Cisco SG-300 52 QoS default DSCP to queue mapping

Similar Questions

• How to console Access of Cisco SG 300 - 28 P

  Hi Experts,

  We have just a cisco SG 300 - 28 P switch. We tried the initial installation according to the manual, but we are not able access the switch to configure. Suite of methods we tried:

  1. connected a lan cable from a computer to an ethernet port on the switch, statically assigned 192.168.1.100 IP address to the computer and attempted to access switch with default IP address: http://192.168.1.254

  2 connected the serial cable that was awarded with the switch on a machine a I tried to access through terminal tera. I have seen cables serial that has RS 32 port to be connected to the machine and RJ45 adapter to the switch console port. But for this switch, it is opposite, IE the RS 32 port switch and RJ 45/machine.

  It would be great if we can access the switch through the console port. Please help me on this.

  Kind regards

  Martin

  Hello

  The correct console cable type is null-modem cable DB9 R232 has "Female DB9" connectors at both ends of the cable.

  Kay Lee Yiu

  Concentrix at Cisco

  .:|:.:|:. CISCO | Kay Lee Yiu | Pre-sales SMB | [email protected] / * / | Phone + 1 (855) 354-7776

  

• How to connect Cisco SG-300-10 L3 switch selector mode in Mode of L2 SG-300-20

  Ladies and gentlemen, please forgive me if you find my question too basic. But, I would really appreciate your help. I have two Cisco switches (SG-300-10 and SG-300-20) and I am struggling to connect with each other.

  Requirements: Switch Cisco SG-300-10 which is in needs of L3 mode to send the traffic of VLAN tagged to the switch Cisco SG-300-20, which is the mode of L2

  What I've done so now

  1 Cisco SG-300-10 (Mode L3) to the router directly connected and configured IP addresses, 192.168.0.21. The GVRP is configured for Port 5. Created the VLAN 1000 with interface IP (192.168.100.1) and configured the Port 5 trunk mode (1U, 1000 t)

  2 connected Cisco SG-300-20 (L2 Mode) to the router and set up the IP address management, 192.168.0.22. The GVRP is configured for Port 5. 1000 of VLANS created and configured the Port 5 trunk mode (1U, 1000 t)

  What does not work

  I can't access the address of management of the L2 (192.168.0.22) switch. Note that the L2 switch only on the uplink, which is to the L3 switch. Since the Port 5 also receives no marked traffic of VLAN1 (192.168.1.1), I'm assuming that he would receive the network management of VLAN1.

  Other Observations

  When I connect the cable between the two switches Port5, I expect to exchange information of VLAN, by documentation. But the lights flash at all.

  I tried other things

  I tried to connect Port 2 (1U) L3 Switch switch 2 L3 Port (1U). Yet, I can't access to the management of the L2 switch port. However, when I connect 2-Port L3 switch to my laptop, I get an IP address. That tells me that I have to solve the problem of management network pair before the switches.

  Hi Späti,

  I think the confusion is the use of the address IP address to you and how you manage your computer.

  VLAN 1 = 192.168.1.1

  VLAN 1000 = 192.168.0.21

  How I read that you connect layer 2 VLAN 1 on 192.168.0.21 switch to layer 3 of the same VLAN 1 interface to 192.168.1.1. It's confusing.

  So first thing to do is this - change layer 2 switch network 192.168.1.x IP and confirm management works on VLAN 1.

  If you want to layer 2 switch works on VLAN 1000, then you need to change the default VLAN 1000, then you can configure your uplink either as the way which you have 1u, 1000 t, or you can use 1000u.

  Your management VLAN on the layer 2 switch is VLAN 1 still unless you changed it (which did you not?)

  A next important thing for the layer 2 switch is going to be the default gateway. The switch of level 3, you need to specify the address IP of the VLAN 1000, which I think you did to 192.168.0.21/24. This 192.168.0.21 must be the default gateway for the layer 2 switch.

  Finally, the computer you connect to layer 3 switch, what that either VLAN that you choose to connect to (1 unidentified), you need to set the IP and default gateway appropriate. So if you're going to VLAN 1 then your computer is 192.168.1.x with gateway 192.168.1.1

  And for the comment extra, GVRP is a horrible Protocol and very pitiful, I don't recommend to use.

• Configure the VLAN voice and data in CISCO SF 300 8 P

  I have a couple of Cisco SF 300 8 P and P 24 switches. I have voice and data VLANS configured as:

  Data VLAN: default 145.17.59.0/24

  Voice VLANS: VLAN 20 172.22.20.0/24

  I have different DHCP servers regarding the data VLAN, we have a physical server that is configured for 145.17.59 * extended IP and Voice VLAN DHCP Server is configured as a router gateway with option 150.

  This configuration works very well with other cisco 2960 switches and 3750 etc. except CISCO SF 300 8 P and 24 p. I tried to set up the voice and data VLAN in these CISCO switches so that phone CISCO (model 6941) should get IP of the VLAN voice and PC should get the IP address of the DHCP server on the data VLAN. I tried several techniques such as LLDP, Port-to-VLAN Config etc.

  Can anyone please guide me / help on this.

  Kind regards
  A K.M.Sayeed

  Hi A.K.M., with Cisco phones you should be able to define simply automatic voice VLAN to be VLAN20.

  ID of the vlan 20 voices

  You must ensure CDP or LLDP is enabled as well. I would check in the web GUI. DHCP for phones can come from a DHCP server on a port access VLAN20 switch, or you can use dhcp for assistance to redirect DHCP server elsewhere.

  If you prefer or you have problems with the CDP or LLDP, you can also program the ports as trunks and add the tag VLAN 20 for them.  In this scenario, you need to ensure inter - vlan routing works and phones that download the file config with corrrect VLAN config.

  These switches do not run ios, so they are similar, but different from the catalyst switches that you mentioned.

  -remember messages useful rate.

• Problems of implementation of VLANS on Cisco SG 300-28 comments

  Hello

  I'm mainly curious if the configuration that I explained below is actually possible, and if so how do I implement. I know that this isn't the easiest configuration and I need to put in place without buying any equipment more if possible.

  I have a SG Cisco 300-28 with three Setup VLAN

  Vlan1 (company) - 192.168.10.0 - switch IP 192.168.10.254

  VLAN2 (VOIP) - 192.168.20.0 - switch IP - 192.168.20.1

  VLAN3 (guest) - 192.168.30.0 - switch IP - 192.168.30.1

  Default gateway is 192.168.10.1 (Netgear router)

  I have a wireless network setup (Netgear WMS and WAP 2) configured with TWO VIRTUAL (1 and 3) networks. They enter ports on the Cisco SG 300 - 28 which are marked on the two VIRTUAL networks. The wireless carriers has worked well, but the guest network is not reout on the Internet.

  After some troubleshooting I realized that the reason wasn't the guest was because there was no path routing of the internet to the router.

  The router I have is not really ideal, it is a Netgear DGN2200, but I managed to create a static route to 192.168.30.1 with a metric of 2, 192,168,10.254 being the jump.

  Success, the connection worked, the only problem is that now my guest network can see my business network because the corporate network uses the static route on my router to router on the guest network (due to the limitations of this device I can't do anything about it)

  So basically, what I have is

  Network Guest can connect to Business VLAN switch. I guess that's because the router is on the VLAN of Business and the default gateway is the router. As they are on the same network the Guest inevetably network can see the network and the server of the company.

  The network of the company can return to the network invited through the router using my static route, I created. The static route is really basic and I can't create a firewall on the router rule to prevent the business network addressing network comments because there is only one LAN - WAN firewall and this connection is LAN - LAN.

  What I need, is...

  somehow stop all traffic from the 192.168.30.0 network routing to what anyone on the 192.168.10.0 network, apart from the router to 192.168.10.1.

  Is this possible? I have this setup at several different site, the only difference is that I have a router from CIsco security on the latter with the VLANS configured so that I don't have this problem. Because I have a Netgear DGN2200 rather limited, I cannot configure the VLAN correctly, and as such, I need to see if I can do this on the switch somehow.

  Any help would be appreciated.

  It is my first post says in the way, so if I missed something that anyone would help then please let me know.

  Kind regards

  David

  Hi David,

  Why not apply an access list to filter incoming traffic in the SG300 switch such as, via the command line or GUI.

  Here is an example below, certainly not comprehensive, just an example

  ,

  Remember, we use the reverse masking of the ACE;

  config

  restrictGuest extended IP access list

  deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
  deny tcp 192.168.30.0 0.0.0.255 any 192.168.30.1 0.0.0.0 www
  deny tcp 192.168.30.0 0.0.0.255 any 192.168.30.1 0.0.0.0 telnet
  deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255

  allow an ip

  output

  interface gigabitethernet1

  Service-acl input restrictGuest

  output

  Don't forget to save the configuration with the following command and respond to the prompt.

  To write

  or do it via the GUI method

  Step 1.  Create an ACL name

  

  step 2, add the ACE base port which is the list of filters.

  

  step 3.   Apply or binding the list to a port so that the port can watch and filter pattern matches to detect traffic in the switch.  I gave you an example of an ACE list above, you can be more creative in what you refuse.

  

  step 4. Now add or copy the entry in other ports on the switch.

  Be sure to save your changes to the configuration.

  I hope this helps.

  Best regards, Dave

• Profile of Cisco 42 '' question marking QoS DCSP for signage package

  Hello

  We have 42 profile Cisco with below specifiction.

  Software version: TCNC4.2.1.265253 product: TANDBERG profile 42 C20

  All the call made by Gatekeeper (VCS 7.1)

  DiffServ QoS is configured on the device.

  During the sip call or SIP registration, regardless of the package comes from video endpoint. I see the value DSCP is 0x00

  But any package from VCS, I see the DCSP value is AF31 0x1a.

  But we have configured singnaling (value 26) QoS on Cisco profile 42 end point. Screenshot is attached.

  Also, we have configured VCS Diffserv QoS and value 26.

  In this case, why we are not able to see any marking signs of Cisco profile 42?

  I have attached the screenshot of output wiresark. Also, I downloaded wireshark message output.

  For the RTP stream, we can see package is marked as being configured IE AF41.

  There is no other device does not change the marking.

  Please suggest.

  Rgds

  Rajesh

  Thanks teak: it's mactching DDT allright!

  If moving to TCNC5.1.6 or even TCNC6.0.0 (just released) should solve the problem.

• Cisco SG 300-20 switch connects to the router

  Hello

  I try to install my new switch Cisco SG300-20 in my local network, but I'm not succeed.

  The SG 300-20 fails to connect to my router.

  When the router is directly connected to the SG 300-20 I fails to obtain the DHCP configuration. Any port I try fails.

  When I add a former switch between the router and the SG 300-20, SG 300 - 20 manages to get the DHCP configuration.

  When I use a static IP on the SG 300-20 and the router is directly connected, it is not an operational bridge in the IPv4 configuration.

  Where I'm looking for a solution?

  The SG 300-20 is maybe defective and I would stay there?

  A. van Egmond

  A few things you can check are:

  See if the system is blinking. If it is the default ip address. If it is solid the IP address has changed due to a static assignment or DHCP.

  If no link light is on or the system flashes, the reason why could not tear out DHCP is due to a shift of port negotiation. Try setting the port on the router or the full 100 MB switch or what ever you like just to see if that helps.

  Make sure that you are also on the latest firmware.

  Try factory default of the switch with the button of reset for 45 seconds.

  Cisco Small Business Support Center

  Randy Manthey

  CCNA, CCNA - security

• Configuration of VLAN Cisco SG 300-10

  I just got a 300-10 switch Cisco SG and I am a relative novice working with smart switches, so bear with me. I added a VLAN (VLAN 2) and assigned port 7. So now, there is the default VLAN 1 and VLAN 2. The IPv4 Interface is:

  VLAN 1

  Interface: VLAN 1

  Type of IP address: static

  IP address: 172.26.0.192

  Mask: 255.255.0.0

  Status: valid

  VLAN 2

  Interface: VLAN 2

  Type of IP address: static

  IP address: 172.27.0.1

  Mask: 255.255.0.0

  Status: valid

  The default gateway is 172.26.0.252.

  IPv4 static routes now look like this:

  

  I changed the mode of the system of layer 3 to layer 2 since I guess I have to make a VIRTUAL LAN see devices on another. I have a mute switch is connected to port 7 (VLAN 2) and a laptop connected to the mute switch with IP 172.27.0.117. On the SG 300-10 switch port 1 is connected to the default gateway (172.26.0.252), and port 2 is connected to a PC with the IP 172.26.0.136. From the Office I can access the internet through the default gateway. As expected, I can't access internet from the laptop (IP 172.27.0.117) I see the desktop because they are on separate VLANs. I want to be able to access the internet and also to be able to see my office (172.26.0.136) of the laptop, so I need the VLAN to be able to access the devices on the other. How would I go to do this? Moreover, all this is done in a test environment because I make sure I get this right before deployment. Thanks for your help on this.

  I have a few questions about the installation:

  (1) what is the default value as the value Gateway for VLAN1 on 2 ports (172.26.0.136) PC?

  (2) is your Internet on Port 1 VLAN 1 (172.26.0.252) gateway, a static route for the 172.27.0.0 pointed out what subnet VLAN 1 (172.26.0.192) as the next hop router?

  (3) is the default gateway for the laptop computer on Port 7 VLAN 2 pointed VLAN 2 (172.27.0.1)?

  If the General Directorate for the PC in the VLAN 1 is the gateway/router Internet router/gateway would require a road static to the interface VLAN 1 IP address for the subnet on the LAN VIRTUAL 2 so that the routing table in the switch can be used. By setting the static route to the Internet this router will fix the problem of connectivity Internet of VLAN 2 as well. Basically the Internet router needs to know how to do and the 172.27.0.0 subnet via the switch. Hope this helps.

• Inter vlan routing on a Cisco SF 300-24 port switch only no internet except when scanning with wireshark

  Hello

  I'm get inter vlan routing to work on a 300-24 ports switch DF.    I have a network of business existing on 192.168.111.0 and want to create a vlan on 192.168.1.1 which can talk to 192.168.111.0.    I activated the layer 3 routing on the switch through the console and also provided ip routing commands. I have the following VIRTUAL networks:

  Vlan1 - default 192.168.111.0

  VLAN2 - 192.168.1.0

  I turned on DNS and provided my two servers DNS 192.168.111.82 & 192.168.111.212.

  I updated the VLAN1 interface 192.168.111.217 and VLAN2 interface 192.168.1.1.

  The FE1 - FE15 ports are access ports and assigned to VLAN1 (unidentified)

  FE16 - FE24 ports are access ports and assigned to VLAN2 (unidentified)

  I put a default route for the switch to 0.0.0.0 0.0.0.0 192.168.111.254 (router Draytek 2600). I have connected a computer (A) at the port of VLAN1 FE3 and a computer (B) to VLAN2 FE16 port.   I put its IP address and computer default gateway has to 192.168.111.217 to 192.168.111.94.    I updated computer B default gateway 192.168.1.1 and 192.168.1.2 IP.

  Computer A has access to the Mdaemon Server files via the network grows but no internet (cannot ping google) and can ping computer B and RDP on computer B.

  Computer B can ping computer A and RDP on A computer but do not have access to the company network i.e. MDaemon, file server etc.   It can also access the internet.

  The console I can ping www.google.co.uk and all the ip addresses in the network of the company i.e. 192.168.111.82 (DNS server).   I do not understand what I am doing wrong and have been banging my head for staretd a few days a new job and desperately need to work so any help would be greatly appreciated

  If I have computer scanner a wireshark wirh internet starts working wheird!

  Show the configuration below:

  switch7c0a71 #show run

  database of VLAN

  VLAN 2

  output

  Add a voice vlan Yes-table 0001e3 Siemens_AG_phone___

  Add a voice vlan Yes-table 00036 b Cisco_phone___

  Add a voice vlan Yes-table 00096e Avaya___

  Add a voice vlan Yes-table 000fe2 H3C_Aolynk___

  Add a voice vlan Yes-table 0060 b 9 Philips_and_NEC_AG_phone

  Add a voice vlan Yes-table 00d01e Pingtel_phone___

  VLAN voice Yes-table add Polycom/Veritel_phone___ 00e075

  Add a voice vlan Yes-table 00e0bb 3Com_phone___

  interface vlan 2

  IP 192.168.1.1 255.255.255.0

  output

  interface vlan 1

  IP 192.168.111.217 255.255.255.0

  output

  IP route 0.0.0.0 0.0.0.0 192.168.111.254

  interface vlan 1

  no ip address dhcp

  output

  Hello interface range vlan 1

  hostname switch7c0a71

  No complexity of passwords allow

  No server snmp Server

  interface fastethernet1

  switchport mode access

  output

  interface fastethernet2

  switchport mode access

  output

  interface fastethernet3

  switchport mode access

  output

  interface fastethernet4

  switchport mode access

  output

  interface fastethernet5

  switchport mode access

  output

  fastethernet6 interface

  switchport mode access

  output

  interface fastethernet7

  switchport mode access

  output

  interface fastethernet8

  switchport mode access

  output

  interface fastethernet9

  switchport mode access

  output

  interface fastethernet10

  switchport mode access

  output

  interface fastethernet11

  switchport mode access

  output

  interface fastethernet12

  switchport mode access

  output

  interface fastethernet13

  switchport mode access

  output

  interface fastethernet14

  switchport mode access

  output

  interface fastethernet15

  switchport mode access

  output

  interface fastethernet16

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet17

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet18

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet19

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet20

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet21

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet22

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet23

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet24

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface vlan 2

  name of development

  output

  Hi Richard,

  43 - permit Protocol: any / all

  42 - Protocol deny EVERYTHING 192.168.2.0 0.0.0.255-> to 192.168.111.0 0.0.0.255

  41 - Protocol to deny ALL 192.168.111.0 0.0.0.255-> to 192.168.2.0 0.0.0.255

  40 allow the RDP Protocol TO ALL

  etc.

  To block everything, including MSSQL, with the exception of the RDP and other ports that you defined above.  The other defined are simply not the RDP Protocol and service work?

  Richard, do note useful messages and identify the right answers.

  Best,

  David

• Remove image of Cisco SF 300-24 flash problem

  backuplo rw 851760 26 August 30, 2011 10:47:28

  directry.prv - 65520 - August 30, 2011 10:46:37

  image-1 rw 7274496 7274496 August 30, 2011 10:46:37

  image-2 rw 7274496 7274496 August 30, 2011 10:46:37

  mirror-config rw 131040 15725 October 20, 2012 17:18:41

  sshkeys.prv - 131040 - August 30, 2011 10:48:01

  startup-config rw 131040 15487 may 10, 2013 12:21:19

  syslog1.sys r-65536-10-may-2013 12:12:14

  syslog2.sys r-65536-10-may-2013 12:12:14

  #show bootvar

  Image filename Version Status Date

  -----  ---------  ---------   ---------------------   -----------

  image 1-1 1.0.0.27 April 28, 2010 13:33:55 not active

  image 2-2 1.1.1.8 August 30, 2011 10:46:34 Active *.

  "*" means that the image has been selected for the next reboot

  Flash://image-1 #delete SF300

  Delete flash://image-1 [y/n]? There

  Delete operation is not allowed on the file flash://image-1

  Am I missing something?  I'm not terribly familiar with the 300 series CLI.

  Thanks in advance.

  Nicholas, remove the flash image is not supported. (In other words, you can't).

  -Tom
  Please mark replied messages useful

• Enable Telnet in Cisco SF 300

  I have more than 20 SF 300 - 24 p 10/100 switches managed switch deployed and running in my business network. All these switches have activated the web configuration utility. We want to activate telnet too. But for this I know I have to visit a site, connect the switch manually with a laptop computer and enable the telnet option.

  I'm looking for how can I activate telnet in these swithches using the switch web-based configuration utility.

  Can someone please help...

  Wrong forum, try it ' small business - switches. You can move your message by using the panle to Actions on the right.

• Cisco C240-M4SX / 12G SAS Embedded Raid Controller Queue depth Reporting resulting in ESXi 6.0

  All,

  We have been a customer of vSAN VMware 6.0 for the last 6 months of our environment entirely on servers of Cisco C240 M4SX with the Cisco 12 G SAS integrated Raid Controller.   Everything in the environment was working well until we started to bring in data warehouse loads in the environment and began to notice performance around latency of disk and most important issues still outstanding IO high.  After that ESXtop and ESXCFG examination we found that the length of the queue announced to the adapter ESXi has been only 234 however the VMware HCL Announces 895; 234 is below minimum spec of 256 to correctly implement vSAN.  We have worked diligently with VMware on it to try different versions certified and non certified driver async for this raid controller in addition to the most recent firmware for the raid controller.  Regardless of the change of the depth of the queue remained 234.  The presence of FBWC affect the depth of queue announced to the operating system?  VMware support has indicated that it is clearly a problem "hardware".  Any ideas as to what may be causing this?

  Our environment:

  C240-M4SX

  Integrated 12G SAS Raid Controller (operation JBOD / pass-through, not FBWC)

  UCSM 2.2 (6 c)

  Driver of VMware for controller: 6.606.06.00 - 1OEM.550.0.0.1331820.x86_64.vib

  VMware vSphere 6.0U1

  12 - 28-2015_5-51 - 31_pm.png

  

  12 - 28-2015_5-56 - 51_pm.png

  

  Greetings.

  Had the chance to spend some time in the laboratory and removed the cache module.

  After that, I now get "207", so I would say it's confirmed that 1,2,4 GB cache modules are used to increase the depth/length of the queue for these controllers.

  12gb_sas_qdepth_no_cache.jpg

  

  Thank you

  Kirk

• SG-300 QoS Cisco on SNMP statistics

  Hello.

  I would like to monitor my Cisco SG-300 statistical QoS switches SNMP.

  I found the statistical QoS configuration page where I could set up two counters.

  Now, I have two questions:

  (1) how to read statistics QoS on SNMP counters?

  (2) I get the distinct quality of service statistics for each single port or following QoS limited to only these two counters?

  OK, move this thread... He worked subsequently in a manner:

  • Download Managed Switch MIB - 1.4.0 available here
  • If you have Linux, extract and put all the files in/usr/share/snmp/MIB/directory
  • now, you'll be able to get all the stats desired by yourself using snmpwalk
  • Here is list of the available QoS all variables related MIB:

  rlQosAceTidxTable
  rlQosAclTable
  rlQosAggregatePolicerStatisticsTable
  rlQoSApplicationDefaultAction
  rlQosClassifierRulesNumberUtilizationSystem
  rlQosClassifierUtilizationSystem
  rlQosClassifierUtilizationTable
  rlQosClassMapTable
  rlQosClearCounters
  rlQosCosQueueDefaultMapTable
  rlQosCosQueueTable
  rlQosDscpMutationTable
  rlQosDscpQueueDefaultMapTable
  rlQosDscpQueueTable
  rlQosDscpRemarkTable
  rlQosDscpToDpTable
  rlQosEfManageTable
  rlQosFreeIndexesTable
  rlQosIfPolicyTable
  rlQosIfProfileCfgTable
  rlQosMaxNumOfAce
  rlQosMibVersion
  rlQosModeGlobalCfgTable
  rlQosNamesToIndexesTable
  rlQosOutQueueStatisticsTable
  rlQosPolicerTable
  rlQosPolicyClassPriorityRefTable
  rlQosPolicyClassRefTable
  rlQosPolicyMapTable
  rlQosPortToProfileMappingTable
  rlQosQueueProfileTable
  rlQosQueueShapeProfileTable
  rlQosSinglePolicerStatisticsTable
  rlQosTupleTable

  • and you can extract data using the snmpwalk command (you must have installed the net-snmp package):

   snmpwalk -v 2c -c CommunitySecret X.X.X.X MIBvariable

  where:

  • CommunitySecret is the Readonly or Readwrite community string, you have defined on the switch
  • Where X.X.X.X is your IP of the switch management
  • MIBvariable is your MIB variable name selected in the list above.

• dot1x fail loop

  Ciao,.

  I've isolated a stange case in dot1x Scenario:

  • IP phones are authenticate via MAB several areas (Cisco IP Phone 7962 Version: SCCP42.9 - 0-3)
  • Pass C3560-IPBASEK9-M ios Version 12.2 (55) SE1 and 12.2 (55) SE6
  • Cisco ACS 5.2

  Dot1x are activated on the phone and he try to authenticate using MIC. This OK

  ACS, has no Cisco MIC CA ROOT and then it does not authenticate the phone: OK that

  EAP - TLS failed SSL/TLS handshake because of unknown CA in the client certificate chain

  Now this process loop that I see on AUTHMGR:

  August 10 to 13:44:53: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000ED00367B2C

  PED-SW-TESTNAC-136 #.

  August 10 to 13:44:55: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000EE0036832B

  PED-SW-TESTNAC-136 #.

  August 10 to 13:44:57: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000EF00368B2A

  PED-SW-TESTNAC-136 #.

  August 10 to 13:44:59: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F000369318

  PED-SW-TESTNAC-136 #.

  August 10 13:45:02: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F100369B0E

  PED-SW-TESTNAC-136 #.

  August 10 13:45:04: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F20036A2F4

  PED-SW-TESTNAC-136 #.

  August 10 13:45:06: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F30036AAEA

  PED-SW-TESTNAC-136 #.

  August 10 13:45:08: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F40036B2F2

  PED-SW-TESTNAC-136 #.

  August 10 13:45:10: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F50036BAF9

  PED-SW-TESTNAC-136 #.

  August 10 13:45:12: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F60036C2E7

  PED-SW-TESTNAC-136 #.

  August 10 13:45:14: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F70036CAE6

  No comments or MAB VLAN are deployed... It isn't okay

  Port configuration:

  interface FastEthernet0/2

  HIGH DRY MODE description

  switchport access vlan 117

  switchport mode access

  switchport voice vlan 417

  priority queue

  authentication event failure action allow vlan 195

  action of death event authentication server allow vlan 117

  no response from the authentication event action allow vlan 195

  multi-domain of host-mode authentication

  Auto control of the port of authentication

  restrict the authentication violation

  MAB

  MLS qos trust device cisco-phone

  MLS qos trust dscp

  dot1x EAP authenticator

  dot1x tx-time 10

  spanning tree portfast

  end

  I'm trying to authenticate with MIC. It works

  I modified the Decree mab dot1x authentication that works

  But is there a method to avoid it? Why the phone does not stop after 3 attempts?

  Grazie a tutti,

  Iarno

  Hello

  This may be the show hit you:

  MAB starts immediately after a failure of IEEE 802. 1 X, there are no problems of timing. However, to trigger the MAB, the endpoint must send a packet after the failure of the IEEE 802. 1 X. In other words, begging him to IEEE 802. 1 X on the endpoint should fail open.

  It is at the beginning of the guide that you posted before.

  Sent by Cisco Support technique iPad App

• Force 10 SERVICE POLICY INPUT using action TRUST DIFFSERV

  Every afternoon,

  I use a Force10 Dell (S4810) in our data center.

  I configured a service policy on the interface of our main switch facing our MPLS network. At the other end of the network MPLS is a remote site with Cisco phones deployed. All the call voice and Manager of gateways are connected to the force10 within the data center so all voice traffic will cross the SPLM.

  Service policy is configured as INPUT with an action to trust diffserv. I use this Setup to ensure that packages marked voice EF are a strict priority.

  My question is, can I use the service of politics on the interface to the network MPLS with an ENTRY, EXIT, or both?

  Configuration as follows:

  Policy-map-input trust-dscp
  Trust diffserv

  INTERFACE connected to the MPLS:
  interface you 0/39
  service-policy input trust dscp

  Global configuration:
  unicast strict-priority 2

  Call flow

  Telephone remote - access - distribution - MPLS network switch desktop - based DC (force10) - voice gateway

  Finally, can I use several strict priority queues? For example, priority strict unicast 1 so that I can give traffic priority AF scored? I guess that the 2 queue is served before 1?

  Thank you very much in advance for your help

  Kind regards

  Jim

  I apologize to this subject, my understanding of strict control was incorrect. After some tests, I have come up with the same results as you and wasn't able to configure both. Here's a short KB article which shows an example of configuration using strict control. It also has a chart showing the DSCP to queue mapping.

  http://Dell.to/2dJJlhT

  A way to confirm the DSCP values are currently kept and passed correctly, would be to perform a packet capture and discovers the DSCP values in wireshark.

  http://bit.LY/2dZG7EE