34

The answer depends on whether the switch is a Layer 2 or a Layer 3 switch. That is to say, is the switch only switching and relaying traffic on to a different device for routing, or, is it doing the routing decisions itself via SVIs (switched virtual interfaces). On a layer 3 switch, the port can be found by using a few simple commands on the device. ...


19

You can use the send log command: switch#send log Halfway through the script! gives my on a Catalyst 3750 with IOS 12.2 May 31 16:36:18: %SYS-2-LOGMSG: Message from 1(name): Halfway through the script! and with IOS 15.0: May 31 16:38:08: %SYS-7-USERLOG_DEBUG: Message from tty1(user id: name): Halfway through the script!


16

show ip route vrf * displays the global routing table plus all the VRF instances. sh ip route vrf * 0.0.0.0 displays the default route for each VRF. This shows the default route for each VRF, including the default VRF. As this IOS 12.4 doesn't show the VRF name when displaying a matching route, a route tag was added on the static routes to help identify ...


14

Unless someone is clearing counters you should never see any odometer-type counters (those that increment based on a packet action) decrease, they should always increase. That part sounds like a bug. As far as what causes output drops in particular, there are so many different causes that it's very difficult to pinpoint it exactly. Sometimes there is ...


14

reload is the only way to purge them.


13

Cisco routers will use the primary subnet configured on the interface for identifying forwarded DHCP requests. The only other option is the DHCP smart relay feature, which allows a router to use the secondary subnet, but only after multiple DHCP offers for the primary subnet are not seen.


13

Firstly, you need to get the MAC address, so get into a machine on the same VLAN and look at its neighbour table - Windows is netsh int ipv4 show neigh, Linux: ip nei Cisco: show ip arp x.x.x.x. Once you have that... If this is a discovery job on a layer 2 switch, do show mac address-table | i 0011.2233.4455 - replacing the mac address bytes as appropriate. ...


13

You can remove the VRF temporarily: sh ip vrf detail | i Id Only reason this VLAN is even created is because either your VPN-CAM is turned off or you have more than 512 VRFs. If you don't have 512 VRFs, you can free up this internal VLAN without removing VRF by making sure VPN-CAM is activated. This may not be the simplest task as there are various ...


13

They are in order of specificity; The most specific (longest network mask) is first, and the least specific (shortest netmask) is last. If the network is variably subnetted, then they are grouped with the least-specific of the various netmasks, and ordered most-specific-first in each of the groupings. update It seems the output of show ip route is in the ...


13

If your switch supports it (not all IOS versions do), the following command should fix this for you: no aaa accounting system guarantee-first Here is an article that goes into more depth: Would you mind waiting for 2-3 mins in a console? And a bit from Cisco's documentation: Establishing a Session with a Router if the AAA Server is Unreachable ...


13

Cisco IOS is the standard operating system from Cisco. It runs on 800/1800/1900/2800/2900/3800/3900/7600 routers. It also runs on Catalyst 2960/3560/3750/4500/6500. Some newer platforms such as Catalyst 3650 and 3850 run IOS XE which is IOS running as a daemon on a Linux kernel. Then you have NXOS which runs on the Nexus platform. IOS XR runs on the SP ...


12

Using a VRF is like using a seperate router. If you have the same WAN IP for both VRF's, then you have to configure it twice in both WAN interfaces. If you however only use one WAN interface, you'll have to divide this interface by trunking (using VLAN's) or subinterfaces. ex: interface FastEthernet0.5 encapsulation dot1Q 5 ip address 1.1.1.1 255.255.255....


12

(Examples performed on ISR 1921 G2) Before we get into the details, I would suggest that instead of backing up your key, you just pull the new key from the new router and update your scripts. You will need to get onto the router without SSH to load the config/enable SSH anyways. This can be done with a script and console cable... you can even pull the new ...


11

Depending on which version of 12.x you're on, you should be able to do the following: router(config)#sip-ua router(config-sip-ua)#no transport tcp router(config-sip-ua)#no transport udp This stops the router from listening on port 5060.


11

Backing up the host keys to replace them is more trouble than it's worth. If you don't want your scripts to barf on key changes (in *nix), run ssh like this... ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no username@hostname This tells the ssh client to use an empty Known Hosts file and do not force strict key checks. As mentioned in the ...


10

It seems that the 6500 generates MPLS labels for every route if BGP is run in VRF. The fact that your IPv4 and MPLS TCAM usage is almost identical seems to indicate this as well. Can you try this command: show bgp vpnv4 uni all labels There seems to be a hidden command that makes IOS allocate labels per VRF instead of per prefix. mpls label mode all-vrfs ...


10

On a Cisco Nexus switch, the syntax for HSRP is actually "HSRP" instead of "Standby". In my experience, it makes it easier to troubleshoot as you know immediately which redundancy protocol you're dealing with (HSRP, GLBP, or VRRP). See this Cisco doc for more information on HSRP on the Nexus 7000 platform. First, be sure that you have enabled HSRP on the ...


9

You have two options. Option One: Configure DHCP smart relay (see more on this in the answers from Dave and Mierdin): ip dhcp smart-relay Option Two: Set up a shared-network statement in your dhcpcd.conf (assuming you're running a Linux-based DHCP server - see Peter's answer below if you aren't) shared-network "testing" { subnet 192.168.2.0 netmask 255....


8

My first thought is unicast flooding, especially if the counters increment in unison across a number of ports in the same vlan. I agree with Aaron that the counter decrementing sounds like a bug. The counter will probably roll over at 2^64, but that won't happen within seconds. I would consider a healthy rate of output drops to be zero, but this is not ...


8

If you mean how to disable the SIP ALG you can configure the following: no ip nat service sip udp port 5060


7

Regardless of whether your switch is performing frame forwarding (layer 2) or packet routing (layer 3), the following should work if the switch has a management IP address in the same subnet as the host you want to find: At the switch, ping the IP address you want to find. If the address is on the same subnet as the switch's management address, an ARP ...


7

I would take a look at this support document from Cisco. In part it recommends to run the following command to see which OID's were recently polled: show snmp stats oid This gives a readout for which OID's you are polling. It will allow you to see, by judging the time stamps, which OID is taking a long time to poll. This is usually where your problem ...


7

I haven't tried it yet but there is a GitHub repo someone made for Cisco IOS Syntax Highlighting for Sublime Text 2.


7

Oh the 6500. I run a small service provider network and run the 6500 as a PE router. Worst decision of my life. (That was an embellished statement, but you get my point.) I run full BGP routes in a VRF and have experienced a lot of problem surrounding this. You're example is not very surprising. As Daniel said in his post there is an LFIB entry for each ...


7

So it turns out that there is an argument that is implied when you invoke a command from Fabric called shell=True. To get things to work correctly I had to specify an argument shell=False. So for example, here is a command that I was running that was failing. def config_t(): run("config t") Which was producing the Line has invalid autocommand "/bin/...


7

Fabric is designed with a certain execution model; It assumes something, Bash by default, will run on the remote to execute your command. You can change what the remote command is though. You might try changing the remote command into a single space for when you're sending commands to something like a CLI (eg, Cisco IOS). See Fabric's Environment ...


7

Do a 'show proc mem sorted' and check for biggest memory users. If that's something that is not related to configuration, it may be bug in the code. If that's something that's related to configuration, you may consider re/deconfigure unnecessary services. As IOS can't defragment memory and you can't reclaim it unless some big allocating process frees memory,...


6

I tried searching in many ways but could find any http://www.cisco.com/go/fn Cisco Feature Navigator -> Research Software Select Software Type: "IOS" Select your desired Major Release, and Release. The "Platform" drop down will then include every platform that is designed to run that release. If you have a specific platform in mind, select "platform" ...


6

Summary You should use Cisco's Embedded Syslog Manager. ESM can dynamically modify or throttle syslog messages when they are generated on the router. ESM Demo I built an example (see bottom of answer) of how to rate-limit configuration messages within a test time window; for the purposes of this demo, I substituted [regexp {CONFIG} $::orig_msg] instead of ...


6

Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN.. because the 5505 has L2 switch ports rather than "L3 Routed Ports" If you want to protect somebody plugging into your switch interface and obtaining root-...


Only top voted, non community-wiki answers of a minimum length are eligible