Catalyst 3500XL layer 3 frozen

I'm not sure about the reason (most likely a broadcast storm), but one of our 3500XL switches stopped processing L3 traffic. Layer 2 switching was normal, and since it's our distribution switch (Cisco Modular Campus Design, here we come!), I didn't really want to reload it.

Consoling to the switch provided me with a responsive CLI, so no trouble there, either. CPU utilization was normal too.

After a few show commands, it turned out that it can't even resolve IPs with ARP.

I tried clear arp-cache, clear mac-address table, clear int vlan 10; no joy. I had to delete the entire vlan interface (no interface vlan 10), clear the caches, and re-create the vlan interface to make it work again. Of course it's running the latest IOS out there (12.0(5)WC17).

A new kind of sexy: Huawei Quidway S2309

During winter break I managed to acquire a new baby to my collection:

a Huawei Quidway S2309 switch.

It's a layer2, carrier CPE grade box, with a lot of features:

http://www.huawei.com/ucmf/groups/public/documents/attachments/hw_093972.pdf

It runs the Huawei VRP software, which is almost like the 3Com Comware, so I can use this baby to practice for my HP ASE exams.

Stay tuned for updates on this baby...

ESXi 3.5 to 4.1 upgrade

Last year I wrote about my 3.5 to 4.0 upgrade adventures. This weekend we scheduled a 3.5 to 4.1 upgrade, assuming it will be a smooth ride (apart from moving 4TB of data).

The first issue was that 4.1 didn't want to boot from the new pendrive. Assuming I did something wrong with the imagedd.bz2 file, I tried it a few times more, wasting about 3 hours. Turns out the box didn't like the Veritech pendrive somehow. Running from a Silicon Power one went like a charm.

Second issue: the LVM.resignature config option disappeared from the ESXi advanced config. Our new friend is the esxcfg-volume command-line utility.

Use

exscfg-volume -l

to list the volumes, and

esxcfg-volume -r

to resignature (and rename) your volumes.

On a related note, ESXi 5.0 does not use the imagedd.bz2 file anymore, so I didn't even start to experiment with it (I wasted too much time on trivial stuff during the upgrade anyway).

ComWare authentication with Cisco Secure ACS

As I'm writing a presentation on Cisco-HP-3Com interoperability, I realized I forgot to post this config a while ago.

The basic setup: we have 2 Cisco ACS servers as RADIUS/TACACS servers, for network management purposes. Both the network devices and the VPN service on the ASA cluster authenticates with them. Setting up Cisco and HP Procurve to use RADIUS is almost the same, but Comware differs significantly.

After an afternoon well spent, here's what I've come up with:

#
local-server nas-ip 127.0.0.1 key 3com
#
radius scheme system
nas-ip 127.0.0.1
radius scheme ceu
server-type standard
primary authentication 10.0.0.10
secondary authentication 10.0.0.11
accounting optional
key authentication XXXXXXX
user-name-format without-domain
#
domain local
domain system
scheme radius-scheme ceu
#
user-interface aux 0
authentication-mode scheme
user-interface vty 0 4
authentication-mode scheme

LLDP support on HP devices, versus my Cisco phones

This week is about LLDP making me sad...

I set out to test the compatibility of my Cisco 7911G phones with the HP switches on our network, as part of the network integration work. The HP documents (like this: h17007.www1.hp.com/docs/interoperability/Cisco/4AA2-2301EEE.pdf) say that it's almost plug'n'play, with minimal configuration required. Cool, I'd love that. Then came reality:

ProCurve 2524

Okay, I'm kinda unfair here, this is an ancient switch. It supports basic LLDP, and has 2 hardware priority queues. On the other hand, it doesn't support a "voice VLAN" feature, but trusts 802.1p markings. The best I can do with this is to set a voice vlan as tagged on the ports, and configure the phones by hand. Not nice.

ProCurve 2510G-24

Nice switch, not too old, should be fine. But, it's not: it doesn't support LLDP-MED. It has the "voice VLAN" feature, which provides auto-qos, but I still have to config my phones by hand for the voice vlan.

ProCurve 2610-48

Untested at the moment, as they are in an other location, but they support LLDP-MED, so they should be fine. These are our mainstay switches, if they work, I'm pretty happy.

And the nasty part came here. A lot of "HP and Cisco interop" documents posted by HP were published before the 3Com merger. And 3Com switches run ComWare, not Provision OS. Hence most HP documents won't help you, if you have 3Com/H3C heritage HP switches.

According to some existing docs, if you run ComWare v5, you should be fine. But I'm not.

HP E4210-48

This not-that-old box runs ComWare v3, and it supports both LLDP and LLDP-MED. So it should work. But it somehow lacks the support of a "voice VLAN", and I never managed to pass that vlan ID to the phone. If you config the phone by hand for the VLAN, it works in both hybrid and trunk port modes.

All switches run the latest possible firmware, and the phone runs the 8.5.3 image, with LLDP-MED support.

Stay tuned for updates on the 2610 and Comware line.

Update:

Turns out I was wrong: the 2610's are actually 2650's. Anyways, they work perfect with LLDP-MED.

Update2:

I managed to grab a Huawei S2309, which is running VRP5, which is basically ComWare v5. More testing to come.