Ask the Expert: ASR9000 Hardware Architecture

With Satya Narra and Xander Thuijs 
Welcome to the Cisco Support Community. This is an opportunity to learn and ask questions about software installation, SMU installation, ASR9000 architecture, installing satellite (ASR9000 nv), and troubleshooting of the Cisco ASR 9000 Series Aggregation Services Routers with experts Satya Narra and Xander Thuijs.
The Cisco ASR 9000 Series Aggregation Services Routers product family offers a significant added value compared to the prior generations of carrier Ethernet routing offerings. The Cisco ASR 9000 Series is an operationally simple, future-optimized platform using next-generation hardware and software. 
Satya Narra is a network consulting engineer and specialist in ASR9000 deployments for service provider networks. He is an expert in many technology areas, including IP routing, MPLS, BGP, OSPF, multicast, system architecture, and network design. Satya has a master of science degree in electrical engineering from Wichita State University, Wichita, KS. He started his career as a customer support engineer in TAC/HTTS supporting some of the biggest networks, including Comcast, Citi, Amazon, JPMorgan, AT&T, Vodofone, and others.   
Xander Thuijs is a principal engineer for the Cisco ASR 9000 Series and Cisco IOS-XR product family at Cisco. He is an expert and advisor in many technology areas, including IP routing, WAN, WAN switching, MPLS, multicast, BNG, ISDN, VoIP, Carrier Ethernet, System Architecture, network design and many others. He has more than 20 years of industry experience in carrier Ethernet, carrier routing, and network access technologies. Xander  holds a dual CCIE certification (number 6775) in service provider and voice technologies. He has a master of science degree in electrical engineering from Hogeschool van University in Amsterdam.
Remember to use the rating system to let Satya and Xander know if you have received an adequate response.
Satya might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation in Service Providers community,  sub-community, XR OS and Platforms discussion forum shortly after the event. This event lasts through February 14, 2014. Visit this forum often to view responses to your questions and the questions of other community members.

Hi Lisa,
The mLACP switchover method can be modified using the following CLI:
RP/0/0/CPU0:IOSXR(config)#interface bundle-ether 1 mlacp switchover type ?
  brute-force    Force switchover by disabling all local member links
  revertive      Revert based on configured priority values
RP/0/0/CPU0:ios(config)#interface bundle-ether 1 mlacp switchover type
These options(and the default, when this configuration is not present) are mutually exclusive, and the configuration must match on the bundle on both POA's. They determine the dynamic priority manamgement or brute force mechanism is used, and whether the behaviour is revertive or non-revertive.
Dynamic Priority Management
Switchover is acheved gracefully by modifying the LACP port priorites.
Brute force
This does not involve any priority changes. When using brute force, the operational priority always matches the configured priority. A Switchover is performed when the bundle goes down on the active POA. A switchover is also performed, If active-minimum-links is not satisfied, it brings down other active links on this bundle to force a switchover completely to other PoA.
Revertive
You can configure the MC-LAG in Revertive switchover mode. It means, whenever higher priority links are available, it forces an automatic switchover to that PoA.
Non-revertive
By default switchover is non-revertive. It means,  bundle does not fail back to the original active PoA except when a subsequent failure is encountered. In this mode, POA's do not consider to be primary and secondary, only active or standby. The configured priorities are only used to determine which POA is initally active.
Regards,
--SN

Similar Messages

  • Ask the Experts: Understanding Cisco ASR 9000 Series Aggregation Services Routers Platform Architecture and Packet Forwarding Troubleshooting

    With Xander Thuijs
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn how to Cisco ASR 9000 Series Aggregation Services Routers with Cisco expert Xander Thuijs. The Cisco ASR 9000 Series Aggregation Services Routers product family offers a significant added value compared to the prior generations of carrier Ethernet routing offerings. The Cisco ASR 9000 Series is an operationally simple, future-optimized platform using next-generation hardware and software. The ASR 9000 platform family is composed of the Cisco ASR 9010 Router, the Cisco ASR 9006 Router, the Cisco ASR 9922 Router, Cisco ASR 9001 Router and the Cisco ASR 9000v Router.
    This is a continuation of the live Webcast.
    Xander Thuijs is a principal engineer for the Cisco ASR 9000 Series and Cisco IOS-XR product family at Cisco. He is an expert and advisor in many technology areas, including IP routing, WAN, WAN switching, MPLS, multicast, BNG, ISDN, VoIP, Carrier Ethernet, System Architecture, network design and many others. He has more than 20 years of industry experience in carrier Ethernet, carrier routing, and network access technologies. Xander  holds a dual CCIE certification (number 6775) in service provider and voice technologies. He has a master of science degree in electrical engineering from Hogeschool van University in Amsterdam.
    Remember to use the rating system to let Xander know if you have received an adequate response.
    Xander might not be able to answer each question because of the volume expected during this event. Remember that you can continue the conversation on the Service Providers community XR OS And Platforms  shortly after the event. This event lasts through Friday, May 24, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.
    Webcast  related links:
    Slides
    Webcast  Video Recording
    FAQ

    Is there a Cisco lab available for ASR 9000
    we have "XR4U" stations coming available soon when XR 511 comes alive. The plan is for a downloadable play image like that. In the interim we have 2 demo systems available, and they can be booked via your account manager representative.
    How will MOD160 perform with multiple 9000NVS?
    very well. the mod 160 has 4 NPU's, 2 per bay. So if you have a 4x10 MPA to serve a satellite, you effectively have a single NPU per 20 1Gigs from the satellite. The pps performance will be stellar. However it might be price technically more ideal to connect satellite with a 36x10. Since the MOD-x has native MPA's with 1G also.
         2. Is there a shortcut for a Bundle-EthernetX interface, such as port-channel interface (poX), in Cisco IOS® ?.
    usability enhancement is there, we are trying to push this into a new reasonable release. follow CSCuh04526
         3. What  is the revolutions per minute (RPM) on these hard disk drives (HDDs)  compared to the solid state drives (SDDs)? Will the spinning drives be  slow?
    depends on the type we had avaialble at time of production, you will see different sizes and disks on the RSP2. the rpm of the HD is not so much an issue as much as the buffered writing we used to do in XR. This is fixed up with XR43 where the disk writing performance is much better. the HD/SDD is used for logging storage only (and maybe your pictures) but other then that we're not that concerned with write perf of the HD.
    regards
    xander

  • Ask the Experts: IOS-XR Fundamentals and Architecture

    Welcome to the Cisco Support Community Ask the Expert conversation. 
    Learn and ask questions about IOS-XR Fundamentals and Architecture.
    November 18, 2014 through November 28, 2014.
    Cisco IOS XR Software is a modular and fully distributed network operating system for service provider networks. Cisco IOS XR creates a highly available, highly secure routing platform.
    It distributes processes across the control, data, and management planes with their own access controls and delivers routing-system scalability, service isolation, and manageability.
    This is a Q&A extension of the Live expert Webcast.
    Cisco subject matter experts Sudeep, Raj, and Sudhir, will focus on IOS-XR fundamentals.
    Including:-
    High-Level Overview of Cisco IOS XR
    Cisco IOS XR Infrastructure
    Configuration Management
    Cisco IOS XR Monitoring and Operations
    Cisco IOS XR Security
    Introduction to different IOS-XR platforms
    Sudeep Valengattil is a customer support engineer in High-Touch Technical Services at Cisco specializing in service provider technologies and platforms. Sudeep has got experience on XR platform like ASR9000, CRS, NCS and GSR. Sudeep has more than 9 years of experience in the IT industry and holds CCIE certification (36098) in Service provider.
    Sudhir Kumar is a customer support engineer in High-Touch Technical Services at Cisco specializing in service provider technologies and platforms. His areas of expertise include Cisco CRS, ASR 9K and Cisco XR 12000 Series Routers. Sudhir has more than 10 years of experience in the IT industry and holds CCIE certification (35219) in Service provider and Routing and switching.
    Raj Pathak is a customer support engineer in High-Touch Technical Services at Cisco specializing in service provider technologies and platforms. He serves as a support engineer for technical issues supporting Cisco IOS XR Software customers on Cisco CRS and Cisco XR 12000 Series Routers. Raj has more than 8 years of experience in the IT industry and holds CCIE certification (38760) in routing and switching.
    For more information about this topic, visit the Expert Corner > Knowledge Sharing
    Remember to use the rating system to let the experts know if you have received an adequate response.

    Hi Charles,
    To answer your question,
    LPTS would be acting only on packet/traffic which is ingressing the router and destined for the router itself (for-us packets).  It provides an internal forwarding table to route control/management protocol packets destined to local router to the right application for further processing.  Once we have a packet entering the interface, the network processor would be performing a lookup to determine, if this packet is destined for us.  Based on which, it will forward to LPTS.  For eg, the ICMP packets coming in on an interface with destination IP of router itself, would be processed by LPTS.  It also provides policing function for this traffic transparently.
    Key facts about LPTS
    1. LPTS is an always on feature.  No user configuration needed to enable it.
    2. LPTS is only applicable for traffic entring to the router and destined to the local router. Applies for control-plane and management plane traffic.
    3. Packets originated by router and transit traffic is not processed by LPTS
    4. LPTS polices the incoming traffic based on the pre-defined policer rates.
    Here is an o/p snip to view the LPTS entries.
    RP/0/RP0/CPU0:CRS-C#sh lpts pifib hard police loc 0/0/cpu0
    Tue Nov 25 23:32:10.666 EDT
    Node 0/0/CPU0:
    Burst = 100ms for all flow types
    FlowType Policer Type Cur. Rate Def. Rate Accepted Dropped
    unconfigured-default 100 Static 500 500 0 0
    L2TPv2-fragment 185 Static 700 700 0 0
    Fragment 106 Static 1000 1000 0 0
    OSPF-mc-known 107 Static 20000 20000 44818 0
    OSPF-mc-default 111 Static 5000 5000 11366 0
    Do let us know if you have any further queries.
    Regards,
    Sudeep Valengattil

  • Ask the Expert: Plan, Design, and Implement Mobile Remote Access, the Cisco Collaboration Edge Architecture

    Welcome to the Cisco® Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about planning, designing, and implementing mobile remote access (Cisco Collaboration Edge Architecture) with Cisco subject matter experts Aashish Jolly and Abhijit Anand.
    Cisco Collaboration Edge Architecture is an architecture that provides VPN-less access of Cisco Unified Communications resources to Cisco Jabber® users. This discussion is dedicated to addressing questions about design best practices while implementing mobile remote access.
    For more information, refer to the Unified Communications Mobile and Remote Access via Cisco VCS deployment guide. 
    Aashish Jolly is a network consulting engineer who is currently serving as the Cisco Unified Communications consultant for the ExxonMobil Global account. Earlier at Cisco, he was part of the Cisco Technical Assistance Center (TAC), where he helped Cisco partners with installation, configuring, and troubleshooting Cisco Unified Communications products such as Cisco Unified Communications Manager and Manager Express, Cisco Unity® solutions, Cisco Unified Border Element, voice gateways and gatekeepers, and more. He has been associated with Cisco Unified Communications for more than seven years. He holds a bachelor of technology degree as well as Cisco CCIE® Voice (#18500), CCNP® Voice, and CCNA® certifications and VMware VCP5 and Red Hat RHCE certifications.
    Abhijit Singh Anand is a network consulting engineer with the Cisco Advanced Services field delivery team in New Delhi. His current role involves designing, implementing, and optimizing large-scale collaboration solutions for enterprise and defense customers. He has also been an engineer at the Cisco TAC. Having worked on multiple technologies including wireless and LAN switching, he has been associated with Cisco Unified Communications technologies since 2006. He holds a master’s degree in computer applications and multiple certifications, including CCIE Voice (#19590), RHCE, and CWSP and CWNP.
    Remember to use the rating system to let Aashish and Abhijit know if you have received an adequate response. 
    Because of the volume expected during this event, our experts might not be able to answer every question. Remember that you can continue the conversation on the Cisco Support Community Collaboration, Voice and Video page, in the Jabber Clients subcommunity, shortly after the event. This event lasts through June 20, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

    Hi Marcelo,
       Yes, there are some requirements for certificates in Expressway.
    Expressway Core (Exp-C)
    - Can be signed by either External or Internal CA
    - Better to use a cluster name even if you start with 1 peer in Exp-C cluster. In the future, if more peers are added, changes would be minimal.
    - Better to use FQDN of cluster as CN of certificate, this way the traversal zone configuration on Expressway-E won't require any change even if new peers are added to Exp-C cluster.
    - If CUCM is mixed mode, include security profile names (in FQDN format) as Subject Alternate Names
    - The Chat Node Aliases that are configured on the IM and Presence servers. They will be required only for Unified Communications XMPP federation deployments that intend to use both TLS and group chat. (Note that Unified Communications XMPP federation will be supported in a future Expressway release). The Expressway-C automatically includes the chat node aliases in the CSR, providing it has discovered a set of IM&P servers.
    - For TLS b/w CUCM, IM-P & Exp-C
      + If using self-signed certificates on CUCM, IM/P. Load Cisco Tomcat, cup, cup-xmpp certificates from IM-P on Exp-C. Load callmanager, Cisco Tomcat certificates from CUCM on Exp-C.
      + If using Internal CA signed certificates on CUCM, IM/P. Load Root CA certificates on Exp-C.
      + Load CA certificate under tomcat-trust, cup-trust, cup-xmpp-trust on IM-P.
      + Load CA certificate under tomcat-trust, callmanager-trust on CUCM.
    Expressway Edge (Exp-E)
    - Signed by External CA
    - Configured Unified Communications domain as Subject Alternate Name
    - If using a cluster, select FQDN of this peer as CN and FQDN of Cluster + this peer as Subject Alternate Name.
    - If XMPP federation is being deployed, enter the same Chat Node Aliases as entered in Exp-C.
    For more details, please refer to the Certificate Creation Guide for Cisco Expressway x8.1.1
    http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-1/Cisco-Expressway-Certificate-Creation-and-Use-Deployment-Guide-X8-1.pdf
    - Aashish

  • Ask the Expert: NGWC (3850/5760): Architecture and Deployment

    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about NGWC (3850/5760): Architecture and Deployment.
    Ask questions from Monday, April 13th, 2015 to Friday, April 24th, 2015
    This Ask the Expert Session will cover questions spanning NGWC products (3850/5760) on Implementation and Deployment from the Wired and Wireless perspective. This will be more specific to Customer’s and Partners questions covering 3850/5760 configuration, Implementation and deployment.
    Dhiresh Yadav is a customer support engineer in High-Touch Technical Services (HTTS)  handling supporting Wireless and Network Management based Cisco products and is based in Bangalore. His areas of expertise include Cisco Wireless CUWN and NGWC Product line. He has over 7 years of industry experience working with large enterprise and service provider networks. He also holds CCNP (RS) and CCIE (DC-Written) and CCIE Wireless certification.
    Naveen Venkateshaiah is working as a Customer support engineer in High-Touch Technical Services (HTTS) handling  and supporting Lan-switching and Data center Products. His areas of expertise include Catalyst 3k,4k , 6500 , Nexus 7k Platform  He has over 7 years of industry experience working with large Enterprise and Service Provider networks. He also holds CCNA, CCNP (RS) and  CCDP-ARCH,CCIE-R&S Written, AWLANFE, LCSAWLAN Certification.
    Find other  https://supportforums.cisco.com/expert-corner/events.
    **Ratings Encourage Participation! **
    Please be sure to rate the Answers to Questions

    Hi Dhiyadav,
    thank you for your reply it cleared some doubts that were in my mind but i need your more support to guide me a converged access deployment which i am going to deploy within few days.
    i have 
    2x5508 in HA as MC
    30x3850 switches, and all will be used as MA(s) with multiple SPGs
    2X5508  1:1 as an anchor controller
    1xISE 1.3 for guest access
    1xCPI for wireless mgmt and monitoring purpose
    1xMSE3355 with wips and context aware licenses
    200x cisco 3702i WAP
    50x WSSI module for monitoring the channels
    can you please put a light on the design and guide me that which are the best possible solutions to get this job done very smoothly.
    i will also let you know about my proposed design scenario but for sure i need your recommendations as well :)
    so,
    i will use 2x5508 wlcs in HA as a MC which are AP-Count and HA licensed..
    3850 switches will be MA and i ll configure SPGs per floor switches stacks 
    WAPs will join on these 3850 MAs base on each floor
    i would have 2 ssid like employee and guest
    i will configure them on each 3850 stack MA along with their SVIs for users access like (empolyee and guest ssid)
    here my question is for guest ssid and its vlan... do i configure it here or on anchor controller???
    i want ISE to be integrated with wireless for employee 802.1x and for guest web Auth. so, how i will integrate ISE with wireless. i mean weather i will integrate it anchor controller or with each 3850 MA???
    between foreign and anchor controller i will use new mobility instead of old EOIP!!!
    where shall place ISE in my network, in DMZ or with Core switch?
    my target for guest users to do not have access to any corporate network sources ?
    MSE:
    can i use both wips and context aware on the single MSE box?
    if yes, than what is the best practice for configuring them?
    are each 3850 MA will be added in MSE?
    WSSI module . will be used for monitoring purpose for wips and context aware profiles.
    all access point will be worked in local mode for serving users access.
    thank you

  • Ask the Experts Session on Mobile Service Architecture (MSA), August 20-24

    Got a question about MSA, JSR 248, a Java ME optional package that defines the next generation Java ME platform? Post it during the week of August 20 on the Ask the Experts page (http://java.sun.com/developer/community/askxprt/) and get answers from Mickhail Gorshenev, Sun's lead for the JSR 248 Technology Conformance Kit (TCK), E-Ming Saung, Product Line Manager in the Java ME Marketing group, and Hinkmond Wong, one of the current project owners of the phoneME open source project and past specification lead for various mobility-related technologies such as the Java ME Connected Device Configuration (CDC) and Foundation Profile.

    i am working in struts with netbeans....can you please guide me in suggesting how to retrieve database in one table when it is already stored in another table in the same database?

  • Ask the Expert: Scaling Data Center Networks with Cisco FabricPath

    With Hatim Badr and Iqbal Syed
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about the Cisco FabricPath with Cisco technical support experts Hatim Badr and Iqbal Syed. Cisco FabricPath is a Cisco NX-OS Software innovation combining the plug-and-play simplicity of Ethernet with the reliability and scalability of Layer 3 routing. Cisco FabricPath uses many of the best characteristics of traditional Layer 2 and Layer 3 technologies, combining them into a new control-plane and data-plane implementation that combines the immediately operational "plug-and-play" deployment model of a bridged spanning-tree environment with the stability, re-convergence characteristics, and ability to use multiple parallel paths typical of a Layer 3 routed environment. The result is a scalable, flexible, and highly available Ethernet fabric suitable for even the most demanding data center environments. Using FabricPath, you can build highly scalable Layer 2 multipath networks without the Spanning Tree Protocol. Such networks are particularly suitable for large virtualization deployments, private clouds, and high-performance computing (HPC) environments.
    This event will focus on technical support questions related to the benefits of Cisco FabricPath over STP or VPC based architectures, design options with FabricPath, migration to FabricPath from STP/VPC based networks and FabricPath design and implementation best practices.
    Hatim Badr is a Solutions Architect for Cisco Advanced Services in Toronto, where he supports Cisco customers across Canada as a specialist in Data Center architecture, design, and optimization projects. He has more than 12 years of experience in the networking industry. He holds CCIE (#14847) in Routing & Switching, CCDP and Cisco Data Center certifications.
    Iqbal Syed is a Technical Marketing Engineer for the Cisco Nexus 7000 Series of switches. He is responsible for product road-mapping and marketing the Nexus 7000 line of products with a focus on L2 technologies such as VPC & Cisco FabricPath and also helps customers with DC design and training. He also focuses on SP customers worldwide and helps promote N7K business within different SP segments. Syed has been with Cisco for more than 10 years, which includes experience in Cisco Advanced Services and the Cisco Technical Assistance Center. His experience ranges from reactive technical support to proactive engineering, design, and optimization. He holds CCIE (#24192) in Routing & Switching, CCDP, Cisco Data Center, and TOGAF (v9) certifications.
    Remember to use the rating system to let Hatim and Iqbal know if you have received an adequate response.  
    They might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Data Center sub-community Unified Computing discussion forum shortly after the event. This event lasts through Dec 7, 2012.. Visit this support forum often to view responses to your questions and the questions of other Cisco Support Community members.

    Hi Sarah,
    Thank you for your question.
    Spanning Tree Protocol is used to build a loop-free topology. Although Spanning Tree Protocol serves a critical function in these Layer 2 networks, it is also frequently the cause of a variety of problems, both operational and architectural.
    One important aspect of Spanning Tree Protocol behavior is its inability to use parallel forwarding paths. Spanning Tree Protocol forms a forwarding tree, rooted at a single device, along which all data-plane traffic must flow. The addition of parallel paths serves as a redundancy mechanism, but adding more than one such path has little benefit because Spanning Tree Protocol blocks any additional paths
    In addition, rooting the forwarding path at a single device results in suboptimal forwarding paths, as shown below, Although a direct connection may exist, it cannot be used because only one active forwarding path is allowed.
    Virtual PortChannel (vPC) technology partially mitigates the limitations of Spanning Tree Protocol. vPC allows a single Ethernet device to connect simultaneously to two discrete Cisco Nexus switches while treating these parallel connections as a single logical PortChannel interface. The result is active-active forwarding paths and the removal of Spanning Tree Protocol blocked links, delivering an effective way to use two parallel paths in the typical Layer 2 topologies used with Spanning Tree Protocol.
    vPC provides several benefits over a standard Spanning Tree Protocol such as elimination of blocker ports and both vPC switches can behave as active default gateway for first-hop redundancy protocols such as Hot Standby Router Protocol (HSRP): that is, traffic can be routed by either vPC peer switch.
    At the same time, however, many of the overall design constraints of a Spanning Tree Protocol network remain even when you deploy vPC such as
    1.     Although vPC provides active-active forwarding, only two active parallel paths are possible.
    2.     vPC offers no means by which VLANs can be extended, a critical limitation of traditional Spanning Tree Protocol designs.
    With Cisco FabricPath, you can create a flexible Ethernet fabric that eliminates many of the constraints of Spanning Tree Protocol. At the control plane, Cisco FabricPath uses a Shortest-Path First (SPF) routing protocol to determine reachability and selects the best path or paths to any given destination in the Cisco FabricPath domain. In addition, the Cisco FabricPath data plane introduces capabilities that help ensure that the network remains stable, and it provides scalable, hardware-based learning and forwarding capabilities not bound by software or CPU capacity.
    Benefits of deploying an Ethernet fabric based on Cisco FabricPath include:
    • Simplicity, reducing operating expenses
    – Cisco FabricPath is extremely simple to configure. In fact, the only necessary configuration consists of distinguishing the core ports, which link the switches, from the edge ports, where end devices are attached. There is no need to tune any parameter to get an optimal configuration, and switch addresses are assigned automatically.
    – A single control protocol is used for unicast forwarding, multicast forwarding, and VLAN pruning. The Cisco FabricPath solution requires less combined configuration than an equivalent Spanning Tree Protocol-based network, further reducing the overall management cost.
    – A device that does not support Cisco FabricPath can be attached redundantly to two separate Cisco FabricPath bridges with enhanced virtual PortChannel (vPC+) technology, providing an easy migration path. Just like vPC, vPC+ relies on PortChannel technology to provide multipathing and redundancy without resorting to Spanning Tree Protocol.
    Scalability based on proven technology
    – Cisco FabricPath uses a control protocol built on top of the powerful Intermediate System-to-Intermediate System (IS-IS) routing protocol, an industry standard that provides fast convergence and that has been proven to scale up to the largest service provider environments. Nevertheless, no specific knowledge of IS-IS is required in order to operate a Cisco FabricPath network.
    – Loop prevention and mitigation is available in the data plane, helping ensure safe forwarding that cannot be matched by any transparent bridging technology. The Cisco FabricPath frames include a time-to-live (TTL) field similar to the one used in IP, and a Reverse Path Forwarding (RPF) check is also applied.
    • Efficiency and high performance
    – Because equal-cost multipath (ECMP) can be used the data plane, the network can use all the links available between any two devices. The first-generation hardware supporting Cisco FabricPath can perform 16-way ECMP, which, when combined with 16-port 10-Gbps port channels, represents a potential bandwidth of 2.56 terabits per second (Tbps) between switches.
    – Frames are forwarded along the shortest path to their destination, reducing the latency of the exchanges between end stations compared to a spanning tree-based solution.
        – MAC addresses are learned selectively at the edge, allowing to scale the network beyond the limits of the MAC addr

  • Ask the Expert: Cisco Unified Contact Center Express (UCCX) Version 10.0 - Upgrade, Migration, and New Features Overview

                With Abhiram Kramadhati 
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about the upgrade, migration methods, and new features of the latest released Version 10.0 of Cisco Unified Contact Center Express (UCCX) with Cisco expert Abhiram Kramadhati.
    Abhiram will address the following on the latest release of Cisco UCCX Version 10.0:
    Installation
    Upgrade from previous versions - both Linux and Windows   
    Migration from MCS to Cisco UCS environment - Different methods and best practices
    New features - Overview and limitations
    This discussion will center on install and upgrade best practices, changes in hardware support, and migration methods from MCS to Cisco UCS. He can also briefly discuss the new features introduced in 10.0. The discussion focuses the latest versions, but queries about general Cisco UCCX topics can be addressed too if time allows.
    Abhiram Kramadhati is an engineer with the Contact Center Backbone group. He has been working with Cisco UCCX since he joined Cisco. During two years at Cisco, he has built his expertise around Cisco UCCX telephony applications, Java Telephony API (JTAPI) integration, Cisco UCCX system behavior, LDAP components, and Cisco UCCX as IP interactive voice response in Unified Contact Center Enterprise (UCCE) environments. He also works on other technologies, including Unified Communications Manager and UCCE. He has been involved in many technical escalations in the Asia Pacific region. Abhiram also holds a CCIE in voice (40065).
    For more details about this topic, refer to the recently published Tech-Talk Video and Blog.
    Remember to use the rating system to let Abhiram know if you have received an adequate response. 
    Abhiram might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation in the Voice, Video, and Collaboration  community,  sub-community, Contact Center discussion forum shortly after the event. This event lasts through January 31, 2014. Visit this forum often to view responses to your questions and the questions of other community members.

    Hi Anurag,
    Thanks for your questions.
    1:Is there change in DB architecture as CUIC is the only option as compared to previous linux version UCCX ?
    I assume this is from the tables regarding historical data. The database schema essentially remains the same since UCCX 9.0 had CUIC too and we had a seperate DB Space for CUIC and we still continue with that. The traditional historical tables remain and the replication process remains the same too.
    2:Is there any version change for Linux OS used as VOS,
    The Linux version is Red Hat Linux 5. To be precise:
    [root@uccx10pub /]# cat etc/redhat-release
    Red Hat Enterprise Linux Server release 5.7 (Tikanga)
    3:Is there any API architecture change in UCCX 10 from previous releases ?
    I can answer this more of an overview. The only enhancement in the API side is the introduction of REST API step in the script editor. You can now make REST calls from the script and this ofcourse opens up a whole new world of possiblities.
    4:Since from UCCX 10 , we can only use either CAD or Finnesse at one  time, whats the impact of changing this after some time in production,  let say , i used CAD for 2 months and then i decided to move to Finesse,  whats the impact ? or is it a smooth change as switching CUIC and HRC  in previoius release ?
    For the scenario you mentioned, there is absolutely no problem. The point to note is that the Finesse services are activated/deactivated but the CAD desktop services are ALWAYS running. The only condition to keep in mind is that you can use ONLY ONE type of agent desktop at any time.  Also if Finesse is not used and CAD operations are used extensively, it is advisable to shutdown the Finesse service.
    5:Is 3rd Party UCS hardware supported by UCCX 10 instead of using Cisco manufactured UCS , can i use HP hardware for Virtualisation ?
    Yes, it can be used. This is something called as "Third party specs based specification". The most important things seen for compatibility are:
    Inter CPU Model
    It it is on thVMWare Hardware Compatibilty List
    You can get more information about this on the "Can I use this server?" section of UC Virtualized Hardware page:
    http://docwiki.cisco.com/wiki/UC_Virtualization_Supported_Hardware#.22Can_I_use_this_server.3F.22
    6:Is Host name change supported?
    Yes, the hostname change is supported. The prcocedure is documented in the UCCX 10.0 Administration Guide:
    http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/crs/express_10_0/configuration/guide/UCCX_BK_W1AF9DDD_00_uccx-admin-guide-10.0.pdf (Pg 168)
    Cheers,
    Abhiram Kramadhati

  • Ask the Expert: Cisco BYOD Wireless Solution: ISE and WLC Integration

    With Jacob Ideji, Richard Hamby  and Raphael Ohaemenyi   
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about  the new Identity Solutions Engine (ISE) and Wireless LAN Controller (WLC) hardware/software, integration, features, specifications, client details, or just questions about  Cisco's Bring-your-own device (BYOD) solution with cisco Experts Richard Hamby, Jacob Ideji, and Raphael Ohaemenyi. The interest in BYOD (Bring You Own Device) solutions in the enterprise has grown exponentially as guests and company users increasingly desire to use personal devices to access .  Cisco BYOD enhances user experience and productivity while providing security, ease-of-administration, and performance. The heart of the Cisco wireless BYOD solution is Identity Solutions Engine (ISE) utilizing the Cisco Unified Wireless portfolio.  Starting with ISE v1.1.1MR and WLC (Wireless LAN Controller) code v7.2.110.0 and higher, end-to-end wireless BYOD integration is reality. 
    Jacob Ideji is the technical team lead in the Cisco authentication, authorization and accounting (AAA) security team in Richardson, Texas. During his four years of experience at Cisco he has worked with Cisco VPN products, Cisco Network Admission Control (NAC) Appliance, Cisco Secure Access Control Server, and Dot1x technology as well as the current Cisco Identity Services Engine. He has a total of more than 12 years experience in the networking industry. Ideji holds CCNA, CCNP, CCSP, CCDA, CCDP, and CISM certifications from Cisco plus other industry certifications.
    Richard Hamby  works on the Cisco BYOD Plan, Design, Implement (PDI) Help Desk for Borderless Networks, where he is the subject matter expert on wireless, supporting partners in the deployment of Cisco Unified Wireless and Identity Services Engine solutions. Prior to his current position, Hamby was a customer support engineer with the Cisco Technical Assistance Center for 3 years on the authentication, authorization, accounting (AAA) and wireless technology teams. 
    Raphael Ohaemenyi  Raphael Ohaemenyi is a customer support engineer with the authentication, authorization and accounting (AAA) team in the Technical Assistance Center in Richardson, Texas, where he supports Cisco customers in identity management technologies. His areas of expertise include Cisco Access Control Server, Cisco Network Admission Control (NAC) Appliance, Cisco Identity Services Engine, and IEEE 802.1X technologies. He has been at Cisco for more than 2 years and has worked in the networking industry for 8 years. He holds CCNP, CCDP, and CCSP certification.
    Remember to use the rating system to let Jacob, Richard and Raphael know if you have received an adequate response.  
    Jacob, Richard and Raphael might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the wireless mobility sub community forum shortly after the event. This event lasts through Oct 5th, 2012. Visit this forum often to view responses to your questions and the questions of other community members.

    OOPS !!
    I will repost the whole messaqge with the correct external URL's:
    In  general, the Trustsec design and deployment guides address the specific  support for the various features of the 'whole' Cisco TS (and other  security) solution frameworks.  And then a drill-down (usually the  proper links are embedded) to the specifc feature, and then that feature  on a given device.  TS 2.1 defines the use of ISE or ACS5 as the policy  server, and confiugration examples for the platforms will include and  refer to them.
    TrustSec Home Page
    http://www.cisco.com/en/US/netsol/ns1051/index.html
    http://www.cisco.com/en/US/solutions/collateral/ns170/ns896/ns1051/product_bulletin_c25-712066.html
    http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/at_a_glance_c45-654884.pdf
    I find this page very helpful as a top-level start to what features and capabilities exist per device:
    http://www.cisco.com/en/US/solutions/ns170/ns896/ns1051/trustsec_matrix.html
    The TS 2.1 Design Guides
    http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html
    DesignZone has some updated docs as well
    http://www.cisco.com/en/US/netsol/ns982/networking_solutions_program_home.html#~bng
    As  the SGT functionality (at this point) is really more of a  router/LAN/client solution, the most detailed information will be in the  IOS TS guides like :
    http://www.cisco.com/en/US/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6.x.html
    http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_cts/configuration/xe-3s/asr1000/sec-usr-cts-xe-3s-asr1000-book.html
    http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/trustsec.html

  • ASK THE EXPERTS:Branch Office Wireless Strategies

    With Jeevan Patil
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to ask how to consolidate your Wireless Branch Network Cisco subject matter expert Jeevan Patil. Mr. Jeevan Patil is a product manager for the Cisco Wireless Controller product portfolio. He has been involved with the wireless industry for over 12 years - since the first days of 802.11 becoming a standard through the evolution to 802.11n. Mr. Patil has been with Cisco for over 12 years. For the first 5 years he was a software engineer working on security, network management and wireless. In the past 7 years he has been the product manager on various initiatives such 802.11n standards, Access Points hardware, Client hardware, CCX, standalone (Autonomous) software, WLSE hardware and software and currently the product line manager on Wireless LAN Controllers.
    Remember to use the rating system to let Jeevan know if you have received an adequate response.  
    Jeevan might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Other Wireless – Mobility Subjects discussion forum shortly after the event. This event lasts through August 12, 2011. Visit this forum often to view responses to your questions and the questions of other community members.

    Hi Nigel,
    Please take a look at the "WAN Requirements" section from the following Flex7500 deployment guide:
    http://www.cisco.com/en/US/products/ps11635/products_tech_note09186a0080b7f141.shtml
    It is highly recommended that the minimum bandwidth restriction remains 128 kbps with the round trip latency no greater than 300 ms for data deployments and 100 ms for data + voice deployments. The maximum transmission unit (MTU) must be at least 500 bytes.
    Deployment Type
    WAN Bandwidth (Min)
    WAN RTT Latency (Max)
    Max APs per Branch
    Max Clients per Branch
    Data
    128 kbps
    300 ms
    5
    25
    Data + Voice
    128 kbps
    100 ms
    5
    25
    Data
    128 kbps
    1 sec
    1
    1
    Monitor
    128 kbps
    2 sec
    5
    N/A
    Data
    1.44 Mbps
    300 ms
    50
    1000
    Data + Voice
    1.44 Mbps
    100 ms
    50
    1000
    Data
    1.44 Mbps
    1 sec
    50
    1000
    Monitor
    1.44 Mbps
    2 sec
    50
    N/A
    Best Regards,
    Jeevan

  • Ask the Expert: Cisco Unified Computing System Director

                With Andrew Nam
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Cisco Unified Computing System (UCS) Director with Cisco expert Andrew Nam.
    Cisco UCS Director was designed to operationally integrate bare-metal and virtual data center infrastructure resources to address complex, time-consuming, manual, and compartmentalized management processes. These processes burden IT organizations, preventing them from achieving business agility and efficiency.  Cisco expert Andrew Nam will provide an update on installation, configuration, and troubleshooting VM provisioning process using Cisco UCS Director.
    Andrew Nam is a data center solution engineer in the DC Solution team in Sydney, Australia, responsible for orchestrating the end-to-end solution support of Cisco Data Centre solutions, including Cisco UCS, Cisco Nexus architecture, VBlock/FlexPod, VDI/VXI, and cloud solutions. His areas of expertise include routing and switching, load balancer, WAN optimization, VPN, and firewalls. Andrew has worked for Cisco for more than 13 years and has 15 years of experience in the networking industry. He graduated from New South Wales University in Australia with a mechanical/manufacturing engineering degree and holds R&S CCIE 9586, VMware VPC5, and Citrix CCA - Xendesktop5 certifications. 
    Remember to use the rating system to let Andrew know if you have received an adequate response. 
    Andrew might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation in Data Center community,  sub-community, Unified Computing discussion forum shortly after the event. This event lasts through January 17, 2014. Visit this forum often to view responses to your questions and the questions of other community members.

    Hi James
    This Ask the Expert session may not be the right place to show you all the essential steps for how the workflow can be related to task library to achieve your initial setup flow chart, and onboarding a new client.
    However, I can briefly walktthrough "Client blade Provisioning" task so it might give some idea and how you can go about.
    Assumption :  the infrastructure used in the following examples consists of:
    -  Vmware VCenter
    -  Cisco UCS
    -  NetApp ONTAP controlled storage
    To be able to provision Cisco UCS blade server in automated fashion, you need to create and define the below UCS entities beforehand.
    - Create UCS Organisation
    - Create UUID Pool
    - Create MAC Address Pool
    - Create WWNN Pool
    - Create WWPN Pool
    - Create vHBA Templates
    - Create vNIC Templates
    - Create UCS Policy vHBAs
    - Create UCS Policy vNICs
    - Create Storage Policy
    - Create Network Policy
    - Create SAN Boot Policy
    - Create LAN Boot Policy
    Once you create all the policy above, you are good to set up a workflow container for the client blade provisoining.
    1. Create UCS Service Profile
    - Add a ‘Create UCS Service Profile’ workflow task and select ‘Map to User Input’ for ‘Service Profile Name’. Select the ‘Service Profile Name’ dropdown as created when the workflow container was created.
    - ‘Create UCS Service Profile’ inputs. Ensure that Storage_Policy, Network_Policy, Boot_Policy_LAN and Boot_Policy_SAN entries are correct.
    - Once this is done , you can move to SAN zoning.
    2. Configure SAN Zoning
    - In this step, a new workflow task will be created in order to configure SAN zoning. Rather than use a specific user input for this task, output variables from the previous ‘Create UCS Service Profile’ workflow task will be used as input items for this task.
    - Open the workflow and search for the workflow task ‘configure san zoning’. Drag the storage workflow task into the work area and map the following user inputs.
    Create Flexible Volume
    - Create a ‘Create Flexible Volume’ workflow task in order to build a NetApp flexible volume and provision it for the required size.
    - Once again, reconfigure the workflow such that the success criteria from the ‘Configure SAN Zoning’ workflow task proceeds to ‘Create Flexible Volume’.
    Create LUN
    - Using the NetApp ONTAP ‘Create LUN’ workflow task, create a LUN located within the volume created during the previous step. In order to do this, map the Volume Name user input to the output from the previous ‘Create Flexible Volume’ workflow task.
    - Next, enter the LUN details, ensuring that the configured size is less than that of the volume created in the previous step.
    - As before, re-map the workflow designer flow so that the successful output of the Create Flexible Volume workflow task flows into this task.
    3. Create Initiator Group
    - Create a ‘Create Initiator Group’ workflow task in order to build a NetApp ONTAP Initiator Group. Map the ‘Filer Identity Name’ attribute to the OUTPUT_FILER_IDENTITY output variable as supplied by the ‘Create NetApp Flexible Volume’ workflow task as created earlier in this workflow.
    - Once again, modify the the workflow designer flow so that the successful output from ‘Create LUN’ flows into ‘Create Initiator Group’
    4. Add Initiator to Initiator Group
    - Create an ‘Add Initiator to Initiator Group’ workflow task and map the ‘Initiator Group Name’ entry to the OUTPUT_IGROUP_IDENTITY output variable from the ‘Create NetApp Initiator Group’ workflow task and map the ‘Initiator Name’ entry to the SP_VHBA1 output variable from the ‘Create UCS Service Profile’ workflow task created earlier in this flow.
    - Repeat this task for in order to add initiator name entry for SP_VHBA2. Once done, re-map the successful output from the two Create Initiator Group workflow tasks so that they flow into each other as follows:
    - Move onto the next step in order to map the created LUN to the initiator group.
    And the rest of steps are fairly similar to above. Create a Workflow and map the User Input Mappings".
    5. Map LUN to Initiator Group
    6. Modify UCS Boot Policy LUN ID
    7. Select UCS Server
    8. Associate UCS Service Profile
    9. Power On UCS Server
    10. Modify UCS Service Profile Boot Policy
    11. Add VLAN to Service Policy
    12. Disassociate UCS Service Profile
    13. Wait for Specified Duration
    14. Associate UCS Service Profile
    15. Power On UCS Server
    16. Register Host with VCenter
    regards
    Andrew

  • Ask the Expert: Hierarchical Network Design, Includes Core, Distribution, and Access

    Welcome to the Cisco® Support Community Ask the Expert conversation.  This is an opportunity to learn and ask questions about hierarchical network design. 
    Recommending a network topology is required for meeting a customer's corporate network design  needs in their business and technical goals and often consists of many interrelated components. The hierarchical design made this easier like "divide and conquer" the job and develop the design in layers.
    Network design experts have developed the hierarchical network design model to help to develop a topology in discrete layers. Each layer can be focused on specific functions, to select the right systems and features for the layer.
    A typical hierarchical topology is
    A core layer of high-end routers and switches that are optimized for availability and performance.
    A distribution layer of routers and switches that implement policies.
    An access layer that connects users via lower-end switches and wireless access points.
    Ahmad Manzoor is a Senior Pre-Sales Engineer at AGCN, Pakistan. He has more than 10 years of experience in first-rate management, commercial and technical skills in the field of data communication and services lifecycle—from solution design through sales pitch, designing RFPs, architecture, and solution—all with the goal toward winning projects (creating win/win situations) of obsolete solutions.  Ahmad also has vast experience in designing end-to-end data centers, from building infrastructure design to data communication and network Infrastructure design. He has worked for several large companies in Pakistan and United Arab Emirates markets; for example, National Engineer, WATEEN Telecom, Emircom, Infotech, Global Solutions, NETS International, Al-Aberah, and AGCN, also known as Getronics, Pakistan.
    Remember to use the rating system to let Ahmad know if he has given you an adequate response. 
    Because of the volume expected during this event, Ahmad might not be able to answer every question. Remember that you can continue the conversation in the  Solutions and Architectures under the sub-community Data Center & Virtualization, shortly after the event. This event lasts through August 15, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

    Dear Leo,
    We are discussing the following without any product line, discussing the concept of hierarchical design, which will help you to take decision which model is better for you Two Layer or Three Layer hierarchical model.  
    Two-Layer Hierarchy
    In many networks, you need only two layers to fulfill all of the layer functions—core and aggregation
    Only one zone exists within the core, and many zones are in the aggregation layer. Examine each of the layer functions to see where it occurs in a two-layer design:
    Traffic forwarding—Ideally, all interzone traffic forwarding occurs in the core. Traffic flows from each zone within the aggregation layer up the hierarchy into the network core and then back down the hierarchy into other aggregation zones.
    Aggregation—Aggregation occurs along the core/aggregation layer border, allowing only interzone traffic to pass between the aggregation and core layers. This also provides an edge for traffic engineering services to be deployed along.
    Routing policy—Routing policy is deployed along the edge of the core and the aggregation layers, generally as routes are advertised from the aggregation layer into the core.
    User attachment—User devices and servers are attached to zones within the aggregation layer. This separation of end devices into the aggregation permits the separation of traffic between traffic through a link and traffic to a link, or device. Typically, it is best not to mix transit and destination traffic in the same area of the network.
    Controlling traffic admittance—Traffic admittance control always occurs where user and server devices are attached to the network, which is in the aggregation layer. You can also place traffic admittance controls at the aggregation points exiting from the aggregation layer into the core of the network, but this is not common.
    You can see, then, how dividing the network into layers enables you to make each layer specialized and to hide information between the layers. For instance, the traffic admittance policy implemented along the edge of the aggregation layer is entirely hidden from the network core.
    You also use the core/aggregation layer edge to hide information about the topology of routing zones from each other, through summarization. Each zone within the aggregation layer should have minimal routing information, possibly just how to make it to the network core through a default route, and no information about the topology of the network core. At the same time, the zones within the aggregation layer should summarize their reachability information into as few routing advertisements as possible at their edge with the core and hide their topology information from the network core.
    Three-Layer Hierarchy
    A three-layer hierarchy divides these same responsibilities through zones in three vertical network layers,
    Traffic Forwarding—As with a two-layer hierarchy, all interzone traffic within a three- layer hierarchy should flow up the hierarchy, through the layers, and back down the hierarchy.
    Aggregation—A three-layer hierarchy has two aggregation points:
    At the edge of the access layer going into the distribution layer
    At the edge of the distribution layer going into the core
    At the edge of the access layer, you aggregate traffic in two places: within each access zone and flowing into the distribution layer. In the same way, you aggregate interzone traffic at the distribution layer and traffic leaving the distribution layer toward the network core. The distribution layer and core are ideal places to deploy traffic engineering within a network.
    Routing policy—The routing policy is deployed within the distribution layer in a three- layer design and along the distribution/core edge. You can also deploy routing policies along the access/distribution edge, particularly route and topology summarization, to hide information from other zones that are attached to the same distribution layer zone.
    User attachment—User devices and servers are attached to zones within the access layer. This separation of end devices into the access layer permits the separation of traffic between traffic through a link and traffic to a link, or device. Typically, you do not want to mix transit and destination traffic in the same area of the network.
    Controlling traffic admittance—Traffic admittance control always occurs where user and server devices are attached to the network, which is in the access layer. You can also place traffic admittance controls at the aggregation points along the aggregation/core edge.
    As you can see, the concepts that are applied to two- and three-layer designs are similar, but you have more application points in a three-layer design.
    Now the confusion takes place in our minds where do we use Two Layer and where the Three layer hierarchical model.
    Now we are discussing that How Many Layers to Use in Network Design?
    Which network design is better: two layers or three layers? As with almost all things in network design, it all depends. Examine some of the following factors involved in deciding whether to build a two- or three-layer network:
    Network geography—Networks that cover a smaller geographic space, such as a single campus or a small number of interconnected campuses, tend to work well as two-layer designs. Networks spanning large geographic areas, such as a country, continent, or even the entire globe, often work better as three layer designs.
    Network topology depth—Networks with a compressed, or flattened, topology tend to work better as two-layer hierarchies. For instance, service provider networks cover large geographic areas, but reducing number of hops through the network is critical in providing the services they sell; therefore, they are often built on a two-layer design. Networks with substantial depth in their topologies, however, tend to work better as three-layer designs.
    Network topology design—Highly meshed networks, with many requirements for interzone traffic flows, tend to work better as two-layer designs. Simplifying the hierarchy to two levels tends to focus the design elements into meshier zones. Networks that focus traffic flows on well-placed distributed resources, or centralized resources, such as a network with a large number of remote sites connecting to a number of centralized Data Centers, tend to work better as three-layer designs.
    Policy implementation—If policies of a network tend to focus on traffic engineering, two-layer designs tend to work better. Networks that attempt to limit access to resources attached to the network and other types of policies tend to work better as three-layer designs.
    Again, however, these are simple rules of thumb. No definitive way exists to decide whether a network should have two or three layers. Likewise, you cannot point to a single factor and say, “Because of this, the network we are working on should have three layers instead of two.”
    I hope that this helps you to understand the purposes of Two Layer & Three layer Hierarchical Model.
    Best regards,
    Ahmad Manzoor

  • Ask the Expert: Integrating Cisco Identity Service Engine (ISE) 1.2 for BYOD

    With Eric Yu and Todd Pula 
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions  about integrating Cisco ISE 1.2 for BYOD with experts Eric Yu and Todd Pula.
    Cisco Bring Your Own Device (BYOD) is an end-to-end architecture that orchestrates the integration of Cisco's mobile and security architectures to various third-party components. The session takes a deep dive into the available tools and methodologies for troubleshooting the Cisco BYOD solution to identify root causes for problems that stem from mobile device manager integration, Microsoft Active Directory and certificate authority services, and Cisco Enterprise Mobility integration to the Cisco Identity Services Engine (ISE). 
    Todd and Eric recently delivered a technical workshop that helps network designers and network engineers understand integration of the various Cisco BYOD components by taking a deep dive to analyze best practice configurations and time-saving troubleshooting methodologies. The content consisted of common troubleshooting scenarios in which TAC engineers help customers address operational challenges as seen in real Cisco BYOD deployments.
    Eric Yu is a technical leader at Cisco responsible for supporting our leading-edge borderless network solutions. He has 10 years of experience in the telecommunications industry designing data and voice networks. Previous to his current role, he worked as a network consulting engineer for Cisco Advance Services, responsible for designing and implementing Cisco Unified Communications for Fortune 500 enterprises. Before joining Cisco, he worked at Verizon Business as an integration engineer responsible for developing a managed services solution for Cisco Unified Communications. Eric holds CCIE certification in routing and switching no. 14590 and has two patents pending related to Cisco's medianet.   
    Todd Pula is a member of the TAC Security and NMS Technical Leadership team supporting the ISE and intrusion prevention system (IPS) product lines. Todd has 15 years of experience in the networking and information security industries, with 6 years of experience working in Cisco's TAC organization. Previous to his current role, Todd was a TAC team lead providing focused technical support on Cisco's wide array of VPN products. Before joining Cisco, he worked at Stanley Black & Decker as a network engineer responsible for the design, configuration, and support of an expansive global network infrastructure. Todd holds his CCIE in routing and switching no. 19383 and an MS degree in IT from Capella University.
    Remember to use the rating system to let Eric and Todd know if you have received an adequate response.
    Because of the volume expected during this event, Eric and Todd might not be able to answer every question. Remember that you can continue the conversation in the Security community, subcommunity AAA, Identity and NAC, shortly after the event. This event lasts through November 15, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

    Hi Antonio,
    Many great questions to start this series.  For the situation that you are observing with your FlexConnect configuration, is the problem 100% reproducible or is it intermittent?  Does the problem happen for one WLAN but not another?  As it stands today, the CoA-Ack needs to be initiated by the management interface.  This limitation is documented in bug CSCuj42870.  I have provided a link for your reference below.  If the problem happens 100% of the time, the two configuration areas that I would check first include:
    On the WLC, navigate to Security > RADIUS > Authentication.  Click on the server index number for the associated ISE node.  On the edit screen, verify that the Support for RFC 3576 option is enabled.
    On the WLC, navigate to the WLANs tab and click on the WLAN ID for the WLAN in question.  On the edit screen, navigate to Security > AAA and make sure the Radius Server Overwrite interface is unchecked.  When this option is checked, the WLC will attemp to send client authentication requests and the CoA-Ack/Nak via the dynamic interface assigned to the WLAN vs. the management interface.  Because of the below referenced bug, all RADIUS packets except the CoA-Ack/Nak will actually be transmitted via the dynamic interface.  As a general rule of thumb, if using the Radius NAC option on a WLAN, you should not configure the Radius Server Overwrite interface feature.
    Bug Info:  https://tools.cisco.com/bugsearch/bug/CSCuj42870
    For your second question, you raise a very valid point which I am going to turn into a documentation enhancement request.  We don't currently have a document that lists the possible supplicant provisioning wizard errors that may be encountered.  Please feel free to post specific errors that you have questions about in this chat and we will try to get you answers.  For most Android devices, the wizard log file can be found at /sdcards/downloads/spw.log.
    As for product roadmap questions, we won't be able to discuss this here due to NDA.  Both are popular asks from the field so it will be interesting to see what the product marketing team comes up with for the next iterration of ISE.
    Related Info:
    Wireless BYOD for FlexConnect Deployment Guide

  • Ask the Expert: Packet Capture Capabilities of Cisco Routers and Switches

    With Rahul Rammanohar 
    Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about packet capture capabilities of Cisco routers and switches.
    In May 2013, we created a video that included packet capture capabilities across multiple Cisco routers and switches. For each product, we began with a discussion about the theory of the capabilities, followed by an explanation of the commands, and we concluded with a demo on real devices. In this Ask the Expert event, you’re encouraged to ask questions about the packet capture capabilities of these Cisco devices:
    •       7600/6500: mini protocol analyzer (MPA), ELAM, and Netdr
    •       ASR9k: network processor capture
    •       7200/ISRs: embedded packet capture
    •       Cisco Nexus 7K, 5K, and 3K: Ethanalyzer
    •       Cisco Nexus 7K: ELAM
    •       CRS: show captured packets
    •       ASR1K: embedded packet capture
    More Information
    Blog URL: Packet Capture Capabilities of Cisco Routers and Switches
    Watch the Video:  https://supportforums.cisco.com/videos/6226
    Hitesh Kumar is a customer support engineer in the High-Touch Technical Services team at Cisco specializing in routing protocols. He has been supporting major service providers and enterprise customers in routing, Multiprotocol Label Switching (MPLS), multicast, and Layer 2 VPN (L2VPN) issues on routing platforms for more than three years. He has more than six years of experience in the IT industry and holds a CCIE certification (number 38757) in service. 
    Rahul Rammanohar is a technical leader with the High-Touch Technical Support Team in India. He handles escalations in the area of routing protocols and large-scale architectures for devices running Cisco IOS, IOS-XR, and IOS-XE Software. He has been supporting major service providers and large enterprise customers for routing, MPLS, multicast, and L2VPN issues on all routing platforms. He has more than 13 years of experience and holds a CCIE certification (number 13015) in routing/switching and service provider.
    Remember to use the rating system to let Hitesh and Rahul know if you have received an adequate response.  
    Because of the volume expected during this event, Hitesh and Rahul might not be able to answer each question. Remember that you can continue the conversation in the Service Provider, sub-community forum shortly after the event. This event lasts through November 1, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

    Hello Erick
        Thanks for the topology. The trigger will be different for labelled  packet as you would need to mention the values of labels too in the  trigger.
         Below are two examples of one or two labels being  used, it depends on where you are capturing the packet in mplsvpn  scenario which will decide teh number of labels being imposed on the  packet.
    Trigger for one label. (if the router on which you are capturing the packet PHP is being performed)
    VPN label - 5678
    Source Address - 111.111.111.111
    Destination Address - 123.123.123.123
    show platform capture elam trigger dbus others if data = 0 0 0 0x88470162 0xE0000000 0 0 0x00006F6F 0x6F6F 7B7B 0x7B7B0000 [ 0 0 0 0xffffffff 0xf0000000 0 0 0x0000ffff 0xffffffff 0xffff0000 ]
    Trigger for two labels. (for other core routers)
    IGP label - 1234
    VPN label - 5678
    Source Address - 111.111.111.111
    Destination Address - 123.123.123.123
    show platform capture elam trigger dbus others if data = 0 0 0 0x8847004D 0x20000162 0xE0000000 0 0 0x00006F6F 0x6F6F7B7B 0x7B7B0000 [ 0 0 0 0xffffffff 0xf000ffff 0xf0000000 0 0 0x0000ffff 0xffffffff 0xffff0000 ]
        You can check the labels being used (by using show ip cef <> details) and covert their values to hex and change the trigger accordingly.
         I have changed the colors for better understanding. If you notice carefully in the trigger the values for ip address, labels have just been converted to their respective hex values which could be replaced.
         Please let me know if this helps.
    Thanks & Regards
    Hitesh & Rahul

  • Ask the Expert: Cisco Hosted Collaboration Solution

    With Chris Ward
    Welcome to the Cisco Support Community Ask the Expert conversation.This is an opportunity to learn about Cisco's new Hosted Collaboration Solution architecture and deployment with Cisco expert Chris Ward. Chris is a technical marketing engineer working on the Cisco Hosted Collaboration Solution. He previously held an escalation position in the Cisco Technical Assistance Center for the Cisco Unified Communications Manager team, where he worked for more than five years. Ward holds bachelor and master of science degrees in information technology from the Rochester Institute of Technology and also holds CCIE Voice certification.
    Remember to use the rating system to let Chris know if you have received an adequate response. 
    Chris might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Service Provider sub-community discussion forum shortly after the event. This event lasts through April 20 , 2012. Visit this forum often to view responses to your questions and the questions of other community members.

    Hi Tenaro,
    Thank you for your question.
    At current, we do not setup CUCM in a multi-tenant configuration. Each HCS end-customer gets their own unique CUCM cluster, the same goes for Unity Connection and Unified Presence.
    There are a few pieces of software that are unique to HCS
    1) HCM - F - This component is used to automate the upgrades of the UC applications, produce bundle-based billing reports from the configuration domain, and also automatically provision/configure the Service Assurance architecture so as you deploy HCS to end customers, the monitoring of those configurations is automatically done for you.
    2) Prime Central for HCS Assurance - This component is responsible for provides lots of functionality in regards to monitoring the HCS solution. It aggregates data from CUOM, CUSM, DCNM, and vCenter and can display all the events/errors/alarms that those components are reporting. It also has the ability to normalize these errors and forward them to an exisitng alarm management or ticketing system via SNMP traps. It also includes a reatures like fault correlation (root cause analysis) and service impact analysis which allows you to see what services are affected based on the error information that is being reported.
    3) This last item is not really a piece of software, but more an advantage over using UC on UCS as opposed to HCS. Within HCS we allow the over subscription of your UCS resources for some of the smaller OVAs where in UC on UCS you would be required to map a vCPU to an entire core. This allows for much greater denisty. Also, the HCS licensing scheme allows for the SP to pool licenses and transfer between the customers as needed where in UC on UCS, these licenses are bound to customers, once purchased.
    To answer your last question, we sell HCS to service providers and partners. Partners may need to have customers bring their own PSTN connectivity or partner with an SP to provide PSTN access, but either way, partners are just as capable of providing this service.
    Hope that helps. Thanks again Tenaro!

Maybe you are looking for