Traffic Shapping on switches ESW500

Similar Questions

• Best practices of priority network traffic at the switch

  What is usually the best way to prioritize the specific traffic a VLAN specific?

  I work with the differentiated Services to match the traffic of a VLAN specific and assign a queue of 6 switch to give traffic a higher priority than normal traffic. But I'm not sure that with this configuration. I red on the priority of traffic from the switch but I didn't understand any of this I think.

  The police are certainly working. In the web interface, I see that are packages offered for the DiffServ, according to me, I'm missing something...

  Config:
  Policy-map {policy name} in
  class {class name}
  Assign-queue 6
  output
  interface port-channel 1
  service-policy in the {policy name}

  Just a brief update: I think that my setup works fine. I figured out that the ping response delay has more to do with the terminal and then with the configuration of the switch :)

• Separate VSANS / Mgmt / Vmotion traffic on different switches

  Hello

  I want to build a hybrid Cluster VSAN 4 knots (6.x).

  I have 2 x 10GE switches dedicated for Taffic VSAN

  also 2 * 1GBE switches for management / VM / Vmotion traffic

  Each host has 2 10 GbE NIC, 1 uplink for each of 10GBE switches

  Each host also has 4 * rising 1GBE, 2 for each of the switches 1GBE

  My idea is to use 10GBE just for VSAN traffic (separate DVSWitch, an asset, a standby) on each 10GBE switch

  Also to use 2 Ports on the management traffic (separate DVSWitch, an asset, a standby) on each 1GBE switch

  And use 2 Ports on traffic VM (separate DVSWitch, an asset, a standby) on each 1GBE switch

  VMotion traffic would be on the same rising as management, but active / standby vice versa

  Question: is - this possiuble / useful to connect vmotion for 10 GbE uplink ports (active standby vice versa VSAN traffic)

  I appreciate any useful comment on my scheduled install (I have no boy networking)

  Couple thoughts.  You can run several vKernels to VSAN and vMotion (allowing one on each switch).  To VSAN, use of VLANS / subnets (one on each switch offers you a pleasant has / B space) while vMotion must have all the vkernel on the same subnet 2 ideally layer.  This allows for maximum reliability, in theory faster failover and access flow.  This also has the advantage of if your cluster is not big (bigger that say 48 ports) you can avoid having multicasting, leaving the switch (usually requires more quarrels with the cats of network) as each switch TOR will have its own VSAN network.    Then use the NIOC for butterfly and protect the traffic between them.  Now the NIOC is not as effective as SR - IOV (but its good enough) to 100% and you will maximize your investment 10 Gbps without swamping the things.

  • Network management interface VMkernel = explicit order of Fail-over = active P1 / P2 ensures 10.1.1.1/24 VLAN 100
  • vMotion VMkernel - an explicit order of Fail-over = interface = active P1 / P2 ensures 10.1.2.1/24 VLAN 101
  • vMotion VMkernel-B interface = explicit Fail-over order active = P2 / P1 ensures 10.1.2.2/24 VLAN 101
  • Machine virtual Portgroup = explicit Fail-over order = active P1 / P2 ensures 10.1.2.1/22 VLAN 102
  • Virtual VMkernel-A SAN interface = explicit order of Fail-over = active P1 / P2 in standby (or not use) * 10.1.3.1/24 VLAN 103
  • Virtual interface of SAN VMkernel-B = explicit Fail-over order active = P2 / P1 Eve (or not use) * 10.1.4.1/24 VLAN 104

  In this case, VLAN, 100, 101 and 102 will be on all switches.

  * 103 and 104 could be configured to only exist on each switch (has / B isolation, failover do not switch on the value and set up on both) or exist on both (and use standby) as described.  This design will focus on maintaining the communications host-to-host on the same switch (decreases complications with multicasting and reduces its lag time as VSAN traffic does not have to jump to another switch unless you run out of switch ports, but now with dense 40Gbps past using 10 Gbps break out in theory you could hit the limit of 64 nodes on a single switch).

  I'm curious of anyone thoughts on just disable the failover and forcing them to each core sticking to its switch (and accepting loss of communication) on this vKernel in the event of a switch failure.  I want to do some tests with both laboratory and to test the failover of the switch/path between both of these configurations (compared to a configuration unique vkernel).

  However, some people prefer a 'simpler' configuration if (and I'm not opposed to that).

  Duncan drawn active passive failover configuration with of the vKernel unique for each host.

  In theory not being not not as dependent on the NIOC for insulation of storage should help the latency for the short bursts it takes to NIOC launch design active active vs.

  Control IO SAN and virtual network

  • Network management interface VMkernel = explicit order of Fail-over = active P1 / P2 ensures
  • vMotion VMkernel interface = explicit Fail-over order = active P1 / P2 ensures
  • Machine virtual Portgroup = explicit Fail-over order = active P1 / P2 ensures
  • SAN VMkernel virtual interface = explicit order of Fail-over = P2 active / standby P1

• Vlan trunk between switches traffic encryption

  Hello

  Can someone guide me to some documents and other resources on how to encrypt the traffic between 2 switches. The switchces will be connected with fiber and use the marking dot-1 q. And I wan't to encrypt all traffic to shared resources.

  I was thinking about L2TP, but I have not found a good description on how to implement this. I have two 3750 switches, I thought I could use.

  Thank you for any input,

  Kind regards

  Paul Mathiesen

  mnemonic

  Norway

  Hello

  Thanks for the reply. I had a look at effect and it seems good. I would have liked to use something P2P but also limit the amount of MAC addresses on the "wire". But let me first give you an understanding of the task:

  We have two sites, linked by fiber, and we want to create a trunk VLAN everywhere and to expand the broadcast domains to you another site.

  The carrier FOOL, has a limitation on the number of MAC addresses, they allow the service to fiber, 100.

  We also encrypt the datatraversing this connectivity.

  MACsec wuold work 100% exept the source and dstination MAC addresses are still sent (at least according to https://docs.google.com/viewer?a=v&q=cache:LEf2qOmYZyYJ:www.ieee802.org/1/files/public/docs2011/bn-hutchison-macsec-sample-packets-0511.pdf+&hl=en&gl=za&pid=bl&srcid=ADGEESgmAHXpDOY0RBAE-Rv1HDpu_C_gkeSPN4cv6NGgyP0M1aXVu0UqzCfxo8t_P41ep6J37k4OLKnjfp1M9hoTDHxY22WGz2h7yB7YRLyPvRUbGS8TICzvEMlG92xqbhy6RWFugmnj&sig=AHIEtbTfu0LQIJejdYidE6yzq4lpPifxjQ
  )

  And who tempt me to eat in the limit of MAC 100.

  Ridiculous I know, but we are looking for an out-of-the-norm plan...

  Thank you

• IDS on switch

  How should a switch and IDS be configured to allow all traffic on the switch to monitor by the ID?

  Here you go:

  http://www.Cisco.com/en/us/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

  Concerning

  Farrukh

• Implementation of QOS for on multiple switches for two VLAN

  afternoon all that I was looking for a little help in configuring QOS for two local area networks VIRTUAL, I created. These will be for voice traffic vlan 22 and traffic video vlan23. I also have three other VLAN for pc, wireless devices and our cnc machines. We have 5 switches which are all SG30028P with a single switch making the intervlan routing (Layer 3-powered). all switches are resources shared by the main switch and ive been through the guide written on how to do it on a single switch, which I think is layer 3.

  could someone help me with what I want the video and voice to take precedence over the rest of the traffic

  best regards Patrick

  Right, this way, you can give priority to IP or MAC address.

  No, there is nothing different, only one review of the routing. As the L3 switch can make local routing decisions, the placement of the ACL can vary. In an L2 environment, all packages are transferred to the router, then back down the network to the local destination, so you can clear an ACL on the uplink.

  Since you have a L3 switch, you can practice the same, empty an ACL on the link downstream for L2 switches for all traffic subject to the ACL. Any connection to the L3 switch, you can of course apply an ACL to the uplink router to get all notice of incoming traffic correctly. You can also apply a policy on port source interface to get the note as soon as traffic hits the switch.

  QoS policy is the concept of an ACL, you want it is the closest to the resource. If you apply a QoS policy an uplink upward, QoS will be marked up when it hits this port. Not before. So it should be applied closest to the device as possible. Many times, local QoS is not as important, until it starts to get to the router. As most Cat 6 environments can generally manage all local traffic. So, depending on the number of devices and the amount of traffic, a decently robust network can handle all traffic local then you just give priority to the uplink remarks to ensure that what is important is first.

• 5508 interfaces with two different switches configuration

  Hello

  I have a 5508 WLC and two 4507 switches that are configured in HSRP.

  Now, I want to configure 5508 interfaces:

  If I want to configure management interface, I need the physical port card

  Question: How can I correspond to two physical port that are connected to two different chassis?

  Configuration interface AP-Manager's optional?

  in this scenario, I'll have to divide AP traffic between two switches (EQ. Assume that 10 aps are, I want to connect to a switch and another 5 to another switch 5).

  How to divide?

  Please guide me to configure the interface in this scenario...

  I have with your answer.

  Hi Vinod,

  Wasn't this already answered here: https://supportforums.cisco.com/thread/2052962 ?

  HTH,
  Tiago

  --

  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• The security design: DMZ ports on internal switch - bad idea?

  Hi all

  I'm looking for a compelling - or he said is not serious - why a customer should not creator of DMZ VLAN on a cat internal-6509.

  Basic topology is a 6509 in a controller area and 2 x ASA - 5510 to active / standby. They finally agreed to start using the DMZ for different services, but because they have no other switch on the domain controller, they are happy to have these DMZ on VLANS separated on the 6509.

  Is this a security risk? (They do NOT use the 6509 as an 'outside' switch so it's something that I guess)

  How the risk can be mitigated?

  How their environments could be compromised?

  Any suggestion is appreciated. Thanks in advance,

  Mike

  I don't see a problem with this setup as:

  (1) External / DMZ is LAYER2 ONLY! Use a safety device to manage all Layer 3 (Firewall, FWSM, etc...)

  (2) you turn off the proxy arp on ALL layer 3 interfaces on the switch.

  (3) you don't give anyone access the switch unless they know what they do (understand the implications of having mixed traffic on the switch)

  (4) configure you a vlan fake, make sure that everyone knows what it is (put a name in it and it document) and make the vlan by default for your switchports.

  (5) you turn off the trunk negotiation (all ports must be configured "switchport mode trunk" or switchport mode access and also "switchport nonegotiate". If you use 802. 1 q (or isl - ugh), explicitly set the VLANs that are allowed to pass "trunk allowed vlan switchport x, y.

  (6) use VTP transparent and not trunk VLAN external to other switches, unless you know what you're doing.

  The most important is probably #3. A layer interface moved 3 or IVR and game over, you filled just Internet to your internal network. I can't emphasize enough that, if this is possible and safe if done correctly, it is VERY dangerous if you don't know what you're doing. Some consider too high of a risk to take and to believe in the physical separation to eliminate the risk. I agree, however, I understand that not all of us can afford to purchase several 6500 s.

  Another thing to consider, did you think to use VRF-Lite?

• High utilization of the processor in Mode VSS when traffic through the internet.

  Hi all

  I have a problem with the installation of VSS. The VSS service install act as a central office switch of transit for internet traffic and the problem arises when there are about 600 Mbps of traffic through the switch. We notice that there are a lot of packages being softswitch and the rate is quite high, almost like 100 to 200 k per second.

  The VSS switch manages ospf and BGP and have plenty of internet routing. After investigation of high CPU usage, I noticed that the AAGR switch is full and has tried to set the course of max mls to the maximum cef and restarted the VSS service.

  Unfortunately, the problem persists after restarting.

  We had planned to filter the full internet routes and enable by default and ospf route only in the VSS service and restart the VSS service to make sure that the table AAGR is not overloaded.

  If I fail the next step is to return to autonomous mode and hope that the processor will not pull up.

  My Question: These step will prevent the issue? Suggestions or the reference similar to the problem I am facing in?

  Hello Sophie,.

  unless you have a PFC 3CXL and all the DFCs the AAGR 3CXL can manage only 256 000 IP prefixes and nowdays that complete a table is in order or 310-320 000 routes.

  See

  http://www.Cisco.com/en/us/prod/collateral/switches/ps5718/ps9336/product_data_sheet0900aecd806ed759_ps708_Products_Data_Sheet.html

  http://www.Cisco.com/en/us/prod/collateral/switches/ps5718/ps708/product_data_sheet09186a0080159856.html

  See table 1 in the second link it tells what I wrote in the first line.

  > We planned to filter the full internet routes and enable by default and ospf route only in the VSS service and restart the VSS service to make sure that the table AAGR is not overloaded.

  You should not need the device after accepting only the default route in OSPF or BGP AAGR use will be greatly reduced this is just wait a few minutes (unless there is an underlying SW bug) for the MSFC to update CFP and then all DFCs

  Hope to help

  Giuseppe

• Logical switch without DLR

  If I choose not to deploy a DLR, but deploy logical switches, can I still make all routing on my physical routers?  Of course, this is not recommended, but is it possible?

  You would need something method to get traffic from the logical to the physical network switches.  Traffic on these switches logical in order to join the physical network to one of the two or three things:

  1. bridge the VXLAN with a VLAN (logical switch in distributed port group).  6.2 NSX, this requires a DLR.

  2. connect the logical switch to a service gateway to dashboard as the default gateway and the uplink of the service gateway to point to a group of ports based on the VLAN.

  3. I also believe that you can add a VTEP parameter based on the equipment, which will act as a bridge between the logical switch and a VLAN physics.

• activity maintaiance for SAN switch

  Dear team,

  our storage has informed us that these people are planning activity enjoyed in the weekend next, SAN both switches are in redundant mode so no impact of the UPS
  activity on the availability of the San. However ask you to check it out on the side of VMware so all the virtual machines are configured for multipath & are not dependent on the only network SAN
  switch to access the storage.

  all the SAN data store have 4 path (a path is active I/O and rest 3 paths are active. PSP is fixed)

  I just want to confirm if a switch goes down then esxi will automatically route the redundant traffic available SAN switch or do I need manual intervention to route traffic to redundant SAN switch.

  concerning

  Mr. VMware

  
  

  You must confirm if the 4 paths to LUN are in different tissues, cause maybe you feel peckish 4 paths as a single fabric, and if the switch of this fabric must be down you will lose access to the storage system.

  You have two HBA? Each connected to a different switch?

  If you find that your 4 paths in different fabrics and each HBA has access to all the controller storage system processor, you can safety put down one of fabric and ESXi will be managing the paths downwards.

• Binding problem rising switch distributed - vim.dvs.DistributedVirtualPort is not available

  Hi all

  I am trying to add a physical link to a distributed switch rising.

  The story unfolded as shown below:

  -default ESX 4 generation created with virtual switch 'standard' with Teddy 0 uplink port & console running through this switch

  -new distributed switch created with groups of separate ports for console, VMkernel and VM traffic

  -Teddy switch 1 assigned as an uplink for distributed

  -new console and VMkernel ports created successfully on the distributed switch

  -console legacy & VMkernel ports correctly migrate from 'standard' virtual switch with for the distributed switch

  -removed 'redundant' console & VMkernel ports to the distributed switch, so there is only one of each kind on the left

  -' standard' virtual switch was successfully deleted

  -When you try to add Teddy 0 (which is displayed as unclaimed) as the second uplink to the distributed switch following error occurs:

  The resource vim.dvs.DistributedVirtualPort is not available in vim. DistributedVirtualSwitch dvSwitch

  Tips / advice / suggestions?

  Kind regards

  Radek

  You can update the number of dvUplinks in the properties of the dvSwitch in stock-> Networking.  Select the switch (icon with the + / according to him, not the object of the child).  It'll be here in the General settings.  You can also change the names of of the uplinks from here.

  JP

• How the Virtual Machine port group communication?

  How the Virtual Machine port group communication?

  Port group is virtual aggregation of ports on vSwitch. A vSwitch can have multiple Port groups which separate the different network traffic. Port groups communicate with vSwitch, and we have physical network maps on vSwitch which establish communication with the external network. We can configure security, NIC teaming, traffic shapping nework political and at the level of the port groups. Once the port group is created, we can assign to vNIC

  How to establish communication?

  Public network > Switch L3 Core > ESXi physical adapter > vSwitch > groups > virtual NIC > Virtual Machine

  Virtual machine connect to the physical map using vNIC coming on Port groups. This is how it works.

• HDMI piling on PowerConnect 5548

  We have 8 switches PowerConnect 5548 and are interested in using the stacking of HDMI for 10GbE.

  We currently have all 8 switches under tension and production running on them traffic.  Each switch is currently either back 'a home run' to a Cisco switch, or connected to another switch PowerConnect 5548.

  • Is mature enough stacking HDMI technology for a production environment?
  • It would be important if each switch have been 'home run'd ' to the Cisco switch and each 5548 PowerConnect was connected in a loop HDMI?
  • Stacking HDMI technology would require restart us our switches to implement?  A failure would be necessary?
  • All the special items of note regarding the type of HDMI cable?  (i.e. owner or any which best buy HDMI cable work?)

  Thank you
  Jon

  Is HDMI sufficiently stable stacking of the PowerConnect 5548 for production?

  • Yes (100%)
    
  • None (0%)
    
  • A little, but you better pay attention to the comments I post... (0 %)
    

  • Total votes: 5

  Jon,

  Technology HDMI wroks ideal for stacking the PowerConnect 55xx series. You can use the HDMI ports on the 55xx for stacking well and not for uplink to a Cisco or other device.  Also, you can stack only as 55xx switches with other 55xx and running the same version of the firmware.

  On the 55xx, you don't need to reboot the switches, but just plug the cables to create the stack.  An algorithm is used to determine which members becomes master and members who become slaves.  In my view, that the master is determined by which switch has been powered as long.  Don't forget that if you have the switches on different subnets or VLANs, they are configurations will be now changed all switches will become like a big switch.

  The type of HDMI cable is important, you will need to consult the documentation that came with the switch, or you can download the Guide of the user to http://support.dell.com.  You need cables that provide a flow rate of 10.2 Gbps (maximum allowed by the HDMI specification).  Usually the cheapest cables don't provide this.

  -Victor

• Help routing with double connections 1 ISP, 2 routers, Firewall-2 lights

  My company is moving to a new building and ordered redundant Internet connections by the same ISP.  I did have a chance to talk to the ISP seller, but from what I've heard say that they expect us to participate in the BGP as will force us to balance load and high availability for inbound web traffic.  My limited experience with BGP has been in a lab environment.  The company has already bought two routers and two ASAs.  We have a block of public IP addresses.

  My goals are to

  1 allow internal out of the Internet users
  2. allow to outside users to browse our public web site.
  3. configure the routers and the ASAs so that if any one device Internet connections or lack fails, the business will continue as usual.

  Here are some of my questions to help me make sure that I'm heading down the correct path:

  -The IP addresses on the links point to point between our routers and the ISP will come from our IP address block, or if they are separated/30 links provided by the ISP?  (Even once, I have not had the chance to talk to the seller)

  ' '-Will be the link iBGP "has" requires the use of public or private IP addresses IPs can be used?  In addition to configuring iBGP on these routers, is thus a first protocol redundancy Hop configured here?

  -Should there be links routed between R1 and R2 and FW2, FW1?  Too complicating the design without real value?

  -Would be OSPF or EIGRP usually configured for links B, C D & to allow redundancy you want between the firewalls and routers?

  -What is the best practice for the determination of the flow of outbound traffic layer 3 switch (6509 s configured as a VSS) to the two ASAs?

  Any help is greatly appreciated.

  Mike

  

  Hello

  first of all that you need in your design for me of course that traffic inbound and outbound flows must be aligned end-to-end

  answers to your questions are by below:

  -The IP addresses on the links point to point between our routers and the ISP will come from our IP address block, or if they are separated/30 links provided by the ISP?  (Even once, I have not had the chance to talk to the seller)

  Any dose not need and ask the ISP to provide their own IPs for p2p links (to avoid wasting your public IP addresses)

  ' '-Will be the link iBGP "has" requires the use of public or private IP addresses IPs can be used?  In addition to configuring iBGP on these routers, is thus a first protocol redundancy Hop configured here?

  You cannot use private IP addresses

  -Should there be links routed between R1 and R2 and FW2, FW1?  Too complicating the design without real value?

  Here, it's better to use a shared VLAN L2 (switch) for these interfaces get FHRP of routers and the FWs failover works as expected

  -Would be OSPF or EIGRP usually configured for links B, C D & to allow redundancy you want between the firewalls and routers?

  If you use between HSRP/VRRP routers and using failover between the FWs, then using a shared vlan L2 as suggested above will be necessary without IGP, such as EIGRP also the link between the firewall used for FW failover is not like the one used between routers 'dose not need routing.

  -What is the best practice for the determination of the flow of outbound traffic layer 3 switch (6509 s configured as a VSS) to the two ASAs?

  If you put the ASA FWs in failover mode, then the IP address of th eprimary/active ASA FW will be used for your static routes in the L3 switches to point to and this IP address will be used by the secondary FW in a failover situation "transparent and automatic.

  hope this helps

  If useful rates