CSS 11501 STP disable option

Hi,
I have configure command:"
"bridge spanning-tree disable" on CSS but still i see my CSS acting as a root switch in the topology. Could some one tell me how do i completely remove the CSS from the STP.

Giles,
Also i dont want to see this in the show bridge status i see couple of vlans(for ex: i have pasted the output) acting as the root but i agree with you that after disabling the option it will still show but i would like to know can you tell the what do i need to do if i dont want this messages to appear when i issue this command.
:CWdevCSS01# sh bridge status
VLAN5 STP State: Disabled
VLAN5: Root Max Age: 6 Root Hello Time: 1 Root Fwd Delay: 4
Designated Root: 80-00-00-14-1c-28-63-7d
Bridge ID: 80-00-00-14-1c-28-63-7d
Root Port Desg
Port State Designated Bridge Designated Root Cost Cost Port
1/2-5 Fwd 80-00-00-14-1c-28-63-7d 80-00-00-14-1c-28-63-7d 0 4 8002

Similar Messages

CSS 11501 StartUp Problem

Hi all,
After i boot up for the first time, the CSS asked for change User/Pass, wich i perform a well known ones.
After that it's always impossible to login.
Is there any way of return to factory default Settings?
or
Is there any password recovery procedure?
or
What are the default User/Pass of the equipment?
I already done a Power Off/On on it with no results.
Best Regards,
Petr?nio

Hi,
I perform the password recovery, as it was documented and then its always getting the "CSS 11501 Offline Diagnostic Monitor menu (OffDM)" Menu, even if i dont press the Y key in the bootup question "Would you like to access the Offline Diagnostic Monitor? (Y)"
Any ideias?
How can i test the login i changed before?
Here is the bootup logging that appear's.
I'm not pressing any key.
******** Boot UP ********
CSS 11501 Offline Diagnostic Monitor menu (OffDM)
Version: 08.10.1.06
M A I N M E N U
Enter the number of a menu selection:
1* Set Boot Configuration
2. Show Boot Configuration
3* Advanced Options
4. Reboot System
> 4
Are you sure you want to reboot? (y/n) [n] y
Rebooting....
BootRom...booting
Copyright (1998-2002), Cisco Systems, Inc
Locked boot flash.
Validating operational boot flash, please wait...
Operational boot flash valid. Jumping to operational boot flash.
Copyright (1998-2002), Cisco Systems, Inc
Operational boot flash.
Attaching interrupt handlers...Done.
Built Mar 9 2006 @ 17:56:32
Version 08.10.1.06
Press to enter the Diagnostic Monitor
Ran 1 times, 24 tests. Detected 0 errors.
Booting OffDm @ 0xbff00000
SCM:MASTER Other:NOT-PRESENT
Initializing the disk...OK
Reading configuration records...
No Primary or Secondary Boot Record Found
FAILED
MGMT disabled, network port not active
Would you like to access the Offline Diagnostic Monitor? (Y)
Booting(-) ...
Transferring to menu...
Waiting for commands..
CSS 11501 Offline Diagnostic Monitor menu (OffDM)
Version: 08.10.1.06
M A I N M E N U
Enter the number of a menu selection:
1* Set Boot Configuration
2. Show Boot Configuration
3* Advanced Options
4. Reboot System
>

How to reset password on Cisco CSS 11501?

Hi,
I have changed the password for the Admin user (which was SuperUser) but when I changed it I forgot to add "SuperUser" at the end, now I don't have SuperUser access to the CSS 11501.
Can anyone shade some light on this problem and explain how can I reset the password for a SuperUser?
Thanks in Advance,
Shai

Hi Shai,
You need to reboot the CSS. When prompt, hit any key to go into the Offline Diagnostic Menu.
When you get in the menu, you will go to Administrative options and create an additional Admin user. When you do this, DO NOT use "admin", use something totally different.
Get out of the Offline DM and reboot the CSS. When the CSS comes up, login as the new user (which will have Superuser rights) and run the "username" cli to change the password of "admin" and add the superuser part this time.
Regards
Pete Knoops
Cisco Systems

NAT and Servers behind CSS 11501

All,
Please forgive my asking this question again. I was injured shortly after asking the last time and out of work for a long period of time.
My problem stems from needing to allow my web servers to initiate traffic to the outside world from behind our CSS boxes.
The web servers sit behind a pair of CSS 11501 content switches in Active-Passive ASR with fate sharing. We are only interested at this time with load balancing HTTP and HTTPS.
Everything works inbound no problem.
What I need to do is setup some type of NAT for my 3 web servers to initiate HTTP/HTTPS for patches, send SMTP from the web apps, and initiate HTTPS for credit card validation.
I have setup NAT on PIX units and routers no problem, but I seem to be unable to do it on these boxes. :(
In reality something as simple as a PAT translation on the outside of the CSS boxes should be sufficient.
Is this possible with our setup? Does anyone have some code examples?
Thanks in advance.
Addresses changed to protect the innocent:
Load Balancer 1:
!*************************** GLOBAL ***************************
bridge spanning-tree disabled
sntp server 1.1.1.41 version 1
snmp community noway read-only
snmp community noway read-write
app session 1.1.1.252
app
logging subsystem netman level info-6
dns primary 2.2.2.41
dns secondary 2.2.2.42
ip route 0.0.0.0 0.0.0.0 1.1.1.1 1
!************************* INTERFACE *************************
interface e1
phy 100Mbits-FD
description "Connect to Primary DMZ 1 3550 Switch"
interface e2
bridge vlan 2
phy 100Mbits-FD
description "Connected to Primary LB Server Switch"
interface e8
description "Inter Switch Communication (ISC) Port"
isc-port-one
!************************** CIRCUIT **************************
circuit VLAN1
description "DMZ 1 Subnet (1.1.1.x/24)"
ip address 1.1.1.251 255.255.255.0
ip virtual-router 1 priority 254 preempt
ip redundant-interface 1 1.1.1.250
ip redundant-vip 1 1.1.1.161
ip redundant-vip 1 1.1.1.162
ip redundant-vip 1 1.1.1.70
ip redundant-vip 1 1.1.1.71
ip redundant-vip 1 1.1.1.72
ip critical-service 1 upstream_downstream
circuit VLAN2
description "Load Balanced Servers Subnet"
ip address 2.2.2.2 255.255.255.0
ip virtual-router 2 priority 254 preempt
ip redundant-interface 2 2.2.2.1
ip critical-service 2 upstream_downstream
Various Services, Owners and Content
Load Balancer 2:
!*************************** GLOBAL ***************************
bridge spanning-tree disabled
sntp server 1.1.1.41 version 1
snmp community noway read-only
snmp community noway read-write
app session 1.1.1.251
app
logging subsystem netman level info-6
dns primary 2.2.2.41
dns secondary 2.2.2.42
ip route 0.0.0.0 0.0.0.0 1.1.1.1 1
!************************* INTERFACE *************************
interface e1
phy 100Mbits-FD
description "Connect to Secondary DMZ 1 3550 Switch"
interface e2
bridge vlan 2
phy 100Mbits-FD
description "Connected to Secondary LB Server Switch"
interface e8
description "Inter Switch Communication (ISC) Port"
isc-port-one
!************************** CIRCUIT **************************
circuit VLAN1
description "DMZ 1 Subnet (1.1.1.x/24)"
ip address 1.1.1.252 255.255.255.0
ip virtual-router 1
ip redundant-interface 1 1.1.1.250
ip redundant-vip 1 1.1.1.161
ip redundant-vip 1 1.1.1.162
ip redundant-vip 1 1.1.1.70
ip redundant-vip 1 1.1.1.71
ip redundant-vip 1 1.1.1.72
ip critical-service 1 upstream_downstream
circuit VLAN2
description "Load Balanced Servers Subnet"
ip address 2.2.2.3 255.255.255.0
ip virtual-router 2
ip redundant-interface 2 2.2.2.1
ip critical-service 2 upstream_downstream
Various Services, Owners and Content.

Gilles,
I added the following commands, and things seem to be working.
To circuit VLAN1
ip redundant-vip 1 1.1.1.80
!*************************** GROUP ***************************
group natout
vip address 1.1.1.80
add service nat_web_servers
active
service nat_web_servers
ip address 192.168.1.10 range 3
active
I do have a question about the above service commands.
I have 3 servers behind the CSS. Let's call them 192.168.1.10, 192.168.1.11 and 192.168.1.12. Am I correct in my thinking that adding range 3 then allows a match on all 3 of those servers and the CSS will then PAT these servers from the VIP address assigned to the group?
Otherwise, I think you have resolved this problem for us. Thank you.

CSS 11501 Load Balancing with X-forwarded-for

Hi,
We have a pair of CSS 11501,
Currently it is using source ip for load balancing and 5 servers as backend , however we have users loggin in using http and based on its source IP (ISP PROXY) , it is forwarded to SERVER A.
However, we have a SSL page and when the client switches over to SSL , it is forwarded to SERVER B/C/D/E based on its source IP ( REAL CLIENT IP) .
This will cause the user to be terminated as the 5 servers are independent and not running in a cluster.
Is there any way that we can use the X-Forwarded-For address to load balance so that when users loging , they are sent to SERVER A (Based on X-Forwarded-For Header IP which translate to REAL CLIENT IP).
This way we are able to also send it back to the same server when it uses SSL.
I believe that we should be able to load balance using X-Forwarded-For IP or to rewrite the X-Forwarded-For IP into client source IP
Regards

Hi,
Unfortunately CSS does not support X-Forwarded-For, and even if CSS supports that, this wont work if you are not using SSL termination.
One option that you can use here, is using SSL termination, so you can manage the SSL traffic on HTTP on the CSS, in this way you can use the same HTTP content rule which is the one currently working.
In summary, you will have an SSL content rule that will decrypt the traffic, and this one will use the same content rule that already exist for HTTP, in case that the server is the one doing the redirect to SSL, but this is something that requires testing since depending on the redirect behavior we might have a redirect loop, but without details it is kind of hard to confirm that you will face this with this option.
Another option, which is less complex, is to use a portless content rule, so this content rule will match port 443 and 80 at the same time, and using sticky or balance based on source IP, you will get the same result with less config. The downside is the troubleshooting, but in this way you will have what you want.
content HTTP-HTTPS
    vip address 10.198.44.70
    advanced-balance sticky-srcip
    add service server1
    add service server2
    add service server3
    add service server4
    add service server5
    protocol tcp
    active
Here the content rule is not looking for the destination port, it is just looking for the source IP, and HTTP and HTTPS will end all the time on the same server.
Thanks,
Rodrigo

CSS 11501 - Network reconnection issue

Using a CSS 11501 switch to configure both Load balancing and server hot standby between two servers (of same config). Clients are connecting to the server using tcp/ip sessions.
The configuration used is shown below:
=========================================
configure
ip route 0.0.0.0 0.0.0.0 10.167.50.1 1
!************************* INTERFACE
interface e2
bridge vlan 9
interface e3
bridge vlan 9
!************************** CIRCUIT
circuit VLAN1
ip address 10.167.50.108 255.255.254.0
circuit VLAN9
ip address 10.167.70.1 255.255.254.0
!************************** SERVICE
service abc_service1
ip address 10.167.70.2
protocol tcp
port 6300
keepalive type tcp
active
service abc_service2
ip address 10.167.70.3
protocol tcp
port 6300
keepalive type tcp
active
!*************************** OWNER
owner xxxxx
content abc_crule
vip address 10.167.50.109
add service abc_service1
add service abc_service2
protocol tcp
port 6300
balance aca
active
===============================
We conducted three tests to verify the hot standby while client sending the data to server app thro tcp/ip.
1) Brought down the service on one server 2) Restarted the OS (Windows 2003) on one server 3) Removed a network cable of one of the server connecting to CSS.
client app lost the conn to the service/server, but when it tried reconnecting to the alternate server, it was successful.
CSS status reflected the actual status of the service/server.
But in third test (removing network conn) the service state changed from "Alive" to "Down" and client app lost conn to the server. Client app tried reconnecting and it was successful connecting to the alternate server.
But when we connected the network cable back, the CSS state was continue to be in "Down". Also,the network connection between CSS and server was not available after reconnection. Also, the status of alternate server changed to "Down", but still client app was successfully transmitting to the alternate server. Stopping the client app and tried reconnecting,
the connection was not going thro.
The connection could be established between CSS and server boxes only after restarting the OS(running windows 2003).
Issues:
1. Service status in CSS continue to be down even after reconnecting the cable with the service running.
2. CSS status of the first service also went down after reconnecting the other server.
3. Client app could not reconnect to any of the servers.
Are we missing any configuration parameter in CSS which will address the above?
regards
Param

Param,
what software version for the CSS ?
Did you see an ARP entry on the server for the CSS ?
Did you see an ARP entry on the CSS for the server ?
is the server directly connected to the CSS or is there an L2 switch inbetween ?
Could you configure 'bridge spanning-tree disabled' on the CSS and see if this improves the situation.
Regards,
Gilles.

CSS 11501 Trouble shooting data throughput

I have two groups of servers that talk to each other through the Load Balancer. It appears that on certain transactions where there is a "get", "head" or "trace" in the actual http data, the transaction is not forwarded through the CSS 11501. This happens maybe once in 11,000 transactions. It appears the word get, head or trace has to be in a certain part of the data payload to cause this problem too occur. Has anybody heard of such an issue? If so, do you have a work around? If not, any suggestion on how I can further isolate the issue. FYI I have a TAC case open but it does not appear to be going any where any time soon.

is it happening in the middle of a persistent connection or with the first request ?
There are 2 possibilities I can think off.
First one would be a flow timeout and the next request is just dropped because the css reclaim the fcb.
The 2nd option is that by default the CSS does not support the "TRACE" http method.
It must be enabled.
See info at :
http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_command_reference_chapter09186a008040c3cf.html
So, configure a flow-timeout-multiplier and enable parsing of rfc2518 methods.
Gilles.

CSS 11501 Config Retrieval

Hi,
We have a fault with our CSS 11501 appliance where it is constantly rebooting and attempting to dump a crash file to filesystem but never succeeding.
It doesn't look as if we have any offline configs in order to build another box.
Is there any way to retrieve the config file by breaking the boot sequence?
Regards
Mike

Param,
what software version for the CSS ?
Did you see an ARP entry on the server for the CSS ?
Did you see an ARP entry on the CSS for the server ?
is the server directly connected to the CSS or is there an L2 switch inbetween ?
Could you configure 'bridge spanning-tree disabled' on the CSS and see if this improves the situation.
Regards,
Gilles.

Disable option "This is a private computer" of webacc

Hi all,
anyone knows how to disable option in webaccess, i want to disable "This is a private computer", just use "this is a public or shared computer" .
"This is a public or shared computer" or "This is a private computer"
is webaccess supported to disable? or can we disable in code of web page?
Regards,

1. Go to: "/opt/novell/groupwise/webaccess/gw/WEB-INF/classes/templates/webacc/css"
2. Backup login.htt
3. Open login.htt with some text editor.
4. Find this lines:
Code:
<table id="idTimeOutOption">
<tr>
<td><input type="radio" tabindex="3" class="checkbox" id="idInternalTimeoutPublic" name="Security.Private.timeout" value="false" onchange="gwwa.mlogin.saveTimeoutCookie(this);"></td>
<td style="font-size: 13px; line-height: 20px;">{STRING Login.public}</td>
</tr>
<tr>
<td><input type="radio" tabindex="4" class="checkbox" id="idInternalTimeoutPrivate" name="Security.Private.timeout" value="true" onchange="gwwa.mlogin.saveTimeoutCookie(this);"></td>
<td style="font-size: 13px; line-height: 20px;">{STRING Login.private}</td>
</tr>
</table>
5. Comment/delete them out.
6. Restart tomcat and apache.

OIM - How To not show the "Disable" option for a Resource object to a group

Hello there,
Is there anyway we can remove or don't show the option to "Disable" a already provisioned resource object ?
I have a requirement over here wherein there is no reason available to show the "disable" option out of the 3 available - "enable", "disable" and "revoke" for an already provisioned RO.
How can we remove it ? We don't want users belonging to a specific group see that option, at all.
Is there any menu item associated with it ? or is there any other way we can configure it ?
Please advise to the earliest.
Thanks !!
P.S.: this is OIM 9102 running on solaris.
Edited by: 786001 on Oct 13, 2010 7:22 PM

Modify JSP:
And to do this just for a particular group, put your java code in JSP itself. This is the easiest approach.
Otherwise you can modify the action class to return two action forwards and then use two different JSP's.
Thanks
Sunny

CSS 11501 Load Balancing Issue

Hi,
We are facing some issue in load balancing in cisco CSS 11501 as we are not able to access the application through virtual IP. Below is the ruuning configuration of the CSS:
CSS11501# sh running-config
!Generated on 10/06/2010 16:51:34
!Active version: sg0810106
configure
!*************************** GLOBAL ***************************
ip route 0.0.0.0 0.0.0.0 132.186.199.1 1
!************************** CIRCUIT **************************
circuit VLAN1
ip address 132.186.199.145 255.255.255.0
!************************** SERVICE **************************
service Server1
ip address 132.186.199.243
port 5001
protocol tcp
keepalive port 5001
active
service Server2
ip address 132.186.199.246
protocol tcp
port 5001
keepalive port 5001
active
!*************************** OWNER ***************************
owner L5_Owner
content L3_Rule
    vip address 132.186.199.146
    protocol tcp
    port 5001
    add service Server1
    add service Server2
    active
content L5_Rule
    vip address 132.186.199.146
    add service Server1
    add service Server2
    protocol tcp
    port 5001
    url "//132.186.199.146:5001/emi"
    active
CSS11501#
Observation : We are able to telnet on VIP: 132.186.199.146 on port 5001, but not able to access the application.
In Actual scenarion customer access application by accessing URL: http://132.186.199.243:5001/emi and once he enter this URL in web browser the request redirects ( by server itself) to URL: https://132.186.199.44:6002/cas/login?service=http%3A%2F%2F132.186.199.243%3A5001%2Femi%2Findex.jsp&acceptStrength=BASIC on backend server for user authenticaton and once user is authenticated then it again redirect to main URL ( http://132.186.199.243:5001/emi ) to access the application but when we are trying to access the application through VIP ( URL: http://132.186.199.146:5001/emi) we are not getting the login page as the request is not gettting redirected to backend server for user authentication.
Please suggest a solution here.

The problem is that you are in one-armed mode.
So you need to configure client nat.
Without nating the client ip address, the server response goes back directly to the client and bypasses the CSS.
Therefore the client receives a response from an unknown server ip address (not the vip).
So configure a group.
For example
group Client
    vip address 132.186.199.146
    add destination service Server1
     add destination service Server2
    active
Also, remove the url command from your content rule.
It is useless in your case and will just make performance worst.
Gilles.

CSS 11501 - SNMP sysname

Hi All
Had a basic query on SNMP polling for CSS 11501..
Im polling a CSS through Ethernet Management Interface, and the SNMP servers are detecting the system name as "Support" instead of the hostname of the device..
SNMP get sysname from x.x.x.x with ****
.1.3.6.1.2.1.1.5.0 = Support
Is there a way to alter the SNMP sysname, to be identical to the hostname of the device ? I dont have issues with other components like routers, switches etc..
Raj

Hi Sachin,
Use the snmp name command to set or modify the SNMP name for this system.
You can specify only one name.
The syntax for this global configuration mode command is as follows:
snmp name "name"
Enter the SNMP name as the unique name assigned to a system by the administrator.
Enter a quoted text string with a maximum of 255 characters.
The standard name convention is the system's fully qualified domain name (for example, [email protected]).
For example:
(config)# snmp name "[email protected]"
To remove the SNMP name for a system and reset it to the default of "Support", enter:
(config)# no snmp name
Best regards,
Sachin Garg

I am unable to remove some addons/extension as i dnt see only disable option n nt the remove option there. What should i do?

There are some addons/extensions which are not compatible with my current version of mozilla. I am seeing the "type error: components.classes[cid]" evry time while starting the firefox. So, i want to remove those incompatible addons. Those are google gears 0.5.36.0,speed boat video downloader2.2.9,widgi toolbar flatform4.4,you tube downloader toolbar 4.4. I went to tools>options>manage addons. But i cant see remove option for above mentioned addons, only disable option i am seeing. What should i do then?

Those extensions were probably installed like plug-ins and since you see them as extensions you will probably have to uninstall each of them through the Control Panel, see directions for various systems in
* http://code.google.com/apis/gears/install.html
If that solves your problem, please mark as solved or post which ones did not uninstall. Very important since I don't see similar questions and marked as solved helps people find solutions.

Cisco CSS 11501 - High-Availabilty

We have a single CSS 11501 and were thinking about just buying a new one and putting it online as the standby with statefull (hopefully) failover, but weren't sure that this would work.
Does anyone know what is needed to create a high-availability Cisco CSS 11501 environment?
Do you only need 2 CSS 11501 and then configure them with one being active and the other being in a standby mode, like a PIX?
Is there a HA Cable that would need to be connected between the 2 CSS's?
Thanks in Advanced.
Joe

Daniel,
There is a new stateful failover mechanism for the Cisco CSS 11500.
This description is a bit "salesy" I know, but it covers the question asked :-)
The Cisco CSS 11500 delivers ASRthe industry's first stateful Layer 5 session redundancy feature that enables failover of important flows while maximizing performance. Some flowssuch as a long-lived File Transfer Protocol (FTP) or a database session may be mission critical, but many are not. Most solutions on the market today require all trafficimportant or notto be backed up from one box to another. If the majority of flows are not critical, then most of system performance is wasted on unnecessary back
ups. With ASR, the Cisco CSS 11500 may be configured so critical flows are marked as replication worthy, whereas others do not need to be so marked. ASR focuses traffic management resources precisely where needed.
Better yet, have a look at the following link focusing on the section on Stateless Redundancy.
http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_510/advcfggd/redndncy.htm
Regards
Pete..

CSS 11501 and SSL

Hi,
I have a few questions regarding the CSS and SSL certificates.
I have 2 CSS 11501 and 3 web servers, how many SSL certificates do I need?
I want to configure the CSS as active - active, is this supported using the SSL accelleration module? If it is, is it configured the same way as a standalone CSS. The documentation only mentions configurations using single module and 2 modules in the same CSS.
And a clarificacion: Does the term Backend in the CSS SSL config refer to servers on a different subnet (in our case physically separated). Our config is 2 FW -> 2 CSS -> 3 Web servers -> 2 backend FW -> 6 Backend servers (app and DB). Am I correct in assuming that Backend refer to this backend? (This might seem like a silly question but the documentation has me confused)
Any help is much appreciated.
Thanks,
Niels

Niels,
there is currently an ASK THE EXPERT event.
Please join us if you have more questions.
Regarding the certificate, you could just use one.
Get 1 certificate for your VIP and upload it on both SSL module.
However, you might have to get 2, because certificate providers usually say it's one per physical device.
If you plan on doing SSL on the servers as well, you need 3 more certificates. Or you coul use a single certificate if this is allowed by the company that will give it to you.
Backend refers to server behind the CSS.
Like a firewall defines inside and outside interfaces, the CSS define the frontend and the backend.
The frontend is the client side and the backend the server side.
When you say active/active, what do you want to achieve exactly ?
You can indeed have 2 Vip and one is active on CSS1 while the other is active on CSS2.
However, if the CSS shares the same set of servers, you need to be careful that the return traffic from the server to the client goes back to the same server. This may require client nat (group config).
Regards,
Gilles.

CSS 11501 STP disable option

Similar Messages

Maybe you are looking for