Nexus 1000v Setup and Configuration

My environment:  Nexus1000v.4.0.4.SV1.3b, VMWare ESXi 4.1, vCenter 4.1

Nexus 1000v consists of VSM (control plane) and VEM (data plane).  VSM can run as a VM or in a standalone appliance.  In my setup I run it as a VM on one of my ESXi hosts.  The Nexus1000v software comes with both VSM and VEM within a zip file.

1. To install the VSM, locate the .ova file in the VSM folder.  In your vSphere client, click File > “Deploy OVF template”

2. During the deployment, you need to provide the following information:

• Control VLAN ID
• Packet VLAN ID
• Domain ID
• Management IP address

3. You can use the same vlan for control, packet and management, and do not place data traffic on this VLAN.  The wizard is quite straight forward so the details will not be covered here.

4. Next step is to create Nexus 1000v plug-in.  Browse the page http://vsm-ip-address and download the cisco_nexus1000v_extension.xml file

5. In vSphere Client, Plug-Ins menu, choose “Manage Plug-Ins”.  Click “Register Plug-In” and import the XML file downloaded from the VSM page.

6. Then connect your VSM to the vCenter

conf t

svs connection VC

protocol vmware-vim

remote ip address 1.2.3.4

vmware dvs datacenter-name panda-DC

connect

7. Then you can create system port-profile and data port-profile. 

port-profile type ethernet system-uplink
  vmware port-group
  switchport mode trunk
  switchport trunk allowed vlan all
  no shutdown
  system vlan 2010
  state enabled

port-profile type vethernet cciev-server
  vmware port-group
  switchport mode access
  switchport access vlan 100
  no shutdown
  state enabled

8. Next step is to install VEM, the easiest way is to do it via VMWare Update Manager.  In vSphere client > Update Manager > Patch Repository, click “Import Patch”, then choose the VEM module in the Nexus 1000v VEM folder.

9. Then create a new baseline.  Under Baseline and Groups, click create baselines.  Choose VEM under extensions. 

10.  You can now apply the baseline to the host.  In vSphere Client > Hosts and Clusters, choose the host you want to install VEM.  Click the Update Manager tab which is usually the last tab.  Click “Attach” to attach the baseline you’ve just created, then click Remediate to apply.

11.  Now the final step is to add the host to the Nexus 1000v switch.  Under Inventory > Networking, choose the Nexus 1000v switch and right click, click “Add host”.  Apply the system port-profile to the vmnic and apply appropriate data port profile to the VMs.

12.  After adding, you can type the command “show interface virtual” and “show module” on VSM to verify your work.

Remote Access SSL VPN and DDNS setup

My environment:  IOS 15.1(3)T on ISR 892

I have been spending quite a lot of time on the road and it is much convenient if I have a way to remote access back to my home network.  In my home network I have setup the SSL VPN for remote access, as well as DDNS as I don’t have a fixed IP address for my home internet access.

1. You can register an account in dyndns.org to get your own DDNS entry

2.  Then you can configure DDNS update on the router, whenever there is an address change, it will update dyndns.org dynamically.

ip ddns update method DynDNS
HTTP
  add http://pandausername:pandapassword@members.dyndns.org/nic/update?system=dyndns&hostname=panda.dyndns.org&myip=<a>
  remove http://pandausername:pandapassword@members.dyndns.org/nic/update?system=dyndns&hostname=panda.dyndns.org&myip=<a>
interval maximum 1 0 0 0

3. Under your internet facing interface, configure the following command:

ip ddns update hostname panda.dyndns.org
ip ddns update DynDNS host members.dyndns.org

4. These are the webvpn configuration of my router, you can modify it for your own setup:

ip local pool vpn-pool 192.168.20.205 192.168.20.215

webvpn gateway panda.dyndns.org
ip address 1.2.3.4 port 443 
ssl trustpoint TP-self-signed-3650870944
logging enable
inservice
!
webvpn install svc flash:/webvpn/svc_1.pkg sequence 1
!
webvpn install svc flash:/webvpn/anyconnect-macosx-i386-2.3.2016-k9.pkg.zip sequence 2
!
webvpn context panda-context
ssl authenticate verify all
!
login-message "Welcome to Panda's home"
!
policy group panda-group
   functions svc-enabled
   banner "Login Successful"
   svc address-pool "vpn-pool"
   svc default-domain "panda.com"
   svc keep-client-installed
   svc rekey method new-tunnel
   svc split include 192.168.20.0 255.255.252.0
   svc dns-server primary 3.4.5.6
default-group-policy panda-group
gateway panda.dyndns.org
inservice

svc split is the split tunnel configuration that allows inserting a specific route to the client’s routing table.  svc split include means that only this route will be inserted to the host, other routes including default route will be based on the client’s own routing table.

5. Then you can use the AnyConnect client to remote access in full tunnel mode.

Installing UCCX 7 on VMWare

My environment:  VMWare ESXi 4.1, UCCX 7.0.1.168

One of the components in your CCIE lab is UCCX, and instead of install it on bare metal you might want to run it on VMWare so that it reduce your hardware investment.  I have just did that and would like to share some points that you need to aware when you are installing UCCX 7 on VMWare

• Ready the UCCX 7 media and license, as well as Windows 2003 server.  In my environment I am using Windows 2003 Enterprise edition, and Standard Edition will also work.
• You will need at least 2GB memory and 72GB vDisk for your UCCX 7 VM, otherwise you can’t continue the installation and the installer will prompt error.
• Don’t use thin provisioning for your VM vDisk.  Allocate all 72GB during the VM creation, otherwise again the installer will not let you to continue the installation
• Install IIS, that is required to run the UCCX appadmin pages.
• Don’t add this machine to a domain
• Add the following “String” to the Windows 2003 registry to cheat the system you are installing on a MCS
• HKLM\Software\Cisco Systems\Model
• Hardware = 7835H05
• Memory = 2048
• Speed = 2333
• Reboot the machine after finish all the above steps
• Mount the ISO with your vSphere client, then copy all the contents to a temporary folder on the UCCX VM.  Then double click CiscoUnifiedCCXAutorun.exe
• Reboot after finish installation
• Access the appadmin page http://uccx7/appadmin, where uccx7 is your hostname or IP address of the UCCX server.  The initial username and password is Administrator/ciscocisco.  Remember the “A” in “Administrator” is upper case.  If you are using lower case, it will show the error I/O AXL error.
• Ready the license and UCM credential for UCM and UCCX integration

Have fun!

Nexus 5000 - SFP validation failed on 1G port

My environment: Nexus 5010 with NX-OS 4.2(1)N2(1)

Nexus 5000 supports 1G connection starting from 4.0(1a)N1(1). I have tried to plug in the GE SFP to N5K and it shows the "SFP validation failed" message" in the "show interface" output. The trick is:

1. Unplug your GE SFP

2. go to your interface configuration, and type "speed 1000". You CAN'T change the port speed after you plug in your SFP.

3. Plug in your GE SFP again. And it works!

More information:

http://www.cisco.com/en/US/partner/docs/switches/datacenter/nexus5000/sw/command/reference/rel_4_1/ethernet-cmd-ref.html#wp1619365

"If the interface and transceiver speed is mismatched, the SFP validation failed message is displayed when you enter the show interface ethernet slot/port command. For example, if you insert a 1-Gigabit SFP transceiver into a port without configuring the speed 1000 command, you will get this error. By default, all ports on a Cisco Nexus 5000 Series switch are 10 Gigabits. "

UCCX 8 Error - Content is not allowed in prolog

Referring the previous 2 blog posts:



Troubleshooting Contact Center Express + Nuance ASR



Contact Center Express 8 - Nuance Integration   

I have encountered a tricky question using the Simple Recognition Step. The error message is:



"org.xml.sax.SAXParseException: Content is not allowed in prolog"

After some troubleshooting, I found that the problem is the grammer file. When I type "more grammer.grxml" file in Windows, an character is observed at the start of file:

I copy and pasted the content without that character to my Linux host with vi and save the files to solve this problem.

Troubleshooting Contact Center Express + Nuance ASR

Referring to the previous blogpost:

Contact Center Express 8 - Nuance Integration

The very basic connectivity test can be shown from the page ASR Server Configuration:

REACHABLE means the Nuance Speech Server is listening port 4900/tcp. But it doesn't mean the ASR integration is done properly. One of the way to verify it is to extract the information from the "Get Contact Info" Step in UCCX editor.

First create a boolean variable:

Then store the resultant value "ASR Supported" to the parameter that you've created in the previous step:

Run the "Reactive Script" debugging and observe the value that you've created, in my case the parameter is called "asr"

You should see the value changed from false to true after "step over" the "Get Contact Info" step.

Then you can try ASR through either "Simple Recognition" or "Generic Recognition" step. Good Luck!

If you observe the boolean doesn't change to true, make sure you have correct settings in UCCX trigger:





The "Override Media Termination" should equal to "Yes" and make sure you've selected your ASR Dialog group.

Contact Center Express 8 - Nuance Integration

My environment:

Cisco Contact Center Express (UCCX) 8.0.2.11001-15

ASR - Nuance Voice Recognizer 9.0.3

TTS - Nuance RealSpeak 4.5.4

MRCP Server - Nuance Speech Server 5.0.9

All 3 Nuance software are installed on the same Windows 2003 server.

If you want TTS and ASR capabilities for UCCX, Nuance is one of the option to provide you both capabilities. Voice Recognizer is the automatic speech recognition engine and RealSpeak provides text-to-speech capability. You will first need to install Voice Recognizer and RealSpeak as well as its language packs, finally install NSS, and load the software license to the license manager.

Start the Nuance Speech Manager in Windows Services MMC:





Then configure UCCX by first create the ASR provider, in my case it is Nuance:





Configure ASR Server, which is your Nuance server address:





"REACHABLE" means the NSS on Nuance is working properly with port 4900/tcp listening. 4900/tcp for MRCP version 1 integration and 5060/tcp for MRCP version 2 integration.

Add appropriate languages to the ASR server:





Next step is to create MRCP ASR Dialog group





For TTS configuration, it is pretty much similar. First specify the TTS provider:





Then add TTS server:





Add the language and gender for your TTS server:





If you are using demo license, make sure you follow the instruction below to modify Nuance config file:
http://www.cisco.com/en/US/prod/collateral/voicesw/custcosw/ps5693/ps1846/product_bulletin_c25-546866.html

EIGRP Stub Leak

EIGRP Stub Leak is a feature on Cisco router which allows EIGRP stub routers to leak route to peer routers.  This is achieved by leak-map, which is a route map that permit specific route to leak through.  A video is recorded to demonstrate how it works:

English version:

Chinese (Cantonese) version:

Learning Nexus 7000 QoS by Example

My environment: Nexus 7010, NX-OS 4.2

Just got a chance to play with the Nexus 7000 NX-OS QoS, the “mls qos” syntax has gone and now all the commands are based on MQC.

 

In the following example, I’m going to configure 2 ingress ports, one with high priority traffic and one with normal traffic, and at egress port high priority traffic will be assigned to PQ to dequeue first.

 

Classification

N7K# conf t

class-map type queuing match-any 1p3q4t-out-pq1

  match cos 5

It can only be done via the main VDC.  It can’t be done on child VDC.  And you can ONLY match cos in the class-map.

Marking

Now let’s mark the ingress traffic, I will do this at the port assigned to the vdc “test”.

N7K# switchto vdc test

N7K-test#

policy-map type queuing highpriority-in-policy

   class type queuing 2q4t-in-q-default

     set cos 5

Scheduling and Queuing

Finally, I want to assign the high priority traffic (cos=5) to PQ

N7K-test#

policy-map type queuing highpriority-out-policy

  class type queuing 1p3q4t-out-pq1

    priority level 1

Last step is to assign service policy to the interface:

N7K-test#

int e3/1

description - High Priority – Ingress -

service-policy type queuing input highpriority-in-policy

!

int e3/2

description – Low Priority – Ingress -

!

int e3/3

description – Egress Port -

service-policy type queuing output highpriority-out-policy

!

Create tftp bindings for phone firmware automatically on CME

My environment:  IOS 12.4(24)T1, CME 7.1, Cisco 2821
You can create automatic tftp bindings for all phone firmware instead of doing it manually one by one by using the “load” command under “telephony-service”.  Make sure you include the firmware file suffix in order to make the tftp binding automatically.  Without the suffix you need to configure it manually with the command “tftp-server flash:xxxx.loads”, etc.
Example:
telephony-service

load 7962 SCCP42.8-4-2S.loads

You might see this error after issuing the above load command:
LOAD COMMAND ERROR:cnf-file location system is not supported for creating automatic tftp bindings. Please use file location flash | slot0 | tftp OR create tftp bindings manually
Make sure you’ve entered the command “cnf-file location flash:” under “telephony-service” to specify the firmware location, then the error will go away!

An iPhone app for CME Config Generation:
http://itunes.apple.com/us/app/cme-config-generator/id453025819?ls=1&mt=8