Re: [c-nsp] How to terminate 100.000 IPsec VPN clients?

2011-09-08 Thread Kenny Sallee
On Thu, Sep 8, 2011 at 12:05 PM, Eugeniu Patrascu wrote: > On Fri, Sep 2, 2011 at 16:55, Florian Bauhaus > wrote: > > Hello, > > > > What would be the best way to terminate 100k IPsec VPN clients? > > > > Use a 6500/7600 with appropriate modules? Put 10 ASA5580-20 in a rack? > > How to manage the

Re: [c-nsp] Cisco BGP Advertised as-path prepends

2011-08-07 Thread Kenny Sallee
On Sun, Aug 7, 2011 at 9:59 PM, Joseph Hardeman wrote: > Hey Guys, > > I have a question regarding displaying the as-path prepends that I am > announcing to my providers. With a foundry I could display the prepends > that I am announcing out, but I don't seem to be able to do that with the > Cisc

Re: [c-nsp] Weird Frame-relay / L3 connectivity problem

2011-06-09 Thread Kenny Sallee
On Thu, Jun 9, 2011 at 1:38 AM, Ibrahim Abo Zaid wrote: > Hello Kenny > > what was Cisco reply for this problem ? > > > Thanks > Ibrahim Abo Zaid , CCIE#27702 > > > Good question - we moved off frame-relay to HDLC and have not had the problem since. Last time I spoke with the Qwest engineers they

Re: [c-nsp] BGP neighbor not establishing session

2010-11-22 Thread Kenny Sallee
On Sun, Nov 21, 2010 at 6:26 PM, Lobo wrote: > I've tried searching around for this problem but haven't found much info. > > We upgraded some 7301 routers the other night and there are a couple of > neighbors which have not been able to re-establish themselves. Debugging > from one of the router

Re: [c-nsp] ASR QoS

2010-10-27 Thread Kenny Sallee
On Wed, Oct 27, 2010 at 9:59 AM, Jaquish, Bret wrote: > Does anyone know if the ASR routing platform does network shaping at the > microsecond level and what the minimum value is of Tc or the shaping window? > > The ASR QoS is fairly complicated from what I've read about and I don't have the direc

Re: [c-nsp] mpls route target export question

2010-08-05 Thread Kenny Sallee
> ack, the "import " option is very important. You don't actually need > the "ibgp unequal-cost" with it, unless you want to do unequal-cost ibgp > load-sharing. > > In newer releases (where the import code was rewritten), the command is > "import path limit " > >oli > > Very cool discussio

Re: [c-nsp] routing between VRF and global

2010-08-05 Thread Kenny Sallee
> > The tunnel source and destination are between different loopbacks > > within the global table, but one end of the tunnel is within the > > global and one end within the VRF table. You might be able to NAT > > across the GRE tunnel. > This is a pretty cool config, but I'm having a hard time see

Re: [c-nsp] mpls route target export question

2010-08-04 Thread Kenny Sallee
Here's my interpretation / explanation: In order to get a route into a VRF there needs to be some type of tag the router can use to determine which routes to import into a particular VRF. This is done with route-target export command. In a particular vrf you'd route-target import what was exporte

Re: [c-nsp] routing between VRF and global

2010-07-16 Thread Kenny Sallee
I solved this problem (leaking routes from VRF to global route table) by creating a 'VRF' that is the 'global' route table. The cisco solution is like you mentioned (GRE, Cable loopage, or static routes - none that I liked). So it physically looks like this: MPLS WAN Frame DS3 w/ many PVCs (for

Re: [c-nsp] QoS Bandwidth percent vs bandwidth remaining percent

2010-07-13 Thread Kenny Sallee
On Tue, Jul 13, 2010 at 12:45 PM, Andriy Bilous wrote: > Multilink. As members come and go you could still have your bandwidth > "slices" proportional to the actual bandwidth available at any given > time. > > Ah yes - very good point ___ cisco-nsp maili

[c-nsp] QoS Bandwidth percent vs bandwidth remaining percent

2010-07-13 Thread Kenny Sallee
So - I've research the difference between the 'bandwidth percent' and 'bandwidth remaining percent' commands with regards to configuring a policy-map on a Cisco router. There are some good links to folks who have the theory behind each command: Cisco: http://www.cisco.com/en/US/tech/tk543/tk757/t

Re: [c-nsp] ASR1002

2010-06-29 Thread Kenny Sallee
On Thu, Jun 24, 2010 at 3:36 AM, Rens wrote: > Did anyone actually give any recommendations? > I'm looking for the same advice to run BGP, OSPF & maybe L2TPv3 later > > Hi Rens - sorry for late reply as I was on vacation. I'm running asr1000rp1-adventerprisek9.02.05.00.122-33.XNE.bin on 2 ASR 10

Re: [c-nsp] dynamic global-vrf leaking

2010-05-25 Thread Kenny Sallee
You could use VRF's for all interfaces and RT import/export the routes between VRF's - even the 'global routes'. Use import-map's to control what routes make it into each VRF. You'll need to run MP-BGP to make it work. I basically do this where I work (different scenario but same concept). Kenn

Re: [c-nsp] cost community alternatives

2010-04-14 Thread Kenny Sallee
What if you used a different routing protocol on the backdoor link and redistributed (carefully) between EIGRP and the diff routing protocol on the backdoor router at each location? You'd have external EIGRP routes everywhere then and could create different seed metrics at the MPLS border (CE rout

Re: [c-nsp] Weird Frame-relay / L3 connectivity problem

2010-04-12 Thread Kenny Sallee
> > > > What's the providers take on this? The problem initially appears to be > in their end according to what you write. > > -- > Peter > > > I've worked with the provider and Cisco today. Looks like perhaps a new(?) bug that has to do with the way the provider applied QoS and our request to use

Re: [c-nsp] BGP as-path access list question on 1841 routers

2010-04-10 Thread Kenny Sallee
t will use the route refresh capability without any extra > configuration or memory use. > > Leah > > -Original Message- > From: cisco-nsp-boun...@puck.nether.net > [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Kenny Sallee > Sent: Thursday, April 01, 2010

[c-nsp] Weird Frame-relay / L3 connectivity problem

2010-04-10 Thread Kenny Sallee
So - I'm having a problem w/ an MPLS provider. We have a Cisco 2851 w/ 124-15.T12.bin on it. Doing basic frame-relay to an MPLS cloud (just frame-really encapsulation). Router is running WCCP for WaaS, BGP routing, some NAT stuff... Here's the problem - over the last couple days - at random - w

Re: [c-nsp] BGP as-path access list question on 1841 routers

2010-04-01 Thread Kenny Sallee
You don't need to specify the 'soft-reconfiguration' under the bgp neighbor but I believe you still should do a clear ip bgp nei soft in|out or clear ip bgp nei soft in|out Kenny On Thu, Apr 1, 2010 at 11:45 AM, Dan Goldberg wrote: > > I left out a detail that may be important: > This is o

Re: [c-nsp] MPLS VPN Running BGP w/ failover IPSec VPN Over Internet

2010-01-27 Thread Kenny Sallee
Why not an IGP on the backup link, BGP over MPLS, and eBGP peer from your 'MPLS' router to your core network? All of your MPLS routes will be eBGP w/ admin of 20 and depending on what IGP you choose it'll have a higher admin distance. Normal ops BGP routes are preferred. If MPLS goes away IGP rou

Re: [c-nsp] BGP to OSPF redistribution

2010-01-13 Thread Kenny Sallee
> > > Is there a way to redistribute BGP into OSPF so that the routes can be > anything but OSPF external? > > I thought (tho it's been a while and I don't have time to research) that you could use a route-map to match external OSPF routes and set them to internal BGP. I think it would look someth

Re: [c-nsp] BGP Peer Group drawbacks???

2010-01-10 Thread Kenny Sallee
On Sat, Jan 9, 2010 at 10:05 PM, Marko Milivojevic wrote: > > Seems to me that peer/session templates would allow you to get more > granular > > with your BGP configuration then peer-groups due to > > their inheritance feature. So it makes sense to me. > > >Well... comparing peer-groups and tem

Re: [c-nsp] BGP Peer Group drawbacks???

2010-01-09 Thread Kenny Sallee
> > > 1998 called, it wants its release notes back. The modern version you > > should be using instead of peer groups is bgp templates: > > ...What...? ...Why? > > At what scale should one consider dumping peer-group? When should one > switch to templates? How about a mix of groups AND templates? >

[c-nsp] ASR1002

2010-01-06 Thread Kenny Sallee
Anyone have recommendations on solid IOS XE code for ASR 1002 that's just doing: - BGP - VRF's - Many sub-interfaces and ACL's It shipped with 02.04.02.122-33.XND2.bin Thanks, Kenny ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.net

Re: [c-nsp] VRF->Global route leaking in multi-VRF CE installation

2010-01-06 Thread Kenny Sallee
On Wed, Jan 6, 2010 at 9:05 AM, Ross Vandegrift wrote: > On Wed, Jan 06, 2010 at 10:57:39AM -0600, Cory Ayers wrote: > > Have you looked at using two interfaces to loop traffic with one > > interface in the global table and one in the VRF? You could run two > > different OSPF processes to transp

Re: [c-nsp] MPLS Multi-AS options...

2009-11-09 Thread Kenny Sallee
Hi Jimmi - thanks for sharing - some comments / questions inline below On Mon, Nov 9, 2009 at 10:07 AM, jimmi wrote: > > Folks. > > I read these papers long time ago, so I do not remember anymore exactly > what > this options labels (A, B, AB,...) definition means. > Quick recap for you: Option

[c-nsp] MPLS Multi-AS options...

2009-11-05 Thread Kenny Sallee
So I'm reading this document from Cisco: http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_vpn_ias_optab.html and http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_vpn_connect_asbr.html as well as RFC 4364 section 10 "Multi-AS Backbones". I'm wondering if anyone is