Monday, April 22, 2019

Extreme Switch - Summit Stacking

Extreme Networks provides an excellent visual Stacking tool makes it easier for you to understand EXOS stacking and hardware compatibility. With so many hardware configurations to choose from, it can be challenging to know which ones can work together.

With the EXOS Stacking Tool v2.0, users can:
  • Build a stack by selecting various EXOS models so the tool can verify compatibility
  • See which stacking technologies (VIM and stacking modules) are compatible and recommended
  • See the minimum and maximum EXOS versions supported by the entire stack
  • See the theoretical table size limits for the entire stack based on model selections
  • See the suggested stack master and backup
  • Access product information and knowledge articles linked from within the tool
The stacking tool is available here.

Here's how to get started:
  1. Drag switches from the Switch catalog on the left to the stack on the right (top to bottom)
  2. Select stacking technologies for Stack ports S1 and S2 by clicking on a switch in the stack
  3. Click on the arrow to the right of the stack to expand the Tables and Reporting section

Click on the "Hamburger button" for help at any time. There you'll find:
  1. Getting Started
  2. Things to Know
  3. About section (provide feedback direct to tool developers)

  • Prerequisite
Before connecting the stacking cables to add the switch to stack verify the following is the same:
  • License Level-----------"show licenses"(all master capable nodes should have the same license)
  • EXOS Version----------"show version images" (Ensure that every switch (or node) in the stack is running the same version of ExtremeXOS.)
  • Active Partition---------"show switch" (Primary or Secondary whatever is booted that should be same for all devices in stack)

Enabling stacking will remove the configuration. You will have to migrate the configuration manually.

To configure a new stack:

Step 1. Physically connect the nodes using the stacking ports.

1-1. Insert the VIM modules into the switches. (Power down the switch to install or remove card.)

1-2. Connect the stacking cables as below.
Various QSFP+ optics/cables can be used for stacking ports: 40G MPO cables with QSPF+ SR4 optics, QSFP+ direct-attach cables, etc. The picture shows in V320 stacking. Connect only S1 and S2 in the same way if it's in V160 stacking.
Summit X460-G2 to be added is required to have a VIM-2q option card (2 x 40GbE ports) installed in the back to support SummitStack-V160.

Step 2. Power on the nodes.

Step 3. For each switch on which the stacking ports are not already enabled, issue the command enable stacking-support.

exos_stack1 # show stacking-support

Stack    Available Ports
Port    Native  Alternate  Configured  Current
-----   -----------------  ----------  ----------
1       Yes     51         Native      N/A
2       Yes     52         Native      N/A
stacking-support:          Disabled    Disabled

Flags: * - Current stack port selection

exos_stack1# enable stacking-support

Stack port 1 configuration is Native
Stack port 2 configuration is Native

This setting will take effect at the next reboot of this switch.

Step 4. Make sure all switches have the same stacking protocol and stacking-support configured

configure stacking protocol [enhanced | standard]
configure stacking-support stack-port [stack-ports | all] selection [native {V80 | V160} | V320} | alternate]

e.g. For SummitStack-V160
exos_stack1 # configure stacking-support stack-ports all selection native V160

This setting will take effect at the next reboot of this switch.

Step 5. Login to any of the nodes through the console port, preferably the one you want to use as the master. If you plan to use Easy Setup, log into the intended master node.
If the stack is a new stack, the default parameters are in effect.

Step 6. Type "show stacking" to verify the stack.
The show stacking command displays all nodes in the stack. All nodes are in a disabled state and all nodes appear as master nodes.

exos_stack1 # show stacking
Stack Topology is a Ring
This node is not in an Active Topology
Node MAC Address    Slot  Stack State  Role     Flags
------------------  ----  -----------  -------  ---
*00:04:96:9b:b3:13  -     Disabled     Master   ---
 00:04:96:9e:a7:34  -     Disabled     Master   ---
 00:04:96:9d:05:56  -     Disabled     Master   ---
 00:04:96:9e:a7:78  -     Disabled     Master   ---
* - Indicates this node
Flags: (C) Candidate for this active topology, (A) Active Node
(O) node may be in Other active topology

Step 7. Type "enable stacking" from the master.
Note: All switches must have stacking-support enabled, but stacking disabled, before you run Easy Setup.

exos_stack1 # enable stacking
You have not yet configured all required stacking parameters.
Would you like to perform an easy setup for stacking operation? (y/N) Yes

Executing "configure stacking easy-setup" command...
For every node in the 4-node stack, this command will:
- enable stacking
- configure a stack MAC address
- choose and configure a slot number (this node will be assigned to slot 1)
- configure redundancy to minimal (slot 1 will be the master node)
- configure the stacking protocol to enhanced
Upon completion, the stack will automatically be rebooted into the new configuration.
Warning: If stacking is already configured, this command will alter that configuration.

Do you wish to proceed? (y/N) Yes

Stacking configuration is complete.  Rebooting...

Step 8. This command presents you the option of using the Easy Setup procedure. Type "configure stacking easy-setup"

Step 9. Restart the stack and type "reboot stack-topology"
The configuration is set to default values while entering the stacking mode, so all previously entered configuration information (except for the NVRAM-based stacking parameters, selected image, and failsafe account information) is not available.

Step 10. Login to the intended master node and verify the stack type "show stacking", "show slot", and "show stacking configuration" commands.

Step 11. If the stack configuration is successful:
All nodes are visible in the stack.
All nodes move to the active state.
Some time after the nodes become active, each node is present in the configured slot.
After the roles are finalized, you can see one master node, one backup.

Step 12. Verify that the master node is the one you intended to be the master.

To build a Stacking on existing standalone switches

o. Check the Prerequisite section above.

1. (Optional) Convert your existing configuration to Stacking config on a switch, which will be the Master (slot-1).

Refer the following article if you want to convert your existing configuration to Stacking config. Otherwise, the configuration will be removed, and you will have to migrate the configuration manually.
How to Convert Non-Stacking configuration to Stacking config

1-1. Download the '' script from GitHub here. And copy the script to the switch via TFTP.
This Python script will convert non stacking configurations to stacking configurations for slot 1.

exos_stack1 # tftp get vr vr-mg
Downloading to switch.... done!

exos_stack1 # ls
drwxrwxrwx 2 root root 1024 Apr 4 11:19 cc_logs
-rw-r--r-- 1 admin admin 59448 Apr 22 16:28 exos_stack1_config.xsf
drw-r--r-- 2 root root 1024 Mar 21 2018 lost+found
-rw-r--r-- 1 admin admin 133931 Apr 22 17:30
-rw-rw-rw- 1 admin admin 1254480 Apr 22 16:28 primary.cfg
drw-r--r-- 4 root root 1024 Apr 4 11:18 ssl
drwxr-xr-x 2 root root 1024 Apr 4 11:18 vmt

1-2. Read through the Readme.MD file to learn about it's limitations and requirements and how to use it.

1-3. Run the script through on EXOS or on a PC.

Switch.1 # save configuration as-script nonstack
Do you want to save configuration to script nonstack.xsf? (y/N) Yes
Saving configuration to script nonstack.xsf on master .... done!

Switch.2 # run script

Note: please only use the show configuration output for this script.
      Make sure the starting non stack configuration file is in the same folder as the python script

what is the non stacking configuration file name? nonstack.xsf

The new stacking configuration will be saved as /usr/local/cfg/stack_nonstack.xsf?

Switch.3# ls
-rw-r--r--    1 admin    admin        3716 Sep 21 11:12
-rw-r--r--    1 admin    admin         869 Nov 10  2014 default.xsf
-rw-rw-rw-    1 root     root         5736 Sep 21 11:13 nonstack.xsf
-rw-rw-rw-    1 root     root       304838 Sep 20 19:13 primary.cfg
-rw-r--r--    1 admin    admin        5838 Sep 21 11:17 stack_nonstack.xsf
drwxr-xr-x    2 root     root            0 Sep  5 07:03 vmt

2. Follow the Step 3 above from the 'To configure a new stack' section.

3. Follow the Step 4 above, but only the following command.
configure stacking-support stack-port [stack-ports | all] selection [native {V80 | V160} | V320} | alternate]

4. Power down the switches.

5. Follow the Step 1 and Step 2 above.

6. Follow the Step 6 above.

* Slot-1 exos_stack1. # show stacking
Stack Topology is a Ring
Active Topology is a Ring
Node MAC Address    Slot  Stack State  Role     Flags
------------------  ----  -----------  -------  ---
*00:04:96:9e:a7:12  1     Active       Master   CA-
 00:04:96:9b:b3:34  2     Active       Backup   CA-
 00:04:96:9e:a7:56  3     Active       Standby  CA-
 00:04:96:9d:05:78  4     Active       Standby  CA-
* - Indicates this node
Flags: (C) Candidate for this active topology, (A) Active Node
(O) node may be in Other active topology

* Reference URL: Getting started with Summit Stacking

* Additional KBs:
How to configure sharing (LAG) with LACP in Summit stack or BlackDiamond switches

Thursday, April 11, 2019

Palo Alto Next-Gen Firewall Hardware

PA-3200 Series

PA-3200 Series Front Panel

The only differences between the PA-3220, PA-3250, and PA-3260 (shown) front panels are the model name and the Ethernet ports, as described in the table.
Ethernet ports 1 through 12
Twelve RJ-45 10Mbps/100Mpbs/1Gbps ports for network traffic. The link speed and link duplex are auto-negotiate only.

SFP ports 13 through 20
These ports vary depending on your firewall model:

  • PA-3220 firewall—Ports 13 through 16 are SFP (1Gbps) and ports 17 through 20 are SFP or SFP+ (10Gbps) based on the installed transceiver.
  • PA-3250 and PA-3260 firewallsPorts 13 through 20 are SFP (1Gbps) or SFP+ (10Gbps) based on the installed transceiver.

QSFP+ ports 21 through 24
(PA-3260 only) Four QSFP+ (40Gbps) ports as defined by the IEEE 802.3ba standard.

HSCI port
One SFP+ (10Gbps) port (supports only an SFP+ transceiver or passive SFP+ cable).

Use this port to connect two PA-3200 Series firewalls in a high availability (HA) configuration as follows:

  • In an active/passive configuration, this port is for HA2 (data link).
  • In an active/active configuration, you can configure this port for HA2 and HA3. HA3 is used for packet forwarding for asymmetrically routed sessions that require Layer 7 inspection for App-ID and Content-ID.

* Note: The HSCI ports must be connected directly between the two firewalls in the HA configuration (without a switch or router between them). When directly connecting the HSCI ports between two PA-3200 Series firewalls that are physically located near each other, Palo Alto Networks recommends that you use a passive SFP+ cable.
For installations where the two firewalls are not near each other and you cannot use a passive SFP+ cable, use a standard SFP+ transceiver and the appropriate cable length.

HA1-A and HA1-B ports
Two RJ-45 10Mbps/100Mbps/1000Mbps ports for high availability (HA) control.

* Note: If the firewall dataplane restarts due to a failure or manual restart, the HA1-B link will also restart. If this occurs and the HA1-A link is not connected and configured, then a split brain condition occurs. Therefore, we recommend that you connect and configure the HA1-A ports and the HA1-B ports to provide redundancy and to avoid split brain issues.

MGT port
Use this Ethernet 10Mbps/100Mbps/1000Mbps port to access the management web interface and perform administrative tasks. The firewall also uses this port for management services, such as retrieving licenses and updating threat and application signatures.

CONSOLE port (RJ-45)
Use this port to connect a management computer to the firewall using a 9-pin serial-to-RJ-45 cable and terminal emulation software.

The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).

* Note: If your management computer does not have a serial port, use a USB-to-serial converter.

Use the following settings to configure your terminal emulation software to connect to the console port:

  • Data rate: 9600
  • Data bits: 8
  • Parity: None
  • Stop bits: 1
  • Flow control: None

USB port
A USB port that accepts a USB flash drive with a bootstrap bundle (PAN-OS configuration).

Bootstrapping speeds up the process of configuring and licensing the firewall to make it operational on the network with or without internet access.

CONSOLE port (Micro USB)
Use this port to connect a management computer to the firewall using a standard Type-A USB-to-micro USB cable.

The console connection provides access to firewall boot messages, the Maintenance Recovery Tool (MRT), and the command line interface (CLI).

Refer to the Micro USB Console Port page for more information and to download the Windows driver or to learn how to connect from a Mac or Linux computer.

LED status indicators
Eight LEDs that indicate the status of the firewall hardware components (see Interpret the PA-3200 Series Status LEDs).

Thursday, March 28, 2019

Extreme (formerly, Avaya) VSP Switches - How to install a license file

First, you should get a license file (*.xml extension) from the Extreme Customer Support Portal.
Please follow the steps in the link.
The XML file contains the Base MAC address of VSP Chassis as below.

You may double check the Base MAC address by CLI command 'show sys-info.'

vsp-8404c_1:1#show sys-info

General Info :

 SysDescr : VSP-8404C ( 

 SysName : vsp-8404c_1
 SysUpTime    : 0 day(s), 23:38:35
SysContact   :
SysLocation  :

Chassis Info:

Chassis : 8404C ModelName : 8404C

BrandName          : Extreme Networks.
Serial#            : 18JP4930AAAA
H/W Revision       : 12
H/W Config         :
Part Number        : EC84000X2-E6
NumSlots           : 4
NumPorts           : 57
BaseMacAddr        : 64:6a:52:e8:1c:99
MacAddrCapacity    : 1024
MgmtMacAddr        : 64:6a:52:e8:1c:88

Step 1. Copy the license file (i.e. premier.xml) into VSP Chassis via FTP
You may copy the license file via FileZilla (open source FTP software). You can simply drag and drop the xml file into the /intflash directory to the right panel from your system.

or, you may copy from the USB as below.
(config)#copy /usb/premier.xml /intflash/premier.xml
   Make sure you have the xml file in the /intflash.

vsp-8404c_1:1#ls *.xml
Listing Directory /intflash:
-rw-r--r--  1 0       0           1017 Mar 29 03:19  license_premier_646A52E81C99.xml

Step 2. Load the license file
Enter the configuration mode by 'configure terminal' and load the license file by 'load-license' command.

vsp-8404c_1:1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.

* Note:
If more than one valid .xml license file exists in the /intflash/ directory, the switch uses the license with the highest capability. It does not require a reboot. However, please do not use a minus (-) symbol in the filename like license_premier-macsec_646A52E81C99.xml.

Step 2. Verify the license

vsp-8404c_1:1#sho license

License file name : /intflash/license_premier_646A52E81C99.xml

License Type           :    PREMIER (includes Base features)
MD5 of Key             :    00000000 00000000 00000000 00000000
MD5 of File            :    00000000 00000000 00000000 00000000
Generation Time        :    2019/03/28 18:20:45
Expiration Time        :
Base Mac Addr          :    64:6a:52:e8:1c:99
flags                  :    0x00000001 SINGLE
memo                   :

Features requiring a Premier license:
-  Layer 3 VSNs
-  MACsec
-  Distributed Virtual Routing(DvR)
-  >24 VRFs

  • 'save config' or 'write memory' CLI commands will show you the license file.
vsp-8404c_1:1#write memory
CP-1: Save config to file /intflash/config.cfg successful.
CP-1: Save license to file /intflash/license_premier_646A52E81C99.xml successful.

* Reference URL: 
How To Install a VSP License File