Re: [c-nsp] ASA vs ISR ZBFW

2011-09-09 Thread Mark Tinka
On Saturday, September 10, 2011 01:16:31 AM Nick Hilliard wrote: > i'm tending to run a local ospf instance on the fw-router > link and then redistributing from ospf->bgp on the > next-hop router. Really it would be much better to have > fw support for bgp, but the ASA is such an enterprise > bo

Re: [c-nsp] Regain CLI access with snmp sets?

2011-09-09 Thread Lee
On 9/9/11, Persio Pucci wrote: > Anybody would have a working recipe for routers, specialy 7200? I've > been trying the ones posted at Cisco (specially the one where you need > several commands) but the final "activate" command gets an error > response... echo "processing $DEV" echo " delete

[c-nsp] Best IOS train for GSR128xx/PRP-2

2011-09-09 Thread Drew Weaver
Howdy, I know the age of this router almost makes this an off-topic post =) I was wondering which version the few remaining folks that are running these beasts have found to be stable? Last I heard for straight IOS 12.0(33)S (latest number) was the best, are you guys finding this still to be t

Re: [c-nsp] Basic IOS questions

2011-09-09 Thread Mack McBride
Show log: If you are trying to get the current day logs you can use "sh log | inc Sep 9" (notice the two spaces since there is no zero and day is two digits) Ssh timeouts: The command you are looking for is "exec-timeout" this has to be applied to the individual vty lines. Osfp ipv6: Yes th

[c-nsp] Basic IOS questions

2011-09-09 Thread Rolf Hanßen
Hi, I have some questions that came up while working with Cisco 7600/6500 boxes first weeks. Maybe you guys have some hints for me. order of sh log: Is there a way to show the latest entries first instead of scrolling down to the end ? ssh timeouts: I would like to disable the console timeout fo

Re: [c-nsp] Router performance PDF

2011-09-09 Thread Mack McBride
ASR numbers would be interesting too. Mack -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Josh Farrelly Sent: Thursday, September 08, 2011 9:29 PM To: Jay Nakamura; cisco-nsp Subject: Re: [c-nsp] Router performance PDF

Re: [c-nsp] Sup7 port availability

2011-09-09 Thread Gregori Parker
No, I'm pretty sure you only get the use of 2 of those ports on each with redundant sup7's I don¹t have docs to reference as I'm remembering this from a recent product walkthrough with Cisco On 9/9/11 8:38 AM, "Edward Beheler" wrote: >I have a 4510R+E chassis with a sup7, which has 4 SFP+ port

Re: [c-nsp] ASA vs ISR ZBFW

2011-09-09 Thread Nick Hilliard
On 09/09/2011 16:51, Colin Whittaker wrote: > This exact limitation is why everytime I deploy firewalls these days > there tends to be some form of L3 switch on either side just so I have > something to run BGP on and just do eBGP multihop across the ASA. i'm tending to run a local ospf instance o

Re: [c-nsp] ASA vs ISR ZBFW

2011-09-09 Thread Gert Doering
Hi, On Fri, Sep 09, 2011 at 11:33:37AM -0400, Matthew Huff wrote: > > Just last week I had a customer call due to weird issues with "passive > > FTP is not working right"... but indeed that might have been an older > > firmware release. > > Hmm, would it happen to have including a NetBSD or OpenB

Re: [c-nsp] ASA vs ISR ZBFW

2011-09-09 Thread Colin Whittaker
On Fri, Sep 09, 2011 at 05:23:59PM +0200, Gert Doering wrote: > > 1) It now does dynamic routing (RIP, OSPF, EIGRP) > > ... but still no BGP, which is undoubtly *the* routing protocol that you > want to use if you don't trust your neighbours (due to much better filtering > support) - and "firewall

[c-nsp] Sup7 port availability

2011-09-09 Thread Edward Beheler
I have a 4510R+E chassis with a sup7, which has 4 SFP+ ports. If I add another sup7 for redundancy, can I use the 4 SFP+ ports on it, and have 8 nonredundant SFP+ ports? I've found documentation that you can do that with a sup 6-E, but the document doesn't have an update for the sup7. http://w

Re: [c-nsp] ASA vs ISR ZBFW

2011-09-09 Thread Matthew Huff
> ... but still no BGP, which is undoubtly *the* routing protocol that you want > to use if you don't trust your neighbours (due to much better filtering > support) - and "firewall environment" is usually all about "not trusting". I prefer to keep my BGP routing and firewall on separate boxes esp

Re: [c-nsp] ASA vs ISR ZBFW

2011-09-09 Thread Gert Doering
Hi, On Fri, Sep 09, 2011 at 11:17:39AM -0400, Matthew Huff wrote: > I understand where this comes from, but the ASA is a bit more modern then the > "PIXen". > > 1) It now does dynamic routing (RIP, OSPF, EIGRP) ... but still no BGP, which is undoubtly *the* routing protocol that you want to use

Re: [c-nsp] ASA vs ISR ZBFW

2011-09-09 Thread Matthew Huff
Gert, I understand where this comes from, but the ASA is a bit more modern then the "PIXen". 1) It now does dynamic routing (RIP, OSPF, EIGRP) 2) Nat (as of 8.3+) is now "normal" 3) The inspect feature still has issues but is necessary for many protocols and is implemented very similar on the Z

Re: [c-nsp] ASA vs ISR ZBFW

2011-09-09 Thread Gert Doering
Hi, On Fri, Sep 09, 2011 at 01:31:06AM -0400, Jay Nakamura wrote: > I have been wondering lately, what advantages do ASA have over ISR as > a firewall on the low end? As just one stand alone firewall, what > features are there for ASA that distinguishes itself? Often, I rather > have an ISR over

Re: [c-nsp] Regain CLI access with snmp sets?

2011-09-09 Thread Bielawa, Daniel Walter
If you don't mind a little bit of perl work. I use a script based on the Cisco::CopyConfig perl module to TFTP config snippets up to a cisco router or switch. This is the method I use when I SNMP access but not SSH/Telnet. http://search.cpan.org/~eug/Cisco-CopyConfig/CopyConfig.pm Thank You Da

Re: [c-nsp] PVLAN Promiscuous Trunk on 6500

2011-09-09 Thread Pavel Skovajsa
AFAIK this was only on CatOS for 6500 so not much useful right now. The private host feature applies vlan tag to the ingress traffic of the access port (not trunk), the private trunk does ingress traffic tag swap of multiple vlans coming in via trunk. So, if you have lot of free ports you might b

Re: [c-nsp] nexus material and coloured CWDM 10G SFP+

2011-09-09 Thread quinn snyder
holemans -- via 'sh int e trans det' one can scrape the dom information from the pluggable, assuming the pluggable supports dom. regards, q. -= sent via iphone. please excuse spelling, grammar, and brevity =- On Sep 9, 2011, at 2:24, Holemans Wim wrote: > Recently we started using CWDM colour

[c-nsp] PVLAN Promiscuous Trunk on 6500

2011-09-09 Thread Persio Pucci
Hi, can anybody confirm if PVLAN Promiscuous Trunk Port is supported on the 6500 platform? I know it is supported on the 4500, and that it is NOT supported on the 3750, but I had the impression it was supported on the 6500, but it does not accept the command "switchport mode private-vlan trunk pro

Re: [c-nsp] Regain CLI access with snmp sets?

2011-09-09 Thread Persio Pucci
Anybody would have a working recipe for routers, specialy 7200? I've been trying the ones posted at Cisco (specially the one where you need several commands) but the final "activate" command gets an error response... Enviado via iPhone Em 08/09/2011, às 18:44, Mike escreveu: > Hello, > >I a

[c-nsp] etherchannel load-balancing & WS-X6708 issue

2011-09-09 Thread Jiri Prochazka
Hi, I'm trying to establish 40 Gbps redundant cirle using a pair of 6500 and 7600 boxes equipped with X6708 cards as shown below -> _ _ || Te1/2 --||/// | core | Te1/1 --| edge-2 |// | 7600-1 | Te1/5 -Po1--||/ |_ __| Te1/6 -

Re: [c-nsp] Regain CLI access with snmp sets?

2011-09-09 Thread Brian Raaen
This link may be what you are looking for. http://cisco.cluepon.net/index.php/TCB_Recovery --- Brian Raaen Network Architect Zcorum bra...@zcorum.com On Thu, Sep 08, 2011 at 02:40:23PM -0700, Mike wrote: > Hello, > > I am sure this can be done and am calling on my fellows to help > light t

[c-nsp] nexus material and coloured CWDM 10G SFP+

2011-09-09 Thread Holemans Wim
Recently we started using CWDM coloured 10G SFP+ interfaces (smartoptics) on our campus network (in 4900M with OneX convertors). This works just fine although Cisco probably will tell us that is not supported... I'm wondering if someone already did the same thing on nexus 5xxx switches, especial

Re: [c-nsp] Regain CLI access with snmp sets?

2011-09-09 Thread Alan Buxey
Hi, > snmpset -v 2c -c > OLD-CISCO-SYS-MIB::netConfigSet. s > > And is dotted decimal. And is a path > relative to you TFTP root. Example: > > snmpset -v 2c -c private 192.0.2.10 > OLD-CISCO-SYS-MIB::netConfigSet.192.0.2.50 s new-config.text yes, have happily used this method to update