Multicast Mroute behavior for local VLAN multicast (with overlap)

We have a multicast address that exists at various locations but we want to isolate them at each location to a single VLAN. We run PIM Sparse with anycast RP throughout our Enterprise. Our original thought was to just turn off PIM on the SVI/VLAN at a campus and isolate that multicast to the VLAN it is in.
We are still learning the Multicast address via PIM from the other sites we have not turned PIM off yet (since it is an overlapping address). The question came up that if you disable PIM for that VLAN/SVI would the multicast stay local if the default gateway for that VLAN still has a multicast route it learned via PIM from another site? Or would that VLAN without PIM still use the mroute table to connect to the Multicast address?

Paul
Sorry, i didn't realise this was addressed to me.
To be honest i have never used this command but reading up on it it would seem you certainly could block the flow of multicast packets between the interface for the group(s) you wanted to so it would be a way of isolating traffic between vlans.
In terms of the RP announcement messages there is a keyword you can add to the command "filter-autorp" which filters discovery and announcement messages as well. But i wouldn't like to say for sure exactly how it would or wouldn't work without testing ie. do you need to filter the RP announcements before they reach the SVI or would it work applied to the SVI.
I could see a use for this if you had a number of SVIs that needed to route the multicast stream between themselves but not to other L3 subnets. But the topology would be a little difficult on a L3 switch ie. if half the SVIs need to route the multicast stream but the other half didn't where do you apply the command. It would have to be on each SVI you didn't want to receive the stream.
It would work better if, for example, you had a L3 switch connected to a router with L3 routed ports and all the SVIs should route the multicast stream but it should stay local to the L3 switch so it is blocked on the L3 uplink (and other potential streams from the router to the L3 switch blocked as well).
Hope that made some sense. It's sometimes difficult to explain things without a diagram
Jon

Similar Messages

Rescue and Recovery: No backups available for "local hard drive" with Full Restore

I can see all my backups in "view all backups" and can restore individual files, although when I select the option for "full restore", it reboots my PC and brings up the Rescue and Recovery interface which gives me the option for "full restore". When I select "full restore", it asks me to select the source.
As my backups are stored on my local hard drive, I select that source, however the scroll box is empty (no backups available for selection).
Can anyone recommend a solution to fix this problem, or should I remove and re-install Rescue and Recovery, then create new backups (and hope they appear in the list for full restore)?
I am running Rescue and Recovery 4.21.0016.00 on a Lenovo T61p with XP SP3.
Thanks.
Gary Grathen

Also, I have RnR 4.00.0117.00.
Where do I find and how do I delete these massive files?
Note from Moderator: Please update your profile with your correct country location as per the forum rules. Products, options and services vary from market to market. Knowing your location helps us help you.
Message Edited by nonny on 04-24-2008 02:15 PM

How to setup Autodiscovery for .local internal domains with Exchange 2013

Hi,
I need to know about how i set autodiscovery in local domain.I have local domain eg
abc.local and domin which i received the emails externally is xyz.com.
I have deployed Exchange2013 recently with same above scenario inbound and outbound mails are working fine using OWA.But outlook clients cannot connect to Exchange server with in the LAN.
Please help me out how set auto discovery in local domain and another help i need how i configure the self sign certificate in this scenario.

You cannot use a self signed cert for RPC/HTTP connections (which is how the Outlook client is connecting exchange2013). Please check this http://social.technet.microsoft.com/Forums/exchange/en-US/aed4ede9-57c3-44c3-90b4-bdfb3a7f017d/exchange-2013-self-signed-certs-and-outlook-client-access?forum=exchangesvrgeneral
But you can use a certificate from an internal CA which you can install in your network issue a certificate for exchange. Please check this it will help you manage internal certificates for a PC and for a domain. http://technet.microsoft.com/en-us/library/cc754841.aspx
You dont need to configure autodiscover for internal domain added clients. If you have clients on the network which are not members of the domain, using Exchange, this could be Windows, MACs or mobile devices, then you should ensure that autodiscover.example.com
resolves internally to the Exchange server via a split DNS system. http://exchange.sembee.mobi/network/split-dns.asp
Please configure your external and internal URLs as well
http://www.mustbegeek.com/configure-external-and-internal-url-in-exchange-2013/
I recommend to buy a 3rd party certificate as it may create issue for external clients e.g.Outlook anywhere
Thanks, MAS
Please mark as helpful if you find my comment helpful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Storage clause for locally manged tablespace with unifom size extents

in oracle 9i PERSONAL EDITION
I HAVE CREATED A TABLESPACE TEST1 AS LOCALLY MANAGED WITH UNIFORM SIZE AS 256K.MY DB_BLOCK_SIZE IS 4K
I HAVE CREATED A TABLE XYX IN THE TEST1 TABLESPACE WITH THE STORAGE (INITIAL 52K NEXT 52K)
WHEN I QUERIED THE DBA_EXTENTS IT SHOWS THE INITAIL EXTENT AS 256 K
BUT WHEN I QUERIED THE DBA_SEGMENTS IT SHOWS THE INITAL_EXTENT AS 52K.
IS THEIR ANY SIGNIFICANCE OF SPECIFYING THE STORAGE CLAUSE IN LOCALLY MANAGED TABLESPACES.

take a example what is effect of set storage parameter in table whoes tablespace is locally manager and have uniform size
i have a tablespace whoes
[b]uniform size is 32k
but when i create a table then i set initial 128k
now when table is create it create 4 extent
of 32 each(32*4=128)
because tablespace uniform size is 32
if we give intial 256 then it create
8 extent(32*8=256)
like
create tablespace tt_check
datafile 'E:\ORACLE\SAFE_DATA\tt_check.dbf' size 10m
extent management local uniform size 32k;
create table tt_1
(no number)
tablespace tt_check
storage(initial 128k
next 128k);
1* select extent_id,segment_name,tablespace_name,bytes from dba_extents where segment_name='TT_1'
QL> /
EXTENT_ID SEGMENT_NAME TABLESPACE_NAME BYTES
0 TT_1 TT_CHECK 32768
1 TT_1 TT_CHECK 32768
2 TT_1 TT_CHECK 32768
3 TT_1 TT_CHECK 32768
hope it will help you
kuljeet pal singh

Poplist behavior for selecting value starting with a letter

Hi
I have got a poplist in a control block in my form. This is a database item and is populated fine.
Now, the problem is if I want to select one record in the poplist starting with a particular letter, in-one-go, it is not possible..
For example, I know that the value in the poplist I want, starts with the letter 'D'
There are 10 values in the poplist that starts with the letter 'D' and I want to select the 6th value that starts with 'D'.What I want is, when I type in 'D', the poplist should pass controlto the (i.e. select) first element in the list, which starts with 'D'...then it should still remain as popped.The user should be allowed to navigate to all "D's" either using up arrow, down arrow or by typing in the letter D itself..
Now what happens is, if I type in 'D' in the keyboard, the first value among the list that starts with 'D' is selected by the poplist and the records corresponding to this value is displayed.
The up arrow/down arrow works fine in the following case now - If I click on the poplist, but do not actually select any item and just use up arrow, downarrow, it works...
But the real requirement is when typing in any letter, any value in the poplist need not get selected ,but the poplist values should popped up so that the user can browse on it, and then select the required value.
I will be grateful if somebody gives me the code for this and also tell me which trigger to put in the code?Any property needs to be changed?
At the moment , my when-list-changed trigger is as follows..Also want to know, if this need to be changed at all?
go_block('MY_DATABLOCK');
clear_block(no_validate) ;
execute_query;Edited by: Krithi on 12-Aug-2009 04:12

Krithi wrote:
You have moved far away from what I really need
I DO NOT use a webform and I dont need to use Javabean in my form!You never mentioned anywhere that YOU DO NOT use a webform. One more reason why you should mention your forms version when you post some questions ;-) which would help others to respond with relevant answer.
Its just the normal form.
I said I have just seen examples in web forms but I believe it is do-able in normal forms too..Pls help someone?I am afraid you do not have much choice in client server.
-Arun

Dynamic VLAN Assignment with RADIUS Server and Aironet Access Points

Hi Guys,
I would like to go for "Dynamic VLAN Assignment with RADIUS Server and Aironet Access Points 1300". I want the AP to broadcast only 1 SSID. The client find the SSID ->put in his user credential->Raudius athentication->assign him to an specific vlan based on his groupship.
The problem here is that I don't have a AP controller but only configurable Aironet Access Points 1300. I can connect to the radius server, but I am not sure how to confirgure the AP's port, radio port, vlan and SSID.
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml#switch
I go through some references:
3.5 RADIUS-Based VLAN Access Control
As discussed earlier, each SSID is mapped to a default VLAN-ID on the wired side. The IT administrator may wish to impose back end (such as RADIUS)-based VLAN access control using 802.1X or MAC address authentication mechanisms. For example, if the WLAN is set up such that all VLANs use 802.1X and similar encryption mechanisms for WLAN user access, then a user can "hop" from one VLAN to another by simply changing the SSID and successfully authenticating to the access point (using 802.1X). This may not be preferred if the WLAN user is confined to a particular VLAN.
There are two different ways to implement RADIUS-based VLAN access control features:
1. RADIUS-based SSID access control: Upon successful 802.1X or MAC address authentication, the RADIUS server passes back the allowed SSID list for the WLAN user to the access point or bridge. If the user used an SSID on the allowed SSID list, then the user is allowed to associate to the WLAN. Otherwise, the user is disassociated from the access point or bridge.
2. RADIUS-based VLAN assignment: Upon successful 802.1X or MAC address authentication, the RADIUS server assigns the user to a predetermined VLAN-ID on the wired side. The SSID used for WLAN access doesn't matter because the user is always assigned to this predetermined VLAN-ID.
extract from: Wireless Virtual LAN Deployment Guide
http://www.cisco.com/en/US/products/hw/wireless/ps430/prod_technical_reference09186a00801444a1.html
==============================================================
Dynamic VLAN Assignment with RADIUS Server and Wireless LAN Controller Configuration Example
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml#switch
==============================================================
Controller: Wireless Domain Services Configuration
http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c951f.shtml
Any help on this issue is appreicated.
Thanks.

I'm not sure if the Autonomous APs have the option for AAA Override. On the WLC, I can go into the BSSID, Security, Advanced, and there's a checkbox that I would check to allow a Radius server to send back the VLAN.
I did a little research and it looks like the 1300 may give this option but instead is defined as "VLAN Override". I've found the release notes for 12.3(7)JA5 (not sure what version you're running) that give mention and a link to configuring EAP on page 4: http://www.ciscosystems.ch/en/US/docs/wireless/access_point/1300/release/notes/o37ja5rn.pdf
Hope this helps

Cisco Catalyst 6500 version 12.2(33)SXI13 configured as DHCP server for a VLAN responds to Windows 7 client with status code NOA

Can anyone help figure out why the Catalyst 6509 is not able to assign an IPv6 address? Thank you.
Cisco Catalyst 6500 version 12.2(33)SXI13 configured as DHCP server for a VLAN responds to Windows 7 client with status code NOADDRS-AVAIL(2). My configuration on the 6500 for the DHCPv6 server is:
ipv6 dhcp database disk0://DHCPV6-DB
ipv6 dhcp pool VLAN206IPV6
prefix-delegation pool VLAN206IPV6-POOL
dns-server 2620:B700:0:1001::53
domain-name global.bio.com
ipv6 local pool VLAN206IPV6-POOL 2620:B700:0:12C7::/65 65
interface Vlan206
description *** IPv6 Subnet ***
ip address 10.2.104.2 255.255.255.0
ipv6 address 2620:B700:0:12C7::2/64
ipv6 nd prefix 2620:B700:0:12C7::/64 14400 14400 no-autoconfig
ipv6 nd managed-config-flag
ipv6 dhcp server VLAN206IPV6
standby version 2
standby 0 ip 10.2.104.1
standby 0 preempt
standby 6 ipv6 2620:B700:0:12C7::1/64
standby 6 preempt
I'm getting a result from my debug as follows:
Apr 10 16:28:02.873 PDT: %LINK-3-UPDOWN: Interface GigabitEthernet2/2, changed state to up
Apr 10 16:28:02.873 PDT: %LINK-SP-3-UPDOWN: Interface GigabitEthernet2/2, changed state to up
Apr 10 16:28:02.877 PDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/2, changed state to up
Apr 10 16:28:03.861 PDT: IPv6 DHCP: Received SOLICIT from FE80::5D5E:7EBD:CDBF:2519 on Vlan206
Apr 10 16:28:03.861 PDT: IPv6 DHCP: detailed packet contents
Apr 10 16:28:03.861 PDT: src FE80::5D5E:7EBD:CDBF:2519 (Vlan206)
Apr 10 16:28:03.861 PDT: dst FF02::1:2
Apr 10 16:28:03.861 PDT: type SOLICIT(1), xid 8277025
Apr 10 16:28:03.861 PDT: option ELAPSED-TIME(8), len 2
Apr 10 16:28:03.861 PDT: elapsed-time 101
Apr 10 16:28:03.861 PDT: option CLIENTID(1), len 14
Apr 10 16:28:03.861 PDT: 00010001195FD895F01FAF10689E
Apr 10 16:28:03.861 PDT: option IA-NA(3), len 12
Apr 10 16:28:03.861 PDT: IAID 0x0FF01FAF, T1 0, T2 0
Apr 10 16:28:03.861 PDT: option UNKNOWN(39), len 32
Apr 10 16:28:03.861 PDT: option VENDOR-CLASS(16), len 14
Apr 10 16:28:03.861 PDT: option ORO(6), len 8
Apr 10 16:28:03.861 PDT: DOMAIN-LIST,DNS-SERVERS,VENDOR-OPTS,UNKNOWN
Apr 10 16:28:03.861 PDT: IPv6 DHCP: Option IA-NA(3) is not supported yet
Apr 10 16:28:03.861 PDT: IPv6 DHCP: Sending ADVERTISE to FE80::5D5E:7EBD:CDBF:2519 on Vlan206
Apr 10 16:28:03.861 PDT: IPv6 DHCP: detailed packet contents
Apr 10 16:28:03.861 PDT: src FE80::21D:E6FF:FEE4:4400
Apr 10 16:28:03.861 PDT: dst FE80::5D5E:7EBD:CDBF:2519 (Vlan206)
Apr 10 16:28:03.861 PDT: type ADVERTISE(2), xid 8277025
Apr 10 16:28:03.861 PDT: option SERVERID(2), len 10
Apr 10 16:28:03.865 PDT: 00030001001DE6E44400
Apr 10 16:28:03.865 PDT: option CLIENTID(1), len 14
Apr 10 16:28:03.865 PDT: 00010001195FD895F01FAF10689E
Apr 10 16:28:03.865 PDT: option STATUS-CODE(13), len 15
Apr 10 16:28:03.865 PDT: status code NOADDRS-AVAIL(2)
Apr 10 16:28:03.865 PDT: status message: NOADDRS-AVAIL

Hello,
maybe hitting the following bug.
Pv6 Address Assignment Support for IPv6 DHCP Server
CSCse81385
Hope this helps

Error "Unable to load word breaker for locale 0. Error code 8007007e." with search service application.

I recreate the Search service application and the default Content source stayning in the 'Recovering' status.
The log give multiple error 'Unable to load word breaker for locale 0. Error code 8007007e.'
The default language is English and the reference in registry for word breaker dll is naturallanguage1.dll but I found only the naturallanguage6.dll.

Hi,
For your issue, check your current language settings and ensure that search supports the current language.
On the SharePoint Server open Registry Editor (Start -> type “Regedit” and hit enter).
Point to : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeServer\14.0\Search\Setup\ContentIndexCommon\LanguageResources\Default\English
Under the registry key for each of the languages there is a value called StemmerDLLPath and WBDLLPathOverride
Updated the registry entry with NATURA~1.dll to NATURA~2.dll
Point to Start -> Administrative Tools -> Services, right click on SharePoint Server Search 14 and click on Restart.
Performed a Full Crawl and wait for the Full Crawl to complete and try searching again.
For more detailed information, refer to the following blogs:
http://blog.ithinksharepoint.com/2008/04/20/a-word-breaker-was-not-found-for-the-given-language-error-when-crawling-content/
http://www.sharepoint2013.me/Blog/Post/175/Word-breakers-in-SharePoint-2013
Best Regards,
Lisa Chen
Lisa Chen
TechNet Community Support

Can I use the Galaxy in Germany if it's "unlocked" with a local SIM (for local rates)?

Can I use this phone in Germany with a *local* SIM card for local rates if I get Verizon to unlock it or do I have to wait for the ever-elusive upgrade for this to be possible?
I have been with Verizon since 2006, my original HTC Incredible has been eligible for an upgrade since April, and I was planning to stay with Verizon since I'm overall happy with the service. However, this uncertainty about being able to use the phone globally (and specifically in Germany) with local SIM cards has me considering other carriers for the first time, who have not crippled their phones in this way. In particular AT&T I guess. I don't understand why Verizon would choose to limit their phone like this.
I would like to stay with Verizon, but I'm not going to wait indefinitely for a required update -- unless someone authoritative can tell me that I am able to use this phone with a local SIM card with local rates in German right now. That would make me very happy .. otherwise, I guess it's time to check out the Galaxy on the other carriers.
ps: I have searched the web, and this forum for related posting w/o the answer for this specific question about unlock helping with Germany.

Hmm .. thanks for the info, I was afraid of that .. I'v really been wanting to upgrade my phone for a few months now ... and the S III seems like the best phone right now, but not without that feature. I would rather stick with Verizon though but I am looking at the other carriers because of this.
Also just found out that FM radio isn't available on the North American versions of the phone .. too bad, my DInc has it, and it helps limit data usage (and presumably uses less power than streaming, plus not all stations stream). It's not a required feature for me, but it was a nice option to have..

HT1495 I have moved to live in Abu Dhabi. I have an iPhone with UK chip that I need to keep for UK contact and business, but now want to buy an iPhone in Abu Dhabi with a UAE chip for local use in AUH. Can I have them both sync'd, and also my other device

I have moved to live in Abu Dhabi. I have an iPhone with UK chip that I need to keep for UK contact and business, but now want to buy an iPhone in Abu Dhabi with a UAE chip for local use in AUH. Can I have them both sync'd, and also my other devices??

SkyDaughter29 wrote:
My current situation: I have soooo many texts on my iphone and I haven't deleted many because I need the information contained in them for future reference and for legal purposes. I would really like to find a means and way to save them other than on the phone itself. I've done searches for various apps yet I'm not finding what I think I would need. It appears Apple does not sync the texts between the iphone and my MacBook Pro.
Try the computer apps PhoneView (Mac) or TouchCopy (Mac & PC):
http://www.ecamm.com/mac/phoneview/
http://www.wideanglesoftware.com/touchcopy/index.php
Best of luck.

Waiting for local disks??? problems with fans and starting up

Hello and please help me. My late 03 Mac isn't loading up. It gets past the grey bit and onto the loading part where everythings going fine until it stops on 'waitng for local disks' the fans then start to go nuts and I have to switch it off manually cos nothing is responding and I fear it may blow up. There's no disks in the drive and I've tried pressing the pmu button, disconnecting the wires and rebooting it from the original disk (when I do the latter it simply loads back up and stops at, yep you guessed it...waiting for local disks)
Any suggestions before I take it into an apple store?

Hi! Try restarting with the mouse button down to eject the disc. After you get the disc out if it still won't boot hold the option key down until the disk comes up and you can select the correct one to start from. All else fails boot from the install disc ("c" key down at startup with the disc inserted) and run the repair disk function of disk utility as per THIS. Tom

VLAN concept with WLC

Hi guys,
This is my VLAN background:
VLANs are used to segment the network and break up the broadcast domains in order to reduce congestion and isolate network problems as well as providing scalability, performance improvement, security and making network additions, moves, and changes easier and more manageable.
And this is my wireless VLAN background with the controllers:
Host A is a wireless LAN client communicating with the wired device, Host B. At the access point, the access point adds an LWAPP Header to the frame and send it to the controller. After processing the 802.11 MAC Header by WLC, it extracts the payload (the IP packet), encapsulates it into an Ethernet frame, and then forwards the frame onto the appropriate wired network, typically adding an 802.1Q VLAN tag.
According to Cisco's "Fundamentals of Wireless Controllers" video (starting at 2:53), the 5508 controller allows you to use much larger subnets and less wireless VLANs. So with a 5508 controller in a completely wireless infrastructure (no wired hosts),
1. I don't need to break up broadcast domains and have multiple subnets and I'm free to use a giant flat network?
2. If I'm allowed to use large subnets, as far as the broadcast traffics (other than ARP and DHCP which are specially handled by WLC) are concerned, how does the controller handle that? I think I still will need multiple VLANs to control them according to my following WLC broadcast handeling background:
"All traffic including broadcast sent to any destination by wireless client get forwarded to WLC from its connected AP. WLC places the broadcast message on to that VLAN, both wired and wireless clients that are part of that vlan interface will get this broadcast message. Now, the receiving wireless clients on that vlan can be associateded on to any/different APs, APs mapped to different AP groups, even APs using different L3 addresses from one or multiple WLCs, WLC inteligently identifies the mapped VLAN interfaces and its respective APs through AP group and forwards the broadcast(encapsulates) as Multicast packet to those specific AP groups. Once APs receives the Multicast(broadcast), it places it on the respective Radio's BSSID(where WLAN/ssid mapped) of AP to reach the right wireless client. AP Radio's BSSID to SSID/WLAN to interface mapping is pushed to AP by WLC at AP join. Also, Wired PCs will receive the broadcast on its vlan as tagged(if tagged, otherwise untagged) from WLC's interface, so does the other WLCs that spans this vlan interface."
Regards,
Saman

You should still follow your best practice for your subnet size. Remember that wireless is half duplex and only one device can talk at a given time. Also... The AP can be in a different vlan, ap group, etc, but the clients are still on the same vlan. So it means that the clients need to be on the same vlan, but the AP's can be on a different subnet since this doesn't matter.
Sent from Cisco Technical Support iPhone App

ISE 1.1.1 (Fallback to local Vlan if radius server is found to be dead) not working

We have configured following commands on switch to fallback to local Vlan if both radius server (policy persona's) is found dead. For test purpose we shutdown both servers (policy persona's) but fallback didn't work. We have 3750 switch running image 12.2(55)SE6 having following configuration.
We do not know whether we configured switch in proper way or do we need to modify it.
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting update periodic 5
aaa accounting auth-proxy default start-stop group radius
aaa accounting dot1x default start-stop group radius
aaa accounting system default start-stop group radius
aaa server radius dynamic-author
client 10.10.10.10 server-key 7 12345678 (Policy Persona 1)
client 10.10.10.11 server-key 7 12345678 (Policy Persona 2)
server-key 7 12345678
ip device tracking
epm logging
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 30 tries 3
radius-server host 10.10.10.10 auth-port 1812 acct-port 1813 key 7 12345678 (Policy Persona 1)
radius-server host 10.10.10.11 auth-port 1812 acct-port 1813 key 7 12345678 (Policy Persona 2)
radius-server vsa send accounting
radius-server vsa send authentication
Port Configuration
interface GigabitEthernet0/1
switchport access vlan 305
switchport mode access
ip access-group ACL-DEFAULT in
authentication event fail action next-method
authentication event server dead action reinitialize vlan 305
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
Please help....
Thanks

Tabish-
The pre-auth ACL that you have on your port is used for what's called a "Low-Impact" mode type of setup. With Low-Impact mode you are allowing services defined in the pre-auth ACL until the user/devices is authenticated. Once authenticated the pre-auth ACL gets replaced with the dACL/authorization policy that you have defined in the authorization profile. As a result, it is not possible to use "fail-open" configuration with low-impact as there is nothing to replace that pre-auth ACL since your NAD device(s) are unavailable.
If you want to use the "fail-open" features you will have to use the "High Securty/Closed Mode." In that mode you cannot utilize the pre-auth ACL and essentially only EPoL traffic is allowed on port until authenticated.
For more info you should reference the TrustSec design guide located at:
http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html
Thank you for rating!

Best Practice for VPC Domain failover with One M2 per N7K switch and 2 sups

I Have been testing some failover scenarios with 4 nexus 7000 switches with an M2 and an F2 card in each. Each Nexus has two supervisor modules.
I have 3 VDC's Admin, F2 and M2
all ports in the M2 are in the M2 VDC and all ports on the F2 are in the F2 VDC.
All vPC's are connected on the M2 cards, configured in the M2 VDC
We have 2 Nexus representing each "site"
In one site we have a vPC domain "100"
The vPC Peer link is connected on ports E1/3 and E1/4 in Port channel 100
The peer-keepalive is configured to use the management ports. This is patched in both Sups into our 3750s. (this is will eventually be on a management out of band switch)
Please see the diagram.
There are 2 vPC's 1&2 connected at each site which represent the virtual port channels that connect back to a pair of 3750X's (the layer 2 switch icons in the diagram.)
There is also the third vPC that connects the 4 Nexus's together. (po172)
We are stretching vlan 900 across the "sites" and would like to keep spanning tree out of this as much as we can, and minimise outages based on link failures, module failures, switch failures, sup failures etc..
ONLY the management vlan (100,101) is allowed on the port-channel between the 3750's, so vlan 900 spanning tree shouldnt have to make this decision.
We are only concerned about layer two for this part of the testing.
As we are connecting the vPC peer link to only one module in each switch (a sinlge) M2 we have configured object tracking as follows:
n7k-1(config)#track 1 interface ethernet 1/1 line-protocol
n7k-1(config)#track 2 interface ethernet 1/2 line-protocol
n7k-1(config)#track 5 interface ethernet 1/5 line-protocol
track 101 list boolean OR
n7k-1(config-track)# object 1
n7k-1(config-track)# object 2
n7k-1(config-track)# object 5
n7k-1(config-track)# end
n7k-1(config)# vpc domain 101
n7k-1(config-vpc-domain)# track 101
The other site is the same, just 100 instead of 101.
We are not tracking port channel 101, not the member interfaces of this port channel as this is the peer link and apparently tracking upstream interfaces and the peer link is only necessary when you have ONE link and one module per switch.
As the interfaces we are tracking are member ports of a vPC, is this a chicken and egg scenario when seeing if these 3 interfaces are up? or is line-protocol purely layer 1 - so that the vPC isnt downing these member ports at layer 2 when it sees a local vPC domain failure, so that the track fails?
I see most people are monitoring upstream layer3 ports that connect back to a core? what about what we are doing monitoring upstream(the 3750's) & downstream layer2 (the other site) - that are part of the very vPC we are trying to protect?
We wanted all 3 of these to be down, for example if the local M2 card failed, the keepalive would send the message to the remote peer to take over.
What are the best practices here? Which objects should we be tracking? Should we also track the perr-link Port channel101?
We saw minimal outages using this design. when reloading the M2 modules, usually 1 -3 pings lost between the laptops in the diff sites across the stretched vlan. Obviously no outages when breaking any link in a vPC
Any wisdom would be greatly appreciated.
Nick

Nick,
I was not talking about the mgmt0 interface. The vlan that you are testing will have a link blocked between the two 3750 port-channel if the root is on the nexus vPC pair.
Logically your topology is like this:
| |
| Nexus Pair |
3750-1-----------------------3750-2
Since you have this triangle setup one of the links will be in blocking state for any vlan configured on these devices.
When you are talking about vPC and L3 are you talking about L3 routing protocols or just intervaln routing.
Intervlan routing is fine. Running L3 routing protocols over the peer-link and forming an adjaceny with an router upstream using L2 links is not recommended. Teh following link should give you an idea about what I am talking here:
http://bradhedlund.com/2010/12/16/routing-over-nexus-7000-vpc-peer-link-yes-and-no/
HSRP is fine.
As mentioned tracking feature purpose is to avoid block hole of traffic. It completely depends on your network setup. Don't think you would be needing to track all the interfaces.
JayaKrishna

Which way is used to allocate/deallocate memory for locals?

Good afternoon.
I would like to know how memory is allocated/deallocated for local variables in an activation record/frame. For example, in the following java code:
1 public void test()
2 {
3     {
4          {
5               String y = "abc";
6          }
7     }
8     {
9          String y = "pqr";
10     }
11 } At line 5, memory is allocated for variable y. Is this memory deallocated at line 6 (right after its declaration block), or after the line 11 at which point the whole activation record for the method is popped out of the stack?
In addition, is this local memory allocation/deallocation strategy required by the Java specification, or could be different with different Java compilers? Thank you very much and have a great weekend,
Sunny

Hi,
Thank you for your comments!
Perhaps I did not state my problems clearly. Here is my real purpose: I am trying to monitor a program's runtime behavior by dynamically maintaining an object graph where nodes represent runtime objects and directed edges represent "refer to" relation between objects. To better understand my questions, let me first briefly introduce my algorithm to update the object graph:
1. add an edge (between objects): when a local refers to an object, add an edge from the enclosing object to the referred object
2. delete an edge: when a local refers to another new object, delete the edge from the enclosing object to the previously referred object; or the memory allocated for this local is deallocated.
For example, if I have the following Java method,
1 m()
2 {
3        {
4                 Object x = objA;
4'                x = objB;
5                 // some statements
6        }
7        {
8                 // some statements
8'                Object x = objC;
9        }
10 }Below, the enclosing obj means the object containing the method m().
At line 4, a local name x is declared and assigned objA, at which point an edge from the enclosing obj to objA should be added. At line 4' the same local is assigned a new value, at which point we should delete the edge from the enclosing obj to objA and add a new edge to objB.
At line 6 this local is out of its scope, whether or not we should delete the edge from the enclosing obj to objB depends on whether the memory allocated for x is deallocated.
Lastly, at line 8' a new local with the same name x is declared so we should add a new edge...
Another example is like this:
1 m1()
2 {
3      Object x = objA;
4     // some statements
5     m2();
6 }
7 m2()
8 {
9     Object x = objB;
10     // some statements
11 }After line 9, I should be able to know the enclosing obj has two outgoing edges labeled with x, one is to objA and the other is to objB.
Is there any solution to getting this runtime information for Java local variables? I would really appreciate any help!
-- Sunny

Multicast Mroute behavior for local VLAN multicast (with overlap)

Similar Messages

Maybe you are looking for