Nexus1000v: Mgmt Port on different VLAN than host
I am setting up a pair of Nexus 1000v switches. As per the Cisco
documentation, I have the management port in the system-uplink
port-profile. However, currently, this management port is in the same
production VLAN as most of our servers. I would rather have the
management in an separate VLAN for security and reliability reasons.
Also, as I cannot assign a VLAN to both the system-uplink and the
data-uplink port-group, this means all of the server traffic will be
using the system-uplink port-group. This does not sound logical.
My question is:
1. Does the management port have to be in the same VLAN as the VM Host
server?
2. If is does, what are the implications of putting the management port
on the data-uplink port-group?
3. OR, if (1) is YES, then what do you think about putting the VM Hosts
(ESXI) on a separate VLAN than the virtual servers?
Note: I have been playing with svs domain mode l3. But as I cannot even
ping the gateway, I haven't had much success.
I would say you should seperate it.
One VLAN Management (mabye in ESX Managemt or Switchmanagement VLAN)
One VLAN for Packet & Contrl.
Others for Data (server, user traffic)
Seperate Management ist just for security reasons
The others should be seperated, because the are very important to let the nexus Work, If packets are lost, the hole nexus will get trouble to work.
Additional you should think about QoS if you don't use a seperate NIC for that traffic. I would suggest to use a bundle of NIC's for evetyhing and work with QoS to be High Available.
Thats my point of view after discussion in a nexus training and with a cisco technician.
regards,
Sebastain
Similar Messages
-
Wireshark capture on access port displays different vlan traffic
Hi Guys,
i have a nexus 4001i Blade Center Switch where i have a server connected in mode access to a particular vlan.
when i use wireshark on this port, i see different traffic conversations of different servers in different vlans which seems strange to me.
anybody have an idea why a server in mode access with wireshark is able to view different vlan traffic? I also see non multicast and non broadcast converations.
the port the server is connected to is not a monitor port but only in switch port mode access.
thanks in advance for you feedbackHi,
So it looks like you're getting unicast traffic flooded to all ports. There are a couple of reasons I've come across that can cause this.
Asymmetric routing: See Unicast Flooding in Switched Campus Networks and/or Case Study #8: Asymmetric Routing and HSRP (Excessive Flooding of Unicast Traffic in Network with Routers That Run HSRP) for details of why it happens and how to prevent it.
Microsoft Network Load Balancing. As per the Microsoft Troubleshooting NLB:
In unicast mode (the default Forefront TMG cluster operation mode) NLB induces switch flooding, by design, relaying packets sent to the VIP addresses to all cluster hosts. Switch flooding is part of the NLB strategy for obtaining the best throughput for any specific load of client requests. However, if the NLB interfaces share the switch with other (non-cluster) computers, switch flooding can add to the other computers' network overhead by including them in the flooding and consequently have a detrimental effect on network and/or server performance.
Regards -
AP On Different Vlan Than Controller
I have a 5508 controller at our headquarters and am installing some 3502 AP's at a remote branch. Unfortunatly, the remote branch has a different Vlan setup for some reason and the vlan that is used for the WLC (90) is designated for telephony at this branch. Can I put the AP's on a different VLAN (10) without having any issues? I will still use DHCP option 43 to point them back to the controller. Below are the configs for the WLC interfaces and what I am proposing for the AP interfaces:
WLC Config
interface GigabitEthernet1/1/38
description WLC01
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 90
switchport trunk allowed vlan 1,10,50,90,91,390,410-413,610-613,800,810,811
switchport mode trunk
channel-group 5 mode on
interface GigabitEthernet1/1/39
description WLC01
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 90
switchport trunk allowed vlan 1,10,50,90,91,390,410-413,610-613,800,810,811
switchport mode trunk
channel-group 5 mode on
interface Port-channel5
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 90
switchport trunk allowed vlan 1,10,50,90,91,390,410-413,610-613,800,810,811
switchport mode trunk
AP Interface Config
interface GigabitEthernet1/0/1
description *** Access Point AP001 ***
switchport access vlan 10
switchport mode access
spanning-tree portfast
Will this work?Hi Pat,
When deciding to do LOCAL mode or CENTRAL SWITCH mode you need to consider a few items:
1) NAT -- If there is a NAT between both locations almost all customers would rather LOCAL mode. Reason being is the ability to access local resources without nat issues. Remember, central model has all traffic and IP addressing coming from the main office.
2) Internet / Main office connection - If the remote office is on a MPLS for exmaple. Using local switching is reartly used becuase if you lose the conenction with the main office you have bigger issues then having wireless access.
These are the 2 questions my customers always look at ...
I hope this helps... -
Traffic Between 2 Ports on Different VLANs on the Same Switch
Hi,
This question probably results from a flaw in my understanding of network layer 2 versus layer 3 and VLANs so any additional context in that regard would be very welcome
If I've got 2 systems on difference VLANs that are connected to ports on the same switch (e.g. 2950), with that switch being connected via an uplink to a router or layer 3 switch and i want to pass traffic between the 2 systems (e.g. copy a file from a folder shared on one system to another), will the traffic pass directly from one port on the 2950 to the other? Or will it need to go through the uplink? I guess it will need to go through the uplink initially as layer 3 needs to be involved for inter-VLAN routing but wondering if layer 2 MAC address will ultimately be learned, allowing traffic to pass directly between the systems, not over the uplink.
Thanks in advance,
cisco_reader.If the hosts are on different Layer 2 Vlans and you want to pass data between them, that data needs to be 'Routed'.
In order to Route data from one Layer 2 Vlan to another, you need a device capable of Layer 3 Routing. That device can be a traditional Router or can be something called a Layer 3 switch.
A 2950 switch is Layer 2 only so has the ability to create many Layer 2 Vlans which is what you have done. In order to route traffic between those Vlans, you can either use a router or a L3 switch.
If you decided to use a router, look up something called 'Router on a Stick' which involves creating a Trunk link from the 2950 to the Router and then setting up Subinterfaces on the Routers port to act as the 'Default Gateway' for each of your Vlans. -
How to use different Vlans outside another gateway in sg-300 28?
dear all
how shall i use different vlans outside another gateway in sg-300 28?
Example:
vlan2 192.168.2.0/24 gateway 192.168.2.1 outside router gateway 192.168.2.254
vlan3 192.168.3.0/24 gateway 192.168.3.1 outside router gateway 192.168.3.254
should me doing in sg-300 28?
thanks.Hi Amin,
Leave the switch in Layer 2 mode
Cable VLAN2 to the to the outside router gateway 192.168.2.254 interface
cable VLAN3 to the to the outside router gateway 192.168.3.254 interface
Excuse the rough diagram
Make the port going to the outside router gateway, untagged in the vlans they will be transporting. (I am assuming that the router gateway is not vlan aware.)
IP hosts will most likely get DHCP from the router gateway. The IP hosts will then automatically send IP traffic to the router gateway.
VLAN 1 in my switch, could then be the only interface within the switch that has a IP address associated with it, for management purposes.
I can see from you post, that English is not your first language, if you want to speak to someone, you can ask a question by going to;
www.cisco.com/go/sbsc
regards Dave -
Multicast Does not work between different VLANS
Hi,
I have problems with multicast. On the same VLAN i can see the SAP announcement in VLC and play, but on different VLAN i can see SAP but i cant play it. The play turn to pause and the video doesn´t appear.
I have 2 Cisco 6500 switch CORE with GLBP configured but not working. In the second switch i have all interfaces in shutdown. The first core switch have L3 routing enable.
The Global configurations:
ip multicast-routing.
I have the transmitter PC on vlan 51 i transmit to 230.0.0.50 group an im trying to recive on vlan 80. The vlans configurations are:
Vlan 51
ip address x.x.31.254 255.255.255.0
ip pim sparse-dense-mode
Vlan 80
ip address x.x.80.1 255.255.255.0
ip pim sparse-dense-mode
I have 2 Cisco 2960 (L2 only) for the access.
The principal commands outputs are:
CORE1#show ip mroute | inc 230.0.0.50
(*, 230.0.0.50), 01:50:50/00:02:21, RP 0.0.0.0, flags: DC
CORE1#
CORE 1
interface Vlan1
ip address x.x.1.1 255.255.0.0
ip access-group 101 out
no ip unreachables
ip pim sparse-dense-mode
mls rp ip
interface Vlan51
ip address x.x.31.254 255.255.255.0
ip access-group 151 out
ip helper-address x.x.x.x
ip helper-address x.x.x.x
no ip unreachables
ip pim sparse-dense-mode
mls rp ip
interface Vlan80
ip address x.x.80.1 255.255.255.0
ip access-group 150 out
no ip unreachables
ip pim sparse-dense-mode
glbp 80 ip x.x.80.254
glbp 80 timers 5 18
glbp 80 timers redirect 600 7200
glbp 80 priority 254
glbp 80 preempt delay minimum 60
glbp 80 authentication text glbpkey
glbp 80 forwarder preempt delay minimum 60
CORE2
interface Vlan1
ip address x.x.1.4 255.255.0.0
ip access-group 101 out
no ip unreachables
ip pim sparse-dense-mode
mls rp ip
interface Vlan51
ip address x.x.31.2 255.255.255.0
ip access-group 151 out
ip helper-address x.x.x.x
ip helper-address x.x.x.x
no ip unreachables
ip pim sparse-dense-mode
shutdown
mls rp ip
glbp 51 ip x.x.31.254
glbp 51 timers 5 18
glbp 51 timers redirect 600 7200
glbp 51 preempt delay minimum 60
glbp 51 authentication text glbpkey
glbp 51 forwarder preempt delay minimum 60
interface Vlan80
ip address x.x.80.2 255.255.255.0
ip access-group 150 out
no ip unreachables
ip pim sparse-dense-mode
shutdown
mls rp ip
glbp 80 ip x.x.80.254
glbp 80 timers 5 18
glbp 80 timers redirect 600 7200
glbp 80 preempt delay minimum 60
glbp 80 authentication text glbpkey
glbp 80 forwarder preempt delay minimum 60
end
Someone can help?
Thanks,
AlfredoHi johnd...
Im using VLC 1.1.2 (i can not update because i have a DVDT2 card to capture the digital terrestrial television and it only work in this version). I have all the firewalls down.
This is the output for the show ip igmp snooping groups on the 2960.
80 230.0.0.50 igmp v2 Gi1/0/21, Gi1/0/24
Port G1/0/21 is where the receiver is conected and the 24port is the trunk.
Jon, i revert and this is the output. I put the ip pim rp-address the same of the lookpback that i create previously.
(*, 230.0.0.50), 00:37:46/00:02:19, RP 192.168.230.230, flags: SJC
Incoming interface: Null, RPF nbr 0.0.0.0
Outgoing interface list:
Vlan80, Forward/Dense, 00:09:52/00:00:00
The strange thing is that I have more than 40 vlans and it only fail in some vlans like 80. -
How to configure a port channel with VLAN trunking (and make it work..)
We're trying to configure a port channel group with trunked ports to connect a NetApp HA pair. We want to create two data LIFs and connect them to the switch stack. We are trying to create 2 data lifs, one for cifs and one for nfs that are on different vlans.
We want the same ports to be able to allow multiple vlans to communicate. (trunked)
These data lifs should be able to fail over to different nodes in the HA pair and still be able to communicate on the network.
What this means is that we have to connect 4 ports each for each node in the NetApp HA Pair to the switches and create a port channel of some type that allows for trunked vlans. When we configure the ports, the configuration is as follows (below):
We are only able to configure an IP on one of the vlans.
When we configure an IP from another vlan for the data lif, it does not respond to a ping.
Does anyone have any idea what I'm doing wrong on the Cisco switch?
interface GigabitEthernet4/0/12
description Netapp2-e0a
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet4/0/13
description Netapp2-e0c
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet6/0/12
description Netapp2-e0b
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet6/0/13
description Netapp2-e0d
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface Port-channel20
description Netapp2-NFS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
spanning-tree portfast
spanning-tree bpduguard enable
endOur problem was fixed by the storage people. They changed the server end to trunk, and the encapsulation / etherchannel.
I like all the suggestions, and they probably helped out with the configuration getting this to work.
Thanks!
interface Port-channel20
description Netapp2-NFS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
interface GigabitEthernet4/0/12
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet4/0/13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet6/0/12
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet6/0/13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active -
Can I have multiple different vlans in one Single Mode Transparent Firewall
Hi,
I am about configuring Data Center FW (ver 9.2) to protect multi tier Servers Farm; Web, Applications & Data Base. There is a requirement to set the FW in Transparent Mode, while the license is the base 2-contexts, only.
I wonder if One Single Transparent Context, with different bridge-groups, one for each vlan is a workable solution. I have pasted the configuration of the FW, it may help in understanding the setup.
======
firewall transparent
names
interface TenGigabitEthernet0/8
description To Nx7K-1 Port-8
channel-group 9 mode passive
no shutdown
no nameif
no security-level
interface TenGigabitEthernet0/9
description Nx7K-1 Port-9
channel-group 9 mode passive
no shutdown
no nameif
no security-level
interface TenGigabitEthernet1/8
description Nx7K-2 Port-8
channel-group 9 mode passive
no shutdown
no nameif
no security-level
interface TenGigabitEthernet1/9
description Nx7K-2 Port-9
channel-group 9 mode passive
no shutdown
no nameif
no security-level
interface BVI1
desc Services Zone
ip address x.x.41.250 255.255.255.0
interface BVI2
description WEB-APPS Zone
ip address x.x.42.250 255.255.255.0
interface BVI3
desc Oracle management
ip address x.x.43.250 255.255.255.0
interface BVI4
descr Oracle DB
ip address x.x.44.250 255.255.255.0
interface Port-channel9
description ECLB Trunk to NX7Ks
duplex full
port-channel load-balance src-dst-ip-port
no nameif
no security-level
switchport mode trunk
switchport trunk allowed vlan 41-44,141-144
interface Port-channel9.41
vlan 41
nameif Services-Outside
bridge-group 1
security-level 0
interface Port-channel9.141
description Services-Inside
vlan 141
nameif Services-Inside
bridge-group 1
security-level 100
interface Port-channel9.42
description WEB_APPS-Outside
vlan 42
nameif WEB_APPS-Outside
bridge-group 2
security-level 0
interface Port-channel9.142
description WEB_APPS-Inside
vlan 142
nameif WEB_APPS-Inside
bridge-group 2
security-level 100
interface Port-channel9.43
desc Oracle management
vlan 43
nameif Oracle_Mgmt-Outside
bridge-group 3
security-level 0
interface Port-channel9.143
description Oracle management Inside
vlan 143
nameif Oracle_Mgmt_Inside
bridge-group 3
security-level 100
interface Port-channel9.44
desc Oracle DB
vlan 44
nameif Oracle_DB_Outside
bridge-group 3
security-level 0
interface Port-channel9.144
description Oracle DB Inside
vlan 144
nameif Oracle_DB_Inside
bridge-group 4
security-level 100it is possible but it is not scaleable. If I remember correctly you can only have a maximum of 8 BVI interfaces...so this means you can only have 8 subnets going across the ASA. You would also need seperate VLANs for the inside interface and the outside interface since you can not configure two interfaces to be in the same VLAN, and then assign these interfaces to the appropriate BVI group.
Please remember to select a correct answer and rate helpful posts -
Switch Port Trunk allowed Vlan
Hi Guys
Request your help on my query :
I have a distribution switch and access switch and port channel between them.
Dist switch is the VTP server
lets assum I have 25 vlan
when I do show vlan brief on the access switch I can see all 25 vlans listed now
no when I configure switch port trunk allowed vlan (ex : permitting 10 vlans )on the link connecting to access switch at Dist switch
Dist switch po1 -- connecting to - po Access switch
Dist switch #
int po1
switch port trunk alllowed vlan x,x,x,x,x,x,x,x,x,
After permitting 10 vlan through trunk allowed vlan and then when I do show vlan brief on the access switch , I should see only the 10 vlan whcih I have permiited right ?
Thanks in advanceHi,
John is absolutely correct - even if you do not permit a VLAN on a trunk, it can still provide communication among local ports on a switch that are all assigned to the same VLAN.
I have a feeling that your original question was focused on a different aspect, though: You probably expected that if you exclude some VLANs from trunks, these VLANs will not be propagated via VTP to surrounding switches. Sadly, this is not the case. The switchport trunk allowed vlan command only affects data traffic in individual VLANs but it has no impact on the operation of VTP protocol. The VTP still advertises all VLANs, regardless of which VLANs are allowed on a trunk. To put it plainly, in a VTP domain, all server/client switches will know about all VLANs. THere is no legal possibility of having a single VTP domain consisting of server/client switch and yet have the switches differ in their VLAN database contents. It's as easy as that: one VTP domain = one big common VLAN database.
Best regards,
Peter -
Change binding port of Xserver rather than 6000
Hi Sysop,
Can we change the binding port of Xserver rather than port number 6000 ?
And how we can make it done ?
Thanks.Hi
The configuration files for the Xserver on your host should be in
/etc/dt/config/Xconfig
/etc/dt/config/Xservers
If these files have never been customised or don't exist you can copy the default versions of
these files from
/usr/dt/config/Xconfig
/usr/dt/config/Xservers
to /etc/dt/confi, you can then edit them.
From your post it's unclear what you are trying to do, however the 2 config files above have
quite a bit of useful information in them about the various settings for the Xserver.
regards -
How to connected mgmt port on switch 2960 -XR
Hi guys,
I need of a technical support to resolve a issue with some Switch 2960-XR and its MGMT Port installed on our infrastructure.
I'd like to reach it via ssh connection to management them from a remote station (my PC), some guides found on Internet suggested me to use a extenal Hub/switch and a PC dedicated for that like this:
|SW1 mgmt port|------|H|
|SW2 mgmt port|------|U|-------- PC
|SW3 mgmt port|------|B|
I've also tried to patch the mgmt port on a port tagged with a management VLAN but it's not worked.
I ask you if there is a way to reach that SW using mngt port without use another external SW, thanks in advance for your supportOur network is hybrid, we have CIsco Sw and IBM Sw.
For the IBM solution the configuration of mgmt port is inband (data) and use an interface called IP2 where assigning an IP address we can manage via ssh the sw. In this case we've created a dedicated Vlan 15 and assigned as IP 10.10.10.15/24 to the interface IP2.
In Cisco Sw the only ways I know is either to create a dedicated Vlan with an IP or using Out of band, but in this case I've to use an external Sw.
Which is the best solution to have the management port on Cisco Sw without to use out of band?
thanks -
Mac mail service isnt listening on default ports at all other than SMTP
Mac mail service isnt listening on default ports at all other than SMTP.
I can port scan locally and here is what's listening
Port Scan has started…
Port Scanning host: <IPADDRESS>
Open TCP Port: 25 smtp
Open TCP Port: 53 domain
Open TCP Port: 80 http
Open TCP Port: 88 kerberos
Open TCP Port: 106 3com-tsmux
Open TCP Port: 311 asip-webadmin
Open TCP Port: 389 ldap
Open TCP Port: 443 https
Open TCP Port: 464 kpasswd
Open TCP Port: 587 submission
Open TCP Port: 625 dec_dlm
Open TCP Port: 749 kerberos-adm
Port Scan has completed…
Mail service is on.first place to start is always /var/log/system.log
stop/start mail service while watching that log.
You will probably catch some dovecot/imap lines that will yield clues.
Post results. -
Configure your network in vmm with different vlan's per customer
What's the best practice to set this up in vmm.
I have 2 hyper v hosts where the network (different vlan's) for the customers should pass on nic 5 and 6 for example?
What are the different step to configure this in vmm
I can't seem to set this up the right way.Hello,
The TechNet Wiki Discussion Forum is a place for the TechNet Wiki Community to engage, question, organize, debate, help, influence and foster the TechNet Wiki content, platform and Community.
Please note that this forum exists to discuss TechNet Wiki as a technology/application.
As it's off-topic here, I am moving the question to the
Where is the forum for... forum.
Karl
When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer.
My Blog: Unlock PowerShell
My Book:
Windows PowerShell 2.0 Bible
My E-mail: -join ('6F6C646B61726C406F75746C6F6F6B2E636F6D'-split'(?<=\G.{2})'|%{if($_){[char][int]"0x$_"}}) -
Re:Can't able to access shared folders from different VLANs in SG300 series switches
Hi All,
I supplied 3 numbers of SG300 series switches for the sole reason to have inter-vlan routing. I created 4 VLANs in the switches and made one switch as Layer 3 switch and other 2 as Layer 2 switch. Inter-Vlan routing is working fine. I am able to ping PCs from different VLANs. But I am not to access shared folders. Customer has installed Window 2003 server installed and it is in VLAN 1. There are some folders created in this server and it is very important for users to have access to the folders.Also, I am not able to access shared folders in other VLANs. I have created a case with Cisco small business and I got a reply saying that the switches will not support shared folder feature, which I think is not real. I am getting a very time to implement this solution in the network. I have a Sonicwall firewall after Core switch which is connected to ISP.
ISP<----->Sonicwall FW<----->Core Switch<------>Layer 2 switch<------>Layer 2 switch
Kindly help me out to resolve this issue.
Regards,
Prashant KHi Prashant,
I think you're running into a Windows firewall issue. SMB file sharing, by default I believe, is only allowed on your local subnet. Please try disabling windows firewall on the computer hosting the shared folder, then see if you can access the shared file.
Best,
David
PS: It looks like this post got published twice. You can delete the other one using the task bar on the right.
Please remember to rate helpful resonses and identify correct answers. -
How to generate & publish webhelp html files in different folder than default folder
Hi All,
I am new to robo help. I have a requirement to generate & publish webhelp html files in a different folder than default folder.
Could anyone please tell me the steps to change the folder
Thanks
RashmiYou change the generate folder and filename in the first field on the first page of the wizard. It must be a folder on your hard disk.
You change the publish folder in the last page of the wizard. Anywhere you like.
See www.grainge.org for RoboHelp and Authoring tips
@petergrainge
Maybe you are looking for
-
Ihave by mistake deleated my program creative cloud the consequence is that have no more creative cloud in my Computer . HOW CAN I RELOAD creative cloud. The best would be if Adobe would send me a mail to click and install it again, but I can't cont
-
Help on Generic Plugable module
Hi to all I am going to create a generic plugable module for swing application. My project is a xml editor that create jtree from xml files and now i want some nodes on jtree that are part of generic plugable module, if i remove this module then my e
-
Security, and pin blocking!
hi there, i jus got a new nokia today the 5300, and im trying to put a block on my text messages, and media....i cant seem to figure that out.. can some one help. i have done the security pin, and i still allows people to roam through my stuff, and i
-
Case Refunds? Apple & AT&T Cases only? Come on?
Are they kidding? After I got my iPhone the AT&T store said there was a problem with the antenna and I should buy a case - BUT because everyone was buying one they were totally sold out (except pink ones - no thank you). They directed me to Best Buy
-
Firefox causes Windows 7 Device Manager to constantly refresh/reset
When I execute Firefox, my Windows 7 Device Manager begins to constantly reset/refresh. This happens about every 10 seconds. Even when I have disabled all extensions and add-ons and I have removed and reinstalled Firefox, the behavior still happens.