VMotion in VM-FEX Hypervisor Bypass Mode

Hello,
I know that when vMotion a virtual machine in a VM-FEX with Hyperv Bypass, the environment gets temporarily switched to Emulated Mode...
Question is: ¿is this switch to Emulated Mode and switch back to Hyperv Bypass automatically done? Or rather it needs human intervention?
Thanks,

No, VM-FEX is managed by the fabric Interconnect cluster. For this reason you can't use VM-FEX to migrate between separate UCS clusters.
Regards,
Robert

Similar Messages

IDSM-2 Throughput in Bypass Mode?

HI,i cisco documentation idsm-2 has 500Mbps throughput in inline mode and 600Mbps throughput in passive.so suppose that our idam-2 is in inline mode,then if we put our idsm-2 in Bypass mode,how much traffic idsm-2 can handle without any inspection?(throughput?)
thanks.

The IDSM-2 would only be supported at the same 500Mbps for both inspection and ByPass mode.
There is not a separate rating for ByPass mode.
With that said, the IDSM-2 will do much higher than 500Mbps while in ByPass mode (assuming nothing else happening on the sensor).
But I am not sure how much more since we don't generally test performance while in ByPass mode.
You would not want to plan your network on the ByPass performance capability.
The other reason is that when the sensor goes into ByPass there be something else going on in the sensor.
In the case of a Signature Update there will be signature processing consuming much of the CPU and memory so ByPass will not perform at its top performance.

IPS 4240 & Interface Up\Down In Bypass-Mode Auto

Hi. this is a strange one. We have a C7200R (FastEthernet) on one side and a C3500 (FastEthernet) on the other with an IPS4240 in the middle. When changing the IPS unit from "bypass-mode on" to auto the interface on the C7200 router goes down, ie no link activity. We have tried several combinations of interface speeds\duplex. The systems would normally be in speed auto\duplex auto but we have tried 100\full forced as well. When in "bypass-mode on" the all systems work fine in auto\auto negotiating 100\full. Any ideas. Thanks Alex

I have a similar problem:
ASA 5510 - E0/0 - Connects to E0/1 on C2800 - when we set it to FULL/100 the connection fails - when the interfaces are set to AUTO everything is fine. Any suggestions? Thanks

SNMP monitoring of Bypass mode on a 4255

Hi,
I am trying to monitor if the IPS is in bypass mode or not through SNMP.
Does anyone know which OID I should be looking at?
Thanks

.1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.0 = STRING: "Indicates that the specified network interface has lost link."
.1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.1 = STRING: "Indicates that the specified network interface has established link."
.1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.2 = STRING: "Indicates that packet traffic has started on the specified network interface."
.1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.3 = STRING: "Indicates that packet traffic has stopped on the specified network interface."
.1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.4 = STRING: "Indicates that the percentage of missed packets on the specified interface has exceeded the configured threshold."
.1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.5 = STRING: "Indicates that the inline data bypass has started."
.1.3.6.1.4.1.9.9.138.1.1.2.1.3.0.6 = STRING: "Indicates that the inline data bypass has stopped."
There seems to be some mibs releated to this, but i'm guessing these are SNMP traps that can be sent. I haven't tested this, but might be worth a shot to setup SNMP traps and manually start bypass to see if you get them.

Question on UCS Livemigration/vMotion with VM-Fex

Hi,
I want to know if or how does livemigration/vMotion work, if I have
a) Vm-Fex and
b) 2 UCS domains, each in one active datacenter. Both datacenters connected via a L2 datacenter interconnect, so they are active/active.
I know livemigration/vMotion will work within 1 UCS domain, but within 2 UCS domains I do not know.
thanks Alois
Sent from Cisco Technical Support iPad App

No, VM-FEX is managed by the fabric Interconnect cluster. For this reason you can't use VM-FEX to migrate between separate UCS clusters.
Regards,
Robert

My iphone 3gs is in ios5 bypass mode and my power button dont work

my power button dont work how can i fix this the bypass problem ?

You have a hardware problem. Make an appointment at the genius bar. You can get an out of warranty replacement for $149.

Adapter FEX and VM Fex

Hi!
I have a questions about Cisco Adapter FEX and VM Fex.
As i understand, Cisco Adapter FEX gives multiple vNIC on one mezzanine card, and each of them appears as virtual port on Fabric Interconnect.
Also, same thing for VM-FEX, each VM NIC appears as virtual port on Fabric Interconnect.
Am i right?
Thank you!

Adaptor FEX is I/O adaptor virtualization, which is agnostic to the OS and therefore works in virtualized as well as non virtualized environments.
VM-FEX (also called Hypervisor Bypass) is available for different Hypervisors
Cisco UCS Manager VM-FEX for Hyper-V CLI Configuration Guide, Release 2.2
Cisco UCS Manager VM-FEX for KVM CLI Configuration Guide, Release 2.2
Cisco UCS Manager VM-FEX for VMware CLI Configuration Guide, Release 2.2
Cisco UCS Manager VM-FEX for Hyper-V GUI Configuration Guide, Release 2.2
Cisco UCS Manager VM-FEX for KVM GUI Configuration Guide, Release 2.2
Cisco UCS Manager VM-FEX for VMware GUI Configuration Guide, Release 2.2
Cisco UCS Manager VM-FEX for Hyper-V CLI Configuration Guide, Release 2.1
Cisco UCS Manager VM-FEX for KVM CLI Configuration Guide, Release 2.1
Cisco UCS Manager VM-FEX for VMware CLI Configuration Guide, Release 2.1
Cisco UCS Manager VM-FEX for Hyper-V GUI Configuration Guide, Release 2.1
Cisco UCS Manager VM-FEX for KVM GUI Configuration Guide, Release 2.1
Cisco UCS Manager VM-FEX for VMware GUI Configuration Guide, Release 2.1
Cisco UCS Manager VM-FEX for KVM CLI Configuration Guide
Cisco UCS Manager VM-FEX for KVM GUI Configuration Guide
Cisco UCS Manager VM-FEX for VMware CLI Configuration Guide
Cisco UCS Manager VM-FEX for VMware GUI Configuration Guide
example VM-FEX for VMware ESX
VM-FEX (previously known as VN-link) is a method to extend the network fabric completely down to the VMs. With VM-FEX, the Fabric Interconnects handle switching for the ESXi host's VMs. UCSM utilizes the vCenter dVS Application Programming Interfaces (API) to this end. Therefore, VM-FEX shows as a dVS in the ESXi host.
There are many benefits to VM-FEX:
Reduced CPU overhead on the ESX host
Faster performance
VMware DirectPath I/O with vMotion support
Network management moved up to the FIs rather than on the ESXi host
Visibility into vSphere with UCSM

IPS mode with IDSM-2 module on Cat6K

Hi,
I have installed the IDSM-2 module on the Catalyst 6509 switch, now I was refering to the configuration guide for IPS 6.0 there are multiple modes I can configure like inline, inline vlan pair, Promiscuous & vlan group mode.. so I'm thinking which one would be the best solution...
The catalyst 6509 is acting as the CORE/Distribution with multiple Vlan's (around 20 vlans) configured, and customer wants the IPS to be deployed in such a way that it covers the traffic from all the vlans..
Also note that there is a redundant Cat6509 switch which also has got the IDSM-2 module installed, so can these both IDSM-2 modules be installed in active/standby or active/active combination...
can someone through some lights on the same please...
Regards
Vijay.

A sensor can enter bypass mode for several reasons, including, but not limited to:
1) Analysis Engine reconfiguration
2) Global Correlation updates
3) Daily Signature DB self purg
4) sensorApp failure
Most of these reasons are benign. I have written Supportability Enhancement CSCtg69012 so that each bypass log will show the reason for entering bypass mode.
The bug is available via the CCO Bug Toolkit: http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs.
You may review the bug and click on the "Save Bug" button at the bottom of the page to receive email updates as changes are made to the bug's state.
To fully diagnose your issue, I suggest opening a TAC case where we will request a "show tech," including debug level logs. This will allow us to see what is triggering the sensor to enter bypass mode.
Thank you,
Blayne Dreier
Cisco TAC IDS Team
**Please check out our Podcast**
TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast

What are different between software VM-FEX and hardware VM-FEX?

Hi everybody,
I am confuse software VM-FEX and hardware VM-FEX.
Does the software VM-FEX is Emulated mode and hardware VM-FEX is VMdirectpath mode?
If i design a VM-FEX, is there must have nexus 1000V or not ?
Is Nexus 1000V and VM-FEX must work together or select one of them?

Have a look at http://keepingitclassless.net/2013/06/cisco-vm-fex-and-the-nexus-1000v/
VM-FEX in hardware requires on the host side a VIC adaptor, and a UCS FI or N5k as a switch (and control plane)
VM-FEX in hardware has 2 submodes (PTS = Emulated Mode) and UPS (path Through)
VM-FEX makes use of the VEM module (same as N1K; it is operated in a different mode however)
VEM can do N1k local switching or VM-FEX path through, but not both !

IDSM-2 Inline mode

Hi,
I am working with the IDSM-2, We have Cisco 6509 with CSM & FWSM, We are planning IDSM-2 in Inline mode and now i want to monitor the traffic which is coming through Outside Interface of the FW context ( Which is nothing but a VLAN A, VLAN B, Vlan C. on MSFC )
Data flow :-- ISP RTR---INternal RTR---FWSM---IDSM---MSFC---CSM---
IDSM version is 5.1(4)S257.0,
This will support only Two VLAN (IN and OUT) on access mode.
My problem is I don't know how to scan the traffic of 3 numbers of VLAN (A,B,C).
Cisco 6509 --- Version 12.2(18)SXF7,

Hi Udaya,
I am not able to find out any subinterface.
I think it is available from IPS 5.1 and this one is IPS5.0(2)
IDSM2CORE2(config-int)# show settin
physical-interfaces (min: 0, max: 999999999, current: 3)
name: GigabitEthernet0/2
media-type: backplane
description:
admin-state: enabled
duplex: auto
speed: auto
alt-tcp-reset-interface
none
name: GigabitEthernet0/7
media-type: backplane
description:
admin-state: enabled
duplex: auto
speed: auto
alt-tcp-reset-interface
interface-name: System0/1
name: GigabitEthernet0/8
media-type: backplane
description:
admin-state: enabled
duplex: auto
speed: auto
alt-tcp-reset-interface
interface-name: System0/1
command-control: GigabitEthernet0/2
inline-interfaces (min: 0, max: 999999999, current: 0)
bypass-mode: auto
interface-notifications
missed-percentage-threshold: 0 percent
notification-interval: 30 seconds
idle-interface-delay: 30 seconds

N7K-F312FQ-25, Not FEX fabric capable?

Dear all,
Anyone struggled with the same problem:
According the specs the F3 line card should support FEX 2000 (in our case: NX2248PQ and NX2238TP)
While configuring an interface with "SWITCH MODE FEX-FABRIC", the system complains with:
DC1(config-if)# switchport mode fex-fabric
ERROR: Ethernet4/10: Configuration does not match the port capability.
Seems like the only interface on the F3 linecard that is able to support FEX fabric, is the BREAK-OUTed interface (4x 10GE) on a F3 interface.
Thanks,
Kind regards, Wim

Hi Reza,
thanks for your feedback.
concerning fex I meant 2248TP, those are indeed connected using breakout cable from: N7K QSFP 40GE -> FEX 2248TP 4x 10GE.
But how to connect a 2248PQ, which has 4x 40GE as uplink to the N7K ? To do so, I need 4x 40GE interfaces at N7k running in FEX FABRIC switch mode.
The N7K is always complaining about port capability when I try to put an interface of the F3 linecard in fex mode.
The N7K is running 6.2(8)

IDSM-2 inline vlan pair mode configs

Dear all,
1. Is it possible to associate 2 vlans( to be paired) on 2 different data ports on IDSM instead of pairing it on single data port on IDSM ?? & configuring these 2 ports on CAT6509 as access ports instead of trunk... Will this thing work ?
2. Since bypass mode is ON by default(AUTO) in IDSM-2 in-line vlan pair mode but when I am testing the bypass its not happening..can any pls. guide what could be the reason for this ?
Regards,
Akhtar

You can bypass analysis engine when inline bypass is activated , allowing traffic to flow through the inline interfaces and inline VLAN pairs without inspection. Inline bypass ensures that packets continue to flow through the sensor when the sensor processes are temporarily stopped for upgrades or when the sensor monitoring processes fail. But not always.

Bypass(IPS or TAP) network cross-connect the two RJ45 connectors electrically thus creating an extended Layer 1 network

Thanks for your time and knowledge. I am trying to understand how bypass mode works in terms of cross connection.
Bypass mode: network relays cross-connect the two RJ45 connectors electrically thus creating an extended Layer 1 network
Let us focus on one connection COM1 --- 3560 --- ELFIQ (Link Balancer) ---- ASA.
Basically ELFIQ will be a bypass mode when power is gone.
The engineer told me that I have to put cross cable between ELFIQ and ASA5505 only which is "2" cable from below diagram.
So, it will be
COM1 ------(Straight)----- 3560 -----(straight)------ ELFIQ (Link Balancer) -----(cross)--- ASA.
And he told me also that if there is no switch (in future). I need to put both cables as cross cables.
COM1 ------------- (Cross) ------------------ ELFIQ-------------- (Cross) ------------------ ASA5505
I couldn't see any consistency from this bypass works because case 1 (with switch) and case 2 (without switch)
Is my understanding right like below?
case 1: straight - straight - cross : cross
case 2: cross - cross: straight.

Thanks for your time and knowledge. I am trying to understand how bypass mode works in terms of cross connection.
Bypass mode: network relays cross-connect the two RJ45 connectors electrically thus creating an extended Layer 1 network
Let us focus on one connection COM1 --- 3560 --- ELFIQ (Link Balancer) ---- ASA.
Basically ELFIQ will be a bypass mode when power is gone.
The engineer told me that I have to put cross cable between ELFIQ and ASA5505 only which is "2" cable from below diagram.
So, it will be
COM1 ------(Straight)----- 3560 -----(straight)------ ELFIQ (Link Balancer) -----(cross)--- ASA.
And he told me also that if there is no switch (in future). I need to put both cables as cross cables.
COM1 ------------- (Cross) ------------------ ELFIQ-------------- (Cross) ------------------ ASA5505
I couldn't see any consistency from this bypass works because case 1 (with switch) and case 2 (without switch)
Is my understanding right like below?
case 1: straight - straight - cross : cross
case 2: cross - cross: straight.

Reg. Cisco IPS Inline VLAN Mode

Hi
Currently my Cisco IPS 4240 version 5.1(5) , is in Promiscous mode.Soon i will be configuring it in Inline mode .i will be using only 1 IPS Interface and will be configuring VLANs in the switch and connect the trunk port to the Gig0/0 of the IPS .The issue is that if the IPS goes down , will the packet flow continue to run smoothly i.e will the "Auto bypass mode" will be applicable for this scenario too and let the traffic goes without inspection ?
Ankur

Perfectly normal. Your test does not test the Software ByPass feature.
The confusion is in how Software ByPass and Virtual Sensor assignment are related.
If ByPass is set ON (Not Auto, but specifcally ON) then the traffic will be software bypassed regardless of whether or not analysis engine is running or whether the inline pair is assigned to any virtual sensors.
The driver does the bypass, and never even attempts to send it to the analysis engine.
If Software ByPass is set to Auto OR Off, the driver will always attempt to send the packets to the analysis engine.
The only difference between Auto and Off is what happens when the analysis engine STOPS pulling new packets from the driver.
With Software ByPass Auto, the driver will start passing the packets straight through and not send them to analysis engine.
With Software ByPass Off, the driver will bring the link down on the NICs until analysis engine is able to start receiving packets again.
So you see that Software ByPass is a function of the NIC driver.
Whether or not the pair is actually assigned to a virtual sensor is UNKNOWN by the NIC driver itself.
Whether or not the inline pair is assigned to a virtual sensor is solely a function of the analysis engine. If the analysis engine is functioning is running then the driver is always going to send it the packets. The analysis engine then checks to see if the packets should be monitored. If the inline pair is assigned to a virtual sensor then it is monitored before being passed back to the driver for transmit.
IF the inline pair is NOT assigned to a virtual sensor, then the packet is STILL passed back to the driver for transmit.
So an inline pair that is NOT assigned to a virtual sensor will STILL have packets passed through if analysis engine is Running. So long as analysis engine is runninng the NIC driver in Software ByPass Auto or Off does not care whether or not it is actually monitored. The driver only knows that it must pass the packet to the analysis engine and the analysis engine will send the packet back for transmit.
So adding and removing inline pairs from virtual sensors does NOT test the Software ByPass feature. The packets will always be passed through so long as analysis engine is running.
If analysis engine stops passing traffic, then software bypass kicks in and all inline pairs (whether monitored or not) will be treated the same depending on whether bypass is Auto or Off.
The only way to really test Software ByPass is to simulate an actual failure of the analysis engine.
To do this:
create a service account
login with service account
switch to user roor (su - root)
The root password is the same as the service account password.
Execute "ps -ef" to find the pid of the sensorApp process (which is the analysis engine)
Now execute "kill -9 ###" replacing the ### with the pid of the sensorApp process.
Now the Software ByPass functionality should kick in.
You can always run "show int" to see the current running status of the Software ByPass feature in the driver.
It will be either On, Off, or Auto_On or Auto_Off
The Auto_On and Auto_Off are the 2 running states for the Auto configuration. Auto_Off is when analysis engine is working, and auto_on is when the analysis engine is not working.

Private-VLAN using Nexus 7010 and 2248TP FEX

I have a Nexus 7010 with several 2248TP FEX modules.
I am trying to configure a Private VLAN on one of the FEX host ports.
I see in the documentation you can't do promiscous but I can't even get the host only configuration to take.
Software
BIOS:      version 3.22.0
kickstart: version 6.0(2)
system:    version 6.0(2)
sho run | inc private
feature private-vlan
vlan 11
name PVLAN_Primary
private-vlan primary
private-vlan association 12
vlan 12
name PVLAN_Secondary
private-vlan isolated
7010(config)# int e101/1/48
7010(config-if)#
7010(config-if)# switchport mode ?
access        Port mode access
dot1q-tunnel Port mode dot1q tunnel
fex-fabric    Port mode FEX fabric
trunk         Port mode trunk
Switchport mode private-vlan doesn't even show up!!!!!!
If I try this command it says its not allowed on the FEX port.
7010(config-if)# switchport private-vlan host-association 11 12
ERROR: Requested config not allowed on fex port
What am I doing wrong?????
Todd

Have you found a solution to this?
-Jeremy

VMotion in VM-FEX Hypervisor Bypass Mode

Similar Messages

Maybe you are looking for