Cisco UCS Manager - Stateless Computing demo (English)

In my previous post I have created a UCS manager demo video about stateless computing in Cantonese.  Now I have updated another version of video with English voice over and hopefully can cover more people, enjoy and let me know what you think!

Previous post:
http://pandaeatsbamboo.blogspot.com/2012/07/cisco-ucs-manager-stateless-computing.html

Cisco UCS Manager - Stateless computing demo

I have created a video to illustrate several demo scenario on how Cisco UCS achieve stateless computing, target to give you all a brief overview on our UCS manageability and how service profiles help to streamline the daily operations.

The video is voice over with Cantonese, sorry for those non-Cantonese speakers.  Will voice over in English when I have time.


Several configuration example has been touched on including:
- Pool creation (UUID, WWNN, WWPN, MAC)
- vNIC and vHBA template creation
- Service Profile template
- Create service profile from service profile template
- Associate Service Profile template with Server Pool to achieve service profile failover
- Rapid Server provisioning
- Server migration

Comparing N5K and N7K - a very high level key features comparison

5K
- A-FEX
- VM-FEX
- FC
- Unified Ports
- EvPC

7K
- OTV
- LISP
- MPLS
- VDC

Both of them support FabricPath (N7K F1 and F2 cards), vPC, L3, FEX, etc

Nexus 7000 - M1 modules and F2 modules quick comparison

A fetaure comparison for quick reference:

M1	F2
Max 8 x 10GE line rate ports	Max 48 1/10GE line rate ports
Full L2 and L3 feature	Full L2 and L3 feature
Large FIB, ACL, QoS Tables	Small FIB, ACL, QoS Tables
MPLS	MPLS NOT supported
LISP	LISP NOT supported
FEX Support	FEX Support
FabricPath NOT Supported	FabricPath
FCoE NOT supported	FCoE (will support in future release)

Nexus 1000v Setup and Configuration

My environment:  Nexus1000v.4.0.4.SV1.3b, VMWare ESXi 4.1, vCenter 4.1

Nexus 1000v consists of VSM (control plane) and VEM (data plane).  VSM can run as a VM or in a standalone appliance.  In my setup I run it as a VM on one of my ESXi hosts.  The Nexus1000v software comes with both VSM and VEM within a zip file.

1. To install the VSM, locate the .ova file in the VSM folder.  In your vSphere client, click File > “Deploy OVF template”

2. During the deployment, you need to provide the following information:

• Control VLAN ID
• Packet VLAN ID
• Domain ID
• Management IP address

3. You can use the same vlan for control, packet and management, and do not place data traffic on this VLAN.  The wizard is quite straight forward so the details will not be covered here.

4. Next step is to create Nexus 1000v plug-in.  Browse the page http://vsm-ip-address and download the cisco_nexus1000v_extension.xml file

5. In vSphere Client, Plug-Ins menu, choose “Manage Plug-Ins”.  Click “Register Plug-In” and import the XML file downloaded from the VSM page.

6. Then connect your VSM to the vCenter

conf t

svs connection VC

protocol vmware-vim

remote ip address 1.2.3.4

vmware dvs datacenter-name panda-DC

connect

7. Then you can create system port-profile and data port-profile. 

port-profile type ethernet system-uplink
  vmware port-group
  switchport mode trunk
  switchport trunk allowed vlan all
  no shutdown
  system vlan 2010
  state enabled

port-profile type vethernet cciev-server
  vmware port-group
  switchport mode access
  switchport access vlan 100
  no shutdown
  state enabled

8. Next step is to install VEM, the easiest way is to do it via VMWare Update Manager.  In vSphere client > Update Manager > Patch Repository, click “Import Patch”, then choose the VEM module in the Nexus 1000v VEM folder.

9. Then create a new baseline.  Under Baseline and Groups, click create baselines.  Choose VEM under extensions. 

10.  You can now apply the baseline to the host.  In vSphere Client > Hosts and Clusters, choose the host you want to install VEM.  Click the Update Manager tab which is usually the last tab.  Click “Attach” to attach the baseline you’ve just created, then click Remediate to apply.

11.  Now the final step is to add the host to the Nexus 1000v switch.  Under Inventory > Networking, choose the Nexus 1000v switch and right click, click “Add host”.  Apply the system port-profile to the vmnic and apply appropriate data port profile to the VMs.

12.  After adding, you can type the command “show interface virtual” and “show module” on VSM to verify your work.

Nexus 5000 - SFP validation failed on 1G port

My environment: Nexus 5010 with NX-OS 4.2(1)N2(1)

Nexus 5000 supports 1G connection starting from 4.0(1a)N1(1). I have tried to plug in the GE SFP to N5K and it shows the "SFP validation failed" message" in the "show interface" output. The trick is:

1. Unplug your GE SFP

2. go to your interface configuration, and type "speed 1000". You CAN'T change the port speed after you plug in your SFP.

3. Plug in your GE SFP again. And it works!

More information:

http://www.cisco.com/en/US/partner/docs/switches/datacenter/nexus5000/sw/command/reference/rel_4_1/ethernet-cmd-ref.html#wp1619365

"If the interface and transceiver speed is mismatched, the SFP validation failed message is displayed when you enter the show interface ethernet slot/port command. For example, if you insert a 1-Gigabit SFP transceiver into a port without configuring the speed 1000 command, you will get this error. By default, all ports on a Cisco Nexus 5000 Series switch are 10 Gigabits. "

Learning Nexus 7000 QoS by Example

My environment: Nexus 7010, NX-OS 4.2

Just got a chance to play with the Nexus 7000 NX-OS QoS, the “mls qos” syntax has gone and now all the commands are based on MQC.

 

In the following example, I’m going to configure 2 ingress ports, one with high priority traffic and one with normal traffic, and at egress port high priority traffic will be assigned to PQ to dequeue first.

 

Classification

N7K# conf t

class-map type queuing match-any 1p3q4t-out-pq1

  match cos 5

It can only be done via the main VDC.  It can’t be done on child VDC.  And you can ONLY match cos in the class-map.

Marking

Now let’s mark the ingress traffic, I will do this at the port assigned to the vdc “test”.

N7K# switchto vdc test

N7K-test#

policy-map type queuing highpriority-in-policy

   class type queuing 2q4t-in-q-default

     set cos 5

Scheduling and Queuing

Finally, I want to assign the high priority traffic (cos=5) to PQ

N7K-test#

policy-map type queuing highpriority-out-policy

  class type queuing 1p3q4t-out-pq1

    priority level 1

Last step is to assign service policy to the interface:

N7K-test#

int e3/1

description - High Priority – Ingress -

service-policy type queuing input highpriority-in-policy

!

int e3/2

description – Low Priority – Ingress -

!

int e3/3

description – Egress Port -

service-policy type queuing output highpriority-out-policy

!

Data Center of the future with Cisco Nexus 7000

Configuration Example for WAE deployment #2 - 2 legs scenario

Another very common scenario is you only have 2 interfaces available on the routers, one for LAN and one for WAN connections. Your LAN facing interface is running dot1q with both LAN and WAE subnets in it.

Router configuration
!
version 12.4
!
hostname Router
!
!
ip wccp 61
ip wccp 62
!
ip cef
!
ip domain name pandaeatsbamboo.com
!
!
interface FastEthernet0/0
no ip address
duplex full
speed 100
!
!
!
interface FastEthernet0/0.10
description “To Local Area Network”
encapsulation dot1Q 10
ip address 1.1.1.1 255.255.255.0
ip wccp 61 redirect in
ip wccp 62 redirect out
!
!
!
interface FastEthernet0/0.11
description “To Cisco WAE Appliance”
encapsulation dot1Q 11
ip address 2.2.2.1 255.255.255.0
ip wccp redirect exclude in
!
!
interface Serial0
description "To Wide Area Network"
ip address 3.3.3.1 255.255.255.0
!
end

WAE Configuration

! WAAS version 4.0.0
!
device mode application-accelerator
!
hostname WAE
!
clock timezone PST -8 0
ip domain-name pandaeatsbamboo.com
!
primary-interface GigabitEthernet 1/0
!
!
interface GigabitEthernet 1/0
ip address 2.2.2.2 255.255.255.0
no autosense
bandwidth 100
full-duplex
exit
interface GigabitEthernet 2/0
shutdown
exit
!
ip default-gateway 2.2.2.1
!
ip name-server 1.1.1.123
!
wccp version 2
wccp router-list 1 2.2.2.1
wccp tcp-promiscuous router-list-num 1
!
cdm ip 1.1.1.10
cms enable
!
policy-engine application

Configuration Example for WAE deployment #1 - 3 legs scenario

This configuration example is useful when your WAE is attached to a dedicated router interface.

Router configuration
!
version 12.4
!
hostname R1
!
!
ip wccp 61
ip wccp 62
!
ip cef
!
ip domain name pandaeatsbamboo.com
!
!
interface FastEthernet0/0
description "To Local Area Network"
ip address 1.1.1.1 255.255.255.0
ip wccp 61 redirect in
duplex full
speed 100
!
interface FastEthernet0/1
description “To Cisco WAE Appliance”
ip address 2.2.2.1 255.255.255.0
duplex full
speed 100
!
interface Serial0
description “To Wide Area Network”
ip address 3.3.3.1 255.255.255.0
ip wccp 62 redirect in
!
end

WAE Configuration

! WAAS version 4.0.0
!
device mode application-accelerator
!
hostname WAE
!
clock timezone PST -8 0
ip domain-name pandaeatsbamboo.com
!
primary-interface GigabitEthernet 1/0
!
!
interface GigabitEthernet 1/0
ip address 2.2.2.2 255.255.255.0
no autosense
bandwidth 100
full-duplex
exit
interface GigabitEthernet 2/0
shutdown
exit
!
ip default-gateway 2.2.2.1
!
ip name-server 1.1.1.123
!
wccp version 2
wccp router-list 1 2.2.2.1
wccp tcp-promiscuous router-list-num 1
!
cdm ip 1.1.1.10
cms enable
!
policy-engine application

WCCPv2 with WAAS and Cat3750

Several points to note when you configure Cisco Catalyst 3750 to use WCCPv2 for network interception and redirection to WAE:

1. IOS Version 12.2(37)SE or newer
2. Ingress redirection only, egress redirection is not supported, redirect exclude commands not supported, redirect list is supported
3. Layer 2 redirect is REQUIRED. GRE redirection is not supported
4. Mask assignment must be configured. Hash assignment is not supported.

WAE(config)# wccp router-list 1 1.2.3.4
WAE(config)# wccp tcp-promiscuous router-list-num 1 l2-redirect mask-assign
WAE(config)# wccp version 2

WAAS GRE egress return

Starting from WAAS 4.0.13, it allows 2 different egress method. When IP forwarding egress method is used the return traffic packets are forwarded to the WAE default gateway.

WAE(config)# egress-method ip-forwarding intercept-method wccp

The limitation of IP forwarding is WAE should reside on a separate subnet to avoid infinite forwarding loop.

The other egress method is GRE return. The return traffic packets are returned back to the intercepting router using the GRE tunnel that is created as a result of WCCP negotiation. With GRE return egress, WAE can be deployed on the same subnet as users and subinterfaces or tertiary interfaces are not required.

WAE(config)# egress-method negotiated-return intercept-method wccp

To view egress method on WAE
WAE# sh egress-methods

New Self-diagnostic command on WAAS 4.0.15

The new 4.0.15 release added support for a self-diagnostic command, which is a good place to start troubleshooting:

WAE-TEST# test self-diagnostic ?

all Run all self-diagnostic tests

basic Basic device configuration

connectivity Basic device connectivity

inline Inline groups and ports

interfaces Physical interfaces

system Device operation

tfo TFO/DRE configuration

wafs WAFS connectivity

wccp WCCP configuration and operation

WAE-TEST#

Capture Traffic on Cisco WAE

To capture packets on WAE for troubleshooting and analysis, you can use the build in tethereal to do this.

To capture all traffic and save to a file:
tethereal -w capture.cap

Ctrl-C to stop the packet capture, and the file is viewable with the "dir" command:

dir *.cap

You can copy the file to some other places for offline viewing then.

Cisco WAAS Cheatsheet

I've prepare a cheatsheet after playing WAAS for months, share with you guys here:

Router with separate interface for WAE connection
access-list 100 permit tcp any any
access-list 100 deny ip any any

ip wccp 61 redirect-list 100
ip wccp 62 redirect-list 100

ip cef

int fa0/0
desc "To LAN"
ip wccp 61 redirect in
duplex full
speed 100

int fa0/1
desc "To WAE"
duplex full
speed 100

int s0
desc "To WAN"
ip wccp 62 redirect in

Router with dot1q sub-interfaces for LAN and WAE
ip wccp 61
ip wccp 62

ip cef

int fa0/0
desc -- dot1q trunk to both client LAN and WAE lan --
duplex full
speed 100

int fa0/0.1
desc -- To LAN --
ip wccp 61 redirect in
ip wccp 62 redirect out

int fa0/0.2
desc -- To WAE appliance --
ip wccp redirect exclude in

int s0
desc -- To WAN - Nothing needs to be done here --

Router - Verify
- sh proc cpu
- sh ip wccp

WAE - Config
no cms enable
no central address
central address 155.161.40.245
cms enable
ntp server 155.161.85.129
ntp server 155.161.85.193
ip name-server 155.161.93.238
no wccp router-list 1 172.23.100.1 172.23.100.2
wccp router-list 1 x.x.x.x y.y.y.y

WAE - verify
sh cms info
sh wccp routers


Useful command
WAE
- sh wccp gre
- sh wccp routers
- sh wccp services
- clear cache dre
- sh stat dre
- sh stat dre con
- sh stat dre con server-p 80
- sh stat tfo
- sh stat bypass
- sh alarms
- sh cms info
- sh disks
- sh proc cpu
- sh tfo status
- sh tfo con sum
- sh tfo con server-p 80
- sh tfo auto-discovery
- sh wccp file-engine
- tcpdump
- tethereal
- cms deregister force
- sh clock detail
- sh ntp status
- sh disk failed-sectors
- sh disk tech-support
- sh proc system count 10 delay 5
- sh cifs auto-discovery status
- sh policy-engine application dynamic
- sh cifs auto-discovery host-db
- sh cifs auto-discovery last
- sh cifs sessions count
- sh cifs sessions list

Router
- sh ip wccp
- sh ip wccp 61 det
- sh ip wccp int

New Monster Switch - Cisco Nexus 7000

Some key points for N7K:

• Data Center Class Switching Platform
• Today 1.4Tbps, Scales beyond 15Tbps
• New OS - NX-OS, a combination of IOS and SAN-OS
• Cisco Trusted Sec enabled - link layer encryption at line rate and RBAC
• Virtualization - Virtual Device Contexts
• Future FCoE support
• Unified I/O - save CapEx and OpEx - less HBA cards

Interesting Facts with N7K:

• Download entire Wikipedia in 10ms
• Download and transfer the entire searchable Internet in 7.5 mins
• Send a photo to every single person on earth in 1/2 hr.
• Transfer 5 mil concurrent Telepresence sessions