Re: [c-nsp] Cisco NCS VxLAN Experience

2020-01-09 Thread Peter Rathlev
On Wed, 2020-01-08 at 18:53 +0200, Alex K. wrote: > A customer of mine's interested in acquiring some NCS boxes, in order > to aggregate all their servers with few NCSes as possible and p2p > connect between them (actually between few small DCs), using VxLAN. I can't seem to find anything on NCS

[c-nsp] ASR 920 Netflow limitations (was: Cisco 8000)

2019-12-19 Thread Peter Rathlev
/www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/netmgmt/16-12-1/b-fnf-xe-16-12-asr920.html#id_26881 -- Peter Rathlev ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp

Re: [c-nsp] Was RFC1213-MIB removed in IOS 15?

2019-11-30 Thread Peter Rathlev
On Fri, 2019-11-29 at 16:07 +, Drew Weaver wrote: > Was just doing some SNMP poking around on IOS 15 and noticed that > RFC1213 seems to not be there anymore. > > Is there a direct replacement for RFC1213-MIB::ipRouteType that is > accessible like this: ipRouteType.NetworkAddr ?? > > I see

[c-nsp] ASR 920 Netflow timestamps?

2019-06-12 Thread Peter Rathlev
We have deployed a handful of ASR 920 routers and are collecting Netflow from them with NFsen. It seems to work okay apart from the timestamps in the Netflow records. The are all just epoch start. Looking at a packet capture and having Wireshark decode it with the "CFLOW" dissector shows that the

Re: [c-nsp] QinQ termination on a Catalyst 6800

2019-02-18 Thread Peter Rathlev
On Mon, 2019-02-18 at 20:14 +, Tom Hill wrote: > On 14/02/2019 09:01, Christophe Fillot wrote: > > Anyone knows if this platform supports QinQ termination ? > > > > The "encapsulation dot1q X second-dot1q Y" command is not present, > > but > > maybe there is another way to do it ? > > EVCs?

Re: [c-nsp] eem-script problem

2019-01-04 Thread Peter Rathlev
On Fri, 2019-01-04 at 00:34 +0100, Peter Rathlev wrote: > When testing on IOS 15.2 it seems that the regular expression has an > implicit anchor in the beginning ("^"). If you don't mind the extra > whitespace in front of the result then a short version is: > >

Re: [c-nsp] eem-script problem

2019-01-03 Thread Peter Rathlev
On Thu, 2019-01-03 at 11:30 +0100, Robert Hass wrote: > event manager applet blah2 authorization bypass > event syslog pattern "%CLEAR-5-COUNTERS: .*" > action 0.01 syslog msg "blah2 script" > action 0.02 cli command "enable" > action 0.03 cli command "term exec prompt timestamp" > action

Re: [c-nsp] ISR (or ISR-like) router with dual SIM?

2018-11-29 Thread Peter Rathlev
Thank you for the input. So it seems there is an ISR1000 router with dual modems, the C1109-4PLTE2P Bjørn mentions. I'll look into that. I can see from the configuration guides that the other models that claim "Dual SIM Support" can only do failover. Expected failover time is in minutes. Joel's

[c-nsp] ISR (or ISR-like) router with dual SIM?

2018-11-27 Thread Peter Rathlev
Anyone know of a router that has the flexibility of and ISR, i.e. where I can do stuff like GRE-in-GRE+IPSec, and can have two cellular data connections via two SIMs from different providers? For some years we have used an ISR C1941W router in a mobile blood donor truck. We have been very

Re: [c-nsp] OSPF+BGP and MPLS Q's

2018-07-23 Thread Peter Rathlev
On Mon, 2018-07-23 at 12:23 +0200, ring...@mail.com wrote: > Anyone else can give an opinion to those three questions? Opinions are easy to give. :-) Authority is a different question altogether. I spend my daytime in a place that started with just 6 PE routers and has slowly grown to 51 over

Re: [c-nsp] spanning-tree for local switching on ASR920

2018-03-15 Thread Peter Rathlev
On Thu, 2018-03-15 at 13:29 +, Nick Cutting wrote: > In the output of show spanning tree - is the port with the untagged > service instance forwarding on vlan 4093? > Unless something changed from 16.6 -> 16.7 I imagine that it is only > forwarding and processing BPDU's on vlans 2 and 10.

Re: [c-nsp] spanning-tree for local switching on ASR920

2018-03-15 Thread Peter Rathlev
For what it's worth I have working Rapid PVST+ on ARS 920 IOS 16.7.1 with the following configuration: spanning-tree mode rapid-pvst spanning-tree vlan 2,10,2302 priority 24576 ! interface TenGigabitEthernet0/0/25 description => Towards HP 5700FF mtu 9216 no ip address load-interval 30

Re: [c-nsp] [j-nsp] Meltdown and Spectre

2018-01-08 Thread Peter Rathlev
On Mon, 2018-01-08 at 10:01 +0100, Gert Doering wrote: > On Mon, Jan 08, 2018 at 09:32:23AM +0100, Thilo Bangert wrote: > > The idea of having secure individual logins goes down the drain > > with Meltdown and Spectre. You want to be sure that a person logged > > into a box cannot snoop the

Re: [c-nsp] spanning-tree for local switching on ASR920

2017-10-18 Thread Peter Rathlev
On Wed, 2017-10-18 at 15:39 +0200, Gert Doering wrote: > I have an ASR920 that is supposed to have gi0/0/10 and gi0/0/11 in > the same bridge group, with a routed IP: > > interface GigabitEthernet0/0/10 >  no ip address >  media-type auto-select >  negotiation auto >  cdp enable >  service

Re: [c-nsp] mac filter on switch

2017-05-23 Thread Peter Rathlev
On Tue, 2017-05-23 at 19:23 +0200, james list wrote: > I tried the port-security feature with a fake mac address to see what > happens, port got "not connect" and I'm not able to recover. > > Could it be the device connected went in the same status ? It's an > old server... > > Any idea is

Re: [c-nsp] mac filter on switch

2017-05-23 Thread Peter Rathlev
> 2017-05-23 17:01 GMT+02:00 Peter Rathlev <pe...@rathlev.dk>: > > Maybe "switchport port-security" with static addresses will do what > > you want? On Tue, 2017-05-23 at 17:33 +0200, james list wrote: > it seems fine, do you have an idea if it's poss

Re: [c-nsp] mac filter on switch

2017-05-23 Thread Peter Rathlev
On Tue, 2017-05-23 at 15:22 +0200, james list wrote: > I’ve a customer switch C3750 (12.2(35)), is there a way to permit on > a specific port only a group of mac address which could generate > traffic towards the switch ? > > I’ve tried mac acl but I do not get the expected result. MAC ACL only

[c-nsp] C6k fabric drops

2017-04-19 Thread Peter Rathlev
Hi all, Sorry for this long tedious post. I'm investigating fabric drops on a C6k switch. I see data that confuses me and it's my hope that someone else have gone through similar troubleshooting with more success. :-) It's a C6509-V-E chassis with a single Sup2T (non-XL). Fabric drops are

Re: [c-nsp] TCAM Utilization

2017-04-19 Thread Peter Rathlev
On Wed, 2017-04-19 at 09:16 +, Mohammad Khalil wrote: > Actually my customer wants to use the latest release in the train  This is something one should recommend to competitors. ;-) > We found a command : > show platform hardware fed switch 1 fwd-asic resource tcam > utilization Nice,

Re: [c-nsp] TCAM Utilization

2017-04-19 Thread Peter Rathlev
On Mon, 2017-04-17 at 11:43 +, Mohammad Khalil wrote: > I have Cisco 3650 switch with Denali version 16.03.03 > > I cannot find the command show platform tcam utilization asic all , > anyone aware of the equivalent ? I tried "upgrading" a 3650 to 16.3.3 and I can also not find any equivalent

Re: [c-nsp] Nexus OIDs

2017-02-27 Thread Peter Rathlev
On Mon, 2017-02-27 at 09:07 -0600, Mike Hammett wrote: > I did an SNMPWalk of two of my Nexus switches looking for what has > the model and serial numbers. I found several, sometimes with > slightly different information. The MIBs on Cisco's site don't go > down this far either. I was wondering if

Re: [c-nsp] Rec for full-table multi-peer bgp router?

2016-11-30 Thread Peter Rathlev
On Wed, 2016-11-30 at 17:43 +0100, Gert Doering wrote: > On Wed, Nov 30, 2016 at 04:41:29PM +, David Hubbard wrote: > > [...] > ASR9001 sounds like it would do what you want (goes up to 12x 10GE, > though only 4 of them are SFP+, the rest is XFP).  Fastest BGP > implementation I've ever seen

Re: [c-nsp] Using MPLS PEs as gateways for access layer

2016-11-30 Thread Peter Rathlev
On Wed, 2016-11-30 at 11:38 -0500, Ryan L wrote: > One other question I have been having with this is, I'll obviously > have some L2 adjacency for my FHRP between the two cores, but should > I also be running an IGP within each DC between the two on the > private VRF? I don't have any other routed

Re: [c-nsp] Using MPLS PEs as gateways for access layer

2016-11-30 Thread Peter Rathlev
On Tue, 2016-11-29 at 19:14 -0500, Ryan L wrote: > Is it somewhat accepted design to run L3VPN in a scenario where the > PEs in DC1 are vrrp active/standby for DC1 VLANs in all VRFs, and the > PEs in DC2 are active/standby for DC2 VLANs in all VRFs, and so on? > From each PE, there'd be a layer 2

Re: [c-nsp] 720-3BXL IOS 15

2016-11-16 Thread Peter Rathlev
On Tue, 2016-11-15 at 15:35 -0500, Curtis Piehler wrote: > Does anyone have any suggested 15.x Versions for the 720-3BXL Cards? > I have a couple of 7606 routers that have a need to run BFD + BGP > within a VRF Instance. The current 12.2(33)SRB3 does not allow this. For what it's worth we are

Re: [c-nsp] IOS/6500 SNMP to detect IPv6 address on a VLAN

2016-09-28 Thread Peter Rathlev
On Wed, 2016-09-28 at 13:21 +, Drew Weaver wrote: > I'm trying to programmatically detect whether or not there is already > an IPv6 address assigned to an SVI/VLAN on a Cat 6500 (IOS). > > Obviously, I can write a snippet that does show run int vlan X and > parse that, but a more elegant way

Re: [c-nsp] Cat6500 VLAN cannot be assigned to a routed port sub-if?

2016-09-19 Thread Peter Rathlev
On Mon, 2016-09-19 at 11:39 +0200, Anders Löwinger wrote: > Sup2t has support in HW for using same VLAN-id on different L3  > interfaces. Cisco has no SW to support it :( Just to be crystal clear: Sup2T hardware and software fully supports using same VLAN ID on different interfaces, and you can

Re: [c-nsp] Cat6500 VLAN cannot be assigned to a routed port sub-if?

2016-09-19 Thread Peter Rathlev
On Sat, 2016-09-17 at 14:24 +0200, Łukasz Bromirski wrote: > > On 16 Sep 2016, at 17:32, Nick Cutting wrote: > > Depends on supervisor - With sup 2t - you could reuse vlans on > > subinterfaces, here is 2 subinterfaces on different ports, and an > > SVI all on vlan 281 > > > > ! > > interface

Re: [c-nsp] 3850 and output drops

2016-09-06 Thread Peter Rathlev
On Tue, 2016-09-06 at 18:48 +0200, Sebastian Beutel wrote: > Everything started when a co-worker tried to troubleshoot a rapidly > increasing output error counter on a 3850 Switchport. What kind of interfaces are these? Would it perhaps be downlink interfaces that connect at a lower rate than the

Re: [c-nsp] cisco ios dhcp server - option 60 assistance needed

2016-09-01 Thread Peter Rathlev
On Wed, 2016-08-31 at 18:03 -0500, Aaron wrote: > I'm trying to use option 60 for stirring an avaya ip phone into a > certain > dhcp pool.  Not working.  > > I want the avaya phone to get ip's from the vlan-phones pool below > (10.0.16.0/22) but it won't How are the two subnets configured? Are

Re: [c-nsp] ASR 920 and Rosen multicast VPN?

2016-08-16 Thread Peter Rathlev
On Thu, 2016-08-11 at 23:13 +0200, Mark Tinka wrote: > On the migration, Juniper proposed an architecture to cleanly > transition a network from Rosen to NG-MVPN. The talk was given by > Emil Gagala at PLNOG in Warsaw in 2010. You can find the link here: > >    >

Re: [c-nsp] ASR 920 and Rosen multicast VPN?

2016-08-11 Thread Peter Rathlev
On Thu, 2016-08-11 at 13:39 +, michalis.bersi...@hq.cyta.gr wrote: > We use the asr920 with the draft rosen implementation with success > with 3.18S IOS Release. Please be aware that you need to change the > SDM profile to video for this to work, but it changes the TCAM > resources in favor of

Re: [c-nsp] ASR 920 and Rosen multicast VPN?

2016-08-11 Thread Peter Rathlev
On Thu, 2016-08-11 at 14:26 +0200, Fredrik Vöcks wrote: > MVPN Rosen + MDT Data is supported since 3.17. > > http://www.cisco.com/c/en/us/td/docs/routers/asr920/release/notes/ASR920_rel_notes/new_features.html#78981 Thank you. The linked configuration guide does look a lot like the way we

[c-nsp] ASR 920 and Rosen multicast VPN?

2016-08-11 Thread Peter Rathlev
We're looking at buying some ASR 920s but are not sure if they would work in our current "Draft Rosen" multicast VPN network. We're generally using 6500 Sup2T and these cannot currently (at least up to IOS 15.2) run mLDP. Replacing the Sup2Ts is a much more complex task that we cannot undertake

Re: [c-nsp] Issue with port-channel hashing

2016-07-25 Thread Peter Rathlev
On Sun, 2016-07-24 at 07:46 +0200, james list wrote: > where can I find the exact alghorithm for the load balancing > decision? Run "show etherchannel load-balance" to see the currently configured hashing mode. (You cannot see the actual algorithm that way, but it's probably "just" values XOR'ed

Re: [c-nsp] CPUHOG and UDLD

2016-07-25 Thread Peter Rathlev
On Thu, 2016-07-21 at 13:05 -0700, Jason Berenson wrote: > Has anyone seem this before? > > 23:30:35.431: %SYS-SP-3-CPUHOG: Task is running for (340)msecs, > morethan  > (28)msecs (232/231),process = UDLD Pseudo Preemption Process. > Jul 19 16:30:37 router.name 290333: -Traceback=

Re: [c-nsp] Netflow with nfsen issue

2016-07-03 Thread Peter Rathlev
On Fri, 2016-07-01 at 12:39 -0400, Satish Patel wrote: > I have following network configured on Cisco ASR1000 but i am seeing > wrong date on nfsen, does anyone experience this issue? > > Should i use ipfix or Netflow v9 ?   I did capture wireshark and its > showing correct date and time. > >

Re: [c-nsp] DCI interconnects at L2 vs Encapsulated spanned Vlan

2016-04-21 Thread Peter Rathlev
On Tue, 2016-04-19 at 08:12 +, Nick Cutting wrote: > If you use a L2 tunneling protocol over a L3 DCI - does this mitigate > all the L2 risks of a data centre interconnect? Not as such. The tunnelled packets have a TTL header and loops in the core are thus less of a problem, but L2 loops

Re: [c-nsp] MTU size, fragmentation and drops

2016-04-15 Thread Peter Rathlev
On Fri, 2016-04-15 at 02:13 +, CiscoNSP List wrote: > > Our PE cust Interface "had" MTU set to 9100 > > Cust CE WAN Interface has MTU set to 1500 [...] > Pinging from CE->PE > > So, CE would send fragmented packet at (for example) 1550PE would > receive, reassemble, and try to send at the

[c-nsp] Rapid PVSTP root re-election of "inferior" bridge

2016-04-12 Thread Peter Rathlev
The short version: When changing to an "inferior" root bridge (higher priority that current root bridge) what is the expected downtime? We shortly need to upgrade a Sup2T to 15.2(1)SY1a to be able to use C6800-16P10G modules. It functions as one of two gateways for a small- ish datacenter and is

Re: [c-nsp] Cisco Security Advisory: Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability

2016-02-15 Thread Peter Rathlev
On Wed, 2016-02-10 at 08:06 -0800, ps...@cisco.com wrote: > Cisco Security Advisory: Cisco ASA Software IKEv1 and IKEv2 Buffer > Overflow Vulnerability > > Advisory ID: cisco-sa-20160210-asa-ike Poor bastards stuck at 8.2 (like us) might be relieved to know that there actually is a 8.2(5)59

Re: [c-nsp] IEEE 802.1P QoS Issue........

2015-11-02 Thread Peter Rathlev
On Mon, 2015-11-02 at 08:40 +0530, Methsri Wickramarathna wrote: > I have purchased a fiber link and local ISP requested us to set Class > of Service ( CoS ) value based on the precentage level Voice , Video , > Business Critical & Best effot. Further they have requested us to > follow the IEEE

Re: [c-nsp] IEEE 802.1P QoS Issue........

2015-11-02 Thread Peter Rathlev
On Mon, 2015-11-02 at 16:29 +0100, Lukas Tribus wrote: > > , so you would have to mark on the physical interface, > > not the subinterface. > > Not so true. Just because you are on a subinterface, doesn't mean > you can't set cos values. Interesting. I was genuinely unaware of that, since I

Re: [c-nsp] NX-OS SNMP agent returns first 64 characters of interface description while CLI allows one to enter 80 characters interface descriptions

2015-10-29 Thread Peter Rathlev
On Thu, 2015-10-29 at 18:25 +0200, Martin T wrote: > However, over SNMP it returns only the first 64 characters of this 80 > characters interface description: [...] > Where does this inconsistency come from? Is there a way to increase > the amount of characters returned by NX-OS SNMP agent for

Re: [c-nsp] 1 or 2 port Console/Ethernet server

2015-10-01 Thread Peter Rathlev
On Thu, 2015-09-24 at 10:47 -0400, f287c...@opayq.com wrote: > Looking for recommendations on small 1 or 2 port ethernet-serial > terminal server. Preferably one with some security on it, and that > allows us to ssh direct to the serial port. Power control would be > an added bonus but not

Re: [c-nsp] SNMP ifLastChange > 30 days

2015-09-02 Thread Peter Rathlev
On Wed, 2015-09-02 at 17:11 +, Drew Weaver wrote: > I came across the oid ifLastChange which tracks against the 32 bit > counter sysUptime.0, the problem obviously is that when sysUptime.0 > resets ifLastChange becomes pretty much useless. > > It seems as though there would be some way to

Re: [c-nsp] Enabling ip routing on cat3750 stack

2015-08-05 Thread Peter Rathlev
On Wed, 2015-08-05 at 22:38 +0300, Artem Viklenko wrote: I expect that entering 'ip routing' shuld be non-disruptive to current L2 traffic on stack as on standalone 3750-s. Is it right? Is there some possible concerns? You should be fine, though OOB management and/or a way to cut the power

[c-nsp] TestFabricCh0Health chassis or supervisor?

2015-08-03 Thread Peter Rathlev
Hi all, We have what seems to be a slot in a WS-C6509-V-E chassis that acts up. There is a WS-X6708-10GE module sitting in the slot and it has crashed several times with the following log message: %CONST_DIAG-SP-2-HM_LC_CRSH: Module 7 crashed due to unrecoverable errors, Reason: Failed

Re: [c-nsp] effect of 'mls qos'

2015-06-02 Thread Peter Rathlev
On Tue, 2015-06-02 at 08:55 -0700, Blake Dunlap wrote: If you don't know how to set it up, and are not doing your own management of your qos, then you *really* shouldn't be turning it on. The 3560/3750 platform comes with some quite unfortunate default settings. Enabling QoS and adjusting

Re: [c-nsp] Redundant DHCP Server

2015-06-02 Thread Peter Rathlev
Hi Mohammad, On Tue, 2015-06-02 at 11:05 +0300, Mohammad Khalil wrote: Usually I rely on DHCPD package on Linux distributions to configure my DHCP server , but the issue is that my client wants his MLS to do that job That's a fair argument. We use IOS routers as DHCP servers for some remote

Re: [c-nsp] Redundant DHCP Server

2015-06-02 Thread Peter Rathlev
On Tue, 2015-06-02 at 11:32 +0100, Nick Hilliard wrote: On 02/06/2015 11:29, Peter Rathlev wrote: That's a fair argument. We use IOS routers as DHCP servers for some remote locations where deploying a server would be overkill. dhcp relay is a win in this situation. Good point. In our case

Re: [c-nsp] effect of 'mls qos'

2015-06-01 Thread Peter Rathlev
Hi Mike, On Sun, 2015-05-31 at 23:02 -0700, Mike wrote: I have a question regarding the effect of 'mls qos' on a 3560g switch, with no other configuration. I did some testing and it seemed to me that the aggregate thruput of my switch, which has 5 port channels with 2 gigE ports

Re: [c-nsp] Redundant DHCP Server

2015-06-01 Thread Peter Rathlev
Hi Mohammad, On Mon, 2015-06-01 at 13:44 +0300, Mohammad Khalil wrote: Sorry for the bad format You did an okay-ish job of making it better. :-) But you should probably consider using another mail client. Then you don't have to spend all that time making your emails readable. ... Now , when

Re: [c-nsp] effect of 'mls qos'

2015-06-01 Thread Peter Rathlev
On Mon, 2015-06-01 at 20:13 +0200, Peter Rathlev wrote: You can enable QoS and adjust the defaults to get something noticeably better than without mls qos. Take a look at this template we have been using for some time now: http://ampere.rathlev.dk/3560-3750-QoS-basis-template.txt

Re: [c-nsp] EEM Multiple Outputs

2015-05-18 Thread Peter Rathlev
On Mon, 2015-05-18 at 10:32 +0300, Mohammad Khalil wrote: Thanks very much , how can I make some space between the outputs? The puts action accepts \n, if by space you mean empty lines: event manager applet TEST-APPLET event none sync yes action 1.0 cli command show interfaces Gi1/1 | incl

Re: [c-nsp] EEM Multiple Outputs

2015-05-17 Thread Peter Rathlev
On Sun, 2015-05-17 at 12:56 +0300, Mohammad Khalil wrote: I have tried to build a script that will view multiple outputs , but it did not work for me R1#sh run | sec event manager event manager applet MULTIPLE event none sync yes action 1.0 cli command show interfaces fastEthernet 1/0 |

Re: [c-nsp] best practice for parity errors in NMS

2015-04-24 Thread Peter Rathlev
On Fri, 2015-04-24 at 10:52 +0200, selamat pagi wrote: In case of most parity errors, Cisco recommends to: ...Monitor the system regularly for reoccurrence. If no further events are observed, it is a soft error. If the error occurs frequently, request a RMA ... ... What would be a good number

Re: [c-nsp] EEM Execution Time

2015-04-23 Thread Peter Rathlev
On Thu, 2015-04-23 at 14:17 +, Adam Vitkovsky wrote: ... this kind of temper might discourage other folks to post questions which is not vital for the list. On Thu, 2015-04-23 at 11:04 -0700, Pete Templin wrote: There's a difference between an overall temper and a simple pointer that

Re: [c-nsp] Cisco IOS XR event manager run

2015-04-07 Thread Peter Rathlev
On Mon, 2015-04-06 at 15:17 +0300, Mohammad Khalil wrote: The user is created with the correct privileges and the policy is registered RP/0/RSP0/CPU0:ASR9K#event manager run backup.tcl Mon Apr 6 15:15:47.956 EET Could not run backup.tcl: policy is not registered Don't know about XR but in

Re: [c-nsp] Cisco IOS XR event manager run

2015-04-07 Thread Peter Rathlev
On Tue, 2015-04-07 at 10:46 +0300, Mohammad Khalil wrote: #Run cmds foreach cmd $commands { action_syslog priority info msg Executing: $cmd set result [ cli_exec $cli(fd) $cmd ] action_syslog priority info msg $result } RP/0/0/CPU0:XR1#event manager run test.tcl Tue Apr 7

Re: [c-nsp] 7600 vlans used with snmp-get

2015-03-23 Thread Peter Rathlev
On Mon, 2015-03-23 at 10:13 +, MKS wrote: Is there a mib / snmp operation that can give me all used vlans on a 7600 or all available vlans? Something like sh vlan internal usage but hopefully containing all used vlans. The CISCO-VTP-MIB::vtpVlanTable that Paul mentions unfortunately

Re: [c-nsp] BGP/route-map/acl question/logic...

2015-02-03 Thread Peter Rathlev
On Tue, 2015-02-03 at 09:30 +0100, Gert Doering wrote: It's hard to come up with a really useful example, but given that extended ACLs match both on prefix base and netmask with wildcards bits, this is more flexibility than you'll ever use without your brain blowing up. access-list 100

Re: [c-nsp] Enabling multicast routing on 3750G platform

2015-01-29 Thread Peter Rathlev
On Wed, 2015-01-28 at 19:57 -0500, Lobo wrote: I've moved the configuration on the switch so that the ports are routed now instead of using vlans but still no go. Does show ip igmp groups show something joined via Gi1/0/2? It probably does since mroute has Gi1/0/2 as an sparse output interface.

Re: [c-nsp] DHCP relay still forwarding to old helper even if it's removed or changed

2015-01-20 Thread Peter Rathlev
On Mon, 2015-01-19 at 21:18 +0200, Tarko Tikan wrote: I tried to change the helper address, but after making the change, the box was still routing broadcasts to the old helper. Are you 100% sure it's actually relayed traffic and not DHCP client that remembers DHCP server address and

Re: [c-nsp] DHCP Proxy

2015-01-20 Thread Peter Rathlev
On Tue, 2015-01-20 at 10:09 +0530, Ambedkar wrote: I want to send the Proxy settings includes IP address, port number through DHCP in cisco routers and switches. Is it possible to send ? If yes, How ?? Can you be a bit more precise? Do you want to forward DHCP requests on a non standard

Re: [c-nsp] DHCP Proxy

2015-01-20 Thread Peter Rathlev
On Tue, 2015-01-20 at 09:06 +0100, Peter Rathlev wrote: On Tue, 2015-01-20 at 10:09 +0530, Ambedkar wrote: I want to send the Proxy settings includes IP address, port number through DHCP in cisco routers and switches. Is it possible to send ? If yes, How ?? Can you be a bit more

Re: [c-nsp] SNMP and interface description - IOS-XR

2015-01-20 Thread Peter Rathlev
On Tue, 2015-01-20 at 19:13 +0200, Hank Nussbacher wrote: In IOS 12.2(33)SRE7a in order to read an interface description we did: snmpwalk -v 2c -c snmp read community rtr1 .1.3.6.1.4.1.9.2.2.1.1.28 [This is the Cisco specific locIfDescr] SNMPv2-SMI::enterprises.9.2.2.1.1.28.3 = STRING:

Re: [c-nsp] command that can display the dropped routes containing AS loops

2015-01-12 Thread Peter Rathlev
On Mon, 2015-01-12 at 22:17 +0800, Song Li wrote: I am curious about the AS loops in the AS-path. I think there should be a very, very few received BGP routes that contain the local AS#. But because such routes will be dropped and not installed in Loc-RIB, I want to know if there is a

Re: [c-nsp] L2 ethernet multipoint over IP?

2014-12-03 Thread Peter Rathlev
On Wed, 2014-12-03 at 14:09 +, Phil Mayers wrote: On 03/12/14 12:50, Peter Rathlev wrote: (PS: It has to be pure IP as seen from the rest of the network, so no MPLS unless it's something like MPLSoGRE.) For curiosity - why *not* MPLS? It really sounds like a job for VPLS, but you

Re: [c-nsp] Cisco 6509-V-E switch sup2t engine recommend IOS version

2014-12-02 Thread Peter Rathlev
On Tue, 2014-12-02 at 15:55 +0800, Xuhu NSP wrote: Hi folks, we are starting to use this platform, any idea which IOS version is quite stable? I checked in Cisco down website saying suggested version is 15.0.1-sy7a. Our feature requirement is quite simple, normal QOS marking and WRR, layer

Re: [c-nsp] Cisco ASA return traffic with explicit deny on outside interface

2014-10-09 Thread Peter Rathlev
On Thu, 2014-10-09 at 19:42 +, Christopher Werny wrote: I am wondering, does return traffic (for connections originated on the inside network) get through the ASA with the explicit deny ip any any statement in the outside ACL? I know it works without an ACL applied to the outside

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread Peter Rathlev
On Wed, 2014-09-24 at 15:12 -0400, Dario Ciccarone wrote: Actually, we think that may be because you're using option a - typing in an IOS release, or selecting from the list. You can instead use option b (and paste the output of multiple show version commands) or option c (and provide a list

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-24 Thread Peter Rathlev
On Wed, 2014-09-24 at 12:23 -0400, Cisco Systems PSIRT wrote: Cisco IOS Software RSVP Vulnerability ... Thank you to PSIRT for generally thorough advisories. :-) I have a grievance though: The Cisco IOS Software section of Software Versions and Fixes not longer includes a comprehensive list of

Re: [c-nsp] Strange IOS as DHCP Client behevior

2014-09-21 Thread Peter Rathlev
On Sun, 2014-09-21 at 23:35 +0200, Robert Hass wrote: My problem is that these routers are visible in DHCP binding database with very strange MAC: 10.2.2.140 0063.6973.636f.2d30.Dec 20 2014 11:44 AM Automatic 3035.302e.3536.6138.

Re: [c-nsp] Silly question regarding C3K-NM-10G

2014-09-11 Thread Peter Rathlev
On Thu, 2014-09-11 at 14:12 +, Drew Weaver wrote: I can't seem to locate a tab on the NM-10G which releases it from the slot. Just repeating what others say: There's no tab to be pressed. It must be an error in the documentation. We just loosen the screws and pull the module in the

Re: [c-nsp] Silly question regarding C3K-NM-10G

2014-09-11 Thread Peter Rathlev
On Thu, 2014-09-11 at 22:57 +0200, Łukasz Bromirski wrote: That’s an error in the doc, it should be corrected. There’s no tab. You just unscrew the module and pull it. Heh, it's a detail a senior tech can use to reveal wether a junior tech actually read the documentation. :-) -- Peter

Re: [c-nsp] OOB Device for remote DC's

2014-09-04 Thread Peter Rathlev
On Tue, 2014-09-02 at 12:22 +1030, CiscoNSP List wrote: We historically have just used Cisco 2511's with standard modem attached, but are finding it increasingly difficult to source modems - Can anyone recommend an alternative(reliable) OOB device? (Built in modem + 4G as backup?) +1 for

Re: [c-nsp] TACACS+ exec authorisation no working on Cisco 2960CG

2014-07-30 Thread Peter Rathlev
On Wed, 2014-07-30 at 15:15 -0400, Andrew Wentzell wrote: On Wed, Jul 30, 2014 at 3:01 PM, Rich Lewis rle...@sis.tv wrote: And if so, is there a way (that people are happy implementing) to get TACACS+ without buying Cisco ACS or ISE? (Don't expect you to answer this bit Javier! ;-)

Re: [c-nsp] SSH problems on cisco generally

2014-07-24 Thread Peter Rathlev
On Wed, 2014-07-23 at 22:10 -0700, Mike wrote: ssh -l mylogin some3560g.my.network.com Connection closed by x.x.x.x. What does it say if you add one or more -v flags to the SSH command? -- Peter ___ cisco-nsp mailing list

Re: [c-nsp] Netflow

2014-07-18 Thread Peter Rathlev
On Thu, 2014-07-17 at 17:32 +0530, thiyagarajan b wrote: I need to enable IPv6 flow exported along with IPv4 which is already enabled. My doubt is whether I need to create a separate monitor map for IPv6 apart from existing IPv4 monitor map?. Pls suggest. What platform and software? What have

Re: [c-nsp] Netflow

2014-07-18 Thread Peter Rathlev
(Readded cisco-nsp since I'm not familiar with ASR9k) On Fri, 2014-07-18 at 16:09 +0530, thiyagarajan b wrote: Hello Peter, I need to export IPv6 flows in ASR9001 v4.3.4, Already IPv4 flows are being exported. Is it possible to configure record IPv6 in the same monitor map along with IPv4. I

Re: [c-nsp] UDLD enabling port prematurely?

2014-07-17 Thread Peter Rathlev
On Thu, 2014-07-17 at 15:14 +0700, Victor Sudakov wrote: [...] I need some sort of point-to-point L2 link fault management between the switches. Is UDLD suitable for this purpose? I have experimented a bit with udld port aggressive and have found out the following strange thing. When

Re: [c-nsp] UDLD enabling port prematurely?

2014-07-17 Thread Peter Rathlev
On Thu, 2014-07-17 at 13:07 +0300, Saku Ytti wrote: Is UDLD useful? Shouldn't ethernet autonego handle unidirectional links natively via down-side asserting RFI, which should make up-side go down? UDLD is useful to use in the places where we use EoMPLS port-mode transport through the core.

Re: [c-nsp] UDLD enabling port prematurely?

2014-07-17 Thread Peter Rathlev
On Thu, 2014-07-17 at 17:00 +0700, Victor Sudakov wrote: Peter Rathlev wrote: no errdisable recovery cause udld Problem is that you have to intervene manually to enable the interface after service has been restored. I may be already unable to reach the switch remotely to intervene

Re: [c-nsp] Need suggestion on cisco 3560 sw IOS

2014-06-26 Thread Peter Rathlev
On Thu, 2014-06-26 at 20:24 +0530, thiyagarajan b wrote: Request to suggest whether 12.2(58)SE or 12.2(55)SE , a stable IOS for Cisco 3560-24TS switch since the switch got a software crash installed with 12.2(52)SE. Both of 12.2(55)SE (and SE1) and 12.2(58)SE1 have been good for us. We've seen

Re: [c-nsp] CPU SPAN on Sup2T / IOS 15?

2014-04-24 Thread Peter Rathlev
On Tue, 2014-04-22 at 08:58 -0400, Pete Lumbis wrote: You could rely on netdr to capture packets and tie it to an EEM script to stop a circular capture when the problem happens. Netdr, of course, thanks. :-) It turns out our VMware guys have started turning on Network Health Check which sends

Re: [c-nsp] CPU SPAN on Sup2T / IOS 15?

2014-04-24 Thread Peter Rathlev
On Tue, 2014-04-22 at 15:32 +0100, Phil Mayers wrote: On 22/04/2014 13:58, Pete Lumbis wrote: CPU span on sup2t is unfortunately not implemented. [...] That's a real shame, but thanks for flagging it up. I guess we should all poke our account teams. +1. It's been really (?:very, ){4,}

[c-nsp] CPU SPAN on Sup2T / IOS 15?

2014-04-22 Thread Peter Rathlev
Would anyone know how to SPAN the CPU of a Sup2T running IOS 15? The monitor session configuration doesn't include source cpu anymore: Sup2T(config)#monitor session 1 type erspan-source Sup2T(config-mon-erspan-src)#source ? interface SPAN source interface

Re: [c-nsp] Peering between route reflectors

2014-04-07 Thread Peter Rathlev
On Mon, 2014-04-07 at 21:01 +0200, Cydon Satyr wrote: Basically, if there are multiple route reflectors NOT in the forwarding path of the traffic, is there ANY reason to peer between them? I don't see a reason why they should peer, but I'd like to get this confirmed. We (enterprise setup,

Re: [c-nsp] snmp-server context on me3600 / 15.3(3)S2

2014-03-31 Thread Peter Rathlev
On Fri, 2014-03-28 at 15:07 +, Phil Mayers wrote: IIRC there's a an SNMP mib which lists the contexts itself, but I can't find a box with it populated right now. ENTITY-MIB::entLogicalTable, specifically ENTITY-MIB::entLogicalContext or ENTITY-MIB::entLogicalCommunity, should list the

Re: [c-nsp] port-channel standalone-disable

2014-03-31 Thread Peter Rathlev
On Mon, 2014-03-31 at 19:24 +, Harry Hambi - Atos wrote: Anyway the recommendations are to use the command, port-channel standalone-disable. Has anyone had any experience with this command?, what are the benefits?, and how does it work?. We don't use the feature but AFAIK it should only

Re: [c-nsp] X6708-10G-3C compatible with 7604 chassis?

2014-03-20 Thread Peter Rathlev
On Thu, 2014-03-20 at 16:50 -0700, Pete Templin wrote: On 3/20/2014 4:21 PM, Jared Mauch wrote: one could swap the DFC with a CFC depending on your needs as well. - jared I can't speak definitively, but I don't think that's possible on a X6708. They certainly aren't sold directly with

Re: [c-nsp] WS-6904-40G and FourX adapter

2014-03-19 Thread Peter Rathlev
On Wed, 2014-03-19 at 14:30 -0400, Jay Young wrote: Anyone have these in production? We started using the in several places. We currently have five in production all using the CVR-CFP-4SFP10G adapter. We just moved some 10 Gig links to these and are experiencing some problems with traffic

Re: [c-nsp] 7600 - Tunnel in VRF not working over MPLS

2014-03-18 Thread Peter Rathlev
On Tue, 2014-03-18 at 13:01 +0100, redscorpion69 wrote: Could anyone explain why the following setup is not working, maybe there is a limitation on 7600 for this? PE1---[MPLS]--PE2tun99--CE Basically, Tunnel 99 is in VRF. All routes including tunnel are visible in

Re: [c-nsp] HWIC-3G-HSPA-G stuck in reset?

2014-03-11 Thread Peter Rathlev
On Mon, 2014-03-10 at 11:53 +0100, Lukas Tribus wrote: %CELLWAN-2-MODEM_DOWN: Modem in HWIC slot 0/0 is DOWN This means you are experiencing a modem firmware crash. Also read Cisco 3G and 4G Serviceability Enhancement User Guide [1]. Ah, thanks for the pointer. It's good read. It's a

[c-nsp] HWIC-3G-HSPA-G stuck in reset?

2014-03-10 Thread Peter Rathlev
On Sun, 2014-03-09 at 00:42 +0100, Lukas Tribus wrote: What about just resetting or power cycling the modem instead of reloading? conf t service internal end test cellular 0/1/0 modem-reset [or] test cellular 0/1/0 modem-power-cycle On this subject: We sometimes have a HWIC-3G-HSPA-G

Re: [c-nsp] C3k: IPv6 multicast listener reports causes high CPU

2014-03-06 Thread Peter Rathlev
On Mon, 2014-03-03 at 19:50 +, Phil Mayers wrote: I can't remember if c3k can do multicast storm limiting without bad side effects; that is how we solved our problem. In particular if it is the same thing (AMT/vPro) we found that even a modest rate-limit closed the flood storms down

[c-nsp] C3k: IPv6 multicast listener reports causes high CPU

2014-03-03 Thread Peter Rathlev
We have some 3560G switches whose control-plane is useless because the switch punts ~2200 pps via the sw forwarding CPU queue. Investigating shows that it's caused to IPv6 traffic. The switch itself is stricly layer-2, is using the desktop default SDM template and has no IPv6 features (like MLD

Re: [c-nsp] C3k: IPv6 multicast listener reports causes high CPU

2014-03-03 Thread Peter Rathlev
On Mon, 2014-03-03 at 19:50 +, Phil Mayers wrote: I wonder if it's the same thing we (and others) saw: http://lists.cluenet.de/pipermail/ipv6-ops/2014-February/009835.html It sounds very much like it, now that you say it. The part about two of these goading each other turned out true; I

Re: [c-nsp] Cisco 4900M questions

2014-02-25 Thread Peter Rathlev
On Tue, 2014-02-25 at 02:05 +, Blake Pfankuch - Mailing List wrote: I am fairly new to VRF's however I think I have this sorted out. I believe I can do a VRF definition for each of the environments, and then assign the vlan interfaces to each VRF. Something like this. Please bear with my

  1   2   3   4   5   6   7   8   9   10   >