Nexus 7000 Storm Control using EEM

N7010# sh run int e1/1

!Command: show running-config interface Ethernet1/1
!Time: Thu Dec 15 06:52:24 2011

version 6.0(1)

interface Ethernet1/1
  switchport
  switchport mode trunk
  switchport trunk allowed vlan 101
  storm-control broadcast level 40.00
  storm-control multicast level 40.00

N7010#
N7010# sh run eem

!Command: show running-config eem
!Time: Thu Dec 15 06:27:19 2011

version 6.0(1)
event manager applet SC-applet
  event storm-control
  action 1 cli enable
  action 2 cli configure terminal
  action 3 cli interface $interface
  action 4 cli shutdown
  action 5 syslog msg EEM Storm Control shutdown action is performed upon interface $interface


N7010#
N7010# sh run | in logging
logging logfile messages 6
logging server 192.168.10.10 6
N7010#
N7010# sh logging

Logging console:                enabled (Severity: critical)
Logging monitor:                enabled (Severity: notifications)
Logging linecard:               enabled (Severity: notifications)
Logging timestamp:              Seconds
Logging loopback :              disabled
Logging server:                 enabled
{192.168.10.10}
        server severity:        information
        server facility:        local7
        server VRF:             default
Logging logflash:               enabled (Severity: information)
Logging logfile:                enabled
        Name - messages: Severity - information Size - 4194304

Facility        Default Severity        Current Session Severity

--- output omitted ---
N7010# terminal monitor
N7010# clear log log
2011 Dec 15 06:44:25 N7010 %SYSLOG-1-SYSTEM_MSG : Logging logfile (messages) cleared by user
N7010#
N7010# 2011 Dec 15 06:44:43 N7010 %VPC-2-PEER_KEEP_ALIVE_RECV_FAIL: In domain 1, VPC peer keep-alive receive has failed
2011 Dec 15 06:44:46 N7010 %ETHPORT-5-STORM_CONTROL_ABOVE_THRESHOLD: Traffic in port Ethernet1/1 exceeds the configured threshold 40%
2011 Dec 15 06:44:46 N7010 %ETHPORT-5-IF_DOWN_CFG_CHANGE: Interface Ethernet1/1 is down(Config change)
2011 Dec 15 06:44:46 N7010 %ETHPORT-5-STORM_CONTROL_BELOW_THRESHOLD: Traffic in port Ethernet1/1 has fallen below the configured threshold 40%
2011 Dec 15 06:44:46 N7010 %ETHPORT-5-IF_DOWN_ADMIN_DOWN: Interface Ethernet1/1 is down (Administratively down)
2011 Dec 15 06:44:46 N7010 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by __eemuser on invalid_ip@pts/1
2011 Dec 15 06:44:51 N7010 %ETHPORT-5-STORM_CONTROL_ABOVE_THRESHOLD: Traffic in port Ethernet1/1 exceeds the configured threshold 40%
2011 Dec 15 06:44:51 N7010 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by __eemuser on invalid_ip@pts/1
2011 Dec 15 06:44:56 N7010 %ETHPORT-5-STORM_CONTROL_BELOW_THRESHOLD: Traffic in port Ethernet1/1 has fallen below the configured threshold 40%

N7010#
N7010# sh log log
2011 Dec 15 06:44:25 N7010 %SYSLOG-1-SYSTEM_MSG : Logging logfile (messages) cleared by user
2011 Dec 15 06:44:43 N7010 %VPC-2-PEER_KEEP_ALIVE_RECV_FAIL: In domain 1, VPC peer keep-alive receive has failed
2011 Dec 15 06:44:46 N7010 %ETHPORT-5-STORM_CONTROL_ABOVE_THRESHOLD: Traffic in port Ethernet1/1 exceeds the configured threshold 40%
2011 Dec 15 06:44:46 N7010 %ETHPORT-5-IF_DOWN_CFG_CHANGE: Interface Ethernet1/1 is down(Config change)
2011 Dec 15 06:44:46 N7010 %ETHPORT-5-STORM_CONTROL_BELOW_THRESHOLD: Traffic in port Ethernet1/1 has fallen below the configured threshold 40%
2011 Dec 15 06:44:46 N7010 %ETHPORT-5-IF_DOWN_ADMIN_DOWN: Interface Ethernet1/1 is down (Administratively down)
2011 Dec 15 06:44:46 N7010 %EEM_ACTION-6-INFORM: EEM Storm Control shutdown action is performed upon interface Ethernet1/1
2011 Dec 15 06:44:46 N7010 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by __eemuser on invalid_ip@pts/1
2011 Dec 15 06:44:51 N7010 %ETHPORT-5-STORM_CONTROL_ABOVE_THRESHOLD: Traffic in port Ethernet1/1 exceeds the configured threshold 40%
2011 Dec 15 06:44:51 N7010 %EEM_ACTION-6-INFORM: EEM Storm Control shutdown action is performed upon interface Ethernet1/1
2011 Dec 15 06:44:51 N7010 %VSHD-5-VSHD_SYSLOG_CONFIG_I: Configured from vty by __eemuser on invalid_ip@pts/1
2011 Dec 15 06:44:56 N7010 %ETHPORT-5-STORM_CONTROL_BELOW_THRESHOLD: Traffic in port Ethernet1/1 has fallen below the configured threshold 40%
N7010#
N7010# sh event manager event-types storm_control
Name : storm_control
Description : Traffic on a port exceeds configured thresholds
Event Parameters : interface, cause
Publisher : Ethernet Port Manager
Default Action : None
N7010#

NX-OS 'Vlans Err-disabled on Trunk' due to 'L4 protocol CAM entry allocation failure'

n7010# sh cdp neighbors
Capability Codes: R - Router, T - Trans-Bridge, B - Source-Route-Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater,
                  V - VoIP-Phone, D - Remotely-Managed-Device,
                  s - Supports-STP-Dispute

Device-ID             Local Intrfce Hldtme Capability  Platform      Port ID
n7010(JAF1447ALEM)     Eth2/41       177    R S I s   N7K-C7010     Eth2/42

n7010(JAF1447ALEM)     Eth2/42       177    R S I s   N7K-C7010     Eth2/41

n7010#
n7010# sh spanning-tree

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    8193
             Address     f025.72a5.a3c1
             This bridge is the root
             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec

  Bridge ID  Priority    8193   (priority 8192 sys-id-ext 1)
             Address     f025.72a5.a3c1
             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Eth2/41          Desg FWD 4         128.297  P2p
Eth2/42          Back BLK 4         128.298  P2p

n7010#
n7010# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
n7010(config)# int vlan 1
n7010(config-if)# ip access-group Test_ACL in
Note: ACL Test_ACL does not exist. Traffic will be implicitly denied
n7010(config-if)#
n7010(config-if)# exit
n7010(config)#
n7010(config)# ip access-list Test_ACL
n7010(config-acl)# deny 1 any any
n7010(config-acl)# deny 2 any any
n7010(config-acl)# deny 3 any any
n7010(config-acl)# deny 4 any any
n7010(config-acl)# deny 5 any any
n7010(config-acl)# deny 6 any any
n7010(config-acl)# deny 7 any any
ERROR: L4 protocol CAM entry allocation failure
n7010(config-acl)#
n7010(config-acl)# sh access-list Test_ACL

IP access list Test_ACL
        10 deny icmp any any
        20 deny igmp any any
        30 deny 3 any any
        40 deny 4 any any
        50 deny 5 any any
        60 deny tcp any any
n7010(config-acl)#
n7010(config-acl)# int vlan 1
n7010(config-if)# no ip access-group Test_ACL in
n7010(config-if)#
n7010(config-if)# ip access-list Test_ACL
n7010(config-acl)# deny 7 any any
n7010(config-acl)# sh ip access-list Test_ACL

IP access list Test_ACL
        10 deny icmp any any
        20 deny igmp any any
        30 deny 3 any any
        40 deny 4 any any
        50 deny 5 any any
        60 deny tcp any any
        70 deny 7 any any
n7010(config-acl)#
n7010(config-acl)# int vlan 1
n7010(config-if)# ip access-group Test_ACL in
ERROR: L4 protocol CAM entry allocation failure
n7010(config-if)#
n7010(config-if)# int e2/41
n7010(config-if)# shut
n7010(config-if)#
n7010(config-if)# int vlan 1
n7010(config-if)# ip access-group Test_ACL in
n7010(config-if)#
n7010(config-if)# clear log log
2011 Jun 17 19:24:58 n7010 %$ VDC-1 %$ %SYSLOG-1-SYSTEM_MSG : Logging logfile (messages) cleared by user
n7010(config-if)#
n7010(config-if)# int e2/41
n7010(config-if)# no shut
n7010(config-if)# sh spanning-tree
No spanning tree instance exists.
n7010(config-if)#
n7010(config-if)# sh int e2/41 trunk

--------------------------------------------------------------------------------
Port          Native  Status        Port
              Vlan                  Channel
--------------------------------------------------------------------------------
Eth2/41       1       trunking      --

--------------------------------------------------------------------------------
Port          Vlans Allowed on Trunk
--------------------------------------------------------------------------------
Eth2/41       1-3967,4048-4093

--------------------------------------------------------------------------------
Port          Vlans Err-disabled on Trunk
--------------------------------------------------------------------------------
Eth2/41       1-8

--------------------------------------------------------------------------------
Port          STP Forwarding
--------------------------------------------------------------------------------
Eth2/41       none

--------------------------------------------------------------------------------
Port          Vlans in spanning tree forwarding state and not pruned
--------------------------------------------------------------------------------
Eth2/41       none

--------------------------------------------------------------------------------
Port          Vlans Forwarding on FabricPath
--------------------------------------------------------------------------------
Eth2/41       none
n7010(config-if)#
n7010(config-if)# sh log log
2011 Jun 17 19:24:58 n7010 %SYSLOG-1-SYSTEM_MSG : Logging logfile (messages) cleared by user
2011 Jun 17 19:25:04 n7010 %ETHPORT-5-IF_ADMIN_UP: Interface Ethernet2/41 is admin up .
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-SPEED: Interface Ethernet2/42, operational speed changed to 1 Gbps
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_DUPLEX: Interface Ethernet2/42, operational duplex mode changed to Full
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Ethernet2/42, operational Receive Flow Control state changed to off
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Ethernet2/42, operational Transmit Flow Control state changed to off
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-SPEED: Interface Ethernet2/41, operational speed changed to 1 Gbps
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_DUPLEX: Interface Ethernet2/41, operational duplex mode changed to Full
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_RX_FLOW_CONTROL: Interface Ethernet2/41, operational Receive Flow Control state changed to off
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_TX_FLOW_CONTROL: Interface Ethernet2/41, operational Transmit Flow Control state changed to off
2011 Jun 17 19:25:07 n7010 %ACLMGR-3-ACLMGR_VERIFY_FAIL: Verify failed: client 8100016E, L4 protocol CAM entry allocation failure
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_SEQ_ERROR: Error ("L4 protocol CAM entry allocation failure") communicating with MTS_SAP_ACLMGR for opcode MTS_OPC_ETHPM_PORT_LOGICAL_BRINGUP (RID_PORT: Ethernet2/42)
2011 Jun 17 19:25:07 n7010 %ETHPORT-3-IF_ERROR_VLANS_SUSPENDED: VLANs 1-8 on Interface Ethernet2/42 are being suspended. (Reason: L4 protocol CAM entry allocation failure)
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_UP: Interface Ethernet2/42 is up in mode trunk
2011 Jun 17 19:25:07 n7010 %ACLMGR-3-ACLMGR_VERIFY_FAIL: Verify failed: client 8100016E, L4 protocol CAM entry allocation failure
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_SEQ_ERROR: Error ("L4 protocol CAM entry allocation failure") communicating with MTS_SAP_ACLMGR for opcode MTS_OPC_ETHPM_PORT_LOGICAL_BRINGUP (RID_PORT: Ethernet2/41)
2011 Jun 17 19:25:07 n7010 %ETHPORT-3-IF_ERROR_VLANS_SUSPENDED: VLANs 1-8 on Interface Ethernet2/41 are being suspended. (Reason: L4 protocol CAM entry allocation failure)
2011 Jun 17 19:25:07 n7010 %ETHPORT-5-IF_UP: Interface Ethernet2/41 is up in mode trunk
n7010(config-if)#

Root Cause:
L4 TCAM allocation failed due to 4 lines of IPv4 ACL entries with uncommon IP protocol numbers (those that are not translated to well-known tcp, udp, icmp, igmp, ospf, eigrp, etc).

Nexus 7000 NetFlow Configuration

Just reached home from a Catalyst 6500 - Nexus 7000 migration.
Got a small task to migrate the ip route-cache flow interface subcommand on the Cat6K SVIs to the Nexus 7000.
Google led me to http://docwiki.cisco.com/wiki/Cisco_NX-OS/IOS_Netflow_Comparison

After some reading and configuration testing / fine-tuning, below is the configuration that satisfied me.

feature netflow

flow record Netflow-Record-1
  description Custom-Flow-Record
  match ipv4 source address
  match ipv4 destination address
  match ip protocol
  match transport source-port
  match transport destination-port
  collect counter bytes
  collect counter packets

flow monitor Netflow-Monitor-1
  record Netflow-Record-1

int vlan1, vlan2, vlan3
  ip flow monitor Netflow-Monitor-1 input
  ip flow monitor Netflow-Monitor-1 output

Below shows the configuration steps on a Nexus 7000:

n7010-sw01# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
n7010-sw01(config)# feature netflow
n7010-sw01(config)#
n7010-sw01(config)# flow record Netflow-Record-1
n7010-sw01(config-flow-record)# description Custom-Flow-Record
n7010-sw01(config-flow-record)# match ipv4 source address
n7010-sw01(config-flow-record)# match ipv4 destination address
n7010-sw01(config-flow-record)# match ip protocol
n7010-sw01(config-flow-record)# match transport source-port
n7010-sw01(config-flow-record)# match transport destination-port
n7010-sw01(config-flow-record)# collect counter bytes
n7010-sw01(config-flow-record)# collect counter packets
n7010-sw01(config-flow-record)# exit
n7010-sw01(config)#
n7010-sw01(config)# flow monitor Netflow-Monitor-1
n7010-sw01(config-flow-monitor)# record Netflow-Record-1
n7010-sw01(config-flow-monitor)# exit
n7010-sw01(config)#
n7010-sw01(config)# int vlan1, vlan2, vlan3
n7010-sw01(config-if)# ip flow monitor Netflow-Monitor-1 input
n7010-sw01(config-if)# ip flow monitor Netflow-Monitor-1 output
n7010-sw01(config-if)# end
n7010-sw01# 

Issue the show hardware flow ip command to obtain the output similar to the show ip cache flow command.

n7010-sw01# sh hardware flow ip

slot  1
=======


D - Direction; L4 Info - Protocol:Source Port:Destination Port
IF - Interface: ()ethernet, (S)vi, (V)lan, (P)ortchannel, (T)unnel
TCP Flags: Ack, Flush, Push, Reset, Syn, Urgent

D IF    SrcAddr         DstAddr         L4 Info         PktCnt     TCP Flags
-+-----+---------------+---------------+---------------+----------+-----------
I S1    128.001.004.080 172.026.021.099 006:02135:08088 0000001686 A . P . . .
I S1    128.001.004.080 172.026.021.099 006:02133:08088 0000001700 A . P . . .
I S1    128.001.005.019 192.168.010.026 006:02189:08080 0000000034 A . P . . .
I S2    192.168.010.026 128.001.005.019 006:08080:02189 0000000042 A . P . . .
I S1    128.001.007.091 128.001.006.202 001:00000:00771 0000000014 . . . . . .
I S1    128.001.005.019 192.168.010.026 006:02196:08080 0000000043 A . P . . .
I S2    192.168.010.026 128.001.005.019 006:08080:02196 0000000058 A . P . . .
I S1    128.001.005.019 192.168.010.026 006:02188:08080 0000000055 A . P . . .
I S2    192.168.010.026 128.001.005.019 006:08080:02188 0000000083 A . P . . .
I S3    128.001.041.202 224.000.000.018 112:08450:00007 0000000067 . . . . . .
I S1    128.001.002.002 224.000.000.018 112:08449:00007 0000000067 . . . . . .
I S1    128.001.005.019 192.168.010.026 006:02200:08080 0000000057 A . P . . .
I S2    192.168.010.026 128.001.005.019 006:08080:02200 0000000081 A . P . . .
I S1    128.001.007.090 128.001.006.202 001:00000:00771 0000000014 . . . . . .
I S1    128.001.002.012 172.020.002.040 006:03397:01442 0000000029 A . P . . .
I S1    128.001.002.002 128.001.048.002 017:00514:00514 0000000008 . . . . . .
I S1    128.001.002.003 128.001.048.002 017:00514:00514 0000000008 . . . . . .
I S3    128.001.045.139 172.020.002.040 006:01201:01442 0000000010 A . P . . .
I S1    128.001.002.012 172.020.002.060 006:04561:00080 0000000152 A . P . S .
I S1    172.020.001.027 128.001.006.202 017:00123:00123 0000000008 . . . . . .
I S1    172.020.001.027 128.001.006.201 017:00123:00123 0000000008 . . . . . .
I S3    128.001.045.092 172.020.002.024 006:01115:00445 0000001170 A . P . . .
I S1    128.001.003.058 172.026.021.033 006:01994:08080 0000000003 . . . . S .
I S1    128.001.006.118 128.001.006.002 017:00123:00123 0000000001 . . . . . .
I S1    128.001.004.211 172.020.002.040 006:01136:01442 0000000001 A . . . . .
I S1    128.001.005.019 192.168.010.026 006:02204:08080 0000000016 A . P . S .
I S2    192.168.010.026 128.001.005.019 006:08080:02204 0000000019 A . P . S .
I S3    128.001.045.224 172.020.009.024 006:01429:00445 0000000040 A F P . S .
I S1    128.001.003.058 172.026.021.033 006:01997:08080 0000000002 . . . . S .
I S1    128.001.005.055 172.026.021.033 006:02112:08088 0000000006 A F P . S .
I S3    128.001.046.021 172.020.003.011 006:01090:00257 0000000003 A . P . . .
I S1    128.001.004.047 172.026.002.104 006:49321:01355 0000000004 A . P . . .
I S1    172.020.001.023 128.001.048.002 017:00514:00514 0000000002 . . . . . .
I S1    128.001.003.058 172.026.021.033 006:02000:08080 0000000002 . . . . S .
I S1    128.001.007.088 172.020.002.013 006:01299:00080 0000000007 A F P . S .
I S1    128.001.005.019 192.168.010.026 006:02202:08080 0000000002 A . P . . .
I S2    192.168.010.026 128.001.005.019 006:08080:02202 0000000002 A . P . . .
I S1    128.001.003.058 172.026.021.033 006:02003:08080 0000000002 . . . . S .
I S1    128.001.004.047 172.020.002.040 006:50967:01442 0000000010 A . P . . .
I S1    128.001.005.055 172.026.021.033 006:02116:08088 0000000006 A F P . S .
I S1    128.001.007.088 172.020.002.013 006:01300:00080 0000000003 A F . . S .
I S1    128.001.005.041 172.020.002.103 006:01284:00443 0000000002 A . P R . .
I S1    128.001.005.041 172.020.002.103 006:01292:00443 0000000007 A . P . S .
I S3    128.001.045.152 172.020.002.040 006:01212:01442 0000000001 A . . . . .
I S1    128.001.005.055 172.026.021.033 006:02114:08088 0000000006 A F P . S .
I S1    128.001.005.168 172.020.002.040 006:02022:01442 0000000002 A . P . . .
I S1    128.001.005.019 050.016.235.173 006:02205:00843 0000000003 . . . . S .
I S2    050.016.235.173 128.001.005.019 006:00843:02205 0000000003 A . . R . .
I S1    128.001.004.080 172.026.021.099 006:02176:08088 0000000005 A F P . S .
I S1    128.001.005.019 050.016.235.173 006:02206:08890 0000000003 . . . . S .
I S2    050.016.235.173 128.001.005.019 006:08890:02206 0000000003 A . . R . .
I S1    128.001.004.080 172.026.021.099 006:02177:08088 0000000005 A F P . S .
I S1    128.001.003.058 172.026.021.033 006:02006:08080 0000000001 . . . . S .
I S1    172.020.001.027 172.020.008.068 017:00123:00123 0000000001 . . . . . .
O S1    172.026.021.099 128.001.004.080 006:08088:02133 0000002653 A . P . . .
O S1    172.026.021.099 128.001.004.080 006:08088:02135 0000002514 A . P . . .
O S2    128.001.005.019 192.168.010.026 006:02200:08080 0000000057 A . P . . .
O S1    192.168.010.026 128.001.005.019 006:08080:02200 0000000081 A . P . . .
O S2    128.001.005.019 192.168.010.026 006:02189:08080 0000000035 A . P . . .
O S1    192.168.010.026 128.001.005.019 006:08080:02189 0000000042 A . P . . .
O S2    128.001.005.019 192.168.010.026 006:02196:08080 0000000043 A . P . . .
O S1    192.168.010.026 128.001.005.019 006:08080:02196 0000000058 A . P . . .
O S2    128.001.005.019 192.168.010.026 006:02188:08080 0000000055 A . P . . .
O S1    192.168.010.026 128.001.005.019 006:08080:02188 0000000083 A . P . . .
O S1    172.020.002.040 128.001.002.012 006:01442:03397 0000000048 A . P . . .
O S3    172.020.002.040 128.001.045.139 006:01442:01201 0000000009 A . P . . .
O S1    172.020.002.060 128.001.002.012 006:00080:04561 0000000096 A . P . S .
O S2    172.020.003.101 010.165.001.013 017:01883:31000 0000000011 . . . . . .
O S1    172.020.001.027 128.001.006.201 017:00123:00123 0000000008 . . . . . .
O S2    128.001.005.019 192.168.010.026 006:02204:08080 0000000016 A . P . S .
O S1    192.168.010.026 128.001.005.019 006:08080:02204 0000000019 A . P . S .
O S3    172.020.009.024 128.001.045.224 006:00445:01429 0000000037 A F P . S .
O S3    172.020.002.024 128.001.045.092 006:00445:01115 0000001395 A . P . . .
O S1    172.020.002.040 128.001.004.211 006:01442:01136 0000000001 A . . . . .
O S1    172.020.002.103 128.001.005.041 006:00443:01284 0000000001 . . . R . .
O S1    172.020.002.103 128.001.005.041 006:00443:01292 0000000007 A F P . S .
O S3    172.020.002.040 128.001.045.152 006:01442:01212 0000000001 A . . . . .
O S1    172.026.021.033 128.001.005.055 006:08088:02114 0000000005 A F P . S .
O S1    172.020.002.040 128.001.005.168 006:01442:02022 0000000001 A . P . . .
O S2    128.001.005.019 050.016.235.173 006:02205:00843 0000000003 . . . . S .
O S1    050.016.235.173 128.001.005.019 006:00843:02205 0000000003 A . . R . .
O S1    172.026.021.099 128.001.004.080 006:08088:02176 0000000005 A F P . S .
O S2    128.001.005.019 050.016.235.173 006:02206:08890 0000000003 . . . . S .
O S1    050.016.235.173 128.001.005.019 006:08890:02206 0000000003 A . . R . .
O S1    172.026.021.099 128.001.004.080 006:08088:02177 0000000005 A F P . S .
O S1    172.017.010.107 172.020.001.015 017:00137:00137 0000000005 . . . . . .
O S1    172.020.008.068 172.020.001.027 017:00123:00123 0000000001 . . . . . .
O S1    172.026.021.033 128.001.005.055 006:08088:02112 0000000005 A F P . S .
O S3    172.020.003.011 128.001.046.021 006:00257:01090 0000000003 A . . . . .
O S1    172.026.002.104 128.001.004.047 006:01355:49321 0000000002 A . P . . .
O S2    172.020.004.049 065.055.184.155 006:03135:00443 0000000003 . . . . S .
O S1    172.020.003.011 128.001.006.201 006:03610:18192 0000000003 . . . . S .
O S1    172.020.002.013 128.001.007.088 006:00080:01299 0000000006 A F P . S .
O S2    128.001.005.019 192.168.010.026 006:02202:08080 0000000002 A . P . . .
O S1    192.168.010.026 128.001.005.019 006:08080:02202 0000000002 A . P . . .
O S1    172.025.002.006 172.020.001.015 017:00137:00137 0000000005 . . . . . .
O S1    172.020.002.040 128.001.004.047 006:01442:50967 0000000009 A . P . . .
O S1    172.026.021.033 128.001.005.055 006:08088:02116 0000000006 A F P . S .
O S1    172.020.002.013 128.001.007.088 006:00080:01300 0000000003 A . . R S .

slot  2
=======


D - Direction; L4 Info - Protocol:Source Port:Destination Port
IF - Interface: ()ethernet, (S)vi, (V)lan, (P)ortchannel, (T)unnel
TCP Flags: Ack, Flush, Push, Reset, Syn, Urgent

D IF    SrcAddr         DstAddr         L4 Info         PktCnt     TCP Flags
-+-----+---------------+---------------+---------------+----------+-----------
I S2    128.001.022.005 224.000.000.002 017:01985:01985 0000000067 . . . . . .
I S1    128.001.004.211 128.001.006.202 001:00000:00771 0000000014 . . . . . .
I S1    128.001.006.210 128.001.006.202 006:01477:00023 0000000080 A . P . . .
I S1    128.001.006.201 224.000.000.002 017:01985:01985 0000000067 . . . . . .
I S3    128.001.046.005 224.000.000.002 017:01985:01985 0000000067 . . . . . .
n7010-sw01#

Issue the clear hardware flow ip command to reset the counters.

n7010-sw01# clear hardware flow ip

slot  1
=======


slot  2
=======

n7010-sw01#

Just for the sake of completeness, below shows a sample output of the show ip cache flow command on a Cat6K.

Cat6K-MSFC#sh ip cache flow
IP packet size distribution (186066824 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .003 .279 .224 .083 .033 .050 .261 .024 .010 .002 .005 .001 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .000 .000 .007 .008 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4456704 bytes
  315 active, 65221 inactive, 44984247 added
  1066017127 ager polls, 0 flow alloc failures
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet       29844      0.0         1    48      0.0      10.0      15.2
TCP-FTP           7547      0.0         1    55      0.0       0.4      14.2
TCP-FTPD            80      0.0         1   894      0.0       5.5      13.2
TCP-WWW        2387684      0.5         1    88      0.9       3.0      13.8
TCP-SMTP         24604      0.0         1    72      0.0       1.3      15.2
TCP-X             4295      0.0         1    60      0.0       3.9      15.2
TCP-other     18312810      4.2         1   192      6.5       4.2      14.4
UDP-DNS         619797      0.1         8    66      1.2       6.9      15.3
UDP-NTP        3258897      0.7         1    76      0.7       0.0      15.4
UDP-TFTP         14604      0.0         1    48      0.0       0.0      15.4
UDP-Frag          5707      0.0         2    61      0.0      20.2      15.3
UDP-other     18851303      4.3         6   146     27.8       5.5      15.4
ICMP           1438190      0.3         2   114      0.7       6.4      15.4
IP-other         26231      0.0       852    56      5.2    1618.5       2.9
Total:        44981593     10.4         4   137     43.3       5.4      14.9

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Vl3           128.1.45.126    Vl22          172.20.2.11     06 0424 01BD     1
Vl1           128.1.5.68      Null          128.1.47.34     06 0D49 238C     3
Vl3           128.1.45.59     Vl17          172.17.1.35     06 065C 0402     1
Vl3           128.1.45.117    Vl17          172.26.21.139   06 0B58 1F90     1
Vl3           128.1.44.72     Vl17          172.26.2.100    06 0469 061B     1
Vl1           128.1.5.236     Vl1           172.20.1.29     06 0A58 238C     2
Vl1           128.1.5.236     Vl1           172.20.1.30     06 0A59 238C     1
Vl3           128.1.44.30     Vl17          172.30.8.44     06 06DD 0051     2
Vl3           128.1.44.233    Vl22          172.20.2.11     06 0F2D 01BD     1
Vl1           172.20.1.32     Vl3           128.1.45.20     06 05D6 0977     4
Vl3           128.1.44.27     Vl22          172.20.2.29     06 086E 06B1     1
Vl1           172.20.1.28     Vl28          172.20.8.18     06 09D0 086C     1
Vl3           128.1.46.21     Vl23          172.20.3.11     06 0935 0101     3
Vl3           128.1.45.59     Vl17          172.17.1.33     11 007B 007B     1
Vl1           128.1.3.155     Vl17          10.31.148.220   06 0D3D 0708     3
Vl3           128.1.47.68     Null          128.1.47.255    11 008A 008A     1
Vl3           128.1.47.30     Null          128.1.47.255    11 008A 008A     1
Vl3           188.87.5.10     Null          188.87.5.255    11 008A 008A     1
Vl1           128.1.2.2       Null          224.0.0.18      70 0000 0000  1479
Vl3           128.1.44.225    Null          128.1.47.255    11 008A 008A     1
Vl3           128.1.44.225    Null          128.1.47.255    11 0089 0089     1
Vl1           128.1.4.224     Null          128.1.7.255     11 0089 0089    14
--- output omitted ---

Viola and thanks for reading... ^_^

Nexus 7000 CMP TACACS+ Login Failure

Problem Symptom:
When AAA authentication through TACACS+ is enabled upon the remote access to the Nexus 7000 Control Processor (CP), login to the CMP (Connectivity Management Processor) via Telnet using a valid TACACS+ username and password failed with the error message "User not known to the underlying authentication module".
Cisco Bug ID: CSCte25626

C:\>telnet 192.168.1.1

Linux 2.6.10_mvl401-pc_targetpspos (n7k-core-sw01-cmp6) (0)

n7k-core-sw01-cmp6 login: user1
Password:

User not known to the underlying authentication module


Connection to host lost.

C:\>

Resolution:
Reboot the CMPs using the reload cmp module slot privileged command on the CP.

Continuous ping to the management IP addresses of the CMPs will timeout for a short period. After the management IP addresses start replying to ICMP Echo Requests, login to the CMP using a valid TACACS+ account is then successful.

Linux 2.6.10_mvl401-pc_targetpspos (n7k-core-sw01-cmp6) (0)

n7k-core-sw01-cmp6 login: user1
Password:
n7k-core-sw01-cmp6#
n7k-core-sw01-cmp6# sh version
CMP Software:
  CMP BIOS version:        02.01.05
  CMP Image version:       4.2(1) [build 4.2(1)]
  CMP BIOS compile time:   7/13/2008 19:44:27
  CMP Image compile time:  1/5/2010 1:00:00
n7k-core-sw01-cmp6#