Probably Overdue Update ;)

I haven't had any time for the blog due to real life commitments since about November 2022, but I have been plodding along with bug fixes & improvements to tooling, so head on over to my GitHub:

• Fixed the SNMP ping sweep to work with Aruba (+ other vendors), after wrangling with snmpwalk. These updates were then applied to the automated pre & post checks tool also.
  
• Improved the ACL decrufter via code simplification & bug fixes.
  
• Rewritten the switch MAC ARP DNS report to handle multiple switches, with ARP & DNS lookup details & Arista support also.
• Created a new tool switch MAC ARP DNS scraper, which attempts to answer the question "what's connected to what" for a given set of devices.
  

Cisco Switch MAC Address Flapping Alerts

MAC address table instability can impact a switch's performance & on lower end switches cause high CPU utilisation that may impact other functions. Cisco switches can generate a syslog entry when they see a MAC address flap between ports, but it’s not enabled by default. Some NX-OS platforms actually temporarily disable MAC address table updates if a certain number of MAC address flaps occur within a set timeframe: https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/nx-os-software/213906-nexus-9000-mac-move-troubleshooting-and.html
The different switch platforms generate slightly different syslog messages, but the common factor is they all have MAC_MOVE in the text for NX-OS, or MACFLAP or HOSTFLAP for IOS / IOS XE. So I created an alert in Splunk to match these keywords in the last hour's log entries.

Commands

IOS / IOX XE:
mac address table notification mac-move

N3K:
mac address table notification mac-move
logging level fwm 6
logging monitor 6

N4K:
mac address table notification mac-move
logging level fwm 6
logging monitor 6

N5K / N6K:
mac address table notification mac-move
logging level fwm 6
logging monitor 6

N7K / N9K:
logging level l2fm 5

Jabber Pickup Groups

Cisco recently released Jabber for Windows 10.5 which introduces support for notification of calls to hunt groups & group pickup capability. However these features aren't enabled by default & the Call Pickup/Hunt Group sections in the Jabber Jabber deployment guide don't actually tell you this, nor does the release notes or the advanced functionality guide. To enable these features you need to add some parameters to jabber-config.xml, the deployment guide does list these parameters in the Client Configuration > Configure Users > Policies Parameters > On-Premises Policies section.
Below is an example jabber-config.xml that enable hunt group notification, pickup & other group pickup:

<?xml version="1.0" encoding="utf-8"?>
<config version="1.0">
 <Policies>
   <EnableCallPickup>true</EnableCallPickup>
   <EnableOtherGroupPickup>true</EnableOtherGroupPickup>
   <EnableHuntGroup>true</EnableHuntGroup>
 </Policies>
</config>

As per usual, this needs to be uploaded to all your TFTP servers & the TFTP service restarted.