Lan or San pin group in UCSM

Hi everybody,
    I am confuse with the vNic and vHBA template setting in  UCSM. Could anyone help me ?
    From vNic template, we can define the Fabric ID and pin group.
    If I define a pin group which is go to Fabric B, and choose the fabric A in vnic template setting.
    How does the traffic goes on?
    which FI does the vnic will create on? 
    As far as i know, pin group is a static pinning , and fabric id is a dynamic pinning.
    I attached a screenshot.
    In "fabric ID" , I chosen fabric A and tick "enable failover"
    In "pin group", i selected specific "PIN to FIB"

Just a General comment:
- I would never recommend to do static pinnning. Why ? it is great to control where your traffic goes, however, if your Installation becomes bigger (whatever that means), it's a Management nightmare; I know not a single customer that is using it therefore. 
- for Ethernet, there is a reshuffling mechanism in place, that distributes outgoing traffic equally over all outgoing links; not available for FC.
- the use of the Failover flag has been discussed in this Forum extensively. The recommendation: if your OS supports loadbalancing and Failover, then let the OS do it, and don't enable Hardware Failover; eg. ESXi, W2012,....
- Never ever use OS Failover AND Hardware Failover enabled; this can lead to ugly behaviour.
Cheers
Walter.

Similar Messages

  • PIN GROUP, Port Channel

    Hi, Cisco Gurus:
    Need your authoritative take on the following: Ethernet and FC is all End-Host Mode.
    1. If client is using FC Port Channel on all of the FC Uplinks for the 2 Fabric Interconnects with a SINGLE VSAN on each FI, MUST THEY USE SAN PIN GROUP? Currently, they are pinning the vHBA template to this SAN Pin Group. vHBA-Fabric A pins to FC-PIN-GROUP-A and vice-versa,
    2.
    If FC Port Channel is being used as in 1, from WHICH UCSM option should the VSAN be created?
    Should VSAN be STILL created under the Individual Fabric A and B as before?
    Or
    It have to be Global VSAN or Dual VSAN outside the Fabric A or Fabric B?
    3.If client is using Ethernet Port Channel for each Fabric Interconnet or each fabric, must they use LAN PIN GROUP?
    Currently, they are pinning the vNIC template to this Pin Group (Fabric A & B). vNICA-Fabric A pins to LAN-PIN-GROUP-A and vice-versa.
    Something which I have SELDOM SEE before.
    As usual, I know it is easy meat for Cisco gurus. Thanks, PAL.
    So Long.
    SiM

    All VSANs in the screenshot above are Global.  Notice they're not created under the Fabric A/ B section.
    Unlike "VLANs", which are almost always Global and normally accessible from each Fabric Interconnect, VSANs are different.  Best practice for storage has keeping each SAN Fabric separate.  Keeping this in mind, does it make more sense to create VSANs as global or under their respective Fabric interconnects? (Under the separate Fabric Inteconnects of course.  The only use case for using Global VSANs is as Craig pointed out - when there is a single Storage switch northbound that both Fabric Interconnects uplink to.
    Where this gets confusing is when you're assigning vHBA's to a VSAN. 
    Ex. 
    Let's say, as your customer has done, they've created their two VSAN 10 and 20 as "Global".  For comparison sake I've also created VSAN 100 just under Fabric-A and VSAN 200 just under Fabric-B. Their VSANs would looks like:
    Now, when creating an vHBA under your service profile, you need to assign it to a VSAN.  Take a look:
    So depending which Fabric (A/B) they want the vHBA connected to the options will change.  You can see that by creating the VSANs 10 and 20 as "Global" they appear when either Fabric is selected - Conversly you can see the two 100 and 200 I created under each Fabric, only appear when that fabric is selected.
    So what?  Well if your upstream SAN switches only use one of the respective VSANs configured and only connect to one Fabric Interconnect, then you can potentially "blackhole" your storage traffic by assigning it to the wrong Fabric Interconnect.  Creating the VSANs only under the appropriate Fabric Interconnect prevents this possibility.
    SAN Port-Channels have no bearing on this.  All a SAN Port Channel does is make mulitple FC Uplinks appear as one - which requires SAN Port Channels configured upstream also.  Leaving the FC Uplinks as individual just lets UCS dynamically pin virtual interfaces across the FC uplinks in a round-robin fashion.
    In your case you have no need for Pin-Groups either.  As Jeremy pointed out, unless you have a specific need for them, it's safer to not use them.
    Regards,
    Robert

  • LAN Pin Groups failover

    Hi,
    I am concerned about how traffic is distributed when we use static and dynamic pinning. Let's say, I have one chassis connected to only one FI. Two ports 1/1, 1/2 (etherchannel) go to one LAN switch, and next two ports 1/3, 1/4 (etherchannel) go to another LAN switch. Now, (1) how traffic from servers is distributed towards LAN if there is no static pinning (is hashing deterministic?), and (2) what if I have some servers pinned statically to one etherchannel, and other servers pinned to second etherchannel, and one LAN switch goes down, will traffic be moved to the other working etherchannel on the same FI?
    Regards,
    Krzysztof

    Yes, also you need to take into consideration the type of bundling/grouping of the uplinks such as using etherchannle with or without vPC
    fo rexample with N1K you can use LACP port channel, Allows for the VMs and VMKernal interfaces to utilise more than
    one link for traffic Allows for fast vMotion and faster VM connectivity by using flow
    based hashing BEST PRACTICE when connecting to upstream switches which are ―clustered upstream switches are ―clustered (vPC, VSS, VBS, Stack…)
    if the upstream switch cannot be clustered use mac pining
    good luck
    if helpful Rate

  • Could you provide sccripts to add old SAN disk groups to New SAN

    Hi,
    I'll giv u a brief about my setup. It is 2 node RAC connected to a SAN storage and size of DB is 500GB on Windows 2003. So now they r having a new storage box with 3TBand they asked to migrate this entire setup to new one. So please provide me the detailed doc on this.
    I've to migrate Database from OLD SAN to New SAN. Some guys helped me the solution, but i couldnt get clearly. They have told me that
    Simply add new LUNs to the existing disk groups. Drop the old SAN LUNs in the disk groups(this merely marks the LUNs to be dropped). Issue a re balance common to move and re stripe the data from the OLD SAN LUNs onto new SAN LUNs.once this operation is completed , ASM will Drop old LUNs from Disk groups and these LUNs can be physically removed. All this can happen with the instance running -it will be obvious of the underlying storage system change being made.
    So please provide me the scripts for the above with detailed process how we need to do that and i ma the only person DBA in organisation but i am not much aware about ASM. So please help me out to complete this task.
    Even i am new DBA...pls help me out
    Regards
    Poorna

    Hi
    Please drop me an email in the below given email id so that I can send you the note which I compiled just now for this.
    There is another question also from my end.....
    Where is OCR and VD stored ? That also will be in the old storage right ? If that also needs migration to the new storage, then there are some additional steps to migrate OCR and VD.
    But for that you will need a small downtime.
    Regards,
    Mahesh.
    [email protected]

  • Enabling Failover While creating the vNIC Template

    Hello all,
    As per my understanding enabling fail-over will create the secondary virtual path, which gives me the failover of vNIC automatically with the secondary virtual path that got created & the traffic will be routed towards another FI.
    While creating the vNIC templates & in most of the deployments i have seen.
    No one is considering the enable failover checkbox & I would like to know the pro's & corn's.
    In which situation do i need consider it ? What is the recommended practice?
    Looking forward for the suggestions.
    Regards,
    Gopi G

    Hi Gopi
    This failover flag made a lot of sense in the past, e.g. when Window server only supported one vnic.
    For VMware ESXi whether its vswitch, DVS, N1000v, it is recommended to not use this hardware failover flag, and let the OS switch handle it.
    see eg
    https://supportforums.cisco.com/discussion/12211096/vnic-enable-failover-or-use-vmware
    https://supportforums.cisco.com/discussion/12257101/cisco-ucs-network-uplink-aggregation-layer
    https://supportforums.cisco.com/document/72501/understanding-fabric-failure-and-failover-ucs
    https://supportforums.cisco.com/discussion/12387816/lan-or-san-pin-group-ucsm
    Walter.

  • Are UCS hardware upgrades service disruptive?

    Hi Community,
    Is fabric interconnect hardware upgrade from dual (clustered) 6120XP to dual 6248 service disruptive?
    Is adding a new 5108 chassis to the existing UCS configuration with dual 6120XP service disruptive?

    Thanks Kenny.
    1). I have actually been using this document for my project, and I think I worked out a pretty good migration plan based on it, but there are some grey areas/questions, MARKED IN BOLD CAPS. Could you clarify them for me?
    Step 1 Upgrade UCS firmware across all the devices to the same version - 2.1(1f). THE NEW 6248S CAN BE TEMPORARY CONFIGURED AS STANDALONE OR IN A CLUSTER FOR THE FIRMWARE UPGRADE, AND THEN THE CONFIGURATION SHOULD BE WIPED OUT AND THE FABRIC INTERCONNECTS POWERED OFF.
    Step 2 Using either the UCS manager CLI or GUI, verify the state (subordinate or active) of the existing (production) fabric interconnects.
    !!! Step 3 Back up the software configuration information and the UCS Manager software !!!
    Step 4 Disable the server ports on the subordinate fabric interconnect – NEW or EXISTING? THIS STEP IS CONFUSING AND IT IS REFERENCED IN STEP 17.
    Step 5 Power down the EXISTING subordinate fabric interconnect by unplugging it from the power source. If you are monitoring the upgrade using a KVM session, you may need to reconnect the KVM session when you power down the fabric interconnect.
                   THE NEW FABRIC INTERCONNECT(S) SHOULD BE POWERED OFF AT THIS POINT
    Step 6 Disconnect the cables running from the chassis IO Modules to the subordinate fabric interconnect ports in slot 1 (the old EXISTING fabric interconnect).
    Step 7 Connect these cables into the corresponding ports in slot 1 on one of the new Cisco UCS 6248 UP fabric interconnect, using the connection records to preserve the port mapping and the configured server pinning.
    See Fabric Interconnect Port Connection Record, on page 7.
    See Fabric Interconnect Upgrade Considerations, on page 1.
    Step 8 Disconnect the L1/L2, M1 management, and Console cables on the old fabric interconnect. The ports for these connections are on the opposite side of the interconnect, so if your cables are just barely long enough to connect two rack-adjacent UCS 6120 interconnects you will probably need new cables.
    Step 9 Connect the M1 management, and Console cables to the new Cisco UCS 6248 UP.
    Step 10 Connect the L1/L2 cables that were disconnected to the new Cisco UCS 6248 UP. L1 connects to L1, L2 connects to L2.
    Step 11 Disconnect the Ethernet or FC cables from slot 2 of the old fabric interconnect.
    Step 12 Connect the Ethernet or FC cables to the corresponding ports in slot 2 of the new Cisco UCS 6248 UP. Some may go to slot 1, depending on the mappings planned out earlier in the process
    I HAVE NO SLOT 2 ON THE NEW FABRIC INTERCONNECTS ON THE OLD ONES, SIX PORTS IN SLOT 2 ARE CONFIGURED AS FIBER CHANNEL PORTS. WILL I NEED TO MANUALLY CONFIGURE LAST SIX PORTS AS FC PORTS? IF YES, AT WHAT STEP IS THIS CONFIGURATION DONE, AND ARE THE FIBER CHANNEL CABLES SUPPOSED TO BE PLUGGED IN BEFORE OR AFTER THE PORTS ARE CONFIGURED AS FC PORTS?
    Step 13 Connect the power to the new Cisco UCS 6248 UP, it will automatically boot and run POST tests.
    Important:         Directly connect the console cable to a terminal and observe the boot sequence. You should at some point see the Basic System Configuration Dialog, where you will configure the switch as a subordinate interconnect. - IS THIS THE WIZARD THAT RUNS ON EVERY UNCONFIGURED FABRIC INTERCONNECT WHEN YOU POWER IT ON, WHEN YOU HAVE TO GIVE IP, NAME, DNS, ETC.? CAN I USE THE SAME IP THAT WAS ON THE OLD FABRIC INTERCONNECT?
    If you do not see this dialog, you either have different builds of software on your old primary and new subordinate, or the new subordinate has previously been part of a cluster and will need to have all configuration information wiped before it can be added to a cluster as a subordinate. In either case, immediately disconnect the L1 and L2 connections and complete the bringup as a standalone fabric interconnect, then correct the issue before proceeding further.
    I AM NOT SURE IF THE NEXT STEP IS APPLICABLE TO ME AT ALL, AS I DO NOT HAVE N10-E0440, I HAVE N10-E0060. COULD YOU COMMENT ON THIS?
    Step 14 (Optional) Remap UCS 6100 fabric interconnect FC ports 2/1 to 2/4 on a N10-E0440 expansion module or any slot 3 ports onto the new fabric interconnect expansion module.
    a) Use UCS Manager to delete the ports on the subordinate fabric interconnect that you will need to move within the configuration - WHERER DO I DELETE THE PORTS - ON THE NEW ONE?
    b) For each port you have just deleted, create new ports on either slot 1 or slot 2. These ports must use the same port type definitions as the old ports, but will use different port numbers.
    c) For recently moved Ethernet server ports, reconfigure the associated service profile to use the new port number for the appropriate LAN pin group.
    d) For recently moved uplink Ethernet ports, reconfigure the port channel settings to use the new ports.
    e) For recently moved uplink FC ports, reconfigure the associated service profile SAN pin group to use the new ports.
    f) Re-acknowledge chassis for blade servers and fabric extender for rack servers.
    This will be disruptive to traffic, but is necessary in this specific scenario. DO I LOOSE CONNECTIVITY FOR THE ENTIRE CHASSIS, OR JUST ONE FABRIC?
    Step 15 The new subordinate fabric interconnect will automatically synchronize the configuration and database/state information from the primary fabric interconnect. Synchronization between primary and subordinate fabric interconnects can take several minutes. The port configuration is copied from the subordinate switch to the new hardware.
    Step 16 Verify that the data path is ready.
    See Verifying that the Data Path is Ready.
    Make sure all faults are resolved before proceeding.
    a) Verify and if necessary reconfigure the SAN pin group for FC ports in the associated service profile.
    b) Verify and if necessary reconfigure the LAN pin group for Ethernet ports in the associated service profile.
    c) Verify and if necessary reconfigure the port channel for uplink Ethernet ports.
    THE FOLLOWING STEP IS ALSO CONFUSING. IF IT IS TALKING ABOUT THE OLD SUBORDINATE FABRIC INTERCONNECT THAT IS BEING REPLACED, WHY DO WE NEED TO ENABLE THE SERVER PORTS ON IT, THERE IS NOTHING CONNECTED TO IT. IF IT IS TALKING ABOUT THE NEW ONE - 6248, THEN, IT MEANS THEY HAVE TO BE DISABLED IN STEP 4, BUT IT MAKES NO SENSE, BECAUSE THEY ARE NOT SUPPOSED TO HAVE ANY CONFIGURATION ON IT. CAN YOU CLARIFY?
    Step 17 Enable the server ports that had been disabled in Step 4. -
    a) If you have changed port mappings, you may need to re-acknowledge the chassis or rack server connected to the subordinate fabric interconnect. DOES IT APPLY TO ALL TYPES OF PORTS – FC, SERVER, UPLINK ETHERNET PORTS?
    b) Verify and if necessary reconfigure Ethernet ports as server ports.
    Step 18 Promote the subordinate fabric interconnect to active, and repeat the process on the second Cisco UCS 6248 UP. Cable the second new fabric interconnect identically to the first, and allow the reconfiguration done to be applied to the second new fabric interconnect as well. DOES THE SECOND NEW 6248 NEED TO BE OFF OR ON WHEN CABLING IT? DO I NEED TO GO THROUGH THE WIZARD AT THE POWER ON TO MAKE IT A PART OF THE CLUSTER?
    See Forcing a Fabric Interconnect Failover.
    2). Does CISCO have a document outlining the steps for adding a chassis?
    Regards,
    Maxim.

  • 6120XP to 6248UP Upgrade - Port remap require chassis re-ack?

    According to the upgrade guide, step 14f, a chassis re-acknowledgement is required when you change the FC port mapping.  Can anyone confirm that this is valid?  I ask because at this point in the steps the server ports are still down so no chassis is technically connected so why would a re-acknowledgement be required?  It says a chassis re-acknowledgement is disruptive and I thought an upgrade from a 6120XP to 6248 would be non-disruptive.
    Any clarification would be excellent. 
    Thanks,
    -Jason
    Upgrade guide: 
    http://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/sw/upgrading/from2-0/to2-0MR/b_UpgradingCiscoUCSFrom2-0To2-0MR/b_UpgradingCiscoUCSFrom1-4To2-0_chapter_0101.html#d8429e24a1635 

    Hi Jason
    I think this comment is very misleading.
    I don't know a single UCS installation that is using LAN and/or SAN pin groups.
    The only reason to do a chassis ack: if you change the server ports connecting the IOM in the chassis.
    No chassis ack necessary if you change FC uplink ports assignments.
    Walter.
    Step 14   (Optional)Remap UCS 6100 fabric interconnect FC ports 2/1 to 2/4 on a N10-E0440 expansion module or any slot 3 ports onto the new fabric interconnect expansion module.
    Use UCS Manager to delete the ports on the subordinate fabric interconnect that you will need to move within the configuration.
    For each port you have just deleted, create new ports on either slot 1 or slot 2. These ports must use the same port type definitions as the old ports, but will use different port numbers.
    For recently moved Ethernet server ports, reconfigure the associated service profile to use the new port number for the appropriate LAN pin group.
    For recently moved uplink Ethernet ports, reconfigure the port channel settings to use the new ports.
    For recently moved uplink FC ports, reconfigure the associated service profile SAN pin group to use the new ports.
    Re-acknowledge chassis for blade servers and fabric extender for rack servers.This will be disruptive to traffic, but is necessary in this specific scenario.

  • UCSM wishlist

    Hello all,
    I would like to ask you if there is some wishlist for future UCS Manager features?
    I have some of those in my mind and there's no place to post them.
    For example see these:
    moving and copying of objects between sub-organizations (let's say I want to have similar, but different, policies in different sub-orgs and don't want to recreate them from scratch in each sub-org) - it would definitely save some time while implementing
    renaming objects - most of object cannot be renamed as the name is probably a primary key in UCSM's DB, in such a case you have to delete the object and create a new one (can you imagine something like this for a VLAN used in production?)
    server BMC IP adress would be part of the service profile (let's say you are using DPM in the VMware DRS cluster, there's no other way to wake up the blade than to use IPMI. But what if you move the service profile? Then the the DPM could accidentaly shutdown different blade than it should!)
    the pin groups can't have more than one port on each fabric (in multi-tenant environment with separated LAN and SAN clouds for each tenant this would be helpful a lot until there is no way to port channel the FC uplinks - CVD for multi-tenant environment assumes all the infrastructure including LAN and SAN is multi tenant as well)
    These are only a few of many ideas which are out there so it would help to have some way how to tell those to UCSM developers.
    If there is please let me know about it, I haven't found any yet.
    Thanks Josef

    Josef, this is great feedback.
    The best would be to work with your cisco account team / sales team and put those in as enhancement request. Raising a business case is useful.
    I just relayed your wish list to product management for their input.
    Please support CSC Helps Haiti
    https://supportforums.cisco.com/docs/DOC-8895
    https://supportforums.cisco.com

  • How to send relevant alerts to different groups?

    I have an environment where different teams own different aspects of the UCS environment. For example, operations is responsible for the environment and physical hardware, architecture is responsible for the configuration (policies, pools, profiles), and the network team is responsible for both LAN and SAN down to the blade. I'm trying to find a means of setting up call home profiles such that each team can get their relevant alerts, but I don't see how that's really possible within UCSM.
    Something that seems promising is alert groups, but I can't find any documentation on how/if they map to user roles or what alerts might fall into an alert group? The documentation meantions the alert groups, but without any description of what each alert group does or how they should be used. Some seem obvious (eg. Environmental) while others are vague (Syslog Port?). Any ideas?

    Brad,
    I've requested our docs team improve the details regarding the CallHome alert groups.  I don't know the specifics of each alert group myself, but when I find out I'll update this thread.
    Regards,
    Robert

  • When to user Availability Group versus traditional Clustered SQL Server

    Hi...
    I'm trying to get my arms around when to use an SQL Server 2014 Availability Group. Here are the characteristics about my platform:
    2 physical servers (Windows Server 2012 / SQL Server 2014)
    Both servers connected to same LAN
    External SAN storage connected DIRECTLY to each physical server via fibr3-channel. (No fibre-channel switch)
    Database resides on SAN storage.
    I've set up a failover cluster between the 2 physical servers.
    I've created a high availability group with a Primary/Secondary and synchronization.
    Both Primary/Secondary are green and show synchronized. The concern I have is that the Primary says Synchronizing (No Data Loss) and the Secondary says Not Synchronizing (Data Loss). When I use the Failover Wizard to failover, it tells me that I will have
    data loss on the Secondary.
    So my questions are these, do you need more than one Secondary node to have an effective Availability Group? If I only plan to have the 2 physical servers, should I be setting up a traditional Clustered SQL Server installation.
    I've used the traditional Clustered SQL Server in the past and used the Active/Passive licensing for the SQL Server software but the Always On Availability Group looked interesting to me, but NOT if it requires more than 2 physical servers and more
    than 2 SQL Instances (and licenses) to provide proper failover capability.
    All input will be appreciated.
    Thanks,
    Brett

    Hi Brett,
    An AlwaysOn Availability Group is created between several standalone SQL Server instances, you don’t need to set up a traditional clustered SQL Server installation when configuring AlwaysOn Availability Group. Also you can have an effective Availability Group
    with only one Secondary node.
    From your description, you have an synchronous-commit availability secondary replica
    and it says Not Synchronizing. This issue can be caused by the following:
    •The availability replica might be disconnected.
    •The data movement might be suspended.
    •The database might not be accessible.
    •There might be a temporary delay issue due to network latency or the load on the primary or secondary replica.
    Please resolve any connection or data movement suspend issues. You can check the events for this issue using SQL Server Management Studio, and find the database error.
    Reference:
    Data synchronization state of some availability database is not healthy
    Availability databases in unhealthy data synchronization state (Error: 35285, Severity: 16, State: 1.)
    Thanks,
    Lydia Zhang
    If you have any feedback on our support, please click
    here.
    Lydia Zhang
    TechNet Community Support

  • OVM 3 Generic Storage Plugin. Acess Group configuration causes server crash

    Our iSCSI management is currently entirely done manually at the servers console, because we still don't have a SAN Equallogic storage plugin.
    At OVM Manager interface, what we thought being just useless in our case (SAN Access Group), is the actual iSCSI connection (and disconnection..) management for servers.
    Following the upgrade to 3.2.1, setting up the SAN did nothing more than what we do manually. But undoing part of it caused the crash.
    All over OVM Manager, any operation/setup that could impact running VMs is denied... Except there, at the real root of everything.
    Removing a iSCSI initiator from that panel disconnects abruptly the iSCSI disk, !!!! without warning !!!!.
    Then, after the 60s timetout, the physical server reboots.
    It is still not clear if we get a benefice to setup that "Access Group" of the SAN or not. At least, once setup, we know that we'd better keep it...

    Updating OVM 3 host to use "brbond0" vs "xend" managed bridge to allow direct hosting of OVM Manager VM.
    Update "ifcfg-bond0",
    [root@ovm322 ~]# cat /etc/sysconfig/network-scripts/ifcfg-bond0
    DEVICE=bond0
    BONDING_OPTS="mode=1 miimon=250 use_carrier=1 updelay=500 downdelay=500 primary=eth0"
    ONBOOT=yes
    BRIDGE=brbond0
    Create "ifcfg-brbond0",
    [root@ovm322 ~]# cat /etc/sysconfig/network-scripts/ifcfg-brbond0
    DEVICE=brbond0
    BOOTPROTO=bridge
    ONBOOT=yes
    IPADDR=A.B.C.D                                                       # IP address of ovm322
    NETMASK=255.255.254.0
    NETWORK=A.B.C.0
    GATEWAY=A.B.C.1
    Update  "/etc/xen/xend-config.sxp",
    # Enable network-bridge, JAP 20120618
    # Disable network-bridge, JAP 20131223
    #(network-script network-bridge)
    Update  "vif" for OVM Manager 3 "vm.cfg",
    [root@ovm322 ~]# grep ^vif /etc/xen/auto/ovm322-m
    vif = ['type=netfront, bridge=brbond0']

  • I want to force lan cable plugin during login process on 802.1x computer only weird client

    Hi
    I Configured Wired and computer only  802.1x authentications on all my switch and client on my network  ,It works without any problem .
    I have user logon script to change local administrator password each time they log on ,I recently find out they boot with light cd and change the administrator password and unplug the lan cable boot the system and login with new administrator password after
    that they plug lan cable , as they computer account is valid in active directory they are authorized and access the LAN .
    they bypass some group policy by this way,
    how can I force 802.1x wired client computer to plug lan cable during boot and login process in order to prevent bypass user login group policy  ?
    I want to force lan cable plugin during login process on 802.1x computer only weird client?
    Rigards

    Hello,
    you can disable CD/USB with GPO settings to prevent the use from it.
    And for the change from the local admin password you should consider that the CEO of the company should make clear policies so users can legally be punished if they don't work with the company rules.
    You can manage lot of settings with scripts etc. BUT there is a time where the CEO is responsible about rules.
    Best regards
    Meinolf Weber
    MVP, MCP, MCTS
    Microsoft MVP - Directory Services
    My Blog: http://blogs.msmvps.com/MWeber
    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
    Twitter:  

  • Fcoe for ethernet AND san

    I'm having a bit of a brain fart....
    I see that you can create an "unified" uplink from the 6248s to an upstream Nexus 5k.  Can I use this single uplink for both VSAN and VLAN traffic, or si the best practice to separare them into an Ethernet uplink and a FCOE San uplink?
    Thanks in advance.

    I'm not sure of any immediate disadvantages.  A lot of design related inputs to separate LAN and SAN are related to pacing the integrating of the two networks. 
    If your already running FCoE and your not migrating from a pure LAN and Fibre channel environment to FCoE - then I'd run both on a unified link.
    Please rate helpful posts.

  • DCNM-SAN & VMware

    Hello,
    In the release notes for DCNM 5.2, it states that DCNM-LAN can be installed as a virtual machine.  However, no where does it state that DCNM-SAN can be installed as a virtual machine.  So my question is can DCNM-SAN be run as a VM?  It would make sense that this would be allowed since LAN and SAN can now exist on the same box with 5.2 but it wouldn't make sense if SAN was not supported as a VM when LAN is.  Thanks.

    http://www.cisco.com/en/US/customer/docs/switches/datacenter/sw/5_x/dcnm/release/notes/dcnm_5_2_relnotes.html#wp61633
    Supported as of 5.2 per the release notes above. And both can coexist in the same VM.
    This is the validation from the release note:
    The Cisco DCNM server can run within a virtual machine, and requires one of the supported Windows or Linux operating systems listed in this section.
    Specifics for the host OS can be found in the release notes.
    Hope that helps,
    Cary Cube'
    CSE, CISCO

  • Group Folder -- Permissions Get Lost/Denied

    We have a small LAN with a single group folder on an AFP network mount. The protocol is set to "inherent permissions" and I've promulgated this to the folder at least once. The owner is "admin" and the group is set to the short name of my workgroup. All (including "everyone") have permission to read/write. Every user is in the group. The acl list is empty, and the network mount is set to "use for: user home directories" (the latter because there is no option to select 'use for group folder.'
    The folder is set to mount at login. (Users login at login, tho their homes are local.) All works fine, BUT after a while, the permissions to use the folder and its contents gets lost and the user is denied access.
    A logout usually restores the right to use the folder, but this is driving me/my users crazy. Any aid much appreciated.

    i'm seeing something very similar but not with a group folder. my users are constantly loosing their permissions on files within sharepoints that they should have access to. they have to log out of the server and log back in to restore the correct permissions.
    is anybody else seeing this? it's becoming a huge problem and happens daily now.

Maybe you are looking for