NetFlow for Catalyst 4500

ccie-rs July 20th, 2009

I had the pleasure of integrating brand new 4500s into production Friday night to alleviate performance bottlenecks on our 3845s.  For quite some time, we’ve been pushing the boundaries of UDP file transfers over our existing routers utilizing a product called Aspera.  While you may think that UDP is unreliable and connectionless, the folks at Asperasoft have devised a way to conduct transfers reliably.  There are a few kinks with the software, but the results are pretty impressive.  Just imagine transferring 1TB of data over a 1Gb connection from LA to NY in less than a day.  To increase the routing threshold, we had to migrate off the 3845s and introduce the 4506-E switches.  The transition went very smoothly and was completed within the maintenance window, which is a rare feat at times.

Once all the hardware was in place I cleaned up our monitoring devices and alerts with new interface information off the switches.  I quickly activated NetFlow and didn’t think anything of it at the time.  On Sunday, I had some time to VPN in and check on the performance of the new switches.  I found out that our ManageEngine software only detected 1 interface to monitor.  That wasn’t going to do me any good, so I decided to do some research.  I checked the config first to make sure I entered the commands correctly:

CRS01#sh run | i flow
ip flow-cache timeout active 1
ip flow-export source Vlan119
ip flow-export version 5
ip flow-export destination 172.16.119.194 9996
ip flow-top-talkers
top 25
sort-by bytes
ip route-cache flow

Looks correct so far.  According to Cisco’s Catalyst 4500 Series Switch Software Configuration Guide, 12.2(50)SG documentation, you should verify that the NetFlow Services daughter card (WS-F4531) is working and available:

CRS01#sh module all
Chassis Type : WS-C4506-E

Power consumed by backplane : 0 Watts

Mod Ports Card Type                              Model              Serial No.
—+—–+————————————–+——————+———–
1     6  Sup V-10GE 10GE (X2), 1000BaseX (SFP)  WS-X4516-10GE      XXXXXXXXXXX
2     6  SFP, 10/100/1000BaseT (RJ45)V, Cisco/I WS-X4506-GB-T      XXXXXXXXXXX
3    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  XXXXXXXXXXX

M MAC addresses                    Hw  Fw           Sw               Status
–+——————————–+—+————+—————-+———
1 0024.1423.78c0 to 0024.1423.78c5 5.1 12.2(31r)SGA 12.2(50)SG1      Ok
2 001b.5481.a2dc to 001b.5481.a2e1 1.4                               Ok
3 0021.a0de.dfc0 to 0021.a0de.dfef 4.1                               Ok

This next section I’m copying from the documentation was missing completely:

Mod  Submodule               Model             Serial No.   Hw   Status

—-+———————–+—————–+————+—-+———

1   Netflow Services Card   WS-F4531          JAB062209CG  0.2  Ok

2   Netflow Services Card   WS-F4531          JAB062209AG  0.2  Ok

After reading around in a few forums, I found that the NetFlow Services Card submodule is built into my Supervisor Engine V-10GE and may not appear when running the command.  I continued to read through the documentation and found that to activate NetFlow for the 4500 I should run the global command:

ip flow ingress

The moment you enter this command, additional command options start to appear in the IOS.

ip flow ingress infer-fields
ip flow ingress layer2-switched

Adding these additional commands still didn’t reveal all the interfaces I wanted to monitor within NetFlow Analyzer so I had to conduct more research.  I finally stumbled upon an additional command:

ip route-cache flow infer-fields

The infer-fields option doesn’t appear when you use the question mark, but the IOS accepts the command.  As soon as I hit enter, my analyzer paged refreshed and all the interfaces appeared.  I wanted to inquire more about the option and Googled ‘ip route-cache flow infer-fields’ and found ManageEngines supporting documentation for Configuring NDE.

If I just continued reading Cisco’s documentation, I would have found the command in the example section.

Configuring WIC-1AM for Dial-In

ccie-rs May 4th, 2009

After my R&S lab attempt, I became very aware with how Cisco’s documentation was structured and was able to weave my way through it quite easily.  Now, after all the changes, it’s somewhat of a tedious task for me to find anything.   In regards to this modem card, I was asked to provide an out-of-band dial-in solution for a few routers that had this card installed already and had the analog lines directly terminated on them.  Having bypassed nearly all of the dial-up requirements for earlier versions of the R&S lab (i.e. 2-day version), I had to seek out documentation to figure out how to configure this card.

Most of Cisco’s documentation had sample configurations for configuring WIC-1AM for dial-out and not so much dial-in.  Also, any information I did find was geared more for an external modem being attached to the card.  Eventually, I had to resort to Google, which led me to some old configurations within a few forums that proved very helpful.  After a few days of researching and testing, I managed to create a configuration that finally works.  Here it is:

modemcap entry CC-TBR21:FD=&F\V1:AA=S0=1:MSC=V0&S0=1+GCI=B5;

interface Vlan194
ip address 192.168.194.3 255.255.255.0

interface Async0/0/0
description OOB TEL#: 818-555-1234
ip unnumbered Vlan194
encapsulation ppp
dialer in-band
dialer string 18185551234
dialer-group 1
async mode interactive
peer default ip address 192.168.194.194

line 0/0/0
exec-timeout 0 0
modem InOut
modem autoconfigure type CC-TBR21
transport input all
stopbits 1
speed 115200
flowcontrol hardware

dialer-list 1 protocol ip permit

The hardest part of testing this configuration was finding an analog line for my laptop.  Who still uses analog lines?  I ended up having to use a fax line in the off-hours at work to test this configuration properly.

I’ll be honest, this first few configurations I whipped up didn’t exactly work.  The key to isolating my exact issues was resolved in utilizing the debug modem command and configuring the appropriate modem initialization string.

WAAS Module: NM-WAE-522-K9

ccie-rs May 3rd, 2009

If you are planning on loading an ISR 2821, 3825, or 3845 router with this particular WAAS module and any of these Advanced Enterprise IOS versions:

12.4.15T9

12.4.20T1

12.4.20.T2

12.4.20.T3

12.4.22T

12.4.22T1

You’ll soon find that the router will hang on start-up.  To overcome this problem you’ll need to upgrade to 12.4.24T in order for the router to boot up properly.  Prior to my upgrade, I was running 12.4.13b which booted up fine, so it appears this issue only appears in the T train.

Element LCD TV (FLX-3210)

ccie-rs April 14th, 2009

In May 2007, I purchased a 32″ Element LCD TV for my master bedroom with an extended warranty.  The main reason I chose the TV was for its’ price point, $600, at Circuit City.  Mind you, I never really purchased anything at Circuit City and decided to go with this TV over a Vizio model from Costco.  For the past 2 years, I never had an issue with the TV since it worked fine for just watching shows and movies.  The only thing that really annoyed me was the display menu when programming features, but other than that, I was pleased with what I had purchased.

A few weeks ago I was moving TV sets around the house to accommodate my lab studies.  Initially, my study room had a 19″ monitor and I decided I wanted more desktop space for my dynamips telnet sessions — apparently 15 maximized sessions weren’t enough for me.  I had acquired a 32″ Polaroid TV from work almost a year ago and decided to finally take it out of the garage, move it to my bedroom, and re-purpose the Element as my new desktop monitor.

As a quick test, I connected my laptop to the Element during the Windows boot-up process.  The LCD screen came up pink so I started fiddling around with the display settings and checking the wiring, which eventually checked out fine.  I decided to shutdown the laptop so I could reconnect the VGA cable before the boot-up process.  I didn’t happen to see it, but my wife stated she saw a message flash on the screen:

The VGA signal has been lost and as a result the TV will power off

A few seconds after the message appeared, the screen went black and the Red Light of Death appeared!  The TV was rendered unusable at this point.  If you Google around, you’ll notice anyone that has this model connected to a computer and shutdown while connected has run into this same problem.  No matter what you do, you won’t be able to restore it, so make sure you don’t make the same mistake.  I’ve been told by some TV buffs in the forums that there may be an RS-232 interface inside the casing, but you’ll have to open the TV up for your own edification.  IMHO, even if there was a port inside, you would still need to find the right hex codes to input in order to restore the TV.  The documentation for the TV is practically non-existent.

Rather than go down this road of tearing open the case, I decided to see what my extended warranty covered.  My support case is slightly different than others in that even though Circuit City was now out of business, there was a 3rd party vendor close enough to my house that was maintaining their extended warranty contracts.  Thankfully enough, I purchased this warranty at the time of my purchase.  Usually, I don’t even bother to waste the extra money, but wanted some peace of mind considering this was a non-standard brand.

After faxing a copy of my receipt, the 3rd party vendor finally came by this morning and picked up the TV.  Hopefully they’ll sort out the issue and send me a new one soon so I can start maximizing on my desktop sessions, otherwise, I guess I’ll have to live with the 19″ monitor for studying.

blank