Catalyst 6500 Module problems

Hi,
We are almost a week dealing with a very instable 6500.
What we see is that modules are undergoing a soft reset. When this reset fails the module has a faulty status. Resetting the module mostly solves the problem. But in some cases more then one module has this problem. Even the supervisor module is undergoing the same soft reset some time.
Here are the messages that appear in the logging.
1/07/2005,6:50:41,10.2.0.116,???,LOCAL,NOTICE,2005 Jul 01 06:47:58 %SYS-5-MOD_NOSCPPINGRESPONSE:Module 5 not responding... resetting module
1/07/2005,6:50:41,10.2.0.116,???,LOCAL7,NOTICE,2005 Jul 01 06:47:58 %SYS-5-MOD_RESET:Module 5 reset from Software
1/07/2005,6:50:43,10.2.0.116,???,LOCAL7,NOTICE,2005 Jul 01 06:48:00 %SYS-5-MOD_NOSCPPINGRESPONSE:Module 6 not responding... resetting module
1/07/2005,6:50:43,10.2.0.116,???,LOCAL7,NOTICE,2005 Jul 01 06:48:00 %SYS-5-MOD_RESET:Module 6 reset from Software
1/07/2005,6:53:36,10.2.0.116,???,LOCAL7,NOTICE,2005 Jul 01 06:50:52 %SYS-5-MOD_RMVDNLDSTOP:Download terminated for module 6. Module removed
1/07/2005,6:53:36,10.2.0.116,???,LOCAL7,NOTICE,2005 Jul 01 06:50:52 %SYS-5-MOD_DNLDFAIL:Download failed for module 6
1/07/2005,6:56:44,10.2.0.116,???,LOCAL7,EMERGENCY,2005 Jul 01 06:54:00 %SYS-0-MOD_NOSLCPRESPONSE:Module 1 SLCP not responding... resetting module
1/07/2005,6:56:44,10.2.0.116,???,LOCAL7,NOTICE,2005 Jul 01 06:54:00 %SYS-5-MOD_RESET:Module 1 reset from Software
What has been done:
Since module 5 always reboots first, this card had been replaced. Then we replaced the supervisor. Since still cards where rebooting we replaced the entire chassis. The power modules have also been replaced.
Anyone seen this problem before?
Many thanks!

SBRU_01> (enable) sh ver
WS-C6509 Software, Version NmpSW: 7.3(2)
Copyright (c) 1995-2002 by Cisco Systems
NMP S/W compiled on Aug 1 2002, 17:18:44
System Bootstrap Version: 5.2(1)
Hardware Version: 2.0 Model: WS-C6509 Serial #: SCA041201PZ
PS1 Module: WS-CAC-1300W Serial #: SON04301066
PS2 Module: WS-CAC-1300W Serial #: SON04290510
Mod Port Model Serial # Versions
1 2 WS-X6K-SUP1-2GE SAD03384603 Hw : 5.0
Fw : 5.2(1)
Fw1: 5.1(1)CSX
Sw : 7.3(2)
Sw1: 7.3(2)
WS-F6020A SAD03405664 Hw : 2.0
2 48 WS-X6248-TEL SAD04130FP9 Hw : 1.0
Fw : 4.2(0.24)VAI78
Sw : 7.3(2)
3 48 WS-X6248-TEL SAD0412056T Hw : 1.0
Fw : 4.2(0.24)VAI78
Sw : 7.3(2)
4 48 WS-X6248-TEL SAD04130FJH Hw : 1.0
Fw : 4.2(0.24)VAI78
Sw : 7.3(2)
5 48 WS-X6248A-TEL SAL05062YWP Hw : 3.0
Fw : 5.4(2)
Sw : 7.3(2)
6 48 WS-X6248A-TEL SAL05106KV4 Hw : 2.0
Fw : 5.4(2)
Sw : 7.3(2)
DRAM FLASH NVRAM
Module Total Used Free Total Used Free Total Used Free
1 65408K 43089K 22319K 16384K 9993K 6391K 512K 377K 135K
Uptime is 0 day, 0 hour, 22 minutes
SBRU_01> (enable) sh mod
Mod Slot Ports Module-Type Model Sub Status
1 1 2 1000BaseX Supervisor WS-X6K-SUP1-2GE yes ok
2 2 48 10/100BaseTX Ethernet WS-X6248-TEL no ok
3 3 48 10/100BaseTX Ethernet WS-X6248-TEL no ok
4 4 48 10/100BaseTX Ethernet WS-X6248-TEL no ok
5 5 48 10/100BaseTX Ethernet WS-X6248A-TEL no other
6 6 48 10/100BaseTX Ethernet WS-X6248A-TEL no other
Mod Module-Name Serial-Num
1 SAD03384603
2 SAD04130FP9
3 SAD0412056T
4 SAD04130FJH
5 SAL05062YWP
6 SAL05106KV4
Mod MAC-Address(es) Hw Fw Sw
1 00-30-80-f7-7a-c2 to 00-30-80-f7-7a-c3 5.0 5.2(1) 7.3(2)
00-30-80-f7-7a-c0 to 00-30-80-f7-7a-c1
00-13-60-48-63-00 to 00-13-60-48-66-ff
2 00-01-97-09-77-f0 to 00-01-97-09-78-1f 1.0 4.2(0.24)V 7.3(2)
3 00-01-97-10-c3-30 to 00-01-97-10-c3-5f 1.0 4.2(0.24)V 7.3(2)
4 00-01-97-09-78-e0 to 00-01-97-09-79-0f 1.0 4.2(0.24)V 7.3(2)
5 00-30-96-37-98-14 to 00-30-96-37-98-43 3.0 5.4(2) 7.3(2)
6 00-02-7e-c1-dc-8c to 00-02-7e-c1-dc-bb 2.0 5.4(2) 7.3(2)
Mod Sub-Type Sub-Model Sub-Serial Sub-Hw
1 L2 Switching Engine II WS-F6020A SAD03405664 2.0

Similar Messages

Modules Gbic Catalyst 6500

I have a peculiar problem with two gbic modules of Catalyst 6500.
First problem, I have a gbic port in module 7, which was a trunkport to Catalyst 2950, that does not allow conection to switch Catalyst 2950, and besides it harmed the yield of Catalyst 6500. I have to disconnect the optical fiber cable so that everything returned to normality.
Second problem. A port gbic in module 8, I let work and I disconnect of the network to one of the servants, by such reason I had to connect the fiber cable in another one gbic of he himself I module.
My question is: is necessary to change I modulate 7 and 8 not to have network problems on watch? or single to change gbic affected in each one of the modules?
Thank you,

Failure to get GBIC up during installation could be as a result of system requirements not met, incorrect cable installed, lack of power to the device, configuration errors or hardware failure. Verify that the GBIC cable is connected to another active network device and that the port is not shut down. Replace cable with a known good cable. Make sure GBICs are matched on either side of the connection. Make sure the flow control and port negotiation settings are consistent on both sides of the link. There may be incompatibilities in the implementation of these features if the switches being connected are from different vendors. If in doubt, turn these features off on both switches. Swap GBIC to a different slot. Also, try using a spare GBIC to see if it works. For more information, refer to Troubleshooting link :
http://www.cisco.com/en/US/products/hw/switches/ps628/products_installation_guide_chapter09186a00800d7681.html

Catalyst 6500 Central Fwd Card for WS-X67xx modules ?

Hi ,
I have a BOM of materials that has this part number in it.
WS-F6700-CFC Catalyst 6500 Central Fwd Card for WS-X67xx modules 1
Though on Cisco configurator it doesnt show up. Is this what it should be WS-F6700-DFC3A Cisco Catalyst 6500 Distributed Forwarding Daughter card-3A for 67xx modules
Are they the same ?
thanks
Allan

Allan,
Both the cards are not same. One is the CFC i.e centralized forwarding card and the other is distributed forwarding card. DFC cards downloads the CEF cache tables on them,both the FIB and the adjacency table.
WS-X67xx modules which are sfipped with CFC's are field upgradable to DFC's.
http://www.cisco.com/en/US/products/hw/switches/ps708/prod_module_installation_guide09186a00801d3b60.html#wp59534
regards,
-amit singh

After upgrading ios Cisco Catalyst 6500 Series Supervisor Engine 2T to the latest release the ASA-SM module is not recognized

after upgrading ios Cisco Catalyst 6500 Series Supervisor Engine 2T to the latest release the ASA-SM module is not recognized it is disabled. the FPD
is not recognized any more. reverted back to previous ios with no luck

Duplicate post.
Being discussed actively in this thread.

How to remove the WiSM2 from the Catalyst 6500 series switch?

Hello, can you explain to me how to safely remove the WiSM2 from the Catalyst 6500 series switch?
According to the documentation "Catalyst 6500 Series Wireless Services Module 2 Installation and Verification Note":
To remove the WiSM2, perform these steps:
Step1     Shut down the module by one of these methods:
In privileged mode from the router prompt, enter the hw-mod module mod shutdown command. NoteIf you enter this command to shut down the module, you must enter the following commands in global configuration mode to restart (power down, and then power up) the module:
Router# no power enable module modRouter# power enable module mod
If the module does not respond to any commands, press the SHUTDOWN button located on the front panel of the module.
Step2     Verify that the WiSM2 shuts down. Do not remove the module from the switch until the POWER LEDis off.
But, in the case of Step1 (1st methods) I do not see a option "shutdown" in the command "hw-mod module 3"...
All I prompted to enter is:
c6500#hw-module module 3 ?
boot           Specify boot options for the module through Power Management Bus control register
reset          Reset specified component
simulate Simulate options for the module
Is it hidden options? IOS version of c6500 is 12.2(33)SXJ1
In the case of Step2 (2nd methods) there is not any button on the front panel of the module?
And yet, it is better to remove the module configuration manually or use the command module clear-config prior to removing the module?

Good catch.
Which one is true, will get back to you on this if i've something soon.
http://www.cisco.com/en/US/docs/wireless/module/wism2/installation/note/WiSM_2.html#wp34727
The above link is procedure to remove wism2. This procedure doesn’t look like wism2 is hot swapable.
http://www.cisco.com/en/US/docs/wireless/module/wism2/installation/note/WiSM_2.html#wp34621
All modules, including the supervisor engine (if you have redundant supervisor engines), support hot swapping. You can add, replace, or remove modules without interrupting the system power or causing other software or interfaces to shut down. For more information about hot-swapping modules, see the Catalyst 6500 Series Switch Module Installation Guide.

[Solved]catalyst-rt module for realtime kernel

Hello,
I've compiled and intstalled the rtkernel with the directions posted here: http://bbs.archlinux.org/viewtopic.php?id=52201
My laptop uses an ati card and needs catalyst drivers. The fglrx module works fine with the vanilla kernel and pacman does not install it for the rt kernel(I think they are not compatible?) so I think I need the catalyst-rt module(also while installing the kernel, the pkgbuild told me that I needed catalyst-rt).
I could find no packages named catalyst-rt in the repos, but AUR database has one:
http://aur.archlinux.org/packages.php?ID=16825
But I think there is a problem with the install. After I compile the package and run it with "pacman -U", it complains about an unexpected EOF because of an unmatched quote mark. I've extracted the generated "catalyst-rt-8.5-2-i686.pkg.tar.gz" file to see if I can come up with something, there is indeed a missing quote in one of the echo statements in the contained catalyst-rt.install file. I tried fixing and retarring it but pacman complained about missing metadatas in the package. This is my 3rd day with arch(and one of those days my Internet connection was broken) so I don't have many clues.
I figure that there are very few people running ati drivers on a rt kernel here(searching for catalyst-rt yields to nothing) but maybe you can help me fix the issue myself, or maybe there is an easier way to use catalyst with an rt kernel?
Any help will be greatly appreciated. Thanks!
Last edited by pyramind (2008-07-27 18:47:04)

Ok, some more progress:
As I said, the vanilla kernel works fine with the catalyst drivers. Fully accelerated etc. When working with vanilla kernel if I say " dmesg | grep fglrx", the output is fine:
fglrx: module license 'Proprietary. (C) 2002 - ATI Technologies, Starnberg, GERMANY' taints kernel.
[fglrx] vendor: 1002 device: 71c5 count: 1
[fglrx] Maximum main memory to use for locked dma buffers: 1898 MBytes.
[fglrx] PAT is enabled successfully!
[fglrx] module loaded - fglrx 8.50.3 [Jun 2 2008] with 1 minors
[fglrx] Reserved FB block: Shared offset:0, size:1000000
[fglrx] Reserved FB block: Unshared offset:1000000, size:5000
[fglrx] Reserved FB block: Unshared offset:ffbf000, size:40000
[fglrx] Reserved FB block: Unshared offset:ffff000, size:1000
[fglrx] Reserved FB block: Shared offset:0, size:1000000
[fglrx] Reserved FB block: Unshared offset:1000000, size:5000
[fglrx] Reserved FB block: Unshared offset:ffbf000, size:40000
[fglrx] Reserved FB block: Unshared offset:ffff000, size:1000
As you can see, the loaded version is fglrx 8.50.3 [Jun 2 2008].
Now if I try the same on rt-kernel with catalyst-rt drivers loaded, the loaded version is shown as the incompatible fglrx 8.49.7 [May 12 2008] version.
The package PKGBUILD downloads is ati-driver-installer-8-5-x86.x86_64
So I assume that should be at least 8.5? Where does this loaded 8.49.7 come from?
I'm checking /lib/modules/<myrtkernel>/ to see if there are any other fglrx.ko floating around but there is only one, the one installed from the package built with ati-driver-installer-8-5-x86.x86_64.run
Since I'm not very competent with linux, I'm hoping some of you can show me some directions. I may try packaging a new ati driver to check but if ati-driver-installer-8-5-x86.x86_64 is actually 8.49, which one should I try then? 8-6? 8-7? I quite don't understand.
Last edited by pyramind (2008-07-27 18:24:34)

IDSM on catalyst 6500 to provide IOS Inline mode support

I am currently evaluating what kind of method to apply in my 6500. I would like to ask if IOS Version 12.2(33)SXI2a support inline mode and inline vlan pair mode with IDSM-2???what configuration should be done with the switch in order for the multiple vlan traffic to flow with an inline interface of the IDSM2??? In my case I have 16 user vlans and 1 server vlan on catalyst 6500...The task is to protect the servers from users....The requirement is to configure inline mode to monitor the traffic from these 16 vlans when they access the servers...But as we know the IDSM-2 has only two logical sensing ports...So my question is how will you configure the switch to forward the traffic from these 16 vlans to the IDSM-2 module via only ONE sensing port, since the other sensing port will be configured in the server vlan??? Because as far as i know, when you configure inline mode on IOS,you will have to configure the sensing ports in access mode( While in CatOS, you configure these as TRUNK ports)...But this will work when you have only two vlans...But in my case, I have 16 vlans to monitor in inline mode..Please suggest any solution.
Any urgent reply will be much grateful...
Many Thanks in advance

Hi Mubin,
If you're looking to monitor all the traffic from the user VLANs to the server VLANs then the simplest way to configure the IDSM-2 would be inline on the server VLAN segment. All traffic destined to the servers (from the users or anywhere else) has to traverse that VLAN. Assuming you have something like this to start:
VLAN 100-120 (users) ====== Switch ------ VLAN 200 (servers)
you'd drop the IDSM-2 inline on VLAN 200 by using a helper VLAN:
VLAN 100-120 (users) ====== Switch ----- VLAN 201 (server gateway) ----- IDSM-2 (bridging 201 to 200) ----- VLAN 200 (servers)
To do this you'll need to perform the following steps:
1. Designate a new VLAN to use as a helper VLAN for your current server VLAN. I'll use 201 for this example and assume your current server VLAN is 200.
Create the helper VLAN on the switch:
switch# conf t
switch(config)# vlan 201
2. Configure the IDSM-2 to bridge the helper VLAN and the server VLAN (200-201)
sensor# conf t
sensor(config)# service interface
sensor(config-int)# phsyical-interface GigabitEthernet0/7
sensor(config-int-phy)# admin-state enabled
sensor(config-int-phy)# subinterface-type inline-vlan-pair
sensor(config-int-phy-inl)# subinterface 1
sensor(config-int-phy-inl-sub)# vlan1 200
sensor(config-int-phy-inl-sub)# vlan2 201
sensor(config-int-phy-inl-sub)# description Server-Helper pair
sensor(config-int-phy-inl-sub)# exit
sensor(config-int-phy-inl)# exit
sensor(config-int-phy)# exit
sensor(config-int)# exit
Apply Changes:?[yes]:
3. Configure the switch to trunk the helper and server VLANs to the IDSM-2 module. I assume the module is in slot 5 in the example. Replace the 5 with the correct slot for your deployment:
switch# conf t
switch(config)# intrusion-detection module 5 data-port 1 trunk allowed-vlan 200,201
switch(config)# intrusion-detection module 5 data-port 1 autostate include
*Warning! This next step may cause an outage if everything is configured correctly. You'll probably want to schedule a window to do this.*
4. Finally, force the traffic from the server VLAN through the IDSM-2 by moving the server VLAN gateway from VLAN 200 (where it is currently) to the helper VLAN you created. To do this, remove the SVI from VLAN 200 and apply the same IP address to VLAN 201. I assume the current server gateway is 192.168.1.1/24
switch# conf t
switch(config)#int vlan 200
switch(config-int)#no ip addr
switch(config-int)#int vlan 201
switch(config-int)#ip addr 192.168.1.1 255.255.255.0
switch(config-int)#exit
switch(config)#exit
switch# wr mem
Now, when the servers try to contact 192.168.1.1 (their gateway) they'll have to be bridged through the IDSM-2 to reach VLAN 201 and in the process all traffic destined to them or sourced from them will be inspected. Do not put any hosts or servers in the helper VLAN (201) or they will not be inspected.
Best Regards,
Justin

Firewalling vlans on Catalyst 6500 by using Cisco ASA Firewalls

Hello,
How to secure vlans on Catalyst 6500 by using Cisco ASA Firewalls?
There are no free modules on Catalyst 6500 to install a FWSM module.
What is the best configuration to secure vlans (~80 vlans) by using cisco ASA firewalls (context, hairpining...)?
Thanks

Hi Bro
Just to understand your question once again, you don't have anymore available slots in your present Cat6K, but you want to know how to secure your VLANs or SVIs that has been configured in your Cat6K?
If you were to ask me, I would not apply a bunch of ACLs in the Cat6K, for starters. You might wanna look into COPP (Control Plane Policing) instead. Furthermore you could also refer to this Cisco document http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00801b49a4.shtml
However, if you do have Cisco ASA FW appliance (not module, I presume from your question), you could enable ACLs, threat-detection feature, IP Audit features, reverse-path policing, capping of the embryonic values etc.
P/S: If you think this comment is useful, please do rate them nicely :-)

Replacement catalyst 6500 switches under redundancy environment

Hi everyone,
I plan to replace old core catalyst 6500 switches with new ones for the purpose of reinforcement.
Now two core catalyst 6500 switches are working under redundancy environment.
There are many catalyst 6500 switches as distribution switch connect to each core catalyst
6500 switches as attached.
I think there are two ways to replace core catalyst 6500 switches.
[One]
Replacing one core catalyst 6500 switches first, then one week later, replacing another core
catalyst 6500 switch. And all traffic will be handled another core catalyst 6500 switch automatically
by EIGRP routing during replacement.
Advantage:
One another core catalyst 6500 switch continues operating even if the replacement fail.
Disadvantage:
Two core catalyst 6500 switches will operate in a different version (CatOS, MSFC IOS) for one week.
Any problem might be happened due to this issue.
[Two]
Replacing both core catalyst 6500 switches at the same time.
Advantage:
Replacement will be finished at one time
Disadvantage:
If the replacement fail, whole network goes to down and it cause critical situation.
I have to replace successfully so I would like know good information about this, such as
best practice, case study and so on.
Your information would be greatly appreciated.
Best regards,

Hi,
If I were you, I will go for option 1.
This option will give us the time to observe the traffic pattern, time to get the network and EIGRP to stabilize and even to check for any issues on the IOS part.
This will give you time frame to work out for any issue if it happens in between the weeks time.This will gibe you tha time to see for any imcompatibilty issues as such.
HTH, Please rate if it does.
-amit singh

Catalyst 6500 with CatOS ISCSI

Hi, I'm configuring a Catalyst 6500 with for ISCSI.
Following the recommendations I have to configure: portfast, jumbo frames, flow control and disable unicast storm control
- Portfast: on the server and ISCSI SAN ports
>
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Tabla normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
set spantree portfast
- Jumbo frames: Set port jumbo
- Flow Control:
> set port flow control receive desired
Questions:
1. Where I have to configure flow control? only on the SAN ports and NIC servers? or server ports too?
2. Unicast Storm control: how can i configure this option?
Thanks

We are having the same exact problem. We've done what you've tried with no luck also. Strange thing is that in another building we have the same setup but only with a 6148V blade and that Tandberg has no issues. We're using a 6148AF with the one we're having problems with. We've tried with a 6348 blade and it works fine. I'm thinking it's something with the 6148AF firmware (ver. 8.2(2)).
Were you able to solve your problem?

Catalyst 6500 and IPS

I have a catalyst 6500 switch on my network and I know it supports an IDS module.What I am not sure is an IPS.
Could somebody who knows be kind enough to tell me if there is the support of IPS in the Catalyst 6500 switch.

The IDSM-2 module is capable of both IDS (promiscuous mode) AND IPS (inline mode).
So if you need IPS (inline mode) you still just buy the same IDSM-2 but configure it for InLine Interface Pair or InLine Vlan Pair mode instead of configuring for Promiscuous mode.

Catalyst 6500 Stack

Hi,
I have heard of Cisco releasing new IOS software that will effectively stack Catalyst 6500 switches. Intitially it was called "Satellite".
Does anyone know about this and when it will be released? Any ideas on how it works?
My main reason for this is Multi-Chassis EtherChannel on 6513's.
Thanks.

The IDSM-2 module is capable of both IDS (promiscuous mode) AND IPS (inline mode).
So if you need IPS (inline mode) you still just buy the same IDSM-2 but configure it for InLine Interface Pair or InLine Vlan Pair mode instead of configuring for Promiscuous mode.

IPS 45xx/43xx/42xx appliance and Catalyst 6500 Inline Mode issues

Hello to everyone!
We have recently got our new IPS 4510 appliance and for now there is a task to develop a connection scheme to our backbone multilayer switch (Catalyst 6500).
There are several server's and user's VLANs connected to 6500.
6500 performs inter-vlan routing.
The main task is to "insert" IPS appliance between traffic path from any VLAN to server's VLANs.
The additional task is to provide failover in "fail-open" manner (We have only one 4510 appliance. So if 4510 fails then traffic should continue passing without inspections).
As I understood from this document https://supportforums.cisco.com/docs/DOC-12206 the only way to implement Inline Mode when using multilayer switch is to "take out" default gateway address for inspected subnet on the other VLAN's SVI.
If we replace IDSM-2 with IPS appliance I suppose we can use hardware bypass feature as a failover measure (in case if IPS fails then traffic between bridged VLANs will still be forwarded).
But what if there are several VLANs that should be monitored?
As I understand in such schema we will need to use addtional interface-inline-pair for each monitored VLAN.
But what if we have 20 VLANs for servers and 50 VLANs for users?
Can using of VLAN-group mode handle this problem?
I am not sure but using of VLAN-groups cannot provide bridging between two different VLANs. Am I right?
And will using of VLAN-group make hardware-bypass feature useless?
I tryed to simulate the first scenario in Cisco Packet Tracer (i used a bridge to simulate an IPS appliance in interface-pair inline mode):
May be this is a bug of Packet Tracer but traffic went through IPS only if it was sent from VLAN 10 to VLAN100.
The return traffic from VLAN 100 to VLAN 10 went through the Catalyst directly.
When Catalyst recieved the frame it said:
"The frame destination MAC address matches the MAC address of the active VLAN interface."
After that it decapsulates the PDU from the Ethernet frame and send IP packet directly to VLAN 10.
Does it mean that there is a need to change SVI's mac address?
Thanks for any advice in advance.

Here is my guess of how to realise my scenario:
Config on Cat6k should looks something like this:
ip routing
interface Ge1/0
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10-12,110-112
switchport mode trunk
switchport nonegotiate
switchport vlan mapping enable
switchport vlan mapping 110 10
switchport vlan mapping 111 11
switchport vlan mapping 112 12
interface Ge1/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10-12
switchport mode trunk
switchport nonegotiate
interface vlan 2
ip address 10.0.2.1 255.255.255.0
interface vlan 3
ip address 10.0.3.1 255.255.255.0
interface Vlan4
ip address 10.0.4.1 255.255.255.0
interface Vlan110
ip address 10.0.10.1 255.255.255.0
interface Vlan111
ip address 10.0.11.1 255.255.255.0
interface Vlan112
ip address 10.0.12.1 255.255.255.0
no interface Vlan10
no interface Vlan11
no interface Vlan12
IPS should operate in VLAN-group inline mode. We could separate traffic by VLAN tag to inspect with different virtual sensors or we use one VS for all trunk traffic.
Traffic routed from any VLAN to VLANs 10-12 should go through IPS.
In case if IPS gets powered off - hardware-bypass feature should provide bridging between trunk ports.
In theory it should work.
Remained to test it in practice
Thoughts / suggestions?

Catalyst 6500 - Nexus 7000 migration

Hello,
I'm planning a platform migration from Catalyst 6500 til Nexus 7000. The old network consists of two pairs of 6500's as serverdistribution, configured with HSRPv1 as FHRP, rapid-pvst and ospf as IGP. Futhermore, the Cat6500 utilize mpls/l3vpn with BGP for 2/3 of the vlans. Otherwise, the topology is quite standard, with a number of 6500 and CBS3020/3120 as serveraccess.
In preparing for the migration, VTP will be discontinued and vlans have been manually "copied" from the 6500 to the N7K's. Bridge assurance is enabled downstream toward the new N55K access-switches, but toward the 6500, the upcoming etherchannels will run in "normal" mode, trying to avoid any problems with BA this way. For now, only L2 will be utilized on the N7K, as we're avaiting the 5.2 release, which includes mpls/l3vpn. But all servers/blade switches will be migrated prior to that.
The questions arise, when migrating Layer3 functionality, incl. hsrp. As per my understanding, hsrp in nxos has been modified slightly to better align with the vPC feature and to avoid sub-optimal forwarding across the vPC peerlink. But that aside, is there anything that would complicate a "sliding" FHRP migration? I'm thinking of configuring SVI's on the N7K's, configuring them with unused ip's and assign the same virtual ip, only decrementing the prio to a value below the current standby-router. Also spanning-tree prio will, if necessary, be modified to better align with hsrp.
From a routing perspective, I'm thinking of configuring ospf/bgp etc. similar to that of the 6500's, only tweaking the metrics (cost, localpref etc) to constrain forwarding on the 6500's and subsequently migrate both routing and FHRP at the same time. Maybe not in a big bang style, but stepwise. Is there anything in particular one should be aware of when doing this? At present, for me this seems like a valid approach, but maybe someone has experience with this (good/bad), so I'm hoping someone has some insight they would like to share.
Topology drawing is attached.
Thanks
/Ulrich

In a normal scenario, yes. But not in vPC. HSRP is a bit different in the vPC environment. Even though the SVI is not the HSRP primary, it will still forward traffic. Please see the below white paper.
http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9402/white_paper_c11-516396.html
I will suggest you to set up the SVIs on the N7K but leave them in the down state. Until you are ready to use the N7K as the gateway for the SVIs, shut down the SVIs on the C6K one at a time and turn up the N7K SVIs. When I said "you are ready", it means the spanning-tree root is at the N7K along with all the L3 northbound links (toward the core).
I had a customer who did the same thing that you are trying to do - to avoid down time. However, out of the 50+ SVIs, we've had 1 SVI that HSRP would not establish between C6K and N7K, we ended up moving everything to the N7K on a fly during of the migration. Yes, they were down for about 30 sec - 1 min for each SVI but it is less painful and waste less time because we don't need to figure out what is wrong or any NXOS bugs.
HTH,
jerry

After upgrading ios Cisco Catalyst 6500 Series Supervisor Engine 2T ASA-SM is disabled

after upgrading ios Cisco Catalyst 6500 Series Supervisor Engine 2T to the latest release the ASA-SM module is not recognized it is disabled. the FPD
is not recognized any more. reverted back to previous ios with no luck

What IOS are you running on your Supervisor 2T? As long as it's 15.0(1)SY1 or later you should be OK. (Reference).
If it's not working with that I'd try reload of the ASA SM module (from IOS cli - e.g. "hw-module <module#> reset" and, failing that, "no power-enable module <module#>" followed by "power-enable module <module#>) while the new Supervisor is installed. Watch the log for relevant messages during that process.

Catalyst 6500 Module problems

Similar Messages

Maybe you are looking for