Booches.nl

Connecting the world…

Cacti, easy going

A decent management server is very important in a network, at least that is my opinion. The most important aspect of a management server is its user friendliness. Our customers are most of the time busy with their own problems and the problems of end users, which include all kind of (silly) problems. So the most of them don’t have a lot of time to spend on configuring a management server.

That is why I like Cacti and especially CactiEZ. CactiEZ is a software appliance, which is up and running in half an hour. After that you just add some devices and you can generate some nice bandwidth statistics with the help of RRDTool. I have also seen a lot of other management servers, like Nagios, HP OpenView and Cisco Works, but the most of them are hard to configure and end up as mp3 player…..

When I configure a management server only for network components like switches, routers and/or firewalls, I always use CactiEZ. It is easy to install and gives me all the things I need. The most important options of Cacti for me are: bandwidth statistics, syslog messages, flow view, mac tracking, reporting and so one. Especially if you combine Cacti(EZ) with SwitchMap, you have a nice, easy to use and robust management server for your network.

Port-channel Cisco vs. VMware ESX

I have had different discussions with different customers about the load-balancing algorithms between a Cisco switch, configured with a port-channel and a VMware ESX server using multiple NICs. Our VMware consultants always choose Route based on IP hashes as load-balancing algorithm. This means that load-balancing happens on layer 3 of the OSI model (source-destination-IP).

In my opinion, the switch should be configured the same way. Depending on the model switch, you can have different default load-balancing algoritmhs. For example, the Cisco Catalyst 3750 uses src-mac load-balancing and the Cisco Catalyst 6500 use src-dst-ip load-balancing. You can check the configured load-balancing algorithm with the following command:

show etherchannel load-balancing

If you would like you change the load-balancing algorithm you can use the global configuration command:

port-channel load-balancing <option>

Be aware that this is a global configuration command, so it affects all the configured port-channels on the switch.

To check the load-balancing between the different NICs, you should have a tool to look at real-time bandwidth statistics. I normally use the tool SNMP Traffic Grapher to monitor the different switch ports. On the ESX console you can check the load-balancing with the commands:

  1. esxtop [enter]
  2. s2 (schedule interval of 2 seconds) [enter]
  3. n [network]

The load should be spread fairly even across the different switch ports en vmnics.

relays.ordb.org

Since the day before yesterday, some of our customers complained having problems with receiving e-mail. The senders from the e-mail noticed that their mail had been blocked by relays.ordb.org. This RBL is offline, according to this article, at least everybody thought. Seems to me, the RBL came online yesterday and blocked everything. I have heard some rumours about the RBL coming online and blocking everything, so postmaster become aware of false configuration of the RBL lists in the mail components. Our customers were using Microsoft Exchange servers and were still using relays.ordb.org in their Connection Filtering rules. After deleting the URL the mail began to flows like nothing happend.

ProCurve excessive STP topology changes

Recently a colleque of mine noticed something strange in the STP configuration from a couple of HP ProCurve switches. He had a network, which was configured by another party, with switches running MST en RSTP mode spanning-tree. He noticed a lot of topology changes in the configuration, but couldn’t find out where they were coming from.

Yesterday I came in another native HP ProCurve environment with two 5412zl switches en multiple 3500yl switches. All the switches have MST configured and I noticed the same strange behavior. One switch had an uptime from 29 days, but had more than 700.000 topology changes. The last change was 11 hours ago. I checked the logging and noticed that ports going up and down, aren’t counted as a topology change. I have looked at different forums, but cannot find a reason for the topology changes.

My colleque and I will try to investigate the problem further, when we have some time left ;-). I hope we can come back on this issue, but maybe some of you already noticed the same problems and know the cause of it….