Re: [c-nsp] Download manager hell and latest Windows VPN Client?

2009-09-25 Thread Peter Hicks
Justin Shore wrote: I've been in situations where I had to download an IOS image with the el cheapo browser in my data phone that does not have Java support, save it to the MicroSD card and then use a card reader to transfer that to my laptop so I could fix a critical network issue. Java

[c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Andy Saykao
This might be a silly question but is there a tool somewhere that will give me a list of IP's that are owned by a particular AS. As an example, I might want to know which IP blocks belong to AS1234? Thanks. Andy This email and any files transmitted with it are confidential and intended

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Hector Herrera
On Thu, Sep 24, 2009 at 11:55 PM, Andy Saykao andy.say...@staff.netspace.net.au wrote: This might be a silly question but is there a tool somewhere that will give me a list of IP's that are owned by a particular AS. As an example, I might want to know which IP blocks belong to AS1234?

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Florian Weimer
* Andy Saykao: This might be a silly question but is there a tool somewhere that will give me a list of IP's that are owned by a particular AS. As an example, I might want to know which IP blocks belong to AS1234? Run this: show ip bgp regexp _1234$ on a router in the DFZ. (I get a

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Andy Saykao
Thanks for the reply guys. What I'm trying to achieve is to monitor the bandwidth utilization on our Internet link. So for example we want to know how much bandwidth is being utilized by our customers so we can say ah huh out of our 100M internet link, 90M of traffic is from youtube.com, so let's

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Gert Doering
Hi, On Fri, Sep 25, 2009 at 04:55:48PM +1000, Andy Saykao wrote: This might be a silly question but is there a tool somewhere that will give me a list of IP's that are owned by a particular AS. As an example, I might want to know which IP blocks belong to AS1234? What exactly do you mean

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Howard Jones
Andy Saykao wrote: This might be a silly question but is there a tool somewhere that will give me a list of IP's that are owned by a particular AS. As an example, I might want to know which IP blocks belong to AS1234? The RIPE IRR does this for europe at least, and I believe RIPE and ARIN

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Steve Natale
On Fri, Sep 25, 2009 at 12:29:17AM -0700, Hector Herrera wrote: On Thu, Sep 24, 2009 at 11:55 PM, Andy Saykao andy.say...@staff.netspace.net.au wrote: This might be a silly question but is there a tool somewhere that will give me a list of IP's that are owned by a particular AS. As an

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Andrey 'sshd' Petrenko
http://webtrace.info/asn?q=1234submit=asn 2009/9/25 Ronan Mullally ro...@iol.ie Hi Andy, On Fri, 25 Sep 2009, Andy Saykao wrote: This is why I needed to know what IP blocks belong to AS1234, so I could find out how much traffic was actually coming from AS1234 on our Internet link.

[c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread Michael Robson
What is the added benefit of running an EoMPLS pseudowire across an MPLS cloud over an L2TPv3 tunnel over the same cloud? Michael -- Michael Robson | Tel: +44 (0) 161 275 6113 Networks| Fax: +44 (0) 161 275 6120 Net North West | Email: michael.rob...@manchester.ac.uk

Re: [c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread Simon Lockhart
On Fri Sep 25, 2009 at 10:44:14AM +0100, Michael Robson wrote: What is the added benefit of running an EoMPLS pseudowire across an MPLS cloud over an L2TPv3 tunnel over the same cloud? In my experience, a difference in which feature is supported on the hardware you've got. My gut feel is that

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Ronan Mullally
Hi Andy, On Fri, 25 Sep 2009, Andy Saykao wrote: This is why I needed to know what IP blocks belong to AS1234, so I could find out how much traffic was actually coming from AS1234 on our Internet link. Some (possibly all?) Whois servers can provide you with this information with: whois -h

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Ian MacKinnon
Hi Andy, Does your device support netflow? That is the best answer for this sort of question. If it does not, can you mirror the traffic to say a server and run ntop on that? Ian -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Joe Provo
On Fri, Sep 25, 2009 at 06:12:22PM +1000, Andy Saykao wrote: Thanks for the reply guys. What I'm trying to achieve is to monitor the bandwidth utilization on our Internet link. So for example we want to know how much bandwidth is being utilized by our customers so we can say ah huh out of

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Andy Davidson
On 25 Sep 2009, at 09:12, Andy Saykao wrote: What I'm trying to achieve is to monitor the bandwidth utilization on our Internet link. So for example we want to know how much bandwidth is being utilized by our customers so we can say ah huh out of our 100M internet link, 90M of traffic is

Re: [c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread David Freedman
Wow, this is actually a tricky question, so I'll jot down some points for you to think about from the top of my head (and anybody, please feel free to correct these if they are wrong, they may be out of date) EoMPLS: - Requires end-to-end MPLS LSP - Does not support path fragmentation (need

Re: [c-nsp] ASA5520 which image should I use?

2009-09-25 Thread Jason Giles
IF you need features in the 8.x code: Use 8.04(32) in the interim releases, if you are authenticating against a windows domain there are some key fixes in there. Love this tidbit of info in the 8.2.1 release notes: The caveats listed in Table 5 are recently-found caveats that were fixed in

Re: [c-nsp] ASA5520 which image should I use?

2009-09-25 Thread Justin Shore
Antonio Soares wrote: Stay away from 8.2. We are experiencing crashes since July (TAC case involved). Tomorrow we will install 8.2.1-10 to see if finally we get rid of this. I've had good luck with 8.2.1-3 for our purposes. Any 8.2 prior to that has that nasty coredump feature that writes

Re: [c-nsp] ASA5520 which image should I use?

2009-09-25 Thread NMaio
Obviously everybody's experience has been different but I have been running very nicely on 8.0.x code. I am running on the latest interim code on both ASAs and PIXs due to a security flaw though.(knock on wood) It has been very stable. 7.2.4 code was very buggy for me. I was upgrading

Re: [c-nsp] ASA5520 which image should I use?

2009-09-25 Thread Ryan West
Nick, I agree with you on the earlier 7.2(4) releases, in particular 7.2(4)18 was bombing on us in multiple locations with site to site tunnels. However, I think the same interim released bugs were in both trains. In terms of bug fixes and general release times, 8.0(4)32 and 7.2(4)33 were

[c-nsp] QOS mismatch for channel ports ??

2009-09-25 Thread Jeff Fitzwater
I have the following two ports on different modules and they have different QOS scheduling which stops them from being members of a channel group. Is there a way to fix this by changing the QOS on one of the ports ? I wanted to keep the ports on separate boards if possible.

Re: [c-nsp] ASA5520 which image should I use?

2009-09-25 Thread Chris Griffin
I have been told that going forward TAC is the only way to get interim releases on 8.2 and newer code. This wouldn't be bad if they put out real releases more than once per year. Crazy that it seems to be SOP that Cisco, through making it difficult to get patches, encourages running code on a

Re: [c-nsp] QOS mismatch for channel ports ??

2009-09-25 Thread Chris Griffin
try no mls qos channel-consistency under the port channel... On Fri, 2009-09-25 at 10:33 -0400, Jeff Fitzwater wrote: I have the following two ports on different modules and they have different QOS scheduling which stops them from being members of a channel group. Is there a way to fix

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Scott Granados
Two words, Arbor Networks. http://www.arbornetworks.com I've used their collector / reporting appliances in a large ISP setting and they were very good. Expensive but if you need detailed reporting and traffic flow analysis these guys make some good tools. Export netflow to the collector

Re: [c-nsp] QOS mismatch for channel ports ??

2009-09-25 Thread Jeff Fitzwater
That command is not available on 12.2SXI but I see that I could just disable QOS per PORT. Also I noticed this command which applies to mod 7 (supervisor) which modifies the scheduling, but it looks like I would have to disable it on the 7/4 port so it reverts back and matches the 12/6

[c-nsp] More on Download hell, java, accessibility and Cisco's response!

2009-09-25 Thread Scott Granados
Hi all, I thought I would post my response that I received from a feedback message I sent after not being able to use the new download tool. I'm encouraged by this response and will be sending Cisco detailed information on screen reader java interactions. For the general concerns it looks

Re: [c-nsp] ASA5520 which image should I use?

2009-09-25 Thread Justin Shore
nm...@guesswho.com wrote: Justin, I believe I saw your posts on the RANCID list and although the 8.2 coredump problem can be a pain you can modify your rancid script to ignore the coredump file when rancid does a show flash. I do this for dhcp snooping since the db is small enough that I can

Re: [c-nsp] ASA5520 which image should I use?

2009-09-25 Thread NMaio
Justin, I definitely see your point but it might be hard to generalize that all CF chips fail at 1 writes. Unless you know that Cisco uses a specific type of flash and the MTBF of that chip is 1 writes. Some CF chips are rated much higher than that. Regardless it is good that Cisco

[c-nsp] Any gotchas in upgrading ASA5520 pairs?

2009-09-25 Thread Scott Granados
Hi, I have two ASA 5520 devices in a active standby pair. I'm presently at firmware 7.0.7 and ASDM 5.0 and want to upgrade to 7.2.4-33. I've googled and found some detailed instructions and the process seems simple and standard, upload the image, change the boot vars, save and restart.

[c-nsp] Ethernet Preamble and FCS on EoMPLS

2009-09-25 Thread Ruter Guike
Hi List. Is Cisco able to include Ethernet preamble and FCS within the mpls packet, on EoMPLS? Is it configurable? AFAIK, these fields are removed, by default, before encapsulating... Thanks in advance. Ruter ___ cisco-nsp mailing list

[c-nsp] FTP seems to work

2009-09-25 Thread Jason Gurtz
I was about to write a little perl to further address the recent outcry over the cisco.com Java misfeatures when lo, I discovered ftp://download-sj.cisco.com will accept my cco login id/pass. I poked around and discovered /cisco/ios and /cisco/ciscosecure/pix seemed to have what I'd be looking

Re: [c-nsp] Any gotchas in upgrading ASA5520 pairs?

2009-09-25 Thread Ryan West
Scott, I'm sure other people follow different methods, but I haven't run into any issues loading the code on both devices, rebooting the primary causing an immediate failover, waiting for the config sync messages on the new primary. Once I see all interfaces as normal, I reload the primary

Re: [c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread Ge Moua
David Freedman- Do you have a preference of one over the other? I've been thinking about the option of replacing our L2TPv3 deployment with EoMPLS (ie, Cisco's ATOM model). We are using Cisco 7203 with NSE engine for L2TPv3 acceleration; but I'm not a big fan of this platform; we have

Re: [c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread Gert Doering
Hi, On Fri, Sep 25, 2009 at 11:49:47AM -0500, Ge Moua wrote: We are using Cisco 7203 with NSE engine for L2TPv3 acceleration; but I'm not a big fan of this platform; we have 3bxl-sup720/cat6k at the core that can do MPLS in hardware; I was just thinking of using GRE to encapsulate the MPLS

Re: [c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread David Freedman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I think the choice is simple. If you have a native MPLS backbone, use EoMPLS. If you don't, then don't, use L2TPv3, please don't do MPLSoGRE, it is more trouble than it is worth. That said, can you not build out a native MPLS network? does your

Re: [c-nsp] FTP seems to work

2009-09-25 Thread Nick Hilliard
On 25/09/2009 17:36, Jason Gurtz wrote: I was about to write a little perl to further address the recent outcry over the cisco.com Java misfeatures when lo, I discovered ftp://download-sj.cisco.com will accept my cco login id/pass. I poked around and discovered /cisco/ios and

Re: [c-nsp] Any gotchas in upgrading ASA5520 pairs?

2009-09-25 Thread Tony Varriale
I would recommend forcing the failover from the CLI. tv - Original Message - From: Ryan West rw...@zyedge.com To: Scott Granados gsgrana...@comcast.net; cisco-nsp@puck.nether.net Sent: Friday, September 25, 2009 11:48 AM Subject: Re: [c-nsp] Any gotchas in upgrading ASA5520 pairs?

Re: [c-nsp] FTP seems to work

2009-09-25 Thread Hector Herrera
On Fri, Sep 25, 2009 at 9:36 AM, Jason Gurtz jasongu...@npumail.com wrote: I was about to write a little perl to further address the recent outcry over the cisco.com Java misfeatures when lo, I discovered ftp://download-sj.cisco.com will accept my cco login id/pass.  I poked around and

Re: [c-nsp] Any gotchas in upgrading ASA5520 pairs?

2009-09-25 Thread NMaio
Scott, Not sure if is a concern for you but upgrading from 7.0 to 7.2 does not allow a zero downtime upgrade. Check out the section Performing Zero Downtime Upgrades for Failover Pairs on the following link: http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/mswlicfg.html

[c-nsp] BFD static in VRF...

2009-09-25 Thread Derick Winkworth
Anyone else try doing this?  I'm on 12.2(33)SRC4 on a 7200 w/NPE-G2 and for some reason the vrf option in ip route static bfd is not showing up... I don't see anything in the release notes about this or in bug toolkit... Anyone thoughts? ___ cisco-nsp

Re: [c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread Ge Moua
Gert- what about the 3cxl; we have some of those on hand too. Regards, Ge Moua | Email: moua0...@umn.edu Network Design Engineer University of Minnesota | Networking Telecommunications Services Gert Doering wrote: Hi, On Fri, Sep 25, 2009 at 11:49:47AM -0500, Ge Moua wrote: We are

Re: [c-nsp] Which IP's belong to AS1234?

2009-09-25 Thread Alex Howells
Andy Saykao wrote: This is why I needed to know what IP blocks belong to AS1234, so I could find out how much traffic was actually coming from AS1234 on our Internet link. What you actually want is Netflow (or JFlow, sFlow, etc) with a suitably smart collector, which will provide you with all

Re: [c-nsp] Ethernet Preamble and FCS on EoMPLS

2009-09-25 Thread Reinhold Fischer
On Fri, Sep 25, 2009 at 01:33:09PM -0300, Ruter Guike wrote: Hi List. Is Cisco able to include Ethernet preamble and FCS within the mpls packet, on EoMPLS? Is it configurable? AFAIK, these fields are removed, by default, before encapsulating... RFC4448 (Encapsulation Methods for

Re: [c-nsp] FTP seems to work

2009-09-25 Thread Jason Gurtz
You won't find crypto images there, but it has lots of other stuff, and is massively easier to negotiate than the web site. Ahh yes, thanks for the clarification, that would explain the missing k9 Suckage...back to the perl idea... ~JasonG smime.p7s Description: S/MIME cryptographic

Re: [c-nsp] Any gotchas in upgrading ASA5520 pairs?

2009-09-25 Thread Scott Granados
Hi, thanks for the link. So it looks like I was close. Am I reading this right in that I have to upgrade from 7.0 to 7.1 first then to 7.2? Thanks Scott - Original Message - From: nm...@guesswho.com To: gsgrana...@comcast.net; cisco-nsp@puck.nether.net Sent: Friday, September 25,

Re: [c-nsp] Any gotchas in upgrading ASA5520 pairs?

2009-09-25 Thread NMaio
Yes that is the recommended procedure. You can upgrade from the last minor release of the previous version to the next major release. For example, you can upgrade from 7.9 to 8.0, assuming that 7.9 is the last minor version in the 7.x release. Nick -Original Message- From: Scott

Re: [c-nsp] Any gotchas in upgrading ASA5520 pairs?

2009-09-25 Thread NMaio
Oops wrong quote. This is the one I intended to send you since you are not going to 8.x code. For example, you can upgrade from 7.0 to 7.1. Upgrading from 7.0 directly to 7.2 is not supported for zero-downtime upgrades; you must first upgrade to 7.1. -Original Message- From: Nicholas

Re: [c-nsp] More on Download hell, java, accessibility and Cisco's response!

2009-09-25 Thread Alan Buxey
Hi, I thought I would post my response that I received from a feedback message I sent after not being able to use the new download tool. I'm encouraged by this response and will be sending Cisco detailed information on screen reader java interactions. For the general concerns it looks

Re: [c-nsp] More on Download hell, java, accessibility and Cisco's response!

2009-09-25 Thread William F. Maton Sotomayor
On Fri, 25 Sep 2009, Alan Buxey wrote: [snip] no path = no file issue too. which isnt amusing after you think you've just downloaded 5 IOS releases to undertake some work. anyway, yes. non java option looks like its coming... For the impatient, I found this:

Re: [c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread Peter Rathlev
On Fri, 2009-09-25 at 12:36 -0500, Ge Moua wrote: Gert Doering wrote: PFC3b cannot do MPLS-over-GRE what about the 3cxl; we have some of those on hand too. Same thing, no MPLSoGRE. In almost all practical regards the PFC3C and PFC3B are the same. -- Peter

Re: [c-nsp] EoMPLS v L2TPv3

2009-09-25 Thread Gert Doering
Hi, On Fri, Sep 25, 2009 at 12:36:37PM -0500, Ge Moua wrote: Gert- what about the 3cxl; we have some of those on hand too. Same. Difference between 3b and 3c is mainly MAC address table space, and xl vs. non-xl is table size for routing table entries (TCAM space), but it's the same EARL.

[c-nsp] Non-Java download option

2009-09-25 Thread Ryan West
You asked, now it's here. You can leverage the download cart to queue up your downloads and get a page with all the URLs. The main difference is now you have to accept the EULA, whereas with the bookmark or Stig's greasemonkey script, you did not. -ryan