Pages

Wednesday, May 7, 2014

DELL versus CISCO server firmware management



DELL and CISCO firmware management philosophies are very different.
DELL has server oriented approach (similar to HP) and CISCO has network centric approach.

DELL System and Firmware Management
DELL System and Firmware Management Approach is year by year better and better but in my opinion still not optimal. But the future is bright and happy J
We have lot of possibilities how to do firmware update and unfortunately sometimes you have to test all of them to be successful L
12-th generation of servers is far the best because lifecycle controller is significantly faster and less problematic than in 11th generation.
I don’t want to go to deeply into specific firmware update problems – and usually there are some ;-) - so I’ll keep it in more general.

CISCO System and Firmware Management
CISCO UCS has single management software for servers embedded in the hardware UCSM (UCS Manager). It is running inside network interconnects (Fabric Interconnects) and because they are two interconnects it is in high availability cluster (active/passive). UCS Manager allow you to do all UCS configurations and also firmware management of all components (Server adapters, Server BIOSes, IO Modules, Fabric Interconnects and UCS Manager itself).

CISCO release firmware packages which must be downloaded into UCS and these firmware’s can be applied. Upgrade order is very important – starting from IOMs, then Fabric Interconnects and lastly UCS Manager.
Server and server adapter firmware management can be included into server profiles. Server profiles is something like AIM personas. It is a logical representation of the server and BIOS + firmware versions can be specified there. When Server profile is applied (associated) to the server then BIOS + firmware is upgraded or downgraded as defined in the profile.

Server upgrade procedure is done out-of-band and server cannot run operating system – therefore maintenance window has to be planned. It takes a while. Internally it works over PXE boot. Server is automatically reconfigured to boot over PXE where PXE and TFTP is provided internally by UCS Manager. Upgraded server boot special linux distribution (CISCO call it PNU linux) and firmware packages are applied in this temporarily running linux system.  After upgrade the server boot order is changed back and server boots normal operating system.    

COMPARISON
Both firmware management approaches are totally different. CISCO has centralized system leveraging internal PXE/TFTP where DELL has distributed system where lot of lifecycle controllers are orchestrated by some 1:many management software.

When I work for CISCO lot of customers were really scare to do UCS upgrade by them self. I can understand it because CISCO UCS is not simple system. CISCO UCS is unified system and when you make mistake during fabric interconnect upgrade you can be in troubles. Therefore customers usually engaged CISCO Advanced Services or certified partners.

When I work for DELL Services I had also several engagements for firmware upgrades because DELL customers are not aware about OpenManage framework and various firmware possibilities.
If DELL customer want to do firmware management by them self I usually do 3 day System Management workshop engagement to explain them practically the architecture and system management possibilities.

CISCO advantage
·         Unified and centralized firmware management
·         Firmware can be defined in Service Profiles
CISCO disadvantages
·         Centralized and complex system – therefore customers are afraid to do upgrade by them self
·         Proprietary system even inside using standard protocols like PXE/TFTP
·         Longer server downtime – I don’t know how it is today but 3 years ago CISCO hadn’t operating system update packages for BIOS and firmware (something like DUPs) – disadvantage mitigation: they expect some form of cluster to eliminate downtimes
DELL advantage
·         Advantages of distributed system – if one server upgrade fails it doesn’t  impact whole system
·         Dell Update Packages (DUP) which can be applied via running operating system – OMSA
·         Out-of-band upgrades via lifecycle controller – firmware staging and application after next server reboot
·         Open system from management point of view – WS-MAN, racadm
·          
DELL disadvantage
·         Lot of software components customer must be aware (DELL Repository Manager, Open Manage Essentials, Lifecycle controller, CMC,  …) – but it is necessary to support all environments
·         Sometimes it doesn’t work as expected and you have to use another tool or upgrade Lifecycle controller to higher version and so on – it is much better on 12th server generation and iDrac 7 and OME 1.2+

Hopefully we will do continuous improvements  in this area.

The best and most optimal DELL Firmware management strategy really depends  on customer environment. It depends on following:
How many servers do they have?
Do they want to use 1:many firmware management like OpenManage Essentials, Altiris, MS System Center, VMware OpenManage Integration?
Do they want to integrate it with some existing system management (Microsoft, VMware)  and configuration management?

And we have to show to our customers how it works. Think about Proof of Concepts.

I understand benefits of both approaches and nobody can say exactly one is better than other. As always – it depends.

Monday, May 5, 2014

The variants of the VLAN configurations on ports with PowerConnect switches and F10

##############################################################################################################################################

FORCE 10

##############################################################################################################################################

By default, all interfaces are in Layer 3 mode and not belonging to any Vlan. So you could configure an IP address on the port concerned, as on a classical router.

RVL-S4810-1# show int ten 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto       Auto   --           -> member in none Vlan

##############################################################################################################################################

To configure the port in a Vlan, you  must make a change to Layer2 / switch port Mode. It also falls automatically to the default untagged Vlan. This is by default Vlan 1. It can be be changed if necessary RVL-S4810-1(conf)#default vlan-id xxx.

A Default VLAN IP address can not be given. To obtain an IP interface to Vlan 1 you must change the default Vlan to another Vlan first

RVL-S4810-1(conf-if-te-0/46)#switchport
RVL-S4810-1#show int ten 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto    1     -> untagged member in default Vlan

To change untagged Vlan:

RVL-S4810-1(conf)# int vlan 2
RVL-S4810-1(conf-if-vl-2)#untagged tengigabitethernet 0/46
RVL-S4810-1#show int ten 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto   2      -> now untagged member in Vlan 2

##############################################################################################################################################

To make the port to trunk port and to tag multiple Vlans without a untagged native VLAN.

RVL-S4810-1(conf-if-te-0/46)#switchport
RVL-S4810-1#show int ten 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto    1          -> untagged member in default Vlan (will be changed/removed when adding the first tagged Vlan)

To add tagged Vlans (here you can see, that the native vlan is removed and the the switch tag all Vlans):

RVL-S4810-1(conf-if-te-0/46)#int vlan 3
RVL-S4810-1(conf-if-vl-3)#tagged tengigabitethernet 0/46
RVL-S4810-1#show int ten 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto   3

RVL-S4810-1(conf-if-te-0/46)#int vlan 4
RVL-S4810-1(conf-if-vl-4)#tagged tengigabitethernet 0/46

RVL-S4810-1#show int ten 0/46 status
Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto   3-4

With RVL-S4810-2# show vlan you can see which Ports are tagged and untagged Members on the Vlans:

RVL-S4810-2# show vlan

Codes: * - Default VLAN, G - GVRP VLANs, R - Remote Port Mirroring VLANs, P - Pimary, C - Community, I - Isolated
       O - Openflow
Q: U - Untagged, T - Tagged
   x - Dot1x untagged, X - Dot1x tagged
   o - OpenFlow untagged, O - OpenFlow tagged
   G - GVRP tagged, M - Vlan-stack, H - VSN tagged
   i - Internal untagged, I - Internal tagged, v - VLT untagged, V - VLT tagged

    NUM    Status    Description                     Q Ports
    1      Active                                             
    2      Active                                   
    3      Active                                    T Te 0/46             -> 0/46 now tagged member in Vlan 3
    4      Active                                    T Te 0/46             -> 0/46 now tagged member in Vlan 4

No untagged native VLAN !!! Port is not in hybride Mode !!

##############################################################################################################################################

To make the port to trunk port and to tag multiple Vlans or to make double tagging on it, it must be configured in the Port Mode Hybrid.

Is it not in the default mode (Layer 3, see above) you have to configure it in these default configure mode:

RVL-S4810-1(conf-if-te-0/46)#portmode hybrid
% Error: Port is in Layer-2 mode Te 0/46.

RVL-S4810-1(conf-if-te-0/46)#int vlan 2
RVL-S4810-1(conf-if-vl-2)#no untagged tengigabitethernet 0/46
RVL-S4810-1(conf-if-te-0/46)#no switchport

Now you can change the port mode:

RVL-S4810-1(conf-if-te-0/46)#portmode hybrid

RVL-S4810-1#show int tengigabitethernet 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto   --           -> member in none Vlan

Now you can add Vlans tagged and untagged to the Port:

RVL-S4810-1(conf-if-te-0/46)#switchport
RVL-S4810-1#show int ten 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto    1          -> untagged member in default Vlan

To change the untagged Vlan:

RVL-S4810-1(conf)# int vlan 2
RVL-S4810-1(conf-if-vl-2)#untagged tengigabitethernet 0/46
RVL-S4810-1#show int ten 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto   2           -> now untagged member in Vlan 2

To add additional tagged Vlans:

RVL-S4810-1(conf-if-te-0/46)#int vlan 3
RVL-S4810-1(conf-if-vl-3)#tagged tengigabitethernet 0/46
RVL-S4810-1#show int ten 0/46 status

Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto   2-3

RVL-S4810-1(conf-if-te-0/46)#int vlan 4
RVL-S4810-1(conf-if-vl-4)#tagged tengigabitethernet 0/46

RVL-S4810-1#show int ten 0/46 status
Port     Description  Status Speed     Duplex Vlan
Te 0/46               Down   Auto      Auto   2-4

With RVL-S4810-2# show vlan you can see which Ports are tagged and untagged Members on the Vlans:

RVL-S4810-2# show vlan

Codes: * - Default VLAN, G - GVRP VLANs, R - Remote Port Mirroring VLANs, P - Pimary, C - Community, I - Isolated
       O - Openflow
Q: U - Untagged, T - Tagged
   x - Dot1x untagged, X - Dot1x tagged
   o - OpenFlow untagged, O - OpenFlow tagged
   G - GVRP tagged, M - Vlan-stack, H - VSN tagged
   i - Internal untagged, I - Internal tagged, v - VLT untagged, V - VLT tagged

    NUM    Status    Description                     Q Ports
    1      Active                                    U Te 0/1-45,47-48         
    2      Active                                    U Te 0/46            -> 0/46 now untagged member in Vlan 2
    3      Active                                    T Te 0/46            -> 0/46 now tagged member in Vlan 3
   4      Active                                    T Te 0/46             -> 0/46 now tagged member in Vlan 4

##############################################################################################################################################

PowerConnect

##############################################################################################################################################

Access — The port belongs to a single untagged VLAN.

Configure a Vlan Untagged to a Port,  In the Example VLAN 23.

console(config)# interface gi1/0/8
console(config-if)# switchport mode access
console(config-if)# switchport access vlan 23

##############################################################################################################################################

Trunk vs. General Mode

·         In General Mode are egress more then one untagged Vlans possible

##############################################################################################################################################


General — The port belongs to VLANs, and each VLAN is user-defined as tagged or untagged (full 802.1Q mode).

Several Vlans tagged and / or untagged configured on a port, eg Uplink (the Vlans 23, 25 are the tagged Vlans, Vlans 24, 27 are untagged, untagged packets that are received in the example will be switched on VLAN 24 (PVID).
The port configuration must be in respect of the tagged / untagged Vlans the same as its counterpart, switch, server can be established). If Only the Command console(config-if)# switchport mode general
is configured then the following Defaults are present:

General Mode PVID: 1 (default)                   -> Vlan 1 untagged
General Mode Ingress Filtering: Enabled
General Mode Acceptable Frame Type: Admit All
General Mode Dynamically Added VLANs:
General Mode Untagged VLANs: 1
General Mode Tagged VLANs:                     -> NO Vlan Tagged
General Mode Forbidden VLANs:

console(config)# interface gi1/0/11
console(config-if)# switchport mode general
console(config-if)# switchport general allowed vlan add 23,25 tagged
console(config-if)# switchport general allowed vlan add 24,27 untagged
console(config-if)# switchport general pvid 24

##############################################################################################################################################

Trunk — The port belongs to VLANs on which all ports are tagged (except for one per port that can be untagged).

Several Vlans tagged  plus one untagged configured on a port, eg Uplink (the Vlans 23, 24, 25 are the tagged Vlans, Vlan 22 is untagged, untagged packets that are received in the example will be switched on VLAN 22.
The port configuration must be in respect of the tagged / untagged Vlans the same as its counterpart, switch, server can be established). If Only the Command console(config-if)# switchport mode trunk
is configured then the following Defaults are present:

Trunking Mode Native VLAN: 1 (default)    -> Vlan 1 untagged
Trunking Mode Native VLAN Tagging: Disabled
Trunking Mode VLANs Enabled: All            -> ALL Vlans Tagged, except Native Vlan 1

console(config)# interface gi1/0/9
console(config-if)# switchport mode trunk
console(config-if)# switchport mode trunk native vlan 22
console(config-if)# switchport mode trunk allowed vlan add 22-25

##############################################################################################################################################

IGMP snooping on Force10 IOA

Here is how IGMP snooping is implemented on the IOA.

IGMP snooping is enabled by default on the switch.
  • FTOS supports version 1, version 2, and version 3 hosts.
  • FTOS IGMP snooping is based on the IP multicast address (not on the Layer 2 multicast MAC address). IGMP snooping entries are stored in the Layer 3 flow table instead of in the Layer 2 forwarding information base (FIB).
  • FTOS IGMP snooping is based on draft-ietf-magma-snoop-10.
  • IGMP snooping is supported on all M I/O Aggregator stack members.
  • A maximum of 8k groups and 4k virtual local area networks (VLAN) are supported.
  • IGMP snooping is not supported on the default VLAN interface.
  • Flooding of unregistered multicast traffic is enabled by default.
  • Queries are not accepted from the server sideports and are only accepted from the uplink LAG.
  • Reports and Leaves are flooded by default to the uplink LAG irrespective of whether it is an mrouter port or not
Of course if you disable a vlan that has been configured with IGMP snooping, any multicast traffic that hits this vlan will be ignored.