912864 packets that have been put in the priorityqueue to be served first, but 856 of them have been dropped because the total bandwidth for the priorityqueue has been higher than 926kb at some point

For class-map CRITICAL wich matches dscp af31 (0 packets) and dscp cs6 (3837968 packets) 3105906 of them have been put in the softwarequeue under the time when there was conquestion, and none of them have been dropped.

All the dscp values at the bottom is just related to the class-map critical and has nothing to do with the class-map REALTIME

For Your last sentense, yes, the priority queue will be served first if there is conquestions, but it will at that moment also be policed to the configured rate (30%) in your case.

If there are no conquetions the priority traffic can be higher than 30%. Because the policy-map only kicks in if interface Cisco 2901-V is conquested.

For more info,

http://www.journalspace.com/index.php?do=/profile-1592/