These are if statements one compares to DPN_2, other to DPN_ERROR, I made both values 02 so when part number check returns DPN_ERROR in fact it returns 2 = 2 PSUs.
Beware of EMC switches sold as Mellanox SX6XXX on eBay
- Thread starter mpogr
- Start date
Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.
All the files modded are for 8012 version:
hwd - patched 1PSU Dingo error via mapping DPN_ERROR to 2 = 2 PSU in function adjust_pses_number_according_to_machine. For genuine part numbers it will have no effect, for converted ensure you use it on a unit with 2 PSUs, cannot tell what happens when you force 2 PSU on 1 PSU unit.
Addresses error: [hwd.WARNING]: adjust_pses_number_according_to_machine: P/N:[(null)] for Dingo is unknown
Other than error message itself impact of this remains unknown. Even with the error green leds on both PSUs are On and System led is green.
rh - patched via *is_vpi_enableda = true; in function util_ui_api_is_ib_eth_vpi_enabled, should match profile = 3 which is enforced during re-manufacturing process.
Addresses error: [web.WARNING]: util_ui_api_is_ib_eth_vpi_enabled: HW supports: IB ETH VPI profiles, but they are not enabled by HW VPD or license.
This error occurs only when one logs in via web GUI so you may want patch it or not.
tc - 1B replaced with 1D and fan speed increment 0A with 05, fan speed is at 5340.0 RPM. I did see fans ramping-up & down on few occasions which was annoying and it appeared to be happening when temp was below? certain threshold. This one is still work in progress as fan logic is complex and unit measures various deviations incl. ambient temp.
Log level = Notice and no errors:
Jan 27 01:54:59 SX6012 mgmtd[4248]: [mgmtd.NOTICE]: User admin (local user admin) authentication method: local
Jan 27 01:57:44 SX6012 rh[7443]: [web.NOTICE]: setting existing tstring [mgmt0] to null
Jan 27 01:57:44 SX6012 rh[7443]: [web.NOTICE]: setting existing tstring [static] to null
Jan 27 06:33:29 SX6012 kernel: hrtimer: interrupt took 37864 ns
Jan 27 09:32:48 SX6012 wsmd[4865]: [wsmd.NOTICE]: User admin (System Administrator) logged into Web UI from 192.168.6.42
Jan 27 09:32:49 SX6012 mgmtd[4248]: [mgmtd.NOTICE]: User admin (local user admin) authentication method: local
hwd,rh,tc
hwd - patched 1PSU Dingo error via mapping DPN_ERROR to 2 = 2 PSU in function adjust_pses_number_according_to_machine. For genuine part numbers it will have no effect, for converted ensure you use it on a unit with 2 PSUs, cannot tell what happens when you force 2 PSU on 1 PSU unit.
Addresses error: [hwd.WARNING]: adjust_pses_number_according_to_machine: P/N:[(null)] for Dingo is unknown
Other than error message itself impact of this remains unknown. Even with the error green leds on both PSUs are On and System led is green.
rh - patched via *is_vpi_enableda = true; in function util_ui_api_is_ib_eth_vpi_enabled, should match profile = 3 which is enforced during re-manufacturing process.
Addresses error: [web.WARNING]: util_ui_api_is_ib_eth_vpi_enabled: HW supports: IB ETH VPI profiles, but they are not enabled by HW VPD or license.
This error occurs only when one logs in via web GUI so you may want patch it or not.
tc - 1B replaced with 1D and fan speed increment 0A with 05, fan speed is at 5340.0 RPM. I did see fans ramping-up & down on few occasions which was annoying and it appeared to be happening when temp was below? certain threshold. This one is still work in progress as fan logic is complex and unit measures various deviations incl. ambient temp.
Log level = Notice and no errors:
Jan 27 01:54:59 SX6012 mgmtd[4248]: [mgmtd.NOTICE]: User admin (local user admin) authentication method: local
Jan 27 01:57:44 SX6012 rh[7443]: [web.NOTICE]: setting existing tstring [mgmt0] to null
Jan 27 01:57:44 SX6012 rh[7443]: [web.NOTICE]: setting existing tstring [static] to null
Jan 27 06:33:29 SX6012 kernel: hrtimer: interrupt took 37864 ns
Jan 27 09:32:48 SX6012 wsmd[4865]: [wsmd.NOTICE]: User admin (System Administrator) logged into Web UI from 192.168.6.42
Jan 27 09:32:49 SX6012 mgmtd[4248]: [mgmtd.NOTICE]: User admin (local user admin) authentication method: local
hwd,rh,tc
Last edited:
I have 4 ibm branded 3m qsfp14 dac cables and they worked at 56GBE without special configuration (on a 6036). IBM part number: "00W0059" and on the mellanox label "00W0057"
Good to see it is working for you with IBM branded one but the part number is different to the ones I got. 4 different IBM cables I have do not work:
2x45W9390
2x45W9379
Having tested each of them makes me convinced it is not an issue with the cable but the models.
I bought from different sources so that's not isolated observation and while advertised like that: MLX ,I got IBM 45W9379 & 45W9390. If that would be advertised like random - fine, but I got neither what is on the pictures, nor the P/N listed and not the right description for it. Upon contacting, the seller said - we send randomly.
So I suggest to check what they are going to send, it may work or maybe won't. You don't expect to pay for maybe when specifically buying a 56Gb/s one, that's my point.
Out of 6 I own of 1m & 2m, only 2 with generic mellanox part numbers work at 56Gb/s.
2x45W9390
2x45W9379
Having tested each of them makes me convinced it is not an issue with the cable but the models.
I bought from different sources so that's not isolated observation and while advertised like that: MLX ,I got IBM 45W9379 & 45W9390. If that would be advertised like random - fine, but I got neither what is on the pictures, nor the P/N listed and not the right description for it. Upon contacting, the seller said - we send randomly.
So I suggest to check what they are going to send, it may work or maybe won't. You don't expect to pay for maybe when specifically buying a 56Gb/s one, that's my point.
Out of 6 I own of 1m & 2m, only 2 with generic mellanox part numbers work at 56Gb/s.
Could anyone check if their SX6012 in VPI mode on 3.6.8012 allows working with ACLs?? I can add them in GUI but unable to change binding to rif needed for vlan filtering.
Also surprised when via CLI I cannot do anything...
SX6012 [standalone: master] (config) # ipv4 access-list TCPportsACL
% Unrecognized command "ipv4".
Type "?" for help.
SX6012 [standalone: master] (config) # show ipv4 access-lists
% Unrecognized command "ipv4".
Type "show ?" for help.
ip filtering works fine.
Also surprised when via CLI I cannot do anything...
SX6012 [standalone: master] (config) # ipv4 access-list TCPportsACL
% Unrecognized command "ipv4".
Type "?" for help.
SX6012 [standalone: master] (config) # show ipv4 access-lists
% Unrecognized command "ipv4".
Type "show ?" for help.
ip filtering works fine.
I see, whereas vlan configuration over web is doable, acl configuration is hardly implemented. 8012 should support rif allowing to bind an acl to vlan interface but web GUI does not give this option. It does not give an option to bind to a specific interface either.
It seems it has to do with the way how certain things are done and without a license eth-single-switch profile cannot be enabled.
% new profile can't be changed to ETH as it is not enabled by license
So, do we have an alternative? If part of commands work via web (which implements its own cli interface btw), but not via cli, this must be cli or cli*so restriction. Let's write to config db directly.
[from cli ipv4 access-list if50] via mreq:
mdreq action /acld/actions/acl_create_table acl_name string "if50" switch_id string "ethernet-default" type string "ipv4"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: requested by: user admin (System Administrator) via Mdreq
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: descr: Create an access list table
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: param: The name of the access-list to create: "if50"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: param: SWITCH ID: "ethernet-default"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: param: Access-list type: "ipv4"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Config change ID 52: item 3: if50 access-list: ACL bind point initially set to "port"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Config change ID 52: item 4: if50 access-list: ACL type initially set to "ipv4"
New access list appears in the config. Now port is L2, we want L3 and that's what manual calls rif: Changes the ACL table bind point from L2 port mode to L3 port.
[from cli ipv4 access-list if50 bind-point rif]
mdreq -vv set modify - /acld/config/switch/ethernet-default/acls/if50/bind_point string "rif"
Jan 29 21:21:08 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Config change ID 53: item 1: if50 access-list: ACL bind point changed from "port" to "rif"
Access list properties reflect in the config. I was grabbing my bottle of beer to...
[from cli config interface vlan50 ipv4 port access-group if50]
mdreq action /acld/actions/acl_bind acl_name string "if50" switch_id string "ethernet-default" type string "ipv4" ifindex string "51050"
Return code: 14002
Return message: Access-list [if50] doesn't match binding point.
...to fail. While rif is the type of acl to be used with vlans it refuses to bind to a vlan interface. Hmm.
It seems it has to do with the way how certain things are done and without a license eth-single-switch profile cannot be enabled.
% new profile can't be changed to ETH as it is not enabled by license
So, do we have an alternative? If part of commands work via web (which implements its own cli interface btw), but not via cli, this must be cli or cli*so restriction. Let's write to config db directly.
[from cli ipv4 access-list if50] via mreq:
mdreq action /acld/actions/acl_create_table acl_name string "if50" switch_id string "ethernet-default" type string "ipv4"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: requested by: user admin (System Administrator) via Mdreq
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: descr: Create an access list table
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: param: The name of the access-list to create: "if50"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: param: SWITCH ID: "ethernet-default"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Action ID 158: param: Access-list type: "ipv4"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Config change ID 52: item 3: if50 access-list: ACL bind point initially set to "port"
Jan 29 21:20:58 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Config change ID 52: item 4: if50 access-list: ACL type initially set to "ipv4"
New access list appears in the config. Now port is L2, we want L3 and that's what manual calls rif: Changes the ACL table bind point from L2 port mode to L3 port.
[from cli ipv4 access-list if50 bind-point rif]
mdreq -vv set modify - /acld/config/switch/ethernet-default/acls/if50/bind_point string "rif"
Jan 29 21:21:08 SX6012 mgmtd[4251]: [mgmtd.NOTICE]: Config change ID 53: item 1: if50 access-list: ACL bind point changed from "port" to "rif"
Access list properties reflect in the config. I was grabbing my bottle of beer to...
[from cli config interface vlan50 ipv4 port access-group if50]
mdreq action /acld/actions/acl_bind acl_name string "if50" switch_id string "ethernet-default" type string "ipv4" ifindex string "51050"
Return code: 14002
Return message: Access-list [if50] doesn't match binding point.
...to fail. While rif is the type of acl to be used with vlans it refuses to bind to a vlan interface. Hmm.
Last edited:
Of course, without L3 I would not have vlan interfaces 50 & 80 (which are L3) represented as ifindex 5x50 & 5x80.
Vlans, vlan interfaces and inter-vlan routing works fine but I don't see a point of L3 capabilities like routing without acls TBH.
Older SW version does not support acls on vlans (<3.6.5000) and newer has some flaws, for now I am not sure what's next.
Vlans, vlan interfaces and inter-vlan routing works fine but I don't see a point of L3 capabilities like routing without acls TBH.
Older SW version does not support acls on vlans (<3.6.5000) and newer has some flaws, for now I am not sure what's next.
Hello All,
I have a technical question about changing the fan direction and air flow on the Mellanox SX series switches. Can you just remove and flip around all the fans to change from optics connector in (-BRS & P2C) to optics connector out (-SFS, -SRS, & C2P) type air flow? ...Looks like it is possible, but I wanted to see if anyone has actual experience before I potentially let any smoke out
.
I assume 'optics connector in' means same as C2P, front to back, or optics to power plug flow, right?
e.g. Mellanox manual says "P2C airflow is connector side outlet, C2P airflow in connector side inlet."
...I would like to put all the optics ports to back of my rack, for cleaner cabling. I understand it will be harder to see port leds on back, but really want shorter cabling.
Best Regards,
ABQ
I have a technical question about changing the fan direction and air flow on the Mellanox SX series switches. Can you just remove and flip around all the fans to change from optics connector in (-BRS & P2C) to optics connector out (-SFS, -SRS, & C2P) type air flow? ...Looks like it is possible, but I wanted to see if anyone has actual experience before I potentially let any smoke out
.I assume 'optics connector in' means same as C2P, front to back, or optics to power plug flow, right?
e.g. Mellanox manual says "P2C airflow is connector side outlet, C2P airflow in connector side inlet."
...I would like to put all the optics ports to back of my rack, for cleaner cabling. I understand it will be harder to see port leds on back, but really want shorter cabling
.Best Regards,
ABQ
Are there any Versions >3.6.5000 which have been confirmed to support ACLs for inter-vlan-routing?
This might be a stupid reply, but have to tried with a license for ethernet? Either generate one or try the license in this sales post, as the license there is a generic one for ethernet and not bound to specific hardware:
With license enabled switch started showing some capabilities in show system capabilities and CLI got new options to work with vlans & ipv4 access-lists! So that's positive.
Yet it appears our SX6012 hardware does not support ACLs on VLANs regardless of the license. I guess someone with non-converted device will have to chip in and either confirm or deny that statement. I get exactly the same result as when talking to the config db directly.
Via CLI:
Access list is created, let's add it to VLAN interface:
SX6012 [standalone: master] (config interface vlan 50) # ipv4 port access-group if50
% Access-list [if50] doesn't match binding point.
Okay, so let's change the binding type as per the manual:
SX6012 [standalone: master] (config ipv4 access-list if50) # bind-point rif
% Unrecognized command "bind-point".
Type "?" for help.
I changed binding type to rif via mdreq, logged in via cli, wr me & reboot. This time I was able to bind to a vlan interface!
##
## ACL configuration
##
ipv4 access-list if50
ipv4 access-list if50 bind-point rif
ipv4 access-list if80
SX6012 [standalone: master] (config interface vlan 50) # ipv4 port access-group if50
SX6012 [standalone: master] (config interface vlan 50) #
No errors.
SX6012 [standalone: master] (config) # show ipv4 access-lists summary
----------------------------------------------------------------------------------------
Table type Table Name Bind Point Total entries Bound to interfaces
----------------------------------------------------------------------------------------
ipv4 if50 rif 0 Vlan50
SX6012 [standalone: master] (config) # show access-lists
Table Type: ipv4
Table Name: if50
Bind-point: rif
----------------------------------------------------------------------------------------------------
seq-number p/d protocol s-ipv4 d-ipv4 sport/type dport/code action
----------------------------------------------------------------------------------------------------
1 deny icmp any any any any none
But don't hold your breathe, while everything seems connected it does not filter anything with the rule on...
64 bytes from 192.168.50.25: icmp_seq=142 ttl=63 time=0.543 ms
64 bytes from 192.168.50.25: icmp_seq=143 ttl=63 time=0.443 ms
64 bytes from 192.168.50.25: icmp_seq=144 ttl=63 time=0.491 ms
Logs show that rule with bind-point set to rif is not properly recognized by acld.
Jan 31 11:43:29 SX6012 acld[5055]: TID 1222894736: [acld.ERR]: acl_hal_wq_create_table(), acl_stack/hal/acl_hal.c:2217, build 1: create table if50: failed to create table in ACL RM using sx_acl_rm_api_acl_set API [1]
Not sure what next action could be... write on mellanox forum to get formal feedback on ACL support with VLANs on SX1012/SX6012? I have no account to do that.
--- hate to report, even with the profile changed to eth-single-switch to avoid any cross-talk with vpi/ib, same result:
SX6012 [standalone: master] (config ipv4 access-list if50) # bind-point rif
% Unrecognized command "bind-point".
Type "?" for help.
Yet it appears our SX6012 hardware does not support ACLs on VLANs regardless of the license. I guess someone with non-converted device will have to chip in and either confirm or deny that statement. I get exactly the same result as when talking to the config db directly.
Via CLI:
Access list is created, let's add it to VLAN interface:
SX6012 [standalone: master] (config interface vlan 50) # ipv4 port access-group if50
% Access-list [if50] doesn't match binding point.
Okay, so let's change the binding type as per the manual:
SX6012 [standalone: master] (config ipv4 access-list if50) # bind-point rif
% Unrecognized command "bind-point".
Type "?" for help.
I changed binding type to rif via mdreq, logged in via cli, wr me & reboot. This time I was able to bind to a vlan interface!
##
## ACL configuration
##
ipv4 access-list if50
ipv4 access-list if50 bind-point rif
ipv4 access-list if80
SX6012 [standalone: master] (config interface vlan 50) # ipv4 port access-group if50
SX6012 [standalone: master] (config interface vlan 50) #
No errors.
SX6012 [standalone: master] (config) # show ipv4 access-lists summary
----------------------------------------------------------------------------------------
Table type Table Name Bind Point Total entries Bound to interfaces
----------------------------------------------------------------------------------------
ipv4 if50 rif 0 Vlan50
SX6012 [standalone: master] (config) # show access-lists
Table Type: ipv4
Table Name: if50
Bind-point: rif
----------------------------------------------------------------------------------------------------
seq-number p/d protocol s-ipv4 d-ipv4 sport/type dport/code action
----------------------------------------------------------------------------------------------------
1 deny icmp any any any any none
But don't hold your breathe, while everything seems connected it does not filter anything with the rule on...
64 bytes from 192.168.50.25: icmp_seq=142 ttl=63 time=0.543 ms
64 bytes from 192.168.50.25: icmp_seq=143 ttl=63 time=0.443 ms
64 bytes from 192.168.50.25: icmp_seq=144 ttl=63 time=0.491 ms
Logs show that rule with bind-point set to rif is not properly recognized by acld.
Jan 31 11:43:29 SX6012 acld[5055]: TID 1222894736: [acld.ERR]: acl_hal_wq_create_table(), acl_stack/hal/acl_hal.c:2217, build 1: create table if50: failed to create table in ACL RM using sx_acl_rm_api_acl_set API [1]
Not sure what next action could be... write on mellanox forum to get formal feedback on ACL support with VLANs on SX1012/SX6012? I have no account to do that.
--- hate to report, even with the profile changed to eth-single-switch to avoid any cross-talk with vpi/ib, same result:
SX6012 [standalone: master] (config ipv4 access-list if50) # bind-point rif
% Unrecognized command "bind-point".
Type "?" for help.
Last edited:
I did it the other way around to look at my leds
For SX6012 is as simple as reversing 4 fans on the back. All 4 fans are mounted on a metal frame you remove with 7 screws and need to cut few zip ties, no black magic and plain screwdriver job. Other larger SX (i.e 6036) units have modular fans where this may or may not be true.
Do your cable management right as these little suckers spin fast and generate a lot of air movement.
I have found the right function/action to trigger an active change of access-list parameters without wr me & reboot, which corresponds to cli menu ipv4 access-list if50 bind-point rif.
mdreq action /acld/actions/acl_set_table_attr acl_name string "if50" switch_id string "ethernet-default" bind_point string "rif"
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: requested by: user admin (System Administrator) via Mdreq
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: descr: Set or unset attributes of an access list
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: param: The name of the access-list: "if50"
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: param: SWITCH ID: "ethernet-default"
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: param: Bind point (RIF/port): "rif"
rif and bind-point are recognized as valid parameter & value.
Feb 2 10:54:20 SX6012 acld[4964]: TID 1208143184: [acld.NOTICE]: handling action '/acld/actions/acl_set_table_attr' msg_id '431907'
Feb 2 10:54:20 SX6012 acld[4964]: TID 1208143184: [acld.NOTICE]: dispatching action '/acld/actions/acl_set_table_attr' msg_id[431907]
Feb 2 10:54:20 SX6012 acld[4964]: TID 1208143184: [acld.NOTICE]: sending action response for action msg_id '431907'
Feb 2 10:54:20 SX6012 acld[4964]: TID 1208143184: [acld.NOTICE]: sending config set request for action msg_id '431907'
Feb 2 10:54:20 SX6012 aclrmd[4916]: TID 1229051024: [aclrmd.NOTICE]: ACL RM LOG MESSAGE: [SX_ACL_RM ][Removed acl id:2 from acl_id_2_acl_info hash table. ]
Feb 2 10:54:20 SX6012 aclrmd[4916]: TID 1229051024: [aclrmd.NOTICE]: ACL RM LOG MESSAGE: [SX_ACL_RM ][Destroy ACL in SDK , type: [0] , direction: [0] , region : [131077] , acl id: [2]. ]
Feb 2 10:54:20 SX6012 sdkd[4972]: TID 1234150544: [sdkd.ERR]: SDK LOG MESSAGE: [ACL ][ACL : Failed to allocate ACL id ]
Feb 2 10:54:20 SX6012 aclrmd[4916]: TID 1229051024: [aclrmd.ERR]: ACL RM LOG MESSAGE: [SX_ACL_RM ][SX_ACL_RM ERROR error;=1, error message:=Failed to create ACL in SDK (error: 14) , type: [0] , direction: [2] , regions : [131077] ]
Feb 2 10:54:20 SX6012 aclrmd[4916]: TID 1229051024: [aclrmd.ERR]: ACL RM LOG MESSAGE: [SX_ACL_RM ][SX_ACL_RM_ERROR, error: 1, SX_ACL_RM_STATUS_ERROR ]
Feb 2 10:54:20 SX6012 acld[4964]: TID 1222894736: [acld.ERR]: [SX_ACL_RM_API] SX_ACL_RM_ERROR, error: 1, SX_ACL_RM_STATUS_ERROR
Feb 2 10:54:20 SX6012 acld[4964]: TID 1222894736: [acld.ERR]: acl_hal_wq_set_table_attr(), acl_stack/hal/acl_hal.c:2649, build 1: set table if50 attributes: failed to set table attributes in ACL RM using sx_acl_rm_api_acl_set API [1]
Feb 2 10:54:20 SX6012 acld[4964]: TID 1222894736: [acld.ERR]: acl_hal_wq_process(), acl_stack/hal/acl_hal.c:3609, build 1: ACL HAL WQ process failed: acl_hal_wq_set_table_attr failed [14000]
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: status: completed with success
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Config change ID 20: requested by: (system), 1 item(s) changed
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Config change ID 20: item 1: rif access-list: ACL bind point changed from "port" to "rif"
While the bind point is updated SX (presumably hardware) reports an error loading this ACL into active hal table, that's why even when in the config now, it has no action.
My bet, not supported in hardware of SX6012.
Wondering would it be different with SX6036? I don't see why would with the same SwitchX-2 chip but curious if someone with SX6036 could try create new acl and do bind-point rif.
mdreq action /acld/actions/acl_set_table_attr acl_name string "if50" switch_id string "ethernet-default" bind_point string "rif"
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: requested by: user admin (System Administrator) via Mdreq
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: descr: Set or unset attributes of an access list
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: param: The name of the access-list: "if50"
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: param: SWITCH ID: "ethernet-default"
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: param: Bind point (RIF/port): "rif"
rif and bind-point are recognized as valid parameter & value.
Feb 2 10:54:20 SX6012 acld[4964]: TID 1208143184: [acld.NOTICE]: handling action '/acld/actions/acl_set_table_attr' msg_id '431907'
Feb 2 10:54:20 SX6012 acld[4964]: TID 1208143184: [acld.NOTICE]: dispatching action '/acld/actions/acl_set_table_attr' msg_id[431907]
Feb 2 10:54:20 SX6012 acld[4964]: TID 1208143184: [acld.NOTICE]: sending action response for action msg_id '431907'
Feb 2 10:54:20 SX6012 acld[4964]: TID 1208143184: [acld.NOTICE]: sending config set request for action msg_id '431907'
Feb 2 10:54:20 SX6012 aclrmd[4916]: TID 1229051024: [aclrmd.NOTICE]: ACL RM LOG MESSAGE: [SX_ACL_RM ][Removed acl id:2 from acl_id_2_acl_info hash table. ]
Feb 2 10:54:20 SX6012 aclrmd[4916]: TID 1229051024: [aclrmd.NOTICE]: ACL RM LOG MESSAGE: [SX_ACL_RM ][Destroy ACL in SDK , type: [0] , direction: [0] , region : [131077] , acl id: [2]. ]
Feb 2 10:54:20 SX6012 sdkd[4972]: TID 1234150544: [sdkd.ERR]: SDK LOG MESSAGE: [ACL ][ACL : Failed to allocate ACL id ]
Feb 2 10:54:20 SX6012 aclrmd[4916]: TID 1229051024: [aclrmd.ERR]: ACL RM LOG MESSAGE: [SX_ACL_RM ][SX_ACL_RM ERROR error;=1, error message:=Failed to create ACL in SDK (error: 14) , type: [0] , direction: [2] , regions : [131077] ]
Feb 2 10:54:20 SX6012 aclrmd[4916]: TID 1229051024: [aclrmd.ERR]: ACL RM LOG MESSAGE: [SX_ACL_RM ][SX_ACL_RM_ERROR, error: 1, SX_ACL_RM_STATUS_ERROR ]
Feb 2 10:54:20 SX6012 acld[4964]: TID 1222894736: [acld.ERR]: [SX_ACL_RM_API] SX_ACL_RM_ERROR, error: 1, SX_ACL_RM_STATUS_ERROR
Feb 2 10:54:20 SX6012 acld[4964]: TID 1222894736: [acld.ERR]: acl_hal_wq_set_table_attr(), acl_stack/hal/acl_hal.c:2649, build 1: set table if50 attributes: failed to set table attributes in ACL RM using sx_acl_rm_api_acl_set API [1]
Feb 2 10:54:20 SX6012 acld[4964]: TID 1222894736: [acld.ERR]: acl_hal_wq_process(), acl_stack/hal/acl_hal.c:3609, build 1: ACL HAL WQ process failed: acl_hal_wq_set_table_attr failed [14000]
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Action ID 78: status: completed with success
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Config change ID 20: requested by: (system), 1 item(s) changed
Feb 2 10:54:20 SX6012 mgmtd[4223]: [mgmtd.NOTICE]: Config change ID 20: item 1: rif access-list: ACL bind point changed from "port" to "rif"
While the bind point is updated SX (presumably hardware) reports an error loading this ACL into active hal table, that's why even when in the config now, it has no action.
My bet, not supported in hardware of SX6012.
Wondering would it be different with SX6036? I don't see why would with the same SwitchX-2 chip but curious if someone with SX6036 could try create new acl and do bind-point rif.
On my SX6036, "mac access-list testacl bind-point rif" gives 'Unrecognized command "bind-point"'. Same goes for "ipv4 access-list testacl bind-point rif".
Running firmware 3.6.8012 and profile eth-single-switch.
Anything else you would like me to try?
There are options in the CLI or also the Web GUI to disable requiring a valid signature for the image that is installed. Could I just change an image to contain the commands to slow down the fans in rc.local as described and install that image via CLI or Web GUI? Or are there any pitfalls?
Moreover, I found a graphic that details the required amount of air in m3 for a given number of Watts and a given difference between the ambient temperature and the maximal temperature. It shows that the Noctua fans should be OK. For example, if ambient is 40°C and the max temp should be below 70°, that give a difference of 30°C. With a maximum of 200Watt, 20m3 per hour should therefore suffice. If the 200W are fed by one psu and it has an efficiency of 80%, the heat generated in the PSU is 40 Watt and, thus, safe for one fan. The other 160 Watt are then generated inside the switch. Here two fans should be OK as the noctua fans are 9,2m3 per hour. What do you think?
Moreover, I found a graphic that details the required amount of air in m3 for a given number of Watts and a given difference between the ambient temperature and the maximal temperature. It shows that the Noctua fans should be OK. For example, if ambient is 40°C and the max temp should be below 70°, that give a difference of 30°C. With a maximum of 200Watt, 20m3 per hour should therefore suffice. If the 200W are fed by one psu and it has an efficiency of 80%, the heat generated in the PSU is 40 Watt and, thus, safe for one fan. The other 160 Watt are then generated inside the switch. Here two fans should be OK as the noctua fans are 9,2m3 per hour. What do you think?
Attachments
Last edited:
Moreover, there seems to be a hidden command "_shell". However, it asks for a special license key that I do not know.
In the manual a license LK2_RESTRICTED_CMDS-... is mentioned. The key shown there is valid, but the switch say "unknown feature".
In the manual a license LK2_RESTRICTED_CMDS-... is mentioned. The key shown there is valid, but the switch say "unknown feature".
Last edited:
Hello all,
Thank you for the guides and effort you guys did with the conversation guide.
I did converted 2 sx6012 to MLNX, but I have an issue where I am unable to create an MLAG cluster is there anybody whom tried MLAG after conversation or do I need separate licenses for the MLAG currently the switches only have Eth license.
The configuration is from the MLNX guideline, I hope it is correct.
Thank you in advance.
Thank you for the guides and effort you guys did with the conversation guide.
I did converted 2 sx6012 to MLNX, but I have an issue where I am unable to create an MLAG cluster is there anybody whom tried MLAG after conversation or do I need separate licenses for the MLAG currently the switches only have Eth license.
The configuration is from the MLNX guideline, I hope it is correct.
Thank you in advance.
MLNX01 [my-vip0: master] (config) # sh run
##
## Running database "initial"
## Generated at 2021/02/16 13:47:15 +0000
## Hostname: MLNX01
##
##
## Running-config temporary prefix mode setting
##
no cli default prefix-modes enable
##
## License keys
##
license install see posts above
##
## Port configuration
##
port 1/1-1/12 type ethernet force
##
## MLAG protocol
##
protocol mlag
##
## Interface Ethernet configuration
##
interface port-channel 1
interface ethernet 1/11-1/12 channel-group 1 mode active
##
## LAG configuration
##
lacp
port-channel load-balance ethernet source-destination-ip source-destination-port
##
## VLAN configuration
##
vlan 4000
##
## STP configuration
##
no spanning-tree
spanning-tree mode rpvst
##
## L3 configuration
##
ip l3
ip routing vrf default
interface vlan 4000
interface vlan 4000 ip address 1.1.1.1/30 primary
##
## DCBX PFC configuration
##
dcb priority-flow-control enable force
interface port-channel 1 dcb priority-flow-control mode on force
##
## MLAG configurations
##
mlag-vip my-vip0 ip 192.168.0.225 /24 force
mlag system-mac 00:00:5E:00:01:5D
interface port-channel 1 ipl 1
interface vlan 4000 ipl 1 peer-address 1.1.1.2
##
## Network interface configuration
##
interface ib0 ip address 0.0.0.0 /0
interface ib0 shutdown
no interface mgmt0 dhcp
interface mgmt0 ip address 192.168.0.223 /24
##
## Network interface IPv6 configuration
##
no interface mgmt0 ipv6 address autoconfig default
no interface mgmt0 ipv6 dhcp client enable
no interface mgmt0 ipv6 enable
##
## Other IPv6 configuration
##
no ipv6 enable
##
## AAA remote server configuration
##
# ldap bind-password ********
# radius-server key ********
# tacacs-server key ********
##
## Network management configuration
##
# web proxy auth basic password ********
##
## X.509 certificates configuration
##
#
# Certificate name system-self-signed, ID 5b4c1e51535eb33e
# (public-cert config omitted since private-key config is hidden)
##
## Persistent prefix mode setting
##
cli default prefix-modes enable
--------------------------------------------------------------------------------------------------
MLNX01 [my-vip0: master] (config) # sh system capabilities |
--------------------------------------------------------------------------------------------------
Ethernet: Supported, L2, L3
Ethernet Max licensed speed: 56Gb
--------------------------------------------------------------------------------------------------
sh mlag-vip |
--------------------------------------------------------------------------------------------------
MLNX01 [my-vip0: master] (config) # sh mlag-vip
MLAG-VIP:
MLAG group name: my-vip0
MLAG VIP address: 192.168.0.225/24
Active nodes: 1
--------------------------------------------------------------
Hostname VIP-State IP Address
--------------------------------------------------------------
MLNX01 master 192.168.0.223
##
## Running database "initial"
## Generated at 2021/02/16 13:47:15 +0000
## Hostname: MLNX01
##
##
## Running-config temporary prefix mode setting
##
no cli default prefix-modes enable
##
## License keys
##
license install see posts above
##
## Port configuration
##
port 1/1-1/12 type ethernet force
##
## MLAG protocol
##
protocol mlag
##
## Interface Ethernet configuration
##
interface port-channel 1
interface ethernet 1/11-1/12 channel-group 1 mode active
##
## LAG configuration
##
lacp
port-channel load-balance ethernet source-destination-ip source-destination-port
##
## VLAN configuration
##
vlan 4000
##
## STP configuration
##
no spanning-tree
spanning-tree mode rpvst
##
## L3 configuration
##
ip l3
ip routing vrf default
interface vlan 4000
interface vlan 4000 ip address 1.1.1.1/30 primary
##
## DCBX PFC configuration
##
dcb priority-flow-control enable force
interface port-channel 1 dcb priority-flow-control mode on force
##
## MLAG configurations
##
mlag-vip my-vip0 ip 192.168.0.225 /24 force
mlag system-mac 00:00:5E:00:01:5D
interface port-channel 1 ipl 1
interface vlan 4000 ipl 1 peer-address 1.1.1.2
##
## Network interface configuration
##
interface ib0 ip address 0.0.0.0 /0
interface ib0 shutdown
no interface mgmt0 dhcp
interface mgmt0 ip address 192.168.0.223 /24
##
## Network interface IPv6 configuration
##
no interface mgmt0 ipv6 address autoconfig default
no interface mgmt0 ipv6 dhcp client enable
no interface mgmt0 ipv6 enable
##
## Other IPv6 configuration
##
no ipv6 enable
##
## AAA remote server configuration
##
# ldap bind-password ********
# radius-server key ********
# tacacs-server key ********
##
## Network management configuration
##
# web proxy auth basic password ********
##
## X.509 certificates configuration
##
#
# Certificate name system-self-signed, ID 5b4c1e51535eb33e
# (public-cert config omitted since private-key config is hidden)
##
## Persistent prefix mode setting
##
cli default prefix-modes enable
--------------------------------------------------------------------------------------------------
MLNX01 [my-vip0: master] (config) # sh system capabilities |
--------------------------------------------------------------------------------------------------
Ethernet: Supported, L2, L3
Ethernet Max licensed speed: 56Gb
--------------------------------------------------------------------------------------------------
sh mlag-vip |
--------------------------------------------------------------------------------------------------
MLNX01 [my-vip0: master] (config) # sh mlag-vip
MLAG-VIP:
MLAG group name: my-vip0
MLAG VIP address: 192.168.0.225/24
Active nodes: 1
--------------------------------------------------------------
Hostname VIP-State IP Address
--------------------------------------------------------------
MLNX01 master 192.168.0.223
MLNX02 [my-vip0: unknown] (config) # sh run
##
## Running database "initial"
## Generated at 2021/02/16 13:31:32 +0000
## Hostname: MLNX02
##
##
## Running-config temporary prefix mode setting
##
no cli default prefix-modes enable
##
## License keys
##
license install see posts above
##
## Port configuration
##
port 1/1-1/12 type ethernet force
##
## MLAG protocol
##
protocol mlag
##
## Interface Ethernet configuration
##
interface port-channel 1
interface ethernet 1/11-1/12 channel-group 1 mode active
##
## LAG configuration
##
lacp
port-channel load-balance ethernet source-destination-ip source-destination-port
##
## VLAN configuration
##
vlan 4000
##
## STP configuration
##
no spanning-tree
spanning-tree mode rpvst
##
## L3 configuration
##
ip l3
ip routing vrf default
interface vlan 4000
interface vlan 4000 ip address 1.1.1.2/30 primary
##
## DCBX PFC configuration
##
dcb priority-flow-control enable force
interface port-channel 1 dcb priority-flow-control mode on force
##
## MLAG configurations
##
mlag-vip my-vip0 ip 0.0.0.0 /0 force
mlag system-mac 00:00:5E:00:01:5D
interface port-channel 1 ipl 1
interface vlan 4000 ipl 1 peer-address 1.1.1.1
##
## Network interface configuration
##
interface ib0 ip address 0.0.0.0 /0
interface ib0 shutdown
no interface mgmt0 dhcp
interface mgmt0 ip address 192.168.0.224 /24
##
## Network interface IPv6 configuration
##
no interface mgmt0 ipv6 address autoconfig default
no interface mgmt0 ipv6 dhcp client enable
no interface mgmt0 ipv6 enable
##
## Other IPv6 configuration
##
no ipv6 enable
##
## AAA remote server configuration
##
# ldap bind-password ********
# radius-server key ********
# tacacs-server key ********
##
## Network management configuration
##
# web proxy auth basic password ********
##
## X.509 certificates configuration
##
#
# Certificate name system-self-signed, ID 21b3fa05784500a0e
# (public-cert config omitted since private-key config is hidden)
##
## Persistent prefix mode setting
##
cli default prefix-modes enable
-----------------------------------------------------------------------------------------------------
MLNX02 [my-vip0: unknown] (config) # sh system capabilities |
-----------------------------------------------------------------------------------------------------
Ethernet: Supported, L2, L3
Ethernet Max licensed speed: 56Gb
--------------------------------------------------------------------------------------------------
MLNX02 [my-vip0: unknown] (config) # sh mlag-vip |
--------------------------------------------------------------------------------------------------
MLAG-VIP:
MLAG group name: my-vip0
MLAG VIP address: 0.0.0.0/0
Active nodes: 1
--------------------------------------------------------------
Hostname VIP-State IP Address
--------------------------------------------------------------
MLNX02 master 192.168.0.224
##
## Running database "initial"
## Generated at 2021/02/16 13:31:32 +0000
## Hostname: MLNX02
##
##
## Running-config temporary prefix mode setting
##
no cli default prefix-modes enable
##
## License keys
##
license install see posts above
##
## Port configuration
##
port 1/1-1/12 type ethernet force
##
## MLAG protocol
##
protocol mlag
##
## Interface Ethernet configuration
##
interface port-channel 1
interface ethernet 1/11-1/12 channel-group 1 mode active
##
## LAG configuration
##
lacp
port-channel load-balance ethernet source-destination-ip source-destination-port
##
## VLAN configuration
##
vlan 4000
##
## STP configuration
##
no spanning-tree
spanning-tree mode rpvst
##
## L3 configuration
##
ip l3
ip routing vrf default
interface vlan 4000
interface vlan 4000 ip address 1.1.1.2/30 primary
##
## DCBX PFC configuration
##
dcb priority-flow-control enable force
interface port-channel 1 dcb priority-flow-control mode on force
##
## MLAG configurations
##
mlag-vip my-vip0 ip 0.0.0.0 /0 force
mlag system-mac 00:00:5E:00:01:5D
interface port-channel 1 ipl 1
interface vlan 4000 ipl 1 peer-address 1.1.1.1
##
## Network interface configuration
##
interface ib0 ip address 0.0.0.0 /0
interface ib0 shutdown
no interface mgmt0 dhcp
interface mgmt0 ip address 192.168.0.224 /24
##
## Network interface IPv6 configuration
##
no interface mgmt0 ipv6 address autoconfig default
no interface mgmt0 ipv6 dhcp client enable
no interface mgmt0 ipv6 enable
##
## Other IPv6 configuration
##
no ipv6 enable
##
## AAA remote server configuration
##
# ldap bind-password ********
# radius-server key ********
# tacacs-server key ********
##
## Network management configuration
##
# web proxy auth basic password ********
##
## X.509 certificates configuration
##
#
# Certificate name system-self-signed, ID 21b3fa05784500a0e
# (public-cert config omitted since private-key config is hidden)
##
## Persistent prefix mode setting
##
cli default prefix-modes enable
-----------------------------------------------------------------------------------------------------
MLNX02 [my-vip0: unknown] (config) # sh system capabilities |
-----------------------------------------------------------------------------------------------------
Ethernet: Supported, L2, L3
Ethernet Max licensed speed: 56Gb
--------------------------------------------------------------------------------------------------
MLNX02 [my-vip0: unknown] (config) # sh mlag-vip |
--------------------------------------------------------------------------------------------------
MLAG-VIP:
MLAG group name: my-vip0
MLAG VIP address: 0.0.0.0/0
Active nodes: 1
--------------------------------------------------------------
Hostname VIP-State IP Address
--------------------------------------------------------------
MLNX02 master 192.168.0.224