Re: [c-nsp] Typhoon support on XRe

2017-05-23 Thread Mark Tinka
On 5/1/17 7:24 PM, Saku Ytti wrote: > Clearly home users aren't driving 10GE, 100GE, 400GE demand, and I > don't anticipate this changing soon. Perhaps vendors still think > market is same as it was 5-10 years ago, where everyone wanted faster > connection on every cycle, but we're now in era wh

Re: [c-nsp] Typhoon support on XRe

2017-05-23 Thread Mark Tinka
On 5/1/17 7:24 PM, Saku Ytti wrote: > Warning largely content free pondering follows. > > This is not XR specific, market is no longer driven by service > providers/access networks, but by content networks. And content > networks want ever faster interfaces in ever denser form factor. > 1GE is g

Re: [c-nsp] BGP-ORR Scaling on vRR

2017-05-23 Thread Mark Tinka
On 4/28/17 4:54 PM, Dhamija Amit via cisco-nsp wrote: > Hi > I am testing the feature BGP-ORR to have a centralized Route Reflectors in > our network. > The feature works well and it ensures optimal routing to the nearest clients. > I have some concerns on the scaling of this feature, with aro

Re: [c-nsp] NCS4200 - re-badged ASR920 / ASR900 ?

2017-05-23 Thread Mark Tinka
On 4/26/17 9:23 AM, George Giannousopoulos wrote: > Hi, > > Concerning IOS-XR on ASR-900 series, during a recent meeting with Cisco we > were told that it's coming with RSP4.. > Haven't heard anything for the ASR920 though.. Personally, I'd still prefer IOS XE on the ASR920. IOS XR is a little

Re: [c-nsp] NCS4200 - re-badged ASR920 / ASR900 ?

2017-05-23 Thread Mark Tinka
On 4/25/17 8:22 AM, Mattias Gyllenvarg wrote: > Perhaps it will take the place of the ME3800X? The ME3800X still has larger resources than an ME3600X, which is on par with the ASR920. I suspect a newer ASR9x0 will replace the ME3800X. Mark. ___ cisc

Re: [c-nsp] Why WiSM appears to ignore IPv6 ACLs that should override interface ACLs?

2017-05-23 Thread Matti Saarinen
Hi, Christopher Werny wrote: > which code version are you currently running? The WiSM2 runs currently 8.0.121.0 as do the two WLC5508s we have. Strangely, we have received no complaints from people who have been connected to the two latter ones. The configurations are mostly identical. Unfortu

[c-nsp] vs bgp announcing of route leaked routes to external peer

2017-05-23 Thread Arne Larsen
Hi all I have a problem with a multi vrf where I ‘we imported routes from other vrf’s. I have an import map on the shared vrf to select the routes from other vrf’s that we want imported. Now I need to send a list of prefixes to an external backup provider from this vrf via bgp peering. I

Re: [c-nsp] mac filter on switch

2017-05-23 Thread Peter Rathlev
On Tue, 2017-05-23 at 19:23 +0200, james list wrote: > I tried the port-security feature with a fake mac address to see what > happens, port got "not connect" and I'm not able to recover. > > Could it be the device connected went in the same status ? It's an > old server... > > Any idea is apprec

Re: [c-nsp] mac filter on switch

2017-05-23 Thread Peter Rathlev
> 2017-05-23 17:01 GMT+02:00 Peter Rathlev : > > Maybe "switchport port-security" with static addresses will do what > > you want? On Tue, 2017-05-23 at 17:33 +0200, james list wrote: > it seems fine, do you have an idea if it's possible to use the mask > for the mac ? > > Something like: > > ma

Re: [c-nsp] mac filter on switch

2017-05-23 Thread james list
I tried the port-security feature with a fake mac address to see what happens, port got "not connect" and I'm not able to recover. Could it be the device connected went in the same status ? It's an old server... Any idea is appreciated. Cheers James 2017-05-23 17:01 GMT+02:00 Peter Rathlev :

Re: [c-nsp] mac filter on switch

2017-05-23 Thread james list
Hi it seems fine, do you have an idea if it's possible to use the mask for the mac ? Something like: mac access-list extended secure-mac permit 40aa.zz00. .00ff. any It seems I've to list all the mac address and is not possible to use a mask. Cheers 2017-05-23 17:01 GMT+02:00 Pete

Re: [c-nsp] mac filter on switch

2017-05-23 Thread Peter Rathlev
On Tue, 2017-05-23 at 15:22 +0200, james list wrote: > I’ve a customer switch C3750 (12.2(35)), is there a way to permit on > a specific port only a group of mac address which could generate > traffic towards the switch ? > > I’ve tried mac acl but I do not get the expected result. MAC ACL only f

[c-nsp] mac filter on switch

2017-05-23 Thread james list
Dear experts, I’ve a customer switch C3750 (12.2(35)), is there a way to permit on a specific port only a group of mac address which could generate traffic towards the switch ? I’ve tried mac acl but I do not get the expected result. Any idea, example or www reference is appreciated. Thanks in

Re: [c-nsp] vrrpv3 + IPv6 hangs in INIT state

2017-05-23 Thread Nick Hilliard
Rolf Hanßen wrote: > I just tried to get VRRP + IPv6 running on a Sup2T with 15.1(2)SY1. > I enabled VRRPv3 and it works at least for IPv4. Yeah, this caught me too. The primary ipv6 address for a vrrpv3 needs to be an ipv6 link-local address: > http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/i

Re: [c-nsp] Why WiSM appears to ignore IPv6 ACLs that should override interface ACLs?

2017-05-23 Thread Christopher Werny
Hi, which code version are you currently running? I have a similar setup where I get rid of all the link local multicast packets (mDNS/LLMNR etc.) as we do not have any use case for them. The IPv6 (and IPv4) ACL is working fine. The only difference to the configuration example is that I have bound

[c-nsp] Why WiSM appears to ignore IPv6 ACLs that should override interface ACLs?

2017-05-23 Thread Matti Saarinen
Hi, Has anyone managed to get IPv6 ACLs working on WiSM/WLC? I followed the instruction described here: http://www.cisco.com/c/en/us/support/docs/wireless/aironet-1100-series-access-point/113443-cuwn-apple-bonjour-dg-00.html#block but I wasn't able to get a working setup. My aim is to prevent

Re: [c-nsp] Best practise/security design for BGP and OSPF

2017-05-23 Thread Saku Ytti
On 23 May 2017 at 13:06, wrote: > Router listening for all IS m-cast MAC addresses on all interfaces rather > than solely on interfaces actually configured with ISIS seems like a bug. Not all HW support per-port punt-masks. So if you have to punt ISIS frames on one interface, you may need to p

Re: [c-nsp] Best practise/security design for BGP and OSPF

2017-05-23 Thread adamv0025
> Saku Ytti [mailto:s...@ytti.fi] > Sent: Tuesday, May 23, 2017 10:11 AM > > On 23 May 2017 at 12:00, wrote: > > Hey, > > > Regarding OSPF, > > Best security is to use it solely for routing PE loopbacks (i.e. no > > connectivity outside the core). > > But because it's IP, you might receive sp

Re: [c-nsp] Best practise/security design for BGP and OSPF

2017-05-23 Thread Saku Ytti
On 23 May 2017 at 12:00, wrote: Hey, > Regarding OSPF, > Best security is to use it solely for routing PE loopbacks (i.e. no > connectivity outside the core). But because it's IP, you might receive spooffed packet further down the line and believe you received it from far-end. So OP's question

Re: [c-nsp] Best practise/security design for BGP and OSPF

2017-05-23 Thread adamv0025
> CiscoNSP List > Sent: Tuesday, May 23, 2017 7:45 AM > > Hi Everyone, > > Just doing a bit of a refresh of our current bgp+ospf templates to ensure > they are inline with todays "best pracitse" > > (I have googled this, but majority of the exmaples are from circa 2012 or > earlierso hoping