Re: [c-nsp] Riverbed

I only have experience with Cisco WAAS but if you're on anything with decent latency (10ms) they caused more (performance) problems for us than they solved. For us the incremental cost of upgrading our bandwidth in most locations was low enough that we didn't take WAAS out of the pilot (and we

Re: [c-nsp] using RANCID in a CCIE lab

It seems like a good idea to me. I do this manually when building test labs and it works quite well. Doing a config replace http from a cvsweb instance should let you revert to a previous config quite easily, though we use https and authentication so I never bothered to try that part myself.

Re: [c-nsp] TACACS emergency password management

Using offline files and folders on our laptops (generally just for the keepass and a few other folders, because it's annoying). On our Blackberries and iPhones it gives the option to re-fetch or use the previous copy, which is often recent enough that I'm not too concerned. Having our passwords

Re: [c-nsp] Cisco 3750 - VTY ACL vrf-also

I currently have an ACL that works as I want it to (allowing management stations to SSH to any of its IP's regardless of VRF). It's a regular 3750 (well a 3750G) so I don't know if that's different than a 3750-ME: floor2.mc#sh ver Cisco IOS Software, C3750 Software (C3750-IPSERVICESK9-M), Version

Re: [c-nsp] App to manage pushing out changes

CiscoWorks LMS or even RANCID will work for this. On a box with RANCID installed it's done like so: for host in router1 router2 router3; do clogin -cconfig t;no ip access list extended asdf;ip access list extended asdf permit any any;end;write mem ${host}; done -saxon On 12 August 2010 13:09,

Re: [c-nsp] ISP - unwanted traffic

I've not tried this, but at a conceptual level I think stateful firewall rules would achieve what you're trying to do. I'm unconvinced you'll enjoy the result, since you're going to have to rely on your session tables and if that isn't perfect then you're going to have unexpected behaviour (and

Re: [c-nsp] ip directed-broadcast access-list

: on 04/29/2010 06:21 PM Saxon Jones said the following: I've had no problems enabling this on Catalyst 6500 sup720-10G's running 12.2(33)SXH5 for the same purpose as you. We also use it on Catalyst 3750G's running 12.2(52)SE with equally good results. I've done no load testing of it, though, we

Re: [c-nsp] ip directed-broadcast access-list

I've had no problems enabling this on Catalyst 6500 sup720-10G's running 12.2(33)SXH5 for the same purpose as you. We also use it on Catalyst 3750G's running 12.2(52)SE with equally good results. I've done no load testing of it, though, we just have our normal rush of WoL packets (generally 2

Re: [c-nsp] 3750X?

/pipermail/cisco-nsp/ -- __ Saxon Jones Email: saxon.jo...@gmail.com Telephone: (780) 669-0899 Toll-free: (866) 701-8022 x2 United Kingdom: 0(1315)168664 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https

Re: [c-nsp] SecureACS Appliance AD Authentication

password. As long as your TACACS+ server is reachable you can't use the enable secret for auth so if just your AD connector fails then disconnect the TACACS+ server and you can then login with that secret. -saxon __ Saxon Jones Email: saxon.jo...@gmail.com Telephone: (780

Re: [c-nsp] PVLANs in a Hosting Environment

We used to use (at a previous job) 3550's, private VLAN's, and local-proxy-arp to achieve this. It would occasionally irritate customers because our 3550 would win the ARP response for traffic going between their hosts, though this usually wasn't an issue since we'd happily push those few

Re: [c-nsp] IP Base vs IP Services with 3750Es

IPv6 exists in IP Services now and the advanced IP services train has been EoL'd. You have to change your SDM profile to get IPv6, so it will initially seem to be absent (it even rejects config commands until you change the profile). -saxon On 25 February 2010 14:40, Alan Buxey

Re: [c-nsp] VRF aware IPSec for remote access without xauth

In the tunnel interface configuration, ip vrf forwarding sets the VRF that traffic in the tunnel is a part of, and tunnel vrf sets the VRF that the tunnel travels over. Is this what you're asking? -saxon On 2 February 2010 21:20, Jay Nakamura zeusda...@gmail.com wrote: I am trying to configure

Re: [c-nsp] BGP to OSPF redistribution

If I understand your question properly, why not just change the administrative distance of the eBGP routes to something less than 110. __ Saxon Jones Email: saxon.jo...@gmail.com 2010/1/13 null zeroroute nullzero.ro...@gmail.com I'm having a problem trying

Re: [c-nsp] BGP to OSPF redistribution

have the desired result). __ Saxon Jones Email: saxon.jo...@gmail.com Telephone: (780) 669-0899 Toll-free: (866) 701-8022 United Kingdom: 0(1315)168664 2010/1/13 Saxon Jones saxon.jo...@gmail.com If I understand your question properly, why not just change

Re: [c-nsp] VRF Limitations/OSPF Process Limitations on 3550/3560

I think the 3550's have a limit of 7 (my guess is the limit is 8 and they have one for their purposes), at least that's what our provider tells us. I've personally created over 20 VRF's on a 3560-E (this was a test, I can't remember exactly how high I got, and I don't think I created OSPF