Troubleshooting [Cisco Nexus 5000 Series Switches]

Contents
Troubleshooting
Recovering a Lost Password
Using the CLI with Network-Admin Privileges
Power Cycling the Switch
Using Ethanalyzer
fctrace
fcping
Verifying Switch Connectivity
show tech-support Command
show tech-support brief Command
show tech-support fc Command
show tech-support platform Command
Default Settings for Troubleshooting Features
Troubleshooting
Troubleshooting
Recovering a Lost Password

This section describes how to recover a lost network administrator password using the console port of the switch.

You can recover the network administrator password using one of two methods:

From the CLI with a username that has network-admin privileges

By power cycling the switch

Using the CLI with Network-Admin Privileges

Power Cycling the Switch
Using the CLI with Network-Admin Privileges
If you are logged in to, or can log into, the switch with a username that has network-admin privileges, follow these steps:

Procedure
Step 1
Verify that your username has network-admin privileges.

Example:
switch# show user-account
user:admin
        this user account has no expiry date
        roles:network-admin
            
            
               user:dbgusr

            
            
                       this user account has no expiry date

            
            
                       roles:network-admin network-operator

            
         
Step 2
Assign a new network administrator password if your username has network-admin privileges.

Example:
switch# configure terminal
switch(config)# username admin password <new password>
switch(config)# exit
Step 3
Save the configuration.

Example:
switch# copy running-config startup-config
Power Cycling the Switch
If you cannot start a session on the switch that has network-admin privileges, you must recover the network administrator password by power cycling the switch.

Caution

This procedure disrupts all traffic on the switch.

Note

You cannot recover the administrator password from a Telnet or SSH session. You must have access to the local console connection.

To recover the network administrator password by power cycling the switch, follow these steps:

Establish a terminal session on the console port of the supervisor module.

Procedure
Step 1 Power cycle the switch.
Step 2
Press the Ctrl-] key sequence from the console port session when the switch begins the Cisco NX-OS software boot sequence to enter the boot prompt mode.
Note
In releases of Cisco NX-OS prior to 4.0(1a) the key sequence to enter the boot prompt mode was Ctrl-Shift-B.

Example:
Ctrl-]
switch(boot)#
Step 3
Reset the network administrator password.

Example:
switch(boot)# configure terminal
switch(boot-config)# admin-password <new password>
switch(boot-config)# exit
Step 4
Display the bootflash: contents to locate the Cisco NX-OS software image file.

Example:
switch(boot)# dir bootflash:
Step 5
Load the Cisco NX-OS system software image.

Example:
In the following example, the system image filename is nx-os.bin:
switch(boot) # load bootflash:nx-os.bin
Step 6
Log in to the switch using the new administrator password.

Example:
switch login: admin
Password: <new password>
Step 7
Reset the new password to ensure that is it is also the SNMP password.

Example:
switch# configure terminal
switch(config)# username admin password <new password>
switch(config)# exit
Step 8
Save the configuration.

Example:
switch# copy running-config startup-config
Using Ethanalyzer
Ethanalyzer is a Cisco NX-OS protocol analyzer tool based on the Wireshark (formerly Ethereal) open source code. Ethanalyzer is a command-line version of Wireshark that captures and decodes packets. You can use Ethanalyzer to troubleshoot your network and analyze the control-plane traffic.

To configure Ethanalyzer, use one or more of the following commands:

Procedure
Command or Action Purpose

Step 1 switch# ethanalyzer local interface interface

Captures packets sent or received by the supervisor and provides detailed protocol information.

Note
For all commands in this table, interface is inbound-hi (Inbound high-priority interface), inbound-low (Inbound low-priority interface), or mgmt (management interface).

Step 2 switch# ethanalyzer local interface interface brief

Captures packets sent or received by the supervisor and provides a summary of protocol information.

Step 3 switch# ethanalyzer local interface interface limit-captured-frames

Limits the number of frames to capture.

Step 4 switch# ethanalyzer local interface interface limit-frame-size

Limits the length of the frame to capture.

Step 5 switch# ethanalyzer local interface interface capture-filter

Filters the types of packets to capture.

Step 6 switch# ethanalyzer local interface interface display-filter

Filters the types of captured packets to display.

Step 7 switch# ethanalyzer local interface interface write

Saves the captured data to a file.

Step 8 switch# ethanalyzer local read file

Opens a captured data file and analyzes it.
Ethanalyzer does not capture data traffic that Cisco NX-OS forwards in the hardware.

Ethanalyzer uses the same capture filter syntax as tcpdump. For more information, see the following URL: http://www.tcpdump.org/tcpdump_man.html

For information on the syntax of the display filter, see the following URL: http://wiki.wireshark.org/DisplayFilters

This example shows captured data (limited to four packets) on the management interface:
switch# ethanalyzer local interface mgmt brief limit-captured-frames 4
Capturing on eth0
2005-01-25 07:18:08.997132 10.193.24.42 -> 10.200.0.103 TELNET Telnet Data ...
2005-01-25 07:18:09.166266 10.200.0.103 -> 10.193.24.42 TCP 1235 > telnet [ACK] Seq=0 Ack=19 Win=64129 Len=0
2005-01-25 07:18:09.166830 10.193.24.42 -> 10.200.0.103 TELNET Telnet Data ...
2005-01-25 07:18:09.376250 10.200.0.103 -> 10.193.24.42 TCP 1235 > telnet [ACK] Seq=0 Ack=99 Win=64049 Len=0
4 packets captured
This example shows detailed captured data for one HSRP packet:
switch(config)# ethanalyzer local interface mgmt capture-filter "tcp port 23" limit-captured-frames 1
Capturing on eth0
Frame 1 (60 bytes on wire, 60 bytes captured)
    Arrival Time: Jan 25, 2005 08:49:49.250719000
    [Time delta from previous captured frame: 1106642989.250719000 seconds]
    [Time delta from previous displayed frame: 1106642989.250719000 seconds]
    [Time since reference or first frame: 1106642989.250719000 seconds]
    Frame Number: 1
    Frame Length: 60 bytes
    Capture Length: 60 bytes
    [Frame is marked: False]
    [Protocols in frame: eth:ip:tcp]
Ethernet II, Src: 00:1a:a2:d2:d7:00 (00:1a:a2:d2:d7:00), Dst: 00:0d:ec:6d:81:00 (00:0d:ec:6d:81:00)
    Destination: 00:0d:ec:6d:81:00 (00:0d:ec:6d:81:00)
        Address: 00:0d:ec:6d:81:00 (00:0d:ec:6d:81:00)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: 00:1a:a2:d2:d7:00 (00:1a:a2:d2:d7:00)
        Address: 00:1a:a2:d2:d7:00 (00:1a:a2:d2:d7:00)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol, Src: 10.200.0.103 (10.200.0.103), Dst: 10.193.24.42 (10.193.24.42)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 40
    Identification: 0xa651 (42577)
    Flags: 0x04 (Don't Fragment)
        0... = Reserved bit: Not set
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 127
    Protocol: TCP (0x06)
    Header checksum: 0x2765 [correct]
        [Good: True]
        [Bad : False]
    Source: 10.200.0.103 (10.200.0.103)
    Destination: 10.193.24.42 (10.193.24.42)
Transmission Control Protocol, Src Port: 1288 (1288), Dst Port: telnet (23), Seq: 0, Ack: 0, Len: 0
    Source port: 1288 (1288)
    Destination port: telnet (23)
    Sequence number: 0    (relative sequence number)
    Acknowledgement number: 0    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
        0... .... = Congestion Window Reduced (CWR): Not set
        .0.. .... = ECN-Echo: Not set
        ..0. .... = Urgent: Not set
        ...1 .... = Acknowledgment: Set
        .... 0... = Push: Not set
        .... .0.. = Reset: Not set
        .... ..0. = Syn: Not set
        .... ...0 = Fin: Not set
    Window size: 64334
    Checksum: 0x934f [correct]
        [Good Checksum: True]
        [Bad Checksum: False]
 
1 packets captured
For more information on Wireshark, see the following URL: http://www.wireshark.org/docs/.
Troubleshooting Fibre Channel
fctrace

The fctrace feature provides the following capabilities:

Trace the route followed by data traffic.

Compute inter-switch (hop-to-hop) latency.

You can invoke fctrace by providing the FC ID, the N port WWN, or the device alias of the destination.

The trace frame is routed normally through the network until it reaches the far edge of the fabric. When the frame reaches the edge of the fabric (the F port connected to the end node with the given port WWN or the FC ID), the frame is looped back (swapping the source ID and the destination ID) to the originator.

If the destination cannot be reached, the path discovery starts, which traces the path up to the point of failure.

Note

The fctrace feature works only on TE ports. Make sure that only TE ports exist in the path to the destination. If there is an E port in the path, the fctrace frame is dropped by that switch. Also, fctrace times out in the originator, and path discovery does not start.

To perform the fctrace operation, perform this task:

Procedure
switch# fctrace {device-alias aliasname | fcid fcid} vsan vsan-id [timeout seconds]

The device-alias option specifies the device alias name. The fcid specifies the FCID of the destination N port, with the format 0xhhhhhh. The pwwn specifies the PWWN of the destination N port, with the format hh:hh:hh:hh:hh:hh:hh:hh. The vsan option specifies a VSAN ID.

Note
By default the period to wait before a time out is 5 seconds and the range is from one through 10 seconds.

Parameters	Default
Timeout period to invoke fctrace	5 seconds
Number of frame sent by the fcping feature	5 frames
Remote capture connection protocol	TCP
Remote capture connection mode	Passive
Local capture frame limits	10 frames
FC ID allocation mode	Auto mode