Re: [c-nsp] Cisco ASR 9k and Windows RADIUS server

2016-05-04 Thread Mick O'Rourke
Working on XR 4.3.2 with Microsoft NPS/Radius here. The only special config required was on the NPS side was an attribute specifying the IOS XR IE task group. Nothing special was required on the XR side - your config looks very similar to what we use. Mick On 4 May 2016 09:31, "David Wilkinson"

Re: [c-nsp] VASI support on ASR920

2015-09-23 Thread Mick O'Rourke
gt; > kind regards > Pshem > > > On Thu, 24 Sep 2015 at 13:09 Mick O'Rourke wrote: > >> Hi, >> >> Is anyone able to confirm if VASI is supported on the ASR920 currently, if >> there are plans for it to be and or if there is a

[c-nsp] VASI support on ASR920

2015-09-23 Thread Mick O'Rourke
Hi, Is anyone able to confirm if VASI is supported on the ASR920 currently, if there are plans for it to be and or if there is a potential or equivalent way to achieve the same result on the 920? Cheers, Mick ___ cisco-nsp mailing list cisco-nsp@puck.

Re: [c-nsp] static nat from vrf to global

2014-04-22 Thread Mick O'Rourke
Have you had a look at VASI and or nat match-in-vrf? On 22 April 2014 18:30, Vladimir Buyalsky wrote: > Hi all. > > I have ASR-1001 with two inet-channels and two default gateways. One from > them i have put in VRF. > Port, which connected to lan, and second channel belong global routing > t

Re: [c-nsp] BGP session going down during DDOS

2014-03-09 Thread Mick O'Rourke
Out of interest, are your transit access interfaces sub-rate? On 10 March 2014 06:41, redscorpion69 wrote: > The BGP session went down, and stayed down for about 3 min, as if there was > a problem for TCP to establish a session back on. It happened during DDOS, > before and after that this sess

Re: [c-nsp] Unique issue which is not making any sense, maybe not even Cisco related...

2014-03-02 Thread Mick O'Rourke
We've seen similar sounding problems before. A couple of suggestions for things to look at: The default F5 config is auto last hop ie. it will forward to the MAC address of the SVI from which the traffic originated not the HSRP for return traffic by default. Look for potential dynamic return path

Re: [c-nsp] Netflow collector location

2013-04-19 Thread Mick O'Rourke
What are you doing with the data? In past roles we've had central collectors 400ms away from exports (UK) as the data was only for support\ease of troubleshooting purposes. The data was classified\tagged\queued etc in a particular way to travel across the WAN along with voice and other business c

Re: [c-nsp] data center/mpls/vpls

2013-04-16 Thread Mick O'Rourke
Wouldn't go near a 9000v it for a data centre deployment on AC power - no dual AC option. On Tue, Apr 16, 2013 at 9:14 PM, Gabor Szabo (gabszabo) wrote: > Hi Aaron, > > Have you checked the ASR9K nV Satellite feature with 9000v which can be > placed physically as TOR device but works as a remot

Re: [c-nsp] ASR1001 which memory RP1 oder RP2 ???

2013-03-22 Thread Mick O'Rourke
Hi Chris, We use an 8GB chip in 1001's. He's a comparison of a default 4GB 1001 with similar output to yours vs another 1001 with 8GB. ASR1001 with 4GB memory #sh version | inc mem cisco ASR1001 (1RU) processor with 1188910K/6147K bytes of memory. 32768K bytes of non-volatile configuration memor

Re: [c-nsp] ASA 8.4 NAT weirdness...

2013-02-17 Thread Mick O'Rourke
My experience is similar, I'd never recommend and upgrade to anyone from 8.2 to 8.3+ as the upgrade scripts for larger configs are imho more pain then they are worth. A once what felt an efficient and supportable config becomes the complete opposite. Do it in the lab prior and fix all the upgrade s

Re: [c-nsp] Connect directly for IPTransit?

2013-02-16 Thread Mick O'Rourke
As a content network we do it directly for both 10GigE transit and 1GigE transit into out 1k's and 9k's. One of our up streams runs both 1k's and 9k's as well, but they terminate customer access at switching layer port running sub nits per customer. It works just as well as what we do given the re

Re: [c-nsp] ASA limit for number of policies

2013-02-06 Thread Mick O'Rourke
This link has some detail on maximum connection profiles vs maximum VPN tunnels http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_groups.pdf But i didnt see anything looking quickly on group policy - which is what I assume your referring to by policy? You've probably hea

Re: [c-nsp] recommendation for upgrade-paths pls

2012-12-19 Thread Mick O'Rourke
What are you Cisco SP account team suggesting? I can't speak on the C2851 replacement side of things or the 760x, but I can offer something small on 1k's as border\transit routers. Price doesn't seem to be hugely different between the ESPs 10/20/40. If your looking at multi-gig - at assume sub-r

Re: [c-nsp] BGP prepend with route-map in input

2012-12-12 Thread Mick O'Rourke
set origin igp > set as-path prepend 1234 > ! > > The function of it is to balance traffic for a particular HA scenario by > matching a particular as-path, adding a pre-pend and doing some other things > with MED values. > > > > > On Wed, Dec 12, 2012 at 1

Re: [c-nsp] BGP prepend with route-map in input

2012-12-12 Thread Mick O'Rourke
, adding a pre-pend and doing some other things with MED values. On Wed, Dec 12, 2012 at 10:16 PM, Mick O'Rourke wrote: > It does yes. > On Dec 12, 2012 9:54 PM, "Riccardo S" wrote: > >> >> Hi >> >> Does it works BGP prepending applied >> wit

Re: [c-nsp] BGP prepend with route-map in input

2012-12-12 Thread Mick O'Rourke
It does yes. On Dec 12, 2012 9:54 PM, "Riccardo S" wrote: > > Hi > > Does it works BGP prepending applied > with a route-map in incoming direction ? > I admit I saw it only in outbond > direction…. > > > > ie: > > router bgp 65221 > > neighbor 10.111.232.62 remote-as > 65010 > > neighbor 10.111.2

Re: [c-nsp] NTP Servers

2012-06-22 Thread Mick O'Rourke
Hi Andrew, How many clients will associate? And how critical is it? We run a couple of older/retired 1841 as ntp on IOS 15, stratum 2/3 - they don't do anything else but do a good enough job with a few thousand clients. On Jun 23, 2012 9:17 AM, "Andrew Miehs" wrote: > Hi Guys > > Perhaps a litt

Re: [c-nsp] Stacking 3750X vs diverse 4948E

2012-05-22 Thread Mick O'Rourke
The X = a Sup7 in a box. 55k MAC. 128k ACL. 60 odd etherchannels and vrfs. Same same. There was a nice thread with detail from the Cisco product manager here on it a while back. On May 23, 2012 7:04 AM, "Mark Tinka" wrote: > On Tuesday, May 22, 2012 10:51:15 PM Gert Doering wrote: > > > Pure L2

Re: [c-nsp] Stacking 3750X vs diverse 4948E

2012-05-19 Thread Mick O'Rourke
> The 3750X is relatively new so I've only seen a few of them. Stackwise in > general is pretty solid. I've never seen a whole stack fail. If a member > fails the stack just keeps going, if the master tails a new master is > elected. For the most part my experience is in-line with the above, y

Re: [c-nsp] AnyConnect 3.x certificate auth prompts

2012-02-23 Thread Mick O'Rourke
If your talking Windows 32 and 64bit I've had the same issues over the years albeit it was by far the minority of machines that would have problems: - The easiest work-around in the end has been to use AnyConnect 2.3, 2.4 onwards to 3.x have all had the same result. - Different result re: clicking

Re: [c-nsp] Cisco ASA and ipads

2012-01-30 Thread Mick O'Rourke
Had a look 6-12 months ago. At the time there were some good MDM options externally or internally managed that could be combined with AnyConnect always on VPN for Ipads Iphones etc. All combined well with any potential BYOD corp policy. It's an interesting space. Well worth having a chat to your T

Re: [c-nsp] general nat issue (not cisco)

2011-06-25 Thread Mick O'Rourke
Is proxy arp is disabled on the ASA? On 26/06/2011, Pete Lumbis wrote: > On Sat, Jun 25, 2011 at 8:49 PM, Aaron Riemer wrote: > >> How does the cisco ASAs take care of this problem? >> >> >> >> > The ASAs "own" the address so they will respond to any ARP requests for NAT > addresses. > _