[c-nsp] 7200/NPE-G1 WCCPv2 performance - L2 redirect vs GRE

2009-09-15 Thread Dale Shaw
Hi all, Does anyone know whether there is any notable performance difference with WCCPv2 using L2 redirect vs GRE as a packet forwarding method on 7200s? (NPE-400, NPE-G1, NPE-G2)? WCCPv2 is a heavy user of processor cycles on our 7200s so I'm looking at ways to reduce the impact without

Re: [c-nsp] Problems creating a new BGP neighbor

2009-09-15 Thread Chris Mason (chrimaso)
Hi Mihai, Check out CSCsz68307 - this occurs when someone attempts to configure an invalid IP address as a BGP peer - after that you are unable to create any additional peers as you get the error message *% Create the peer-group first. To resolve the problem you either need to reload the box

Re: [c-nsp] Problems creating a new BGP neighbor

2009-09-15 Thread Mihai Campean
Hi Chris, I reloaded the box this morning, but I'll configure the command in order to prevent further issues :) Thanks:) Chris Mason (chrimaso) wrote: Hi Mihai, Check out CSCsz68307 - this occurs when someone attempts to configure an invalid IP address as a BGP peer - after that you are

Re: [c-nsp] instabilities with SXI2?

2009-09-15 Thread Mark Tinka
On Tuesday 15 September 2009 05:53:07 am Alan Buxey wrote: and hope you dont hit another bug. waiting with intense interest for SXI3 which should stop the instant crash when using ISIS with IPv6 :-( Are you seeing this in SXI2? We are planning to move to SXI2a at the end of October. We are

Re: [c-nsp] 12.2(18)SXD to 12.2(33)SRB|C|D

2009-09-15 Thread Mark Tinka
On Tuesday 15 September 2009 04:39:53 am Richard A Steenbergen wrote: Personally my recommendation for going forward is SRC (SRC4 is pretty stable, all things considered). Would also recommend SRC; we have it largely deployed on a number of 7200's. SRC4 is stable, but a few issues, that

Re: [c-nsp] dampening for VPNv4

2009-09-15 Thread Ved Labs
the culprit was CSCsy58115 what a relief On Thu, Sep 3, 2009 at 11:44 AM, Ved Labs vedl...@gmail.com wrote: Thanks Ben for the directions . I enabled the bgp dampening for VPNv4 address-family . It helped to some extent to see the flapped statistics from the CE . I blocked one of

[c-nsp] debug bgp updates within VRF

2009-09-15 Thread Ved Labs
How do i *debug bgp updates within VRF* ** *Thanks,* *Biddu.* ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

[c-nsp] Cisco NAC - SSO Issues

2009-09-15 Thread Antonio Soares
Hello group, I'm troubleshooting a NAC issue. I see lot's of CLOSE_WAIT sessions on the CAS and i need to find a way to restart the SSO service (TCP:8910) without restarting the whole box. Disabling the option Enable Agent-Based Windows Single Sign-On with Active Directory (Kerberos) in the CAM

Re: [c-nsp] 12.2(18)SXD to 12.2(33)SRB|C|D

2009-09-15 Thread Jason Lixfeld
Upgraded to SRC4 last night and everything went pretty smoothly. A couple things I'm wondering if anyone has seen with SRC4: 1- When SRC4 booted, we were a little paniced when we saw that a bunch of our SFP ports were now dark. We resolved it by pulling the fiber and the SFP and reseating

Re: [c-nsp] Cat 4948 NAT support

2009-09-15 Thread Rodney Dunn
The real issue with NAT today is ALG processing and scale. My motto is if you are not going to sign up for full support in hardware on a box that can scale to 1+ Mpps don't bother half baking it. I deal with a customer about once per week where they tried something like this. The ASR1k (no

Re: [c-nsp] Cisco NAC - SSO Issues

2009-09-15 Thread Antonio Soares
I found a matching bug in the meanwhile but the workaround does not work: + CSCsk46672 Bug Details CAS stops listening on 8910 after threads in CLOSE_WAIT state Symptom: Agent fails to perform ADSSO Conditions: CAS no longer listening to tcp port 8910

Re: [c-nsp] Cisco NAC - SSO Issues

2009-09-15 Thread Luan Nguyen
NOD32 Antivirus, version of virus signature database 4426 (20090915) __ The message was checked by ESET NOD32 Antivirus. http://www.eset.com __ Information from ESET NOD32 Antivirus, version of virus signature database 4426 (20090915) __ The message was checked by ESET

Re: [c-nsp] Cisco NAC - SSO Issues

2009-09-15 Thread Antonio Soares
ESET NOD32 Antivirus, version of virus signature database 4426 (20090915) __ The message was checked by ESET NOD32 Antivirus. http://www.eset.com __ Information from ESET NOD32 Antivirus, version of virus signature database 4426 (20090915) __ The message was checked

Re: [c-nsp] Cisco SCE 2020 and snmp question

2009-09-15 Thread Georgi Genov
Donato Dunguihual Morales wrote: Hi, I need to graph via snmp and mrtg or rrdttool , ip traffic and protocols for Cisco sce 2020 box. I saw in the web , the utility rtmcmd. http://www.cisco.com/en/US/products/ps6135/products_user_guide09186a00808165dd.html#o16507. Iґm trying to

[c-nsp] SP-grade Ethernet over TDM

2009-09-15 Thread Justin Shore
Does anyone have any suggestions for providing Ethernet links over bonded T1s? We originally looked at Overture. They claimed that their product used standard MLPPP and interoped well with 7200s. They sent out a tech to help configure it in a lab. As it turns out they also require the use

[c-nsp] AnyConnect VPN client, IOS, and Vista

2009-09-15 Thread Jay Nakamura
Has anyone gotten AnyConnect client to work with IOS router and Vista? (With self signed cert?) I got it to work with XP but not Vista. Can someone share their config or some pointers? With Vista, it gets to the cert warning part, then dies. aaa authentication login ciscocp_vpn_xauth_ml_1

Re: [c-nsp] SP-grade Ethernet over TDM

2009-09-15 Thread Roland Dobbins
On Sep 16, 2009, at 12:14 AM, Justin Shore wrote: Does anyone have any suggestions for providing Ethernet links over bonded T1s? Yes - don't do it, given that the basic premise of running layer-2 between sites is a Very Bad Idea, much less trying to do it over bonded T1s, heh. ;

[c-nsp] Enhanced download procedure

2009-09-15 Thread Jay Hennigan
What the #$^$...@# is going on with Cisco's download site? It completely hangs Firefox with some shopping cart java thing. And this is downright scary: http://www.west.net/~jay/images/cisco-wants-root.png Enhanced downloads, brought to you by the same people who brought us enhanced

Re: [c-nsp] SP-grade Ethernet over TDM

2009-09-15 Thread sthaug
Does anyone have any suggestions for providing Ethernet links over bonded T1s? Yes - don't do it, given that the basic premise of running layer-2 between sites is a Very Bad Idea, much less trying to do it over bonded T1s, heh. In general I would agree. However, there is quite a

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Tassos Chatzithomaoglou
It should work after you allow it. Btw, it took me 1 hour to download an ASR1k IOS today with the new downloader!!! And i couldn't find another way to download it. -- Tassos Jay Hennigan wrote on 15/09/2009 20:39: What the #$^$...@# is going on with Cisco's download site? It completely hangs

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Jay Hennigan
Tassos Chatzithomaoglou wrote: It should work after you allow it. Why should I need to allow Unrestricted access to my computer in order to download a file? What exactly is that Java applet doing? Could it do something malicious? How do you know for sure? -- Jay Hennigan - CCIE #7880 -

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Church, Charles
It looks like it needs unrestricted access so that it can access your file system, since it presents its own file manager looking thing so you can pick where to save the files. No way to know for sure though. Chuck -Original Message- From: cisco-nsp-boun...@puck.nether.net

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Seth Mattinen
Jay Hennigan wrote: Tassos Chatzithomaoglou wrote: It should work after you allow it. Why should I need to allow Unrestricted access to my computer in order to download a file? What exactly is that Java applet doing? Could it do something malicious? How do you know for sure? I can't

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Jared Mauch
On Sep 15, 2009, at 2:19 PM, Church, Charles wrote: It looks like it needs unrestricted access so that it can access your file system, since it presents its own file manager looking thing so you can pick where to save the files. No way to know for sure though. Another reason to use

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Jay Hennigan
Church, Charles wrote: It looks like it needs unrestricted access so that it can access your file system, since it presents its own file manager looking thing so you can pick where to save the files. No way to know for sure though. But every browser has a built-in download utility so this

Re: [c-nsp] SP-grade Ethernet over TDM

2009-09-15 Thread Michael K. Smith - Adhost
Top posting since it's so brief. http://www.radware.com - they have all different manner of conversion technologies in their product set. Mike -- Michael K. Smith - CISSP, GISP Chief Technical Officer - Adhost Internet LLC mksm...@adhost.com w: +1 (206) 404-9500 f: +1 (206) 404-9050 PGP: B49A

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Jared Mauch
On Sep 15, 2009, at 2:22 PM, Seth Mattinen wrote: Jay Hennigan wrote: Tassos Chatzithomaoglou wrote: It should work after you allow it. Why should I need to allow Unrestricted access to my computer in order to download a file? What exactly is that Java applet doing? Could it do

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Jared Mauch
On Sep 15, 2009, at 2:25 PM, Jay Hennigan wrote: Church, Charles wrote: It looks like it needs unrestricted access so that it can access your file system, since it presents its own file manager looking thing so you can pick where to save the files. No way to know for sure though. But

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Rodney Dunn
Please check the email thread a week or so back where I gave the direct contacts for feedback. They are open and want to hear helpful constructive feedback. Rodney Seth Mattinen wrote: Jay Hennigan wrote: Tassos Chatzithomaoglou wrote: It should work after you allow it. Why should I

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Tassos Chatzithomaoglou
You probably need to enabled cookies. -- Tassos Seth Mattinen wrote on 15/09/2009 21:22: Jay Hennigan wrote: Tassos Chatzithomaoglou wrote: It should work after you allow it. Why should I need to allow Unrestricted access to my computer in order to download a file? What exactly is that

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Seth Mattinen
Jared Mauch wrote: On Sep 15, 2009, at 2:19 PM, Church, Charles wrote: It looks like it needs unrestricted access so that it can access your file system, since it presents its own file manager looking thing so you can pick where to save the files. No way to know for sure though.

Re: [c-nsp] MPLS TE Fast Re-route

2009-09-15 Thread Yan Filyurin
When you say backup path for patch-protection, are you talking about path protection? I've never done path protection, but it is slightly slower than FRR with link or node protection to converge, but from what I understand it is alternative to FRR that does link and node and the path gets set

[c-nsp] LLDP between a 6500 and a 3750

2009-09-15 Thread Colin Whittaker
Having a wierd issue with LLDP between a 6500 and a 3750 There are two gig links which are in a port channel. The 6500 (r2 below) sees a lldp neighbor on both ports but the 3750 only shows the 6500 being a neighbor on the port which it has most recently received an update. This is breaking some of

Re: [c-nsp] Enhanced download procedure

2009-09-15 Thread Judah Scott
I agree 100% It makes no sense to force people to use proprietary download managers, especially when they fund the bandwidth used to retrieve the file. :thumbdown: On Tue, Sep 15, 2009 at 11:56 AM, Seth Mattinen se...@rollernet.us wrote: Jared Mauch wrote: On Sep 15, 2009, at 2:19 PM,

[c-nsp] ASA5505, Restricted VLAN VPN

2009-09-15 Thread Dave Brockman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello all, first time poster, please be gentle... I have a client scenario that I can't work out in the lab for a few days, hoping someone here might already know if it is possible or not. I have a client with an ASA5505, base license, currently

Re: [c-nsp] ASA5505, Restricted VLAN VPN

2009-09-15 Thread Michael K. Smith - Adhost
Hello Dave: snip Hello all, first time poster, please be gentle... I have a client scenario that I can't work out in the lab for a few days, hoping someone here might already know if it is possible or not. I have a client with an ASA5505, base license, currently utilizing the restricted

[c-nsp] RSVP MPLS Fast Reroute PLR Behavior

2009-09-15 Thread Judah Scott
While testing out Fast Reroute I notice that after a linkdown and successful FRR switch onto bypass, the SUT does not switch back to the primary path after link is restored and IGP reconverges. Is this expected behavior or am I perhaps missing some important config statement? I am testing on

Re: [c-nsp] debug bgp updates within VRF

2009-09-15 Thread Tony
Hi Biddu, If you wish to see route table updates, then you can use debug ip routing vrf name. This will show you the updates as they are applied to the VRF routing table. If you wish to see what BGP specifically is doing then something like deb ip bgp vpnv4 unicast updates should help you

Re: [c-nsp] RSVP MPLS Fast Reroute PLR Behavior

2009-09-15 Thread sthaug
While testing out Fast Reroute I notice that after a linkdown and successful FRR switch onto bypass, the SUT does not switch back to the primary path after link is restored and IGP reconverges. Is this expected behavior or am I perhaps missing some important config statement? I am testing on