From zhqasmi at cyber.net.pk  Mon Jun  1 00:34:11 2009
From: zhqasmi at cyber.net.pk (Amjad Ul Hasnain Qasmi)
Date: Mon, 01 Jun 2009 10:34:11 +0600
Subject: [c-nsp] strange behavior over MPLS network -
 remote	desktopwon't work
In-Reply-To: <db092ca60905311942j78008f3ew7f39db9a578fa6fc@mail.gmail.com>
References: <db092ca60905311301p13e05985q2d3442be7aba6fc@mail.gmail.com>
	<4A22E68F.4010605@wbsconnect.com>
	<db092ca60905311404j2ae21a00ve1017a4060285d@mail.gmail.com>
	<alpine.DEB.1.10.0905312320090.21799@locus>
	<db092ca60905311654u11afa2ddncfdcc0f5b77f43f4@mail.gmail.com>
	<E5C9EC8A665E4CFFAA1BFB99DE34E678@oneunified.local>
	<db092ca60905311942j78008f3ew7f39db9a578fa6fc@mail.gmail.com>
Message-ID: <004c01c9e272$36ff9b40$a4fed1c0$@net.pk>

If your PE-PE is not a trunk port, which is normaly the case, and you want
to successfully transport a payload of 1500 bytes, you should consider
setting IP MTU as 1500 + 20 = 1520 bytes. mostly two labeled are stacked for
vpn traffic but there are cases when 3 label may also be used so you should
consider 12 bytes for mpls header ( 4bytes each), it will make the mpls mtu
as 1532. Your physical interface mtu should be equal or larger than 1532 +
18(Ethernet header) bytes.
Try this out and share the results.

/AHQ

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Chris Hale
Sent: Monday, June 01, 2009 8:42 AM
To: cisco-nsp
Subject: Re: [c-nsp] strange behavior over MPLS network - remote
desktopwon't work

On Sun, May 31, 2009 at 9:04 PM, Ray Burkholder <ray at oneunified.net> wrote:

> >
> >
> > What does that indicate to you?  1472 + VLAN tag plus MPLS < 1500?
> >
>
> When provisioning MPLS circuits, one has to be careful.  Basic MPLS will
> attach one or more 4 byte labels on to each packet.  Psuedowires attach
> additional bytes onto each packet.  WAN circuits running MPLS need to be
> provisioned such that the interface MTU is set to 1500 PLUS any pseudowire
> overhead plus any MPLS label overhead.  If you try to run MPLS stuff
across
> a standard 1500 MTU WAN interface, you get the problems you are now
> encountering: fragmentation, drops, corruption, ...  Some protocols can
> handle it, but I've read that RDP sets the no-fragment bit, thus dropping
> the packets.
>
> STM-1 and DS3 circuits run by default at 4470 bytes so easily accommodate
> MPLS overhead.  Ethernet circuits are at 1500, and you have to work with
> upstream vendors to ensure their networks can handle MTU's greater than
> 1500.  Cisco switches need a reboot after setting a system mtu setting.
> Routers can change interface mtu settings on the fly.
>
> You could try setting your MTU setting on your pc to 1300 and see if
things
> work.  If they do, then you know you have an upstream mtu problem.
>

I have an available DS3 interface on each of the POP H routers.  Maybe I
will set that up tomorrow and push the MPLS traffic across this interconnect
to see if that helps.  Maybe the mpls mtu setting on the PA-FE-TX interfaces
just isn't working.  I have also forced the GigE MPLS MTU settings on the
backbone link between the POPs to 1538 as they were at the default of 1500
before.

Thanks again,
Chris
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From tom at snnap.net  Mon Jun  1 00:57:16 2009
From: tom at snnap.net (Tom Storey)
Date: Mon, 1 Jun 2009 13:57:16 +0900 (EIT)
Subject: [c-nsp] Ingress policing on a 3560
Message-ID: <61575.172.25.144.4.1243832236.squirrel@imap.snnap.net>

Thanks to those who have responded so far.

To answer a couple of so far common questions:

"mls qos" is enabled:

sw2#sh mls qos
QoS is enabled
QoS ip packet dscp rewrite is enabled

And I dont appear to be counting any hits against my MAC ACL, which may
explain part of the problem:

sw2#sh access-lists mac-any-any

Extended MAC access list mac-any-any
    permit any any 0x0 0xFFFF

I tried applying the ACL inbound on the interface to see if it would count
any hits, and there are zero hits on there too. I also modified the ACL
rule to what you see above based on an example I found.

So something is definitely up there, considering I am pumping 12000+ pps
through it each way with iperf. :-)

Back to the drawing board.

Cheers,
Tom

> Hi all.
>
> What I'm trying to do is police ingress on a port, using a MAC ACL to
> match traffic to police (just a "permit any any" to match all traffic).
>
> But what I'm getting is that the switch doesnt appear to be matching any
> traffic at all.
>
> sw2#sh int gi0/14 | inc put rate
>   30 second input rate 20449000 bits/sec, 1688 packets/sec
>   30 second output rate 2620000 bits/sec, 1690 packets/sec
> sw2#sh policy-map int gi0/14
>  GigabitEthernet0/14
>
>   Service-policy input: police-10mbit-in
>
>     Class-map: mac-any-any (match-any)
>       0 packets, 0 bytes
>       30 second offered rate 0 bps, drop rate 0 bps
>       Match: access-group name mac-any-any
>         0 packets, 0 bytes
>         30 second rate 0 bps
>
>     Class-map: class-default (match-any)
>       0 packets, 0 bytes
>       30 second offered rate 0 bps, drop rate 0 bps
>       Match: any
>         0 packets, 0 bytes
>         30 second rate 0 bps
>
> Does anyone have any pointers as to what I'm doing wrong? Below is my
> config.
>
> mac access-list extended mac-any-any
>  permit any any
> !
> class-map match-any mac-any-any
>  match access-group name mac-any-any
> !
> policy-map police-10mbit-in
>  class mac-any-any
>   police 10000000 1000000 exceed-action drop
> !
> interface GigabitEthernet0/14
>  service-policy input police-10mbit-in
> !
>
> Ive also tried with just class-default, but got the same result.
>
> I am currently using the "vlan" SDM profile, if that makes any difference.
>
> Cheers,
> Tom
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From achatz at forthnet.gr  Mon Jun  1 03:48:42 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Mon, 01 Jun 2009 10:48:42 +0300
Subject: [c-nsp] Ingress policing on a 3560
In-Reply-To: <61575.172.25.144.4.1243832236.squirrel@imap.snnap.net>
References: <61575.172.25.144.4.1243832236.squirrel@imap.snnap.net>
Message-ID: <4A2387DA.7030108@forthnet.gr>

Tom,

If i remember right, in 3560/3750 MAC ACLs are used only for classification of non ip 
traffic. So if you're testing with ip (like iperf) you won't be able to match it.

Also, use "sh mls qos int gi0/14 stat" to check for drops due to policing.

-- 
Tassos

Tom Storey wrote on 01/06/2009 07:57:
> Thanks to those who have responded so far.
> 
> To answer a couple of so far common questions:
> 
> "mls qos" is enabled:
> 
> sw2#sh mls qos
> QoS is enabled
> QoS ip packet dscp rewrite is enabled
> 
> And I dont appear to be counting any hits against my MAC ACL, which may
> explain part of the problem:
> 
> sw2#sh access-lists mac-any-any
> 
> Extended MAC access list mac-any-any
>     permit any any 0x0 0xFFFF
> 
> I tried applying the ACL inbound on the interface to see if it would count
> any hits, and there are zero hits on there too. I also modified the ACL
> rule to what you see above based on an example I found.
> 
> So something is definitely up there, considering I am pumping 12000+ pps
> through it each way with iperf. :-)
> 
> Back to the drawing board.
> 
> Cheers,
> Tom
> 
>> Hi all.
>>
>> What I'm trying to do is police ingress on a port, using a MAC ACL to
>> match traffic to police (just a "permit any any" to match all traffic).
>>
>> But what I'm getting is that the switch doesnt appear to be matching any
>> traffic at all.
>>
>> sw2#sh int gi0/14 | inc put rate
>>   30 second input rate 20449000 bits/sec, 1688 packets/sec
>>   30 second output rate 2620000 bits/sec, 1690 packets/sec
>> sw2#sh policy-map int gi0/14
>>  GigabitEthernet0/14
>>
>>   Service-policy input: police-10mbit-in
>>
>>     Class-map: mac-any-any (match-any)
>>       0 packets, 0 bytes
>>       30 second offered rate 0 bps, drop rate 0 bps
>>       Match: access-group name mac-any-any
>>         0 packets, 0 bytes
>>         30 second rate 0 bps
>>
>>     Class-map: class-default (match-any)
>>       0 packets, 0 bytes
>>       30 second offered rate 0 bps, drop rate 0 bps
>>       Match: any
>>         0 packets, 0 bytes
>>         30 second rate 0 bps
>>
>> Does anyone have any pointers as to what I'm doing wrong? Below is my
>> config.
>>
>> mac access-list extended mac-any-any
>>  permit any any
>> !
>> class-map match-any mac-any-any
>>  match access-group name mac-any-any
>> !
>> policy-map police-10mbit-in
>>  class mac-any-any
>>   police 10000000 1000000 exceed-action drop
>> !
>> interface GigabitEthernet0/14
>>  service-policy input police-10mbit-in
>> !
>>
>> Ive also tried with just class-default, but got the same result.
>>
>> I am currently using the "vlan" SDM profile, if that makes any difference.
>>
>> Cheers,
>> Tom
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 

From peter at rathlev.dk  Mon Jun  1 06:35:50 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 01 Jun 2009 12:35:50 +0200
Subject: [c-nsp] strange behavior over MPLS network - remote desktop
 won't work
In-Reply-To: <db092ca60905311654u11afa2ddncfdcc0f5b77f43f4@mail.gmail.com>
References: <db092ca60905311301p13e05985q2d3442be7aba6fc@mail.gmail.com>
	<4A22E68F.4010605@wbsconnect.com>
	<db092ca60905311404j2ae21a00ve1017a4060285d@mail.gmail.com>
	<alpine.DEB.1.10.0905312320090.21799@locus>
	<db092ca60905311654u11afa2ddncfdcc0f5b77f43f4@mail.gmail.com>
Message-ID: <1243852550.3428.2.camel@localhost.localdomain>

On Sun, 2009-05-31 at 19:54 -0400, Chris Hale wrote:
> ping do-not-fragment detail size 1473 192.168.3.254
> PING 192.168.3.254 (192.168.3.254): 1473 data bytes
> ping: sendto: Message too long
...
> What does that indicate to you?  1472 + VLAN tag plus MPLS < 1500?

To me this indicates that the Juniper doesn't wan't to send the packet.
As others mentioned 1472 is the largest ICMP payload to expect on a
regularr 1500 byte MTU link.

The "sendto: Message too long" is what I would assume if the IP stack of
the sending host refuses to accept the packet. So the packet never
leaves the CE.

Regards,
Peter



From doraemonheng at yahoo.com.sg  Mon Jun  1 06:17:38 2009
From: doraemonheng at yahoo.com.sg (Doraemon Heng)
Date: Mon, 1 Jun 2009 18:17:38 +0800 (SGT)
Subject: [c-nsp] 4x E1 MLPPP max throughput?
Message-ID: <701771.79941.qm@web76013.mail.sg1.yahoo.com>

Dear All,

We are experiencing packet loss when ping from PE1 to CE2 when the traffic above 7.2Mbps.
CE1 - PE1 ? PE2 ? CE2 
Type of point-to-point between PE2 and CE2 is 4x E1 multilink (bandwidth 8192Kbit).

Note*** (PE1 to PE2 no packet loss)

We do see the Total output drops keep increasing even the traffic is low. Is it a normal behavior or does this caused the packet loss when PE1 ping to CE2?

Also, what is the maximum throughput can the 4x E1 multilink handle without any packet loss?

PE2#show interfaces multilink 10
Multilink10 is up, line protocol is up
  Hardware is multilink group interface
  Internet address is 10.19.60..9/30
  MTU 1500 bytes, BW 8192 Kbit, DLY 100000 usec,
     reliability 255/255, txload 180/255, rxload 107/255
  Encapsulation PPP, LCP Open, multilink Open
  Open: IPCP, loopback not set
  Keepalive set (10 sec)
  DTR is pulsed for 2 seconds on reset
  Last input 01:17:03, output never, output hang never
  Last clearing of "show interface" counters 05:24:17
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 31000
  Queueing strategy: fifo
  Output queue: 31/300 (size/max)
  30 second input rate 3440000 bits/sec, 1226 packets/sec
  30 second output rate 5802000 bits/sec, 1212 packets/sec
     22649490 packets input, 598130070 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     22368689 packets output, 2467487460 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out
     0 carrier transitions


Thanks & Regards,



      New Email addresses available on Yahoo!
Get the Email name you&#39;ve always wanted on the new @ymail and @rocketmail. 
Hurry before someone else does!
http://mail.promotions.yahoo.com/newdomains/sg/

From dloughlin at otc.fsu.edu  Mon Jun  1 10:12:56 2009
From: dloughlin at otc.fsu.edu (Loughlin, Daniel J.)
Date: Mon, 1 Jun 2009 10:12:56 -0400
Subject: [c-nsp] Ingress policing on a 3560
In-Reply-To: <4A2387DA.7030108@forthnet.gr>
References: <61575.172.25.144.4.1243832236.squirrel@imap.snnap.net>
	<4A2387DA.7030108@forthnet.gr>
Message-ID: <0B5DA805D198954F8E6160D2AB3B43A595CE24@fsu-exch-11.fsu.edu>

Yeah, that's correct. Mac acls only match non-IP traffic. 

-Danny

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Tassos
Chatzithomaoglou
Sent: Monday, June 01, 2009 3:49 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Ingress policing on a 3560

Tom,

If i remember right, in 3560/3750 MAC ACLs are used only for
classification of non ip 
traffic. So if you're testing with ip (like iperf) you won't be able to
match it.

Also, use "sh mls qos int gi0/14 stat" to check for drops due to
policing.

-- 
Tassos

Tom Storey wrote on 01/06/2009 07:57:
> Thanks to those who have responded so far.
> 
> To answer a couple of so far common questions:
> 
> "mls qos" is enabled:
> 
> sw2#sh mls qos
> QoS is enabled
> QoS ip packet dscp rewrite is enabled
> 
> And I dont appear to be counting any hits against my MAC ACL, which
may
> explain part of the problem:
> 
> sw2#sh access-lists mac-any-any
> 
> Extended MAC access list mac-any-any
>     permit any any 0x0 0xFFFF
> 
> I tried applying the ACL inbound on the interface to see if it would
count
> any hits, and there are zero hits on there too. I also modified the
ACL
> rule to what you see above based on an example I found.
> 
> So something is definitely up there, considering I am pumping 12000+
pps
> through it each way with iperf. :-)
> 
> Back to the drawing board.
> 
> Cheers,
> Tom
> 
>> Hi all.
>>
>> What I'm trying to do is police ingress on a port, using a MAC ACL to
>> match traffic to police (just a "permit any any" to match all
traffic).
>>
>> But what I'm getting is that the switch doesnt appear to be matching
any
>> traffic at all.
>>
>> sw2#sh int gi0/14 | inc put rate
>>   30 second input rate 20449000 bits/sec, 1688 packets/sec
>>   30 second output rate 2620000 bits/sec, 1690 packets/sec
>> sw2#sh policy-map int gi0/14
>>  GigabitEthernet0/14
>>
>>   Service-policy input: police-10mbit-in
>>
>>     Class-map: mac-any-any (match-any)
>>       0 packets, 0 bytes
>>       30 second offered rate 0 bps, drop rate 0 bps
>>       Match: access-group name mac-any-any
>>         0 packets, 0 bytes
>>         30 second rate 0 bps
>>
>>     Class-map: class-default (match-any)
>>       0 packets, 0 bytes
>>       30 second offered rate 0 bps, drop rate 0 bps
>>       Match: any
>>         0 packets, 0 bytes
>>         30 second rate 0 bps
>>
>> Does anyone have any pointers as to what I'm doing wrong? Below is my
>> config.
>>
>> mac access-list extended mac-any-any
>>  permit any any
>> !
>> class-map match-any mac-any-any
>>  match access-group name mac-any-any
>> !
>> policy-map police-10mbit-in
>>  class mac-any-any
>>   police 10000000 1000000 exceed-action drop
>> !
>> interface GigabitEthernet0/14
>>  service-policy input police-10mbit-in
>> !
>>
>> Ive also tried with just class-default, but got the same result.
>>
>> I am currently using the "vlan" SDM profile, if that makes any
difference.
>>
>> Cheers,
>> Tom
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From ying-xiang at 163.com  Mon Jun  1 10:29:46 2009
From: ying-xiang at 163.com (ying-xiang)
Date: Mon, 1 Jun 2009 22:29:46 +0800 (CST)
Subject: [c-nsp] even Eompls "vc" is up but can not work
Message-ID: <30733322.938901243866586761.JavaMail.coremail@bj163app25.163.com>

 hi
the vc still is up,but the eompls does't work suddenly.
i got the show message on the cli
 

Local interface: VFI SDH-NEC VFI up

  MPLS VC type is VFI, interworking type is Ethernet

  Destination address: 192.168.4.16, VC ID: 807, VC status: up

    Output interface: Te2/0/0, imposed label stack {185 188}

    Preferred path: not configured

    Default path: active

    Next hop: 192.168.128.14

  Create time: 19w4d, last status change time: 17:31:07

  Signaling protocol: LDP, peer 192.168.4.16:0 up

    Targeted Hello: 192.168.0.1(LDP Id) -> 192.168.4.16

    MPLS VC labels: local 336, remote 188

    Group ID: local 0, remote 0

    MTU: local 1500, remote 1500

    Remote interface description:

  Sequencing: receive disabled, send disabled

  VC statistics:

    packet totals: receive 4016946, send 9576394

    byte totals:   receive 427480129, send 2838427498

    packet drops:  receive 0, send 0

 

sh mpls l2transport vc

VFI SDH-NEC    VFI                        192.168.4.16    807        UP

 

seems it does not have any issue here, except tunnel lable can not be found .what should i do for the further troubleshooting?

From sam_mailinglists at spacething.org  Mon Jun  1 11:27:54 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Mon, 01 Jun 2009 16:27:54 +0100
Subject: [c-nsp] Nexus V1000 - Feedback?
Message-ID: <4A23F37A.60008@spacething.org>

Hi,

Has anyone here deployed the Nexus V1000? I'm interested in feedback 
(good, back or indifferent).

Thanks,

Sam

From wireless at starbeam.com  Mon Jun  1 11:46:44 2009
From: wireless at starbeam.com (Jerry Bacon)
Date: Mon, 1 Jun 2009 08:46:44 -0700
Subject: [c-nsp] even Eompls "vc" is up but can not work
References: <30733322.938901243866586761.JavaMail.coremail@bj163app25.163.com>
Message-ID: <1C46AB7345A44FD48211917490E2E9C4@user6006cfcba1>

Check the other end and make sure it is also up. I've seen cases where the 
PE router on one side shows the circuit as "up", but the other PE router 
will show it as "down".

-- 
Jerry B.


----- Original Message ----- 

> the vc still is up,but the eompls does't work suddenly.
> i got the show message on the cli
>
>
> Local interface: VFI SDH-NEC VFI up
>
[snip]
>
> sh mpls l2transport vc
>
> VFI SDH-NEC    VFI                        192.168.4.16    807        UP
>
> seems it does not have any issue here, except tunnel lable can not be 
> found .what should i do for the further troubleshooting?


From gert at greenie.muc.de  Mon Jun  1 13:20:18 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Mon, 1 Jun 2009 19:20:18 +0200
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A23F37A.60008@spacething.org>
References: <4A23F37A.60008@spacething.org>
Message-ID: <20090601172018.GN290@greenie.muc.de>

Hi,

On Mon, Jun 01, 2009 at 04:27:54PM +0100, Sam Stickland wrote:
> Has anyone here deployed the Nexus V1000? I'm interested in feedback 
> (good, back or indifferent).

We haven't deployed it yet, but what I was demonstrated at Networkers
in Barcelona was definitely Way Cool.  "The Cisco way" to configure
and monitor switches, not the VMware web-thingie...

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090601/0b515b6f/attachment.bin>

From gert at greenie.muc.de  Mon Jun  1 16:35:06 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Mon, 1 Jun 2009 22:35:06 +0200
Subject: [c-nsp] strange behavior over MPLS network - remote desktop
	won't work
In-Reply-To: <alpine.DEB.1.10.0905312320090.21799@locus>
References: <db092ca60905311301p13e05985q2d3442be7aba6fc@mail.gmail.com>
	<4A22E68F.4010605@wbsconnect.com>
	<db092ca60905311404j2ae21a00ve1017a4060285d@mail.gmail.com>
	<alpine.DEB.1.10.0905312320090.21799@locus>
Message-ID: <20090601203506.GO290@greenie.muc.de>

Hi,

On Sun, May 31, 2009 at 11:22:08PM +0200, Sascha E. Pollok wrote:
> Also, what kind of FE boards do you use on the 7206?
> I am currently unsure whether e.g. PA-FE-TX support
> larger MTUs needed for MPLS/VPN.

"Sort of".  There was a lengthy discussion on this list, about two years
ago - as far as I remember, the single-port FEs for the 7200s are bugged
and can only do an MTU up to 1530 bytes.

... but this still works nicely for simple L3 VPN stuff (1500+4+4).

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090601/4a0845ff/attachment.bin>

From ml at kenweb.org  Mon Jun  1 20:44:04 2009
From: ml at kenweb.org (ML)
Date: Mon, 01 Jun 2009 20:44:04 -0400
Subject: [c-nsp] uRPF on ME3400
Message-ID: <4A2475D4.8000006@kenweb.org>

With the IOS available today it's apparent that uRPF is only available 
in VRFs on the ME3400.

Like some people I've run across, I want uRPF not in a VRF.  Has anyone 
found a workaround to this limitation?

Or should I hold my horses and hope it's in 12.2(52)SE?


Thanks


From n03ri at telkom.co.id  Mon Jun  1 22:15:02 2009
From: n03ri at telkom.co.id (Nur Wahid)
Date: Tue, 02 Jun 2009 09:15:02 +0700
Subject: [c-nsp] Cos to DSCP mapping in Cisco 7600 series
In-Reply-To: <mailman.3.1243872001.64973.cisco-nsp@puck.nether.net>
References: <mailman.3.1243872001.64973.cisco-nsp@puck.nether.net>
Message-ID: <4A248B26.7020405@telkom.co.id>

Hi All,
I want to do configuring policy map in Cisco 7600 series:
1. The ingress DSCP to CoS mapping
2. The egress CoS to DSCP mapping
Does anyone have template this mapping in both ingress or egress interface?

-- 
Thanks and Best Regards,
 
Abdul Wahid


====================================
Mau GRATIS TELPON LOKAL, DISCOUNT 50% SMS, 
DISCOUNT 20% SLJJ, dan DISCOUNT FLEXI MILIS? 
Ikuti Dahsyatnya FLEXI KOMUNITAS. 
Ketik CREATE<spasi>[NAMA GRUP], sms ke 345. 
Contoh: CREATE SMU2, sms ke 345. 
Informasi selanjutnya:
- hubungi 147
- http://www.telkomflexi.com
- ketik INFO, sms ke 345.

From rlucas at nz1.ibm.com  Tue Jun  2 02:10:29 2009
From: rlucas at nz1.ibm.com (Raymond Lucas)
Date: Tue, 2 Jun 2009 18:10:29 +1200
Subject: [c-nsp] OSPF LSA timers
Message-ID: <OF603BD14F.B6929832-ONCC2575C9.0020532A-CC2575C9.0021EB3B@nz1.ibm.com>


Hi,

I have been gradually rolling out OSPF across a network including the
following bit of config:

router ospf 172
 ispf
 timers throttle lsa all 10 100 5000
 timers lsa arrival 80

Which was fine until I arrived at a couple of 6506s with SUP2/MSFC2 running
12.2(17d)SXB9 which don't support those commands.  Seems they were only
introduced in 12.2(18)SXF according to Software Advisor.

We can't upgrade to 12.2(18)SXF due to a lack of memory on the switch
processors.  I'm not too worried by the "ispf" business, but I have a bad
feeling about having a couple of devices different from their neighbours
with the LSA stuff.  To really up the nerves, these 6506s are are part of
the core.  I can imagine it working well most of the time but then failing
badly when the pressure is on.

So I guess my questions are:

- Am I right to be worried, or will things work fine if I miss these
commands from these devices?

- Since these timers can only be set on a per device basis, as opposed to
per interface, is there an elegant way to deal with this scenario?
Obviously I would not be keen to remove the modified timers from the rest
of the network!

Thanks,
Ray


From tom at netspot.com.au  Tue Jun  2 03:15:25 2009
From: tom at netspot.com.au (Tom Lanyon)
Date: Tue, 2 Jun 2009 16:45:25 +0930
Subject: [c-nsp] Any problems w/ 3750 IOS 12.2(46)SE?
Message-ID: <A77B4558-D03A-439D-B6F9-60169E9CCF83@netspot.com.au>


We are seeing consistent low TCP throughput over a dual gig  
etherchannel between two stacks of 3x 3750G + 1x 3750E and  
intermittent delays (ie. random slow ICMP ping times) on another 2x  
3750G stack, all on 12.2(46)SE. All switches are doing L2/L3  
forwarding and a small amount of EIGRP.

The stack with delayed ICMP has seemingly random high CPU load and  
this seems to correlate with the delayed ICMP packets; example:
	5Min Processes: 27% CPU
	Interrupts: 0% CPU
	Sum of all processes: 1.88% CPU

The other stacks haven't shown signs of ICMP delayed packets but still  
list high (40-100%) peaks of CPU utilisation. Can't see any  
indications of TCAM exhaustion on any switch (all desktop default SDM  
template).

Just thought I'd throw this to the list to see if anyone else has had  
something similar?

Tom

From blahu77 at gmail.com  Tue Jun  2 03:48:38 2009
From: blahu77 at gmail.com (Mateusz Blaszczyk)
Date: Tue, 2 Jun 2009 08:48:38 +0100
Subject: [c-nsp] uRPF on ME3400
In-Reply-To: <4A2475D4.8000006@kenweb.org>
References: <4A2475D4.8000006@kenweb.org>
Message-ID: <383357750906020048r63eccb30u38b54e2ff1353b61@mail.gmail.com>

2009/6/2 ML <ml at kenweb.org>:
> With the IOS available today it's apparent that uRPF is only available in
> VRFs on the ME3400.
>
> Like some people I've run across, I want uRPF not in a VRF. ?Has anyone
> found a workaround to this limitation?

if you are running vrf-lite i could create vrf global and put any
interface in that vrf.

BRs,

-mat

From jp at softnet.si  Tue Jun  2 03:33:06 2009
From: jp at softnet.si (Primoz Jeroncic)
Date: Tue, 2 Jun 2009 09:33:06 +0200 (CEST)
Subject: [c-nsp] MPLS PE on Cisco L3 switches
Message-ID: <Pine.GSO.4.44.0906020918270.8930-100000@jessie>

Hi guys

I'm looking for solution of relatively cheap L3 switch, which could
also be configured as MPLS PE device. As far as I know, until now
cheapest option was Cisco 3750 Metro. Now I was reading whitepapers
for Cisco ME3400, and to be honest I didn't find any certain info
about this. Does anyone know if ME3400 (with proper IOS image) supports
MPLS (as I wrote before, I basically want to configure it as PE device)
or it still doesn't?


Thanks for any info you might have.

Have fun,
Primoz Jeroncic
Support - IP Connectivity & Routing
-------------------------------------------------------------------
Softnet d.o.o.  tel:  +386 1 562 31 40   |
Borovec 2       fax:  +386 1 562 18 55   |       1 + 1 = 3
1236 Trzin      primoz(at)softnet.si     | for larger values of 1
Slovenija       http://flea.softnet.si/
-------------------------------------------------------------------


From elmi at 4ever.de  Tue Jun  2 05:23:28 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Tue, 2 Jun 2009 11:23:28 +0200
Subject: [c-nsp] ASR 1000 series again: Netflow export
In-Reply-To: <20090514125033.GZ29526@ronin.4ever.de>
References: <20090514090638.GQ29526@ronin.4ever.de>
	<F308ED42-9A78-48E3-B125-A2B225C2FC74@puck.nether.net>
	<20090514125033.GZ29526@ronin.4ever.de>
Message-ID: <20090602092328.GO6911@ronin.4ever.de>

I must follow up on that one...

As a lot of people pointed out, the mgt if is out of the question,
so I configured another mgt vrf to be able to put an interface
into that (no, you cannot get another interface into the default
mgt-vrf...it's only for gi0).

I set the static route to null0 in the default vrf in order to see

  VRF ID : Default
      Source(1)       172.16.202.5 (Unknown)
      Destination(1)  172.16.31.250 (12001)
  Version 5 flow records, origin-as
  Cache for as aggregation:
    Flow export is disabled
  2609363 flows exported in 122960 udp datagrams


...instead of the external address as the source.

Still, I see no packets going out.

Does anyone have a hint to get this running?

Thanks for any input,
			Elmar.


From sthaug at nethelp.no  Tue Jun  2 04:23:40 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Tue, 02 Jun 2009 10:23:40 +0200 (CEST)
Subject: [c-nsp] MPLS PE on Cisco L3 switches
In-Reply-To: <Pine.GSO.4.44.0906020918270.8930-100000@jessie>
References: <Pine.GSO.4.44.0906020918270.8930-100000@jessie>
Message-ID: <20090602.102340.74688870.sthaug@nethelp.no>

> I'm looking for solution of relatively cheap L3 switch, which could
> also be configured as MPLS PE device. As far as I know, until now
> cheapest option was Cisco 3750 Metro. Now I was reading whitepapers
> for Cisco ME3400, and to be honest I didn't find any certain info
> about this. Does anyone know if ME3400 (with proper IOS image) supports
> MPLS (as I wrote before, I basically want to configure it as PE device)
> or it still doesn't?

It does not.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From zivl at gilat.net  Tue Jun  2 08:43:03 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Tue, 2 Jun 2009 15:43:03 +0300
Subject: [c-nsp] Ingress policing on a 3560
In-Reply-To: <63266.172.25.144.4.1243823930.squirrel@imap.snnap.net>
References: <63266.172.25.144.4.1243823930.squirrel@imap.snnap.net>
Message-ID: <EC993E87D960A541A66BF21D62AA42A622FF0389D9@exch2k7.gilat.local>

I'm applying the same you need using dscp instead of mac for "all traffic" and it's working good, here's a sample:

class-map match-all ALL-TRAFFIC
  match ip dscp 0
!
policy-map 7-MEGA
  class ALL-TRAFFIC
    police 7168000 1344000 exceed-action drop

!
interface FastEthernet0/1
description 7 Megabit rated interface sample
service-policy input 7-MEGA
!



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Tom Storey
Sent: Monday, June 01, 2009 5:39 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Ingress policing on a 3560

Hi all.

What I'm trying to do is police ingress on a port, using a MAC ACL to
match traffic to police (just a "permit any any" to match all traffic).

But what I'm getting is that the switch doesnt appear to be matching any
traffic at all.

sw2#sh int gi0/14 | inc put rate
  30 second input rate 20449000 bits/sec, 1688 packets/sec
  30 second output rate 2620000 bits/sec, 1690 packets/sec
sw2#sh policy-map int gi0/14
 GigabitEthernet0/14

  Service-policy input: police-10mbit-in

    Class-map: mac-any-any (match-any)
      0 packets, 0 bytes
      30 second offered rate 0 bps, drop rate 0 bps
      Match: access-group name mac-any-any
        0 packets, 0 bytes
        30 second rate 0 bps

    Class-map: class-default (match-any)
      0 packets, 0 bytes
      30 second offered rate 0 bps, drop rate 0 bps
      Match: any
        0 packets, 0 bytes
        30 second rate 0 bps

Does anyone have any pointers as to what I'm doing wrong? Below is my config.

mac access-list extended mac-any-any
 permit any any
!
class-map match-any mac-any-any
 match access-group name mac-any-any
!
policy-map police-10mbit-in
 class mac-any-any
  police 10000000 1000000 exceed-action drop
!
interface GigabitEthernet0/14
 service-policy input police-10mbit-in
!

Ive also tried with just class-default, but got the same result.

I am currently using the "vlan" SDM profile, if that makes any difference.

Cheers,
Tom

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From uugnaa_mns at yahoo.com  Tue Jun  2 07:52:25 2009
From: uugnaa_mns at yahoo.com (uugnaa)
Date: Tue, 2 Jun 2009 04:52:25 -0700 (PDT)
Subject: [c-nsp] Optical Transceiver Module
Message-ID: <268079.75440.qm@web55102.mail.re4.yahoo.com>

Hello all,

Is there any Cisco or third party Optical Transceiver SFP module which goes up to 80km, up to 15km and up to 20km.

Please help me on this.

thank you in advance.



      

From johnny at johnnykarmspedersen.dk  Tue Jun  2 09:55:08 2009
From: johnny at johnnykarmspedersen.dk (Johnny Karms Pedersen)
Date: Tue, 2 Jun 2009 15:55:08 +0200
Subject: [c-nsp] Cisco 3640 flash installation issue.
Message-ID: <kkm6nw.91b8kg@webmail.servnet.dk>

Hi,

I've just installed two 16 MB flash modules in one of my Cisco 3640 with bootstrap v. 11.1(20)AA2.
After I've installed the modules I boot the router up using an external flash card, the modules are recognized and I can partition them as one 32 MB partition. I can also succesfully copy an IOS image to it (checksum verification says everything is ok).

But I reload the router I get the following error messages:

-------------
get_man_dev: Unknown device - probably NOT formatted.
unknown flash device - mandev code = 0x89aa
cannot read flash info
getdevnum warning: device "flash" has size of zero
get_man_dev: Unknown device - probably NOT formatted.
unknown flash device - mandev code = 0x89aa
cannot read flash info
getdevnum warning: device "flash" has size of zero
get_man_dev: Unknown device - probably NOT formatted.
unknown flash device - mandev code = 0x89aa
cannot read flash info
getdevnum warning: device "flash" has size of zero
get_man_dev: Unknown device - probably NOT formatted.
unknown flash device - mandev code = 0x89aa
cannot read flash info
getdevnum warning: device "flash" has size of zero
open: read error...requested 0x4 bytes, got 0x0
trouble reading device magic number
dir: cannot open device "flash:"
------------

I've got several others running the exact same setup with same bootstrap version.

Any clues to why this doesn't seem to work when booting up, and how to solve it?


Best regards
Johnny Karms Pedersen


From pavel.skovajsa at gmail.com  Tue Jun  2 11:21:21 2009
From: pavel.skovajsa at gmail.com (Pavel Skovajsa)
Date: Tue, 2 Jun 2009 17:21:21 +0200
Subject: [c-nsp] Dot1x stuck in guest-vlan
Message-ID: <323aca890906020821m4d89c879rdaddd5ebe636f0f8@mail.gmail.com>

Hello all,

I am struggling with the way the Guest Vlan is handled in dot1x.
All the port states work just fine, except during workstation boot-up
the switch does not receive dot1x packets from workstation dot1x
client hence forcing the port to fall into Guest Vlan, as below:

=============================================
C3560#sh authentication sessions interface fa0/38
            Interface:  FastEthernet0/38
          MAC Address:  Unknown
           IP Address:  Unknown
            User-Name:  UNRESPONSIVE
               Status:  Authz Success
               Domain:  DATA
       Oper host mode:  multi-host
     Oper control dir:  both
        Authorized By:  Guest Vlan
          Vlan Policy:  330
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0A821A5C00003727DE21D3A1
      Acct Session ID:  0x000045A8
               Handle:  0x63000727

Runnable methods list:
       Method   State
       dot1x    Failed over
==============================================

Once PC and its dot1x client or supplicant is up and running the port
status does not change as I would expect - to production Vlan.
The only remedy here is to shut / no shut the port.

port config:
====================
interface FastEthernet0/38
 switchport access vlan 100
 switchport mode access
 switchport voice vlan 500
 priority-queue out
 authentication event fail action authorize vlan 330
 authentication event server dead action authorize vlan 100
 authentication event no-response action authorize vlan 330         <=
it works without this command for compliant users, however
non-compliant guest machines would not be allowed any network
connectivity at all
 authentication event server alive action reinitialize
 authentication port-control auto
 authentication periodic
 authentication timer restart 20
 authentication timer reauthenticate 20
 authentication timer inactivity 120
 mls qos trust device cisco-phone
 mls qos trust cos
 dot1x pae authenticator
 dot1x timeout server-timeout 100
 dot1x timeout tx-period 2
 dot1x timeout supp-timeout 10
 spanning-tree portfast
end
===========================

Many thanks for any hints,

Pavel Skovajsa

From Michael.Balasko at cityofhenderson.com  Tue Jun  2 14:24:47 2009
From: Michael.Balasko at cityofhenderson.com (Michael Balasko)
Date: Tue, 2 Jun 2009 11:24:47 -0700
Subject: [c-nsp] Optical Transceiver Module
In-Reply-To: <268079.75440.qm@web55102.mail.re4.yahoo.com>
References: <268079.75440.qm@web55102.mail.re4.yahoo.com>
Message-ID: <9AF22D15085E7D409ED5710CBC779E930A870DCE@COHNTCS09.ci.henderson.nv.us>

Distance is irrelevant - it's all about optical budget and the quality
of your SM fiber number of splices/patches etc... but you're looking for
a zx spec optic. 

http://www.google.com/search?hl=en&q=sfp+zx&aq=f&oq=&aqi=

Michael Balasko
CCNP,CCSP,MCSE,MCNE
Network Specialist II
City of Henderson, Nevada
240 Water St. 
Henderson, NV 89015
702-267-4337 (single number reach)


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of uugnaa
Sent: Tuesday, June 02, 2009 4:52 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Optical Transceiver Module

Hello all,

Is there any Cisco or third party Optical Transceiver SFP module which
goes up to 80km, up to 15km and up to 20km.

Please help me on this.

thank you in advance.



      
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From pdavis at i2k.com  Tue Jun  2 14:43:41 2009
From: pdavis at i2k.com (Phil Davis)
Date: Tue, 02 Jun 2009 14:43:41 -0400
Subject: [c-nsp] PA-A3-T3 FEBE and LOS
Message-ID: <4A2572DD.3000506@i2k.com>

Hello,

  I have an ATM DS3 coming through a PA-A3-T3. The last few days it 
would abruptly go down for 5-10 minutes, perhaps every 12 hours on 
average. During these times, the interface would show rapidly growing 
carrier signal loss (about 10-20/sec.) I also saw incrementing FEBE 
errors. However, neither the provider, nor a third-party transport 
provider was detecting LOS on the line. However, the far side did see a 
relatively small number of FEBE errors.
  I swapped the interface and it's been quiet for last few hours, though 
it remains to be seen if that's the last of the issue. Does this make 
sense to anybody? I don't understand why an erroring PA would detect LOS 
without LOS being present. Could it have been bouncing in and out of 
loopback?

sh run int ATM1/0:
interface ATM1/0
 no ip address
 no ip mroute-cache
 atm scrambling cell-payload
 atm framing cbitplcp
 no atm auto-configuration
 no atm ilmi-keepalive
 no atm address-registration
 no atm ilmi-enable
 no clns route-cache
end

sh diag 1:
ATM WAN DS3 Port adapter, 1 port
        Port adapter is analyzed
        Port adapter insertion time 02:39:05 ago
        EEPROM contents at hardware discovery:
        Hardware revision 2.0           Board revision A0
        Serial number     23121181      Part number    73-2432-04
        FRU Part Number:  PA-A3-T3=

        Test history      0x0           RMA number     00-00-00
        EEPROM format version 1
        EEPROM contents (hex):
          0x00: 01 5B 02 00 01 60 CD 1D 49 09 80 04 00 00 00 00
          0x10: 50 00 00 00 00 09 17 00 FF FF FF FF FF FF FF FF

sh contr atm1/0:
Slot 1:
        ATM WAN DS3 Port adapter, 1 port
        Port adapter is analyzed
        Port adapter insertion time 02:39:05 ago
        EEPROM contents at hardware discovery:
        Hardware revision 2.0           Board revision A0
        Serial number     23121181      Part number    73-2432-04
        FRU Part Number:  PA-A3-T3=

        Test history      0x0           RMA number     00-00-00
        EEPROM format version 1
        EEPROM contents (hex):
          0x00: 01 5B 02 00 01 60 CD 1D 49 09 80 04 00 00 00 00
          0x10: 50 00 00 00 00 09 17 00 FF FF FF FF FF FF FF FF

sh contr atm1/0:
Interface ATM1/0 is up
Hardware is ENHANCED ATM PA - DS3 (45000Kbps)
Framer is PMC PM7345 S/UNI-PDH, SAR is LSI ATMIZER II
Firmware rev: G153, Framer rev: 1, ATMIZER II rev: 3
  idb=0x63A1F0D4, ds=0x63A491E0, vc=0x63A572E0
  slot 1, unit 1, subunit 0, fci_type 0x005B, ticks 9682
  1200 rx buffers: size=512, encap=64, trailer=28, magic=4
Curr Stats:
  VCC count: current=32, peak=32
  AAL2 VCC count: 0
  AAL2 TX no buffer count: 0
  AAL2 RX no buffer count: 0
  SAR crashes: Rx SAR=0, Tx SAR=0
  rx_cell_lost=0, rx_no_buffer=0, rx_crc_10=0, rx_no_mem=0
  rx_cell_len=0, rx_no_vcd=313, rx_cell_throttle=0, tx_aci_err=0
Rx Free Ring status:
  base=0x3CA7C040, size=2048, write=1016
Rx Compl Ring status:
  base=0x7E4DB7E0, size=2048, read=834
Tx Ring status:
  base=0x3CF13A40, size=8192, write=2205
Tx Compl Ring status:
  base=0x0E1B3840, size=4096, read=1101
BFD Cache status:
  base=0x65F45940, size=6144, read=6140
Rx Cache status:
  base=0x64458360, size=16, write=2
Tx Shadow status:
  base=0x66691E60, size=8192, read=2191, write=2205
Control data:
  rx_max_spins=22, max_tx_count=144, tx_count=14
  rx_threshold=800, rx_count=2, tx_threshold=4608
  tx bfd write indx=0x47C, rx_pool_info=0x63A208C0
Control data base address:
       rx_buf_base = 0x0E3A6C80        rx_p_base = 0x66802E80
            rx_pak = 0x639727DC              cmd = 0x64752080
            framer = 0x60479798        framer_cb = 0x6474FB80
       framer_base = 0x3C900000     pci_pa_stats = 0x7E391900
    device_base[0] = 0x3C800000   device_base[1] = 0x3CC00000
     ssram_base[0] = 0x3CA00000    ssram_base[1] = 0x3CE00000
     sdram_base[0] = 0x3CB00000    sdram_base[1] = 0x3CF00000
     pa_cmd_buf[0] = 0x3CA7FC00    pa_cmd_buf[1] = 0x3CE7FC00
       vcd_base[0] = 0x3CA00000      vcd_base[1] = 0x3CE18000
      chip_dump[0] = 0x0E39192C     chip_dump[1] = 0x0E391A2C
   sar_buf_base[0] = 0x3CB24000  sar_buf_base[1] = 0x3CF1C000
       bfd_base[0] = 0x3CA64000      bfd_base[1] = 0x3CE00000
       acd_base[0] = 0x3CA22080      acd_base[1] = 0x3CE38240
Framer Information:
 Framing mode: DS3 C-bit PLCP
 No alarm detected
Facility statistics: current interval elapsed 682 seconds
          lcv       fbe       ezd        pe       ppe      febe      hcse
   ----------------------------------------------------------------------
 0          1         0         1         1         1         0         0

PLCP Errors:
         bipe       fbe      febe
    -----------------------------
 0          1         0         0

   lcv:  Line Code Violation
   fbe:  Framing Bit Error
   ezd:  Summed Excessive Zeros
   pe:   Parity Error
   ppe:  Path Parity Error
   febe: Far-end Block Error
   hcse: Rx Cell HCS Error
   bipe: Bit Interleave Parity (B1) Error

Thanks!
Phil

From andy at xecu.net  Tue Jun  2 15:21:12 2009
From: andy at xecu.net (Andy Dills)
Date: Tue, 2 Jun 2009 15:21:12 -0400 (EDT)
Subject: [c-nsp] Netflow analyzer suggestions
Message-ID: <20090602150859.H38689@shell.xecu.net>


Hi there,

Apologies for the non-cisco specific post, but I couldn't think of a 
better list to post to off of the top of my head.

A friend of mine is looking to get some better visibility into their 
network usage (low bandwidth, T1 type scenario). I got them setup with an 
IOS that supports netflow v9, and since they had a freebsd box being 
barely used, I built ntop to be their collector/analyzer.

It works reasonably well, but it's perhaps not quite...user friendly 
enough for them.

What they're looking for is a graphical representation at the host level. 
In essence, they're looking for something like cricket/mrtg but with each 
IP having its own graph (rather than each interface). Additional features, 
such as protocol breakdown and so forth are helpful, but the primary 
desire is to be able to see how much bandwidth a given IP address is using 
currently and was using in the past.

They're open to commercial solutions, but would prefer to keep costs down. 
Host operating system requirements for the collector/analyzer aren't 
important.

Does anybody have any suggestions they could pass along?

Thanks,
Andy

---
Andy Dills
Xecunet, Inc.
www.xecu.net
301-682-9972
---

From florinb at teksavvy.com  Tue Jun  2 16:59:41 2009
From: florinb at teksavvy.com (florinb at teksavvy.com)
Date: Tue, 02 Jun 2009 16:59:41 -0400
Subject: [c-nsp] Cisco 7204 Ethernet LMI Question
Message-ID: <d180e9ff1a12883c8c839bbabc956346@teksavvy.com>

Hi, 
I would like to ask your opinion on an issue I see in a configuration where a 7204 acts as a CE and it is running Ethernet LMI on an FastE interface: 

interface FastEthernet2/0
no ip address
logging event subif-link-status
duplex full
no keepalive
ethernet lmi interface
ethernet lmi t391 10
ethernet lmi n393 4
!
interface FastEthernet2/0.10
encapsulation dot1Q 10
ip address 10.0.11.12 255.255.255.0

As soon as the PE is sending an Ethernet LMI Status Full Status message with one EVC MAP entry indicating that EVC10 (mapped to VLAN 10 )is new and active in the MEN, the line protocol on interface Fast 2/0 changes status to down, the subinterface Fast 2/0.10 stays up (because LMI indicated the EVC associated to VLAN 10 is active). 
c7204#show int fast 2/0
FastEthernet2/0 is up, line protocol is down
Hardware is AmdFE, address is 0005.dd6e.9038 (bia 0005.dd6e.9038)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set
Keepalive not set
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:12, output 00:00:04, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/40/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
842 packets input, 62128 bytes
Received 0 broadcasts, 0 runts, 0 giants, 1 throttles
1 input errors, 1 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog
0 input packets with dribble condition detected
17244 packets output, 1683765 bytes, 0 underruns
0 output errors, 0 collisions, 35 interface resets
57 unknown protocol drops
57 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

My take is the line protocol status on interface fast 2/0 changes to down because there was no indication from PE of an active EVC associated with VLAN 1 (native VLAN the system associates by default with interface fast 2/0). 
At this point the interface Fast 2/0 keeps sending Ethernet LMI PDUs (as expected by LMI protocol) but it does not accept any Ethernet LMI PDUs from PE ( Ethernet LMI PDUs are untagged ). 
If the PE includes the VLAN 1 in the CE-VLAN map it sends (or if I set the VLAN 10 as native on CE ) the Ethernet LMI PDUs exchange will be successful. 

I wonder if I miss something in CE configuration as it looks unusual to me the Ethernet LMI has to "enable" the data path it will use to send owns PDUs. 
Please let me know your opinion. 
Thanks, 
Florin 



From scott at labyrinth.org  Tue Jun  2 19:58:52 2009
From: scott at labyrinth.org (Scott Keoseyan)
Date: Tue, 2 Jun 2009 19:58:52 -0400
Subject: [c-nsp] Dot1x stuck in guest-vlan
In-Reply-To: <323aca890906020821m4d89c879rdaddd5ebe636f0f8@mail.gmail.com>
References: <323aca890906020821m4d89c879rdaddd5ebe636f0f8@mail.gmail.com>
Message-ID: <88985CB2-7E54-48EB-A397-4826D0283693@labyrinth.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

If you're using the Microsoft supplicant, you may need to make a  
registry change to force the supplicant to issue an EAPOL start to  
initialize the state machine on the port.

See:

http://technet.microsoft.com/en-us/network/cc987603.aspx


The SupplicantMode registry value (HKEY_LOCAL_MACHINE\Software 
\Microsoft\EAPOL\Parameters \General\Global\SupplicantMode) affects  
the behavior of an 802.1X supplicant when sending EAP over LAN (EAPOL)- 
Start packets during 802.1X authentication. The SupplicantMode value  
can be set to the following:

     * 0 - Disable IEEE 802.1X operation.
     * 1 - Never send an EAPOL-Start packet.
     * 2 - Automatically determine when to initiate the transmission  
of EAPOL-Start packets. This is the default value for wired connections.
     * 3 - Send an EAPOL-Start message upon association to initiate  
the 802.1X authentication process, for compliance with the IEEE 802.1X  
specification.



On Jun 2, 2009, at 11:21 AM, Pavel Skovajsa wrote:

> Hello all,
>
> I am struggling with the way the Guest Vlan is handled in dot1x.
> All the port states work just fine, except during workstation boot-up
> the switch does not receive dot1x packets from workstation dot1x
> client hence forcing the port to fall into Guest Vlan, as below:
>
> =============================================
> C3560#sh authentication sessions interface fa0/38
>            Interface:  FastEthernet0/38
>          MAC Address:  Unknown
>           IP Address:  Unknown
>            User-Name:  UNRESPONSIVE
>               Status:  Authz Success
>               Domain:  DATA
>       Oper host mode:  multi-host
>     Oper control dir:  both
>        Authorized By:  Guest Vlan
>          Vlan Policy:  330
>      Session timeout:  N/A
>         Idle timeout:  N/A
>    Common Session ID:  0A821A5C00003727DE21D3A1
>      Acct Session ID:  0x000045A8
>               Handle:  0x63000727
>
> Runnable methods list:
>       Method   State
>       dot1x    Failed over
> ==============================================
>
> Once PC and its dot1x client or supplicant is up and running the port
> status does not change as I would expect - to production Vlan.
> The only remedy here is to shut / no shut the port.
>
> port config:
> ====================
> interface FastEthernet0/38
> switchport access vlan 100
> switchport mode access
> switchport voice vlan 500
> priority-queue out
> authentication event fail action authorize vlan 330
> authentication event server dead action authorize vlan 100
> authentication event no-response action authorize vlan 330         <=
> it works without this command for compliant users, however
> non-compliant guest machines would not be allowed any network
> connectivity at all
> authentication event server alive action reinitialize
> authentication port-control auto
> authentication periodic
> authentication timer restart 20
> authentication timer reauthenticate 20
> authentication timer inactivity 120
> mls qos trust device cisco-phone
> mls qos trust cos
> dot1x pae authenticator
> dot1x timeout server-timeout 100
> dot1x timeout tx-period 2
> dot1x timeout supp-timeout 10
> spanning-tree portfast
> end
> ===========================
>
> Many thanks for any hints,
>
> Pavel Skovajsa
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

- --
Scott Keoseyan
scott at labyrinth.org
Homepage - http://www.labyrinth.org/homepages/scott
Blog - http://www.labyrinth.org/wp1
PGP Key - http://www.labyrinth.org/homepages/scott/pgp.html




-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.11 (Darwin)

iEYEARECAAYFAkolvMAACgkQA7TpMPAlvEdl1gCeOKWRQybwDsfo+rJ5sqX/cXs1
MZYAn1X37ReSSi1zIkGcELpLeaMv1yqp
=X0L3
-----END PGP SIGNATURE-----

From ltd at cisco.com  Tue Jun  2 20:12:42 2009
From: ltd at cisco.com (Lincoln Dale)
Date: Wed, 03 Jun 2009 10:12:42 +1000
Subject: [c-nsp] Optical Transceiver Module
In-Reply-To: <268079.75440.qm@web55102.mail.re4.yahoo.com>
References: <268079.75440.qm@web55102.mail.re4.yahoo.com>
Message-ID: <4A25BFFA.4040406@cisco.com>

in Cisco terms:
    80km would be covered by DWDM, CWDM and ZX optics.
    20km would be covered by DWDM, CWDM, ZX and ER/ER+ optics
    15km may be covered by LR optics at a pinch. would have to be very 
good fiber, few patches etc.  you'd need to know exact fiber 
charactieristcs as to whether its possible.  but if not, then it'll be 
the same as 20km above.

http://www.cisco.com/en/US/prod/collateral/modules/ps5455/white_paper_c11-463661.html 
provides all the details you're looking for.
as others have indicated "distance" is more of a 'typical' thing rather 
than an absolute science.


cheers,

lincoln.

uugnaa wrote:
> Hello all,
>
> Is there any Cisco or third party Optical Transceiver SFP module which goes up to 80km, up to 15km and up to 20km.
>
> Please help me on this.
>
> thank you in advance.
>
>   

From rdobbins at arbor.net  Tue Jun  2 20:35:48 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 3 Jun 2009 07:35:48 +0700
Subject: [c-nsp] Netflow analyzer suggestions
In-Reply-To: <20090602150859.H38689@shell.xecu.net>
References: <20090602150859.H38689@shell.xecu.net>
Message-ID: <222ACA30-9C13-4636-98F9-6F3F87604466@arbor.net>


On Jun 3, 2009, at 2:21 AM, Andy Dills wrote:

> Does anybody have any suggestions they could pass along?

They should be able to use nfdump/nfsen, or most any of the others,  
and do graphing/reporting on individual IPs as /32s, one should think?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From jloiacon at csc.com  Tue Jun  2 20:52:38 2009
From: jloiacon at csc.com (Joe Loiacono)
Date: Tue, 2 Jun 2009 20:52:38 -0400
Subject: [c-nsp] Netflow analyzer suggestions
In-Reply-To: <20090602150859.H38689@shell.xecu.net>
References: <20090602150859.H38689@shell.xecu.net>
Message-ID: <OF9EFA05A9.E09314DD-ON852575CA.00046AC1-852575CA.0004D216@csc.com>

One open-source option is flow-tools and FlowViewer. It does exactly what 
you're asking for. But you would have to export v5 or v7. For information 
and screenshots:

http://ensight.eos.nasa.gov/FlowViewer/

Joe



Andy Dills <andy at xecu.net> 
Sent by: cisco-nsp-bounces at puck.nether.net
06/02/2009 03:21 PM

To
cisco-nsp at puck.nether.net
cc

Subject
[c-nsp] Netflow analyzer suggestions







Hi there,

Apologies for the non-cisco specific post, but I couldn't think of a 
better list to post to off of the top of my head.

A friend of mine is looking to get some better visibility into their 
network usage (low bandwidth, T1 type scenario). I got them setup with an 
IOS that supports netflow v9, and since they had a freebsd box being 
barely used, I built ntop to be their collector/analyzer.

It works reasonably well, but it's perhaps not quite...user friendly 
enough for them.

What they're looking for is a graphical representation at the host level. 
In essence, they're looking for something like cricket/mrtg but with each 
IP having its own graph (rather than each interface). Additional features, 

such as protocol breakdown and so forth are helpful, but the primary 
desire is to be able to see how much bandwidth a given IP address is using 

currently and was using in the past.

They're open to commercial solutions, but would prefer to keep costs down. 

Host operating system requirements for the collector/analyzer aren't 
important.

Does anybody have any suggestions they could pass along?

Thanks,
Andy

---
Andy Dills
Xecunet, Inc.
www.xecu.net
301-682-9972
---
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From r.burts at earthlink.net  Tue Jun  2 21:17:23 2009
From: r.burts at earthlink.net (Rick Burts)
Date: Tue, 02 Jun 2009 21:17:23 -0400
Subject: [c-nsp] ASA / EIGRP / Redundant Interfaces
In-Reply-To: <007a01c9c9b5$22c119a1$0600a8c0@whgroup.com>
References: <007a01c9c9b5$22c119a1$0600a8c0@whgroup.com>
Message-ID: <4A25CF23.4040806@earthlink.net>

It seems to me that an offset list applied outbound
on one of the routers could make its routes less
attractive than the routes from the other router.
This should give you 1 primary set of routes and 1
backup set of routes. And does not require any
special configuration on the ASA.

HTH

Rick

Jason Link wrote:
> Maybe that's the best option here.  I can't seem to find any other way to do it cleanly.
> 
> Thanks!
> 
> 
> -----Original Message-----
> From: Peter Rathlev <peter at rathlev.dk>
> Sent: Thursday, April 30, 2009 11:52 AM
> To: Jason Link <Jason.Link at whgroup.com>
> Cc: Cisco-nsp <cisco-nsp at puck.nether.net>
> Subject: RE: [c-nsp] ASA / EIGRP / Redundant Interfaces
> 
> On Thu, 2009-04-30 at 11:39 -0500, Jason Link wrote:
>> Additionally, I'm not sure HSRP would help me in a situation like this,
>> since the way I understand it the ASA will still learn both routers
>> "real" IP address and will form a neighbor to each one.  I would like to
>> avoid calling out the neighbor specifically, if I can help it.
> 
> Yes of course, if the ASA has to do EIGRP my suggestion is irrelevant. I
> overlooked that somewhat since I'm not used to thinking about having
> firewalls do dynamic routing. :-)
> 
> The HSRP thing would of course be with the ASA not participating in the
> EIGRP. On the ASA side you would use static routes pointing at the HSRP
> IP. On the router side you would use static routes pointing at the ASA
> primary IP.
> 
> Regards,
> Peter
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From pshem.k at gmail.com  Tue Jun  2 22:26:37 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Wed, 3 Jun 2009 14:26:37 +1200
Subject: [c-nsp] ICMP replay from egress PE
Message-ID: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>

Hi,

Recently we've upgraded some of our 7301 to ASR (1004). Config
remained pretty much the same (from L3VPNs perspective), but it looks
like the behaviour of both platforms is somewhat different. I'm not
sure if it's a feature or a bug yet.

We have a typical setup, like this:
CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
                        |              |
                        + --- PE3 --- CE3

So customers site is multihomed via PE2 and PE3 and has internal
connection between CE2 and CE3

With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
(egress interface from the vrf), after the upgrade to ASRs - all we
can see is PE1's IP and then straight CE2/CE3, but since customer
drops icmp packets - we can't really see which way it's really going.
Is there a way to get an ICMP reply from the egress ASR? I understand
it switches the packets out through the interface without actually
doing any lookups, but even after forcing 'label-per-vrf' we can't see
the last hop.
Any ideas if this behaviour can be corrected?

kind regards
Pshem

From zhqasmi at cyber.net.pk  Tue Jun  2 23:45:04 2009
From: zhqasmi at cyber.net.pk (Amjad Ul Hasnain Qasmi)
Date: Wed, 03 Jun 2009 09:45:04 +0600
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
Message-ID: <00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>

Try enabling " mpls ip propagate-ttl "
http://www.cisco.com/en/US/docs/ios/12_3/switch/command/reference/swi_m2.htm
l#wp1058956

Regards,
AHQ

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Pshem Kowalczyk
Sent: Wednesday, June 03, 2009 8:27 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ICMP replay from egress PE

Hi,

Recently we've upgraded some of our 7301 to ASR (1004). Config
remained pretty much the same (from L3VPNs perspective), but it looks
like the behaviour of both platforms is somewhat different. I'm not
sure if it's a feature or a bug yet.

We have a typical setup, like this:
CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
                        |              |
                        + --- PE3 --- CE3

So customers site is multihomed via PE2 and PE3 and has internal
connection between CE2 and CE3

With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
(egress interface from the vrf), after the upgrade to ASRs - all we
can see is PE1's IP and then straight CE2/CE3, but since customer
drops icmp packets - we can't really see which way it's really going.
Is there a way to get an ICMP reply from the egress ASR? I understand
it switches the packets out through the interface without actually
doing any lookups, but even after forcing 'label-per-vrf' we can't see
the last hop.
Any ideas if this behaviour can be corrected?

kind regards
Pshem
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From pshem.k at gmail.com  Wed Jun  3 01:00:13 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Wed, 3 Jun 2009 17:00:13 +1200
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com> 
	<00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>
Message-ID: <20fe625b0906022200h31a74b7ei399dbf870d499636@mail.gmail.com>

Hi,

If I do that I'll see the 'MPLS' hops, which I don't want. All I would
like to see is ICMP reply from the address inside the vrf.

kind regards
Pshem

2009/6/3 Amjad Ul Hasnain Qasmi <zhqasmi at cyber.net.pk>:
> Try enabling " mpls ip propagate-ttl "
> http://www.cisco.com/en/US/docs/ios/12_3/switch/command/reference/swi_m2.htm
> l#wp1058956
>
> Regards,
> AHQ
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Pshem Kowalczyk
> Sent: Wednesday, June 03, 2009 8:27 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ICMP replay from egress PE
>
> Hi,
>
> Recently we've upgraded some of our 7301 to ASR (1004). Config
> remained pretty much the same (from L3VPNs perspective), but it looks
> like the behaviour of both platforms is somewhat different. I'm not
> sure if it's a feature or a bug yet.
>
> We have a typical setup, like this:
> CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
> ? ? ? ? ? ? ? ? ? ? ? ?| ? ? ? ? ? ? ?|
> ? ? ? ? ? ? ? ? ? ? ? ?+ --- PE3 --- CE3
>
> So customers site is multihomed via PE2 and PE3 and has internal
> connection between CE2 and CE3
>
> With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
> (egress interface from the vrf), after the upgrade to ASRs - all we
> can see is PE1's IP and then straight CE2/CE3, but since customer
> drops icmp packets - we can't really see which way it's really going.
> Is there a way to get an ICMP reply from the egress ASR? I understand
> it switches the packets out through the interface without actually
> doing any lookups, but even after forcing 'label-per-vrf' we can't see
> the last hop.
> Any ideas if this behaviour can be corrected?
>
> kind regards
> Pshem
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>

From rick at woofpaws.com  Wed Jun  3 00:54:07 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Tue, 2 Jun 2009 21:54:07 -0700 (PDT)
Subject: [c-nsp] Revisiting ethernet bandwidth management
Message-ID: <58184.172.16.5.57.1244004847.squirrel@www.woofpaws.com>


I'm working on a network refresh that includes the customer aggregation. 
Services to customers are primarily across ethernet (LAN and MAN).

I've been researching/fighting/experimenting with methods to handle
per-port bidirectional bandwidth control.  The legacy configuration uses
Cisco's CAR, and I've been looking at traffic-shaping and policing. From
what I can see, the various bandwidth management techniques require
increasing CPU as the traffic rate increase (more packets/bytes == more
work for the CPU).

I need a device that does at least HSRP/VRRP/equivalent plus OSPF and
handles the bandwidth management.  The 3550G (playing with it for a
different project) reportedly has problems with multiple ports/streams
above 1Mbs.  The chassis-based devices (6500/7600) appear to punt at least
some of the traffic to CPU, plus I'd like to deploy small devices per
patch-panel and backhaul to the aggregation or core (depending on how much
functionality is in the device).

I'd like either a stackable or small chassis device that I can either
configure "M"Mbs per port/VLAN or "P"percent per port, not necessarily
with bursting capability. The extreme hypothetical environment would be
24ea 10/100/1000 ports each configured for 1Mbs bandwidth and hosts on all
ports attempting to send and/or receive at line rate without cratering the
device.

I've also considered essentially aggregating multiple ports/VLANs on a
switch and uplinking with a 100Mbs port.  This would require monitoring
and manual intervention to ensure the aggregate doesn't exceed 100mbs.  We
also have customers that need more than 100mbs which means I'd somehow
have to ensure that a single customer couldn't consume the capacity of an
entire GigE (unless provisioned for it).

Am I missing a feature/device/configuration that is obvious to somebody
else, or.... ?  My concern with any CPU-based solution is that it won't
scale as customer bandwidth needs continue to increase.  I'd also prefer
small, stand-alone devices and distribute them at the patch-panel level
for "light bulb" replacement and ease of cable management.

Thanks,


From rdobbins at arbor.net  Wed Jun  3 01:37:37 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 3 Jun 2009 12:37:37 +0700
Subject: [c-nsp] Revisiting ethernet bandwidth management
In-Reply-To: <58184.172.16.5.57.1244004847.squirrel@www.woofpaws.com>
References: <58184.172.16.5.57.1244004847.squirrel@www.woofpaws.com>
Message-ID: <14260C2D-D4D0-41C9-A506-120AFA1B52A4@arbor.net>


On Jun 3, 2009, at 11:54 AM, Rick Ernst wrote:

> Am I missing a feature/device/configuration that is obvious to  
> somebody
> else, or.... ?

Have you considered going with ASIC-based switches and make use of the  
QoS functionality, so you aren't CPU-bound?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From zhqasmi at cyber.net.pk  Wed Jun  3 02:10:36 2009
From: zhqasmi at cyber.net.pk (Amjad Ul Hasnain Qasmi)
Date: Wed, 03 Jun 2009 12:10:36 +0600
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <20fe625b0906022200h31a74b7ei399dbf870d499636@mail.gmail.com>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
	<00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>
	<20fe625b0906022200h31a74b7ei399dbf870d499636@mail.gmail.com>
Message-ID: <010001c9e412$0369a810$0a3cf830$@net.pk>

As per my understanding of your issue, you want to keep your mpls domain hidden from customer perspective but at the same time you want your egress LER to be appeared in traceroute. you may need to to disable TTL propagation for forwarded packets (VPN traffic), use "no mpls ip propagate forwarded" on LERs, this allows the structure of the MPLS network to be hidden from customers, but not the provider.

Regards,
AHQ



-----Original Message-----
From: Pshem Kowalczyk [mailto:pshem.k at gmail.com] 
Sent: Wednesday, June 03, 2009 11:00 AM
To: Amjad Ul Hasnain Qasmi
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] ICMP replay from egress PE

Hi,

If I do that I'll see the 'MPLS' hops, which I don't want. All I would
like to see is ICMP reply from the address inside the vrf.

kind regards
Pshem

2009/6/3 Amjad Ul Hasnain Qasmi <zhqasmi at cyber.net.pk>:
> Try enabling " mpls ip propagate-ttl "
> http://www.cisco.com/en/US/docs/ios/12_3/switch/command/reference/swi_m2.htm
> l#wp1058956
>
> Regards,
> AHQ
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Pshem Kowalczyk
> Sent: Wednesday, June 03, 2009 8:27 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ICMP replay from egress PE
>
> Hi,
>
> Recently we've upgraded some of our 7301 to ASR (1004). Config
> remained pretty much the same (from L3VPNs perspective), but it looks
> like the behaviour of both platforms is somewhat different. I'm not
> sure if it's a feature or a bug yet.
>
> We have a typical setup, like this:
> CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
>                        |              |
>                        + --- PE3 --- CE3
>
> So customers site is multihomed via PE2 and PE3 and has internal
> connection between CE2 and CE3
>
> With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
> (egress interface from the vrf), after the upgrade to ASRs - all we
> can see is PE1's IP and then straight CE2/CE3, but since customer
> drops icmp packets - we can't really see which way it's really going.
> Is there a way to get an ICMP reply from the egress ASR? I understand
> it switches the packets out through the interface without actually
> doing any lookups, but even after forcing 'label-per-vrf' we can't see
> the last hop.
> Any ideas if this behaviour can be corrected?
>
> kind regards
> Pshem
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>


From gert at greenie.muc.de  Wed Jun  3 03:16:09 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 3 Jun 2009 09:16:09 +0200
Subject: [c-nsp] hung vty on SXH3a?
Message-ID: <20090603071609.GY290@greenie.muc.de>

Hi,

so far, we have been quite happy with SXH3a, but today two of our boxes
have started playing games with me...  notably, the command we use to
auto-upload ACLs etc

   rcp new_config.txt router:running-config

started to fail with "rcp: running-config: No such file or directory".

On other boxes, it works "as usual".  All the "ip rcmd" config is present
and sane.

The only thing that looks different is this:

Cisco#who
    Line       User       Host(s)              Idle       Location
   1 vty 0                Virtual Exec         00:00:00   
*  2 vty 1     gert       idle                 00:00:00 mgmthost

  Interface      User        Mode                     Idle     Peer Address

Cisco#

- "vty 0" looks weird.  I can't find a way to recover that vty, that is
"clear line 1" or "clear line vty 0" don't change anything.  Nor is there
a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
"show tcb vty 0" doesn't display anything).


So... is this a known bug in SXH3a?  Is there a way to reclaim that VTY
without rebooting?

(I've also tried configuring "transport input none" under "line vty 0", 
and to completely disable "ip rcmd ..." to get rid of the session, but no 
change either).

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090603/50c6f5ed/attachment.bin>

From pshem.k at gmail.com  Wed Jun  3 04:30:02 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Wed, 3 Jun 2009 20:30:02 +1200
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <010001c9e412$0369a810$0a3cf830$@net.pk>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com> 
	<00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>
	<20fe625b0906022200h31a74b7ei399dbf870d499636@mail.gmail.com> 
	<010001c9e412$0369a810$0a3cf830$@net.pk>
Message-ID: <20fe625b0906030130o16aedbf1we98d8db9dc920ca1@mail.gmail.com>

Hi,

That setup (without ttl propagation) works fine on 7301. I would like
to know if its possible to achieve the same result using and ASR1004.
Since we are not talking here about only one customer, or one person
that need to troubleshoot the problems having the previous behaviour
back is definitely the best option.

kind regards
Pshem


2009/6/3 Amjad Ul Hasnain Qasmi <zhqasmi at cyber.net.pk>:
> As per my understanding of your issue, you want to keep your mpls domain hidden from customer perspective but at the same time you want your egress LER to be appeared in traceroute. you may need to to disable TTL propagation for forwarded packets (VPN traffic), use "no mpls ip propagate forwarded" on LERs, this allows the structure of the MPLS network to be hidden from customers, but not the provider.
>
> Regards,
> AHQ
>
>
>
> -----Original Message-----
> From: Pshem Kowalczyk [mailto:pshem.k at gmail.com]
> Sent: Wednesday, June 03, 2009 11:00 AM
> To: Amjad Ul Hasnain Qasmi
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] ICMP replay from egress PE
>
> Hi,
>
> If I do that I'll see the 'MPLS' hops, which I don't want. All I would
> like to see is ICMP reply from the address inside the vrf.
>
> kind regards
> Pshem
>
> 2009/6/3 Amjad Ul Hasnain Qasmi <zhqasmi at cyber.net.pk>:
>> Try enabling " mpls ip propagate-ttl "
>> http://www.cisco.com/en/US/docs/ios/12_3/switch/command/reference/swi_m2.htm
>> l#wp1058956
>>
>> Regards,
>> AHQ
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Pshem Kowalczyk
>> Sent: Wednesday, June 03, 2009 8:27 AM
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] ICMP replay from egress PE
>>
>> Hi,
>>
>> Recently we've upgraded some of our 7301 to ASR (1004). Config
>> remained pretty much the same (from L3VPNs perspective), but it looks
>> like the behaviour of both platforms is somewhat different. I'm not
>> sure if it's a feature or a bug yet.
>>
>> We have a typical setup, like this:
>> CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
>> ? ? ? ? ? ? ? ? ? ? ? ?| ? ? ? ? ? ? ?|
>> ? ? ? ? ? ? ? ? ? ? ? ?+ --- PE3 --- CE3
>>
>> So customers site is multihomed via PE2 and PE3 and has internal
>> connection between CE2 and CE3
>>
>> With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
>> (egress interface from the vrf), after the upgrade to ASRs - all we
>> can see is PE1's IP and then straight CE2/CE3, but since customer
>> drops icmp packets - we can't really see which way it's really going.
>> Is there a way to get an ICMP reply from the egress ASR? I understand
>> it switches the packets out through the interface without actually
>> doing any lookups, but even after forcing 'label-per-vrf' we can't see
>> the last hop.
>> Any ideas if this behaviour can be corrected?
>>
>> kind regards
>> Pshem
>> _______________________________________________
>> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>
>
>

From peter at rathlev.dk  Wed Jun  3 04:29:59 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Wed, 03 Jun 2009 10:29:59 +0200
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <20090603071609.GY290@greenie.muc.de>
References: <20090603071609.GY290@greenie.muc.de>
Message-ID: <1244017799.3444.41.camel@localhost.localdomain>

On Wed, 2009-06-03 at 09:16 +0200, Gert Doering wrote:
...
> Cisco#who
>     Line       User       Host(s)              Idle       Location
>    1 vty 0                Virtual Exec         00:00:00   
> *  2 vty 1     gert       idle                 00:00:00 mgmthost
> 
>   Interface      User        Mode                     Idle     Peer Address
> 
> Cisco#
> 
> - "vty 0" looks weird.  I can't find a way to recover that vty, that is
> "clear line 1" or "clear line vty 0" don't change anything.  Nor is there
> a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
> "show tcb vty 0" doesn't display anything).

I've seen this on a 3560 when I tried running an exec command needing
user input via TFTP uploaded configuration. (Specifically I tried to do
a "do delete flash:/something" as a test.)

The session never recovered and only a hard reset (power off) could fix
it. The "reload" command didn't work. It was accepted, but nothing
happened. Needless to say, I just went on with my life and ignored
this. :-)

No strange commands were present in the "new_config.txt" copied over?

Regards,
Peter



From gert at greenie.muc.de  Wed Jun  3 04:47:53 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 3 Jun 2009 10:47:53 +0200
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <1244017799.3444.41.camel@localhost.localdomain>
References: <20090603071609.GY290@greenie.muc.de>
	<1244017799.3444.41.camel@localhost.localdomain>
Message-ID: <20090603084753.GZ290@greenie.muc.de>

Hi,

On Wed, Jun 03, 2009 at 10:29:59AM +0200, Peter Rathlev wrote:
> > - "vty 0" looks weird.  I can't find a way to recover that vty, that is
> > "clear line 1" or "clear line vty 0" don't change anything.  Nor is there
> > a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
> > "show tcb vty 0" doesn't display anything).
> 
> I've seen this on a 3560 when I tried running an exec command needing
> user input via TFTP uploaded configuration. (Specifically I tried to do
> a "do delete flash:/something" as a test.)

Mmmh.  I'm not sure what my colleagues tried - I just found the box in
this state...

> The session never recovered and only a hard reset (power off) could fix
> it. The "reload" command didn't work. It was accepted, but nothing
> happened. Needless to say, I just went on with my life and ignored
> this. :-)

Now *that* is scary.  Sounds something really got stuck on your box.

Well.  Time to reload, and upgrade to SXI...

> No strange commands were present in the "new_config.txt" copied over?

It wasn't *my* new_config.txt, otherwise all the other SXH3a boxes would
be in the same funny state now as well (and they aren't).  Just two of
them...

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090603/7ae93e4a/attachment.bin>

From Kris.Amy at EIP.net.au  Wed Jun  3 04:59:35 2009
From: Kris.Amy at EIP.net.au (Kris Amy)
Date: Wed, 3 Jun 2009 18:59:35 +1000
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <20090603084753.GZ290@greenie.muc.de>
Message-ID: <C64C7897.3EC5B%kris.amy@eip.net.au>

Hi,

I have something similar on a 7200 running 12.3(24a).

    Line       User       Host(s)              Idle       Location
   2 vty 0                idle                    14w6d A.B.C.D

I just haven't got around to reloading the router as this seems the only way to clear the vty.

Cheers,
Kris

On 3/06/09 6:47 PM, "Gert Doering" <gert at greenie.muc.de> wrote:

Hi,

On Wed, Jun 03, 2009 at 10:29:59AM +0200, Peter Rathlev wrote:
> > - "vty 0" looks weird.  I can't find a way to recover that vty, that is
> > "clear line 1" or "clear line vty 0" don't change anything.  Nor is there
> > a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
> > "show tcb vty 0" doesn't display anything).
>
> I've seen this on a 3560 when I tried running an exec command needing
> user input via TFTP uploaded configuration. (Specifically I tried to do
> a "do delete flash:/something" as a test.)

Mmmh.  I'm not sure what my colleagues tried - I just found the box in
this state...

> The session never recovered and only a hard reset (power off) could fix
> it. The "reload" command didn't work. It was accepted, but nothing
> happened. Needless to say, I just went on with my life and ignored
> this. :-)

Now *that* is scary.  Sounds something really got stuck on your box.

Well.  Time to reload, and upgrade to SXI...

> No strange commands were present in the "new_config.txt" copied over?

It wasn't *my* new_config.txt, otherwise all the other SXH3a boxes would
be in the same funny state now as well (and they aren't).  Just two of
them...

gert
--
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de


--
Kind Regards,
Kris Amy
Enterprise IP
Phone:    07 3123 5510
National: 1300 347 287
Fax:      1300 347 329
Direct:   07 3123 5511
Email:    kris.amy at eip.net.au

From achatz at forthnet.gr  Wed Jun  3 08:14:58 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 03 Jun 2009 15:14:58 +0300
Subject: [c-nsp] Ingress policing on a 3560
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A622FF0389D9@exch2k7.gilat.local>
References: <63266.172.25.144.4.1243823930.squirrel@imap.snnap.net>
	<EC993E87D960A541A66BF21D62AA42A622FF0389D9@exch2k7.gilat.local>
Message-ID: <4A266942.1030708@forthnet.gr>

Yep, that is a known way for matching ALL "by-default untrusted" traffic.

--
Tassos

Ziv Leyes wrote on 02/06/2009 15:43:
> I'm applying the same you need using dscp instead of mac for "all traffic" and it's working good, here's a sample:
> 
> class-map match-all ALL-TRAFFIC
>   match ip dscp 0
> !
> policy-map 7-MEGA
>   class ALL-TRAFFIC
>     police 7168000 1344000 exceed-action drop
> 
> !
> interface FastEthernet0/1
> description 7 Megabit rated interface sample
> service-policy input 7-MEGA
> !
> 
> 
> 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Tom Storey
> Sent: Monday, June 01, 2009 5:39 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Ingress policing on a 3560
> 
> Hi all.
> 
> What I'm trying to do is police ingress on a port, using a MAC ACL to
> match traffic to police (just a "permit any any" to match all traffic).
> 
> But what I'm getting is that the switch doesnt appear to be matching any
> traffic at all.
> 
> sw2#sh int gi0/14 | inc put rate
>   30 second input rate 20449000 bits/sec, 1688 packets/sec
>   30 second output rate 2620000 bits/sec, 1690 packets/sec
> sw2#sh policy-map int gi0/14
>  GigabitEthernet0/14
> 
>   Service-policy input: police-10mbit-in
> 
>     Class-map: mac-any-any (match-any)
>       0 packets, 0 bytes
>       30 second offered rate 0 bps, drop rate 0 bps
>       Match: access-group name mac-any-any
>         0 packets, 0 bytes
>         30 second rate 0 bps
> 
>     Class-map: class-default (match-any)
>       0 packets, 0 bytes
>       30 second offered rate 0 bps, drop rate 0 bps
>       Match: any
>         0 packets, 0 bytes
>         30 second rate 0 bps
> 
> Does anyone have any pointers as to what I'm doing wrong? Below is my config.
> 
> mac access-list extended mac-any-any
>  permit any any
> !
> class-map match-any mac-any-any
>  match access-group name mac-any-any
> !
> policy-map police-10mbit-in
>  class mac-any-any
>   police 10000000 1000000 exceed-action drop
> !
> interface GigabitEthernet0/14
>  service-policy input police-10mbit-in
> !
> 
> Ive also tried with just class-default, but got the same result.
> 
> I am currently using the "vlan" SDM profile, if that makes any difference.
> 
> Cheers,
> Tom
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
>  
>  
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
> 
> 
>  
>  
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From ip at ioshints.info  Wed Jun  3 08:23:17 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Wed, 3 Jun 2009 14:23:17 +0200
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
Message-ID: <000d01c9e446$14212550$0a00000a@nil.si>

The only reason I could see for this behavior is the per-platform specific
IP packet processing on the egress PE router.

Obviously the difference between the 7300 and the ASR is the exact moment at
which the TTL is decrememented in the switching path. Based on your
description, ASR decrements TTL before LFIB lookup is performed and thus
decrements the label TTL, whereas the 7301 decrements TTL after the LFIB
lookup causes the VPN label to be popped exposing the IP packet and thus
decrements IP TTL.

I am not sure you can get what you used to have with the ASRs.

You could still, though, ping the PE2/PE3 in-VRF IP address from CE1 to
verify that the PE-CE links are up (and I'm positive you know all this), but
obviously cannot perform end-to-end path verification if CE2/CE3 block
traceroute probes. How about inspecting the VRF routing table on PE1? Do you
have access to it?

Interesting behavior, thanks for sharing it!
Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/
 

> -----Original Message-----
> From: Pshem Kowalczyk [mailto:pshem.k at gmail.com] 
> Sent: Wednesday, June 03, 2009 4:27 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ICMP replay from egress PE
> 
> Hi,
> 
> Recently we've upgraded some of our 7301 to ASR (1004). 
> Config remained pretty much the same (from L3VPNs 
> perspective), but it looks like the behaviour of both 
> platforms is somewhat different. I'm not sure if it's a 
> feature or a bug yet.
> 
> We have a typical setup, like this:
> CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
>                         |              |
>                         + --- PE3 --- CE3
> 
> So customers site is multihomed via PE2 and PE3 and has 
> internal connection between CE2 and CE3
> 
> With 7301 Traceroute from CE1 used to show the IP of PE2 or 
> PE3 (egress interface from the vrf), after the upgrade to 
> ASRs - all we can see is PE1's IP and then straight CE2/CE3, 
> but since customer drops icmp packets - we can't really see 
> which way it's really going.
> Is there a way to get an ICMP reply from the egress ASR? I 
> understand it switches the packets out through the interface 
> without actually doing any lookups, but even after forcing 
> 'label-per-vrf' we can't see the last hop.
> Any ideas if this behaviour can be corrected?
> 
> kind regards
> Pshem
> 
> 


From panocisco77 at gmail.com  Wed Jun  3 09:45:14 2009
From: panocisco77 at gmail.com (Renelson Panosky)
Date: Wed, 3 Jun 2009 09:45:14 -0400
Subject: [c-nsp] IPV6 implementation
Message-ID: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>

I am getting ready to start running IPV6 on my core routers, i have a couple
questions for the people who already have IPV6 running

1. Should I let computers determine their own IPV6 addresses ?

2. Should I procure IPV6 DHCP Appliance ?

or

3. Should i configure my router to act as the IPV6 DHCP Servers?



Renelson

From jcposeidon at cantv.net  Wed Jun  3 09:52:01 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 03 Jun 2009 09:22:01 -0430
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU Load?
Message-ID: <4A268001.8030101@cantv.net>

Guys

    I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor 
stuff) and we are thinking about change the IO/7200-2FE by one 
IO/7200-GE could this help with this load?

Thanks

From rick at woofpaws.com  Wed Jun  3 10:15:41 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Wed, 3 Jun 2009 07:15:41 -0700 (PDT)
Subject: [c-nsp] Revisiting ethernet bandwidth management
In-Reply-To: <14260C2D-D4D0-41C9-A506-120AFA1B52A4@arbor.net>
References: <58184.172.16.5.57.1244004847.squirrel@www.woofpaws.com>
	<14260C2D-D4D0-41C9-A506-120AFA1B52A4@arbor.net>
Message-ID: <44037.69.30.17.85.1244038541.squirrel@www.woofpaws.com>


Any specific ASIC-based switch in mind?

What I've found (so far) with QoS is that it's generally ingress-only or
prioritization/congestion-management rather than bandwidth control.  I'm
quite willing to be corrected, though. :)

Rick


On Tue, June 2, 2009 22:37, Roland Dobbins wrote:
>
> On Jun 3, 2009, at 11:54 AM, Rick Ernst wrote:
>
>> Am I missing a feature/device/configuration that is obvious to
>> somebody
>> else, or.... ?
>
> Have you considered going with ASIC-based switches and make use of the
> QoS functionality, so you aren't CPU-bound?
>
> -----------------------------------------------------------------------
> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>
>          Unfortunately, inefficiency scales really well.
>
> 		   -- Kevin Lawton
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>


From pdavis at i2k.com  Wed Jun  3 10:21:20 2009
From: pdavis at i2k.com (Phil Davis)
Date: Wed, 03 Jun 2009 10:21:20 -0400
Subject: [c-nsp] PA-A3-T3 FEBE and LOS
In-Reply-To: <4A2572DD.3000506@i2k.com>
References: <4A2572DD.3000506@i2k.com>
Message-ID: <4A2686E0.9080207@i2k.com>

Phil Davis wrote:
> Hello,
>
>  I have an ATM DS3 coming through a PA-A3-T3. The last few days it 
> would abruptly go down for 5-10 minutes, perhaps every 12 hours on 
> average. During these times, the interface would show rapidly growing 
> carrier signal loss (about 10-20/sec.) I also saw incrementing FEBE 
> errors. However, neither the provider, nor a third-party transport 
> provider was detecting LOS on the line...<>

Just wanted to add to this. Overnight we saw the same issue with the 
replacement card, so I don't think it's our equipment. I now have some 
statistics that show the carrier transition/febe errors. I'm at a loss 
to fully interpret the sh controllers atm command. What is the first 
column on PLPC errors? Would appreciate any help I could get on this. 
Thanks!

Phil

sh int ATM1/0:
ATM1/0 is up, line protocol is up
  Hardware is ENHANCED ATM PA
  MTU 4470 bytes, sub MTU 4470, BW 40704 Kbit, DLY 190 usec,
     reliability 255/255, txload 204/255, rxload 29/255
  Encapsulation ATM, loopback not set
  Encapsulation(s): AAL5
  4095 maximum active VCs, 32 current VCCs
  VC Auto Creation Disabled.
  VC idle disconnect time: 300 seconds
  74 carrier transitions
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters 22:12:59
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 4673
  Queueing strategy: Per VC Queueing
  5 minute input rate 4695000 bits/sec, 2630 packets/sec
  5 minute output rate 32647000 bits/sec, 3750 packets/sec
     132076194 packets input, 900144269 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     38 input errors, 38 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     174968028 packets output, 1377286139 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out

I do see some CRC errors now, which did not see previously. That may be 
from insertion.

sh controller atm 1/0:
Interface ATM1/0 is up
Hardware is ENHANCED ATM PA - DS3 (45000Kbps)
Framer is PMC PM7345 S/UNI-PDH, SAR is LSI ATMIZER II
Firmware rev: G153, Framer rev: 1, ATMIZER II rev: 3
  idb=0x63A1F0D4, ds=0x63A491E0, vc=0x63A572E0
  slot 1, unit 1, subunit 0, fci_type 0x005B, ticks 79887
  1200 rx buffers: size=512, encap=64, trailer=28, magic=4
Curr Stats:
  VCC count: current=32, peak=32
  AAL2 VCC count: 0
  AAL2 TX no buffer count: 0
  AAL2 RX no buffer count: 0
  SAR crashes: Rx SAR=0, Tx SAR=0
  rx_cell_lost=0, rx_no_buffer=0, rx_crc_10=0, rx_no_mem=0
  rx_cell_len=0, rx_no_vcd=34410, rx_cell_throttle=0, tx_aci_err=0
Rx Free Ring status:
  base=0x3CA7C040, size=2048, write=400
Rx Compl Ring status:
  base=0x7E4DB7E0, size=2048, read=1662
Tx Ring status:
  base=0x3CF13A40, size=8192, write=312
Tx Compl Ring status:
  base=0x0E1B3840, size=4096, read=156
BFD Cache status:
  base=0x65F45940, size=6144, read=6143
Rx Cache status:
  base=0x64458360, size=16, write=14
Tx Shadow status:
  base=0x66691E60, size=8192, read=303, write=312
Control data:
  rx_max_spins=42, max_tx_count=144, tx_count=9
  rx_threshold=800, rx_count=14, tx_threshold=4608
  tx bfd write indx=0x10DF, rx_pool_info=0x63A208C0
Control data base address:
       rx_buf_base = 0x0E3A6C80        rx_p_base = 0x66802E80
            rx_pak = 0x639727DC              cmd = 0x64752080
            framer = 0x60479798        framer_cb = 0x6474FB80
       framer_base = 0x3C900000     pci_pa_stats = 0x7E391900
    device_base[0] = 0x3C800000   device_base[1] = 0x3CC00000
     ssram_base[0] = 0x3CA00000    ssram_base[1] = 0x3CE00000
     sdram_base[0] = 0x3CB00000    sdram_base[1] = 0x3CF00000
     pa_cmd_buf[0] = 0x3CA7FC00    pa_cmd_buf[1] = 0x3CE7FC00
       vcd_base[0] = 0x3CA00000      vcd_base[1] = 0x3CE18000
      chip_dump[0] = 0x0E39192C     chip_dump[1] = 0x0E391A2C
   sar_buf_base[0] = 0x3CB24000  sar_buf_base[1] = 0x3CF1C000
       bfd_base[0] = 0x3CA64000      bfd_base[1] = 0x3CE00000
       acd_base[0] = 0x3CA22080      acd_base[1] = 0x3CE38240
Framer Information:
 Framing mode: DS3 C-bit PLCP
 No alarm detected
Facility statistics: current interval elapsed 687 seconds
          lcv       fbe       ezd        pe       ppe      febe      hcse
   ----------------------------------------------------------------------
21          2         0         1         1         1         0         0
25          2         0         1         0         0         0         0
33          0         0         0         0         0    865055         0
34          0         0         0         0         0   5002913         0
38          0         0         0         0         0   7526033         0
39          0         0         0         0         0   3415647         0
40          0         0         0         0         0   1498637         0
42          0         0         0         0         0    217324         0
44          0         0         0         0         0   2972255         0
68          2         0         1         0         0         0         0
78          1         0         1         1         1         0         0

PLCP Errors:
         bipe       fbe      febe
    -----------------------------
21          1         0         0
25          2         0         0
33          0         0     65655
34          0         0    272680
38          0         0   1744705
39          0         0   2043937
40          0         0    957544
42          0         0     21423
44          0         0    866414
68          1         0         0
78          1         0         0

   lcv:  Line Code Violation
   fbe:  Framing Bit Error
   ezd:  Summed Excessive Zeros
   pe:   Parity Error
   ppe:  Path Parity Error
   febe: Far-end Block Error
   hcse: Rx Cell HCS Error
   bipe: Bit Interleave Parity (B1) Error




From gert at greenie.muc.de  Wed Jun  3 10:34:15 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 3 Jun 2009 16:34:15 +0200
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <4A268001.8030101@cantv.net>
References: <4A268001.8030101@cantv.net>
Message-ID: <20090603143415.GC290@greenie.muc.de>

Hi,

On Wed, Jun 03, 2009 at 09:22:01AM -0430, Juan C. Crespo R. wrote:
>    I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor 
> stuff) and we are thinking about change the IO/7200-2FE by one 
> IO/7200-GE could this help with this load?

No.  This is a CPU-based platform - the only way to reduce the CPU load
is to get a faster CPU or turn off features.

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090603/5e23730e/attachment.bin>

From trejrco at gmail.com  Wed Jun  3 10:27:58 2009
From: trejrco at gmail.com (TJ)
Date: Wed, 3 Jun 2009 10:27:58 -0400
Subject: [c-nsp] IPV6 implementation
In-Reply-To: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>
References: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>
Message-ID: <005a01c9e457$a7456380$f5d02a80$@com>

Short answer - it depends.

Quick thoughts:
	1) SLAAC can suffice, assuming IPv4 is present to "cheat" off of for
DNS/name resolution.  
	   Or if/when RFC5006 gets more widely supported.
	
	2) Maybe, see next comment :).
	
	3) DHCPv6 client and server support is not exactly 100% available on
all platforms, atleast 
	   not natively (3rd party apps exist, e.g. - Dibbler).  Many
routers currently support 
	   stateless DHCPv6 server functionality only ... not stateful.


HTH!
/TJ


>-----Original Message-----
>From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
>bounces at puck.nether.net] On Behalf Of Renelson Panosky
>Sent: Wednesday, June 03, 2009 9:45 AM
>To: cisco-nsp at puck.nether.net
>Subject: [c-nsp] IPV6 implementation
>
>I am getting ready to start running IPV6 on my core routers, i have a
couple
>questions for the people who already have IPV6 running
>
>1. Should I let computers determine their own IPV6 addresses ?
>
>2. Should I procure IPV6 DHCP Appliance ?
>
>or
>
>3. Should i configure my router to act as the IPV6 DHCP Servers?
>
>
>
>Renelson
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/


From dgranzer at gmail.com  Wed Jun  3 10:49:01 2009
From: dgranzer at gmail.com (David Granzer)
Date: Wed, 3 Jun 2009 16:49:01 +0200
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <4A268001.8030101@cantv.net>
References: <4A268001.8030101@cantv.net>
Message-ID: <844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>

Hi,

could you post how much bandwidth and packet per second your 7200 ?
Generally upgrade to I/O GE will not
help much because the performance is based on the NPE used.

regards,
David


On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R. <jcposeidon at cantv.net> wrote:
> Guys
>
> ? I have one POP with 90% of CPU Load (WCCP2, ?QoS and other minor stuff)
> and we are thinking about change the IO/7200-2FE by one IO/7200-GE could
> this help with this load?
>
> Thanks
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From jcposeidon at cantv.net  Wed Jun  3 11:01:10 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 03 Jun 2009 10:31:10 -0430
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
Message-ID: <4A269036.3080507@cantv.net>

It have

int fa0/0
  30 second input rate 30616000 bits/sec, 13300 packets/sec
  30 second output rate 47680000 bits/sec, 12178 packets/sec

int fa 0/1
  30 second input rate 27478000 bits/sec, 4672 packets/sec
  30 second output rate 19071000 bits/sec, 3774 packets/sec

int ser4/0 (ds3 link)
 30 second input rate 43264000 bits/sec, 11862 packets/sec
 30 second output rate 28832000 bits/sec, 13590 packets/sec

59376 Total

Thanks

David Granzer escribi?:
> Hi,
>
> could you post how much bandwidth and packet per second your 7200 ?
> Generally upgrade to I/O GE will not
> help much because the performance is based on the NPE used.
>
> regards,
> David
>
>
> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R. <jcposeidon at cantv.net> wrote:
>   
>> Guys
>>
>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor stuff)
>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE could
>> this help with this load?
>>
>> Thanks
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>     
>
>   

From lists at quux.de  Wed Jun  3 11:09:11 2009
From: lists at quux.de (Jens Link)
Date: Wed, 03 Jun 2009 17:09:11 +0200
Subject: [c-nsp] IPV6 implementation
In-Reply-To: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>
	(Renelson Panosky's message of "Wed\,
	3 Jun 2009 09\:45\:14 -0400")
References: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>
Message-ID: <87oct5z754.fsf@laphroiag.quux.de>

Renelson Panosky <panocisco77 at gmail.com> writes:

> I am getting ready to start running IPV6 on my core routers, i have a couple
> questions for the people who already have IPV6 running
>
> 1. Should I let computers determine their own IPV6 addresses ?

Yes and no. For end user computers I would use SLAC (or maybe DCHPv6), for
servers, printers, ... static addresses

> 2. Should I procure IPV6 DHCP Appliance ?
>
> or
>
> 3. Should i configure my router to act as the IPV6 DHCP Servers?

Well that depends on how big your network is and if you have one group
managing DHCP and the other managing the routers. A *NIX (or Windows)
Sever will work just fine, it's more transparent, easier to troubleshoot
and yo probably get security updates faster.

cheers 

Jens
--
-------------------------------------------------------------------------
| Foelderichstr. 40  | 13595 Berlin, Germany | +49-151-18721264         |
| http://www.quux.de | http://blog.quux.de   | jabber: jenslink at guug.de |
-------------------------------------------------------------------------

From masood at nexlinx.net.pk  Wed Jun  3 12:24:15 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Wed, 3 Jun 2009 21:24:15 +0500 (PKT)
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A269036.3080507@cantv.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
Message-ID: <25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>

cisco 7200 is a software based router so that every packet is punted to
the NPE. You need to replace your NPE instead of PIC. which cisco 7200
series network processing engine you are running? what you get when do
"show version" on this router? By using 'show processes cpu sorted 1min'
you can check which process is eating NPE cpu cycles.

Regards,
Masood


> It have
>
> int fa0/0
>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>
> int fa 0/1
>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>
> int ser4/0 (ds3 link)
>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>
> 59376 Total
>
> Thanks
>
> David Granzer escribi?:
>> Hi,
>>
>> could you post how much bandwidth and packet per second your 7200 ?
>> Generally upgrade to I/O GE will not
>> help much because the performance is based on the NPE used.
>>
>> regards,
>> David
>>
>>
>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R. <jcposeidon at cantv.net>
>> wrote:
>>
>>> Guys
>>>
>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>> stuff)
>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>> could
>>> this help with this load?
>>>
>>> Thanks
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>>
>>
>>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From jcposeidon at cantv.net  Wed Jun  3 11:26:05 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 03 Jun 2009 10:56:05 -0430
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <4A26960D.8070206@cantv.net>

NPE 400

CPU utilization for five seconds: 76%/75%; one minute: 74%; five 
minutes: 75%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  45   210365012  85449013       2461  0.23%  0.19%  0.19%   0 IP Input
 118    99161264 248440739        399  0.23%  0.08%  0.06%   0 traffic_shape
  18    19988356  29194664        684  0.00%  0.03%  0.02%   0 ARP Input
   4    49353040   2274191      21701  0.00%  0.03%  0.04%   0 Check heaps
  10    11268080  11331204        994  0.00%  0.02%  0.00%   0 EnvMon
  63     8535512  47262546        180  0.07%  0.01%  0.00%   0 Spanning Tree
  29    19555460    389652      50187  0.00%  0.01%  0.00%   0 
Per-minute Jobs
   5     6393048    430645      14845  0.07%  0.00%  0.00%   0 Pool Manager
 119    14495556   1901716       7622  0.00%  0.00%  0.00%   0 MFI LFD 
Timer Pr
  59     5397356   1127172       4788  0.00%  0.00%  0.00%   0 WCCP V2 
Protocol
  11           0         1          0  0.00%  0.00%  0.00%   0 OIR Handler
  12        7912    190100         41  0.00%  0.00%  0.00%   0 IPC 
Dynamic Cach
  13           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone 
Manager
  14     1344312  11329870        118  0.00%  0.00%  0.00%   0 IPC 
Periodic Tim
  15     1196200  11329850        105  0.00%  0.00%  0.00%   0 IPC 
Deferred Por
  16           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat 
Manager
  17       44772   1140352         39  0.00%  0.00%  0.00%   0 Compute 
SRP rate
   9           0         1          0  0.00%  0.00%  0.00%   0 Policy 
Manager
  19           0        28          0  0.00%  0.00%  0.00%   0 DDR Timers
  20           0         2          0  0.00%  0.00%  0.00%   0 Dialer event
  21           0         2          0  0.00%  0.00%  0.00%   0 Entity 
MIB API
  22           0         1          0  0.00%  0.00%  0.00%   0 SERIAL 
A'detect
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  23      770388   2845739        270  0.00%  0.00%  0.00%   0 HC 
Counter Timer
  24        5264        22     239272  0.00%  0.00%  0.00%   0 Critical 
Bkgnd
  25     3963452   4658455        850  0.00%  0.00%  0.00%   0 Net 
Background
  26        6188      3016       2051  0.00%  0.00%  0.00%   0 Logger
  27     2206724  11329804        194  0.00%  0.00%  0.00%   0 TTY 
Background
  28    65577956  11340517       5782  0.00%  0.00%  0.00%   0 
Per-Second Jobs
   8      144284   2275716         63  0.00%  0.00%  0.00%   0 
ALARM_TRIGGER_SC
   7           0         2          0  0.00%  0.00%  0.00%   0 Serial 
Backgroun
  31           0         1          0  0.00%  0.00%  0.00%   0 CSP Timer
   6           0         2          0  0.00%  0.00%  0.00%   0 Timers
  33           0         2          0  0.00%  0.00%  0.00%   0 Hawkeye 
Backgrou
  34           0         1          0  0.00%  0.00%  0.00%   0 SONET 
alarm time
   3     3297860   3024757       1090  0.00%  0.00%  0.00%   0 OSPF Hello
  36           0         2          0  0.00%  0.00%  0.00%   0 VNM DSPRM 
MAIN
  37           0         1          0  0.00%  0.00%  0.00%   0 CES Line 
Conditi
  38           0         2          0  0.00%  0.00%  0.00%   0 Flash MIB 
Update
  39           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM Input
  40           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM TIMER
  41           8        86         93  0.00%  0.00%  0.00%   0 TurboACL
  42           0         2          0  0.00%  0.00%  0.00%   0 CEF 
switching ba
  43           0         1          0  0.00%  0.00%  0.00%   0 AC Switch
  44           0         2          0  0.00%  0.00%  0.00%   0 AAA 
Dictionary R
   2      635356   2279979        278  0.00%  0.00%  0.00%   0 Load Meter
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  46           0         1          0  0.00%  0.00%  0.00%   0 ICMP 
event handl
  47     1608916   1520006       1058  0.00%  0.00%  0.00%   0 CDP Protocol
  48     1785752   1202253       1485  0.00%  0.00%  0.00%   0 LDP
  49          16       175         91  0.00%  0.00%  0.00%   0 OLM
  50           0         1          0  0.00%  0.00%  0.00%   0 PPPATM 
Session d
  51           0         2          0  0.00%  0.00%  0.00%   0 PASVC 
create VA
  52        9512      1676       5675  0.00%  0.00%  0.00%   0 EEM ED Syslog
  53           0         2          0  0.00%  0.00%  0.00%   0 EEM ED SNMP
  54           0         2          0  0.00%  0.00%  0.00%   0 EEM ED 
Memory Th
  55       23596    202778        116  0.00%  0.00%  0.00%   0 EEM ED Timer
  56           0         2          0  0.00%  0.00%  0.00%   0 EEM ED 
Counter
  57           0         2          0  0.00%  0.00%  0.00%   0 EEM ED 
Interface
  58           0         3          0  0.00%  0.00%  0.00%   0 EEM ED IOSWD
  30           0         1          0  0.00%  0.00%  0.00%   0 Inode 
Table Dest
  32           0         2          0  0.00%  0.00%  0.00%   0 CES Timer
  61           0         1          0  0.00%  0.00%  0.00%   0 MPLS 
Auto-Tunnel
  62           0         1          0  0.00%  0.00%  0.00%   0 O-UNI 
Client Msg
  35           0         1          0  0.00%  0.00%  0.00%   0 POS APS 
Event Pr
  64           0         1          0  0.00%  0.00%  0.00%   0 AC Mgr
  65           0         1          0  0.00%  0.00%  0.00%   0 SSS Manager
  66           0         2          0  0.00%  0.00%  0.00%   0 SSM 
connection m
  67           0         1          0  0.00%  0.00%  0.00%   0 PPP IP 
Add Route
  68       90640    189720        477  0.00%  0.00%  0.00%   0 CEF 
background
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  69           0         1          0  0.00%  0.00%  0.00%   0 IP IRDP
   1           0         2          0  0.00%  0.00%  0.00%   0 Chunk Manager
  71     2091684    355745       5879  0.00%  0.00%  0.00%   0 IP Background
  72     2340232    344710       6788  0.00%  0.00%  0.00%   0 IP RIB Update
  73    69186296  16952818       4081  0.00%  0.00%  0.00%   0 CEF: IPv4 
proces
  74          24       122        196  0.00%  0.00%  0.00%   0 ADJ 
background
  75           0         1          0  0.00%  0.00%  0.00%   0 L2X Data 
Daemon
  76           0         1          0  0.00%  0.00%  0.00%   0 HTTP Timer
  77      646408    693913        931  0.00%  0.00%  0.00%   0 TCP Timer
  78         800       219       3652  0.00%  0.00%  0.00%   0 TCP Protocols
  79           0         1          0  0.00%  0.00%  0.00%   0 Probe Input
  80           0         1          0  0.00%  0.00%  0.00%   0 RARP Input
  81           0         1          0  0.00%  0.00%  0.00%   0 Socket Timers
  82           0         2          0  0.00%  0.00%  0.00%   0 LSP Tunnels
  83           0         1          0  0.00%  0.00%  0.00%   0 COPS
  84           0         1          0  0.00%  0.00%  0.00%   0 X.25 
Encaps Mana
  85           0         1          0  0.00%  0.00%  0.00%   0 PAD InCall
  86           0         2          0  0.00%  0.00%  0.00%   0 X.25 
Background
  87          88       375        234  0.00%  0.00%  0.00%   0 AToM manager
  88           0         5          0  0.00%  0.00%  0.00%   0 AToM LDP 
manager
  89       79992    190099        420  0.00%  0.00%  0.00%   0 LDP 
Background
  90           0         1          0  0.00%  0.00%  0.00%   0 L2X 
Socket proce
  91           0         1          0  0.00%  0.00%  0.00%   0 L2X SSS 
manager
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  92           0         1          0  0.00%  0.00%  0.00%   0 L2TP mgmt 
daemon
  93          28       204        137  0.00%  0.00%  0.00%   0 TCP Listener
  94           4         1       4000  0.00%  0.00%  0.00%   0 TSP
  95           0         1          0  0.00%  0.00%  0.00%   0 VOIP RTP 
Udp Inp
  96           0         1          0  0.00%  0.00%  0.00%   0 
QOS_MODULE_MAIN
  97           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_HTSP
  98           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_R2
  99           0         1          0  0.00%  0.00%  0.00%   0 CCSWVOICE
 100       43864   1140167         38  0.00%  0.00%  0.00%   0 RMON 
Recycle Pro
 101           0         2          0  0.00%  0.00%  0.00%   0 RMON 
Deferred Se
 102           0         1          0  0.00%  0.00%  0.00%   0 SYSMGT Events
 103     1016848  11311292         89  0.00%  0.00%  0.00%   0 
cerf_daemon_proc
 104           0         1          0  0.00%  0.00%  0.00%   0 SONET Traps
 105      640712   2278427        281  0.00%  0.00%  0.00%   0 EEM Server
 106           0         1          0  0.00%  0.00%  0.00%   0 Syslog Traps
 107           0         1          0  0.00%  0.00%  0.00%   0 DATA 
Transfer Pr
 108           0         1          0  0.00%  0.00%  0.00%   0 DATA 
Collector
 109           0         1          0  0.00%  0.00%  0.00%   0 RMON Packets
 110           0         2          0  0.00%  0.00%  0.00%   0 EEM 
Policy Direc
 111     1019748  11311275         90  0.00%  0.00%  0.00%   0 trunk 
conditioni
 112           0         1          0  0.00%  0.00%  0.00%   0 trunk 
conditioni
 113      503088   3349106        150  0.00%  0.00%  0.00%   0 Net Input
 114     2325524   2279676       1020  0.00%  0.00%  0.00%   0 Compute 
load avg
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
 115       83736    766853        109  0.00%  0.00%  0.00%   0 LSP 
Tunnel Head
 116           0         2          0  0.00%  0.00%  0.00%   0 LSDp 
Input Proc
 117     1288824   2405686        535  0.00%  0.00%  0.00%   0 LSD Main Proc
  60           0         1          0  0.00%  0.00%  0.00%   0 LSP 
Tunnel FRR
  70           0         3          0  0.00%  0.00%  0.00%   0 SNMP Timers
 120           0         2          0  0.00%  0.00%  0.00%   0 MFI LFD 
Main Pro
 121     2593264  11627651        223  0.00%  0.00%  0.00%   0 NTP
 122     6873376   1817623       3781  0.00%  0.00%  0.00%   0 Tag Control
 123       21808    190119        114  0.00%  0.00%  0.00%   0 IPRM
 124           0         2          0  0.00%  0.00%  0.00%   0 IP Flow 
Backgrou
 125     4970232   4644514       1070  0.00%  0.00%  0.00%   0 OSPF Hello
 126     4203656   2503602       1679  0.00%  0.00%  0.00%   0 IP SNMP
 127      457588   1255865        364  0.00%  0.00%  0.00%   0 PDU 
DISPATCHER
 128     5118352   1257172       4071  0.00%  0.00%  0.00%   0 SNMP ENGINE
 129           0         1          0  0.00%  0.00%  0.00%   0 SNMP 
ConfCopyPro
 130           0         1          0  0.00%  0.00%  0.00%   0 SNMP Traps
 131       28584    190100        150  0.00%  0.00%  0.00%   0 Time 
Range Proce
 132           0         1          0  0.00%  0.00%  0.00%   0 xcpa-driver
 133        1208       274       4408  0.00%  0.00%  0.00%   0 Tagcon Addr
 134     4599240  11781205        390  0.00%  0.00%  0.00%   0 OSPF Router 1
 135     1168632  11563127        101  0.00%  0.00%  0.00%   0 OSPF Router 2
 136     7196544   6637085       1084  0.00%  0.00%  0.00%   0 TDP Hello
 137        2712      1138       2383  0.00%  0.00%  0.00%   0 RADIUS
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
 139         516       180       2866  0.00%  0.00%  0.00%   0 AAA 
Accounting
 140          60      1542         38  0.00%  0.00%  0.00%   2 Virtual Exec



masood at nexlinx.net.pk escribi?:
> cisco 7200 is a software based router so that every packet is punted to
> the NPE. You need to replace your NPE instead of PIC. which cisco 7200
> series network processing engine you are running? what you get when do
> "show version" on this router? By using 'show processes cpu sorted 1min'
> you can check which process is eating NPE cpu cycles.
>
> Regards,
> Masood
>
>
>   
>> It have
>>
>> int fa0/0
>>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>>
>> int fa 0/1
>>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>>
>> int ser4/0 (ds3 link)
>>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>>
>> 59376 Total
>>
>> Thanks
>>
>> David Granzer escribi?:
>>     
>>> Hi,
>>>
>>> could you post how much bandwidth and packet per second your 7200 ?
>>> Generally upgrade to I/O GE will not
>>> help much because the performance is based on the NPE used.
>>>
>>> regards,
>>> David
>>>
>>>
>>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R. <jcposeidon at cantv.net>
>>> wrote:
>>>
>>>       
>>>> Guys
>>>>
>>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>>> stuff)
>>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>>> could
>>>> this help with this load?
>>>>
>>>> Thanks
>>>> _______________________________________________
>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>
>>>>
>>>>         
>>>       
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>     
>
>
>
>   

From david.freedman at uk.clara.net  Wed Jun  3 11:32:08 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 03 Jun 2009 16:32:08 +0100
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
Message-ID: <h0651o$car$1@ger.gmane.org>

Has anybody come across this and if so are there any known workarounds?

Am keen to know under what circumstances an EFP does not get programmed
to the card, if anybody has any more information on this would be
appreciative of it online or offline.

Regards,

David Freedman


From sethm at rollernet.us  Wed Jun  3 11:35:31 2009
From: sethm at rollernet.us (Seth Mattinen)
Date: Wed, 03 Jun 2009 08:35:31 -0700
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A26960D.8070206@cantv.net>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
Message-ID: <4A269843.9070300@rollernet.us>

Juan C. Crespo R. wrote:
> NPE 400
> 

Upgrade the NPE, turn off features, or reduce the load. You can change
to a GE if you don't believe us, but you'll probably find it didn't help
anything.

~Seth

From masood at nexlinx.net.pk  Wed Jun  3 12:41:52 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Wed, 3 Jun 2009 21:41:52 +0500 (PKT)
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A26960D.8070206@cantv.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
Message-ID: <46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>

cisco 7200 NPE-400 is normally for customer premise equipment and DS1/DS3
aggregation. As per cisco performance of up to 400 kpps in cef switching.

You can upgrade to NPE-G1 which provides performance of up to 1 million
packets per second in cef switching (an increase of up to 250 percent over
the cisco 7200 series npe 400)

Regards,
Masood

> NPE 400
>
> CPU utilization for five seconds: 76%/75%; one minute: 74%; five
> minutes: 75%
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   45   210365012  85449013       2461  0.23%  0.19%  0.19%   0 IP Input
>  118    99161264 248440739        399  0.23%  0.08%  0.06%   0
> traffic_shape
>   18    19988356  29194664        684  0.00%  0.03%  0.02%   0 ARP Input
>    4    49353040   2274191      21701  0.00%  0.03%  0.04%   0 Check heaps
>   10    11268080  11331204        994  0.00%  0.02%  0.00%   0 EnvMon
>   63     8535512  47262546        180  0.07%  0.01%  0.00%   0 Spanning
> Tree
>   29    19555460    389652      50187  0.00%  0.01%  0.00%   0
> Per-minute Jobs
>    5     6393048    430645      14845  0.07%  0.00%  0.00%   0 Pool
> Manager
>  119    14495556   1901716       7622  0.00%  0.00%  0.00%   0 MFI LFD
> Timer Pr
>   59     5397356   1127172       4788  0.00%  0.00%  0.00%   0 WCCP V2
> Protocol
>   11           0         1          0  0.00%  0.00%  0.00%   0 OIR Handler
>   12        7912    190100         41  0.00%  0.00%  0.00%   0 IPC
> Dynamic Cach
>   13           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone
> Manager
>   14     1344312  11329870        118  0.00%  0.00%  0.00%   0 IPC
> Periodic Tim
>   15     1196200  11329850        105  0.00%  0.00%  0.00%   0 IPC
> Deferred Por
>   16           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat
> Manager
>   17       44772   1140352         39  0.00%  0.00%  0.00%   0 Compute
> SRP rate
>    9           0         1          0  0.00%  0.00%  0.00%   0 Policy
> Manager
>   19           0        28          0  0.00%  0.00%  0.00%   0 DDR Timers
>   20           0         2          0  0.00%  0.00%  0.00%   0 Dialer
> event
>   21           0         2          0  0.00%  0.00%  0.00%   0 Entity
> MIB API
>   22           0         1          0  0.00%  0.00%  0.00%   0 SERIAL
> A'detect
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   23      770388   2845739        270  0.00%  0.00%  0.00%   0 HC
> Counter Timer
>   24        5264        22     239272  0.00%  0.00%  0.00%   0 Critical
> Bkgnd
>   25     3963452   4658455        850  0.00%  0.00%  0.00%   0 Net
> Background
>   26        6188      3016       2051  0.00%  0.00%  0.00%   0 Logger
>   27     2206724  11329804        194  0.00%  0.00%  0.00%   0 TTY
> Background
>   28    65577956  11340517       5782  0.00%  0.00%  0.00%   0
> Per-Second Jobs
>    8      144284   2275716         63  0.00%  0.00%  0.00%   0
> ALARM_TRIGGER_SC
>    7           0         2          0  0.00%  0.00%  0.00%   0 Serial
> Backgroun
>   31           0         1          0  0.00%  0.00%  0.00%   0 CSP Timer
>    6           0         2          0  0.00%  0.00%  0.00%   0 Timers
>   33           0         2          0  0.00%  0.00%  0.00%   0 Hawkeye
> Backgrou
>   34           0         1          0  0.00%  0.00%  0.00%   0 SONET
> alarm time
>    3     3297860   3024757       1090  0.00%  0.00%  0.00%   0 OSPF Hello
>   36           0         2          0  0.00%  0.00%  0.00%   0 VNM DSPRM
> MAIN
>   37           0         1          0  0.00%  0.00%  0.00%   0 CES Line
> Conditi
>   38           0         2          0  0.00%  0.00%  0.00%   0 Flash MIB
> Update
>   39           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
> Input
>   40           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
> TIMER
>   41           8        86         93  0.00%  0.00%  0.00%   0 TurboACL
>   42           0         2          0  0.00%  0.00%  0.00%   0 CEF
> switching ba
>   43           0         1          0  0.00%  0.00%  0.00%   0 AC Switch
>   44           0         2          0  0.00%  0.00%  0.00%   0 AAA
> Dictionary R
>    2      635356   2279979        278  0.00%  0.00%  0.00%   0 Load Meter
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   46           0         1          0  0.00%  0.00%  0.00%   0 ICMP
> event handl
>   47     1608916   1520006       1058  0.00%  0.00%  0.00%   0 CDP
> Protocol
>   48     1785752   1202253       1485  0.00%  0.00%  0.00%   0 LDP
>   49          16       175         91  0.00%  0.00%  0.00%   0 OLM
>   50           0         1          0  0.00%  0.00%  0.00%   0 PPPATM
> Session d
>   51           0         2          0  0.00%  0.00%  0.00%   0 PASVC
> create VA
>   52        9512      1676       5675  0.00%  0.00%  0.00%   0 EEM ED
> Syslog
>   53           0         2          0  0.00%  0.00%  0.00%   0 EEM ED SNMP
>   54           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
> Memory Th
>   55       23596    202778        116  0.00%  0.00%  0.00%   0 EEM ED
> Timer
>   56           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
> Counter
>   57           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
> Interface
>   58           0         3          0  0.00%  0.00%  0.00%   0 EEM ED
> IOSWD
>   30           0         1          0  0.00%  0.00%  0.00%   0 Inode
> Table Dest
>   32           0         2          0  0.00%  0.00%  0.00%   0 CES Timer
>   61           0         1          0  0.00%  0.00%  0.00%   0 MPLS
> Auto-Tunnel
>   62           0         1          0  0.00%  0.00%  0.00%   0 O-UNI
> Client Msg
>   35           0         1          0  0.00%  0.00%  0.00%   0 POS APS
> Event Pr
>   64           0         1          0  0.00%  0.00%  0.00%   0 AC Mgr
>   65           0         1          0  0.00%  0.00%  0.00%   0 SSS Manager
>   66           0         2          0  0.00%  0.00%  0.00%   0 SSM
> connection m
>   67           0         1          0  0.00%  0.00%  0.00%   0 PPP IP
> Add Route
>   68       90640    189720        477  0.00%  0.00%  0.00%   0 CEF
> background
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   69           0         1          0  0.00%  0.00%  0.00%   0 IP IRDP
>    1           0         2          0  0.00%  0.00%  0.00%   0 Chunk
> Manager
>   71     2091684    355745       5879  0.00%  0.00%  0.00%   0 IP
> Background
>   72     2340232    344710       6788  0.00%  0.00%  0.00%   0 IP RIB
> Update
>   73    69186296  16952818       4081  0.00%  0.00%  0.00%   0 CEF: IPv4
> proces
>   74          24       122        196  0.00%  0.00%  0.00%   0 ADJ
> background
>   75           0         1          0  0.00%  0.00%  0.00%   0 L2X Data
> Daemon
>   76           0         1          0  0.00%  0.00%  0.00%   0 HTTP Timer
>   77      646408    693913        931  0.00%  0.00%  0.00%   0 TCP Timer
>   78         800       219       3652  0.00%  0.00%  0.00%   0 TCP
> Protocols
>   79           0         1          0  0.00%  0.00%  0.00%   0 Probe Input
>   80           0         1          0  0.00%  0.00%  0.00%   0 RARP Input
>   81           0         1          0  0.00%  0.00%  0.00%   0 Socket
> Timers
>   82           0         2          0  0.00%  0.00%  0.00%   0 LSP Tunnels
>   83           0         1          0  0.00%  0.00%  0.00%   0 COPS
>   84           0         1          0  0.00%  0.00%  0.00%   0 X.25
> Encaps Mana
>   85           0         1          0  0.00%  0.00%  0.00%   0 PAD InCall
>   86           0         2          0  0.00%  0.00%  0.00%   0 X.25
> Background
>   87          88       375        234  0.00%  0.00%  0.00%   0 AToM
> manager
>   88           0         5          0  0.00%  0.00%  0.00%   0 AToM LDP
> manager
>   89       79992    190099        420  0.00%  0.00%  0.00%   0 LDP
> Background
>   90           0         1          0  0.00%  0.00%  0.00%   0 L2X
> Socket proce
>   91           0         1          0  0.00%  0.00%  0.00%   0 L2X SSS
> manager
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   92           0         1          0  0.00%  0.00%  0.00%   0 L2TP mgmt
> daemon
>   93          28       204        137  0.00%  0.00%  0.00%   0 TCP
> Listener
>   94           4         1       4000  0.00%  0.00%  0.00%   0 TSP
>   95           0         1          0  0.00%  0.00%  0.00%   0 VOIP RTP
> Udp Inp
>   96           0         1          0  0.00%  0.00%  0.00%   0
> QOS_MODULE_MAIN
>   97           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_HTSP
>   98           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_R2
>   99           0         1          0  0.00%  0.00%  0.00%   0 CCSWVOICE
>  100       43864   1140167         38  0.00%  0.00%  0.00%   0 RMON
> Recycle Pro
>  101           0         2          0  0.00%  0.00%  0.00%   0 RMON
> Deferred Se
>  102           0         1          0  0.00%  0.00%  0.00%   0 SYSMGT
> Events
>  103     1016848  11311292         89  0.00%  0.00%  0.00%   0
> cerf_daemon_proc
>  104           0         1          0  0.00%  0.00%  0.00%   0 SONET Traps
>  105      640712   2278427        281  0.00%  0.00%  0.00%   0 EEM Server
>  106           0         1          0  0.00%  0.00%  0.00%   0 Syslog
> Traps
>  107           0         1          0  0.00%  0.00%  0.00%   0 DATA
> Transfer Pr
>  108           0         1          0  0.00%  0.00%  0.00%   0 DATA
> Collector
>  109           0         1          0  0.00%  0.00%  0.00%   0 RMON
> Packets
>  110           0         2          0  0.00%  0.00%  0.00%   0 EEM
> Policy Direc
>  111     1019748  11311275         90  0.00%  0.00%  0.00%   0 trunk
> conditioni
>  112           0         1          0  0.00%  0.00%  0.00%   0 trunk
> conditioni
>  113      503088   3349106        150  0.00%  0.00%  0.00%   0 Net Input
>  114     2325524   2279676       1020  0.00%  0.00%  0.00%   0 Compute
> load avg
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>  115       83736    766853        109  0.00%  0.00%  0.00%   0 LSP
> Tunnel Head
>  116           0         2          0  0.00%  0.00%  0.00%   0 LSDp
> Input Proc
>  117     1288824   2405686        535  0.00%  0.00%  0.00%   0 LSD Main
> Proc
>   60           0         1          0  0.00%  0.00%  0.00%   0 LSP
> Tunnel FRR
>   70           0         3          0  0.00%  0.00%  0.00%   0 SNMP Timers
>  120           0         2          0  0.00%  0.00%  0.00%   0 MFI LFD
> Main Pro
>  121     2593264  11627651        223  0.00%  0.00%  0.00%   0 NTP
>  122     6873376   1817623       3781  0.00%  0.00%  0.00%   0 Tag Control
>  123       21808    190119        114  0.00%  0.00%  0.00%   0 IPRM
>  124           0         2          0  0.00%  0.00%  0.00%   0 IP Flow
> Backgrou
>  125     4970232   4644514       1070  0.00%  0.00%  0.00%   0 OSPF Hello
>  126     4203656   2503602       1679  0.00%  0.00%  0.00%   0 IP SNMP
>  127      457588   1255865        364  0.00%  0.00%  0.00%   0 PDU
> DISPATCHER
>  128     5118352   1257172       4071  0.00%  0.00%  0.00%   0 SNMP ENGINE
>  129           0         1          0  0.00%  0.00%  0.00%   0 SNMP
> ConfCopyPro
>  130           0         1          0  0.00%  0.00%  0.00%   0 SNMP Traps
>  131       28584    190100        150  0.00%  0.00%  0.00%   0 Time
> Range Proce
>  132           0         1          0  0.00%  0.00%  0.00%   0 xcpa-driver
>  133        1208       274       4408  0.00%  0.00%  0.00%   0 Tagcon Addr
>  134     4599240  11781205        390  0.00%  0.00%  0.00%   0 OSPF Router
> 1
>  135     1168632  11563127        101  0.00%  0.00%  0.00%   0 OSPF Router
> 2
>  136     7196544   6637085       1084  0.00%  0.00%  0.00%   0 TDP Hello
>  137        2712      1138       2383  0.00%  0.00%  0.00%   0 RADIUS
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>  139         516       180       2866  0.00%  0.00%  0.00%   0 AAA
> Accounting
>  140          60      1542         38  0.00%  0.00%  0.00%   2 Virtual
> Exec
>
>
>
> masood at nexlinx.net.pk escribi?:
>> cisco 7200 is a software based router so that every packet is punted to
>> the NPE. You need to replace your NPE instead of PIC. which cisco 7200
>> series network processing engine you are running? what you get when do
>> "show version" on this router? By using 'show processes cpu sorted 1min'
>> you can check which process is eating NPE cpu cycles.
>>
>> Regards,
>> Masood
>>
>>
>>
>>> It have
>>>
>>> int fa0/0
>>>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>>>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>>>
>>> int fa 0/1
>>>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>>>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>>>
>>> int ser4/0 (ds3 link)
>>>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>>>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>>>
>>> 59376 Total
>>>
>>> Thanks
>>>
>>> David Granzer escribi?:
>>>
>>>> Hi,
>>>>
>>>> could you post how much bandwidth and packet per second your 7200 ?
>>>> Generally upgrade to I/O GE will not
>>>> help much because the performance is based on the NPE used.
>>>>
>>>> regards,
>>>> David
>>>>
>>>>
>>>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R.
>>>> <jcposeidon at cantv.net>
>>>> wrote:
>>>>
>>>>
>>>>> Guys
>>>>>
>>>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>>>> stuff)
>>>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>>>> could
>>>>> this help with this load?
>>>>>
>>>>> Thanks
>>>>> _______________________________________________
>>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>>
>>>>>
>>>>>
>>>>
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>>
>>
>>
>>
>>
>



From jcposeidon at cantv.net  Wed Jun  3 11:40:47 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 03 Jun 2009 11:10:47 -0430
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <4A26997F.3030107@cantv.net>

That's great but the IO7200GE could help with the cpu load? if don't I 
must wait until get some budget

Thanks

masood at nexlinx.net.pk escribi?:
> cisco 7200 NPE-400 is normally for customer premise equipment and DS1/DS3
> aggregation. As per cisco performance of up to 400 kpps in cef switching.
>
> You can upgrade to NPE-G1 which provides performance of up to 1 million
> packets per second in cef switching (an increase of up to 250 percent over
> the cisco 7200 series npe 400)
>
> Regards,
> Masood
>
>   
>> NPE 400
>>
>> CPU utilization for five seconds: 76%/75%; one minute: 74%; five
>> minutes: 75%
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   45   210365012  85449013       2461  0.23%  0.19%  0.19%   0 IP Input
>>  118    99161264 248440739        399  0.23%  0.08%  0.06%   0
>> traffic_shape
>>   18    19988356  29194664        684  0.00%  0.03%  0.02%   0 ARP Input
>>    4    49353040   2274191      21701  0.00%  0.03%  0.04%   0 Check heaps
>>   10    11268080  11331204        994  0.00%  0.02%  0.00%   0 EnvMon
>>   63     8535512  47262546        180  0.07%  0.01%  0.00%   0 Spanning
>> Tree
>>   29    19555460    389652      50187  0.00%  0.01%  0.00%   0
>> Per-minute Jobs
>>    5     6393048    430645      14845  0.07%  0.00%  0.00%   0 Pool
>> Manager
>>  119    14495556   1901716       7622  0.00%  0.00%  0.00%   0 MFI LFD
>> Timer Pr
>>   59     5397356   1127172       4788  0.00%  0.00%  0.00%   0 WCCP V2
>> Protocol
>>   11           0         1          0  0.00%  0.00%  0.00%   0 OIR Handler
>>   12        7912    190100         41  0.00%  0.00%  0.00%   0 IPC
>> Dynamic Cach
>>   13           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone
>> Manager
>>   14     1344312  11329870        118  0.00%  0.00%  0.00%   0 IPC
>> Periodic Tim
>>   15     1196200  11329850        105  0.00%  0.00%  0.00%   0 IPC
>> Deferred Por
>>   16           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat
>> Manager
>>   17       44772   1140352         39  0.00%  0.00%  0.00%   0 Compute
>> SRP rate
>>    9           0         1          0  0.00%  0.00%  0.00%   0 Policy
>> Manager
>>   19           0        28          0  0.00%  0.00%  0.00%   0 DDR Timers
>>   20           0         2          0  0.00%  0.00%  0.00%   0 Dialer
>> event
>>   21           0         2          0  0.00%  0.00%  0.00%   0 Entity
>> MIB API
>>   22           0         1          0  0.00%  0.00%  0.00%   0 SERIAL
>> A'detect
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   23      770388   2845739        270  0.00%  0.00%  0.00%   0 HC
>> Counter Timer
>>   24        5264        22     239272  0.00%  0.00%  0.00%   0 Critical
>> Bkgnd
>>   25     3963452   4658455        850  0.00%  0.00%  0.00%   0 Net
>> Background
>>   26        6188      3016       2051  0.00%  0.00%  0.00%   0 Logger
>>   27     2206724  11329804        194  0.00%  0.00%  0.00%   0 TTY
>> Background
>>   28    65577956  11340517       5782  0.00%  0.00%  0.00%   0
>> Per-Second Jobs
>>    8      144284   2275716         63  0.00%  0.00%  0.00%   0
>> ALARM_TRIGGER_SC
>>    7           0         2          0  0.00%  0.00%  0.00%   0 Serial
>> Backgroun
>>   31           0         1          0  0.00%  0.00%  0.00%   0 CSP Timer
>>    6           0         2          0  0.00%  0.00%  0.00%   0 Timers
>>   33           0         2          0  0.00%  0.00%  0.00%   0 Hawkeye
>> Backgrou
>>   34           0         1          0  0.00%  0.00%  0.00%   0 SONET
>> alarm time
>>    3     3297860   3024757       1090  0.00%  0.00%  0.00%   0 OSPF Hello
>>   36           0         2          0  0.00%  0.00%  0.00%   0 VNM DSPRM
>> MAIN
>>   37           0         1          0  0.00%  0.00%  0.00%   0 CES Line
>> Conditi
>>   38           0         2          0  0.00%  0.00%  0.00%   0 Flash MIB
>> Update
>>   39           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
>> Input
>>   40           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
>> TIMER
>>   41           8        86         93  0.00%  0.00%  0.00%   0 TurboACL
>>   42           0         2          0  0.00%  0.00%  0.00%   0 CEF
>> switching ba
>>   43           0         1          0  0.00%  0.00%  0.00%   0 AC Switch
>>   44           0         2          0  0.00%  0.00%  0.00%   0 AAA
>> Dictionary R
>>    2      635356   2279979        278  0.00%  0.00%  0.00%   0 Load Meter
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   46           0         1          0  0.00%  0.00%  0.00%   0 ICMP
>> event handl
>>   47     1608916   1520006       1058  0.00%  0.00%  0.00%   0 CDP
>> Protocol
>>   48     1785752   1202253       1485  0.00%  0.00%  0.00%   0 LDP
>>   49          16       175         91  0.00%  0.00%  0.00%   0 OLM
>>   50           0         1          0  0.00%  0.00%  0.00%   0 PPPATM
>> Session d
>>   51           0         2          0  0.00%  0.00%  0.00%   0 PASVC
>> create VA
>>   52        9512      1676       5675  0.00%  0.00%  0.00%   0 EEM ED
>> Syslog
>>   53           0         2          0  0.00%  0.00%  0.00%   0 EEM ED SNMP
>>   54           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>> Memory Th
>>   55       23596    202778        116  0.00%  0.00%  0.00%   0 EEM ED
>> Timer
>>   56           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>> Counter
>>   57           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>> Interface
>>   58           0         3          0  0.00%  0.00%  0.00%   0 EEM ED
>> IOSWD
>>   30           0         1          0  0.00%  0.00%  0.00%   0 Inode
>> Table Dest
>>   32           0         2          0  0.00%  0.00%  0.00%   0 CES Timer
>>   61           0         1          0  0.00%  0.00%  0.00%   0 MPLS
>> Auto-Tunnel
>>   62           0         1          0  0.00%  0.00%  0.00%   0 O-UNI
>> Client Msg
>>   35           0         1          0  0.00%  0.00%  0.00%   0 POS APS
>> Event Pr
>>   64           0         1          0  0.00%  0.00%  0.00%   0 AC Mgr
>>   65           0         1          0  0.00%  0.00%  0.00%   0 SSS Manager
>>   66           0         2          0  0.00%  0.00%  0.00%   0 SSM
>> connection m
>>   67           0         1          0  0.00%  0.00%  0.00%   0 PPP IP
>> Add Route
>>   68       90640    189720        477  0.00%  0.00%  0.00%   0 CEF
>> background
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   69           0         1          0  0.00%  0.00%  0.00%   0 IP IRDP
>>    1           0         2          0  0.00%  0.00%  0.00%   0 Chunk
>> Manager
>>   71     2091684    355745       5879  0.00%  0.00%  0.00%   0 IP
>> Background
>>   72     2340232    344710       6788  0.00%  0.00%  0.00%   0 IP RIB
>> Update
>>   73    69186296  16952818       4081  0.00%  0.00%  0.00%   0 CEF: IPv4
>> proces
>>   74          24       122        196  0.00%  0.00%  0.00%   0 ADJ
>> background
>>   75           0         1          0  0.00%  0.00%  0.00%   0 L2X Data
>> Daemon
>>   76           0         1          0  0.00%  0.00%  0.00%   0 HTTP Timer
>>   77      646408    693913        931  0.00%  0.00%  0.00%   0 TCP Timer
>>   78         800       219       3652  0.00%  0.00%  0.00%   0 TCP
>> Protocols
>>   79           0         1          0  0.00%  0.00%  0.00%   0 Probe Input
>>   80           0         1          0  0.00%  0.00%  0.00%   0 RARP Input
>>   81           0         1          0  0.00%  0.00%  0.00%   0 Socket
>> Timers
>>   82           0         2          0  0.00%  0.00%  0.00%   0 LSP Tunnels
>>   83           0         1          0  0.00%  0.00%  0.00%   0 COPS
>>   84           0         1          0  0.00%  0.00%  0.00%   0 X.25
>> Encaps Mana
>>   85           0         1          0  0.00%  0.00%  0.00%   0 PAD InCall
>>   86           0         2          0  0.00%  0.00%  0.00%   0 X.25
>> Background
>>   87          88       375        234  0.00%  0.00%  0.00%   0 AToM
>> manager
>>   88           0         5          0  0.00%  0.00%  0.00%   0 AToM LDP
>> manager
>>   89       79992    190099        420  0.00%  0.00%  0.00%   0 LDP
>> Background
>>   90           0         1          0  0.00%  0.00%  0.00%   0 L2X
>> Socket proce
>>   91           0         1          0  0.00%  0.00%  0.00%   0 L2X SSS
>> manager
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   92           0         1          0  0.00%  0.00%  0.00%   0 L2TP mgmt
>> daemon
>>   93          28       204        137  0.00%  0.00%  0.00%   0 TCP
>> Listener
>>   94           4         1       4000  0.00%  0.00%  0.00%   0 TSP
>>   95           0         1          0  0.00%  0.00%  0.00%   0 VOIP RTP
>> Udp Inp
>>   96           0         1          0  0.00%  0.00%  0.00%   0
>> QOS_MODULE_MAIN
>>   97           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_HTSP
>>   98           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_R2
>>   99           0         1          0  0.00%  0.00%  0.00%   0 CCSWVOICE
>>  100       43864   1140167         38  0.00%  0.00%  0.00%   0 RMON
>> Recycle Pro
>>  101           0         2          0  0.00%  0.00%  0.00%   0 RMON
>> Deferred Se
>>  102           0         1          0  0.00%  0.00%  0.00%   0 SYSMGT
>> Events
>>  103     1016848  11311292         89  0.00%  0.00%  0.00%   0
>> cerf_daemon_proc
>>  104           0         1          0  0.00%  0.00%  0.00%   0 SONET Traps
>>  105      640712   2278427        281  0.00%  0.00%  0.00%   0 EEM Server
>>  106           0         1          0  0.00%  0.00%  0.00%   0 Syslog
>> Traps
>>  107           0         1          0  0.00%  0.00%  0.00%   0 DATA
>> Transfer Pr
>>  108           0         1          0  0.00%  0.00%  0.00%   0 DATA
>> Collector
>>  109           0         1          0  0.00%  0.00%  0.00%   0 RMON
>> Packets
>>  110           0         2          0  0.00%  0.00%  0.00%   0 EEM
>> Policy Direc
>>  111     1019748  11311275         90  0.00%  0.00%  0.00%   0 trunk
>> conditioni
>>  112           0         1          0  0.00%  0.00%  0.00%   0 trunk
>> conditioni
>>  113      503088   3349106        150  0.00%  0.00%  0.00%   0 Net Input
>>  114     2325524   2279676       1020  0.00%  0.00%  0.00%   0 Compute
>> load avg
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>  115       83736    766853        109  0.00%  0.00%  0.00%   0 LSP
>> Tunnel Head
>>  116           0         2          0  0.00%  0.00%  0.00%   0 LSDp
>> Input Proc
>>  117     1288824   2405686        535  0.00%  0.00%  0.00%   0 LSD Main
>> Proc
>>   60           0         1          0  0.00%  0.00%  0.00%   0 LSP
>> Tunnel FRR
>>   70           0         3          0  0.00%  0.00%  0.00%   0 SNMP Timers
>>  120           0         2          0  0.00%  0.00%  0.00%   0 MFI LFD
>> Main Pro
>>  121     2593264  11627651        223  0.00%  0.00%  0.00%   0 NTP
>>  122     6873376   1817623       3781  0.00%  0.00%  0.00%   0 Tag Control
>>  123       21808    190119        114  0.00%  0.00%  0.00%   0 IPRM
>>  124           0         2          0  0.00%  0.00%  0.00%   0 IP Flow
>> Backgrou
>>  125     4970232   4644514       1070  0.00%  0.00%  0.00%   0 OSPF Hello
>>  126     4203656   2503602       1679  0.00%  0.00%  0.00%   0 IP SNMP
>>  127      457588   1255865        364  0.00%  0.00%  0.00%   0 PDU
>> DISPATCHER
>>  128     5118352   1257172       4071  0.00%  0.00%  0.00%   0 SNMP ENGINE
>>  129           0         1          0  0.00%  0.00%  0.00%   0 SNMP
>> ConfCopyPro
>>  130           0         1          0  0.00%  0.00%  0.00%   0 SNMP Traps
>>  131       28584    190100        150  0.00%  0.00%  0.00%   0 Time
>> Range Proce
>>  132           0         1          0  0.00%  0.00%  0.00%   0 xcpa-driver
>>  133        1208       274       4408  0.00%  0.00%  0.00%   0 Tagcon Addr
>>  134     4599240  11781205        390  0.00%  0.00%  0.00%   0 OSPF Router
>> 1
>>  135     1168632  11563127        101  0.00%  0.00%  0.00%   0 OSPF Router
>> 2
>>  136     7196544   6637085       1084  0.00%  0.00%  0.00%   0 TDP Hello
>>  137        2712      1138       2383  0.00%  0.00%  0.00%   0 RADIUS
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>  139         516       180       2866  0.00%  0.00%  0.00%   0 AAA
>> Accounting
>>  140          60      1542         38  0.00%  0.00%  0.00%   2 Virtual
>> Exec
>>
>>
>>
>> masood at nexlinx.net.pk escribi?:
>>     
>>> cisco 7200 is a software based router so that every packet is punted to
>>> the NPE. You need to replace your NPE instead of PIC. which cisco 7200
>>> series network processing engine you are running? what you get when do
>>> "show version" on this router? By using 'show processes cpu sorted 1min'
>>> you can check which process is eating NPE cpu cycles.
>>>
>>> Regards,
>>> Masood
>>>
>>>
>>>
>>>       
>>>> It have
>>>>
>>>> int fa0/0
>>>>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>>>>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>>>>
>>>> int fa 0/1
>>>>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>>>>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>>>>
>>>> int ser4/0 (ds3 link)
>>>>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>>>>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>>>>
>>>> 59376 Total
>>>>
>>>> Thanks
>>>>
>>>> David Granzer escribi?:
>>>>
>>>>         
>>>>> Hi,
>>>>>
>>>>> could you post how much bandwidth and packet per second your 7200 ?
>>>>> Generally upgrade to I/O GE will not
>>>>> help much because the performance is based on the NPE used.
>>>>>
>>>>> regards,
>>>>> David
>>>>>
>>>>>
>>>>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R.
>>>>> <jcposeidon at cantv.net>
>>>>> wrote:
>>>>>
>>>>>
>>>>>           
>>>>>> Guys
>>>>>>
>>>>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>>>>> stuff)
>>>>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>>>>> could
>>>>>> this help with this load?
>>>>>>
>>>>>> Thanks
>>>>>> _______________________________________________
>>>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>>>
>>>>>>
>>>>>>
>>>>>>             
>>>> _______________________________________________
>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>
>>>>
>>>>         
>>>
>>>
>>>       
>
>
>
>   

From sethm at rollernet.us  Wed Jun  3 11:45:37 2009
From: sethm at rollernet.us (Seth Mattinen)
Date: Wed, 03 Jun 2009 08:45:37 -0700
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A26997F.3030107@cantv.net>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>	<4A26960D.8070206@cantv.net>	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net>
Message-ID: <4A269AA1.2030509@rollernet.us>

Juan C. Crespo R. wrote:
> That's great but the IO7200GE could help with the cpu load? if don't I
> must wait until get some budget
> 

To copy and paste Gert's initial response:

"No.  This is a CPU-based platform - the only way to reduce the CPU load
is to get a faster CPU or turn off features."

~Seth

From masood at nexlinx.net.pk  Wed Jun  3 12:53:55 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Wed, 3 Jun 2009 21:53:55 +0500 (PKT)
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A26997F.3030107@cantv.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net>
Message-ID: <61750.196.46.241.57.1244048035.squirrel@nexmail1.nexlinx.net.pk>

The answer to your question...

That's great but the IO7200GE could help with the cpu load?  Nah :)

What you need is NPE-G1 or NPE-G2 (double the speed of NPE-G1). Before
making a decision, calculate your network bandwidth requirements.

Regards,
Masood

> That's great but the IO7200GE could help with the cpu load? if don't I
> must wait until get some budget
>
> Thanks
>
> masood at nexlinx.net.pk escribi?:
>> cisco 7200 NPE-400 is normally for customer premise equipment and
>> DS1/DS3
>> aggregation. As per cisco performance of up to 400 kpps in cef
>> switching.
>>
>> You can upgrade to NPE-G1 which provides performance of up to 1 million
>> packets per second in cef switching (an increase of up to 250 percent
>> over
>> the cisco 7200 series npe 400)
>>
>> Regards,
>> Masood
>>
>>
>>> NPE 400
>>>
>>> CPU utilization for five seconds: 76%/75%; one minute: 74%; five
>>> minutes: 75%
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   45   210365012  85449013       2461  0.23%  0.19%  0.19%   0 IP Input
>>>  118    99161264 248440739        399  0.23%  0.08%  0.06%   0
>>> traffic_shape
>>>   18    19988356  29194664        684  0.00%  0.03%  0.02%   0 ARP
>>> Input
>>>    4    49353040   2274191      21701  0.00%  0.03%  0.04%   0 Check
>>> heaps
>>>   10    11268080  11331204        994  0.00%  0.02%  0.00%   0 EnvMon
>>>   63     8535512  47262546        180  0.07%  0.01%  0.00%   0 Spanning
>>> Tree
>>>   29    19555460    389652      50187  0.00%  0.01%  0.00%   0
>>> Per-minute Jobs
>>>    5     6393048    430645      14845  0.07%  0.00%  0.00%   0 Pool
>>> Manager
>>>  119    14495556   1901716       7622  0.00%  0.00%  0.00%   0 MFI LFD
>>> Timer Pr
>>>   59     5397356   1127172       4788  0.00%  0.00%  0.00%   0 WCCP V2
>>> Protocol
>>>   11           0         1          0  0.00%  0.00%  0.00%   0 OIR
>>> Handler
>>>   12        7912    190100         41  0.00%  0.00%  0.00%   0 IPC
>>> Dynamic Cach
>>>   13           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone
>>> Manager
>>>   14     1344312  11329870        118  0.00%  0.00%  0.00%   0 IPC
>>> Periodic Tim
>>>   15     1196200  11329850        105  0.00%  0.00%  0.00%   0 IPC
>>> Deferred Por
>>>   16           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat
>>> Manager
>>>   17       44772   1140352         39  0.00%  0.00%  0.00%   0 Compute
>>> SRP rate
>>>    9           0         1          0  0.00%  0.00%  0.00%   0 Policy
>>> Manager
>>>   19           0        28          0  0.00%  0.00%  0.00%   0 DDR
>>> Timers
>>>   20           0         2          0  0.00%  0.00%  0.00%   0 Dialer
>>> event
>>>   21           0         2          0  0.00%  0.00%  0.00%   0 Entity
>>> MIB API
>>>   22           0         1          0  0.00%  0.00%  0.00%   0 SERIAL
>>> A'detect
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   23      770388   2845739        270  0.00%  0.00%  0.00%   0 HC
>>> Counter Timer
>>>   24        5264        22     239272  0.00%  0.00%  0.00%   0 Critical
>>> Bkgnd
>>>   25     3963452   4658455        850  0.00%  0.00%  0.00%   0 Net
>>> Background
>>>   26        6188      3016       2051  0.00%  0.00%  0.00%   0 Logger
>>>   27     2206724  11329804        194  0.00%  0.00%  0.00%   0 TTY
>>> Background
>>>   28    65577956  11340517       5782  0.00%  0.00%  0.00%   0
>>> Per-Second Jobs
>>>    8      144284   2275716         63  0.00%  0.00%  0.00%   0
>>> ALARM_TRIGGER_SC
>>>    7           0         2          0  0.00%  0.00%  0.00%   0 Serial
>>> Backgroun
>>>   31           0         1          0  0.00%  0.00%  0.00%   0 CSP
>>> Timer
>>>    6           0         2          0  0.00%  0.00%  0.00%   0 Timers
>>>   33           0         2          0  0.00%  0.00%  0.00%   0 Hawkeye
>>> Backgrou
>>>   34           0         1          0  0.00%  0.00%  0.00%   0 SONET
>>> alarm time
>>>    3     3297860   3024757       1090  0.00%  0.00%  0.00%   0 OSPF
>>> Hello
>>>   36           0         2          0  0.00%  0.00%  0.00%   0 VNM
>>> DSPRM
>>> MAIN
>>>   37           0         1          0  0.00%  0.00%  0.00%   0 CES Line
>>> Conditi
>>>   38           0         2          0  0.00%  0.00%  0.00%   0 Flash
>>> MIB
>>> Update
>>>   39           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
>>> Input
>>>   40           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
>>> TIMER
>>>   41           8        86         93  0.00%  0.00%  0.00%   0 TurboACL
>>>   42           0         2          0  0.00%  0.00%  0.00%   0 CEF
>>> switching ba
>>>   43           0         1          0  0.00%  0.00%  0.00%   0 AC
>>> Switch
>>>   44           0         2          0  0.00%  0.00%  0.00%   0 AAA
>>> Dictionary R
>>>    2      635356   2279979        278  0.00%  0.00%  0.00%   0 Load
>>> Meter
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   46           0         1          0  0.00%  0.00%  0.00%   0 ICMP
>>> event handl
>>>   47     1608916   1520006       1058  0.00%  0.00%  0.00%   0 CDP
>>> Protocol
>>>   48     1785752   1202253       1485  0.00%  0.00%  0.00%   0 LDP
>>>   49          16       175         91  0.00%  0.00%  0.00%   0 OLM
>>>   50           0         1          0  0.00%  0.00%  0.00%   0 PPPATM
>>> Session d
>>>   51           0         2          0  0.00%  0.00%  0.00%   0 PASVC
>>> create VA
>>>   52        9512      1676       5675  0.00%  0.00%  0.00%   0 EEM ED
>>> Syslog
>>>   53           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>>> SNMP
>>>   54           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>>> Memory Th
>>>   55       23596    202778        116  0.00%  0.00%  0.00%   0 EEM ED
>>> Timer
>>>   56           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>>> Counter
>>>   57           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>>> Interface
>>>   58           0         3          0  0.00%  0.00%  0.00%   0 EEM ED
>>> IOSWD
>>>   30           0         1          0  0.00%  0.00%  0.00%   0 Inode
>>> Table Dest
>>>   32           0         2          0  0.00%  0.00%  0.00%   0 CES
>>> Timer
>>>   61           0         1          0  0.00%  0.00%  0.00%   0 MPLS
>>> Auto-Tunnel
>>>   62           0         1          0  0.00%  0.00%  0.00%   0 O-UNI
>>> Client Msg
>>>   35           0         1          0  0.00%  0.00%  0.00%   0 POS APS
>>> Event Pr
>>>   64           0         1          0  0.00%  0.00%  0.00%   0 AC Mgr
>>>   65           0         1          0  0.00%  0.00%  0.00%   0 SSS
>>> Manager
>>>   66           0         2          0  0.00%  0.00%  0.00%   0 SSM
>>> connection m
>>>   67           0         1          0  0.00%  0.00%  0.00%   0 PPP IP
>>> Add Route
>>>   68       90640    189720        477  0.00%  0.00%  0.00%   0 CEF
>>> background
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   69           0         1          0  0.00%  0.00%  0.00%   0 IP IRDP
>>>    1           0         2          0  0.00%  0.00%  0.00%   0 Chunk
>>> Manager
>>>   71     2091684    355745       5879  0.00%  0.00%  0.00%   0 IP
>>> Background
>>>   72     2340232    344710       6788  0.00%  0.00%  0.00%   0 IP RIB
>>> Update
>>>   73    69186296  16952818       4081  0.00%  0.00%  0.00%   0 CEF:
>>> IPv4
>>> proces
>>>   74          24       122        196  0.00%  0.00%  0.00%   0 ADJ
>>> background
>>>   75           0         1          0  0.00%  0.00%  0.00%   0 L2X Data
>>> Daemon
>>>   76           0         1          0  0.00%  0.00%  0.00%   0 HTTP
>>> Timer
>>>   77      646408    693913        931  0.00%  0.00%  0.00%   0 TCP
>>> Timer
>>>   78         800       219       3652  0.00%  0.00%  0.00%   0 TCP
>>> Protocols
>>>   79           0         1          0  0.00%  0.00%  0.00%   0 Probe
>>> Input
>>>   80           0         1          0  0.00%  0.00%  0.00%   0 RARP
>>> Input
>>>   81           0         1          0  0.00%  0.00%  0.00%   0 Socket
>>> Timers
>>>   82           0         2          0  0.00%  0.00%  0.00%   0 LSP
>>> Tunnels
>>>   83           0         1          0  0.00%  0.00%  0.00%   0 COPS
>>>   84           0         1          0  0.00%  0.00%  0.00%   0 X.25
>>> Encaps Mana
>>>   85           0         1          0  0.00%  0.00%  0.00%   0 PAD
>>> InCall
>>>   86           0         2          0  0.00%  0.00%  0.00%   0 X.25
>>> Background
>>>   87          88       375        234  0.00%  0.00%  0.00%   0 AToM
>>> manager
>>>   88           0         5          0  0.00%  0.00%  0.00%   0 AToM LDP
>>> manager
>>>   89       79992    190099        420  0.00%  0.00%  0.00%   0 LDP
>>> Background
>>>   90           0         1          0  0.00%  0.00%  0.00%   0 L2X
>>> Socket proce
>>>   91           0         1          0  0.00%  0.00%  0.00%   0 L2X SSS
>>> manager
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   92           0         1          0  0.00%  0.00%  0.00%   0 L2TP
>>> mgmt
>>> daemon
>>>   93          28       204        137  0.00%  0.00%  0.00%   0 TCP
>>> Listener
>>>   94           4         1       4000  0.00%  0.00%  0.00%   0 TSP
>>>   95           0         1          0  0.00%  0.00%  0.00%   0 VOIP RTP
>>> Udp Inp
>>>   96           0         1          0  0.00%  0.00%  0.00%   0
>>> QOS_MODULE_MAIN
>>>   97           0         1          0  0.00%  0.00%  0.00%   0
>>> CCVPM_HTSP
>>>   98           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_R2
>>>   99           0         1          0  0.00%  0.00%  0.00%   0
>>> CCSWVOICE
>>>  100       43864   1140167         38  0.00%  0.00%  0.00%   0 RMON
>>> Recycle Pro
>>>  101           0         2          0  0.00%  0.00%  0.00%   0 RMON
>>> Deferred Se
>>>  102           0         1          0  0.00%  0.00%  0.00%   0 SYSMGT
>>> Events
>>>  103     1016848  11311292         89  0.00%  0.00%  0.00%   0
>>> cerf_daemon_proc
>>>  104           0         1          0  0.00%  0.00%  0.00%   0 SONET
>>> Traps
>>>  105      640712   2278427        281  0.00%  0.00%  0.00%   0 EEM
>>> Server
>>>  106           0         1          0  0.00%  0.00%  0.00%   0 Syslog
>>> Traps
>>>  107           0         1          0  0.00%  0.00%  0.00%   0 DATA
>>> Transfer Pr
>>>  108           0         1          0  0.00%  0.00%  0.00%   0 DATA
>>> Collector
>>>  109           0         1          0  0.00%  0.00%  0.00%   0 RMON
>>> Packets
>>>  110           0         2          0  0.00%  0.00%  0.00%   0 EEM
>>> Policy Direc
>>>  111     1019748  11311275         90  0.00%  0.00%  0.00%   0 trunk
>>> conditioni
>>>  112           0         1          0  0.00%  0.00%  0.00%   0 trunk
>>> conditioni
>>>  113      503088   3349106        150  0.00%  0.00%  0.00%   0 Net
>>> Input
>>>  114     2325524   2279676       1020  0.00%  0.00%  0.00%   0 Compute
>>> load avg
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>  115       83736    766853        109  0.00%  0.00%  0.00%   0 LSP
>>> Tunnel Head
>>>  116           0         2          0  0.00%  0.00%  0.00%   0 LSDp
>>> Input Proc
>>>  117     1288824   2405686        535  0.00%  0.00%  0.00%   0 LSD Main
>>> Proc
>>>   60           0         1          0  0.00%  0.00%  0.00%   0 LSP
>>> Tunnel FRR
>>>   70           0         3          0  0.00%  0.00%  0.00%   0 SNMP
>>> Timers
>>>  120           0         2          0  0.00%  0.00%  0.00%   0 MFI LFD
>>> Main Pro
>>>  121     2593264  11627651        223  0.00%  0.00%  0.00%   0 NTP
>>>  122     6873376   1817623       3781  0.00%  0.00%  0.00%   0 Tag
>>> Control
>>>  123       21808    190119        114  0.00%  0.00%  0.00%   0 IPRM
>>>  124           0         2          0  0.00%  0.00%  0.00%   0 IP Flow
>>> Backgrou
>>>  125     4970232   4644514       1070  0.00%  0.00%  0.00%   0 OSPF
>>> Hello
>>>  126     4203656   2503602       1679  0.00%  0.00%  0.00%   0 IP SNMP
>>>  127      457588   1255865        364  0.00%  0.00%  0.00%   0 PDU
>>> DISPATCHER
>>>  128     5118352   1257172       4071  0.00%  0.00%  0.00%   0 SNMP
>>> ENGINE
>>>  129           0         1          0  0.00%  0.00%  0.00%   0 SNMP
>>> ConfCopyPro
>>>  130           0         1          0  0.00%  0.00%  0.00%   0 SNMP
>>> Traps
>>>  131       28584    190100        150  0.00%  0.00%  0.00%   0 Time
>>> Range Proce
>>>  132           0         1          0  0.00%  0.00%  0.00%   0
>>> xcpa-driver
>>>  133        1208       274       4408  0.00%  0.00%  0.00%   0 Tagcon
>>> Addr
>>>  134     4599240  11781205        390  0.00%  0.00%  0.00%   0 OSPF
>>> Router
>>> 1
>>>  135     1168632  11563127        101  0.00%  0.00%  0.00%   0 OSPF
>>> Router
>>> 2
>>>  136     7196544   6637085       1084  0.00%  0.00%  0.00%   0 TDP
>>> Hello
>>>  137        2712      1138       2383  0.00%  0.00%  0.00%   0 RADIUS
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>  139         516       180       2866  0.00%  0.00%  0.00%   0 AAA
>>> Accounting
>>>  140          60      1542         38  0.00%  0.00%  0.00%   2 Virtual
>>> Exec
>>>
>>>
>>>
>>> masood at nexlinx.net.pk escribi?:
>>>
>>>> cisco 7200 is a software based router so that every packet is punted
>>>> to
>>>> the NPE. You need to replace your NPE instead of PIC. which cisco 7200
>>>> series network processing engine you are running? what you get when do
>>>> "show version" on this router? By using 'show processes cpu sorted
>>>> 1min'
>>>> you can check which process is eating NPE cpu cycles.
>>>>
>>>> Regards,
>>>> Masood
>>>>
>>>>
>>>>
>>>>
>>>>> It have
>>>>>
>>>>> int fa0/0
>>>>>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>>>>>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>>>>>
>>>>> int fa 0/1
>>>>>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>>>>>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>>>>>
>>>>> int ser4/0 (ds3 link)
>>>>>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>>>>>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>>>>>
>>>>> 59376 Total
>>>>>
>>>>> Thanks
>>>>>
>>>>> David Granzer escribi?:
>>>>>
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> could you post how much bandwidth and packet per second your 7200 ?
>>>>>> Generally upgrade to I/O GE will not
>>>>>> help much because the performance is based on the NPE used.
>>>>>>
>>>>>> regards,
>>>>>> David
>>>>>>
>>>>>>
>>>>>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R.
>>>>>> <jcposeidon at cantv.net>
>>>>>> wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>> Guys
>>>>>>>
>>>>>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>>>>>> stuff)
>>>>>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>>>>>> could
>>>>>>> this help with this load?
>>>>>>>
>>>>>>> Thanks
>>>>>>> _______________________________________________
>>>>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>> _______________________________________________
>>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>>
>>
>>
>>
>>
>



From MatlockK at exempla.org  Wed Jun  3 11:52:28 2009
From: MatlockK at exempla.org (Matlock, Kenneth L)
Date: Wed, 3 Jun 2009 09:52:28 -0600
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <4A269AA1.2030509@rollernet.us>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>	<4A26960D.8070206@cantv.net>	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk><4A26997F.3030107@cantv.net>
	<4A269AA1.2030509@rollernet.us>
Message-ID: <4288131ED5E3024C9CD4782CECCAD2C7065D36B9@LMC-MAIL2.exempla.org>

To reiterate :)

The problem you're having is the CPU is having to process EVERY packet
coming in (the nature of the chassis unfortunately). Changing out the IO
module will only allow you to have faster interfaces, but the CPU is
still the exact same. 

The ONLY fixes are:

1) Reduce the packet rate on the chassis
2) Reduce the number of 'extraneous' services on the chassis
3) Get a faster CPU (NPE-G1 or NPE-G2)

The advertised PPS rates are assuming (I believe) 64-byte packets, and
nothing else (QoS/ACLs/dynamic routing protocols/etc) running on the
chassis.

Ken Matlock
Network Analyst
Exempla Healthcare
(303) 467-4671
matlockk at exempla.org


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Seth Mattinen
Sent: Wednesday, June 03, 2009 9:46 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] IO 7200 GE Improve Performance and help with the
CPU Load?

Juan C. Crespo R. wrote:
> That's great but the IO7200GE could help with the cpu load? if don't I
> must wait until get some budget
> 

To copy and paste Gert's initial response:

"No.  This is a CPU-based platform - the only way to reduce the CPU load
is to get a faster CPU or turn off features."

~Seth
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From paul at paulstewart.org  Wed Jun  3 11:55:26 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 3 Jun 2009 11:55:26 -0400
Subject: [c-nsp] BGP Advertising - Question re more specific block
Message-ID: <004201c9e463$b72ec280$258c4780$@org>

Hi folks.

 

I'd like to know if there's a better way to approach this.

 

We are advertising a specific /22 that belongs to a /18 block via one
specific upstream BGP connection.  The /18 is advertised to all upstreams,
the /22 is only advertised to one upstream as a method of influencing
traffic via that carrier (knowing that if that particular carrier went down,
the less specific subnet will still be reachable via the other providers).
Prepending is very ugly for this situation FYI.

 

We use BGP communities to identify upstream and downstream BGP connections
along with our own netblocks.

 

First I built a route-map that I could use inside the BGP network statement:

 

route-map blahblah-routes-providerx permit 1000

 set community 11666:6001 

 

Then created the network statement:

 

network xx.xx.xx.0 mask 255.255.252.0 route-map blahblah-routes-providerx

 

Created a new IP community-list that includes previous communities plus this
one new specific community (11666:6001):

 

ip community-list 101 permit 11666:4000

ip community-list 101 permit 11666:5000

ip community-list 101 permit 11666:6001

 

And, updated the route-map towards this upstream as applicable:

 

route-map outbound-tsystems permit 10

 match community 101

 

 

My question - is there a better way to configure this?  This is working just
fine for our needs but there's a lot of steps and we're going to have to add
more into this in future so rather do as simple a config as possible ;)

 

Thanks,

 

Paul

 

 


From achatz at forthnet.gr  Wed Jun  3 13:21:26 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 03 Jun 2009 20:21:26 +0300
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
In-Reply-To: <h0651o$car$1@ger.gmane.org>
References: <h0651o$car$1@ger.gmane.org>
Message-ID: <4A26B116.4040803@forthnet.gr>

Although i haven't met this, it might mean that the EVC frame matching config (the "encapsulation dot1q xxx" under the 
service instance) is not "converted" into the appropriate TCAM entry in the ES card. A possible result would be that 
frames that should be forwarded through this service instance, are either not forwarded at all or forwarded through a 
less specific match criterion of another service instance.

In any case, your account SE should be able to provide you with more -internal- details about this bug.

Regards,
Tassos

David Freedman wrote on 03/06/2009 18:32:
> Has anybody come across this and if so are there any known workarounds?
> 
> Am keen to know under what circumstances an EFP does not get programmed
> to the card, if anybody has any more information on this would be
> appreciative of it online or offline.
> 
> Regards,
> 
> David Freedman
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From gert at greenie.muc.de  Wed Jun  3 13:23:47 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 3 Jun 2009 19:23:47 +0200
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <4A26997F.3030107@cantv.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net>
Message-ID: <20090603172347.GD290@greenie.muc.de>

Hi,

On Wed, Jun 03, 2009 at 11:10:47AM -0430, Juan C. Crespo R. wrote:
> That's great but the IO7200GE could help with the cpu load? 

*NO*.

There is no intelligence on the IO board.  Packets go to the CPU.  If
the CPU is loaded, it doesn't matter where the packets are coming from.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090603/adb0848a/attachment.bin>

From david.freedman at uk.clara.net  Wed Jun  3 13:33:29 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 03 Jun 2009 18:33:29 +0100
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
In-Reply-To: <4A26B116.4040803@forthnet.gr>
References: <h0651o$car$1@ger.gmane.org> <4A26B116.4040803@forthnet.gr>
Message-ID: <4A26B3E9.3010303@uk.clara.net>

Tassos, the problem is that the EFP (Ethernet Flowpoint) is not
programmed to the card using the efp-client , without an EFP the service
instance has nothing to attach to.

Am currently waiting on somebody to share the DE notes with me so I can
see if I can find a workaround (even if it means a slew of test commands
to prod the subsystems directly)

I know this is resolved in SRC4 and we are on target to upgrade, would
just appreciate a faster solution , we are all out of alternatives :)

Dave.


Tassos Chatzithomaoglou wrote:
> Although i haven't met this, it might mean that the EVC frame matching
> config (the "encapsulation dot1q xxx" under the service instance) is not
> "converted" into the appropriate TCAM entry in the ES card. A possible
> result would be that frames that should be forwarded through this
> service instance, are either not forwarded at all or forwarded through a
> less specific match criterion of another service instance.
> 
> In any case, your account SE should be able to provide you with more
> -internal- details about this bug.
> 
> Regards,
> Tassos
> 
> David Freedman wrote on 03/06/2009 18:32:
>> Has anybody come across this and if so are there any known workarounds?
>>
>> Am keen to know under what circumstances an EFP does not get programmed
>> to the card, if anybody has any more information on this would be
>> appreciative of it online or offline.
>>
>> Regards,
>>
>> David Freedman
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From david.freedman at uk.clara.net  Wed Jun  3 13:33:29 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 03 Jun 2009 18:33:29 +0100
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
In-Reply-To: <4A26B116.4040803@forthnet.gr>
References: <h0651o$car$1@ger.gmane.org> <4A26B116.4040803@forthnet.gr>
Message-ID: <4A26B3E9.3010303@uk.clara.net>

Tassos, the problem is that the EFP (Ethernet Flowpoint) is not
programmed to the card using the efp-client , without an EFP the service
instance has nothing to attach to.

Am currently waiting on somebody to share the DE notes with me so I can
see if I can find a workaround (even if it means a slew of test commands
to prod the subsystems directly)

I know this is resolved in SRC4 and we are on target to upgrade, would
just appreciate a faster solution , we are all out of alternatives :)

Dave.


Tassos Chatzithomaoglou wrote:
> Although i haven't met this, it might mean that the EVC frame matching
> config (the "encapsulation dot1q xxx" under the service instance) is not
> "converted" into the appropriate TCAM entry in the ES card. A possible
> result would be that frames that should be forwarded through this
> service instance, are either not forwarded at all or forwarded through a
> less specific match criterion of another service instance.
> 
> In any case, your account SE should be able to provide you with more
> -internal- details about this bug.
> 
> Regards,
> Tassos
> 
> David Freedman wrote on 03/06/2009 18:32:
>> Has anybody come across this and if so are there any known workarounds?
>>
>> Am keen to know under what circumstances an EFP does not get programmed
>> to the card, if anybody has any more information on this would be
>> appreciative of it online or offline.
>>
>> Regards,
>>
>> David Freedman
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From achatz at forthnet.gr  Wed Jun  3 14:11:14 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 03 Jun 2009 21:11:14 +0300
Subject: [c-nsp] Mac-in-Mac supported in ES+ ?
Message-ID: <4A26BCC2.5090405@forthnet.gr>

Does anyone know more details about current mac-in-mac (802.1ah Provider Backbone Bridges) support?

7600#sh ethernet service ?
   evc         Ethernet EVC
   instance    Ethernet Service Instance
   interface   Ethernet Service Interface
   ipc         Ethernet Service IPC
   mac-tunnel  Ethernet Mac-in-Mac tunnel


CCO returned only pages regarding IOS-XR.

--
Tassos

From billf at mu.org  Wed Jun  3 16:13:18 2009
From: billf at mu.org (bill fumerola)
Date: Wed, 3 Jun 2009 13:13:18 -0700
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <20090603172347.GD290@greenie.muc.de>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net> <20090603172347.GD290@greenie.muc.de>
Message-ID: <20090603201318.GM14367@elvis.mu.org>

On Wed, Jun 03, 2009 at 07:23:47PM +0200, Gert Doering wrote:
> On Wed, Jun 03, 2009 at 11:10:47AM -0430, Juan C. Crespo R. wrote:
> > That's great but the IO7200GE could help with the cpu load? 
> 
> *NO*.
> 
> There is no intelligence on the IO board.  Packets go to the CPU.  If
> the CPU is loaded, it doesn't matter where the packets are coming from.

unless pushing all the frames to one interface causes reduced CPU time
spent servicing interrupts from interrupt coalescing.

-- bill




From mduksa at gmail.com  Wed Jun  3 19:07:29 2009
From: mduksa at gmail.com (Marlon Duksa)
Date: Wed, 3 Jun 2009 16:07:29 -0700
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
Message-ID: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>

Hi -Does anyone know which cards on Cat6500 support MPLS
and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
distributed (DFC) forwarding solution?

I know that Cat6500 is very limited in VPLS support, but IP-VPN and EoMPLS
should be no problem, right?

Thanks,
Marlon

From avayner at cisco.com  Thu Jun  4 00:19:03 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Thu, 4 Jun 2009 06:19:03 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>

Marlon,

If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
done in hardware and in distributed forwarding mode.
For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
the core. Having this card means that again VPLS is done in hardware -
some functionality is done on the regular DFCs and some on the egress
core facing module.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
Sent: Thursday, June 04, 2009 02:07
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

Hi -Does anyone know which cards on Cat6500 support MPLS
and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
distributed (DFC) forwarding solution?

I know that Cat6500 is very limited in VPLS support, but IP-VPN and
EoMPLS
should be no problem, right?

Thanks,
Marlon
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From achatz at forthnet.gr  Thu Jun  4 02:20:12 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Thu, 04 Jun 2009 09:20:12 +0300
Subject: [c-nsp] standby RSP720 gets "Data TLB Error Exception" after rommon
	upgrade
Message-ID: <4A27679C.3070503@forthnet.gr>

Has anyone managed to do a rommon upgrade to a RSP720 and immediately afterwards had it 
boot as a standby ? I did it twice and i always got the "Data TLB Error Exception" message

rommon 7 > boot bootdisk:c7600rsp72043-advipservicesk9-mz.122-33.SRB5a.bin

Initializing ATA monitor library...

*** Data TLB Error Exception ***
PC = 0x40442e4, Vector = 0x1400, SP = 0x4012dc4


I have RMAed 2 RSP720s until now after doing exactly the same procedure and now i'm 
waiting for the 3rd one!

If the RSP720 is the only one in the chassis (so it's acting like an active), then booting 
after the rommon upgrade works fine! If the RSP720 gets booted as a standby after the 
rommon upgrade, then it gets destroyed and cannot be used neither as an active nor as a 
standby.

-- 
Tassos

From asturluismi at gmail.com  Thu Jun  4 04:26:21 2009
From: asturluismi at gmail.com (luismi)
Date: Thu, 04 Jun 2009 10:26:21 +0200
Subject: [c-nsp] Any problems w/ 3750 IOS 12.2(46)SE?
In-Reply-To: <A77B4558-D03A-439D-B6F9-60169E9CCF83@netspot.com.au>
References: <A77B4558-D03A-439D-B6F9-60169E9CCF83@netspot.com.au>
Message-ID: <1244103981.7817.0.camel@dsba-ipso>

What we saw with 12.2.(46) was a corruption of the "ifindex" file.
We will go for 12.2(50)

El mar, 02-06-2009 a las 16:45 +0930, Tom Lanyon escribi?:
> We are seeing consistent low TCP throughput over a dual gig  
> etherchannel between two stacks of 3x 3750G + 1x 3750E and  
> intermittent delays (ie. random slow ICMP ping times) on another 2x  
> 3750G stack, all on 12.2(46)SE. All switches are doing L2/L3  
> forwarding and a small amount of EIGRP.
> 
> The stack with delayed ICMP has seemingly random high CPU load and  
> this seems to correlate with the delayed ICMP packets; example:
> 	5Min Processes: 27% CPU
> 	Interrupts: 0% CPU
> 	Sum of all processes: 1.88% CPU
> 
> The other stacks haven't shown signs of ICMP delayed packets but still  
> list high (40-100%) peaks of CPU utilisation. Can't see any  
> indications of TCAM exhaustion on any switch (all desktop default SDM  
> template).
> 
> Just thought I'd throw this to the list to see if anyone else has had  
> something similar?
> 
> Tom
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From rgallagh at cisco.com  Thu Jun  4 06:05:22 2009
From: rgallagh at cisco.com (Richard Gallagher)
Date: Thu, 4 Jun 2009 11:05:22 +0100
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
In-Reply-To: <4A26B3E9.3010303@uk.clara.net>
References: <h0651o$car$1@ger.gmane.org> <4A26B116.4040803@forthnet.gr>
	<4A26B3E9.3010303@uk.clara.net>
Message-ID: <381A4C3F-2CE8-4BB4-96DC-8651ED9A093B@cisco.com>

I've had a look for you and there is no workaround unfortunately.

You could try OIR'ing the LC if you are hitting the issue, this may  
resolve it, there are no magic "test commands" to overcome it.

Rich

On 3 Jun 2009, at 18:33, David Freedman wrote:

> Tassos, the problem is that the EFP (Ethernet Flowpoint) is not
> programmed to the card using the efp-client , without an EFP the  
> service
> instance has nothing to attach to.
>
> Am currently waiting on somebody to share the DE notes with me so I  
> can
> see if I can find a workaround (even if it means a slew of test  
> commands
> to prod the subsystems directly)
>
> I know this is resolved in SRC4 and we are on target to upgrade, would
> just appreciate a faster solution , we are all out of alternatives :)
>
> Dave.
>
>
> Tassos Chatzithomaoglou wrote:
>> Although i haven't met this, it might mean that the EVC frame  
>> matching
>> config (the "encapsulation dot1q xxx" under the service instance)  
>> is not
>> "converted" into the appropriate TCAM entry in the ES card. A  
>> possible
>> result would be that frames that should be forwarded through this
>> service instance, are either not forwarded at all or forwarded  
>> through a
>> less specific match criterion of another service instance.
>>
>> In any case, your account SE should be able to provide you with more
>> -internal- details about this bug.
>>
>> Regards,
>> Tassos
>>
>> David Freedman wrote on 03/06/2009 18:32:
>>> Has anybody come across this and if so are there any known  
>>> workarounds?
>>>
>>> Am keen to know under what circumstances an EFP does not get  
>>> programmed
>>> to the card, if anybody has any more information on this would be
>>> appreciative of it online or offline.
>>>
>>> Regards,
>>>
>>> David Freedman
>>>
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From RGoldberg at compudyne.net  Thu Jun  4 08:16:53 2009
From: RGoldberg at compudyne.net (Ryan Goldberg)
Date: Thu, 4 Jun 2009 07:16:53 -0500
Subject: [c-nsp] basic nat question
Message-ID: <D501339A41BE8E498AFEF0F6EB9343A00246E67FCD@crossfire08>

I really did *not* want my first post to cisco-nsp to be this lame, but...

if you have second-

got an 1841 out there, with x.x.x.161/29 bound on the internet facing port, and .163, .164, .165 also bound as secondaries.  

need to do some static nat, but only the entries for the primary IP work

eg

ip nat inside source static tcp 192.168.1.103 110 x.x.x.161 110 vrf ISP2 extendable

works just fine

ip nat inside source static tcp 192.168.1.156 443 x.x.x.163 110 vrf ISP2 extendable

does not work

a clue that I'm unable to make use of is the traffic that I send to the secondary, comes back from the primary according to the nat trans table, and as verified by packet capture

any help you could provide would be hugely appreciated

running 12.4.24T..

Thanks-
Ryan	


From paul at paulstewart.org  Thu Jun  4 09:39:47 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Thu, 4 Jun 2009 09:39:47 -0400
Subject: [c-nsp] BGP Advertising - Question re more specific block
In-Reply-To: <4A27C5C4.1070300@ibctech.ca>
References: <004201c9e463$b72ec280$258c4780$@org> <4A27C5C4.1070300@ibctech.ca>
Message-ID: <000001c9e519$ed961970$c8c24c50$@org>

Hi Steve..

That is correct - we will actually be taking any specifics and tagging them
with one community.  We will use that community only with certain upstream
and peering points.

Our overall problem is that we have one upstream that we are stuck with in
contract and are not remotely meeting our minimum traffic levels with them -
if we start prepending then we get too large of a traffic shift.  So I'm
hoping to take a few /22 and maybe a /20 and advertise it as a more specific
route to that upstream and also to our peering points (we don't want to push
any traffic away from peering points of course).

Thanks,

Paul


-----Original Message-----
From: Steve Bertrand [mailto:steve at ibctech.ca] 
Sent: Thursday, June 04, 2009 9:02 AM
To: Paul Stewart
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] BGP Advertising - Question re more specific block

* PGP - S/MIME Signed by an unverified key: 06/04/09 at 09:01:56

Paul Stewart wrote:

> We are advertising a specific /22 that belongs to a /18 block via one
> specific upstream BGP connection.  The /18 is advertised to all upstreams,
> the /22 is only advertised to one upstream as a method of influencing
> traffic via that carrier (knowing that if that particular carrier went
down,
> the less specific subnet will still be reachable via the other providers).
> Prepending is very ugly for this situation FYI.

Paul,

Just so I can get a better understanding, you are applying a community
to each /22 you are advertising to certain peers.

You are then applying a route-map to a particular peer, that only sends
the prefixes that have a particular community set. Is this correct?

Do you advertise this exact group of /22's to more than one upstream peer?

Steve

* Thawte Freemail Member <steve at ibctech.ca>
* Issuer: Thawte Consulting (Pty) Ltd. - Unverified


From cchurc05 at harris.com  Thu Jun  4 09:00:41 2009
From: cchurc05 at harris.com (Church, Charles)
Date: Thu, 4 Jun 2009 08:00:41 -0500
Subject: [c-nsp] basic nat question
In-Reply-To: <D501339A41BE8E498AFEF0F6EB9343A00246E67FCD@crossfire08>
References: <D501339A41BE8E498AFEF0F6EB9343A00246E67FCD@crossfire08>
Message-ID: <FA1BA229357DB640B944218F3585FECA0257C6D8@mspe2k1.cs.myharris.net>

What's the purpose of having those additional addresses bound as
secondaries?  It's not needed for NAT.

Chuck

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ryan Goldberg
Sent: Thursday, June 04, 2009 8:17 AM
To: 'cisco-nsp at puck.nether.net'
Subject: [c-nsp] basic nat question


I really did *not* want my first post to cisco-nsp to be this lame,
but...

if you have second-

got an 1841 out there, with x.x.x.161/29 bound on the internet facing
port, and .163, .164, .165 also bound as secondaries.  

need to do some static nat, but only the entries for the primary IP work

eg

ip nat inside source static tcp 192.168.1.103 110 x.x.x.161 110 vrf ISP2
extendable

works just fine

ip nat inside source static tcp 192.168.1.156 443 x.x.x.163 110 vrf ISP2
extendable

does not work

a clue that I'm unable to make use of is the traffic that I send to the
secondary, comes back from the primary according to the nat trans table,
and as verified by packet capture

any help you could provide would be hugely appreciated

running 12.4.24T..

Thanks-
Ryan	

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From steve at ibctech.ca  Thu Jun  4 09:01:56 2009
From: steve at ibctech.ca (Steve Bertrand)
Date: Thu, 04 Jun 2009 09:01:56 -0400
Subject: [c-nsp] BGP Advertising - Question re more specific block
In-Reply-To: <004201c9e463$b72ec280$258c4780$@org>
References: <004201c9e463$b72ec280$258c4780$@org>
Message-ID: <4A27C5C4.1070300@ibctech.ca>

Paul Stewart wrote:

> We are advertising a specific /22 that belongs to a /18 block via one
> specific upstream BGP connection.  The /18 is advertised to all upstreams,
> the /22 is only advertised to one upstream as a method of influencing
> traffic via that carrier (knowing that if that particular carrier went down,
> the less specific subnet will still be reachable via the other providers).
> Prepending is very ugly for this situation FYI.

Paul,

Just so I can get a better understanding, you are applying a community
to each /22 you are advertising to certain peers.

You are then applying a route-map to a particular peer, that only sends
the prefixes that have a particular community set. Is this correct?

Do you advertise this exact group of /22's to more than one upstream peer?

Steve
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3233 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090604/cbcdbf02/attachment-0001.bin>

From mduksa at gmail.com  Thu Jun  4 10:10:27 2009
From: mduksa at gmail.com (Marlon Duksa)
Date: Thu, 4 Jun 2009 07:10:27 -0700
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
Message-ID: <a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>

Thanks Arie. But ES cards are not supported on Cat6500, no? And also VPLS
over MPLS on a SIP in Cat6500 - is it supported? If so do you know which
SIP?Thanks,
Marlon

On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner) <avayner at cisco.com>wrote:

> Marlon,
>
> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
> done in hardware and in distributed forwarding mode.
> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
> the core. Having this card means that again VPLS is done in hardware -
> some functionality is done on the regular DFCs and some on the egress
> core facing module.
>
> Arie
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
> Sent: Thursday, June 04, 2009 02:07
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
> Hi -Does anyone know which cards on Cat6500 support MPLS
> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
> distributed (DFC) forwarding solution?
>
> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
> EoMPLS
> should be no problem, right?
>
> Thanks,
> Marlon
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From masood at nexlinx.net.pk  Thu Jun  4 11:26:16 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Thu, 4 Jun 2009 20:26:16 +0500 (PKT)
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
Message-ID: <28289.196.46.241.57.1244129176.squirrel@nexmail1.nexlinx.net.pk>

AFAIK VPLS is not supported on the Catalyst 6500 series. You should
upgrade to the 7600 series with enhanced core facing interfaces, such as
ES-cards or SIP-400/600 cards.

Regards,
Masood

> Thanks Arie. But ES cards are not supported on Cat6500, no? And also VPLS
> over MPLS on a SIP in Cat6500 - is it supported? If so do you know which
> SIP?Thanks,
> Marlon
>
> On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
> <avayner at cisco.com>wrote:
>
>> Marlon,
>>
>> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
>> done in hardware and in distributed forwarding mode.
>> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
>> the core. Having this card means that again VPLS is done in hardware -
>> some functionality is done on the regular DFCs and some on the egress
>> core facing module.
>>
>> Arie
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
>> Sent: Thursday, June 04, 2009 02:07
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>>
>> Hi -Does anyone know which cards on Cat6500 support MPLS
>> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
>> distributed (DFC) forwarding solution?
>>
>> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
>> EoMPLS
>> should be no problem, right?
>>
>> Thanks,
>> Marlon
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From chris.fournier at dal.ca  Thu Jun  4 09:55:08 2009
From: chris.fournier at dal.ca (Chris Fournier)
Date: Thu, 04 Jun 2009 10:55:08 -0300
Subject: [c-nsp] L2TPv3 performance over gig?
Message-ID: <1244123708.30703.5351.camel@linux-xvcs>

Does anyone use L2TPv3 over a gig link, and what is the performance
overhead introduced? I've seen some numbers at the Cisco website, but
these seem to reference encryption versus encapsulation.


Chris


From eng_mssk at hotmail.com  Thu Jun  4 10:36:41 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Thu, 4 Jun 2009 17:36:41 +0300
Subject: [c-nsp] Juniper Simulator
Message-ID: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>


Hey all
how are u ?
I am looking for a free simulator for Juniper routers

Thanks in advance

_________________________________________________________________
Windows Live?: Keep your life in sync. Check it out!
http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009

From achatz at forthnet.gr  Thu Jun  4 10:52:50 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Thu, 04 Jun 2009 17:52:50 +0300
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <28289.196.46.241.57.1244129176.squirrel@nexmail1.nexlinx.net.pk>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
	<28289.196.46.241.57.1244129176.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <4A27DFC2.7030805@forthnet.gr>

I had seen a presentation where with SIP-400 and SXI you could have VPLS on the 6500.

--
Tassos

masood at nexlinx.net.pk wrote on 04/06/2009 18:26:
> AFAIK VPLS is not supported on the Catalyst 6500 series. You should
> upgrade to the 7600 series with enhanced core facing interfaces, such as
> ES-cards or SIP-400/600 cards.
> 
> Regards,
> Masood
> 
>> Thanks Arie. But ES cards are not supported on Cat6500, no? And also VPLS
>> over MPLS on a SIP in Cat6500 - is it supported? If so do you know which
>> SIP?Thanks,
>> Marlon
>>
>> On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
>> <avayner at cisco.com>wrote:
>>
>>> Marlon,
>>>
>>> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
>>> done in hardware and in distributed forwarding mode.
>>> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
>>> the core. Having this card means that again VPLS is done in hardware -
>>> some functionality is done on the regular DFCs and some on the egress
>>> core facing module.
>>>
>>> Arie
>>>
>>> -----Original Message-----
>>> From: cisco-nsp-bounces at puck.nether.net
>>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
>>> Sent: Thursday, June 04, 2009 02:07
>>> To: cisco-nsp at puck.nether.net
>>> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>>>
>>> Hi -Does anyone know which cards on Cat6500 support MPLS
>>> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
>>> distributed (DFC) forwarding solution?
>>>
>>> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
>>> EoMPLS
>>> should be no problem, right?
>>>
>>> Thanks,
>>> Marlon
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>

From masood at nexlinx.net.pk  Thu Jun  4 11:57:38 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Thu, 4 Jun 2009 20:57:38 +0500 (PKT)
Subject: [c-nsp] Juniper Simulator
In-Reply-To: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
References: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
Message-ID: <65498.196.46.241.57.1244131058.squirrel@nexmail1.nexlinx.net.pk>

wrong list for this question, you use cisco-nsp for cisco stuff. you can
use juniper-nsp for juniper.
Anyway You can use QEMU with Olive to emulate Juniper JUNOS. The following
URL will take you to the page...

http://tinyurl.com/o4gbba

Regards,
Masood



>
> Hey all
> how are u ?
> I am looking for a free simulator for Juniper routers
>
> Thanks in advance
>
> _________________________________________________________________
> Windows Live?: Keep your life in sync. Check it out!
> http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/



From eng_mssk at hotmail.com  Thu Jun  4 10:54:20 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Thu, 4 Jun 2009 17:54:20 +0300
Subject: [c-nsp] Juniper Simulator
In-Reply-To: <65498.196.46.241.57.1244131058.squirrel@nexmail1.nexlinx.net.pk>
References: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
	<65498.196.46.241.57.1244131058.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <BLU102-W500F42E002081AB6169D7EFA4B0@phx.gbl>


i didnt know about juniper nsp 

thats y i asked here 

> Date: Thu, 4 Jun 2009 20:57:38 +0500
> Subject: Re: [c-nsp] Juniper Simulator
> From: masood at nexlinx.net.pk
> To: eng_mssk at hotmail.com
> CC: cisco-nsp at puck.nether.net
> 
> wrong list for this question, you use cisco-nsp for cisco stuff. you can
> use juniper-nsp for juniper.
> Anyway You can use QEMU with Olive to emulate Juniper JUNOS. The following
> URL will take you to the page...
> 
> http://tinyurl.com/o4gbba
> 
> Regards,
> Masood
> 
> 
> 
> >
> > Hey all
> > how are u ?
> > I am looking for a free simulator for Juniper routers
> >
> > Thanks in advance
> >
> > _________________________________________________________________
> > Windows Live?: Keep your life in sync. Check it out!
> > http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> 

_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

From dudepron at gmail.com  Thu Jun  4 10:54:43 2009
From: dudepron at gmail.com (Aaron)
Date: Thu, 4 Jun 2009 10:54:43 -0400
Subject: [c-nsp] L2TPv3 performance over gig?
In-Reply-To: <1244123708.30703.5351.camel@linux-xvcs>
References: <1244123708.30703.5351.camel@linux-xvcs>
Message-ID: <480dad640906040754u4786db38v34e1782bdac1ed8d@mail.gmail.com>

nothing more than doing mpls. Actually a little less since you don't have
ldp going

On Thu, Jun 4, 2009 at 09:55, Chris Fournier <chris.fournier at dal.ca> wrote:

> Does anyone use L2TPv3 over a gig link, and what is the performance
> overhead introduced? I've seen some numbers at the Cisco website, but
> these seem to reference encryption versus encapsulation.
>
>
> Chris
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From rus-p at inbox.ru  Thu Jun  4 09:34:05 2009
From: rus-p at inbox.ru (Ruslan Pustovoitov)
Date: Thu, 04 Jun 2009 17:34:05 +0400
Subject: [c-nsp] (no subject)
Message-ID: <E1MCD53-0006RC-00.rus-p-inbox-ru@f265.mail.ru>



Hi all,

I read config guide for IOS 12.2(x) about MSDP on 3750 and see this statements:

MSDP is not fully supported in this software release because of a lack of support for Multicast Border Gateway Protocol (MBGP), which works closely with MSDP. However, it is possible to create default peers that MSDP can operate with if MBGP is not running.
....
In this software release, because BGP and MBGP are not supported, you cannot configure an MSDP peer on the local switch by using the ip msdp peer global configuration command. Instead, you define a default MSDP peer (by using the ip msdp default-peer global configuration command) from which to accept all SA messages for the switch. 

Could anybody tell me why MSDP cannot use BGP to accomplish peer-rpf check flooding on this platform ?
Instead of this, config guide describe a simple case with default-peer configuration.




From moua0100 at umn.edu  Thu Jun  4 11:09:20 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 04 Jun 2009 10:09:20 -0500
Subject: [c-nsp] L2TPv3 performance over gig?
In-Reply-To: <1244123708.30703.5351.camel@linux-xvcs>
References: <1244123708.30703.5351.camel@linux-xvcs>
Message-ID: <4A27E3A0.5090102@umn.edu>

I've done testing for both:
* no encryption: ~ 980Mb
* encryption ~ 240 Mb

Performance dependent on router platform (in my case 7203 w/ NSE-100)

Encryption was on 7206 w/ NPE-G1 & VAM2+

Conclusion, performance limited to hardware used and not layer-1 link speed.



Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Chris Fournier wrote:
> Does anyone use L2TPv3 over a gig link, and what is the performance
> overhead introduced? I've seen some numbers at the Cisco website, but
> these seem to reference encryption versus encapsulation.
>
>
> Chris
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From sil at infiltrated.net  Thu Jun  4 10:41:28 2009
From: sil at infiltrated.net (J. Oquendo)
Date: Thu, 04 Jun 2009 10:41:28 -0400
Subject: [c-nsp] Juniper Simulator
In-Reply-To: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
References: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
Message-ID: <4A27DD18.2020107@infiltrated.net>

Mohammad Khalil wrote:
> Hey all
> how are u ?
> I am looking for a free simulator for Juniper routers
>
> Thanks in advance
>
> _________________________________________________________________
> Windows Live?: Keep your life in sync. Check it out!
> http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
http://juniper.cluepon.net/index.php/Olive

-- 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP

"It takes 20 years to build a reputation and five minutes to
ruin it. If you think about that, you'll do things
differently." - Warren Buffett

227C 5D35 7DCB 0893 95AA  4771 1DCE 1FD1 5CCD 6B5E
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E


From avayner at cisco.com  Thu Jun  4 11:29:49 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Thu, 4 Jun 2009 17:29:49 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>

Yes, this is true, ES20 is 7600 only (I missed the 6500 angle here ;-) )

We can do VPLS with SIP400 (lower BW) or SIP600 (higher BW).

 

BTW, There is also support for MPLSoGRE

 

Arie

 

From: Marlon Duksa [mailto:mduksa at gmail.com] 
Sent: Thursday, June 04, 2009 17:10
To: Arie Vayner (avayner)
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

 

Thanks Arie. But ES cards are not supported on Cat6500, no? And also
VPLS over MPLS on a SIP in Cat6500 - is it supported? If so do you know
which SIP?

Thanks,

Marlon

On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
<avayner at cisco.com> wrote:

Marlon,

If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
done in hardware and in distributed forwarding mode.
For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
the core. Having this card means that again VPLS is done in hardware -
some functionality is done on the regular DFCs and some on the egress
core facing module.

Arie


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
Sent: Thursday, June 04, 2009 02:07
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

Hi -Does anyone know which cards on Cat6500 support MPLS
and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
distributed (DFC) forwarding solution?

I know that Cat6500 is very limited in VPLS support, but IP-VPN and
EoMPLS
should be no problem, right?

Thanks,
Marlon

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 


From dudepron at gmail.com  Thu Jun  4 13:14:40 2009
From: dudepron at gmail.com (Aaron)
Date: Thu, 4 Jun 2009 13:14:40 -0400
Subject: [c-nsp] L2TPv3 performance over gig?
In-Reply-To: <4A27E3A0.5090102@umn.edu>
References: <1244123708.30703.5351.camel@linux-xvcs> <4A27E3A0.5090102@umn.edu>
Message-ID: <480dad640906041014g52456b6dkbcf72517d719ce1c@mail.gmail.com>

What does that have to do with L2TPv3?

On Thu, Jun 4, 2009 at 11:09, Ge Moua <moua0100 at umn.edu> wrote:

> I've done testing for both:
> * no encryption: ~ 980Mb
> * encryption ~ 240 Mb
>
> Performance dependent on router platform (in my case 7203 w/ NSE-100)
>
> Encryption was on 7206 w/ NPE-G1 & VAM2+
>
> Conclusion, performance limited to hardware used and not layer-1 link
> speed.
>
>
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
>
> Chris Fournier wrote:
>
>> Does anyone use L2TPv3 over a gig link, and what is the performance
>> overhead introduced? I've seen some numbers at the Cisco website, but
>> these seem to reference encryption versus encapsulation.
>>
>>
>> Chris
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From moua0100 at umn.edu  Thu Jun  4 14:01:38 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 04 Jun 2009 13:01:38 -0500
Subject: [c-nsp] L2TPv3 performance over gig?
In-Reply-To: <480dad640906041014g52456b6dkbcf72517d719ce1c@mail.gmail.com>
References: <1244123708.30703.5351.camel@linux-xvcs> <4A27E3A0.5090102@umn.edu>
	<480dad640906041014g52456b6dkbcf72517d719ce1c@mail.gmail.com>
Message-ID: <4A280C02.4070101@umn.edu>

The (2) scenarios is:
* L2TPv3 vc w/ no ecryption
vs.
* L2TPv3 vc w/ IPSec encryption (encapsulated inside of)

One can also do layer-2 VPN with MPLS, eg, AToM (EoMPLS), but I think 
the initial thread was about L2TPv3 (layer-2 VPN inside native IP).  
Persoanally I like the AToM/EoMPLS (or even VPLS) approach with the 
many-to-many connections flexibility (vs. one-to-one connection 
limitation with L2TPv3).

We have about a half-dozen sites on L2TPv3 but have considered 
AToM/EoMPLS.  Just in case your wondering Cisco TAC has far more 
in-depth expertise w/ MPLS flavors as I've been told; when you run into 
issues.

Good luck.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Aaron wrote:
> What does that have to do with L2TPv3?
>
> On Thu, Jun 4, 2009 at 11:09, Ge Moua <moua0100 at umn.edu 
> <mailto:moua0100 at umn.edu>> wrote:
>
>     I've done testing for both:
>     * no encryption: ~ 980Mb
>     * encryption ~ 240 Mb
>
>     Performance dependent on router platform (in my case 7203 w/ NSE-100)
>
>     Encryption was on 7206 w/ NPE-G1 & VAM2+
>
>     Conclusion, performance limited to hardware used and not layer-1
>     link speed.
>
>
>
>     Regards,
>     Ge Moua | Email: moua0100 at umn.edu <mailto:moua0100 at umn.edu>
>
>     Network Design Engineer
>     University of Minnesota | Networking & Telecommunications Services
>
>
>
>
>     Chris Fournier wrote:
>
>         Does anyone use L2TPv3 over a gig link, and what is the
>         performance
>         overhead introduced? I've seen some numbers at the Cisco
>         website, but
>         these seem to reference encryption versus encapsulation.
>
>
>         Chris
>
>         _______________________________________________
>         cisco-nsp mailing list  cisco-nsp at puck.nether.net
>         <mailto:cisco-nsp at puck.nether.net>
>         https://puck.nether.net/mailman/listinfo/cisco-nsp
>         archive at http://puck.nether.net/pipermail/cisco-nsp/
>          
>
>     _______________________________________________
>     cisco-nsp mailing list  cisco-nsp at puck.nether.net
>     <mailto:cisco-nsp at puck.nether.net>
>     https://puck.nether.net/mailman/listinfo/cisco-nsp
>     archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>

From lists.james.edwards at gmail.com  Thu Jun  4 14:46:41 2009
From: lists.james.edwards at gmail.com (james edwards)
Date: Thu, 4 Jun 2009 12:46:41 -0600
Subject: [c-nsp] help with BGP logs
Message-ID: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>

Can anyone give me some help with these logs ? The session is to a vyatta
router (Quagga) from a 7206,
what attribute is this ?

Jun  4 12:42:25.842 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Down BGP
protocol initialization
Jun  4 12:42:55.158 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Up
Jun  4 12:43:04.986 MST: %BGP-3-NOTIFICATION: received from neighbor
164.64.41.180 3/4 (invalid flags for attribute) 8 bytes E0150501 0000B7AA
Jun  4 12:43:04.990 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Down BGP
protocol initialization
Jun  4 12:43:17.170 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Up
Jun  4 12:43:46.710 MST: %BGP-3-NOTIFICATION: received from neighbor
164.64.41.180 3/4 (invalid flags for attribute) 8 bytes E0150501 0000B7AA

-- 
James H. Edwards
Senior Network Systems Administrator
Judicial Information Division
jedwards at nmcourts.gov

From achatz at forthnet.gr  Thu Jun  4 15:09:45 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Thu, 04 Jun 2009 22:09:45 +0300
Subject: [c-nsp] standby RSP720 gets "Data TLB Error Exception" after
 rommon	upgrade
In-Reply-To: <4A27679C.3070503@forthnet.gr>
References: <4A27679C.3070503@forthnet.gr>
Message-ID: <4A281BF9.1000205@forthnet.gr>

For everyone interested, bug was CSCsy92252.
Many thanks to Arie and Andrew (@Cisco) for pointing that out.

-- 
Tassos

Tassos Chatzithomaoglou wrote on 04/06/2009 09:20:
> Has anyone managed to do a rommon upgrade to a RSP720 and immediately 
> afterwards had it boot as a standby ? I did it twice and i always got 
> the "Data TLB Error Exception" message
> 
> rommon 7 > boot bootdisk:c7600rsp72043-advipservicesk9-mz.122-33.SRB5a.bin
> 
> Initializing ATA monitor library...
> 
> *** Data TLB Error Exception ***
> PC = 0x40442e4, Vector = 0x1400, SP = 0x4012dc4
> 
> 
> I have RMAed 2 RSP720s until now after doing exactly the same procedure 
> and now i'm waiting for the 3rd one!
> 
> If the RSP720 is the only one in the chassis (so it's acting like an 
> active), then booting after the rommon upgrade works fine! If the RSP720 
> gets booted as a standby after the rommon upgrade, then it gets 
> destroyed and cannot be used neither as an active nor as a standby.
> 


From biged7600 at gmail.com  Thu Jun  4 16:21:19 2009
From: biged7600 at gmail.com (James Edmondson)
Date: Thu, 4 Jun 2009 15:21:19 -0500
Subject: [c-nsp] standby RSP720 gets "Data TLB Error Exception" after
	rommon upgrade
In-Reply-To: <4A281BF9.1000205@forthnet.gr>
References: <4A27679C.3070503@forthnet.gr> <4A281BF9.1000205@forthnet.gr>
Message-ID: <d35a6baf0906041321y4fae4641u748f70a130da5d6f@mail.gmail.com>

I would suggest SRD1 IOS, however be prepared to upgrade the firmware if you
have any SPA boards.

On Thu, Jun 4, 2009 at 2:09 PM, Tassos Chatzithomaoglou
<achatz at forthnet.gr>wrote:

> For everyone interested, bug was CSCsy92252.
> Many thanks to Arie and Andrew (@Cisco) for pointing that out.
>
> --
> Tassos
>
> Tassos Chatzithomaoglou wrote on 04/06/2009 09:20:
>
>> Has anyone managed to do a rommon upgrade to a RSP720 and immediately
>> afterwards had it boot as a standby ? I did it twice and i always got the
>> "Data TLB Error Exception" message
>>
>> rommon 7 > boot bootdisk:c7600rsp72043-advipservicesk9-mz.122-33.SRB5a.bin
>>
>> Initializing ATA monitor library...
>>
>> *** Data TLB Error Exception ***
>> PC = 0x40442e4, Vector = 0x1400, SP = 0x4012dc4
>>
>>
>> I have RMAed 2 RSP720s until now after doing exactly the same procedure
>> and now i'm waiting for the 3rd one!
>>
>> If the RSP720 is the only one in the chassis (so it's acting like an
>> active), then booting after the rommon upgrade works fine! If the RSP720
>> gets booted as a standby after the rommon upgrade, then it gets destroyed
>> and cannot be used neither as an active nor as a standby.
>>
>>
>  _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
James

From RGoldberg at compudyne.net  Thu Jun  4 16:28:58 2009
From: RGoldberg at compudyne.net (Ryan Goldberg)
Date: Thu, 4 Jun 2009 15:28:58 -0500
Subject: [c-nsp] basic nat question
In-Reply-To: <FA1BA229357DB640B944218F3585FECA0257C6D8@mspe2k1.cs.myharris.net>
References: <D501339A41BE8E498AFEF0F6EB9343A00246E67FCD@crossfire08>
	<FA1BA229357DB640B944218F3585FECA0257C6D8@mspe2k1.cs.myharris.net>
Message-ID: <D501339A41BE8E498AFEF0F6EB9343A00246E68044@crossfire08>

> -----Original Message-----
> From: Church, Charles [mailto:cchurc05 at harris.com]

> What's the purpose of having those additional addresses bound as
> secondaries?  It's not needed for NAT.

desperate attempt to make things work I guess

> I really did *not* want my first post to cisco-nsp to be this lame,
> but...

aghhhh...

> ip nat inside source static tcp 192.168.1.103 110 x.x.x.161 110 vrf
> ISP2
> extendable
> 
> works just fine
> 
> ip nat inside source static tcp 192.168.1.156 443 x.x.x.163 110 vrf
> ISP2
> extendable
> 
> does not work

Had my head on wrong - wrong vrf.  Although I don't understand at this point why it worked with the primary.

Thanks for the responses...
Ryan

From cordmacleod at gmail.com  Thu Jun  4 18:39:58 2009
From: cordmacleod at gmail.com (Cord MacLeod)
Date: Thu, 4 Jun 2009 15:39:58 -0700
Subject: [c-nsp] static arping gateways
Message-ID: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>

Would it be a reasonable solution to static arp a gateway on a cisco  
L3 switch to prevent a user from taking over the gateway?  So assuming  
you have HSRP running on 2 layer 3 switches and they share a gateway  
of 10.0.0.1 with switch one's address being 10.0.0.2 and two's address  
being 10.0.0.3 would it be reasonable to static arp each of these  
addresses to each switch? 
  

From peter at rathlev.dk  Thu Jun  4 19:31:33 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Fri, 05 Jun 2009 01:31:33 +0200
Subject: [c-nsp] static arping gateways
In-Reply-To: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
References: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
Message-ID: <1244158293.4721.8.camel@localhost.localdomain>

On Thu, 2009-06-04 at 15:39 -0700, Cord MacLeod wrote:
> Would it be a reasonable solution to static arp a gateway on a cisco  
> L3 switch to prevent a user from taking over the gateway?  So assuming  
> you have HSRP running on 2 layer 3 switches and they share a gateway  
> of 10.0.0.1 with switch one's address being 10.0.0.2 and two's address  
> being 10.0.0.3 would it be reasonable to static arp each of these  
> addresses to each switch? 

I'd say there's always a better way than static configuration.

I'm not sure exactly what the scenario is, but if you're talking about
simple L2 switches with a L3 interface for management, just keep the L3
termination away from user VLANs.

If you're talking about two L3 switches with a configuration like:

! *** A ***
interface Vlan2
 ip address 10.0.0.2 255.255.255.0
 standby ip 10.0.0.1
!

! *** B ***
interface Vlan2
 ip address 10.0.0.3 255.255.255.0
 standby ip 10.0.0.1
!

And then if you should configure each with a static ARP entry mapping
10.0.0.1 to 0000.0c07.ac00, then this would only "protect" each of these
two switches, not any hosts on the network. And the switches would often
have their own uplink(s), rarely needing to send traffic to the
"gateway" address.

Have you looked at Dynamic Arp Inspection?

Regards,
Peter



From amsoares at netcabo.pt  Thu Jun  4 19:34:49 2009
From: amsoares at netcabo.pt (Antonio Soares)
Date: Fri, 5 Jun 2009 00:34:49 +0100
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
Message-ID: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>

Hello group,

I need help in order to calculate the memory needed to accomodate 2 or more Full BGP Feeds. This is for a 12400 running IOS. Today i
saw this problem with some linecards:

++++++++++++++++++++++++++++++
%FIB-2-FIBDISABLE: Fatal error, slot X: no memory
++++++++++++++++++++++++++++++
%HW_RES_FAIL-4-LOW_CEF_MEM: SLOT Y is running low on E4_Lookup External SRAM resources.  CEF will begin resource constrained
forwarding operation if problem persists.  For additional details please see show ip cef resource and show ip cef summary
%LC-3-HWRESFAIL: OUT OF HW RESOURCES - FORWARDING MAY NOT BE ACCURATE.PLEASE CORRECT THE SITUATION AND TRY CLEAR CEF LINECARD TO
RECOVER
++++++++++++++++++++++++++++++

Slot X is a GE-GBIC-SC-B with 256 Mb of RAM and Slot Y is a 1X10GE-LR-SC with 512 Mb of RAM. The errors above occurred after the 2nd
Full BGP Feed was received. Linecards 4GE-SFP-LC with 512 Mb of RAM did not complain. Neither the SIP-600 with 1 Gb or the SIP-601
with 2Gb.

I have a PRP-2 with 1 Gb of RAM.

I understand that 256 Mb is definitely not enough. But i don't understand why the problem only affected the 1X10GE-LR-SC and not the
4GE-SFP-LC. Both have 512 Mb of RAM.



Thanks.

Regards,

Antonio Soares, CCIE #18473 (R&S)
amsoares at netcabo.pt





From cordmacleod at gmail.com  Thu Jun  4 19:37:52 2009
From: cordmacleod at gmail.com (Cord MacLeod)
Date: Thu, 4 Jun 2009 16:37:52 -0700
Subject: [c-nsp] static arping gateways
In-Reply-To: <1244158293.4721.8.camel@localhost.localdomain>
References: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
	<1244158293.4721.8.camel@localhost.localdomain>
Message-ID: <771064F0-629E-4D3F-8914-234F1C4FFFEF@gmail.com>


On Jun 4, 2009, at 4:31 PM, Peter Rathlev wrote:

> On Thu, 2009-06-04 at 15:39 -0700, Cord MacLeod wrote:
>> Would it be a reasonable solution to static arp a gateway on a cisco
>> L3 switch to prevent a user from taking over the gateway?  So  
>> assuming
>> you have HSRP running on 2 layer 3 switches and they share a gateway
>> of 10.0.0.1 with switch one's address being 10.0.0.2 and two's  
>> address
>> being 10.0.0.3 would it be reasonable to static arp each of these
>> addresses to each switch?
>
> I'd say there's always a better way than static configuration.
>
> I'm not sure exactly what the scenario is, but if you're talking about
> simple L2 switches with a L3 interface for management, just keep the  
> L3
> termination away from user VLANs.

A bunch of L2 switches connected to two L3 switches.

>
>
> If you're talking about two L3 switches with a configuration like:
>
> ! *** A ***
> interface Vlan2
> ip address 10.0.0.2 255.255.255.0
> standby ip 10.0.0.1
> !
>
> ! *** B ***
> interface Vlan2
> ip address 10.0.0.3 255.255.255.0
> standby ip 10.0.0.1
> !

Essentially, yes.

>
>
> And then if you should configure each with a static ARP entry mapping
> 10.0.0.1 to 0000.0c07.ac00, then this would only "protect" each of  
> these
> two switches, not any hosts on the network. And the switches would  
> often
> have their own uplink(s), rarely needing to send traffic to the
> "gateway" address.

I only want to protect the switches.  I don't want anyone stealing  
their ip addresses or the hrsp gateway addresses.

>
>
> Have you looked at Dynamic Arp Inspection?

Wish I could use this.  Unfortunately, I can't.  We use LVS, which is  
a linux load balancer.  This does use a VIP, but not a virtual mac  
address.  Therefore when there's a failover, the switch ignores the  
new mac address with DAI, found this out the hard way on my Juniper  
switches, which have DAI enabled by default.

>
>
> Regards,
> Peter
>
>


From fwissue at gmail.com  Thu Jun  4 21:06:29 2009
From: fwissue at gmail.com (Michael Lee)
Date: Thu, 4 Jun 2009 18:06:29 -0700
Subject: [c-nsp] help with BGP logs
In-Reply-To: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>
References: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>
Message-ID: <7ACEDD3C-6142-4BF0-BF9C-D6905E844E6A@gmail.com>

No enforce first as in bgp configuration

Regards

-mike

On Jun 4, 2009, at 11:46 AM, james edwards <lists.james.edwards at gmail.com 
 > wrote:

> Can anyone give me some help with these logs ? The session is to a  
> vyatta
> router (Quagga) from a 7206,
> what attribute is this ?
>
> Jun  4 12:42:25.842 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180  
> Down BGP
> protocol initialization
> Jun  4 12:42:55.158 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Up
> Jun  4 12:43:04.986 MST: %BGP-3-NOTIFICATION: received from neighbor
> 164.64.41.180 3/4 (invalid flags for attribute) 8 bytes E0150501  
> 0000B7AA
> Jun  4 12:43:04.990 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180  
> Down BGP
> protocol initialization
> Jun  4 12:43:17.170 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Up
> Jun  4 12:43:46.710 MST: %BGP-3-NOTIFICATION: received from neighbor
> 164.64.41.180 3/4 (invalid flags for attribute) 8 bytes E0150501  
> 0000B7AA
>
> -- 
> James H. Edwards
> Senior Network Systems Administrator
> Judicial Information Division
> jedwards at nmcourts.gov
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From RWerber at epiknetworks.com  Thu Jun  4 21:37:57 2009
From: RWerber at epiknetworks.com (Ryan Werber)
Date: Thu, 4 Jun 2009 21:37:57 -0400
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
Message-ID: <4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Antonio Soares

>I need help in order to calculate the memory needed to accomodate 2 or
more Full BGP >Feeds. This is for a 12400 running IOS. Today i
>saw this problem with some linecards:

OUR GE-GBIC-SC-B's w/ 256MB Generally have about 100 megs of ram free
with 2 directly connected full feeds, and at least 6 through ibgp.
There may be a configuration issue.  Only recently have our Engine-0
Cards been running out of memory, as they only have 128MB.

bbr1.tor#execute-on slot 3 show proc mem | i Free
========= Line Card (Slot 3) =========
Total: 223634112, Used: 88582896, Free: 135051216

We have 12008's with GRP-B's w/ 512 RP Ram.

Hope this helps!

Ryan Werber
Epik Networks


From ltd at cisco.com  Thu Jun  4 22:43:13 2009
From: ltd at cisco.com (Lincoln Dale)
Date: Fri, 05 Jun 2009 12:43:13 +1000
Subject: [c-nsp] static arping gateways
In-Reply-To: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
References: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
Message-ID: <4A288641.90105@cisco.com>



Cord MacLeod wrote:
> Would it be a reasonable solution to static arp a gateway on a cisco 
> L3 switch to prevent a user from taking over the gateway?  So assuming 
> you have HSRP running on 2 layer 3 switches and they share a gateway 
> of 10.0.0.1 with switch one's address being 10.0.0.2 and two's address 
> being 10.0.0.3 would it be reasonable to static arp each of these 
> addresses to each switch? 
a better solution would be to enable Dynamic ARP Inspection (DAI) on 
your Cisco L3 switch.
"best practice" would be to enable various other integrated security 
features to protect against other DoS, flooding, spoofing, starvation 
attack vectors.


cheers,

lincoln.

From swmike at swm.pp.se  Fri Jun  5 00:13:01 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Fri, 5 Jun 2009 06:13:01 +0200 (CEST)
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
In-Reply-To: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
Message-ID: <alpine.DEB.1.10.0906050609370.22851@uplift.swm.pp.se>

On Fri, 5 Jun 2009, Antonio Soares wrote:

> I understand that 256 Mb is definitely not enough. But i don't 
> understand why the problem only affected the 1X10GE-LR-SC and not the 
> 4GE-SFP-LC. Both have 512 Mb of RAM.

Different models of linecards need different amounts of RAM for the same 
amount of routes. For instance, the 4GE gives up earlier when having just 
256M of ram (we had to upgrade a year ago or so) compared to the 3GE 
(which still works).

You need to monitor your RP and LC memory as well as your "show ip cef 
resources". Make sure your RP and LCs have *at least* 50 megs of ram free 
at all times, it's sometimes needed during a re-route.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From peter at rathlev.dk  Fri Jun  5 05:02:18 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Fri, 05 Jun 2009 11:02:18 +0200
Subject: [c-nsp] static arping gateways
In-Reply-To: <771064F0-629E-4D3F-8914-234F1C4FFFEF@gmail.com>
References: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
	<1244158293.4721.8.camel@localhost.localdomain>
	<771064F0-629E-4D3F-8914-234F1C4FFFEF@gmail.com>
Message-ID: <1244192538.3480.2.camel@localhost.localdomain>

On Thu, 2009-06-04 at 16:37 -0700, Cord MacLeod wrote:
> On Jun 4, 2009, at 4:31 PM, Peter Rathlev wrote:
> > I'm not sure exactly what the scenario is, but if you're talking
> > about simple L2 switches with a L3 interface for management, just
> > keep the L3 termination away from user VLANs.
> 
> A bunch of L2 switches connected to two L3 switches.

So why not just keep their management-interfaces on a seperate VLAN?
That would protect the L2 switches. And the L3 switches have their own
uplinks I assume, so they would probably not need to send traffic to
each other via the user VLAN.

Regards,
Peter



From amsoares at netcabo.pt  Fri Jun  5 07:13:44 2009
From: amsoares at netcabo.pt (Antonio Soares)
Date: Fri, 5 Jun 2009 12:13:44 +0100
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
In-Reply-To: <4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
Message-ID: <153DAD8392C948D6B0E0864E232B909C@int.convex.pt>

Wow, this is unbelievable ! Can you show us your "show proc mem | inc BGP" ? Do you really have two full BGP feeds (about 284k
prefixes each) ?


Thanks.

Regards,

Antonio Soares, CCIE #18473 (R&S)
amsoares at netcabo.pt

-----Original Message-----
From: Ryan Werber [mailto:RWerber at epiknetworks.com] 
Sent: sexta-feira, 5 de Junho de 2009 2:38
To: Antonio Soares; cisco-nsp
Subject: RE: [c-nsp] 12k Full BGP Feed Memory Requirements



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Antonio Soares

>I need help in order to calculate the memory needed to accomodate 2 or
more Full BGP >Feeds. This is for a 12400 running IOS. Today i
>saw this problem with some linecards:

OUR GE-GBIC-SC-B's w/ 256MB Generally have about 100 megs of ram free
with 2 directly connected full feeds, and at least 6 through ibgp.
There may be a configuration issue.  Only recently have our Engine-0
Cards been running out of memory, as they only have 128MB.

bbr1.tor#execute-on slot 3 show proc mem | i Free
========= Line Card (Slot 3) =========
Total: 223634112, Used: 88582896, Free: 135051216

We have 12008's with GRP-B's w/ 512 RP Ram.

Hope this helps!

Ryan Werber
Epik Networks



From masood at nexlinx.net.pk  Fri Jun  5 08:30:52 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Fri, 5 Jun 2009 17:30:52 +0500 (PKT)
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
In-Reply-To: <153DAD8392C948D6B0E0864E232B909C@int.convex.pt>
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
	<153DAD8392C948D6B0E0864E232B909C@int.convex.pt>
Message-ID: <28604.196.46.241.57.1244205052.squirrel@nexmail1.nexlinx.net.pk>

it seems very special memory tweaking/management stuff.. LOLs :)
i can't believe it. two full BGP feeds = 284k :P

Regards,
Masood

> Wow, this is unbelievable ! Can you show us your "show proc mem | inc BGP"
> ? Do you really have two full BGP feeds (about 284k
> prefixes each) ?
>
>
> Thanks.
>
> Regards,
>
> Antonio Soares, CCIE #18473 (R&S)
> amsoares at netcabo.pt
>
> -----Original Message-----
> From: Ryan Werber [mailto:RWerber at epiknetworks.com]
> Sent: sexta-feira, 5 de Junho de 2009 2:38
> To: Antonio Soares; cisco-nsp
> Subject: RE: [c-nsp] 12k Full BGP Feed Memory Requirements
>
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Antonio Soares
>
>>I need help in order to calculate the memory needed to accomodate 2 or
> more Full BGP >Feeds. This is for a 12400 running IOS. Today i
>>saw this problem with some linecards:
>
> OUR GE-GBIC-SC-B's w/ 256MB Generally have about 100 megs of ram free
> with 2 directly connected full feeds, and at least 6 through ibgp.
> There may be a configuration issue.  Only recently have our Engine-0
> Cards been running out of memory, as they only have 128MB.
>
> bbr1.tor#execute-on slot 3 show proc mem | i Free
> ========= Line Card (Slot 3) =========
> Total: 223634112, Used: 88582896, Free: 135051216
>
> We have 12008's with GRP-B's w/ 512 RP Ram.
>
> Hope this helps!
>
> Ryan Werber
> Epik Networks
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From mvanton at gmail.com  Fri Jun  5 09:09:28 2009
From: mvanton at gmail.com (vince anton)
Date: Fri, 5 Jun 2009 15:09:28 +0200
Subject: [c-nsp] optical power on SPA 10GE
Message-ID: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>

Hi All,


got a quick question:

Is it possible from a 12k GSR to obtain the optical power levels reaching a
10GE SPA.

With a 'sh controller' I can see the optical power in db reaching my POS
SPA, but no such luck with 10GE SPA (SPA-1X10GE-L-V2).

Any ideas how to get this info ?


Thanks

anton

From david.freedman at uk.clara.net  Fri Jun  5 10:13:04 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Fri, 05 Jun 2009 15:13:04 +0100
Subject: [c-nsp] optical power on SPA 10GE
In-Reply-To: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>
References: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>
Message-ID: <h0b95g$vrl$1@ger.gmane.org>

You mean the XFP?

Assuming you have a DOM XFP, try:

sh hw-module subslot X/Y transceiver Z

Where interface is X/Y/Z

Dave.


vince anton wrote:
> Hi All,
> 
> 
> got a quick question:
> 
> Is it possible from a 12k GSR to obtain the optical power levels reaching a
> 10GE SPA.
> 
> With a 'sh controller' I can see the optical power in db reaching my POS
> SPA, but no such luck with 10GE SPA (SPA-1X10GE-L-V2).
> 
> Any ideas how to get this info ?
> 
> 
> Thanks
> 
> anton
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From david.freedman at uk.clara.net  Fri Jun  5 10:13:40 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Fri, 05 Jun 2009 15:13:40 +0100
Subject: [c-nsp] optical power on SPA 10GE
In-Reply-To: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>
References: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>
Message-ID: <h0b96k$vrl$2@ger.gmane.org>

I omitted the trailing keyword "status"


vince anton wrote:
> Hi All,
> 
> 
> got a quick question:
> 
> Is it possible from a 12k GSR to obtain the optical power levels reaching a
> 10GE SPA.
> 
> With a 'sh controller' I can see the optical power in db reaching my POS
> SPA, but no such luck with 10GE SPA (SPA-1X10GE-L-V2).
> 
> Any ideas how to get this info ?
> 
> 
> Thanks
> 
> anton
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From lists.james.edwards at gmail.com  Fri Jun  5 10:54:14 2009
From: lists.james.edwards at gmail.com (james edwards)
Date: Fri, 5 Jun 2009 08:54:14 -0600
Subject: [c-nsp] help with BGP logs
In-Reply-To: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>
References: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>
Message-ID: <b7f636a60906050754k3e959e05xc57e6948bbb784bd@mail.gmail.com>

Thanks to those who replied, it turned out to be a bug in Quagga.

Someone advertised 208.185.195.0/24 for about an hour with AS-Pathlimit
attribute. We filtered it out and will upgrade
Quagga. One version of Quagga, 099.9, had a bug and brought down the session
when it received a prefix with
the AS-Pathlimit attribute set.



-- 
James H. Edwards
Senior Network Systems Administrator
Judicial Information Division
jedwards at nmcourts.gov

From RWerber at epiknetworks.com  Fri Jun  5 15:30:37 2009
From: RWerber at epiknetworks.com (Ryan Werber)
Date: Fri, 5 Jun 2009 15:30:37 -0400
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
	<153DAD8392C948D6B0E0864E232B909C@int.convex.pt>
Message-ID: <4D58C7B4943F874BA4CB5D68A7924060B0F5F6@Epikserver2.Epik.local>




>-----Original Message-----
>From: Antonio Soares [mailto:amsoares at netcabo.pt] 
>Sent: Friday, June 05, 2009 4:14 AM

>Wow, this is unbelievable ! Can you show us your "show proc mem | inc
BGP" ? Do you really have two full BGP feeds (about 284k
>prefixes each) ?




#show proc memory  | i BGP
 169   0 2895956668 1123582500  310165452          0          0 BGP
Router
 172   0    3975400 1008225208       6840      53464          0 BGP I/O
 173   0       4188   12111120      14028          0          0 BGP
Scanner

First one is Cogent (174), the Second one is Tiscali (3257).  There are
4 Ibgp Route-Servers as well. we have ~10 full transit feeds throughout
our asn, as well as a ton of peering.  The only thing changed below are
ip addresses to protect the innocent. We currently have ~130 meg free on
the GRP-B. We also have 1 directly connected eBGP IPv6 peer, and 5
throughout our ASN.

38.103.xx.xx   4   174 3895305   60405 22155189    0    0 5w6d
283503
77.67.xx.xx    4  3257 5813157  139266 22155189    0    0 6w6d
282571
PEER-RS-1      4 21513 2472535 3813308 22155189    0    0 15:25:46
100863
RS-1           4 21513 4092583 3613405 22155189    0    0 6w6d
265775
RS-2           4 21513 3244549 3613398 22155189    0    0 6w6d
267897
RS-3           4 21513 5660680 3711962 22155189    0    0 1w1d
284664

show ip cef summary
IP Distributed CEF with switching (Table Version 8565971), flags=0x0
  288375 routes, 0 reresolve, 0 unresolved (0 old, 0 new), peak 18273
  8561775 instant recursive resolutions, 0 used background process
  12 load sharing elements, 12 references
  1389 in-place/0 aborted modifications
  57883336 bytes allocated to the FIB table data structures
  universal per-destination load sharing algorithm, id 6CE54348
  2(0) CEF resets
  Resolution Timer: Exponential (currently 1s, peak 4s)
  Tree summary:
   8-8-8-8 stride pattern
   short mask protection disabled
   288375 leaves, 14605 nodes using 23265244 bytes
  Transient memory used: 149355436, max: 149395476

  Table epoch: 0 (288375 entries at this epoch)

Adjacency Table has 41 adjacencies
  34 IPv4 adjacencies
  7 IPv6 adjacencies



From chale99 at gmail.com  Fri Jun  5 17:31:33 2009
From: chale99 at gmail.com (Chris Hale)
Date: Fri, 5 Jun 2009 17:31:33 -0400
Subject: [c-nsp] SOLVED: Re: strange behavior over MPLS network - remote
	desktop won't work
Message-ID: <db092ca60906051431i3ae0cba8w3ee411bfc936498e@mail.gmail.com>

I set the interfaces between the two 7206's at POP H as well as the GigE
backbone link to mpls mtu 1530, and everything worked.

Thanks all.

Chris

On Mon, Jun 1, 2009 at 4:35 PM, Gert Doering <gert at greenie.muc.de> wrote:

> Hi,
>
> On Sun, May 31, 2009 at 11:22:08PM +0200, Sascha E. Pollok wrote:
> > Also, what kind of FE boards do you use on the 7206?
> > I am currently unsure whether e.g. PA-FE-TX support
> > larger MTUs needed for MPLS/VPN.
>
> "Sort of".  There was a lengthy discussion on this list, about two years
> ago - as far as I remember, the single-port FEs for the 7200s are bugged
> and can only do an MTU up to 1530 bytes.
>
> ... but this still works nicely for simple L3 VPN stuff (1500+4+4).
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                           //
> www.muc.de/~gert/ <http://www.muc.de/%7Egert/>
> Gert Doering - Munich, Germany
> gert at greenie.muc.de
> fax: +49-89-35655025
> gert at net.informatik.tu-muenchen.de
>



-- 
------------------
Chris Hale
chale99 at gmail.com

From walter.keen at RainierConnect.net  Fri Jun  5 17:35:01 2009
From: walter.keen at RainierConnect.net (Walter Keen)
Date: Fri, 05 Jun 2009 14:35:01 -0700
Subject: [c-nsp] 7500 performance (was: Re: IO 7200 GE Improve Performance
 and help with the CPU Load?)
In-Reply-To: <4A269AA1.2030509@rollernet.us>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>	<4A26960D.8070206@cantv.net>	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>	<4A26997F.3030107@cantv.net>
	<4A269AA1.2030509@rollernet.us>
Message-ID: <4A298F85.5060002@rainierconnect.net>

Speaking of CPU performance, does anyone have any feedback on the Cisco 
7500 series, I'm considering using it instead of multiple 7204's to 
aggregate/terminate atm (9 oc3, 1 ds3) and T1 (channelized ds3) traffic, 
I'm looking at the RSP8, with vip4-80's and the appropriate PA's, and 
planning on doing etherchannel on (2) pa-fe's back to our core (7613) 
router.


From gsgranados at comcast.net  Sat Jun  6 02:27:36 2009
From: gsgranados at comcast.net (Scott Granados)
Date: Fri, 5 Jun 2009 23:27:36 -0700
Subject: [c-nsp] ACL creation and editing tool suggestions?
Message-ID: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>

I'm working in an environment with several large (north of 300 lines) ACLs that need managing.  Several different people have had their hands in editing before I arrived and the lists have grown in to large jumbled messes and as such are introducing a lot of error because of their complexity. I'm wondering how people manage large ACLs effectively.  Are there any tools that help in the automation of ACL creation or any good methods, if even by hand, that folks could recommend to help ease the clean up and maintenance process.  Something that could optimize the ACL in automated fashion?

Any pointers would be appreciated.

Thanks
Scott

From rdobbins at arbor.net  Sat Jun  6 06:26:05 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Sat, 6 Jun 2009 17:26:05 +0700
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
Message-ID: <BA2CC3F2-CDF9-4C63-9FE9-980D3EAEEB5B@arbor.net>


On Jun 6, 2009, at 1:27 PM, Scott Granados wrote:

> Something that could optimize the ACL in automated fashion?

None of the commercial tools I've seen do this in a platform-aware way  
- they're oriented towards software routers running T-train, and don't  
take into account hardware platform caveats.

You can start by organizing your ACLs into named and commented text  
files, and using something as simple as RCS to implement version  
control and to check out/check in ACL files for editing.  Lots of  
folks end up using tools like RANCID, RAT, Pancho, et. al. to help  
with auditing, and then custom Perl scripts or somesuch for editing/ 
updating.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From yvanog at hotmail.com  Sat Jun  6 12:51:43 2009
From: yvanog at hotmail.com (Rob Montgomery)
Date: Sat, 6 Jun 2009 12:51:43 -0400
Subject: [c-nsp] FW: 2621XM as Term Server
Message-ID: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>

 

Has anyone configured a 2621XM (ASYNC32A) as a terminal server?


From lukasz at bromirski.net  Sat Jun  6 14:20:15 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sat, 06 Jun 2009 20:20:15 +0200
Subject: [c-nsp] FW: 2621XM as Term Server
In-Reply-To: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>
References: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>
Message-ID: <4A2AB35F.6010806@bromirski.net>

On 2009-06-06 18:51, Rob Montgomery wrote:

> Has anyone configured a 2621XM (ASYNC32A) as a terminal server?

What is the *exact* problem you're facing?

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From sethm at rollernet.us  Sat Jun  6 15:31:05 2009
From: sethm at rollernet.us (Seth Mattinen)
Date: Sat, 06 Jun 2009 12:31:05 -0700
Subject: [c-nsp] FW: 2621XM as Term Server
In-Reply-To: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>
References: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>
Message-ID: <4A2AC3F9.8080301@rollernet.us>

Rob Montgomery wrote:
>  
> 
> Has anyone configured a 2621XM (ASYNC32A) as a terminal server?
> 

Yes, not with a 2621XM specifically, but they're practically all the same.

~Seth

From zivl at gilat.net  Sun Jun  7 08:48:43 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Sun, 7 Jun 2009 15:48:43 +0300
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
Message-ID: <EC993E87D960A541A66BF21D62AA42A622FF2D2189@exch2k7.gilat.local>

I can't imagine any kind of environment that would need 300 or more lines of ACL, I'm sure most of it is historical trash that can be disposed.
I'd suggest you to try to determine what do you REALLY need and create new ACL based on actual and updated needs, and then just delete the unused old ones.

I have some long ACLs which I'm used to create divided by sections, according to protocols, then most to less specific, stating from permitted and ending with the denies, even when implied I like to put them so it's clear to others, e.g

ip access extended TEST
 permit icmp any any
 permit udp any eq 53 any
 permit tcp any any established
 permit tcp any host 2.2.2.2 eq 80
 permit tcp host 1.1.1.1 host 2.2.2.2 eq 3339
 deny tcp any host 2.2.2.2 eq 3339
 permit ip host 3.3.3.3 4.4.4.0 0.0.0.255
 deny ip any 4.4.4.0 0.0.0.255
 permit ip any any

In case I need to add/remove/edit a working ACL I always use the line numbers
If you do "show ip access-list TEST" for instance you'll get this output:

Extended IP access list TEST
    10 permit icmp any any
    20 permit udp any eq domain any
    30 permit tcp any any established
    40 permit tcp any host 2.2.2.2 eq www
    50 permit tcp host 1.1.1.1 host 2.2.2.2 eq 3339
    60 deny tcp any host 2.2.2.2 eq 3339
    70 permit ip host 3.3.3.3 4.4.4.0 0.0.0.255
    80 deny ip any 4.4.4.0 0.0.0.255
 90 permit ip any any

This allows you to remove a line by doing
conf t
ip access-list extended TEST
no 60
!
Or add a line in between
55 permit tcp host 5.5.5.5 host 2.2.2.2 eq 3339

Which will change your ACL to:

Extended IP access list TEST
    10 permit icmp any any
    20 permit udp any eq domain any
    30 permit tcp any any established
    40 permit tcp any host 2.2.2.2 eq www
    50 permit tcp host 1.1.1.1 host 2.2.2.2 eq 3339
    55 permit tcp host 5.5.5.5 host 2.2.2.2 eq 3339
    60 deny tcp any host 2.2.2.2 eq 3339
    70 permit ip host 3.3.3.3 4.4.4.0 0.0.0.255
    80 deny ip any 4.4.4.0 0.0.0.255
 90 permit ip any any

Anyway, I wouldn't suggest using any kind of automatic stuff, you'll have to actually go line by line, as tedious as it may sound, to determine what exactly you need or not, or just opt to create them from scratch setting only the stuff you're sure you need and save the old ones for reference or future review.
Hope this helps,
Ziv



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Scott Granados
Sent: Saturday, June 06, 2009 9:28 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ACL creation and editing tool suggestions?

I'm working in an environment with several large (north of 300 lines) ACLs that need managing.  Several different people have had their hands in editing before I arrived and the lists have grown in to large jumbled messes and as such are introducing a lot of error because of their complexity. I'm wondering how people manage large ACLs effectively.  Are there any tools that help in the automation of ACL creation or any good methods, if even by hand, that folks could recommend to help ease the clean up and maintenance process.  Something that could optimize the ACL in automated fashion?

Any pointers would be appreciated.

Thanks
Scott
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From ygauteron at gmail.com  Sun Jun  7 11:45:53 2009
From: ygauteron at gmail.com (Yann Gauteron)
Date: Sun, 7 Jun 2009 17:45:53 +0200
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A622FF2D2189@exch2k7.gilat.local>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
	<EC993E87D960A541A66BF21D62AA42A622FF2D2189@exch2k7.gilat.local>
Message-ID: <8097baf0906070845l3cd1e20bmb989a322e1bcfc60@mail.gmail.com>

2009/6/7 Ziv Leyes <zivl at gilat.net>:
> I can't imagine any kind of environment that would need 300 or more lines of ACL, I'm sure most of it is historical trash that can be disposed.
> I'd suggest you to try to determine what do you REALLY need and create new ACL based on actual and updated needs, and then just delete the unused old ones.

I can imagine a design where subnets are badly aggregated and where an
ACL entry has to be repeated many times because it has to be applied
to non-adjacent subnets that should have the same access control
applied. I have seen this once... This was the result of historical
evolution of the network without never thinking more steps forward
than just the present augmentation (for instance reserving some
ajdacent IP subnets for future extensions). ACL management is a
nightmare, but redesigning the network was just something that was not
considered by the company (because of the time and costs, and "why
would I redesign it, as it operates as expected ?")

From ibrahim.abozaid at gmail.com  Sun Jun  7 19:09:53 2009
From: ibrahim.abozaid at gmail.com (Ibrahim Abo Zaid)
Date: Mon, 8 Jun 2009 02:09:53 +0300
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
Message-ID: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>

Hi All


I am trying to establish L2 Etherchannel between 2 7609 routers ,
SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
12.2(33)SRD*

are there any concerns to establish this etherchannel between ports in
different line cards ?


best regards
--Ibrahim

From peter at rathlev.dk  Sun Jun  7 20:01:16 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 08 Jun 2009 02:01:16 +0200
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
In-Reply-To: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
References: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
Message-ID: <1244419276.3423.70.camel@localhost.localdomain>

On Mon, 2009-06-08 at 02:09 +0300, Ibrahim Abo Zaid wrote:
> I am trying to establish L2 Etherchannel between 2 7609 routers ,
> SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
> 12.2(33)SRD*
> 
> are there any concerns to establish this etherchannel between ports in
> different line cards ?

Etherchannels are a little pointless on the WS-X6148-GE card and
similiar. They have 1GB/s ASICs, so you'll never exceed 1GB/s anyhow.
And the ASIC to physical port ratio also limits you.

But generally speaking, cross module etherchannels are a good idea and
AFAIK is recommended from Cisco for high availability.

Regards,
Peter



From paul at paulstewart.org  Sun Jun  7 20:07:41 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Sun, 7 Jun 2009 20:07:41 -0400
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
In-Reply-To: <1244419276.3423.70.camel@localhost.localdomain>
References: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
	<1244419276.3423.70.camel@localhost.localdomain>
Message-ID: <000901c9e7cd$24df84b0$6e9e8e10$@org>

You may wish to clarify the 1Gb/s limit however on the 6148A unless I am
mistaken.  Yes, 1 Gig per ASIC but doesn't the 6148A have one ASIC per 8
ports or am I thinking of a different card?  

Thank you for the clarification...

Paul



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Rathlev
Sent: June 7, 2009 8:01 PM
To: Ibrahim Abo Zaid
Cc: cisco_nsp
Subject: Re: [c-nsp] 7600 router and Etherchannel across multiple line card

On Mon, 2009-06-08 at 02:09 +0300, Ibrahim Abo Zaid wrote:
> I am trying to establish L2 Etherchannel between 2 7609 routers ,
> SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
> 12.2(33)SRD*
> 
> are there any concerns to establish this etherchannel between ports in
> different line cards ?

Etherchannels are a little pointless on the WS-X6148-GE card and
similiar. They have 1GB/s ASICs, so you'll never exceed 1GB/s anyhow.
And the ASIC to physical port ratio also limits you.

But generally speaking, cross module etherchannels are a good idea and
AFAIK is recommended from Cisco for high availability.

Regards,
Peter


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From paul at paulstewart.org  Sun Jun  7 20:10:30 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Sun, 7 Jun 2009 20:10:30 -0400
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
In-Reply-To: <1244419276.3423.70.camel@localhost.localdomain>
References: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
	<1244419276.3423.70.camel@localhost.localdomain>
Message-ID: <000a01c9e7cd$8958f430$9c0adc90$@org>

Apologies for bumping the post....

My notes show the following:

WS-X6148A-GE-TX 
*Number of ports: 48 
Number of port groups: 6 
Port ranges per port group: 1-8, 9-16, 17-24, 25-32, 33-40, 41-48 *The 
aggregate bandwidth of each port group is 1 Gbps. 

WS-X6148-GE-TX 
*Number of ports: 48 
Number of port groups: 2 
Port ranges per port group: 1-24, 25-48 
Note WS-X6148-GE-TX, WS-X6148V-GE-TX, and WS-X6148-GE-45AF do not 
support these features: 
*More than 1 Gbps of traffic per EtherChannel

Sorry, I was thinking 6148A and the OP has specified the non-A version hence
the confusion on my part...

Thanks,

Paul


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Rathlev
Sent: June 7, 2009 8:01 PM
To: Ibrahim Abo Zaid
Cc: cisco_nsp
Subject: Re: [c-nsp] 7600 router and Etherchannel across multiple line card

On Mon, 2009-06-08 at 02:09 +0300, Ibrahim Abo Zaid wrote:
> I am trying to establish L2 Etherchannel between 2 7609 routers ,
> SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
> 12.2(33)SRD*
> 
> are there any concerns to establish this etherchannel between ports in
> different line cards ?

Etherchannels are a little pointless on the WS-X6148-GE card and
similiar. They have 1GB/s ASICs, so you'll never exceed 1GB/s anyhow.
And the ASIC to physical port ratio also limits you.

But generally speaking, cross module etherchannels are a good idea and
AFAIK is recommended from Cisco for high availability.

Regards,
Peter


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From dstorandt at teljet.com  Sun Jun  7 20:51:22 2009
From: dstorandt at teljet.com (David Storandt)
Date: Sun, 7 Jun 2009 20:51:22 -0400
Subject: [c-nsp] 7500 performance
Message-ID: <f52f476c0906071751m4ff1cdddy993e4fcaeac0b8e2@mail.gmail.com>

Have you seen Cisco's performance spec sheet? Once of their better
references for rough platform performance estimation.

http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf

A RSP8 is a touch faster than a 720x/NPE400, but also the 7500-series
distributed switching capability will offload the CPU when it doesn't
have to deal with forwarding, leaving more cycles for pure software
processes.

-Dave

From sfischer1967 at gmail.com  Sun Jun  7 22:47:58 2009
From: sfischer1967 at gmail.com (Steven Fischer)
Date: Sun, 7 Jun 2009 22:47:58 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
Message-ID: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>

I have a 4510 in our environment that is reporting literally dozens of
changes to the running configuration throughout the day - days on which I am
certain no changes have been made to it - the syslog message is given with
the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
whole lot.  Any ideas on what could be causing this?

-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy

From rdobbins at arbor.net  Sun Jun  7 23:00:22 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Mon, 8 Jun 2009 10:00:22 +0700
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
Message-ID: <A9443A5C-3795-4CFF-B1F1-8E1FA5A5FABD@arbor.net>


On Jun 8, 2009, at 9:47 AM, Steven Fischer wrote:

> Any ideas on what could be causing this?

Are you doing config diffs in order to ensure that no changes are in  
fact being made?  Have you looked through the AAA logs to look at  
logins/logouts and commands executed by authorized personnel?

You should consider the possibility that someone other than authorized  
personnel within your organization is making changes, and investigate  
accordingly - especially if all the usual BCPs around iACLs, vty ACLs,  
AAA, strong local account/password, et. al. haven't yet been  
implemented.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From sfischer1967 at gmail.com  Sun Jun  7 23:02:45 2009
From: sfischer1967 at gmail.com (Steven Fischer)
Date: Sun, 7 Jun 2009 23:02:45 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>
Message-ID: <500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>

indeed, we are running RANCID...good call.  and they are periodic...but none
of my other devices do this, and we have another 4510 that doesn't appear to
be doing it either.

can anything be done?  I'm just waiting for management to see this and
wonder what in blue-blazes is going on, and then to panic.

On Sun, Jun 7, 2009 at 10:56 PM, Ryan West <rwest at zyedge.com> wrote:

> Are you running any type of backup utility (RANCID etc) that might be
> triggering your logs?  Are the timestamps periodic or random?
>
> -ryan
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:
> cisco-nsp-bounces at puck.nether.net] On Behalf Of Steven Fischer
> Sent: Sunday, June 07, 2009 10:48 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
> day...
>
> I have a 4510 in our environment that is reporting literally dozens of
> changes to the running configuration throughout the day - days on which I
> am
> certain no changes have been made to it - the syslog message is given with
> the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
> whole lot.  Any ideas on what could be causing this?
>
> --
> To him who is able to keep you from falling and to present you before his
> glorious presence without fault and with great joy
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy

From rdobbins at arbor.net  Sun Jun  7 23:13:00 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Mon, 8 Jun 2009 10:13:00 +0700
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>
	<500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>
Message-ID: <80C93820-59A7-49E7-9617-F40B68EBAB5D@arbor.net>


On Jun 8, 2009, at 10:02 AM, Steven Fischer wrote:

> can anything be done?


Assuming it's RANCID or something else legit, and assuming that you in  
fact don't want to see this in your logs (why non-technical management  
are looking at your logs in the first place is an interesting  
question, heh), is the log-level on this box different than the log- 
level on the other boxes?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From andhy.indarto at indosat.com  Sun Jun  7 22:38:59 2009
From: andhy.indarto at indosat.com (Andhy Indarto)
Date: Mon, 8 Jun 2009 09:38:59 +0700
Subject: [c-nsp] atm oam ping ok but ping ip not ok
Message-ID: <2233A6BE8D55AE4C9119D7870748FC310C6AEB90@isatjkt-msg01.office.corp.indosat.com>

Dear all,

I have experience with ATM interface that when I do atm oam ping the
result is normal but when I do ping ip then the result is bad and have a
lot of packet loss.

This is the reslt of atm oam ping :

Sending 500, 53-byte end-to-end OAM echoes, timeout is 2 seconds:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Success rate is 100 percent (500/500), round-trip min/avg/max = 4/6/16
ms

 

And this is the result of ping ip :

Sending 100, 100-byte ICMP Echos to 10.149.3.97, timeout is 2 seconds:

..!!..!!!.!!!..!...!!!.!!!!.!.!!!!.!!...!...!..!!!..!!!.!!!.!!..!!....

..!..!!..!!!.!.!!!...!!..!..!!

Success rate is 53 percent (53/100), round-trip min/avg/max = 4/4/8 ms

I am new with atm and I have to troubleshoot inter-city link using ATM,
what is the cause of L2 ping ok but L3 ping is bad ? What is the
troubleshooting scenario that I should do to verify and find the root
cause ?

Thanks

andhi




*****
"This message is intended only for recipients who are authorized to receive it. 
It contains confidential and/ or legally priveleged information belong to PT INDOSAT Tbk ("INDOSAT"), therefore the authorized recipients shall  protect this confidential information disclosed pursuant to provisions of Indosat's policy.
If you are not a valid recipient of this message, please delete it from your system and/ or destroy all of the tangible material produced from the information herein together with all copies or reproductions thereof and notify the sender immediately. 
Please also be notified that any disclosure, copying, distribution or taking any action based on the contents of this message is strictly prohibited and may be unlawful".
*****

From rwest at zyedge.com  Sun Jun  7 22:56:32 2009
From: rwest at zyedge.com (Ryan West)
Date: Sun, 7 Jun 2009 22:56:32 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout
	the	day...
In-Reply-To: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>

Are you running any type of backup utility (RANCID etc) that might be triggering your logs?  Are the timestamps periodic or random?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Steven Fischer
Sent: Sunday, June 07, 2009 10:48 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the day...

I have a 4510 in our environment that is reporting literally dozens of
changes to the running configuration throughout the day - days on which I am
certain no changes have been made to it - the syslog message is given with
the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
whole lot.  Any ideas on what could be causing this?

-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From rwest at zyedge.com  Sun Jun  7 23:20:38 2009
From: rwest at zyedge.com (Ryan West)
Date: Sun, 7 Jun 2009 23:20:38 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
 day...
In-Reply-To: <500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>
	<500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074F@zy-ex1.zyedge.local>

Without seeing the differences between configs on your 4510's, I would look at the archive section of the config to see if the auditing is enabled.

-ryan

From: Steven Fischer [mailto:sfischer1967 at gmail.com]
Sent: Sunday, June 07, 2009 11:03 PM
To: Ryan West
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] 4510 reporting dozens of config changes throughout the day...

indeed, we are running RANCID...good call.  and they are periodic...but none of my other devices do this, and we have another 4510 that doesn't appear to be doing it either.

can anything be done?  I'm just waiting for management to see this and wonder what in blue-blazes is going on, and then to panic.
On Sun, Jun 7, 2009 at 10:56 PM, Ryan West <rwest at zyedge.com<mailto:rwest at zyedge.com>> wrote:
Are you running any type of backup utility (RANCID etc) that might be triggering your logs?  Are the timestamps periodic or random?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net<mailto:cisco-nsp-bounces at puck.nether.net> [mailto:cisco-nsp-bounces at puck.nether.net<mailto:cisco-nsp-bounces at puck.nether.net>] On Behalf Of Steven Fischer
Sent: Sunday, June 07, 2009 10:48 PM
To: cisco-nsp at puck.nether.net<mailto:cisco-nsp at puck.nether.net>
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the day...

I have a 4510 in our environment that is reporting literally dozens of
changes to the running configuration throughout the day - days on which I am
certain no changes have been made to it - the syslog message is given with
the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
whole lot.  Any ideas on what could be causing this?

--
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net<mailto:cisco-nsp at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



--
To him who is able to keep you from falling and to present you before his glorious presence without fault and with great joy

From swmike at swm.pp.se  Mon Jun  8 01:27:14 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Mon, 8 Jun 2009 07:27:14 +0200 (CEST)
Subject: [c-nsp] atm oam ping ok but ping ip not ok
In-Reply-To: <2233A6BE8D55AE4C9119D7870748FC310C6AEB90@isatjkt-msg01.office.corp.indosat.com>
References: <2233A6BE8D55AE4C9119D7870748FC310C6AEB90@isatjkt-msg01.office.corp.indosat.com>
Message-ID: <alpine.DEB.1.10.0906080725370.22851@uplift.swm.pp.se>

On Mon, 8 Jun 2009, Andhy Indarto wrote:

> I am new with atm and I have to troubleshoot inter-city link using ATM, 
> what is the cause of L2 ping ok but L3 ping is bad ? What is the 
> troubleshooting scenario that I should do to verify and find the root 
> cause ?

When I've run into this it's always been that the routers are sending 
packets with higher bitrate than the ATM network is policing cellrate to. 
Make sure you have the correct UBR in your routers compared to what the 
ATM network is policing the PVC to.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From david.freedman at uk.clara.net  Mon Jun  8 05:23:46 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 08 Jun 2009 10:23:46 +0100
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
 day...
In-Reply-To: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
Message-ID: <4A2CD8A2.8050809@uk.clara.net>

Silly question, but are you running RANCID and do these changes appear
to be to port/vlan membership?

It is quite a common occurrence to have flapping ports be shown as
members and then suddenly not members of a vlan when rancid executes the
"show vlan" command.

Dave.


Steven Fischer wrote:
> I have a 4510 in our environment that is reporting literally dozens of
> changes to the running configuration throughout the day - days on which I am
> certain no changes have been made to it - the syslog message is given with
> the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
> whole lot.  Any ideas on what could be causing this?
> 


From david.freedman at uk.clara.net  Mon Jun  8 05:23:46 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 08 Jun 2009 10:23:46 +0100
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
 day...
In-Reply-To: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
Message-ID: <4A2CD8A2.8050809@uk.clara.net>

Silly question, but are you running RANCID and do these changes appear
to be to port/vlan membership?

It is quite a common occurrence to have flapping ports be shown as
members and then suddenly not members of a vlan when rancid executes the
"show vlan" command.

Dave.


Steven Fischer wrote:
> I have a 4510 in our environment that is reporting literally dozens of
> changes to the running configuration throughout the day - days on which I am
> certain no changes have been made to it - the syslog message is given with
> the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
> whole lot.  Any ideas on what could be causing this?
> 


From david.freedman at uk.clara.net  Mon Jun  8 05:26:40 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 08 Jun 2009 10:26:40 +0100
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
Message-ID: <4A2CD950.70704@uk.clara.net>

A newcomer to the 12.4(T) train is "ACL Object Groups"

http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_object_group_acl.html

I can see this making everybody's lives useful when it hits real
production trains.

For the time being, I'm emulating this functionality with my own
home-grown software.

Dave.


Scott Granados wrote:
> I'm working in an environment with several large (north of 300 lines) ACLs that need managing.  Several different people have had their hands in editing before I arrived and the lists have grown in to large jumbled messes and as such are introducing a lot of error because of their complexity. I'm wondering how people manage large ACLs effectively.  Are there any tools that help in the automation of ACL creation or any good methods, if even by hand, that folks could recommend to help ease the clean up and maintenance process.  Something that could optimize the ACL in automated fashion?
> 
> Any pointers would be appreciated.
> 
> Thanks
> Scott
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From david.freedman at uk.clara.net  Mon Jun  8 05:26:40 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 08 Jun 2009 10:26:40 +0100
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
Message-ID: <4A2CD950.70704@uk.clara.net>

A newcomer to the 12.4(T) train is "ACL Object Groups"

http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_object_group_acl.html

I can see this making everybody's lives useful when it hits real
production trains.

For the time being, I'm emulating this functionality with my own
home-grown software.

Dave.


Scott Granados wrote:
> I'm working in an environment with several large (north of 300 lines) ACLs that need managing.  Several different people have had their hands in editing before I arrived and the lists have grown in to large jumbled messes and as such are introducing a lot of error because of their complexity. I'm wondering how people manage large ACLs effectively.  Are there any tools that help in the automation of ACL creation or any good methods, if even by hand, that folks could recommend to help ease the clean up and maintenance process.  Something that could optimize the ACL in automated fashion?
> 
> Any pointers would be appreciated.
> 
> Thanks
> Scott
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From tom at netspot.com.au  Mon Jun  8 05:36:26 2009
From: tom at netspot.com.au (Tom Lanyon)
Date: Mon, 8 Jun 2009 19:06:26 +0930
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <4A2CD8A2.8050809@uk.clara.net>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<4A2CD8A2.8050809@uk.clara.net>
Message-ID: <BAC5728D-B7DE-4760-891D-56CB3F752F6D@netspot.com.au>

On 08/06/2009, at 6:53 PM, David Freedman wrote:

> Silly question, but are you running RANCID and do these changes appear
> to be to port/vlan membership?
>
> It is quite a common occurrence to have flapping ports be shown as
> members and then suddenly not members of a vlan when rancid executes  
> the
> "show vlan" command.


That shouldn't cause a AUDIT-5-RUN_CONFIG log message though, right?

Tom

From sfischer1967 at gmail.com  Mon Jun  8 06:01:15 2009
From: sfischer1967 at gmail.com (Steven Fischer)
Date: Mon, 8 Jun 2009 06:01:15 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <BAC5728D-B7DE-4760-891D-56CB3F752F6D@netspot.com.au>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<4A2CD8A2.8050809@uk.clara.net>
	<BAC5728D-B7DE-4760-891D-56CB3F752F6D@netspot.com.au>
Message-ID: <500ffb690906080301p40dfd68bu4a74c721ae3ea083@mail.gmail.com>

doing a compare, I found a single config element, "ip ssh logging events"
that was present on the device generating the messages, but not on the 4510
that isn't.  Removed it, and will see what that does.

On Mon, Jun 8, 2009 at 5:36 AM, Tom Lanyon <tom at netspot.com.au> wrote:

> On 08/06/2009, at 6:53 PM, David Freedman wrote:
>
> Silly question, but are you running RANCID and do these changes appear
>> to be to port/vlan membership?
>>
>> It is quite a common occurrence to have flapping ports be shown as
>> members and then suddenly not members of a vlan when rancid executes the
>> "show vlan" command.
>>
>
>
> That shouldn't cause a AUDIT-5-RUN_CONFIG log message though, right?
>
> Tom
>



-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy

From karim.adel at gmail.com  Mon Jun  8 06:13:01 2009
From: karim.adel at gmail.com (Kasper Adel)
Date: Mon, 8 Jun 2009 13:13:01 +0300
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
Message-ID: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>

Hello,

I'm looking for a way to measure Jitter for a VoIP network and i cant get my
hands on IXIA or any fancy tool like that so i'm asking if anyone used any
open source tool specifically for the matter.

IPerf is an option but i've never used it, so can you guys point me if i can
be used and what are the tests that i can try with it, my skills on *nix and
these tools is similar to my skills with Chinese poetry ;)

Thanks,
Kas

From Ian.Mackinnon at lumison.net  Mon Jun  8 06:19:12 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Mon, 8 Jun 2009 11:19:12 +0100
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D91C2BB9@nbg01-exch-01.entlstaff.domain.lumison.net>

Is using IP SLA functionality on your routers an option?
Then graph the data with Cacti or mrtg.
Or smoke ping, http://oss.oetiker.ch/smokeping/


> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Kasper Adel
> Sent: 08 June 2009 11:13
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
>
> Hello,
>
> I'm looking for a way to measure Jitter for a VoIP network and i cant
> get my
> hands on IXIA or any fancy tool like that so i'm asking if anyone used
> any
> open source tool specifically for the matter.
>
> IPerf is an option but i've never used it, so can you guys point me if
> i can
> be used and what are the tests that i can try with it, my skills on
> *nix and
> these tools is similar to my skills with Chinese poetry ;)
>
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From peter at rathlev.dk  Mon Jun  8 06:24:56 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 08 Jun 2009 12:24:56 +0200
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <1244456696.5100.37.camel@localhost.localdomain>

On Mon, 2009-06-08 at 13:13 +0300, Kasper Adel wrote:
> I'm looking for a way to measure Jitter for a VoIP network and i cant
> get my hands on IXIA or any fancy tool like that so i'm asking if
> anyone used any open source tool specifically for the matter.
> 
> IPerf is an option but i've never used it, so can you guys point me if
> i can be used and what are the tests that i can try with it, my skills
> on *nix and these tools is similar to my skills with Chinese poetry ;)

We use IP SLA / RTR measuring and graph it via Cacti. This URL describes
the procedure for installing the required templates in Cacti:

desc
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From peter at rathlev.dk  Mon Jun  8 06:25:57 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 08 Jun 2009 12:25:57 +0200
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <1244456757.5100.38.camel@localhost.localdomain>

(Hist Ctrl+Enter a little fast before, sorry. :-))

On Mon, 2009-06-08 at 13:13 +0300, Kasper Adel wrote:
> I'm looking for a way to measure Jitter for a VoIP network and i cant
> get my hands on IXIA or any fancy tool like that so i'm asking if
> anyone used any open source tool specifically for the matter.
> 
> IPerf is an option but i've never used it, so can you guys point me if
> i can be used and what are the tests that i can try with it, my skills
> on *nix and these tools is similar to my skills with Chinese poetry ;)

We use IP SLA / RTR measuring and graph it via Cacti. This URL describes
the procedure for installing the required templates in Cacti:

http://forums.cacti.net/about19542.html

Regards,
Peter



From masood at nexlinx.net.pk  Mon Jun  8 07:31:51 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Mon, 8 Jun 2009 16:31:51 +0500 (PKT)
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>

MTR is a nice tool to check delay, loss and jitter stuff. If you wana keep
track of historic logs, you can use nagios (or a tool like nagios).

You can write your own scripts (using tcl, bash, perl or whatever u like)
to monitor delay, jitter and loss and can feed the output to nagios for
historic logs.

Regards,
Masood


> Hello,
>
> I'm looking for a way to measure Jitter for a VoIP network and i cant get
> my
> hands on IXIA or any fancy tool like that so i'm asking if anyone used any
> open source tool specifically for the matter.
>
> IPerf is an option but i've never used it, so can you guys point me if i
> can
> be used and what are the tests that i can try with it, my skills on *nix
> and
> these tools is similar to my skills with Chinese poetry ;)
>
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From karim.adel at gmail.com  Mon Jun  8 06:53:33 2009
From: karim.adel at gmail.com (Kasper Adel)
Date: Mon, 8 Jun 2009 13:53:33 +0300
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <e05f39290906080353j21135d03i4372f2d811aaee6b@mail.gmail.com>

Thanks guys, the customer is looking for a third party vendor for this test
because we already used IP SLA and it looks good but the Media Gateways
vendor has its own measurement tool inside and they mentioned that their
values are bad (8 msec jittter).

Cheers,
Kas

On Mon, Jun 8, 2009 at 2:31 PM, <masood at nexlinx.net.pk> wrote:

> MTR is a nice tool to check delay, loss and jitter stuff. If you wana keep
> track of historic logs, you can use nagios (or a tool like nagios).
>
> You can write your own scripts (using tcl, bash, perl or whatever u like)
> to monitor delay, jitter and loss and can feed the output to nagios for
> historic logs.
>
> Regards,
> Masood
>
>
> > Hello,
> >
> > I'm looking for a way to measure Jitter for a VoIP network and i cant get
> > my
> > hands on IXIA or any fancy tool like that so i'm asking if anyone used
> any
> > open source tool specifically for the matter.
> >
> > IPerf is an option but i've never used it, so can you guys point me if i
> > can
> > be used and what are the tests that i can try with it, my skills on *nix
> > and
> > these tools is similar to my skills with Chinese poetry ;)
> >
> > Thanks,
> > Kas
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
>
>
>

From ray at oneunified.net  Mon Jun  8 07:02:52 2009
From: ray at oneunified.net (Ray Burkholder)
Date: Mon, 8 Jun 2009 08:02:52 -0300
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080353j21135d03i4372f2d811aaee6b@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>	<35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
	<e05f39290906080353j21135d03i4372f2d811aaee6b@mail.gmail.com>
Message-ID: <052801c9e828$ca440100$5ecc0300$@net>

> 
> Thanks guys, the customer is looking for a third party vendor for this
> test
> because we already used IP SLA and it looks good but the Media Gateways
> vendor has its own measurement tool inside and they mentioned that
> their
> values are bad (8 msec jittter).

Obtain nProbe from NTOP.  It can be used to collect jitter statistics,
amongst other things.  nProbe has a small, reasonable one time licensing
fee.  Use any version 9 netflow analyzer to look at the statistics.

http://www.oneunified.net/blog/OpenSource/Debian/Monitoring/ntop.article

> 
> 
> On Mon, Jun 8, 2009 at 2:31 PM, <masood at nexlinx.net.pk> wrote:
> 
> > MTR is a nice tool to check delay, loss and jitter stuff. If you wana
> keep
> > track of historic logs, you can use nagios (or a tool like nagios).
> >
> > You can write your own scripts (using tcl, bash, perl or whatever u
> like)
> > to monitor delay, jitter and loss and can feed the output to nagios
> for
> > historic logs.
> >
> >
> > > Hello,
> > >
> > > I'm looking for a way to measure Jitter for a VoIP network and i
> cant get
> > > my
> > > hands on IXIA or any fancy tool like that so i'm asking if anyone
> used
> > any
> > > open source tool specifically for the matter.
> > >
> > > IPerf is an option but i've never used it, so can you guys point me
> if i
> > > can
> > > be used and what are the tests that i can try with it, my skills on
> *nix
> > > and
> > > these tools is similar to my skills with Chinese poetry ;)
> > >


-- 
Scanned for viruses and dangerous content at 
http://www.oneunified.net and is believed to be clean.


From rodunn at cisco.com  Mon Jun  8 07:15:28 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Mon, 8 Jun 2009 07:15:28 -0400
Subject: [c-nsp] 7500 performance (was: Re: IO 7200 GE Improve
	Performance and help with the CPU Load?)
In-Reply-To: <4A298F85.5060002@rainierconnect.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net> <4A269AA1.2030509@rollernet.us>
	<4A298F85.5060002@rainierconnect.net>
Message-ID: <20090608111528.GE1288@rtp-cse-489.cisco.com>

As long as you want just basic IP with very little features and
you make sure it's all dCEF switched you will probably be ok.

Watch the VIP cpu loads though if you pack the oc3's and etherchannels.

It's all software, although distributed, switching.

Rodney

On Fri, Jun 05, 2009 at 02:35:01PM -0700, Walter Keen wrote:
> Speaking of CPU performance, does anyone have any feedback on the Cisco 
> 7500 series, I'm considering using it instead of multiple 7204's to 
> aggregate/terminate atm (9 oc3, 1 ds3) and T1 (channelized ds3) traffic, 
> I'm looking at the RSP8, with vip4-80's and the appropriate PA's, and 
> planning on doing etherchannel on (2) pa-fe's back to our core (7613) 
> router.
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From pekkas at netcore.fi  Mon Jun  8 07:17:46 2009
From: pekkas at netcore.fi (Pekka Savola)
Date: Mon, 8 Jun 2009 14:17:46 +0300 (EEST)
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <alpine.LRH.2.00.0906081415520.26369@netcore.fi>

On Mon, 8 Jun 2009, masood at nexlinx.net.pk wrote:
> MTR is a nice tool to check delay, loss and jitter stuff. If you wana keep
> track of historic logs, you can use nagios (or a tool like nagios).

Note that MTR is measuring almost everything it does from the ICMPs 
generated by the routers.  As such it doesn't necessarily give the 
right idea of end-to-end network properties.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

From bbc at misn.com  Mon Jun  8 08:46:06 2009
From: bbc at misn.com (Bryan Campbell)
Date: Mon, 08 Jun 2009 07:46:06 -0500
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <1244465167.7701.8.camel@home-desktop>


You cannot measure VOIP (sip) jitter using ICMP tools.  You will only
isolate false positives when the ICMP is not doing well.

Route or mirror the customers traffic trough a monitoring station.  Run
tcpdump or Wireshark to get a pcap file that contains traffic of
interest.  Wash the pcap file through the Wireshark VOIP analysis tool
to find your jitter.  It is a standard tool in Wireshark.

If you can't find jitter in this manner, it cannot be found.  If it
cannot be found, it doesn't exist.

bbc at misn.com



On Mon, 2009-06-08 at 13:13 +0300, Kasper Adel wrote:
> Hello,
> 
> I'm looking for a way to measure Jitter for a VoIP network and i cant get my
> hands on IXIA or any fancy tool like that so i'm asking if anyone used any
> open source tool specifically for the matter.
> 
> IPerf is an option but i've never used it, so can you guys point me if i can
> be used and what are the tests that i can try with it, my skills on *nix and
> these tools is similar to my skills with Chinese poetry ;)
> 
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From eric at atlantech.net  Mon Jun  8 10:06:21 2009
From: eric at atlantech.net (Eric Van Tol)
Date: Mon, 8 Jun 2009 10:06:21 -0400
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <1244465167.7701.8.camel@home-desktop>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<1244465167.7701.8.camel@home-desktop>
Message-ID: <2C05E949E19A9146AF7BDF9D44085B8635399EACA9@exchange.aoihq.local>

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Bryan Campbell
> Sent: Monday, June 08, 2009 8:46 AM
> To: Kasper Adel
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Opensource tool to measure Jitter for VoIP
> 
> 
> You cannot measure VOIP (sip) jitter using ICMP tools.  You will only
> isolate false positives when the ICMP is not doing well.
> 
> Route or mirror the customers traffic trough a monitoring station.  Run
> tcpdump or Wireshark to get a pcap file that contains traffic of
> interest.  Wash the pcap file through the Wireshark VOIP analysis tool
> to find your jitter.  It is a standard tool in Wireshark.
> 
> If you can't find jitter in this manner, it cannot be found.  If it
> cannot be found, it doesn't exist.
> 
> bbc at misn.com

What are the there legal ramifications to this?  While I like to think that "it's my network, I'll do what I want to measure its performance", I *think* that sniffing voice traffic without consent is considered wiretapping.  IANAL, but it would behoove you to get a consent form from your customer prior to taking this route, just in case.

-evt

From moua0100 at umn.edu  Mon Jun  8 10:11:29 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Mon, 08 Jun 2009 09:11:29 -0500
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <4A2D1C11.3010105@umn.edu>

smokeping

supports latency metrics out of the box; add plugins for jitter

easy to install (debian based *nix)
apt-get install smokeping



Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Kasper Adel wrote:
> Hello,
>
> I'm looking for a way to measure Jitter for a VoIP network and i cant get my
> hands on IXIA or any fancy tool like that so i'm asking if anyone used any
> open source tool specifically for the matter.
>
> IPerf is an option but i've never used it, so can you guys point me if i can
> be used and what are the tests that i can try with it, my skills on *nix and
> these tools is similar to my skills with Chinese poetry ;)
>
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From mcgrath at fas.harvard.edu  Mon Jun  8 09:46:38 2009
From: mcgrath at fas.harvard.edu (Scott McGrath)
Date: Mon, 8 Jun 2009 08:46:38 -0500
Subject: [c-nsp] 4510 reporting dozens of config changes throughout
 the	day...
Message-ID: <0964463E42710F45AD34A9F2D9F249DC22A62F8735@34093-MBX-C05.mex07a.mlsrvr.com>

Port autonegotiation may be a cause you may prefer not logging port status changes which DO alter the running config

Sent with Good (www.good.com)


 -----Original Message-----
From: 	Steven Fischer [mailto:sfischer1967 at gmail.com]
Sent:	Sunday, June 07, 2009 10:06 PM Central Standard Time
To:	Ryan West
Cc:	cisco-nsp at puck.nether.net
Subject:	Re: [c-nsp] 4510 reporting dozens of config changes throughout the	day...

indeed, we are running RANCID...good call.  and they are periodic...but none
of my other devices do this, and we have another 4510 that doesn't appear to
be doing it either.

can anything be done?  I'm just waiting for management to see this and
wonder what in blue-blazes is going on, and then to panic.

On Sun, Jun 7, 2009 at 10:56 PM, Ryan West <rwest at zyedge.com> wrote:

> Are you running any type of backup utility (RANCID etc) that might be
> triggering your logs?  Are the timestamps periodic or random?
>
> -ryan
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:
> cisco-nsp-bounces at puck.nether.net] On Behalf Of Steven Fischer
> Sent: Sunday, June 07, 2009 10:48 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
> day...
>
> I have a 4510 in our environment that is reporting literally dozens of
> changes to the running configuration throughout the day - days on which I
> am
> certain no changes have been made to it - the syslog message is given with
> the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
> whole lot.  Any ideas on what could be causing this?
>
> --
> To him who is able to keep you from falling and to present you before his
> glorious presence without fault and with great joy
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From paul at paulstewart.org  Mon Jun  8 11:04:19 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Mon, 8 Jun 2009 11:04:19 -0400
Subject: [c-nsp] BGP Advertising - Question re more specific block
In-Reply-To: <200906081038.30501.kratzers@pa.net>
References: <004201c9e463$b72ec280$258c4780$@org>
	<200906081038.30501.kratzers@pa.net>
Message-ID: <001301c9e84a$66b67fb0$34237f10$@org>

Thank you....

We've messed already with a number of the options as you mentioned - this is
really a last resort from our viewpoint. ;)  The upstream (AS3320) does not
have good reach when going against our other upstreams/peering and we are
locked in a contract so trying to hit our minimum commit with them as best
as we can.

When we do some granular local-pref options it swings traffic around too
"dramatically" - using communities doesn't seem to resolve it neither (would
have thought it would actually)...

Appreciate it,

Paul


-----Original Message-----
From: Stephen Kratzer [mailto:kratzers at pa.net] 
Sent: Monday, June 08, 2009 10:39 AM
To: cisco-nsp at puck.nether.net
Cc: Paul Stewart
Subject: Re: [c-nsp] BGP Advertising - Question re more specific block

If the provider to which you are advertising a /22 is well-connected, I
would 
suggest determining what communities they support and try having them bump 
local pref up for the /18 and removing the more specific advertisements. If 
that brings too much traffic in via that provider, consider advertising 
the /18 with default local pref, but advertising a few more specifics with 
either no-advertise or no-export communities. Doing so should force that 
provider to use the more specifics while keeping global routing table 
pollution to a minimum. And if either of these two approaches don't bring 
enough traffic in via this provider, try tweaking local pref
(depreferencing) 
on other providers.

I realize that this doesn't address your specific config question, but I
think 
these approaches might be a bit better (more granular and nicer to the rest 
of us) than plain deaggregation. And yes, do as I say, not as I do.

Stephen

On Wednesday 03 June 2009 11:55:26 Paul Stewart wrote:
> Hi folks.
>
>
>
> I'd like to know if there's a better way to approach this.
>
>
>
> We are advertising a specific /22 that belongs to a /18 block via one
> specific upstream BGP connection.  The /18 is advertised to all upstreams,
> the /22 is only advertised to one upstream as a method of influencing
> traffic via that carrier (knowing that if that particular carrier went
> down, the less specific subnet will still be reachable via the other
> providers). Prepending is very ugly for this situation FYI.
>
>
>
> We use BGP communities to identify upstream and downstream BGP connections
> along with our own netblocks.
>
>
>
> First I built a route-map that I could use inside the BGP network
> statement:
>
>
>
> route-map blahblah-routes-providerx permit 1000
>
>  set community 11666:6001
>
>
>
> Then created the network statement:
>
>
>
> network xx.xx.xx.0 mask 255.255.252.0 route-map blahblah-routes-providerx
>
>
>
> Created a new IP community-list that includes previous communities plus
> this one new specific community (11666:6001):
>
>
>
> ip community-list 101 permit 11666:4000
>
> ip community-list 101 permit 11666:5000
>
> ip community-list 101 permit 11666:6001
>
>
>
> And, updated the route-map towards this upstream as applicable:
>
>
>
> route-map outbound-tsystems permit 10
>
>  match community 101
>
>
>
>
>
> My question - is there a better way to configure this?  This is working
> just fine for our needs but there's a lot of steps and we're going to have
> to add more into this in future so rather do as simple a config as
possible
> ;)
>
>
>
> Thanks,
>
>
>
> Paul
>
>
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/




From A.L.M.Buxey at lboro.ac.uk  Mon Jun  8 11:18:28 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Mon, 8 Jun 2009 16:18:28 +0100
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <2C05E949E19A9146AF7BDF9D44085B8635399EACA9@exchange.aoihq.local>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<1244465167.7701.8.camel@home-desktop>
	<2C05E949E19A9146AF7BDF9D44085B8635399EACA9@exchange.aoihq.local>
Message-ID: <20090608151828.GB1811@lboro.ac.uk>

Hi,

> What are the there legal ramifications to this?  While I like to think that "it's my network, I'll do what I want to measure its performance", I *think* that sniffing voice traffic without consent is considered wiretapping.  IANAL, but it would behoove you to get a consent form from your customer prior to taking this route, just in case.

dependsw what country you are in, why you are 'sniffing' and
how you are sniffing. if you are using an automated process to
keep measurements and are not looking at anything such as the payload
you have already removed a whole heap of issues. one would hope that
the voice traffic was encrypted by default so there was no 'wire-tapping'
argument (boy, I've had fun demonstrating why encryption should be
turned on ('but I'm on a private switched network!' they scream) )
finally, if you have no other indications of _who_ or _where_ the
IP addresses in src/dst are then thats another lot of privacy baggage
dumped.

the general concensus is that standard automated monitoring of network
performance with no tie to ownership or data within packets is fair game.

PS IANAL.

alan

From petelists at templin.org  Mon Jun  8 10:44:45 2009
From: petelists at templin.org (Pete Templin)
Date: Mon, 08 Jun 2009 09:44:45 -0500
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
In-Reply-To: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
References: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
Message-ID: <4A2D23DD.4080503@templin.org>

Ibrahim Abo Zaid wrote:

> I am trying to establish L2 Etherchannel between 2 7609 routers ,
> SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
> 12.2(33)SRD*
> 
> are there any concerns to establish this etherchannel between ports in
> different line cards ?

I vaguely recall a major limitation in the 6148 cards: not only is the 
card limited by only 6 1Gbps controllers, I believe EtherChannel traffic 
is mirrored across all 6 1Gbps controllers and therefore 1Gbps of EC 
traffic will max the card.

pt


From madunix at gmail.com  Mon Jun  8 11:50:10 2009
From: madunix at gmail.com (madunix)
Date: Mon, 8 Jun 2009 17:50:10 +0200
Subject: [c-nsp] MPLS
Message-ID: <4d3f56c90906080850j5eef041cua8abd4938698d177@mail.gmail.com>

agree with you security concern and latency, the overhead to make the
routing work in an MPLS network will
slow the traffic down, this will  creates latency concerns for the customer.

>madunix wrote:
>> I have 3x sites with DS8100 SAN Storage at each side, I will be
>> replicating data from one side to another (A - B, synchronous,
>> distance 100Km) and (B-C, asynchronous, 300Km). Am thinking to use
>> MPLS based on IP-VPN  since its secure and not visible to other
>> customers or internet.
>> Out of your experience ...what do you think about ?
>>
>
>Well, it's not "secure", it's simply routing isolated.  If you want
>security, as in encryption, you will need to do that on your own.
>
>If you need low convergence times, MPLS/VPN is probably not your best
>choice.  I don't know of many (if any) providers who will guarantee the
>convergence times through their network.  You should expect convergence
>times in the 10's of seconds or more for certain types of failures.
>
>You may want to consider getting an L2VPN solution such as VPWS or VPLS and
>running your own routing protocol and failure detection methods.
>


madunix

From petelists at templin.org  Mon Jun  8 11:27:01 2009
From: petelists at templin.org (Pete Templin)
Date: Mon, 08 Jun 2009 10:27:01 -0500
Subject: [c-nsp] 7500 performance
In-Reply-To: <4A298F85.5060002@rainierconnect.net>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>	<4A26960D.8070206@cantv.net>	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>	<4A26997F.3030107@cantv.net>	<4A269AA1.2030509@rollernet.us>
	<4A298F85.5060002@rainierconnect.net>
Message-ID: <4A2D2DC5.1020605@templin.org>

Walter Keen wrote:
> Speaking of CPU performance, does anyone have any feedback on the Cisco 
> 7500 series, I'm considering using it instead of multiple 7204's to 
> aggregate/terminate atm (9 oc3, 1 ds3) and T1 (channelized ds3) traffic, 
> I'm looking at the RSP8, with vip4-80's and the appropriate PA's, and 
> planning on doing etherchannel on (2) pa-fe's back to our core (7613) 
> router.

As someone (Jon Lewis?) said a while ago, VIPs in a 7500 are like 
individual 7202s with a magic backplane between them.  Sizing your VIPs 
is like sizing your NPEs.  If I were buying 7500s (which I wouldn't be 
doing), I'd be buying VIP4-80s at the bare minimum, VIP6-80s if I had 
the need, and RSP4s (if I didn't need full routes) or RSP16s (if I did 
need full routes).

I don't know how well those etherchannels will work for you.  I think 
they're software-dependent, but I suspect GEIP+ may be the better bet 
for you.  Complexity (of which etherchannel most likely qualifies) is 
not the 7500 strong suit.

pt


From zeusdadog at gmail.com  Mon Jun  8 14:33:09 2009
From: zeusdadog at gmail.com (Jay Nakamura)
Date: Mon, 8 Jun 2009 14:33:09 -0400
Subject: [c-nsp] Cisco IOS content filtering
Message-ID: <9418aca70906081133yd17948duaa1fd4153970828c@mail.gmail.com>

I am trying out for the first time the IOS content filtering feature.
Detail documentation seems little lacking.  One thing I can't find
references to is what exactly does each security categories and
productivity categories includes.  For example, UNBLEMISHED, what web
sites does that include?  Anyone have any info on this?

Thanks!

From mylists at battleop.com  Mon Jun  8 14:29:15 2009
From: mylists at battleop.com (Richey)
Date: Mon, 8 Jun 2009 14:29:15 -0400
Subject: [c-nsp] "sh run" crashes router
Message-ID: <00bb01c9e867$0727bc90$157735b0$@com>

I am setting up Tacacs+ on all of our far end routers so I can run rancid.
I have found several 1720s and a 2621 that crash when I log in to them and
issue the "sh run" command.   They reboot quickly and then I don't have a
problem with the "sh run" command after the reload.   If I look at the
output from a "sh ver" I get  System returned to ROM by error - a SegV
exception, PC 0x8066A150.    This seems to only be a small number of
routers.  They are in different environments (one is in a server room,
another on the wall in a warehouse, etc)   The 1700s are running various
versions of the same image type.    The only thing that they all have in
common is that it's been months since anyone has logged into the router.
Is this some bug that comes from long uptimes without any activity at the
CLI?

 

Richey

 

 


From eninja at gmail.com  Mon Jun  8 17:02:00 2009
From: eninja at gmail.com (e ninja)
Date: Mon, 8 Jun 2009 14:02:00 -0700
Subject: [c-nsp] "sh run" crashes router
In-Reply-To: <00bb01c9e867$0727bc90$157735b0$@com>
References: <00bb01c9e867$0727bc90$157735b0$@com>
Message-ID: <e8590f60906081402lcd51917o25f28fa998cafb53@mail.gmail.com>

Segmentation Violations (SegV) exceptions are _always_  caused by a bug in
Cisco IOS and could be triggered by either of the following:

   - Accessing an invalid memory address e.g. attempting to access the
   lowest 16KB of memory on powerPC platforms
   - Writing to a read-only memory region
   - A jump to an invalid PC (often 0x0)

Contact your network maintenance service provider/Cisco to get your bug fix.

More info at...

   -
   http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a0080189ddb.shtml
   - http://solutions.mysolvr.com/Spurious_Memory_Accesses

eninja



On Mon, Jun 8, 2009 at 11:29 AM, Richey <mylists at battleop.com> wrote:

> I am setting up Tacacs+ on all of our far end routers so I can run rancid.
> I have found several 1720s and a 2621 that crash when I log in to them and
> issue the "sh run" command.   They reboot quickly and then I don't have a
> problem with the "sh run" command after the reload.   If I look at the
> output from a "sh ver" I get  System returned to ROM by error - a SegV
> exception, PC 0x8066A150.    This seems to only be a small number of
> routers.  They are in different environments (one is in a server room,
> another on the wall in a warehouse, etc)   The 1700s are running various
> versions of the same image type.    The only thing that they all have in
> common is that it's been months since anyone has logged into the router.
> Is this some bug that comes from long uptimes without any activity at the
> CLI?
>
>
>
> Richey
>
>
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From elmi at 4ever.de  Mon Jun  8 17:03:27 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Mon, 8 Jun 2009 23:03:27 +0200
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)
Message-ID: <20090608210327.GV6911@ronin.4ever.de>

Re folks,

my private 7401 felt a bit empty, and I bought an ISL for it
(this should be the mgt interface, not much bandwidth).

I wonder if it is broken, or if I am doing something wrong, or
if this just cannot work because I'm too st00p1d and bought the
wrong thing...

The "show interface" output is quite interesting. No input packets,
but hundreds of thousands of input errors _per second_:

==========================================================================

rt#sh int f1/0
FastEthernet1/0 is up, line protocol is up
  Hardware is DEC21140A, address is 000a.4230.841c (bia 000a.4230.841c)
  Internet address is *.*.*.*
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 245/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, Unknown Speed, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  30 second input rate 0 bits/sec, 0 packets/sec
  30 second output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     2770584934 input errors, 0 CRC, 0 frame, 42604211 overrun, 2727980723 ignored
     0 watchdog
     0 input packets with dribble condition detected
     2432 packets output, 242733 bytes, 0 underruns
     0 output errors, 0 collisions, 2090 interface resets
     0 babbles, 0 late collision, 0 deferred
     2078 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

==========================================================================

Needless to say, I cannot see anything there and I cannot ping the
address with a direct connection either...

Config is straightforward:

interface FastEthernet1/0
 ip address *.*.*.* *.*.*.*
 load-interval 30
 duplex full
end

(I explicitly set the media-type, but that was obviously alright)

Of course the switch (3560) the box is connected to has full-duplex
configured on the if.


Any ideas?
		Elmar.

From paul at paulstewart.org  Mon Jun  8 17:40:37 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Mon, 8 Jun 2009 17:40:37 -0400
Subject: [c-nsp] "sh run" crashes router
In-Reply-To: <e8590f60906081402lcd51917o25f28fa998cafb53@mail.gmail.com>
References: <00bb01c9e867$0727bc90$157735b0$@com>
	<e8590f60906081402lcd51917o25f28fa998cafb53@mail.gmail.com>
Message-ID: <005901c9e881$c3c4ce50$4b4e6af0$@org>

What are some of the versions you are running?  We have some 1710/1711
routers and many 2621 in the field and have never experienced that
particular issue..

Agree with eninja though - always IOS bug 95% of the time anyways...;)

Paul


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of e ninja
Sent: June 8, 2009 5:02 PM
To: Richey
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] "sh run" crashes router

Segmentation Violations (SegV) exceptions are _always_  caused by a bug in
Cisco IOS and could be triggered by either of the following:

   - Accessing an invalid memory address e.g. attempting to access the
   lowest 16KB of memory on powerPC platforms
   - Writing to a read-only memory region
   - A jump to an invalid PC (often 0x0)

Contact your network maintenance service provider/Cisco to get your bug fix.

More info at...

   -
 
http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186
a0080189ddb.shtml
   - http://solutions.mysolvr.com/Spurious_Memory_Accesses

eninja



On Mon, Jun 8, 2009 at 11:29 AM, Richey <mylists at battleop.com> wrote:

> I am setting up Tacacs+ on all of our far end routers so I can run rancid.
> I have found several 1720s and a 2621 that crash when I log in to them and
> issue the "sh run" command.   They reboot quickly and then I don't have a
> problem with the "sh run" command after the reload.   If I look at the
> output from a "sh ver" I get  System returned to ROM by error - a SegV
> exception, PC 0x8066A150.    This seems to only be a small number of
> routers.  They are in different environments (one is in a server room,
> another on the wall in a warehouse, etc)   The 1700s are running various
> versions of the same image type.    The only thing that they all have in
> common is that it's been months since anyone has logged into the router.
> Is this some bug that comes from long uptimes without any activity at the
> CLI?
>
>
>
> Richey
>
>
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From mhuff at ox.com  Mon Jun  8 18:10:38 2009
From: mhuff at ox.com (Matthew Huff)
Date: Mon, 8 Jun 2009 18:10:38 -0400
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)
In-Reply-To: <20090608210327.GV6911@ronin.4ever.de>
References: <20090608210327.GV6911@ronin.4ever.de>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>

Duplex problems typically show runt, crc and collisions. 

The show interface line with:

  Full-duplex, Unknown Speed, 100BaseTX/FX

might be the problem.

How about :

interface FastEthernet1/0
 ip address *.*.*.* *.*.*.*
 load-interval 30
 speed 100
 duplex full
end

and check the config on the 3560

int fa1/2
  speed 100
  duplex full
  switchport
  switchport mode access
  spanning-tree portfast

If you are paranoid with portfast, add "spanning-tree bpduguard enable"



----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com? | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Elmar K. Bins
Sent: Monday, June 08, 2009 5:03 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)

Re folks,

my private 7401 felt a bit empty, and I bought an ISL for it
(this should be the mgt interface, not much bandwidth).

I wonder if it is broken, or if I am doing something wrong, or
if this just cannot work because I'm too st00p1d and bought the
wrong thing...

The "show interface" output is quite interesting. No input packets,
but hundreds of thousands of input errors _per second_:

==========================================================================

rt#sh int f1/0
FastEthernet1/0 is up, line protocol is up
  Hardware is DEC21140A, address is 000a.4230.841c (bia 000a.4230.841c)
  Internet address is *.*.*.*
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 245/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, Unknown Speed, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  30 second input rate 0 bits/sec, 0 packets/sec
  30 second output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     2770584934 input errors, 0 CRC, 0 frame, 42604211 overrun, 2727980723 ignored
     0 watchdog
     0 input packets with dribble condition detected
     2432 packets output, 242733 bytes, 0 underruns
     0 output errors, 0 collisions, 2090 interface resets
     0 babbles, 0 late collision, 0 deferred
     2078 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

==========================================================================

Needless to say, I cannot see anything there and I cannot ping the
address with a direct connection either...

Config is straightforward:

interface FastEthernet1/0
 ip address *.*.*.* *.*.*.*
 load-interval 30
 duplex full
end

(I explicitly set the media-type, but that was obviously alright)

Of course the switch (3560) the box is connected to has full-duplex
configured on the if.


Any ideas?
		Elmar.
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From andy.saykao at staff.netspace.net.au  Mon Jun  8 21:48:30 2009
From: andy.saykao at staff.netspace.net.au (Andy Saykao)
Date: Tue, 9 Jun 2009 11:48:30 +1000
Subject: [c-nsp] data corruption erros on the 7606 sup-720
Message-ID: <56F211C5E3F24F47B103EA1B253822BE03654E51@vic-cr-ex1.staff.netspace.net.au>

Anybody come across data corruption erros on the 7606 sup-720 before?
What's causing them? Are they bad or can we live with them???? 
 
 
Eg:
 
router-1#sh data-corruption
Data inconsistency records for:
s72033_rp Software (s72033_rp-IPSERVICESK9_WAN-M), Version
12.2(18)SXF16, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Compiled Tue 03-Mar-09 23:54 by kellythw
 
Count           Traceback
  112920        40E36158, 4045D590 40E36158 40E36EFC 40E49340 40E3B3D8
40EB04B4 40E8F3B0
               1: May 13 19:10:42.989
               2: May 13 19:10:42.989
               3: May 13 19:10:42.993
          112920: Jun  9 01:40:38.250
 
We're using IOS s72033-ipservicesk9_wan-mz.122-18.SXF16.bin
 
We're only seeing these data corrpuption errors on this particular
hardware platform and IOS. We've got other 7606s deployed but these are
sup-32's instead and do not show any data corruption errors.

Thanks.
 
Andy

This email and any files transmitted with it are confidential and intended
 solely for the use of the individual or entity to whom they are addressed. 
Please notify the sender immediately by email if you have received this 
email by mistake and delete this email from your system. Please note that
 any views or opinions presented in this email are solely those of the
 author and do not necessarily represent those of the organisation. 
Finally, the recipient should check this email and any attachments for 
the presence of viruses. The organisation accepts no liability for any 
damage caused by any virus transmitted by this email.


From frnkblk at iname.com  Mon Jun  8 22:39:08 2009
From: frnkblk at iname.com (Frank Bulk - iName.com)
Date: Mon, 8 Jun 2009 21:39:08 -0500
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <20090603071609.GY290@greenie.muc.de>
References: <20090603071609.GY290@greenie.muc.de>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>

Have you tried the SNMP approach?

Frank

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Gert Doering
Sent: Wednesday, June 03, 2009 2:16 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] hung vty on SXH3a?

Hi,

so far, we have been quite happy with SXH3a, but today two of our boxes
have started playing games with me...  notably, the command we use to
auto-upload ACLs etc

   rcp new_config.txt router:running-config

started to fail with "rcp: running-config: No such file or directory".

On other boxes, it works "as usual".  All the "ip rcmd" config is present
and sane.

The only thing that looks different is this:

Cisco#who
    Line       User       Host(s)              Idle       Location
   1 vty 0                Virtual Exec         00:00:00   
*  2 vty 1     gert       idle                 00:00:00 mgmthost

  Interface      User        Mode                     Idle     Peer Address

Cisco#

- "vty 0" looks weird.  I can't find a way to recover that vty, that is
"clear line 1" or "clear line vty 0" don't change anything.  Nor is there
a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
"show tcb vty 0" doesn't display anything).


So... is this a known bug in SXH3a?  Is there a way to reclaim that VTY
without rebooting?

(I've also tried configuring "transport input none" under "line vty 0", 
and to completely disable "ip rcmd ..." to get rid of the session, but no 
change either).

gert

-- 
USENET is *not* the non-clickable part of WWW!
 
//www.muc.de/~gert/
Gert Doering - Munich, Germany
gert at greenie.muc.de
fax: +49-89-35655025
gert at net.informatik.tu-muenchen.de


From frnkblk at iname.com  Mon Jun  8 22:39:08 2009
From: frnkblk at iname.com (Frank Bulk - iName.com)
Date: Mon, 8 Jun 2009 21:39:08 -0500
Subject: [c-nsp] Netflow analyzer suggestions
In-Reply-To: <20090602150859.H38689@shell.xecu.net>
References: <20090602150859.H38689@shell.xecu.net>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABwr8R3BhjNQogpoNi10l+BAQAAAAA=@iname.com>

It's not cheap, but Xangati may be a good match.

Frank

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Andy Dills
Sent: Tuesday, June 02, 2009 2:21 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Netflow analyzer suggestions


Hi there,

Apologies for the non-cisco specific post, but I couldn't think of a 
better list to post to off of the top of my head.

A friend of mine is looking to get some better visibility into their 
network usage (low bandwidth, T1 type scenario). I got them setup with an 
IOS that supports netflow v9, and since they had a freebsd box being 
barely used, I built ntop to be their collector/analyzer.

It works reasonably well, but it's perhaps not quite...user friendly 
enough for them.

What they're looking for is a graphical representation at the host level. 
In essence, they're looking for something like cricket/mrtg but with each 
IP having its own graph (rather than each interface). Additional features, 
such as protocol breakdown and so forth are helpful, but the primary 
desire is to be able to see how much bandwidth a given IP address is using 
currently and was using in the past.

They're open to commercial solutions, but would prefer to keep costs down. 
Host operating system requirements for the collector/analyzer aren't 
important.

Does anybody have any suggestions they could pass along?

Thanks,
Andy

---
Andy Dills
Xecunet, Inc.
www.xecu.net
301-682-9972
---
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From ml at kenweb.org  Mon Jun  8 22:44:01 2009
From: ml at kenweb.org (ML)
Date: Mon, 08 Jun 2009 22:44:01 -0400
Subject: [c-nsp] ME3400 Transmit queues and architecture
Message-ID: <4A2DCC71.6080605@kenweb.org>

This is a multi part question please bear with me.

Background synopsis: A large (on the order of millions) of output queue 
drops were causing noticeable breakup of multicast video streams.
I learned that the default egress queue size is 160 starting in 
12.2.46SE.  I upgraded some lab switches, This helped my situation 
immensely.
However output queue drops continued albeit much less frequently.

Question 1:
 From an off-list reply to my original question I was told I could 
increase the number of queues per interface with this policy-map:

policy-map max-queue
  class class-default
  queue-limit 544

Naturally I would want to apply to this to every interface, however I am 
unsure if this will be detrimental.  What I don't know is where queue 
space exists: DRAM, a small supply of onboard SRAM?
If I allocate 544 queues to every interface on an ME3400-24TS-A will I 
starve other processes for memory (unlikely check my math below)?
If the current default queue size is 160 and I increase it to 544 for 
all FastEthernet interfaces I would increase the amount of memory usage 
by 2.25 megabytes:

Queue size is 256 bytes; 24 interfaces.
((256*(544-160)bytes))*24 = 2.25 megabytes

Since these ME3400s are just access switches I seem to always at least 
50MB of free memory. Therefore 2.25 MBs doesn't seem like a big impact.

Am I correct in my calculations about the impact of the preceding 
policy-map applied system wide? Do the output queues live in run of the 
mill DRAM?


Question 2:

When I do apply the 'max-queue' policy-map to an interface and inspect 
my work:

sh platform qos debug port-class
sh platform qos debug port-config X

Port Class 0: Queue #3 seems to have my new max-queue setting but every 
other Port Class  and corresponding  Queue are still set to 48 (The 
pre-12.2.46SE default queue size?)

Am I missing something when I use these commands? This is new territory 
for me.


Question 3:

Are the FastEthernet ports on the ME3400 over subscribed in any way? Can 
I expect line-rate performance on every port at once or is there an ASIC 
handling groups of 2^n ports?


Thanks in advance for any help.

****





From ip at ioshints.info  Tue Jun  9 00:58:25 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Tue, 9 Jun 2009 06:58:25 +0200
Subject: [c-nsp] Cisco IOS content filtering
In-Reply-To: <9418aca70906081133yd17948duaa1fd4153970828c@mail.gmail.com>
References: <9418aca70906081133yd17948duaa1fd4153970828c@mail.gmail.com>
Message-ID: <001101c9e8be$ecad7230$0a00000a@nil.si>

Haven't tried the server-based configuration yet (it only works on ISRs),
here's what you can do locally:

http://wiki.nil.com/Local_Content_Filtering_in_Cisco_IOS

Best regards
Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/ 

> -----Original Message-----
> From: Jay Nakamura [mailto:zeusdadog at gmail.com] 
> Sent: Monday, June 08, 2009 8:33 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco IOS content filtering
> 
> I am trying out for the first time the IOS content filtering feature.
> Detail documentation seems little lacking.  One thing I can't 
> find references to is what exactly does each security 
> categories and productivity categories includes.  For 
> example, UNBLEMISHED, what web sites does that include?  
> Anyone have any info on this?
> 
> Thanks!
> 
> 


From elmi at 4ever.de  Tue Jun  9 03:14:28 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Tue, 9 Jun 2009 09:14:28 +0200
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>
References: <20090608210327.GV6911@ronin.4ever.de>
	<483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>
Message-ID: <20090609071427.GW6911@ronin.4ever.de>

Re everyone and thank you for the input.

The "speed unknown" hadn't revealed itself to me _but_ I cannot
make it go away. The interface does not understand the "speed"
command:

rt(config-if)#speed ?
% Unrecognized command


The duplex does of course match on both sides - I did not see any
collision or late collision errors. The router i/f doesn't seem
capable of any kind of negotiation, at least there's no matching
command except for, maybe, "no duplex"...


I also get this from time to time:

*Jun  9 06:44:18: %SYS-3-CPUHOG: Task is running for (2004)msecs, more than (2000)msecs (0/0),process = Exec.
-Traceback= 0x608FAE9C 0x608FACB0 0x6015BA10 0x60162FC0 0x6016001C 0x6087A44C 0x60879ABC 0x6086F7A4 0x607FDF2C 0x6081BDD8 0x608BEFCC 0x608BEFB0


I wonder whether the interface is really broken (and I should
return it), or whether it's supposed to (not) work that way.

Yours,
	Elmar.

PS: Although my WS worked fine on that cable and switchport, I'll
    go swap the cable next.

PPS: IOSes tried are 12.3(14)T3 and 12.4(12)a.

From gert at greenie.muc.de  Tue Jun  9 03:20:46 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Tue, 9 Jun 2009 09:20:46 +0200
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>
References: <20090603071609.GY290@greenie.muc.de>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>
Message-ID: <20090609072046.GR290@greenie.muc.de>

Hi,

On Mon, Jun 08, 2009 at 09:39:08PM -0500, Frank Bulk - iName.com wrote:
> Have you tried the SNMP approach?

What is "the SNMP approach"?

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090609/a03def86/attachment.bin>

From mark.r.zipp at gmail.com  Tue Jun  9 03:26:31 2009
From: mark.r.zipp at gmail.com (Mark Zipp)
Date: Tue, 9 Jun 2009 16:56:31 +0930
Subject: [c-nsp] Non-Cisco SFPs (i.e. Finisar) in TwinGig modules on a 4900M?
Message-ID: <a9a0929d0906090026y67b4234bg1eaf61eb5d5e5ee@mail.gmail.com>

Hi,

Does anybody know if the 'service unsupported-transceiver' command is
supported on the 4900Ms? We're intending to use Finisar 1000BaseLX
SFPs.

Thanks,
Mark.

From elmi at 4ever.de  Tue Jun  9 03:28:11 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Tue, 9 Jun 2009 09:28:11 +0200
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>
References: <20090608210327.GV6911@ronin.4ever.de>
	<483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>
Message-ID: <20090609072811.GY6911@ronin.4ever.de>

I have an update on this one...

I powered off the router (in order to put a Wattmeter in between),
and while I was at it, I thought "hell, pull and push the card
back in again" which I did.

Well, I don't know why, but this worked, the card sees a speed
now and seems to work.

Thank you all for your kind responses and help!

Elmar.

From p.mayers at imperial.ac.uk  Tue Jun  9 04:33:38 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Tue, 09 Jun 2009 09:33:38 +0100
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <20090609072046.GR290@greenie.muc.de>
References: <20090603071609.GY290@greenie.muc.de>	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>
	<20090609072046.GR290@greenie.muc.de>
Message-ID: <4A2E1E62.8020301@imperial.ac.uk>

Gert Doering wrote:
> Hi,
> 
> On Mon, Jun 08, 2009 at 09:39:08PM -0500, Frank Bulk - iName.com wrote:
>> Have you tried the SNMP approach?
> 
> What is "the SNMP approach"?

You can use SNMP to close the TCP connection. Our local docs reckon:

snmpwalk -c READCOMM -v 2c ROUTER .1.3.6.1.2.1.6.13.1.1

...to get a list of connections, then:

snmpset -c WRITECOMM -v 2c ROUTER 
.1.3.6.1.2.1.6.13.1.1.locip.locport.remip.remport integer 12


From sam_mailinglists at spacething.org  Tue Jun  9 07:12:32 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Tue, 09 Jun 2009 12:12:32 +0100
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A23F37A.60008@spacething.org>
References: <4A23F37A.60008@spacething.org>
Message-ID: <4A2E43A0.2050306@spacething.org>

All,

I had some feedback from people that have tried it in the lab, but not 
in production yet.

I notice that in all the Cisco marketing material it talks repeatedly 
about how the guest's security profile will migrate with the VM. 
However, as far as I can tell NX-OS only offers non-stateful ACLs and no 
inspection so I'm not sure it's really that useful?

Sam

Sam Stickland wrote:
> Hi,
>
> Has anyone here deployed the Nexus V1000? I'm interested in feedback 
> (good, back or indifferent).
>
> Thanks,
>
> Sam
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From shinejoseph at dodo.com.au  Tue Jun  9 07:00:52 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Tue, 9 Jun 2009 19:00:52 +0800
Subject: [c-nsp] Policy Based Routing on Cisco 6500
Message-ID: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>

Hi,

I am wondering if there any performance issue with using PBR on a Cisco 6500 with Sup720?

Any pointers and suggestions are most appreciated.

Thanks in advance,

Shine

From cisco-nsp at ml.karotte.org  Tue Jun  9 07:11:09 2009
From: cisco-nsp at ml.karotte.org (Sebastian Wiesinger)
Date: Tue, 9 Jun 2009 13:11:09 +0200
Subject: [c-nsp] Non-Cisco SFPs (i.e. Finisar) in TwinGig modules on a
	4900M?
In-Reply-To: <a9a0929d0906090026y67b4234bg1eaf61eb5d5e5ee@mail.gmail.com>
References: <a9a0929d0906090026y67b4234bg1eaf61eb5d5e5ee@mail.gmail.com>
Message-ID: <20090609111109.GA22755@danton.fire-world.de>

* Mark Zipp <mark.r.zipp at gmail.com> [2009-06-09 09:33]:
> Hi,
> 
> Does anybody know if the 'service unsupported-transceiver' command is
> supported on the 4900Ms? We're intending to use Finisar 1000BaseLX
> SFPs.

I can confirm this:

NAME: "Converter 3/2", DESCR: "Converter Module"
PID: CVR-X2-SFP        , VID: V01  , SN: CAT111058P7

NAME: "GigabitEthernet3/11", DESCR: "1000BaseSX"
PID: Unspecified       , VID:      , SN: FNS11172H80

Don't forget to use

hw-module module X port-group Y select gigabitethernet

or you'll get some not-so-helpful errors (in older IOS versions).

-- 
GPG Key-ID: 0x76B79F20 (0x1B6034F476B79F20)
'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE.
            -- Terry Pratchett, The Fifth Elephant

From rdobbins at arbor.net  Tue Jun  9 07:54:32 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Tue, 9 Jun 2009 18:54:32 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2E43A0.2050306@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
Message-ID: <DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>


On Jun 9, 2009, at 6:12 PM, Sam Stickland wrote:

>  only offers non-stateful ACLs and no inspection so I'm not sure  
> it's really that useful?

Stateful inspection in front of front-end servers is generally not  
only useless, but counterproductive, as it greatly increases  
susceptibility to DDoS.  Especially with a software-based switch/ 
router/what-have-you.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From rdobbins at arbor.net  Tue Jun  9 08:01:15 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Tue, 9 Jun 2009 19:01:15 +0700
Subject: [c-nsp] Policy Based Routing on Cisco 6500
In-Reply-To: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
References: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
Message-ID: <4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>


On Jun 9, 2009, at 6:00 PM, Shine Joseph wrote:

> I am wondering if there any performance issue with using PBR on a  
> Cisco 6500 with Sup720?

I think (correction welcome) that it only works in hardware based upon  
matching an extended ACL - any attempt to do things like match on  
packet size, etc. results in software switching.

PBR by its nature is operationally brittle and ugly; if there's  
another way to accomplish one's goal, it's generally best to pursue an  
alternate method, if at all possible.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From avayner at cisco.com  Tue Jun  9 08:07:19 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Tue, 9 Jun 2009 14:07:19 +0200
Subject: [c-nsp] Policy Based Routing on Cisco 6500
In-Reply-To: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
References: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7BE31D4@xmb-ams-331.emea.cisco.com>

Shine,

PBR is done in hardware on the 6500. If you have DFC's, it would be done
on the DFC. If not, the central PFC will do it.
You should monitor your TCAM resources, as it may fill it up, and then
traffic would be punted to the CPU - which you want to avoid at all
costs.

Use the "show tcam counts" command.

Take a look here:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/con
figuration/guide/cef.html


Arie 

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Shine Joseph
Sent: Tuesday, June 09, 2009 14:01
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Policy Based Routing on Cisco 6500

Hi,

I am wondering if there any performance issue with using PBR on a Cisco
6500 with Sup720?

Any pointers and suggestions are most appreciated.

Thanks in advance,

Shine
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From rodunn at cisco.com  Tue Jun  9 09:13:11 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Tue, 9 Jun 2009 09:13:11 -0400
Subject: [c-nsp] "sh run" crashes router
In-Reply-To: <00bb01c9e867$0727bc90$157735b0$@com>
References: <00bb01c9e867$0727bc90$157735b0$@com>
Message-ID: <20090609131311.GB14941@rtp-cse-489.cisco.com>

Need:

sh ver
sh stack
and bonus points for a crashinfo file from flash:

Did you try posting the sh stack in the output interpreter on Cisco.com?

Rodney


sh On Mon, Jun 08, 2009 at 02:29:15PM -0400, Richey wrote:
> I am setting up Tacacs+ on all of our far end routers so I can run rancid.
> I have found several 1720s and a 2621 that crash when I log in to them and
> issue the "sh run" command.   They reboot quickly and then I don't have a
> problem with the "sh run" command after the reload.   If I look at the
> output from a "sh ver" I get  System returned to ROM by error - a SegV
> exception, PC 0x8066A150.    This seems to only be a small number of
> routers.  They are in different environments (one is in a server room,
> another on the wall in a warehouse, etc)   The 1700s are running various
> versions of the same image type.    The only thing that they all have in
> common is that it's been months since anyone has logged into the router.
> Is this some bug that comes from long uptimes without any activity at the
> CLI?
> 
>  
> 
> Richey
> 
>  
> 
>  
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From gert at greenie.muc.de  Tue Jun  9 10:39:21 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Tue, 9 Jun 2009 16:39:21 +0200
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2E43A0.2050306@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
Message-ID: <20090609143921.GY290@greenie.muc.de>

Hi,

On Tue, Jun 09, 2009 at 12:12:32PM +0100, Sam Stickland wrote:
> I notice that in all the Cisco marketing material it talks repeatedly 
> about how the guest's security profile will migrate with the VM. 
> However, as far as I can tell NX-OS only offers non-stateful ACLs and no 
> inspection so I'm not sure it's really that useful?

Well, you need to put this in relation to the "standard" VMware switch
- which can't do ACLs, and where nothing whatsoever will migrate but
everything (VLAN setup etc) needs to be properly prepated beforhand 
for VMotion to work...

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090609/2a3200dd/attachment.bin>

From linux.yahoo at gmail.com  Tue Jun  9 11:25:40 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 9 Jun 2009 17:25:40 +0200
Subject: [c-nsp] VPLS & FRR (RSVP Fast Reroute)
Message-ID: <7100ed370906090825u5e4d4d9fiaa8bc568141f19f0@mail.gmail.com>

Hello,

Is it possible to deploy MPLS VPLS by using RSVP instead of LDP?

I need FRR feature ;)

Thanks & Best Regards,
Manu

From tstevens at cisco.com  Tue Jun  9 11:42:36 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Tue, 09 Jun 2009 08:42:36 -0700
Subject: [c-nsp] Policy Based Routing on Cisco 6500
In-Reply-To: <4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>
References: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
	<4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>
Message-ID: <200906091542.n59FgakC013593@sj-core-3.cisco.com>

Correct. See:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/layer3.html#wpmkr1033564

?The Policy Feature Card (PFC) and any 
Distributed Feature Cards (DFCs) provide hardware 
support for policy-based routing (PBR) for 
route-map sequences that use the match ip 
address, set ip next-hop, and ip default next-hop PBR keywords.


HTH,
Tim


At 05:01 AM 6/9/2009, Roland Dobbins proclaimed:

>On Jun 9, 2009, at 6:00 PM, Shine Joseph wrote:
>
> > I am wondering if there any performance issue with using PBR on a
> > Cisco 6500 with Sup720?
>
>I think (correction welcome) that it only works in hardware based upon
>matching an extended ACL - any attempt to do things like match on
>packet size, etc. results in software switching.
>
>PBR by its nature is operationally brittle and ugly; if there's
>another way to accomplish one's goal, it's generally best to pursue an
>alternate method, if at all possible.
>
>-----------------------------------------------------------------------
>Roland Dobbins <rdobbins at arbor.net> // 
><<http://www.arbornetworks.com>http://www.arbornetworks.com>
>
>          Unfortunately, inefficiency scales really well.
>
>                    -- Kevin Lawton
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
><https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at 
><http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From sthaug at nethelp.no  Tue Jun  9 11:51:09 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Tue, 09 Jun 2009 17:51:09 +0200 (CEST)
Subject: [c-nsp] VPLS & FRR (RSVP Fast Reroute)
In-Reply-To: <7100ed370906090825u5e4d4d9fiaa8bc568141f19f0@mail.gmail.com>
References: <7100ed370906090825u5e4d4d9fiaa8bc568141f19f0@mail.gmail.com>
Message-ID: <20090609.175109.74673745.sthaug@nethelp.no>

> Is it possible to deploy MPLS VPLS by using RSVP instead of LDP?
> 
> I need FRR feature ;)

<tongue in cheek> Yes, it's called Juniper. </tongue in cheek>

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From linux.yahoo at gmail.com  Tue Jun  9 11:54:09 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 9 Jun 2009 17:54:09 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>
Message-ID: <7100ed370906090854y681a4828u8eb1a5b96fde6526@mail.gmail.com>

SIP400/SIP600 is 7600 only too

no?

On Thu, Jun 4, 2009 at 5:29 PM, Arie Vayner (avayner) <avayner at cisco.com>wrote:

> Yes, this is true, ES20 is 7600 only (I missed the 6500 angle here ;-) )
>
> We can do VPLS with SIP400 (lower BW) or SIP600 (higher BW).
>
>
>
> BTW, There is also support for MPLSoGRE
>
>
>
> Arie
>
>
>
> From: Marlon Duksa [mailto:mduksa at gmail.com]
> Sent: Thursday, June 04, 2009 17:10
> To: Arie Vayner (avayner)
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
>
>
> Thanks Arie. But ES cards are not supported on Cat6500, no? And also
> VPLS over MPLS on a SIP in Cat6500 - is it supported? If so do you know
> which SIP?
>
> Thanks,
>
> Marlon
>
> On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
> <avayner at cisco.com> wrote:
>
> Marlon,
>
> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
> done in hardware and in distributed forwarding mode.
> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
> the core. Having this card means that again VPLS is done in hardware -
> some functionality is done on the regular DFCs and some on the egress
> core facing module.
>
> Arie
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
> Sent: Thursday, June 04, 2009 02:07
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
> Hi -Does anyone know which cards on Cat6500 support MPLS
> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
> distributed (DFC) forwarding solution?
>
> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
> EoMPLS
> should be no problem, right?
>
> Thanks,
> Marlon
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From linux.yahoo at gmail.com  Tue Jun  9 11:55:16 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 9 Jun 2009 17:55:16 +0200
Subject: [c-nsp] VPLS & FRR (RSVP Fast Reroute)
In-Reply-To: <20090609.175109.74673745.sthaug@nethelp.no>
References: <7100ed370906090825u5e4d4d9fiaa8bc568141f19f0@mail.gmail.com>
	<20090609.175109.74673745.sthaug@nethelp.no>
Message-ID: <7100ed370906090855sef8c88ao51a6121b4d102e71@mail.gmail.com>

i know junos very well thanks ;)

On Tue, Jun 9, 2009 at 5:51 PM, <sthaug at nethelp.no> wrote:

> > Is it possible to deploy MPLS VPLS by using RSVP instead of LDP?
> >
> > I need FRR feature ;)
>
> <tongue in cheek> Yes, it's called Juniper. </tongue in cheek>
>
> Steinar Haug, Nethelp consulting, sthaug at nethelp.no
>

From gert at greenie.muc.de  Tue Jun  9 12:09:00 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Tue, 9 Jun 2009 18:09:00 +0200
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <4A2E1E62.8020301@imperial.ac.uk>
References: <20090603071609.GY290@greenie.muc.de>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>
	<20090609072046.GR290@greenie.muc.de>
	<4A2E1E62.8020301@imperial.ac.uk>
Message-ID: <20090609160900.GZ290@greenie.muc.de>

Hi,

On Tue, Jun 09, 2009 at 09:33:38AM +0100, Phil Mayers wrote:
> Gert Doering wrote:
> >On Mon, Jun 08, 2009 at 09:39:08PM -0500, Frank Bulk - iName.com wrote:
> >>Have you tried the SNMP approach?
> >
> >What is "the SNMP approach"?
> 
> You can use SNMP to close the TCP connection. Our local docs reckon:
> 
> snmpwalk -c READCOMM -v 2c ROUTER .1.3.6.1.2.1.6.13.1.1
> 
> ...to get a list of connections, then:
> 
> snmpset -c WRITECOMM -v 2c ROUTER 
> .1.3.6.1.2.1.6.13.1.1.locip.locport.remip.remport integer 12

Thanks.  Indeed, there *is* a connection, stuck in CLOSEWAIT state.

Knowing what to look for, I can see it with "show tcp" as well, and
can clear it with "clear tcp tcb...".

I'm not sure whether it actually helped anything - now the session is
in "CLOSED" state, the VTY is still stuck, and the TCP session refuses
to "really" go away... :-(

But thanks for the explanation :-)

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090609/869e7fba/attachment.bin>

From avayner at cisco.com  Tue Jun  9 12:23:31 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Tue, 9 Jun 2009 18:23:31 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <7100ed370906090854y681a4828u8eb1a5b96fde6526@mail.gmail.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>
	<7100ed370906090854y681a4828u8eb1a5b96fde6526@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7BE3340@xmb-ams-331.emea.cisco.com>

Not that I am aware of...

 

http://www.cisco.com/en/US/products/hw/switches/ps708/products_relevant_
interfaces_and_modules.html

 

Arie

 

From: Manu Chao [mailto:linux.yahoo at gmail.com] 
Sent: Tuesday, June 09, 2009 18:54
To: Arie Vayner (avayner)
Cc: Marlon Duksa; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

 

SIP400/SIP600 is 7600 only too

 

no?

On Thu, Jun 4, 2009 at 5:29 PM, Arie Vayner (avayner)
<avayner at cisco.com> wrote:

Yes, this is true, ES20 is 7600 only (I missed the 6500 angle here ;-) )

We can do VPLS with SIP400 (lower BW) or SIP600 (higher BW).



BTW, There is also support for MPLSoGRE



Arie



From: Marlon Duksa [mailto:mduksa at gmail.com]
Sent: Thursday, June 04, 2009 17:10
To: Arie Vayner (avayner)
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500




Thanks Arie. But ES cards are not supported on Cat6500, no? And also
VPLS over MPLS on a SIP in Cat6500 - is it supported? If so do you know
which SIP?

Thanks,

Marlon

On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
<avayner at cisco.com> wrote:

Marlon,

If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
done in hardware and in distributed forwarding mode.
For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
the core. Having this card means that again VPLS is done in hardware -
some functionality is done on the regular DFCs and some on the egress
core facing module.

Arie


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
Sent: Thursday, June 04, 2009 02:07
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

Hi -Does anyone know which cards on Cat6500 support MPLS
and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
distributed (DFC) forwarding solution?

I know that Cat6500 is very limited in VPLS support, but IP-VPN and
EoMPLS
should be no problem, right?

Thanks,
Marlon

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 


From ibrahim.abozaid at gmail.com  Tue Jun  9 12:26:18 2009
From: ibrahim.abozaid at gmail.com (Ibrahim Abo Zaid)
Date: Tue, 9 Jun 2009 19:26:18 +0300
Subject: [c-nsp] HSRP and Standby router
Message-ID: <a48927f70906090926l6cf8831bs1ceebe234fa66a19@mail.gmail.com>

Hi All

I was studying some HSRP senario which is little bit different than what
used to work on , we have 2 routers connected with access ports to internal
box which has 2 direct physical layer-2 links to both routers and HSRP is
running between VLAN SVIs on both routers across L2 ether-channel between
them

if physical link to active router fail , the client will ARP stanby router
for MAC of HSRP group IP , my question here is stanby router will answer ARP
requests while it still detect that active router is still alive from HSRP
over etherchannel between them ? and if yes , what MAC address it will
answer with ? the active router owns group vmac address so if standby reply
it will reply with bia address and L2-switch the traffic to active router ?

waiting for opinions and your experience share


best regards
--Ibrahim

From ip at ioshints.info  Tue Jun  9 12:54:09 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Tue, 9 Jun 2009 18:54:09 +0200
Subject: [c-nsp] Policy Based Routing on Cisco 6500
In-Reply-To: <4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>
References: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
	<4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>
Message-ID: <003801c9e922$e98c84b0$0a00000a@nil.si>

> PBR by its nature is operationally brittle and ugly; if 
> there's another way to accomplish one's goal, it's generally 
> best to pursue an alternate method, if at all possible.

Absolutely forcefully agree :) While this is a bit off-topic here's an
example of what you can do with a distance-vector routing protocol:

http://www.nil.com/ipcorner/ScalablePolicyRouting/

MPLS + BGP or MPLS TE can also solve numerous issues for which people tend
to use PBR.

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


From oliver.gorwits at oucs.ox.ac.uk  Tue Jun  9 14:03:32 2009
From: oliver.gorwits at oucs.ox.ac.uk (Oliver Gorwits)
Date: Tue, 09 Jun 2009 19:03:32 +0100
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <4A2CD950.70704@uk.clara.net>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
	<4A2CD950.70704@uk.clara.net>
Message-ID: <4A2EA3F4.60306@oucs.ox.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


David Freedman wrote:
> A newcomer to the 12.4(T) train is "ACL Object Groups"

Some time ago I wrote a couple of Perl modules to help generate
these for FWSM type devices. They might still be useful:

http://search.cpan.org/perldoc?Net::Cisco::ObjectGroup
http://search.cpan.org/perldoc?Net::Cisco::AccessList::Extended


regards,
- --
Oliver Gorwits, Network and Telecommunications Group,
Oxford University Computing Services
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFKLqP02NPq7pwWBt4RAjN3AKDC1qvUvProXTG51b4n46kOz2wx/QCgoubB
q+JGCEb4jUkXrCDV8AeMTAs=
=uFSK
-----END PGP SIGNATURE-----

From tvarriale at comcast.net  Tue Jun  9 13:22:22 2009
From: tvarriale at comcast.net (Tony Varriale)
Date: Tue, 9 Jun 2009 12:22:22 -0500
Subject: [c-nsp] hung vty on SXH3a?
References: <20090603071609.GY290@greenie.muc.de><!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com><20090609072046.GR290@greenie.muc.de><4A2E1E62.8020301@imperial.ac.uk>
	<20090609160900.GZ290@greenie.muc.de>
Message-ID: <C4EA1540E9BA42B0A5CF85A57BBEEDD7@flamdt01>

Odd, I've been seeing similiar problems lately in ASA 8.x code with IPv6 SSH 
connections...when IPv6 isn't enabled.

Maybe the same team writes the management code? :)

tv
----- Original Message ----- 
From: "Gert Doering" <gert at greenie.muc.de>
To: "Phil Mayers" <p.mayers at imperial.ac.uk>
Cc: "Gert Doering" <gert at greenie.muc.de>; <cisco-nsp at puck.nether.net>
Sent: Tuesday, June 09, 2009 11:09 AM
Subject: Re: [c-nsp] hung vty on SXH3a?


> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/ 


From vandry at TZoNE.ORG  Tue Jun  9 13:31:52 2009
From: vandry at TZoNE.ORG (Phil Vandry)
Date: Tue, 9 Jun 2009 13:31:52 -0400
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <1244465167.7701.8.camel@home-desktop>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<1244465167.7701.8.camel@home-desktop>
Message-ID: <20090609173152.GA14962@OZoNE.TZoNE.ORG>

On Mon, Jun 08, 2009 at 07:46:06AM -0500, Bryan Campbell wrote:
> You cannot measure VOIP (sip) jitter using ICMP tools.  You will only

s/sip/RTP/

[snip using Wireshark VoIP analysis]
> If you can't find jitter in this manner, it cannot be found.  If it
> cannot be found, it doesn't exist.

This will be true as long as you are monitoring close to the receiving
end. Otherwise you will miss jitter that is introduced by the network
beyond your monitoring point.

This means you may want to have two monitoring points for bidirectional
voice traffic: one close to each receiving end.

On Mon, Jun 08, 2009 at 10:06:21AM -0400, Eric Van Tol wrote:
> What are the there legal ramifications to this?  While I like to think
> that "it's my network, I'll do what I want to measure its performance",

You could avoid problems by capturing (Wireshark or tcpdump) using a
limited snapshot length. You do not need the payload to perform jitter
analysis so "tcpdump -s 50" might be safer (14 bytes Ethernet + 20 IP +
8 UDP + 8 RTP header).

-Phil

From linux.yahoo at gmail.com  Tue Jun  9 14:39:22 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 9 Jun 2009 20:39:22 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7BE3340@xmb-ams-331.emea.cisco.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>
	<7100ed370906090854y681a4828u8eb1a5b96fde6526@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7BE3340@xmb-ams-331.emea.cisco.com>
Message-ID: <7100ed370906091139n7afa958em4ff1927b9adc907d@mail.gmail.com>

Thanks Arie

On Tue, Jun 9, 2009 at 6:23 PM, Arie Vayner (avayner) <avayner at cisco.com>wrote:

>  Not that I am aware of?
>
>
>
>
> http://www.cisco.com/en/US/products/hw/switches/ps708/products_relevant_interfaces_and_modules.html
>
>
>
> Arie
>
>
>
> *From:* Manu Chao [mailto:linux.yahoo at gmail.com]
> *Sent:* Tuesday, June 09, 2009 18:54
> *To:* Arie Vayner (avayner)
> *Cc:* Marlon Duksa; cisco-nsp at puck.nether.net
>
> *Subject:* Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
>
>
> SIP400/SIP600 is 7600 only too
>
>
>
> no?
>
> On Thu, Jun 4, 2009 at 5:29 PM, Arie Vayner (avayner) <avayner at cisco.com>
> wrote:
>
> Yes, this is true, ES20 is 7600 only (I missed the 6500 angle here ;-) )
>
> We can do VPLS with SIP400 (lower BW) or SIP600 (higher BW).
>
>
>
> BTW, There is also support for MPLSoGRE
>
>
>
> Arie
>
>
>
> From: Marlon Duksa [mailto:mduksa at gmail.com]
> Sent: Thursday, June 04, 2009 17:10
> To: Arie Vayner (avayner)
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
>
>
>
> Thanks Arie. But ES cards are not supported on Cat6500, no? And also
> VPLS over MPLS on a SIP in Cat6500 - is it supported? If so do you know
> which SIP?
>
> Thanks,
>
> Marlon
>
> On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
> <avayner at cisco.com> wrote:
>
> Marlon,
>
> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
> done in hardware and in distributed forwarding mode.
> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
> the core. Having this card means that again VPLS is done in hardware -
> some functionality is done on the regular DFCs and some on the egress
> core facing module.
>
> Arie
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
> Sent: Thursday, June 04, 2009 02:07
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
> Hi -Does anyone know which cards on Cat6500 support MPLS
> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
> distributed (DFC) forwarding solution?
>
> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
> EoMPLS
> should be no problem, right?
>
> Thanks,
> Marlon
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>

From ayourtch at cisco.com  Tue Jun  9 15:16:11 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Tue, 9 Jun 2009 21:16:11 +0200 (CEST)
Subject: [c-nsp] ASA IPv6 SSH Re:  hung vty on SXH3a?
In-Reply-To: <C4EA1540E9BA42B0A5CF85A57BBEEDD7@flamdt01>
References: <20090603071609.GY290@greenie.muc.de><!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com><20090609072046.GR290@greenie.muc.de><4A2E1E62.8020301@imperial.ac.uk>
	<20090609160900.GZ290@greenie.muc.de>
	<C4EA1540E9BA42B0A5CF85A57BBEEDD7@flamdt01>
Message-ID: <Pine.LNX.4.64.0906092111330.3439@zippy.stdio.be>



On Tue, 9 Jun 2009, Tony Varriale wrote:

> Odd, I've been seeing similiar problems lately in ASA 8.x code with IPv6 SSH 
> connections...when IPv6 isn't enabled.
>
> Maybe the same team writes the management code? :)

nope, they are different. :)

If you have more details / case# for the ASA IPv6 SSH issue - please 
unicast the details, let's take a look. (yes, I work in TAC and yes i 
am interested ensure we sort out this IPv6-related issue :)

cheers,
andrew

From mb at adv.gcomm.com.au  Tue Jun  9 19:05:31 2009
From: mb at adv.gcomm.com.au (mb at adv.gcomm.com.au)
Date: Wed, 10 Jun 2009 09:05:31 +1000
Subject: [c-nsp] BGP -> OSPF (Or another way?)
Message-ID: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>

Hi,

We are receiving a /24 from one of our upstreams, that we need to 
redistribute into our IGP (OSPF), so that all of our cores are aware 
that they can reach this /24 primarily through this upstream(Then, if 
this upstream is down, traffic destined to this /24 would go via our 
other upstreams)

I know redistributing bgp->ospf is considered a bad idea, but other 
than adding a static route, is there another option?

Under ospf would it be
redistribute bgp xxx route-map SUBNET_TO_INJECT_FROM_BGP

With the above route maps acl only allowing the /24 we are interested in?

Thanks in advance.

-------------------------------------------------------------------------
This e-mail was sent via GCOMM WebMail http://www.gcomm.com.au/



From mulitskiy at acedsl.com  Tue Jun  9 18:37:06 2009
From: mulitskiy at acedsl.com (Michael Ulitskiy)
Date: Tue, 9 Jun 2009 18:37:06 -0400
Subject: [c-nsp] RTL-8139 NIC in WS-X6348-RJ-45 - no link
Message-ID: <200906091837.06067.mulitskiy@acedsl.com>



From mulitskiy at acedsl.com  Tue Jun  9 18:37:06 2009
From: mulitskiy at acedsl.com (Michael Ulitskiy)
Date: Tue, 9 Jun 2009 18:37:06 -0400
Subject: [c-nsp] RTL-8139 NIC in WS-X6348-RJ-45 - no link
Message-ID: <200906091837.06067.mulitskiy@acedsl.com>

Hello,

I have some very strange problem. 
I have 2 old servers that I still need to support that have RTL-8139 NIC on-board.
For some reason if I connect them to WS-X6348-RJ-45 in 6500 the link doesn't come up whatever I do.
If I connect them to another switch - I tried 3500XL and 8500 - then everything OK and link 
comes up as it should.
Is anyone aware about some kind of incompatibility between Realtek and WS-X6348-RJ-45?
Is there any knob to turn?
Thanks,

Michael

From dale.shaw+cisco-nsp at gmail.com  Tue Jun  9 19:34:22 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Wed, 10 Jun 2009 09:34:22 +1000
Subject: [c-nsp] BGP -> OSPF (Or another way?)
In-Reply-To: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
References: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
Message-ID: <3329cbb40906091634p1a7a8017rdb7e206368ca0ebc@mail.gmail.com>

Hi,

On Wed, Jun 10, 2009 at 9:05 AM, <mb at adv.gcomm.com.au> wrote:
> I know redistributing bgp->ospf is considered a bad idea, but other than
> adding a static route, is there another option?

You could use a 'reliable static' (using IP SLA and the 'track'
keyword on the 'ip route' command) and redistribute that, but I'm not
sure it's any 'better' in this case, as long as you're only ever
redistributing a small number of routes. You could probably get
quicker convergence this way, depending on how connectivity to the
upstream fails.

http://www.cisco.com/en/US/docs/ios/12_3/12_3x/12_3xe/feature/guide/dbackupx.html

Assuming you pursue the BGP -> OSPF redistribution --

> Under ospf would it be
> redistribute bgp xxx route-map SUBNET_TO_INJECT_FROM_BGP

Don't forget the 'subnets' keyword.

> With the above route maps acl only allowing the /24 we are interested in?

Depending on your route-map config, yeah.

ip prefix-list BGP_TO_OSPF permit 192.168.55.0/24
!
route-map SUBNET_TO_INJECT_FROM_BGP
 match ip address prefix BGP_TO_OSPF
!
router ospf 1
 redistribute bgp 12345 subnets route-map SUBNET_TO_INJECT_FROM_BGP

This will inject anything matched in the 'BGP_TO_OSPF' prefix-list
into OSPF as a type-2 external ("O E2") route. This'll turn your BGP
router into an OSPF ASBR, if it's not already. Make sure it's not in a
stub area.

cheers,
Dale

From max.reid at saikonetworks.com  Tue Jun  9 19:41:25 2009
From: max.reid at saikonetworks.com (Maxwell Reid)
Date: Tue, 9 Jun 2009 16:41:25 -0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <20090609143921.GY290@greenie.muc.de>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<20090609143921.GY290@greenie.muc.de>
Message-ID: <8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>


The ACL"s on the vswitch/nexus are only part of the security  
equation.  It's using them in combination with vShield  Zones at the  
ESX level (new feature of v4) that yields the best results.


~Max



On Jun 9, 2009, at 7:39 AM, Gert Doering wrote:

> Hi,
>
> On Tue, Jun 09, 2009 at 12:12:32PM +0100, Sam Stickland wrote:
>> I notice that in all the Cisco marketing material it talks repeatedly
>> about how the guest's security profile will migrate with the VM.
>> However, as far as I can tell NX-OS only offers non-stateful ACLs  
>> and no
>> inspection so I'm not sure it's really that useful?
>
> Well, you need to put this in relation to the "standard" VMware switch
> - which can't do ACLs, and where nothing whatsoever will migrate but
> everything (VLAN setup etc) needs to be properly prepated beforhand
> for VMotion to work...
>
> gert
>
> -- 
> USENET is *not* the non-clickable part of WWW!
>                                                           //www.muc.de/~gert/
> Gert Doering - Munich, Germany                             gert at greenie.muc.de
> fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From Kris.Amy at EIP.net.au  Tue Jun  9 19:43:08 2009
From: Kris.Amy at EIP.net.au (Kris Amy)
Date: Wed, 10 Jun 2009 09:43:08 +1000
Subject: [c-nsp] BGP -> OSPF (Or another way?)
In-Reply-To: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
Message-ID: <C65530AD.3F126%kris.amy@eip.net.au>

You could run iBGP from your borders into your core.


On 10/06/09 9:05 AM, "mb at adv.gcomm.com.au" <mb at adv.gcomm.com.au> wrote:

Hi,

We are receiving a /24 from one of our upstreams, that we need to
redistribute into our IGP (OSPF), so that all of our cores are aware
that they can reach this /24 primarily through this upstream(Then, if
this upstream is down, traffic destined to this /24 would go via our
other upstreams)

I know redistributing bgp->ospf is considered a bad idea, but other
than adding a static route, is there another option?

Under ospf would it be
redistribute bgp xxx route-map SUBNET_TO_INJECT_FROM_BGP

With the above route maps acl only allowing the /24 we are interested in?

Thanks in advance.

-------------------------------------------------------------------------
This e-mail was sent via GCOMM WebMail http://www.gcomm.com.au/


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


--
Kind Regards,
Kris Amy
Enterprise IP
Phone:    07 3123 5510
National: 1300 347 287
Fax:      1300 347 329
Direct:   07 3123 5511
Email:    kris.amy at eip.net.au

From rdobbins at arbor.net  Tue Jun  9 20:00:36 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 10 Jun 2009 07:00:36 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<20090609143921.GY290@greenie.muc.de>
	<8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>
Message-ID: <7B1AB359-3C4C-49C4-B566-54056F489D46@arbor.net>


On Jun 10, 2009, at 6:41 AM, Maxwell Reid wrote:

>  It's using them in combination with vShield  Zones at the ESX level  
> (new feature of v4) that yields the best results.

It's also important to note that all of this runs in software, and is  
thus subject to the performance limitations thereof.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From mark.r.zipp at gmail.com  Tue Jun  9 21:16:32 2009
From: mark.r.zipp at gmail.com (Mark Zipp)
Date: Wed, 10 Jun 2009 10:46:32 +0930
Subject: [c-nsp] Non-Cisco SFPs (i.e. Finisar) in TwinGig modules on a
	4900M?
In-Reply-To: <20090609111109.GA22755@danton.fire-world.de>
References: <a9a0929d0906090026y67b4234bg1eaf61eb5d5e5ee@mail.gmail.com>
	<20090609111109.GA22755@danton.fire-world.de>
Message-ID: <a9a0929d0906091816o38b7f78bka0cc8f4b72cab3f3@mail.gmail.com>

Hi Sebastian,

2009/6/9 Sebastian Wiesinger <cisco-nsp at ml.karotte.org>:
> * Mark Zipp <mark.r.zipp at gmail.com> [2009-06-09 09:33]:
>> Hi,
>>
>> Does anybody know if the 'service unsupported-transceiver' command is
>> supported on the 4900Ms? We're intending to use Finisar 1000BaseLX
>> SFPs.
>
> I can confirm this:
>
> NAME: "Converter 3/2", DESCR: "Converter Module"
> PID: CVR-X2-SFP ? ? ? ?, VID: V01 ?, SN: CAT111058P7
>
> NAME: "GigabitEthernet3/11", DESCR: "1000BaseSX"
> PID: Unspecified ? ? ? , VID: ? ? ?, SN: FNS11172H80
>
> Don't forget to use
>
> hw-module module X port-group Y select gigabitethernet
>
> or you'll get some not-so-helpful errors (in older IOS versions).
>

Thanks very much for that info - it'll save us $000s!

Regards,
Mark.

> --
> GPG Key-ID: 0x76B79F20 (0x1B6034F476B79F20)
> 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE.
> ? ? ? ? ? ?-- Terry Pratchett, The Fifth Elephant
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From mksmith at adhost.com  Tue Jun  9 21:58:15 2009
From: mksmith at adhost.com (Michael K. Smith)
Date: Tue, 09 Jun 2009 18:58:15 -0700
Subject: [c-nsp] BGP -> OSPF (Or another way?)
In-Reply-To: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
Message-ID: <C6546147.7ADD6%mksmith@adhost.com>




On 6/9/09 4:05 PM, "mb at adv.gcomm.com.au" <mb at adv.gcomm.com.au> wrote:

> Hi,
> 
> We are receiving a /24 from one of our upstreams, that we need to
> redistribute into our IGP (OSPF), so that all of our cores are aware
> that they can reach this /24 primarily through this upstream(Then, if
> this upstream is down, traffic destined to this /24 would go via our
> other upstreams)
> 
> I know redistributing bgp->ospf is considered a bad idea, but other
> than adding a static route, is there another option?
> 
> Under ospf would it be
> redistribute bgp xxx route-map SUBNET_TO_INJECT_FROM_BGP
> 
> With the above route maps acl only allowing the /24 we are interested in?
> 

I think, as Kris said, you should be running iBGP to distribute external
routes through your network.  This keeps the two processes and associated
routes nicely separated.

Setting up an iBGP mesh should be as easy as a single network statement on
each of your connected devices towards every other (unless you want to use
route reflectors).

Regards,

Mike


From Skeeve at eintellego.net  Tue Jun  9 22:22:25 2009
From: Skeeve at eintellego.net (Skeeve Stevens)
Date: Wed, 10 Jun 2009 12:22:25 +1000
Subject: [c-nsp] PA-GE GBIC-T Support?
Message-ID: <292AF25E62B8894C921B893B53A19D97394469E479@BUSINESSEX.business.ad>

Does anyone know if the GBIC-T is officially supported in the PA-GE (for 7200's).

We're actually running these in a dozen routers but until the other day have never noticed it saying:

GigabitEthernet2/0 is up, line protocol is up
  Hardware is WISEMAN, address is 0005.5f23.b41c (bia 0005.5f23.b438)
...
  Full-duplex, 1000Mb/s, link type is autonegotiation, media type is unknown media type

But... it is fully working, and has been since it was installed with no errors.

This page: http://www.cisco.com/en/US/products/hw/modules/ps2033/products_data_sheet09186a0080091ce7.html

Only mentions:
1000Base-SX
1000Base-LX/LH
1000Base-ZX

This may or may not be an old page, but the GBIC-T is not mentioned anywhere, but maybe importantly, does not say that it "isn't" supported.

My googling for any commentary on the PA-GE with GBIC-T has resulted in nothing.

Thoughts anyone?

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
--
NOC, NOC, who's there?

Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.


From clinton at scripty.com  Tue Jun  9 23:38:01 2009
From: clinton at scripty.com (Clinton Work)
Date: Tue, 09 Jun 2009 21:38:01 -0600
Subject: [c-nsp] PA-GE GBIC-T Support?
In-Reply-To: <292AF25E62B8894C921B893B53A19D97394469E479@BUSINESSEX.business.ad>
References: <292AF25E62B8894C921B893B53A19D97394469E479@BUSINESSEX.business.ad>
Message-ID: <4A2F2A99.8010803@scripty.com>


The topic has been discussed before.  Sounds like it works, but isn't 
officially supported. 

http://markmail.org/message/ozlmnboj6ytph4tq

Skeeve Stevens wrote:
> Does anyone know if the GBIC-T is officially supported in the PA-GE (for 7200's).
>
> We're actually running these in a dozen routers but until the other day have never noticed it saying:
>
> GigabitEthernet2/0 is up, line protocol is up
>
>   


-- 
==================================================================
Clinton Work
Airdrie, AB



From achatz at forthnet.gr  Wed Jun 10 04:10:01 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 10 Jun 2009 11:10:01 +0300
Subject: [c-nsp] Inter-AS EoMPLS/VPLS
Message-ID: <4A2F6A59.2000100@forthnet.gr>

Does anyone have any experience?

I can see it's supported only on IOS-XR, so 7600 it's out of the question (any plans?).
http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.7/mpls/configuration/guide/gc37v2.html#wp1100339

-- 
Tassos

From ibrahim.abozaid at gmail.com  Wed Jun 10 04:30:05 2009
From: ibrahim.abozaid at gmail.com (Ibrahim Abo Zaid)
Date: Wed, 10 Jun 2009 11:30:05 +0300
Subject: [c-nsp] HSRP and Standby router
Message-ID: <a48927f70906100130r757e387fj5a8e4c95c35421ce@mail.gmail.com>

Hi All

I was studying some HSRP senario which is little bit different than what
used to work on , we have 2 routers connected with access ports to internal
box which has 2 direct physical layer-2 links to both routers and HSRP is
running between VLAN SVIs on both routers across L2 ether-channel between
them

if physical link to active router fail , the client will ARP stanby router
for MAC of HSRP group IP , my question here is stanby router will answer ARP
requests while it still detect that active router is still alive from HSRP
over etherchannel between them ? and if yes , what MAC address it will
answer with ? the active router owns group vmac address so if standby reply
it will reply with bia address and L2-switch the traffic to active router ?

waiting for opinions and your experience share


best regards
--Ibrahim

From llc at dansketelecom.com  Wed Jun 10 04:34:51 2009
From: llc at dansketelecom.com (Lars Lystrup Christensen)
Date: Wed, 10 Jun 2009 10:34:51 +0200
Subject: [c-nsp] Inter-AS EoMPLS/VPLS
In-Reply-To: <4A2F6A59.2000100@forthnet.gr>
References: <4A2F6A59.2000100@forthnet.gr>
Message-ID: <44417CD2F19FEA4F885088340A71D33201F0E6FD@mail.office.dansketelecom.com>

Hi Tassos,

You could do inter-AS EoMPLS by using Pseudo Wire stitching/switching, which is supporte don 12.2(33)SRC on the 7600.

It's done as a kind of VPLS domain, however it can only handle one neighbour.

______________________________________

Med venlig hilsen / Kind regards

Lars Lystrup Christensen 
Director of Engineering, CCIE(tm) #20292

Danske Telecom A/S
Sundkrogsgade 13, 4 
2100 K?benhavn ? 


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Tassos Chatzithomaoglou
Sent: 10. juni 2009 10:10
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Inter-AS EoMPLS/VPLS

Does anyone have any experience?

I can see it's supported only on IOS-XR, so 7600 it's out of the question (any plans?).
http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.7/mpls/configuration/guide/gc37v2.html#wp1100339

-- 
Tassos
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From sam_mailinglists at spacething.org  Wed Jun 10 05:56:46 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Wed, 10 Jun 2009 10:56:46 +0100
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
Message-ID: <4A2F835E.1090204@spacething.org>


From rdobbins at arbor.net  Wed Jun 10 06:12:48 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 10 Jun 2009 17:12:48 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2F835E.1090204@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
	<4A2F835E.1090204@spacething.org>
Message-ID: <0BABBA46-C1B8-40B2-B1A3-95F69BD458A8@arbor.net>



From rdobbins at arbor.net  Wed Jun 10 06:34:04 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 10 Jun 2009 17:34:04 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2F8AEE.4010904@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
	<4A2F835E.1090204@spacething.org> <4A2F8AEE.4010904@spacething.org>
Message-ID: <1F20BA2C-C258-4ABF-A626-415B17B7A4A9@arbor.net>



From sam_mailinglists at spacething.org  Wed Jun 10 06:29:02 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Wed, 10 Jun 2009 11:29:02 +0100
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2F835E.1090204@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
	<4A2F835E.1090204@spacething.org>
Message-ID: <4A2F8AEE.4010904@spacething.org>


From snar at snar.spb.ru  Wed Jun 10 05:11:59 2009
From: snar at snar.spb.ru (Alexandre Snarskii)
Date: Wed, 10 Jun 2009 13:11:59 +0400
Subject: [c-nsp] Inter-AS EoMPLS/VPLS
In-Reply-To: <4A2F6A59.2000100@forthnet.gr>
References: <4A2F6A59.2000100@forthnet.gr>
Message-ID: <20090610091159.GA73066@snar.spb.ru>



From j.varaillon at cosmoline.com  Wed Jun 10 05:30:05 2009
From: j.varaillon at cosmoline.com (Varaillon Jean Christophe)
Date: Wed, 10 Jun 2009 12:30:05 +0300
Subject: [c-nsp] BGP -> OSPF (Or another way?)
In-Reply-To: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
References: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
Message-ID: <011701c9e9ae$0a20c1b0$1e624510$%varaillon@cosmoline.com>



From peter at rathlev.dk  Wed Jun 10 07:26:31 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Wed, 10 Jun 2009 13:26:31 +0200
Subject: [c-nsp] HSRP and Standby router
In-Reply-To: <a48927f70906100130r757e387fj5a8e4c95c35421ce@mail.gmail.com>
References: <a48927f70906100130r757e387fj5a8e4c95c35421ce@mail.gmail.com>
Message-ID: <1244633191.6034.13.camel@localhost.localdomain>

On Wed, 2009-06-10 at 11:30 +0300, Ibrahim Abo Zaid wrote:
> I was studying some HSRP senario which is little bit different than
> what used to work on , we have 2 routers connected with access ports
> to internal box which has 2 direct physical layer-2 links to both
> routers and HSRP is running between VLAN SVIs on both routers across
> L2 ether-channel between them
> 
> if physical link to active router fail , the client will ARP stanby
> router for MAC of HSRP group IP , my question here is stanby router
> will answer ARP requests while it still detect that active router is
> still alive from HSRP over etherchannel between them ? and if yes ,
> what MAC address it will answer with ? the active router owns group
> vmac address so if standby reply it will reply with bia address and
> L2-switch the traffic to active router ?

Assuming that the routers bridge the access connection and the
connection between them, thus forming a triangular bridge domain, then
if only one physical access link fails and the connection between the
routers is still active the HSRP role will not move between the two
routers. As long as they can see each other somehow the HSRP is stable.

This is effectively a ring topology where any one link may fail without
impacting the forwarding ability. The spanning tree might need to be
recalculated, so it might introduce a short-ish pause.

Traffic from access towards the HSRP standby IP might be switched
through the inactive HSRP member, and this might not be the most
effective way of switching, maybe introducing congestion, but traffic
would still end up in the right place.

OTOH if the two routers lose L2 contact they will both go active.
(Though if the router has no active ports in the VLAN the SVI should go
"line protocol down" and not try to participate in HSRP.) You can expect
loss of connectivity towards the gateway for a full HSRP hold-time
interval, default 10 seconds. AFAIK the standby HSRP unit will not
answer ARP queries in this period.

ARP entries need not be updated since the MAC address of the standby IP
address stays the same.

A topology change notification, sent out when there are changes in the
physical topology, will flush all MAC address tables, helping this part
of the convergence.

I may not have understood your question completely though. :-)

-- 
Peter Rathlev



From peter at rathlev.dk  Wed Jun 10 09:52:13 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Wed, 10 Jun 2009 15:52:13 +0200
Subject: [c-nsp] 3750E and X2-10GB-ZR compatibility?
Message-ID: <1244641933.7592.25.camel@localhost.localdomain>

Just a quick question: The 3750E doesn't support X2-10GB-ZR
tranceivers[1], only up to ER. Using "service unsupported-transceiver" I
can get the switch to recognize the transceiver, but will I be able to
get a link with it?

It's for testing part of a fiber stretch, so it's not for production.
Does anybody have any experience that can confirm or deny any of the
following:

- Could it damage the transceiver?
- Could it damage the switch?
- Would I be able to get link up with it? (The other end is a similar
transceiver in a WS-X6708-10GE-3C module.)
- If I got link up, could I trust this to generally work?

The problem is that the last part of the stretch isn't finished yet, and
it's a little much to carry around a 6506 chassis for testing purposes.

(We have OTDR btw, just want to do a "live" test.)

Thanks in advance.

-- 
Peter Rathlev

[1]: http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modu
les/compatibility/matrix/OL_6974.html#wp48759
(http://tinyurl.com/yooxks)



From max.reid at saikonetworks.com  Wed Jun 10 10:32:31 2009
From: max.reid at saikonetworks.com (Maxwell Reid)
Date: Wed, 10 Jun 2009 07:32:31 -0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <7B1AB359-3C4C-49C4-B566-54056F489D46@arbor.net>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<20090609143921.GY290@greenie.muc.de>
	<8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>
	<7B1AB359-3C4C-49C4-B566-54056F489D46@arbor.net>
Message-ID: <ABC850B9-F3AB-4249-ABA3-49F7C241F63E@saikonetworks.com>


On Jun 9, 2009, at 5:00 PM, Roland Dobbins wrote:

>
> On Jun 10, 2009, at 6:41 AM, Maxwell Reid wrote:
>
>> It's using them in combination with vShield  Zones at the ESX level  
>> (new feature of v4) that yields the best results.
>
> It's also important to note that all of this runs in software, and  
> is thus subject to the performance limitations thereof.



When you're talking about a box with 16-32 3 Ghz Cores and 128 GBs of  
ram with offloading NIC/CNA's that "software" is pretty speedy.   A  
single host running 3 vms can go  as high as 350,000 IOPs/sec from a  
storage perspective, and handle high PPS loads w/ 10GbE at line rate.   
Even "hardware" appliances like the ASA boot strap off what appears to  
be KVM and handle multiple contexts in software; and you really only  
need specialized ASIC's as part of the forwarding plane of high end  
routers.


~Max










>
>
> -----------------------------------------------------------------------
> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>
>        Unfortunately, inefficiency scales really well.
>
> 		   -- Kevin Lawton
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From jcposeidon at cantv.net  Wed Jun 10 11:33:33 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 10 Jun 2009 11:03:33 -0430
Subject: [c-nsp] Cisco DSLAM ?
Message-ID: <4A2FD24D.2060703@cantv.net>

Guys

Does anyone of you knows a good DSLAM for HDSL & ADSL ?

Thanks

From paul at paulstewart.org  Wed Jun 10 12:28:51 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 10 Jun 2009 12:28:51 -0400
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <4A2FD24D.2060703@cantv.net>
References: <4A2FD24D.2060703@cantv.net>
Message-ID: <000001c9e9e8$8abbfcb0$a033f610$@org>

Occam... ;)

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo R.
Sent: Wednesday, June 10, 2009 11:34 AM
To: Cisco Post NSP
Cc: cisco-nsp at puck.nether.net
Subject: [c-nsp] Cisco DSLAM ?

Guys

Does anyone of you knows a good DSLAM for HDSL & ADSL ?

Thanks
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From panocisco77 at gmail.com  Wed Jun 10 12:40:48 2009
From: panocisco77 at gmail.com (Renelson Panosky)
Date: Wed, 10 Jun 2009 12:40:48 -0400
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
Message-ID: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com>

I Have a brand new 6509-E with WS-SUP32-GE-3B booting up in rommon> mode i
was able to type the command boot so it can look for the right code to boot
up but after i configured the switch i turned off and turned it back on,  it
boot up in rommon mode again and everything was lost.  I know someone had
upgraded the IOS and i am sure that's what causing the problem and i know
there is command i can type to fix the problem but i can't remember it or
find it on the web can someone please help me out with this ?

Renelson

From avayner at cisco.com  Wed Jun 10 12:46:17 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Wed, 10 Jun 2009 18:46:17 +0200
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <4A2FD24D.2060703@cantv.net>
References: <4A2FD24D.2060703@cantv.net>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>

Juan,

Cisco does not make DSLAMs for a long time now...

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo
R.
Sent: Wednesday, June 10, 2009 18:34
To: Cisco Post NSP
Cc: cisco-nsp at puck.nether.net
Subject: [c-nsp] Cisco DSLAM ?

Guys

Does anyone of you knows a good DSLAM for HDSL & ADSL ?

Thanks
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From avayner at cisco.com  Wed Jun 10 12:50:31 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Wed, 10 Jun 2009 18:50:31 +0200
Subject: [c-nsp] HSRP and Standby router
In-Reply-To: <1244633191.6034.13.camel@localhost.localdomain>
References: <a48927f70906100130r757e387fj5a8e4c95c35421ce@mail.gmail.com>
	<1244633191.6034.13.camel@localhost.localdomain>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C48BFA@xmb-ams-331.emea.cisco.com>

I think this document can provide more insight:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DC_Infr
a2_5/DCInfra_6.html

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Rathlev
Sent: Wednesday, June 10, 2009 14:27
To: Ibrahim Abo Zaid
Cc: cisco at groupstudy.com; cisco_nsp
Subject: Re: [c-nsp] HSRP and Standby router

On Wed, 2009-06-10 at 11:30 +0300, Ibrahim Abo Zaid wrote:
> I was studying some HSRP senario which is little bit different than
> what used to work on , we have 2 routers connected with access ports
> to internal box which has 2 direct physical layer-2 links to both
> routers and HSRP is running between VLAN SVIs on both routers across
> L2 ether-channel between them
> 
> if physical link to active router fail , the client will ARP stanby
> router for MAC of HSRP group IP , my question here is stanby router
> will answer ARP requests while it still detect that active router is
> still alive from HSRP over etherchannel between them ? and if yes ,
> what MAC address it will answer with ? the active router owns group
> vmac address so if standby reply it will reply with bia address and
> L2-switch the traffic to active router ?

Assuming that the routers bridge the access connection and the
connection between them, thus forming a triangular bridge domain, then
if only one physical access link fails and the connection between the
routers is still active the HSRP role will not move between the two
routers. As long as they can see each other somehow the HSRP is stable.

This is effectively a ring topology where any one link may fail without
impacting the forwarding ability. The spanning tree might need to be
recalculated, so it might introduce a short-ish pause.

Traffic from access towards the HSRP standby IP might be switched
through the inactive HSRP member, and this might not be the most
effective way of switching, maybe introducing congestion, but traffic
would still end up in the right place.

OTOH if the two routers lose L2 contact they will both go active.
(Though if the router has no active ports in the VLAN the SVI should go
"line protocol down" and not try to participate in HSRP.) You can expect
loss of connectivity towards the gateway for a full HSRP hold-time
interval, default 10 seconds. AFAIK the standby HSRP unit will not
answer ARP queries in this period.

ARP entries need not be updated since the MAC address of the standby IP
address stays the same.

A topology change notification, sent out when there are changes in the
physical topology, will flush all MAC address tables, helping this part
of the convergence.

I may not have understood your question completely though. :-)

-- 
Peter Rathlev


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From aaron at wsc.ma.edu  Wed Jun 10 13:24:34 2009
From: aaron at wsc.ma.edu (Childs, Aaron)
Date: Wed, 10 Jun 2009 13:24:34 -0400
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
In-Reply-To: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com>
References: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com>
Message-ID: <3760B7E1B344364AA0384B231FE7BA6901BBF92B31@ex-be1.ads.wsc.ma.edu>

Hi Renelson,
  What's the configuration register set to? (sh boot) once you're in IOS.  0x0 will bring you to rommon everytime, 0x2102 will boot the sup using the config file.

Aaron

-------------
Aaron Childs
Assistant Director, Networking
Westfield State College
http://www.wsc.ma.edu/it/


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Renelson Panosky
Sent: Wednesday, June 10, 2009 12:41 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B

I Have a brand new 6509-E with WS-SUP32-GE-3B booting up in rommon> mode i
was able to type the command boot so it can look for the right code to boot
up but after i configured the switch i turned off and turned it back on,  it
boot up in rommon mode again and everything was lost.  I know someone had
upgraded the IOS and i am sure that's what causing the problem and i know
there is command i can type to fix the problem but i can't remember it or
find it on the web can someone please help me out with this ?

Renelson
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From paul at paulstewart.org  Wed Jun 10 13:25:01 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 10 Jun 2009 13:25:01 -0400
Subject: [c-nsp] IPTV Switch Recommendation
Message-ID: <000801c9e9f0$638170a0$2a8451e0$@org>

Hi there.

 

We have a customer that does lots of IPTV - they have a new deployment
currently going into an MDU (condos).  They have asked for a recommended
switch that is "IPTV friendly" - I'm presuming they mean multicast aware
etc.  

 

Which Cisco switches would be recommended to handoff approximately 20 Cat5
drops fed by fiber coming in?

 

Cheers,

 

Paul

 

 

 


From masood at nexlinx.net.pk  Wed Jun 10 14:29:51 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Wed, 10 Jun 2009 23:29:51 +0500 (PKT)
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
References: <4A2FD24D.2060703@cantv.net>
	<78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
Message-ID: <27388.196.46.241.57.1244658591.squirrel@nexmail1.nexlinx.net.pk>

Yup Cisco does not make DSLAMs anymore. I think paradyne guys are doing
great job in fact.

http://www.paradyne.com/

Regards,
Masood

> Juan,
>
> Cisco does not make DSLAMs for a long time now...
>
> Arie
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo
> R.
> Sent: Wednesday, June 10, 2009 18:34
> To: Cisco Post NSP
> Cc: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco DSLAM ?
>
> Guys
>
> Does anyone of you knows a good DSLAM for HDSL & ADSL ?
>
> Thanks
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From swmike at swm.pp.se  Wed Jun 10 13:56:51 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Wed, 10 Jun 2009 19:56:51 +0200 (CEST)
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <000801c9e9f0$638170a0$2a8451e0$@org>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
Message-ID: <alpine.DEB.1.10.0906101956050.22851@uplift.swm.pp.se>

On Wed, 10 Jun 2009, Paul Stewart wrote:

> Which Cisco switches would be recommended to handoff approximately 20 
> Cat5 drops fed by fiber coming in?

3560/3750 seems to work well for this.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From ed at edgeoc.net  Wed Jun 10 14:00:41 2009
From: ed at edgeoc.net (Edward Salonia)
Date: Wed, 10 Jun 2009 18:00:41 +0000
Subject: [c-nsp] IPTV Switch Recommendation
Message-ID: <900802754-1244656846-cardhu_decombobulator_blackberry.rim.net-62317833-@bxe1048.bisx.prod.on.blackberry>

Take a look at the ME3400 series.

- Ed

------Original Message------
From: Paul Stewart
Sender: cisco-nsp-bounces at puck.nether.net
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] IPTV Switch Recommendation
Sent: Jun 10, 2009 1:25 PM

Hi there.

 

We have a customer that does lots of IPTV - they have a new deployment
currently going into an MDU (condos).  They have asked for a recommended
switch that is "IPTV friendly" - I'm presuming they mean multicast aware
etc.  

 

Which Cisco switches would be recommended to handoff approximately 20 Cat5
drops fed by fiber coming in?

 

Cheers,

 

Paul

 

 

 

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From savage at savage.za.org  Wed Jun 10 14:09:37 2009
From: savage at savage.za.org (Chris Knipe)
Date: Wed, 10 Jun 2009 20:09:37 +0200
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <000801c9e9f0$638170a0$2a8451e0$@org>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
Message-ID: <20090610180937.GA27437@fusion.opticnetworks.net>

On 10/06/09 13:25 -0400, Paul Stewart wrote:

>We have a customer that does lots of IPTV - they have a new deployment
>currently going into an MDU (condos).  They have asked for a recommended
>switch that is "IPTV friendly" - I'm presuming they mean multicast aware
>etc.  
>
>Which Cisco switches would be recommended to handoff approximately 20 Cat5
>drops fed by fiber coming in?


We're going through the same story at this stage.  Working with allot of 
vendors, testing, and trails.  So far for us, a combination of entry
level 2960s and 3560s are working fine.  You are correct, the most
important thing is Multicast and IGMP subscriptions, so pretty much
any half decent switch would be capable.

Ciscos naturally just work best for us though because we love them so 
much.

--
Chris.


From jeff-kell at utc.edu  Wed Jun 10 14:27:17 2009
From: jeff-kell at utc.edu (Jeff Kell)
Date: Wed, 10 Jun 2009 14:27:17 -0400
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <20090610180937.GA27437@fusion.opticnetworks.net>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
	<20090610180937.GA27437@fusion.opticnetworks.net>
Message-ID: <4A2FFB05.1050709@utc.edu>

Chris Knipe wrote:
> We're going through the same story at this stage.  Working with allot
> of vendors, testing, and trails.  So far for us, a combination of entry
> level 2960s and 3560s are working fine.  You are correct, the most
> important thing is Multicast and IGMP subscriptions, so pretty much
> any half decent switch would be capable. 

Reminds me... do you need the "LAN Base" version to make it fly, or will
"LAN Lite" work?

(or for the 3560s, IP Base or IP Services?)

Jeff

From savage at savage.za.org  Wed Jun 10 14:29:43 2009
From: savage at savage.za.org (Chris Knipe)
Date: Wed, 10 Jun 2009 20:29:43 +0200
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <4A2FFB05.1050709@utc.edu>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
	<20090610180937.GA27437@fusion.opticnetworks.net>
	<4A2FFB05.1050709@utc.edu>
Message-ID: <20090610182943.GA29875@fusion.opticnetworks.net>

On 10/06/09 14:27 -0400, Jeff Kell wrote:
>Chris Knipe wrote:
>> We're going through the same story at this stage.  Working with allot
>> of vendors, testing, and trails.  So far for us, a combination of entry
>> level 2960s and 3560s are working fine.  You are correct, the most
>> important thing is Multicast and IGMP subscriptions, so pretty much
>> any half decent switch would be capable. 
>
>Reminds me... do you need the "LAN Base" version to make it fly, or will
>"LAN Lite" work?

Didn't even know there is a LAN Lite :(  All our switches runs LAN Base

--
Chris



From rshughes at gmail.com  Wed Jun 10 14:54:55 2009
From: rshughes at gmail.com (Ryan Hughes)
Date: Wed, 10 Jun 2009 14:54:55 -0400
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <4A2FFB05.1050709@utc.edu>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
	<20090610180937.GA27437@fusion.opticnetworks.net>
	<4A2FFB05.1050709@utc.edu>
Message-ID: <e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>

It "depends" - largely on the type of Multicast you're rolling out.

I had mixed results with 3560's running IP Base versus IP Services for
SSM/AutoRP roll out. Depending on your requirements you could maybe get IP
Base to work but best results were with IP Services.

Ryan

On Wed, Jun 10, 2009 at 2:27 PM, Jeff Kell <jeff-kell at utc.edu> wrote:

> Chris Knipe wrote:
> > We're going through the same story at this stage.  Working with allot
> > of vendors, testing, and trails.  So far for us, a combination of entry
> > level 2960s and 3560s are working fine.  You are correct, the most
> > important thing is Multicast and IGMP subscriptions, so pretty much
> > any half decent switch would be capable.
>
> Reminds me... do you need the "LAN Base" version to make it fly, or will
> "LAN Lite" work?
>
> (or for the 3560s, IP Base or IP Services?)
>
> Jeff
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From amgnetforums at gmail.com  Wed Jun 10 15:45:45 2009
From: amgnetforums at gmail.com (amgnetforums)
Date: Wed, 10 Jun 2009 20:45:45 +0100
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>
References: <000801c9e9f0$638170a0$2a8451e0$@org>	<20090610180937.GA27437@fusion.opticnetworks.net>	<4A2FFB05.1050709@utc.edu>
	<e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>
Message-ID: <4A300D69.9060501@gmail.com>

Ryan Hughes wrote:
> It "depends" - largely on the type of Multicast you're rolling out.
>
> I had mixed results with 3560's running IP Base versus IP Services for
> SSM/AutoRP roll out. Depending on your requirements you could maybe get IP
> Base to work but best results were with IP Services.
>
> Ryan
>
> On Wed, Jun 10, 2009 at 2:27 PM, Jeff Kell <jeff-kell at utc.edu> wrote:
>
>   
>> Chris Knipe wrote:
>>     
>>> We're going through the same story at this stage.  Working with allot
>>> of vendors, testing, and trails.  So far for us, a combination of entry
>>> level 2960s and 3560s are working fine.  You are correct, the most
>>> important thing is Multicast and IGMP subscriptions, so pretty much
>>> any half decent switch would be capable.
>>>       
>> Reminds me... do you need the "LAN Base" version to make it fly, or will
>> "LAN Lite" work?
>>
>> (or for the 3560s, IP Base or IP Services?)
>>
>> Jeff
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>     
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   
Hi

We use ME3400 with metro ip access image. ssm works perfect. Have a look 
at the following links for some guidelines.

http://www.cisco.com/en/US/products/ps6902/products_implementation_design_guide_book09186a00806b5b4c.html

http://www.cisco.com/en/US/partner/products/ps6902/products_implementation_design_guide_book09186a0080665c4c.html

Anthony

From tarko at lanparty.ee  Wed Jun 10 15:12:57 2009
From: tarko at lanparty.ee (Tarko Tikan)
Date: Wed, 10 Jun 2009 22:12:57 +0300
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <000801c9e9f0$638170a0$2a8451e0$@org>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
Message-ID: <1244660866-sup-9497@valgus>

hey,

> We have a customer that does lots of IPTV - they have a new deployment
> currently going into an MDU (condos).  They have asked for a recommended
> switch that is "IPTV friendly" - I'm presuming they mean multicast aware
> etc.  

I have been down this road - don't waste your time with "cheaper" vendors, you will end up replacing the gear anyway.

> Which Cisco switches would be recommended to handoff approximately 20 Cat5
> drops fed by fiber coming in?

2960 does fine job. You now get all the security features that were available on 3750 only, on 2960 too.

ME2400 used to be an alternative but it always looked like a box made for one customer and it's EOS now anyway.

-- 
tarko

From tkacprzynski at SpencerStuart.com  Wed Jun 10 15:55:59 2009
From: tkacprzynski at SpencerStuart.com (tkacprzynski at SpencerStuart.com)
Date: Wed, 10 Jun 2009 14:55:59 -0500
Subject: [c-nsp] WS-X6148-RJ21 Ethernet Modules
In-Reply-To: <4A300D69.9060501@gmail.com>
References: <000801c9e9f0$638170a0$2a8451e0$@org>	<20090610180937.GA27437@fusion.opticnetworks.net>	<4A2FFB05.1050709@utc.edu><e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>
	<4A300D69.9060501@gmail.com>
Message-ID: <A8A11BA006DA57498FAC0A56686865042AA79799@usilwdex04.spencerstuart.com>

Hello
I was wondering if anyone has any experience using the RJ21 modules for
6500 Catalyst? Any good things to say? Any bad things to say?

Regrets deploying it? 

This would be for access switches.

Thank you,

Tom


From shinejoseph at dodo.com.au  Wed Jun 10 16:42:26 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 11 Jun 2009 04:42:26 +0800
Subject: [c-nsp] WLC discovery
Message-ID: <58C3E1A533144637A09B8082C7489B21@au.didata.local>

Hi,

A Cisco WLC4402 is configured and working alright. All of the APs currently are in the same subnet and hence the discovery do not require DHCP Option 43 or DNS. I want to add another AP that is in a different. When the AP tries to register with the WLC, it registers momentarily and un registers. This has happened for eithe DHCP option and DNS discovery.

I am sure, there is something I have not done to get this working. Can anyone suggest somthing that I should try?

Thanks in advance,

Shine

From eng_mssk at hotmail.com  Wed Jun 10 17:09:37 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Thu, 11 Jun 2009 00:09:37 +0300
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <4A2FD24D.2060703@cantv.net>
References: <4A2FD24D.2060703@cantv.net>
Message-ID: <BLU102-W261A5BC1409B9331812498FA450@phx.gbl>


you can use Paradyne DSLAMs or Alcatel ISAMs (IP DSLAMs)

> Date: Wed, 10 Jun 2009 11:03:33 -0430
> From: jcposeidon at cantv.net
> To: cisco-nsp-request at puck.nether.net
> CC: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco DSLAM ?
> 
> Guys
> 
> Does anyone of you knows a good DSLAM for HDSL & ADSL ?
> 
> Thanks
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

From A.L.M.Buxey at lboro.ac.uk  Wed Jun 10 17:11:31 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Wed, 10 Jun 2009 22:11:31 +0100
Subject: [c-nsp] WLC discovery
In-Reply-To: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
References: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
Message-ID: <20090610211131.GA9779@lboro.ac.uk>

Hi,
> Hi,
> 
> A Cisco WLC4402 is configured and working alright. All of the APs currently are in the same subnet and hence the discovery do not require DHCP Option 43 or DNS. I want to add another AP that is in a different. When the AP tries to register with the WLC, it registers momentarily and un registers. This has happened for eithe DHCP option and DNS discovery.
> 
> I am sure, there is something I have not done to get this working. Can anyone suggest somthing that I should try?

is master controller mode turned on?

alan

From shinejoseph at dodo.com.au  Wed Jun 10 17:14:08 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 11 Jun 2009 05:14:08 +0800
Subject: [c-nsp] WLC discovery
References: <C65594B8.DAF3%KaeglerM@tessco.com>
Message-ID: <29674A7372B443BDBC917147C67A32B7@au.didata.local>

Thanks Mike for the the quick response.

That means I have to have physical access to the APs which are already 
mounted on the ceiling.
I am in the process of moving this AP to another subnet and I have some 18 
of them to be moved from a single subnet to different subnets.

I can see this AP regsiters momentarily and de-registers. We are running 
code 5.1.

When the AP regsiters I can go to its configuration page and I see Hardware 
reset and Reset to Factory defaults.

Any help is appreciated.

Thanks,
Shine
----- Original Message ----- 
From: "Kaegler, Mike" <KaeglerM at tessco.com>
To: "Shine Joseph" <shinejoseph at dodo.com.au>; <cisco-nsp at puck.nether.net>
Sent: Thursday, June 11, 2009 4:50 AM
Subject: Re: [c-nsp] WLC discovery


> Boot the AP with the Mode button down to reset its parameter memory.
> If that doesn't help, hook into console and watch the messages.
> If that doesn't help, execute some 'debug [...]' statements on the same
> console.
> -porkchop
>
>
> On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:
>
>> Hi,
>>
>> A Cisco WLC4402 is configured and working alright. All of the APs 
>> currently
>> are in the same subnet and hence the discovery do not require DHCP Option 
>> 43
>> or DNS. I want to add another AP that is in a different. When the AP 
>> tries to
>> register with the WLC, it registers momentarily and un registers. This 
>> has
>> happened for eithe DHCP option and DNS discovery.
>>
>> I am sure, there is something I have not done to get this working. Can 
>> anyone
>> suggest somthing that I should try?
>>
>> Thanks in advance,
>>
>> Shine
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
> -- 
> Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
> Your wireless success, nothing less. http://www.tessco.com/
> 


From shinejoseph at dodo.com.au  Wed Jun 10 17:18:37 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 11 Jun 2009 05:18:37 +0800
Subject: [c-nsp] WLC discovery
References: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
	<20090610211131.GA9779@lboro.ac.uk>
Message-ID: <523AE2E8DAAC4990BDA1EB865ECB8630@au.didata.local>

Hi,

There is only one controller and I believe this is the master controller. DO 
you know, where I could check this?

Thanks,
Shine

----- Original Message ----- 
From: <A.L.M.Buxey at lboro.ac.uk>
To: "Shine Joseph" <shinejoseph at dodo.com.au>
Cc: <cisco-nsp at puck.nether.net>
Sent: Thursday, June 11, 2009 5:11 AM
Subject: Re: [c-nsp] WLC discovery


> Hi,
>> Hi,
>>
>> A Cisco WLC4402 is configured and working alright. All of the APs 
>> currently are in the same subnet and hence the discovery do not require 
>> DHCP Option 43 or DNS. I want to add another AP that is in a different. 
>> When the AP tries to register with the WLC, it registers momentarily and 
>> un registers. This has happened for eithe DHCP option and DNS discovery.
>>
>> I am sure, there is something I have not done to get this working. Can 
>> anyone suggest somthing that I should try?
>
> is master controller mode turned on?
>
> alan 


From KaeglerM at tessco.com  Wed Jun 10 16:50:00 2009
From: KaeglerM at tessco.com (Kaegler, Mike)
Date: Wed, 10 Jun 2009 16:50:00 -0400
Subject: [c-nsp] WLC discovery
In-Reply-To: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
Message-ID: <C65594B8.DAF3%KaeglerM@tessco.com>

Boot the AP with the Mode button down to reset its parameter memory.
If that doesn't help, hook into console and watch the messages.
If that doesn't help, execute some 'debug [...]' statements on the same
console.
-porkchop


On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:

> Hi,
> 
> A Cisco WLC4402 is configured and working alright. All of the APs currently
> are in the same subnet and hence the discovery do not require DHCP Option 43
> or DNS. I want to add another AP that is in a different. When the AP tries to
> register with the WLC, it registers momentarily and un registers. This has
> happened for eithe DHCP option and DNS discovery.
> 
> I am sure, there is something I have not done to get this working. Can anyone
> suggest somthing that I should try?
> 
> Thanks in advance,
> 
> Shine
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 

-- 
Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
Your wireless success, nothing less. http://www.tessco.com/


From rwest at zyedge.com  Wed Jun 10 17:30:32 2009
From: rwest at zyedge.com (Ryan West)
Date: Wed, 10 Jun 2009 17:30:32 -0400
Subject: [c-nsp] WLC discovery
In-Reply-To: <29674A7372B443BDBC917147C67A32B7@au.didata.local>
References: <C65594B8.DAF3%KaeglerM@tessco.com>
	<29674A7372B443BDBC917147C67A32B7@au.didata.local>
Message-ID: <8ED19A65-5326-45D3-9AB4-8ED342823302@zyedge.com>

Are you in Layer 2 or Layer 3 AP mode. I forget if this is the actual  
name, but you may need to switch to layer 3.

Sent from handheld.

On Jun 10, 2009, at 5:26 PM, "Shine Joseph" <shinejoseph at dodo.com.au>  
wrote:

> Thanks Mike for the the quick response.
>
> That means I have to have physical access to the APs which are already
> mounted on the ceiling.
> I am in the process of moving this AP to another subnet and I have  
> some 18
> of them to be moved from a single subnet to different subnets.
>
> I can see this AP regsiters momentarily and de-registers. We are  
> running
> code 5.1.
>
> When the AP regsiters I can go to its configuration page and I see  
> Hardware
> reset and Reset to Factory defaults.
>
> Any help is appreciated.
>
> Thanks,
> Shine
> ----- Original Message -----
> From: "Kaegler, Mike" <KaeglerM at tessco.com>
> To: "Shine Joseph" <shinejoseph at dodo.com.au>; <cisco-nsp at puck.nether.net 
> >
> Sent: Thursday, June 11, 2009 4:50 AM
> Subject: Re: [c-nsp] WLC discovery
>
>
>> Boot the AP with the Mode button down to reset its parameter memory.
>> If that doesn't help, hook into console and watch the messages.
>> If that doesn't help, execute some 'debug [...]' statements on the  
>> same
>> console.
>> -porkchop
>>
>>
>> On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:
>>
>>> Hi,
>>>
>>> A Cisco WLC4402 is configured and working alright. All of the APs
>>> currently
>>> are in the same subnet and hence the discovery do not require DHCP  
>>> Option
>>> 43
>>> or DNS. I want to add another AP that is in a different. When the AP
>>> tries to
>>> register with the WLC, it registers momentarily and un registers.  
>>> This
>>> has
>>> happened for eithe DHCP option and DNS discovery.
>>>
>>> I am sure, there is something I have not done to get this working.  
>>> Can
>>> anyone
>>> suggest somthing that I should try?
>>>
>>> Thanks in advance,
>>>
>>> Shine
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>
>> -- 
>> Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
>> Your wireless success, nothing less. http://www.tessco.com/
>>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From shinejoseph at dodo.com.au  Wed Jun 10 17:49:10 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 11 Jun 2009 05:49:10 +0800
Subject: [c-nsp] WLC discovery
References: <C65594B8.DAF3%KaeglerM@tessco.com>
	<29674A7372B443BDBC917147C67A32B7@au.didata.local>
	<8ED19A65-5326-45D3-9AB4-8ED342823302@zyedge.com>
Message-ID: <49E6C818867140B7A647B639486C81C8@au.didata.local>

Yes it is in layer 3 mode

----- Original Message ----- 
From: "Ryan West" <rwest at zyedge.com>
To: "Shine Joseph" <shinejoseph at dodo.com.au>
Cc: "Kaegler, Mike" <KaeglerM at tessco.com>; <cisco-nsp at puck.nether.net>
Sent: Thursday, June 11, 2009 5:30 AM
Subject: Re: [c-nsp] WLC discovery


Are you in Layer 2 or Layer 3 AP mode. I forget if this is the actual  
name, but you may need to switch to layer 3.

Sent from handheld.

On Jun 10, 2009, at 5:26 PM, "Shine Joseph" <shinejoseph at dodo.com.au>  
wrote:

> Thanks Mike for the the quick response.
>
> That means I have to have physical access to the APs which are already
> mounted on the ceiling.
> I am in the process of moving this AP to another subnet and I have  
> some 18
> of them to be moved from a single subnet to different subnets.
>
> I can see this AP regsiters momentarily and de-registers. We are  
> running
> code 5.1.
>
> When the AP regsiters I can go to its configuration page and I see  
> Hardware
> reset and Reset to Factory defaults.
>
> Any help is appreciated.
>
> Thanks,
> Shine
> ----- Original Message -----
> From: "Kaegler, Mike" <KaeglerM at tessco.com>
> To: "Shine Joseph" <shinejoseph at dodo.com.au>; <cisco-nsp at puck.nether.net 
> >
> Sent: Thursday, June 11, 2009 4:50 AM
> Subject: Re: [c-nsp] WLC discovery
>
>
>> Boot the AP with the Mode button down to reset its parameter memory.
>> If that doesn't help, hook into console and watch the messages.
>> If that doesn't help, execute some 'debug [...]' statements on the  
>> same
>> console.
>> -porkchop
>>
>>
>> On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:
>>
>>> Hi,
>>>
>>> A Cisco WLC4402 is configured and working alright. All of the APs
>>> currently
>>> are in the same subnet and hence the discovery do not require DHCP  
>>> Option
>>> 43
>>> or DNS. I want to add another AP that is in a different. When the AP
>>> tries to
>>> register with the WLC, it registers momentarily and un registers.  
>>> This
>>> has
>>> happened for eithe DHCP option and DNS discovery.
>>>
>>> I am sure, there is something I have not done to get this working.  
>>> Can
>>> anyone
>>> suggest somthing that I should try?
>>>
>>> Thanks in advance,
>>>
>>> Shine
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>
>> -- 
>> Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
>> Your wireless success, nothing less. http://www.tessco.com/
>>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From KaeglerM at tessco.com  Wed Jun 10 17:56:36 2009
From: KaeglerM at tessco.com (Kaegler, Mike)
Date: Wed, 10 Jun 2009 17:56:36 -0400
Subject: [c-nsp] WLC discovery
In-Reply-To: <49E6C818867140B7A647B639486C81C8@au.didata.local>
Message-ID: <C655A454.DB0E%KaeglerM@tessco.com>

Good call anyway, Ryan.

Master mode will have no affect in this scenario, AFAIK. Master will only
cause this controller to take priority over any other controllers if several
share the same group, forcing new APs to land on the Master (knowing where
they'd land makes for easier configuration during initial deployment). In
the era of WCS, this is less of an issue.

The only other things you can do are check firewalls between subnets (make
sure both IPs are allowed, etc). You can try a few 'debug [...]' commands on
the controller, but what you may really need is a ladder.
-porkchop

On 6/10/09 5:49 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:

> Yes it is in layer 3 mode
> 
> ----- Original Message -----
> From: "Ryan West" <rwest at zyedge.com>
> To: "Shine Joseph" <shinejoseph at dodo.com.au>
> Cc: "Kaegler, Mike" <KaeglerM at tessco.com>; <cisco-nsp at puck.nether.net>
> Sent: Thursday, June 11, 2009 5:30 AM
> Subject: Re: [c-nsp] WLC discovery
> 
> 
> Are you in Layer 2 or Layer 3 AP mode. I forget if this is the actual
> name, but you may need to switch to layer 3.
> 
> Sent from handheld.
> 
> On Jun 10, 2009, at 5:26 PM, "Shine Joseph" <shinejoseph at dodo.com.au>
> wrote:
> 
>> Thanks Mike for the the quick response.
>> 
>> That means I have to have physical access to the APs which are already
>> mounted on the ceiling.
>> I am in the process of moving this AP to another subnet and I have
>> some 18
>> of them to be moved from a single subnet to different subnets.
>> 
>> I can see this AP regsiters momentarily and de-registers. We are
>> running
>> code 5.1.
>> 
>> When the AP regsiters I can go to its configuration page and I see
>> Hardware
>> reset and Reset to Factory defaults.
>> 
>> Any help is appreciated.
>> 
>> Thanks,
>> Shine
>> ----- Original Message -----
>> From: "Kaegler, Mike" <KaeglerM at tessco.com>
>> To: "Shine Joseph" <shinejoseph at dodo.com.au>; <cisco-nsp at puck.nether.net
>>> 
>> Sent: Thursday, June 11, 2009 4:50 AM
>> Subject: Re: [c-nsp] WLC discovery
>> 
>> 
>>> Boot the AP with the Mode button down to reset its parameter memory.
>>> If that doesn't help, hook into console and watch the messages.
>>> If that doesn't help, execute some 'debug [...]' statements on the
>>> same
>>> console.
>>> -porkchop
>>> 
>>> 
>>> On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:
>>> 
>>>> Hi,
>>>> 
>>>> A Cisco WLC4402 is configured and working alright. All of the APs
>>>> currently
>>>> are in the same subnet and hence the discovery do not require DHCP
>>>> Option
>>>> 43
>>>> or DNS. I want to add another AP that is in a different. When the AP
>>>> tries to
>>>> register with the WLC, it registers momentarily and un registers.
>>>> This
>>>> has
>>>> happened for eithe DHCP option and DNS discovery.
>>>> 
>>>> I am sure, there is something I have not done to get this working.
>>>> Can
>>>> anyone
>>>> suggest somthing that I should try?
>>>> 
>>>> Thanks in advance,
>>>> 
>>>> Shine
>>>> _______________________________________________
>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>> 
>>> 
>>> -- 
>>> Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
>>> Your wireless success, nothing less. http://www.tessco.com/
>>> 
>> 
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 

-- 
Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
Your wireless success, nothing less. http://www.tessco.com/


From dale.shaw+cisco-nsp at gmail.com  Wed Jun 10 18:25:41 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Thu, 11 Jun 2009 08:25:41 +1000
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
In-Reply-To: <3760B7E1B344364AA0384B231FE7BA6901BBF92B31@ex-be1.ads.wsc.ma.edu>
References: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com>
	<3760B7E1B344364AA0384B231FE7BA6901BBF92B31@ex-be1.ads.wsc.ma.edu>
Message-ID: <3329cbb40906101525g2bf543fdu9ee4a7e74a429a31@mail.gmail.com>

Check the config-register, as Aaron suggests, but also check the SP's
config-register.

#remote command switch show boot

If the RP shows 0x2102 but the SP is something else, that could be the
problem. To fix, go into config mode on the RP and re-enter the 0x2102
config-register, ^Z, then write mem.

Cheers,
Dale

On Thu, Jun 11, 2009 at 3:24 AM, Childs, Aaron<aaron at wsc.ma.edu> wrote:
> ?What's the configuration register set to? (sh boot) once you're in IOS. ?0x0 will bring you to rommon everytime, 0x2102 will boot the sup using the config file.
>
> Aaron
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Renelson Panosky
> Sent: Wednesday, June 10, 2009 12:41 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
>
> I Have a brand new 6509-E with WS-SUP32-GE-3B booting up in rommon> mode i
> was able to type the command boot so it can look for the right code to boot
> up but after i configured the switch i turned off and turned it back on, ?it
> boot up in rommon mode again and everything was lost. ?I know someone had
> upgraded the IOS and i am sure that's what causing the problem and i know
> there is command i can type to fix the problem but i can't remember it or
> find it on the web can someone please help me out with this ?
>
> Renelson

From cayers at ena.com  Wed Jun 10 19:08:06 2009
From: cayers at ena.com (Cory Ayers)
Date: Wed, 10 Jun 2009 18:08:06 -0500
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
In-Reply-To: <3329cbb40906101525g2bf543fdu9ee4a7e74a429a31@mail.gmail.com>
References: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com><3760B7E1B344364AA0384B231FE7BA6901BBF92B31@ex-be1.ads.wsc.ma.edu>
	<3329cbb40906101525g2bf543fdu9ee4a7e74a429a31@mail.gmail.com>
Message-ID: <A7B0A9F02975A74A845FE85D0B95B8FA0D4DE305@misex01.ena.com>

> 
> Check the config-register, as Aaron suggests, but also check the SP's
> config-register.
> 
> #remote command switch show boot
> 
> If the RP shows 0x2102 but the SP is something else, that could be the
> problem. To fix, go into config mode on the RP and re-enter the 0x2102
> config-register, ^Z, then write mem.
> 
> Cheers,
> Dale
> 

While looking at show boot, you should also verify the boot variable.
It may be necessary to explicitly specify the image filename.
show boot
BOOT variable =
disk0:c7600s72033-advipservicesk9-mz.122-33.SRC2.bin,1;,1;

show star | i ^boot
boot-start-marker
boot system flash disk0:c7600s72033-advipservicesk9-mz.122-33.SRC2.bin
boot system flash 
boot-end-marker

From rdobbins at arbor.net  Wed Jun 10 21:16:00 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 11 Jun 2009 08:16:00 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <ABC850B9-F3AB-4249-ABA3-49F7C241F63E@saikonetworks.com>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<20090609143921.GY290@greenie.muc.de>
	<8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>
	<7B1AB359-3C4C-49C4-B566-54056F489D46@arbor.net>
	<ABC850B9-F3AB-4249-ABA3-49F7C241F63E@saikonetworks.com>
Message-ID: <E2657D70-B26F-48D4-9425-7014EC0D5D13@arbor.net>


On Jun 10, 2009, at 9:32 PM, Maxwell Reid wrote:

> you really only need specialized ASIC's as part of the forwarding  
> plane of high end routers.

When you're talking about DDoS, that's what's needed; general-purpose  
CPUs on boxes running many different VM/OS/app stacks, or things like  
ASAs don't cut it.

That's why you don't see stateful firewalling in front of major public- 
facing properties; not only is it useless by definition in such  
scenarios, in which every single incoming connection is unsolicited,  
but it's a DDoS chokepoint due to the state instantiated and the  
limited resources available.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From jrhett at netconsonance.com  Wed Jun 10 20:58:04 2009
From: jrhett at netconsonance.com (Jo Rhett)
Date: Wed, 10 Jun 2009 17:58:04 -0700
Subject: [c-nsp] full routing table / provider-class chassis
Message-ID: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>

I've been trying to spec Cisco for an upgrade of our Force10 backbone  
for nearly 2 months now.  I'm just trying to clarify which platform  
Cisco recommends for full routing table/hardware forwarding/provider- 
class environments.

Unfortunately every time I get through to the supposed right group, I  
mention our requirements and Cisco never follows up.  It's almost like  
they realize they have nothing on Juniper and they don't even bother.   
They are about to be eliminated from the choices for lack of having an  
answer.

Until they decide to care, is there anyone on here willing to propose  
a basic platform for provider-class environment?  By which I mean

* Full IPv4 & v6 routing table  (Cisco has 760k v4/260k v6 I know with  
SUP720/3CXL)
* ASIC-based line-rate forwarding (SUP720-3CXL and DFC-3CXL on each  
line card, right?)
* 196 ports copper 10/100/1000
* 40 ports SFP 1g  (on two line cards, not one)
* 96+ BGP peers, 8-10 full routing table peers

Unfortunately, Cisco's partners are useless.  They propose 6509s  
without the DFCs, which we know will fall over.   And as I understand  
it, the 6509 even with the 3CXL cards can't handle 5 full peers,  
nevermind 96 total peers.   Most people suggest the 7600 platform, but  
at least two comments on the mailing list indicate it isn't much better.

What are people using today for this kind of environment?  Does it work?

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness




From rdobbins at arbor.net  Wed Jun 10 21:42:49 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 11 Jun 2009 08:42:49 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
Message-ID: <CAAA2EF6-92A2-41E3-8172-9CA9F78EFD96@arbor.net>


On Jun 11, 2009, at 7:58 AM, Jo Rhett wrote:

> What are people using today for this kind of environment?

GSR, ASR 1K, CRS-1 all work quite well.

Avoid 6500/7600 for edge applications due to NetFlow, uRPF, & ACL  
caveats (they're fine in the core).

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From kgraham at industrial-marshmallow.com  Wed Jun 10 21:17:49 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Wed, 10 Jun 2009 18:17:49 -0700 (PDT)
Subject: [c-nsp] Location of 67xx rommon (c2lc-rm) images?
Message-ID: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>


With the new and not so improved software download and documentation
sites, does anyone know where to find rommon images and release notes
for 6500 line cards? RP/SP images are linked under the 6500 download 
pages, but the only DFC-related link is for c6dfc3 (65xx/68xx DFC3,
I believe).

Thanks.


From arup.ab at gmail.com  Wed Jun 10 22:28:16 2009
From: arup.ab at gmail.com (Arup Bhattacharya)
Date: Thu, 11 Jun 2009 07:58:16 +0530
Subject: [c-nsp] need help.....
Message-ID: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>

Why VLAN 0 is not configur in Switch where as starting range of VLAN is 0
and default VLAN is 1.......

-- 
Regards.....
Arup Bhattacharya
GSM-9748238797
-------------------------------------
Success is not final, failure is not fatal: it is the courage to continue
that counts

From achatz at forthnet.gr  Thu Jun 11 00:01:58 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Thu, 11 Jun 2009 07:01:58 +0300
Subject: [c-nsp] Location of 67xx rommon (c2lc-rm) images?
In-Reply-To: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
References: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
Message-ID: <4A3081B6.3040102@forthnet.gr>

Do a search for "c2lc-rm2.srec.122-18r.S1" and you'll find many download locations.

i.e.
http://tools.cisco.com/support/downloads/go/IPCheck.x?defAdv=N&sftAdv=N&filename=c2lc-rm2.srec.122-18r.S1&advUrl=null&defInd=N&mdfid=281569550&sftType=IOS%20ROMMON%20Software&optPlat=&relVer=12.2(18r)S1&md5=cabfe0b596363489047c769baf9dc161&modifmdfid=281569550&imname=null&imst=N&hybrid=Y&modelName=Cisco%20Catalyst%206500%20Series%20Virtual%20Switching%20Supervisor%20Engine%20720%20with%2010GE%20uplinks&treeMdfId=268437717&treeName=Cisco%20Interfaces%20and%20Modules&edesignator=&fsd=&hasfsd=N&nodecount=0


or use the old -classic- one:

http://www.cisco.com/cgi-bin/Software/Tablebuild/doftp.pl?ftpfile=/cisco/lan/catalyst/6000/rommon/c2lc-rm2.srec.122-18r.S1


--
Tassos

Kevin Graham wrote on 11/06/2009 04:17:
> With the new and not so improved software download and documentation
> sites, does anyone know where to find rommon images and release notes
> for 6500 line cards? RP/SP images are linked under the 6500 download 
> pages, but the only DFC-related link is for c6dfc3 (65xx/68xx DFC3,
> I believe).
> 
> Thanks.
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From spinthiras.mario at gmail.com  Thu Jun 11 02:31:15 2009
From: spinthiras.mario at gmail.com (Mario Spinthiras)
Date: Thu, 11 Jun 2009 09:31:15 +0300
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <BLU102-W261A5BC1409B9331812498FA450@phx.gbl>
References: <4A2FD24D.2060703@cantv.net>
	<BLU102-W261A5BC1409B9331812498FA450@phx.gbl>
Message-ID: <4f890e580906102331r10937ac9yfb8859586248f60b@mail.gmail.com>

Haven't had much DSLAM hands on but the Allied Telesis iMAP range is nice.

Regards,
Mario

From baimoung at inet.co.th  Thu Jun 11 02:51:35 2009
From: baimoung at inet.co.th (Charuntorn Baimoung)
Date: Thu, 11 Jun 2009 13:51:35 +0700 (ICT)
Subject: [c-nsp] Finisar SFPs on 6500 and 2960
In-Reply-To: <4A3081B6.3040102@forthnet.gr>
References: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
	<4A3081B6.3040102@forthnet.gr>
Message-ID: <Pine.LNX.4.62.0906111347110.27082@johann.inet.co.th>

     Can anyone ever use Finisar SFPs on connection between 6500 and 2960? 
Both switch compatible with Finisar SFPs.


Thanks


From eng_mssk at hotmail.com  Thu Jun 11 03:21:01 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Thu, 11 Jun 2009 10:21:01 +0300
Subject: [c-nsp] MetroEthernet Switches
Message-ID: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>


Hey all , 
we have ME-C3750-24TE switches
and we are using a product named redline for broadband lesaed lines 
we are using power adapters between the redline and the switch port
if i connect the redline directly to the switch port , am i going to face any failure ???
Input Power
The AN-80i is powered by the PoE power injector available in 90-264 VAC (50/60 Hz) or +/- 18-60 VDC versions.

Thanks in advance,

_________________________________________________________________
Show them the way! Add maps and directions to your party invites. 
http://www.microsoft.com/windows/windowslive/products/events.aspx

From A.L.M.Buxey at lboro.ac.uk  Thu Jun 11 03:54:16 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Thu, 11 Jun 2009 08:54:16 +0100
Subject: [c-nsp] WLC discovery
In-Reply-To: <523AE2E8DAAC4990BDA1EB865ECB8630@au.didata.local>
References: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
	<20090610211131.GA9779@lboro.ac.uk>
	<523AE2E8DAAC4990BDA1EB865ECB8630@au.didata.local>
Message-ID: <20090611075416.GA12785@lboro.ac.uk>

Hi,
> Hi,
>
> There is only one controller and I believe this is the master controller. 
> DO you know, where I could check this?

CLI or web interface. on web interface it should be under controller
menu. CLI is buried somewhere non intuitive ;-)

alan

From elmi at 4ever.de  Thu Jun 11 06:28:31 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Thu, 11 Jun 2009 12:28:31 +0200
Subject: [c-nsp] need help.....
In-Reply-To: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>
References: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>
Message-ID: <20090611102831.GS1071@ronin.4ever.de>

arup.ab at gmail.com (Arup Bhattacharya) wrote:

> Why VLAN 0 is not configur in Switch where as starting range of VLAN is 0
> and default VLAN is 1.......

There is no VLAN 0. "0" means "untagged".



From jcovini at free.fr  Thu Jun 11 04:42:26 2009
From: jcovini at free.fr (jcovini at free.fr)
Date: Thu, 11 Jun 2009 10:42:26 +0200
Subject: [c-nsp] need help.....
In-Reply-To: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>
References: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>
Message-ID: <1244709746.4a30c3725a782@imp.free.fr>

C2950(config)#vlan 0
Command rejected: Bad VLAN list - character #2 (EOL) delimits a VLAN
number (0) out of the range 1..4094.

But go and check the following doc, you will see that VLAN 0 can be used by a
Cisco switch to forward DOT1P-tagged voices frames :

http://www.cisco.com/en/US/docs/switches/lan/catalyst2970/software/release/12.1_19_ea1/configuration/guide/swvoip.html#wp1034347


Selon Arup Bhattacharya <arup.ab at gmail.com>:

> Why VLAN 0 is not configur in Switch where as starting range of VLAN is 0
> and default VLAN is 1.......
>
> --
> Regards.....
> Arup Bhattacharya
> GSM-9748238797
> -------------------------------------
> Success is not final, failure is not fatal: it is the courage to continue
> that counts
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From A.L.M.Buxey at lboro.ac.uk  Thu Jun 11 04:44:29 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Thu, 11 Jun 2009 09:44:29 +0100
Subject: [c-nsp] WLC discovery
In-Reply-To: <C655A454.DB0E%KaeglerM@tessco.com>
References: <49E6C818867140B7A647B639486C81C8@au.didata.local>
	<C655A454.DB0E%KaeglerM@tessco.com>
Message-ID: <20090611084429.GB13857@lboro.ac.uk>

Hi,

> The only other things you can do are check firewalls between subnets (make
> sure both IPs are allowed, etc). You can try a few 'debug [...]' commands on
> the controller, but what you may really need is a ladder.

:-)

the AP joins..and then goes. when you move to l3 mode you rely on
information such as DHCP responses of DNS entries for the AP to
know what controller to talk to...hmm, but the AP does talk to
the controller at some point. AP debugging seems to be the best choice
here - normally the output will be screaming out the issue.

I wonder if its joining, being told about a firmware update...unable
to get that firmware update (via TFTP..cant recall) across the 
L3 link due to ACLs and then either just sitting there pretty or going
through the cycle again?

alan

From avayner at cisco.com  Thu Jun 11 03:56:00 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Thu, 11 Jun 2009 09:56:00 +0200
Subject: [c-nsp] MetroEthernet Switches
In-Reply-To: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>
References: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C48CFB@xmb-ams-331.emea.cisco.com>

Mohammad,

I would assume that the power adaptor is there in order to feed the
AN-80i with power, as the ME-C3750-24TE switches are not PoE enabled. If
you remove it, I guess the AN-80i will not get power, and would not
work...

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Mohammad Khalil
Sent: Thursday, June 11, 2009 10:21
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] MetroEthernet Switches


Hey all , 
we have ME-C3750-24TE switches
and we are using a product named redline for broadband lesaed lines 
we are using power adapters between the redline and the switch port
if i connect the redline directly to the switch port , am i going to
face any failure ???
Input Power
The AN-80i is powered by the PoE power injector available in 90-264 VAC
(50/60 Hz) or +/- 18-60 VDC versions.

Thanks in advance,

_________________________________________________________________
Show them the way! Add maps and directions to your party invites. 
http://www.microsoft.com/windows/windowslive/products/events.aspx
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From vedlabs at gmail.com  Thu Jun 11 06:34:30 2009
From: vedlabs at gmail.com (Ved Labs)
Date: Thu, 11 Jun 2009 16:04:30 +0530
Subject: [c-nsp] MetroEthernet Switches
In-Reply-To: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>
References: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>
Message-ID: <7db92dcc0906110334r28781be5k4805d3cd41560002@mail.gmail.com>

Will you be using the DC to DC convertor and use the RPS port for the same ,

On Thu, Jun 11, 2009 at 12:51 PM, Mohammad Khalil <eng_mssk at hotmail.com>wrote:

>
> Hey all ,
> we have ME-C3750-24TE switches
> and we are using a product named redline for broadband lesaed lines
> we are using power adapters between the redline and the switch port
> if i connect the redline directly to the switch port , am i going to face
> any failure ???
> Input Power
> The AN-80i is powered by the PoE power injector available in 90-264 VAC
> (50/60 Hz) or +/- 18-60 VDC versions.
>
> Thanks in advance,
>
> _________________________________________________________________
> Show them the way! Add maps and directions to your party invites.
> http://www.microsoft.com/windows/windowslive/products/events.aspx
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From md at bts.sk  Thu Jun 11 06:54:20 2009
From: md at bts.sk (Marian =?utf-8?B?xI51cmtvdmnEjQ==?=)
Date: Thu, 11 Jun 2009 12:54:20 +0200
Subject: [c-nsp] 3750E and X2-10GB-ZR compatibility?
In-Reply-To: <1244641933.7592.25.camel@localhost.localdomain>
References: <1244641933.7592.25.camel@localhost.localdomain>
Message-ID: <20090611105420.GA34090@bts.sk>

On Wed, Jun 10, 2009 at 03:52:13PM +0200, Peter Rathlev wrote:
> Just a quick question: The 3750E doesn't support X2-10GB-ZR
> tranceivers[1], only up to ER. Using "service unsupported-transceiver" I
> can get the switch to recognize the transceiver, but will I be able to
> get a link with it?

There is nothing special about the X2-ZR units, they are fully compliant
with X2 spec, just have longer reach. Lack of "support" means there's no
entry in your IOS for ZR - but it was already added into 12.2(50)SE.

So either upgrade to 12.2(50)SE2 or use service unsupported-transceiver
in your present IOS and everything will work as expected. We're using
them in production with 12.2(44)SE1 for several months already.

   With kind regards,

       M.

From Skeeve at eintellego.net  Thu Jun 11 08:00:16 2009
From: Skeeve at eintellego.net (Skeeve Stevens)
Date: Thu, 11 Jun 2009 22:00:16 +1000
Subject: [c-nsp] Cisco IP Phones and IPv6
Message-ID: <292AF25E62B8894C921B893B53A19D97394469E4CE@BUSINESSEX.business.ad>

Does anyone know if any of the SCCP or SIP images for any of the models of Cisco IP Phones support IPv6?

...Skeeve

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
--
NOC, NOC, who's there?

Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.


From david.freedman at uk.clara.net  Thu Jun 11 09:41:48 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Thu, 11 Jun 2009 14:41:48 +0100
Subject: [c-nsp] Inter-AS EoMPLS/VPLS
In-Reply-To: <4A2F6A59.2000100@forthnet.gr>
References: <4A2F6A59.2000100@forthnet.gr>
Message-ID: <h0r1is$kdp$1@ger.gmane.org>

If you send labels via BGP for your xconnect endpoints then you can do
it without this feature. (Just like RFC4364 Section 10(C))

It does mean however sending eachother your /32s like you would if you
had mutual IGP , just without the IGP.

Dave.



Tassos Chatzithomaoglou wrote:
> Does anyone have any experience?
> 
> I can see it's supported only on IOS-XR, so 7600 it's out of the
> question (any plans?).
> http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.7/mpls/configuration/guide/gc37v2.html#wp1100339
> 
> 


From jfitz at Princeton.EDU  Thu Jun 11 09:44:14 2009
From: jfitz at Princeton.EDU (Jeff Fitzwater)
Date: Thu, 11 Jun 2009 09:44:14 -0400
Subject: [c-nsp] 3750 running jumbo frames ?
Message-ID: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>

We have the need to run two 3750 switches with jumbo frames (9000),  
for a high performance data transfer application.  Both switches will  
be manages by connections to a NON-JUMBO frame environment.   (That  
is, if this will work)

If I enable jumbo frames (which is a global change) and leave the  
management interface MTU at 1500 so the switch will use 1500 as packet  
size for all management, is there any NEGATIVE ISSUES I should be  
aware because of them being connected to the non-jumbo environment?



Thanks for any help,




Jeff Fitzwater
OIT Network Systems
Princeton University

From alexmoya at bellsouth.net  Thu Jun 11 09:00:04 2009
From: alexmoya at bellsouth.net (Alex Moya)
Date: Thu, 11 Jun 2009 06:00:04 -0700 (PDT)
Subject: [c-nsp] Cisco IP Phones and IPv6
Message-ID: <933154.15438.qm@web180712.mail.sp1.yahoo.com>


I beleave that 8.4 on the 7961 does

Sent from my iPhone

On Jun 11, 2009, at 8:00 AM, Skeeve Stevens <Skeeve at eintellego.net> wrote:

Does anyone know if any of the SCCP or SIP images for any of the models of Cisco IP Phones support IPv6?

...Skeeve

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
--
NOC, NOC, who's there?

Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee
 that attachments are!
 virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From jarruda-cnsp at jarruda.com  Thu Jun 11 09:29:53 2009
From: jarruda-cnsp at jarruda.com (Julio Arruda)
Date: Thu, 11 Jun 2009 09:29:53 -0400
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
References: <4A2FD24D.2060703@cantv.net>
	<78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
Message-ID: <4A3106D1.5010506@jarruda.com>

Arie Vayner (avayner) wrote:
> Juan,
> 
> Cisco does not make DSLAMs for a long time now...
> 

I wonder if there is any Next-Gen DLC that Cisco has been seeing/using 
in customers ?
In a previous life in NT, I remember Calix was quite popular in ANSI/T1 
customers in Caribean market, so, if someone is looking atend-to-end 
solutions, would cisco kit 'fit' better with any specific vendor (IOT 
and etc ?).


> Arie
> 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo
> R.
> Sent: Wednesday, June 10, 2009 18:34
> To: Cisco Post NSP
> Cc: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco DSLAM ?
> 
> Guys
> 
> Does anyone of you knows a good DSLAM for HDSL & ADSL ?
> 
> Thanks
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From jfitz at Princeton.EDU  Thu Jun 11 10:14:11 2009
From: jfitz at Princeton.EDU (Jeff Fitzwater)
Date: Thu, 11 Jun 2009 10:14:11 -0400
Subject: [c-nsp] 3750 running jumbo frames ?
In-Reply-To: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
References: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
Message-ID: <31CE01FD-0D58-4C4D-9152-0C41D2B53673@princeton.edu>

	I forgot to mention that the hosts that will be using jumbo frames,  
will be on a separate VLAN between the two switches.  The concern was  
since the jumbo frame was a global change (all gig ports on 3750), how  
would it impact the other vlan that only has 1500 MTU hosts on.   I  
would assume there isn't any impact for hosts with a 1500 MTU, its  
just that the switch can now pass 9k frames if present.   The switch  
management was the other key issue.


Thanks


Jeff


On Jun 11, 2009, at 9:44 AM, Jeff Fitzwater wrote:

> We have the need to run two 3750 switches with jumbo frames (9000),  
> for a high performance data transfer application.  Both switches  
> will be manages by connections to a NON-JUMBO frame environment.    
> (That is, if this will work)
>
> If I enable jumbo frames (which is a global change) and leave the  
> management interface MTU at 1500 so the switch will use 1500 as  
> packet size for all management, is there any NEGATIVE ISSUES I  
> should be aware because of them being connected to the non-jumbo  
> environment?
>
>
>
> Thanks for any help,
>
>
>
>
> Jeff Fitzwater
> OIT Network Systems
> Princeton University
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From jared at puck.nether.net  Thu Jun 11 10:22:13 2009
From: jared at puck.nether.net (Jared Mauch)
Date: Thu, 11 Jun 2009 10:22:13 -0400
Subject: [c-nsp] Cisco IP Phones and IPv6
In-Reply-To: <933154.15438.qm@web180712.mail.sp1.yahoo.com>
References: <933154.15438.qm@web180712.mail.sp1.yahoo.com>
Message-ID: <3203A896-2BB5-4B6A-8DDE-C00FCE8C87A6@puck.nether.net>

They do, but require DHCPv6 to be configured.

- Jared

On Jun 11, 2009, at 9:00 AM, Alex Moya wrote:

>
> I beleave that 8.4 on the 7961 does
>
> Sent from my iPhone
>
> On Jun 11, 2009, at 8:00 AM, Skeeve Stevens <Skeeve at eintellego.net>  
> wrote:
>
> Does anyone know if any of the SCCP or SIP images for any of the  
> models of Cisco IP Phones support IPv6?
>
> ...Skeeve
>
> --
> Skeeve Stevens, CEO/Technical Director
> eintellego Pty Ltd - The Networking Specialists
> skeeve at eintellego.net / www.eintellego.net
> Phone: 1300 753 383, Fax: (+612) 8572 9954
> Cell +61 (0)414 753 383 / skype://skeeve
> --
> NOC, NOC, who's there?
>
> Disclaimer: Limits of Liability and Disclaimer: This message is for  
> the named person's use only. It may contain sensitive and private  
> proprietary or legally privileged information. You must not,  
> directly or indirectly, use, disclose, distribute, print, or copy  
> any part of this message if you are not the intended recipient.  
> eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd  
> group of companies reserve the right to monitor all e-mail  
> communications through its networks.  Any views expressed in this  
> message are those of the individual sender, except where the message  
> states otherwise and the sender is authorised to state them to be  
> the views of any such entity. Any reference to costs, fee  
> quotations, contractual transactions and variations to contract  
> terms is subject to separate confirmation in writing signed by an  
> authorised representative of eintellego. Whilst all efforts are made  
> to safeguard inbound and outbound e-mails, we cannot guarantee
> that attachments are!
> virus-free or compatible with your systems and do not accept any  
> liability in respect of viruses or computer problems experienced.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From bacon at walleyesoftware.com  Thu Jun 11 10:22:22 2009
From: bacon at walleyesoftware.com (Jeff Bacon)
Date: Thu, 11 Jun 2009 09:22:22 -0500
Subject: [c-nsp] full routing table / provider-class chassis (Roland
	Dobbins)
In-Reply-To: <mailman.7.1244716142.2683.cisco-nsp@puck.nether.net>
References: <mailman.7.1244716142.2683.cisco-nsp@puck.nether.net>
Message-ID: <5A69C25361FED34F83ABF05F5047524505CD8001@wally.walleyetrading.net>

> On Jun 11, 2009, at 7:58 AM, Jo Rhett wrote:
> 
> > What are people using today for this kind of environment?
> 
> GSR, ASR 1K, CRS-1 all work quite well.
> 
> Avoid 6500/7600 for edge applications due to NetFlow, uRPF, & ACL
> caveats (they're fine in the core).

Is there a good list of these caveats somewhere I can look at? 

Thanks
-bacon


From gert at greenie.muc.de  Thu Jun 11 09:41:24 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Thu, 11 Jun 2009 15:41:24 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
Message-ID: <20090611134124.GO290@greenie.muc.de>

Hi,

On Wed, Jun 10, 2009 at 05:58:04PM -0700, Jo Rhett wrote:
> Unfortunately, Cisco's partners are useless.  They propose 6509s  
> without the DFCs, which we know will fall over.   

Whether or not you need DFCs really depends on the throughput on the
box, and the features used.  DFCs are good due to local switching (less
load on the Sup and the fabrich) and because they do local netflow - but
if the aggregate throughput is lower than what the Supervisor('s hardware
forwarding engine) can handle, a DFC will not be mandatory.

Some of our peering/uplink routers have DFCs, others have not, and with
the load we have (peak traffic ~ 4-5 Gbit/s on those boxes) the DFCs are
not yet really needed.

> And as I understand  
> it, the 6509 even with the 3CXL cards can't handle 5 full peers,  

"XL" or "non-XL" has nothing to do with the number of *peers*.

"XL" decides on the number of prefixes that you can have in your 
forwarding table (hardware FIB) - and this will be about the same 
for "1 peer with a full BGP Table" or "20 peers with the same set of
prefixes but just different BGP paths".

A higher number of different "full table "peers is going to eat up CPU 
memory and CPU power - memory is easy (Sup720-3CXL comes with 1Gbyte
RAM, which is sufficient for at least 10 "full table" BGP peers), but
CPU might reach its limit with 5 full table peers and 91 others.

Our most loaded box has 2 full table eBGP peerings + iBGP full mesh + 
~30 smaller eBGP peerings, and the CPU load is usually well below 10% -
so it might work or it might not.


> nevermind 96 total peers.   Most people suggest the 7600 platform, but  
> at least two comments on the mailing list indicate it isn't much better.

For the 7600, there is the RSP720 supervisor board, which has a faster
CPU, so it should scale better with the number


> What are people using today for this kind of environment?  Does it work?

We use 6500s with Sup720-10G (-3CXL) and Sup720-3B, and we're quite happy
with them.  The platform has its limits (shared VLAN space being the 
most significant for many folks), but compared to a "real router" (CRS-1)
the main advantage is that it's dirt cheap.

For us, questions like "does our 'router box' need to have large line
card memory to do nice QoS things in case our backbone lines fill up?"
(which is one of the big differences between LAN hardware and ES/CRS
cards) translates to "for the price difference, we can just double or
triple the raw capacity of our backbone, thus having no congestion, 
thus needing no QoS"...

(Yes, caveats apply.  With LAN hardware, you always have issues with
microbursts and buffering.  But ES/CRS - or Juniper - hardware is LOTS 
of extra money.)

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/8d77bc9f/attachment.bin>

From pr at isprime.com  Thu Jun 11 09:41:28 2009
From: pr at isprime.com (Phil Rosenthal)
Date: Thu, 11 Jun 2009 09:41:28 -0400
Subject: [c-nsp] BGP Default announcement disappearing
Message-ID: <E41D4325-8F74-4E7C-8C8A-7464B1530847@isprime.com>

Hi all,

I know we've seen this bug now for several years, and I've given up  
hope for cisco ever fixing it.

We're now running SRD on a Sup720.

For those of you who haven't seen the bug before, it goes something  
like this:

1) Everything is working fine, you have your router in a full mesh in  
your network, seeing several full tables from various sources,  
including (at least) one directly connected full transit provider  
announcing a full table (or at least some peer with a very large  
number of routes).  You are announcing default (0.0.0.0/0) to several  
customer peers via BGP.
2) Transit provider (or peer with large number of routes) flaps a  
couple of times in rapid succession
3) A small number of default-only customer peers will see the default  
route get withdrawn, but most will continue as normal
4) Any default-only customer peer that flaps after this point will  
either not learn the default route, or will see it announced and then  
withdrawn immediately afterwards.

Sessions that are like this (supposed to be receiving default, but  
not), still show up just fine in a show ip bgp nei x.x.x routes  
command, eg:
BGP table version is 20510920, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i -  
internal,
               r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Originating default network 0.0.0.0

    Network          Next Hop            Metric LocPrf Weight Path

Total number of prefixes 0


Does anyone know of a way to get the router to once again announce  
0.0.0.0/0 without a reload?
I've tried removing the null0 route for 0/0 and re-adding it, as well  
as completely unconfiguring the sessions that should learn default and  
re-adding them, neither has worked.

Thanks,
-Phil

From dcp at dcptech.com  Thu Jun 11 10:53:50 2009
From: dcp at dcptech.com (David Prall)
Date: Thu, 11 Jun 2009 10:53:50 -0400
Subject: [c-nsp] 3750 running jumbo frames ?
In-Reply-To: <31CE01FD-0D58-4C4D-9152-0C41D2B53673@princeton.edu>
References: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
	<31CE01FD-0D58-4C4D-9152-0C41D2B53673@princeton.edu>
Message-ID: <005f01c9eaa4$8145c820$83d15860$@com>

The 3750 and 3560 can only pass L2 jumbos. They are limited to a frame size
of 1998 for routed packets.

http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration
_example09186a008010edab.shtml#c3

David

--
http://dcp.dcptech.com
 

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Jeff Fitzwater
> Sent: Thursday, June 11, 2009 10:14 AM
> To: Jeff Fitzwater
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] 3750 running jumbo frames ?
> 
> 	I forgot to mention that the hosts that will be using jumbo
> frames,
> will be on a separate VLAN between the two switches.  The concern was
> since the jumbo frame was a global change (all gig ports on 3750), how
> would it impact the other vlan that only has 1500 MTU hosts on.   I
> would assume there isn't any impact for hosts with a 1500 MTU, its
> just that the switch can now pass 9k frames if present.   The switch
> management was the other key issue.
> 
> 
> Thanks
> 
> 
> Jeff
> 
> 
> On Jun 11, 2009, at 9:44 AM, Jeff Fitzwater wrote:
> 
> > We have the need to run two 3750 switches with jumbo frames (9000),
> > for a high performance data transfer application.  Both switches
> > will be manages by connections to a NON-JUMBO frame environment.
> > (That is, if this will work)
> >
> > If I enable jumbo frames (which is a global change) and leave the
> > management interface MTU at 1500 so the switch will use 1500 as
> > packet size for all management, is there any NEGATIVE ISSUES I
> > should be aware because of them being connected to the non-jumbo
> > environment?
> >
> >
> >
> > Thanks for any help,
> >
> >
> >
> >
> > Jeff Fitzwater
> > OIT Network Systems
> > Princeton University
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From Ian.Mackinnon at lumison.net  Thu Jun 11 10:57:11 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Thu, 11 Jun 2009 15:57:11 +0100
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090611134124.GO290@greenie.muc.de>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>

Hi Gert,

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Gert Doering
> Sent: 11 June 2009 14:41
> To: Jo Rhett
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp

<SNIP>

> "XL" or "non-XL" has nothing to do with the number of *peers*.
>
> "XL" decides on the number of prefixes that you can have in your
> forwarding table (hardware FIB) - and this will be about the same for
> "1 peer with a full BGP Table" or "20 peers with the same set of
> prefixes but just different BGP paths".
>
> A higher number of different "full table "peers is going to eat up CPU
> memory and CPU power - memory is easy (Sup720-3CXL comes with 1Gbyte
> RAM, which is sufficient for at least 10 "full table" BGP peers), but
> CPU might reach its limit with 5 full table peers and 91 others.



I was the under the impression that the limit on these boxes (and ASR1002 R1) was approx 1 Million routes.
I had assumed that was the total number of routes from all your peers, eg we see about 280k routes in a full table, so that would be approx 4 full tables.
Are you saying that the limit on the number of routes, is actually in the FIB, ie active routes, so currently would always be about 280k, and multiple full tables is OK.


--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From mhuff at ox.com  Thu Jun 11 10:38:44 2009
From: mhuff at ox.com (Matthew Huff)
Date: Thu, 11 Jun 2009 10:38:44 -0400
Subject: [c-nsp] [c-nap] Location of 67xx rommon (c2lc-rm) images?
In-Reply-To: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
References: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C3811FD2A8@PUR-EXCH07.ox.com>

It's hidden.

We ran into the same thing. 

Look under the LAN Switches section, for switches, 6509, then the 6500
Virtual Switching Supervisor 720, IOS Rommmon. 

It's only there, and it's the same for DFC with regular sup 720. We found
this out from a TAC case.



----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Kevin Graham
> Sent: Wednesday, June 10, 2009 9:18 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Location of 67xx rommon (c2lc-rm) images?
> 
> 
> With the new and not so improved software download and documentation
> sites, does anyone know where to find rommon images and release notes
> for 6500 line cards? RP/SP images are linked under the 6500 download
> pages, but the only DFC-related link is for c6dfc3 (65xx/68xx DFC3,
> I believe).
> 
> Thanks.
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/3ad8a922/attachment-0001.bin>

From gert at greenie.muc.de  Thu Jun 11 11:17:01 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Thu, 11 Jun 2009 17:17:01 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
	<B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
Message-ID: <20090611151701.GQ290@greenie.muc.de>

Hi,

On Thu, Jun 11, 2009 at 03:57:11PM +0100, Ian MacKinnon wrote:
> > "XL" or "non-XL" has nothing to do with the number of *peers*.
> >
> > "XL" decides on the number of prefixes that you can have in your
> > forwarding table (hardware FIB) - and this will be about the same for
> > "1 peer with a full BGP Table" or "20 peers with the same set of
> > prefixes but just different BGP paths".
> >
> > A higher number of different "full table "peers is going to eat up CPU
> > memory and CPU power - memory is easy (Sup720-3CXL comes with 1Gbyte
> > RAM, which is sufficient for at least 10 "full table" BGP peers), but
> > CPU might reach its limit with 5 full table peers and 91 others.
> 
> I was the under the impression that the limit on these boxes 
> (and ASR1002 R1) was approx 1 Million routes.

True.  *FIB space* routes.

> I had assumed that was the total number of routes from all your peers, 
> eg we see about 280k routes in a full table, 

Correct.

> so that would be approx 4 full tables.

No.

1 full table has 280k routes.

100 full tables have 280k routes as well. (But LOTS of additional BGP path
information - but those are not stored in the FIB, and don't count for 
the "1 million" limit).

> Are you saying that the limit on the number of routes, is actually in 
> the FIB, ie active routes, so currently would always be about 280k, and 
> multiple full tables is OK.

BGP paths that don't go to the FIB are not "routes".  They are just prefixes
with path info.

(In other words: yes).

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/81db1f0b/attachment.bin>

From Ian.Mackinnon at lumison.net  Thu Jun 11 11:18:44 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Thu, 11 Jun 2009 16:18:44 +0100
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090611151701.GQ290@greenie.muc.de>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
	<B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
	<20090611151701.GQ290@greenie.muc.de>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D9444EEC@nbg01-exch-01.entlstaff.domain.lumison.net>

Thanks Gert, excellent answer.

> -----Original Message-----
> From: Gert Doering [mailto:gert at greenie.muc.de]
> Sent: 11 June 2009 16:17
> To: Ian MacKinnon
> Cc: Gert Doering; Jo Rhett; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] full routing table / provider-class chassis
>
> Hi,
>
> On Thu, Jun 11, 2009 at 03:57:11PM +0100, Ian MacKinnon wrote:
> > > "XL" or "non-XL" has nothing to do with the number of *peers*.
> > >
> > > "XL" decides on the number of prefixes that you can have in your
> > > forwarding table (hardware FIB) - and this will be about the same
> > > for
> > > "1 peer with a full BGP Table" or "20 peers with the same set of
> > > prefixes but just different BGP paths".
> > >
> > > A higher number of different "full table "peers is going to eat up
> > > CPU memory and CPU power - memory is easy (Sup720-3CXL comes with
> > > 1Gbyte RAM, which is sufficient for at least 10 "full table" BGP
> > > peers), but CPU might reach its limit with 5 full table peers and
> 91 others.
> >
> > I was the under the impression that the limit on these boxes (and
> > ASR1002 R1) was approx 1 Million routes.
>
> True.  *FIB space* routes.
>
> > I had assumed that was the total number of routes from all your
> peers,
> > eg we see about 280k routes in a full table,
>
> Correct.
>
> > so that would be approx 4 full tables.
>
> No.
>
> 1 full table has 280k routes.
>
> 100 full tables have 280k routes as well. (But LOTS of additional BGP
> path information - but those are not stored in the FIB, and don't count
> for the "1 million" limit).
>
> > Are you saying that the limit on the number of routes, is actually in
> > the FIB, ie active routes, so currently would always be about 280k,
> > and multiple full tables is OK.
>
> BGP paths that don't go to the FIB are not "routes".  They are just
> prefixes with path info.
>
> (In other words: yes).
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>
> //www.muc.de/~gert/
> Gert Doering - Munich, Germany
> gert at greenie.muc.de
> fax: +49-89-35655025                        gert at net.informatik.tu-
> muenchen.de

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From gert at greenie.muc.de  Thu Jun 11 11:23:10 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Thu, 11 Jun 2009 17:23:10 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090611151701.GQ290@greenie.muc.de>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
	<B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
	<20090611151701.GQ290@greenie.muc.de>
Message-ID: <20090611152310.GR290@greenie.muc.de>

Hi,

On Thu, Jun 11, 2009 at 05:17:01PM +0200, Gert Doering wrote:
> > Are you saying that the limit on the number of routes, is actually in 
> > the FIB, ie active routes, so currently would always be about 280k, and 
> > multiple full tables is OK.
> 
> BGP paths that don't go to the FIB are not "routes".  They are just prefixes
> with path info.
> 
> (In other words: yes).

To clarify: this is the way *Cisco* does it.  Information gets collected
inside routing processes, routing processes (here: BGP) select a "winner"
amoing all candidates (= 1 route out of many BGP paths), and the result
goes to the FIB (if it's the protocol with the best preference).

As far as I understand, Juniper handles this a bit different, with no
separate tables for "inside BGP" stuff, so things might look different
there.

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/98b465e6/attachment.bin>

From A.L.M.Buxey at lboro.ac.uk  Thu Jun 11 12:03:18 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Thu, 11 Jun 2009 17:03:18 +0100
Subject: [c-nsp] Cisco IP Phones and IPv6
In-Reply-To: <933154.15438.qm@web180712.mail.sp1.yahoo.com>
References: <933154.15438.qm@web180712.mail.sp1.yahoo.com>
Message-ID: <20090611160318.GA14721@lboro.ac.uk>

Hi,
> 
> I beleave that 8.4 on the 7961 does
> 
> Sent from my iPhone
> 
> On Jun 11, 2009, at 8:00 AM, Skeeve Stevens <Skeeve at eintellego.net> wrote:
> 
> Does anyone know if any of the SCCP or SIP images for any of the models of Cisco IP Phones support IPv6?

8.4.2S show it ghosted out on the network info page...i think 
we're just one version short - cant recall if its the firmware
or the CUCM we need to deal with....its certainly coming!

alan

From rdobbins at arbor.net  Thu Jun 11 12:07:47 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 11 Jun 2009 23:07:47 +0700
Subject: [c-nsp] full routing table / provider-class chassis (Roland
	Dobbins)
In-Reply-To: <5A69C25361FED34F83ABF05F5047524505CD8001@wally.walleyetrading.net>
References: <mailman.7.1244716142.2683.cisco-nsp@puck.nether.net>
	<5A69C25361FED34F83ABF05F5047524505CD8001@wally.walleyetrading.net>
Message-ID: <7813E55B-4111-4B52-A1A5-34337B7CE8DD@arbor.net>


On Jun 11, 2009, at 9:22 PM, Jeff Bacon wrote:

> Is there a good list of these caveats somewhere I can look at?

NetFlow:

256K mls tables at 93% efficiency (~233K entries).

No packet-sampled control of flow creation can lead to mls table  
overflow & non-deterministic skewing of stats/heuristics; small mls  
table size contributes to this in environments with diverse traffic  
patterns and/or high pps, such as SP edge.  NetFlow 'sampling' on  
6500/7600 is actually NDE output telemetry sampling only, not the same  
as packet-sampled control of flow creation on software platforms, GSR,  
ASR 1K, CRS-1, N7K.

No logical OR of TCP flags observed throughout a TCP flow, only the  
last flag.

No dropped traffic stats/heuristics.

ACLs:

ACLs must be carefully crafted to avoid LOU exhaustion & subsequent  
software switching self-DoS:

<https://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00800c9470.shtml#wp43500 
 >

uRPF:

uRPF mode must be the same for all interfaces in a chassis.

Note that these are all edge features.  These boxes are fine running  
in the core and/or other areas in which these particular edge features  
aren't required; it's the edge which can be problematic.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From cmadams at hiwaay.net  Thu Jun 11 12:13:05 2009
From: cmadams at hiwaay.net (Chris Adams)
Date: Thu, 11 Jun 2009 11:13:05 -0500
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090611152310.GR290@greenie.muc.de>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
	<B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
	<20090611151701.GQ290@greenie.muc.de>
	<20090611152310.GR290@greenie.muc.de>
Message-ID: <20090611161305.GC1185296@hiwaay.net>

Once upon a time, Gert Doering <gert at greenie.muc.de> said:
> As far as I understand, Juniper handles this a bit different, with no
> separate tables for "inside BGP" stuff, so things might look different
> there.

Juniper JUNOS keeps all routes (static, OSPF, BGP, etc.) in the "route
table" in the routing engine (where the protocols run), and exports the
best routes to the "forwarding table" in the forwarding engine (where
the packets are forwarded).  The forwarding table in a router with full
Internet BGP routes currently has ~282K routes, while the route table
has ~282K times however many full-route peers you have (plus internal
routes in both cases).

The route table has all the routes (from all sources and peers) known to
the router, but routing engine RAM is (relatively) cheap since the RE is
basically just a PC running FreeBSD.  I'm not sure off the top of my
head how much additional RAM is used per full-route peer.

-- 
Chris Adams <cmadams at hiwaay.net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.

From Jeff.Wojciechowski at midlandpaper.com  Thu Jun 11 12:37:42 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Thu, 11 Jun 2009 11:37:42 -0500
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>

Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
  Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
        Full-Duplex, 100 Mbps
        Description: LAN/STATE Failover Interface
        MAC address 0024.14d3.7b37, MTU 1500
        IP address x.x.x.x, subnet mask 255.255.255.0
        558 packets input, 49468 bytes, 0 no buffer
        Received 3 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        499 packets output, 71296 bytes, 0 underruns
        0 output errors, 0 collisions, 9 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        input queue (curr/max packets): hardware (0/25) software (0/0)
        output queue (curr/max packets): hardware (0/0) software (0/0)
  Traffic Statistics for "failover":
        558 packets input, 39264 bytes
        502 packets output, 59800 bytes
        0 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff

From mhuff at ox.com  Thu Jun 11 13:04:26 2009
From: mhuff at ox.com (Matthew Huff)
Date: Thu, 11 Jun 2009 13:04:26 -0400
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C3811FD2C3@PUR-EXCH07.ox.com>

Try connecting to the serial port on both boxes and setting the name on
both, and then retrying the sync.

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
> Sent: Thursday, June 11, 2009 12:38 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ASA 5510 Configuration Replication Failure
> 
> Dearest List:
> 
> We are building a new active/standby ASA cluster with 5510's and the
> initial config synch went just fine.
> 
> However, when we changed the hostname on the primary unit and did a
> 'write standby' I got the following:
> 
> VaultASA(config)# wr stan
> Building configuration...
> [OK]
> VaultASA(config)# Beginning configuration replication: Sending to mate.
> Failover LAN Failed
> Configuration Replication Failure
> sh ver
> 
> Cisco Adaptive Security Appliance Software Version 8.0(3)
> Device Manager Version 6.1(5)
> 
> Another interesting point about this is that both units show the synch
> interface (E0/3 on both units in our case) show line protocol down.
> 
> VaultASA(config)# sh int e0/3
> Interface Ethernet0/3 "failover", is down, line protocol is down
>   Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
>         Full-Duplex, 100 Mbps
>         Description: LAN/STATE Failover Interface
>         MAC address 0024.14d3.7b37, MTU 1500
>         IP address x.x.x.x, subnet mask 255.255.255.0
>         558 packets input, 49468 bytes, 0 no buffer
>         Received 3 broadcasts, 0 runts, 0 giants
>         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
>         0 L2 decode drops
>         499 packets output, 71296 bytes, 0 underruns
>         0 output errors, 0 collisions, 9 interface resets
>         0 babbles, 0 late collisions, 0 deferred
>         0 lost carrier, 0 no carrier
>         input queue (curr/max packets): hardware (0/25) software (0/0)
>         output queue (curr/max packets): hardware (0/0) software (0/0)
>   Traffic Statistics for "failover":
>         558 packets input, 39264 bytes
>         502 packets output, 59800 bytes
>         0 packets dropped
>       1 minute input rate 0 pkts/sec,  0 bytes/sec
>       1 minute output rate 0 pkts/sec,  0 bytes/sec
>       1 minute drop rate, 0 pkts/sec
>       5 minute input rate 0 pkts/sec,  0 bytes/sec
>       5 minute output rate 0 pkts/sec,  0 bytes/sec
>       5 minute drop rate, 0 pkts/sec
> VaultASA(config)#
> 
> Ideas?
> 
> Thanks in advance.
> 
> Jeff
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/3fd2bdad/attachment.bin>

From peter at rathlev.dk  Thu Jun 11 13:04:03 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 11 Jun 2009 19:04:03 +0200
Subject: [c-nsp] 3750E and X2-10GB-ZR compatibility?
In-Reply-To: <20090611105420.GA34090@bts.sk>
References: <1244641933.7592.25.camel@localhost.localdomain>
	<20090611105420.GA34090@bts.sk>
Message-ID: <1244739843.3383.1.camel@localhost.localdomain>

Hi Marian,

On Thu, 2009-06-11 at 12:54 +0200, Marian ?urkovi? wrote:
> There is nothing special about the X2-ZR units, they are fully compliant
> with X2 spec, just have longer reach. Lack of "support" means there's no
> entry in your IOS for ZR - but it was already added into 12.2(50)SE.

Thank you very much for poiting this out, after loading 12.2(50)SE2 it
was recognized fine. :-)

Regards,
Peter



From peter at rathlev.dk  Thu Jun 11 13:13:09 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 11 Jun 2009 19:13:09 +0200
Subject: [c-nsp] 3750 running jumbo frames ?
In-Reply-To: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
References: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
Message-ID: <1244740389.3383.6.camel@localhost.localdomain>

On Thu, 2009-06-11 at 09:44 -0400, Jeff Fitzwater wrote:
> We have the need to run two 3750 switches with jumbo frames (9000),  
> for a high performance data transfer application.  Both switches will  
> be manages by connections to a NON-JUMBO frame environment.   (That  
> is, if this will work)
> 
> If I enable jumbo frames (which is a global change) and leave the  
> management interface MTU at 1500 so the switch will use 1500 as packet  
> size for all management, is there any NEGATIVE ISSUES I should be  
> aware because of them being connected to the non-jumbo environment?

This will not present problems. As David mentions only L2 switched
frames can be jumbo. Management-traffic wouldn't exceed the routing MTU,
which is 1500 bytes by default. Changing the "system jumbo mtu" doesn't
change the L3 MTU.

Any TCP based L3 connection would use the lowest of the two endpoint
MSSs anyway, so hosts connecting from 1500 byte MTU segments would
always end up using 1500 byte MTU connections. Even if you could adjust
routing MTU to 9000 bytes you probably wouldn't face any problems.

IMHO there would never be any negative effects from enabling 9000 bytes
MTU, unless of course you explicitely WANT to limit the MTU.

Regards,
Peter



From kloch at kl.net  Thu Jun 11 12:40:50 2009
From: kloch at kl.net (Kevin Loch)
Date: Thu, 11 Jun 2009 12:40:50 -0400
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
Message-ID: <4A313392.60604@kl.net>

Jo Rhett wrote:
> I've been trying to spec Cisco for an upgrade of our Force10 backbone 
> for nearly 2 months now.  I'm just trying to clarify which platform 
> Cisco recommends for full routing table/hardware 
> forwarding/provider-class environments.
> 
> Unfortunately every time I get through to the supposed right group, I 
> mention our requirements and Cisco never follows up.  It's almost like 
> they realize they have nothing on Juniper and they don't even bother.  
> They are about to be eliminated from the choices for lack of having an 
> answer.
> 
> Until they decide to care, is there anyone on here willing to propose a 
> basic platform for provider-class environment?  By which I mean
> 
> * Full IPv4 & v6 routing table  (Cisco has 760k v4/260k v6 I know with 
> SUP720/3CXL)
> * ASIC-based line-rate forwarding (SUP720-3CXL and DFC-3CXL on each line 
> card, right?)
> * 196 ports copper 10/100/1000
> * 40 ports SFP 1g  (on two line cards, not one)
> * 96+ BGP peers, 8-10 full routing table peers
> 
> Unfortunately, Cisco's partners are useless.  They propose 6509s without 
> the DFCs, which we know will fall over.  

Well that depends...

The DFC's only do next-hop (tcam) lookups and netflow.  All packets are
switched on the centralized PFC.  Each line card has two 20Gbit/s
fabric channels (2x 40Gbit/s full duplex) to the PFC.  The PFC also has
tcam for lookups and netflow to service any cards that do not have
a DFC.

The PFC is rated at something like 30Mpps so if you are doing less
than that and you don't need the extra netflow tcam you don't
need any DFC's and can still theoretically do 640Gbit/s (320Gbit/s
for those of us to have highly unbalanced traffic flows).

Netflow is subsampled on this platform.  I have been able to get
pretty good estimates of traffic flow (checked against SNMP counters)
but I would not use that for any kind of accounting.  The
SNMP counters are fairly noisy due to the several second update
intervals.  SNMP counters on vlans are even worse and loop
over after a few gbit/s even though the coutners themselves
are 64bit.  You may find using smaller switches (like 3560)
for most customer ports and using 10Gig uplinks is better
than using copper ports on the 6500/7600.

I would avoid the sup720, the rsp720 has 2x the ram and more
than 2x the cpu power.  cpu on the sup720 is by far it's biggest
limitation.



> And as I understand it, the 
> 6509 even with the 3CXL cards can't handle 5 full peers, nevermind 96 
> total peers.   Most people suggest the 7600 platform, but at least two 
> comments on the mailing list indicate it isn't much better.
> 
> What are people using today for this kind of environment?  Does it work?
> 


From lukasz at bromirski.net  Thu Jun 11 13:40:32 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Thu, 11 Jun 2009 19:40:32 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A313392.60604@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net>
Message-ID: <4A314190.8050907@bromirski.net>

On 2009-06-11 18:40, Kevin Loch wrote:

You've got something messed up Kevin:

> The DFC's only do next-hop (tcam) lookups and netflow.

DFCs are doing all and exactly the same work as PFC on
Supervisors locally on the LC that they are installed to.
They're the same in terms of hardware, just in a
different form - to fit the LC, not the Sup.

 > All packets are switched on the centralized PFC.

If the LC has a DFC, packet is switched by DFC toward
destination - if it's on the same card, it's switched locally
(until, of course, you seem to have 6748/6704/6708/6716 where
the card is divided into two).

If the LC doesn't have a DFC but CFC only, the traffic is
switched by PFC.

 > Each line card has two 20Gbit/s fabric channels
 > (2x 40Gbit/s full duplex) to the PFC.

Each 67xx series LC can have one or two 20Gbit/s channel
connections to switch fabric located at Supervisor. Switch
Fabric ASICs and PFCs are not the same thing.

65xx LCs have one or two 8Gbit/s connections to the switch fabric
and different DFCs models, but the switch fabric of Sup720/RSP720
can autonegotiate 8/20 Gbit/s upon insertion into chassis/boot.

> The PFC is rated at something like 30Mpps so if you are doing less
> than that and you don't need the extra netflow tcam you don't
> need any DFC's and can still theoretically do 640Gbit/s (320Gbit/s
> for those of us to have highly unbalanced traffic flows).

PFC is 30Mpps, DFCs for 67xx LCs can do 48Mpps.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From bacon at walleyesoftware.com  Thu Jun 11 14:00:52 2009
From: bacon at walleyesoftware.com (Jeff Bacon)
Date: Thu, 11 Jun 2009 13:00:52 -0500
Subject: [c-nsp] cisco-nsp Digest, Vol 79, Issue 37
In-Reply-To: <mailman.33.1244733169.2683.cisco-nsp@puck.nether.net>
References: <mailman.33.1244733169.2683.cisco-nsp@puck.nether.net>
Message-ID: <5A69C25361FED34F83ABF05F5047524505CD8011@wally.walleyetrading.net>

> 
> Message: 4
> Date: Thu, 11 Jun 2009 15:41:24 +0200
> From: Gert Doering <gert at greenie.muc.de>
> To: Jo Rhett <jrhett at netconsonance.com>
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] full routing table / provider-class chassis
> Message-ID: <20090611134124.GO290 at greenie.muc.de>
> Content-Type: text/plain; charset="us-ascii"
> 
> 
> (Yes, caveats apply.  With LAN hardware, you always have issues with
> microbursts and buffering.  But ES/CRS - or Juniper - hardware is LOTS
> of extra money.)
> 
> gert
> 

So is there a good way to watch/track microbursts? I don't care if it
buffers, but in our environment (lot of market data) we suffer from 
a) regular microbursts (micro meaning in the 1s or less timeframe)
b) no really good way to measure or capture them short of putting packet
sniffers on lines and sorting through packet dumps ex-post-facto. 

We're using 6500/720-3BXL hardware but could buy other hardware (though
I imagine that's not the problem). Traffic comes in over gig fiber or
various metro-e, NYC metro area. 

Our general answer is "throw more bandwidth at the problem" - which is
fine; the problem is knowing _when_ we need to, short of finding out
from end-users. 

-bacon


From rwest at zyedge.com  Thu Jun 11 14:16:16 2009
From: rwest at zyedge.com (Ryan West)
Date: Thu, 11 Jun 2009 14:16:16 -0400
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>

Jeff,

It's hard to tell exactly what happened based on your post, can you do a 'show failover'?  When the ASA's are paired, you should only need to do a wr to save config on both.  Try erasing the config on the backup ASA, regenerate your RSA key with your new hostname (on the primary), re-enter the failover commands (on the standby) and see if it sync's up again.  You should consider moving away from 8.0(3), there a number of publicized security risks with it.  The interim releases should have much fewer bugs as well.

As for the failover interface, are you using a crossover or does it connect to a switch?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
Sent: Thursday, June 11, 2009 12:38 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ASA 5510 Configuration Replication Failure

Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
  Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
        Full-Duplex, 100 Mbps
        Description: LAN/STATE Failover Interface
        MAC address 0024.14d3.7b37, MTU 1500
        IP address x.x.x.x, subnet mask 255.255.255.0
        558 packets input, 49468 bytes, 0 no buffer
        Received 3 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        499 packets output, 71296 bytes, 0 underruns
        0 output errors, 0 collisions, 9 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        input queue (curr/max packets): hardware (0/25) software (0/0)
        output queue (curr/max packets): hardware (0/0) software (0/0)
  Traffic Statistics for "failover":
        558 packets input, 39264 bytes
        502 packets output, 59800 bytes
        0 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From randy_94108 at yahoo.com  Thu Jun 11 13:39:43 2009
From: randy_94108 at yahoo.com (Randy)
Date: Thu, 11 Jun 2009 10:39:43 -0700 (PDT)
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
Message-ID: <755887.26624.qm@web80506.mail.mud.yahoo.com>

was the appliance actually *the active unit* when you made the change?
despite the replication failure, you should still be able to connect to both appliances and see what they think their host names are. Make sure it is the same.
?
make sure you have the following entries in the config:
in active:
?
conf t
standby lan unit primary
hostname state(this will display the state of the unit at the prompt - hostname/act and hostname/stdby)
?
in standby:
conf t
standby lan unit secondary
hostname state
?
Regards
?


--- On Thu, 6/11/09, Jeff Wojciechowski <Jeff.Wojciechowski at midlandpaper.com> wrote:


From: Jeff Wojciechowski <Jeff.Wojciechowski at midlandpaper.com>
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
To: "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>
Date: Thursday, June 11, 2009, 9:37 AM


Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
? Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
? ? ? ? Full-Duplex, 100 Mbps
? ? ? ? Description: LAN/STATE Failover Interface
? ? ? ? MAC address 0024.14d3.7b37, MTU 1500
? ? ? ? IP address x.x.x.x, subnet mask 255.255.255.0
? ? ? ? 558 packets input, 49468 bytes, 0 no buffer
? ? ? ? Received 3 broadcasts, 0 runts, 0 giants
? ? ? ? 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
? ? ? ? 0 L2 decode drops
? ? ? ? 499 packets output, 71296 bytes, 0 underruns
? ? ? ? 0 output errors, 0 collisions, 9 interface resets
? ? ? ? 0 babbles, 0 late collisions, 0 deferred
? ? ? ? 0 lost carrier, 0 no carrier
? ? ? ? input queue (curr/max packets): hardware (0/25) software (0/0)
? ? ? ? output queue (curr/max packets): hardware (0/0) software (0/0)
? Traffic Statistics for "failover":
? ? ? ? 558 packets input, 39264 bytes
? ? ? ? 502 packets output, 59800 bytes
? ? ? ? 0 packets dropped
? ? ? 1 minute input rate 0 pkts/sec,? 0 bytes/sec
? ? ? 1 minute output rate 0 pkts/sec,? 0 bytes/sec
? ? ? 1 minute drop rate, 0 pkts/sec
? ? ? 5 minute input rate 0 pkts/sec,? 0 bytes/sec
? ? ? 5 minute output rate 0 pkts/sec,? 0 bytes/sec
? ? ? 5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff
_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From mhuff at ox.com  Thu Jun 11 14:56:52 2009
From: mhuff at ox.com (Matthew Huff)
Date: Thu, 11 Jun 2009 14:56:52 -0400
Subject: [c-nsp] cisco-nsp Digest, Vol 79, Issue 37
In-Reply-To: <5A69C25361FED34F83ABF05F5047524505CD8011@wally.walleyetrading.net>
References: <mailman.33.1244733169.2683.cisco-nsp@puck.nether.net>
	<5A69C25361FED34F83ABF05F5047524505CD8011@wally.walleyetrading.net>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C3811FD2CE@PUR-EXCH07.ox.com>

input and output drops on the interface are the key (depending on
direction). Microbursting is a problem with the short term sustained rate
overflows the input or output hardware buffer. If the system can't dequeue
the packets faster enough the you will get tail drops. With a 6500/720-3BXL
the problem with microbursting is going to be in the linecard.

With a 67xx series linecard you shouldn't receive microbursting unless you
have a very congested fabric or are saturating the interface
With a 65xx series linecard it will depend on the rate. On an otherwise
normal utilization microbursting shouldn't be a big problem
With a 61xx,62xx, 63xx the buffers are pretty shallow, hence their
positioning as access linecards for end users

All this depends on hardware switching. If something is causing the packets
to be punted to the CPU, then microbursting drops can occur on any linecard.


----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Jeff Bacon
> Sent: Thursday, June 11, 2009 2:01 PM
> To: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] cisco-nsp Digest, Vol 79, Issue 37
> 
> >
> > Message: 4
> > Date: Thu, 11 Jun 2009 15:41:24 +0200
> > From: Gert Doering <gert at greenie.muc.de>
> > To: Jo Rhett <jrhett at netconsonance.com>
> > Cc: cisco-nsp at puck.nether.net
> > Subject: Re: [c-nsp] full routing table / provider-class chassis
> > Message-ID: <20090611134124.GO290 at greenie.muc.de>
> > Content-Type: text/plain; charset="us-ascii"
> >
> >
> > (Yes, caveats apply.  With LAN hardware, you always have issues with
> > microbursts and buffering.  But ES/CRS - or Juniper - hardware is
> LOTS
> > of extra money.)
> >
> > gert
> >
> 
> So is there a good way to watch/track microbursts? I don't care if it
> buffers, but in our environment (lot of market data) we suffer from
> a) regular microbursts (micro meaning in the 1s or less timeframe)
> b) no really good way to measure or capture them short of putting
> packet
> sniffers on lines and sorting through packet dumps ex-post-facto.
> 
> We're using 6500/720-3BXL hardware but could buy other hardware (though
> I imagine that's not the problem). Traffic comes in over gig fiber or
> various metro-e, NYC metro area.
> 
> Our general answer is "throw more bandwidth at the problem" - which is
> fine; the problem is knowing _when_ we need to, short of finding out
> from end-users.
> 
> -bacon
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/0f636d9e/attachment-0001.bin>

From p.mayers at imperial.ac.uk  Thu Jun 11 15:01:34 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Thu, 11 Jun 2009 20:01:34 +0100
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A313392.60604@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net>
Message-ID: <4A31548E.3080501@imperial.ac.uk>

Kevin Loch wrote:

>>
>> Unfortunately, Cisco's partners are useless.  They propose 6509s without 
>> the DFCs, which we know will fall over.  
> 
> Well that depends...
> 
> The DFC's only do next-hop (tcam) lookups and netflow.  All packets are
> switched on the centralized PFC.  Each line card has two 20Gbit/s

?ukasz has already addressed this; suffice to say he's right, and the 
above is not correct. A TCAM lookup *is* the forwarding operation, and 
the DFC has all information required locally to switch the packet (via 
the fabric) to the output linecard, and does so.

> 
> Netflow is subsampled on this platform.  I have been able to get

I don't know what you mean by "subsampled", but my experience of netflow 
on this platform does not match this description.

Because we are within the netflow TCAM limits, I get 100% accurate 
netflow. There's no sampling in hardware - the hardware is in fact not 
*capable* of such - and we see all packets in our flow table.

> pretty good estimates of traffic flow (checked against SNMP counters)
> but I would not use that for any kind of accounting.  The

Again, this depends on your traffic pattern. We use it for accounting 
and it is essentially totally reliable, given our traffic patterns.

It's popular to bash netflow on the 6500s, but I personally think that's 
unfair. It's very effective for the (large numbers of) sites who are 
within the design limits of the platform. I can understand it's 
frustrating to be outside those limits though.

> SNMP counters are fairly noisy due to the several second update
> intervals.  SNMP counters on vlans are even worse and loop
> over after a few gbit/s even though the coutners themselves
> are 64bit.  You may find using smaller switches (like 3560)
> for most customer ports and using 10Gig uplinks is better
> than using copper ports on the 6500/7600.

I think that would depend on the architecture one was trying to build. 
By terminating the link on a 6748-TX, you get:

  * sensible power redundancy
  * sensible control-plane redundancy
  * better performance / lower contention
  * fewer devices to manage

> 
> I would avoid the sup720, the rsp720 has 2x the ram and more

Obviously it's worth emphasising that the RSP720 is 7600-only, and from 
posts on this list it's still not in general availability I think?

> than 2x the cpu power.  cpu on the sup720 is by far it's biggest
> limitation.

That's certainly true; 600Mhz is pretty derisory these days.

From Jeff.Wojciechowski at midlandpaper.com  Thu Jun 11 15:15:30 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Thu, 11 Jun 2009 14:15:30 -0500
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>

Ryan,

Thx for the heads up on the 8.0(3) bugs.

I blew away the configs on the secondary unit - upgraded to 8.0(4) on both units, re synched and the synch interface goes line protocol down and got this:

OUTPUT FROM SECONDARY:
______________________

        Detected an Active mate
 Beginning configuration replication from mate.
Failover LAN Failed

        Switching to Active

VaultASA(config-if)# sh fail
Failover On
Failover unit Secondary
Failover LAN Interface: failover Ethernet0/3 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 250 maximum
Version: Ours 8.0(4), Mate 8.0(4)
Last Failover at: 14:05:04 CDT Jun 11 2009
        This host: Secondary - Active
                Active time: 53 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Up Sys)
                  Interface outside (172.20.50.16): Normal (Waiting)
                  Interface inside (172.20.40.16): Normal (Waiting)
                slot 1: empty
        Other host: Primary - Failed
                Active time: 204 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Unknown/Unknown)
                  Interface outside (172.20.50.17): Unknown (Waiting)
                  Interface inside (172.20.40.17): Unknown (Waiting)
                slot 1: empty

Stateful Failover Logical Update Statistics
        Link : failover Ethernet0/3 (Failed)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         0          0          0          0
        sys cmd         0          0          0          0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         0          0          0          0
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       0       0
        Xmit Q:         0       0       0

Sh Fail on Primary (after failure):
___________________________________

VaultASA# sh fail
Failover On
Failover unit Primary
Failover LAN Interface: failover Ethernet0/3 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 250 maximum
Version: Ours 8.0(4), Mate 8.0(4)
Last Failover at: 14:01:27 CDT Jun 11 2009
        This host: Primary - Active
                Active time: 387 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Up Sys)
                  Interface outside (172.20.50.16): Normal (Waiting)
                  Interface inside (172.20.40.16): Normal (Waiting)
                slot 1: empty
        Other host: Secondary - Failed
                Active time: 0 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Unknown/Unknown)
                  Interface outside (172.20.50.17): Unknown (Waiting)
                  Interface inside (172.20.40.17): Unknown (Waiting)
                slot 1: empty

Stateful Failover Logical Update Statistics
        Link : failover Ethernet0/3 (Failed)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         0          0          0          0
        sys cmd         0          0          0          0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         0          0          0          0
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       0       0
        Xmit Q:         0       0       0


To answer your question - the failover interfaces are connected directly using a straight thru cable - the interfaces come 'up' long enough to synch and then immediately go down after a synch. And yes we tried different cable(s) on the synch interface :o)

Thanks,

-Jeff


-----Original Message-----
From: Ryan West [mailto:rwest at zyedge.com] 
Sent: Thursday, June 11, 2009 1:16 PM
To: Jeff Wojciechowski; cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Jeff,

It's hard to tell exactly what happened based on your post, can you do a 'show failover'?  When the ASA's are paired, you should only need to do a wr to save config on both.  Try erasing the config on the backup ASA, regenerate your RSA key with your new hostname (on the primary), re-enter the failover commands (on the standby) and see if it sync's up again.  You should consider moving away from 8.0(3), there a number of publicized security risks with it.  The interim releases should have much fewer bugs as well.

As for the failover interface, are you using a crossover or does it connect to a switch?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
Sent: Thursday, June 11, 2009 12:38 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ASA 5510 Configuration Replication Failure

Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
  Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
        Full-Duplex, 100 Mbps
        Description: LAN/STATE Failover Interface
        MAC address 0024.14d3.7b37, MTU 1500
        IP address x.x.x.x, subnet mask 255.255.255.0
        558 packets input, 49468 bytes, 0 no buffer
        Received 3 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        499 packets output, 71296 bytes, 0 underruns
        0 output errors, 0 collisions, 9 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        input queue (curr/max packets): hardware (0/25) software (0/0)
        output queue (curr/max packets): hardware (0/0) software (0/0)
  Traffic Statistics for "failover":
        558 packets input, 39264 bytes
        502 packets output, 59800 bytes
        0 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From chadwick.whitten at gmail.com  Thu Jun 11 15:23:32 2009
From: chadwick.whitten at gmail.com (Chad Whitten)
Date: Thu, 11 Jun 2009 14:23:32 -0500
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <4A3106D1.5010506@jarruda.com>
References: <4A2FD24D.2060703@cantv.net>
	<78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
	<4A3106D1.5010506@jarruda.com>
Message-ID: <973236a60906111223v7d847c46x82e1674834c4ac52@mail.gmail.com>

On Thu, Jun 11, 2009 at 8:29 AM, Julio Arruda <jarruda-cnsp at jarruda.com>wrote:

> Arie Vayner (avayner) wrote:
>
>> Juan,
>>
>> Cisco does not make DSLAMs for a long time now...
>>
>>
> I wonder if there is any Next-Gen DLC that Cisco has been seeing/using in
> customers ?
> In a previous life in NT, I remember Calix was quite popular in ANSI/T1
> customers in Caribean market, so, if someone is looking atend-to-end
> solutions, would cisco kit 'fit' better with any specific vendor (IOT and
> etc ?).
>
>
>
>  Arie
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo
>> R.
>> Sent: Wednesday, June 10, 2009 18:34
>> To: Cisco Post NSP
>> Cc: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] Cisco DSLAM ?
>>
>> Guys
>>
>> Does anyone of you knows a good DSLAM for HDSL & ADSL ?
>>
>> Thanks
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
Chad Whitten
chadwick.whitten at gmail.com
601-519-4172

From jfitz at Princeton.EDU  Thu Jun 11 16:23:03 2009
From: jfitz at Princeton.EDU (Jeff Fitzwater)
Date: Thu, 11 Jun 2009 16:23:03 -0400
Subject: [c-nsp] 3750 running jumbo frames ?
In-Reply-To: <1244740389.3383.6.camel@localhost.localdomain>
References: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
	<1244740389.3383.6.camel@localhost.localdomain>
Message-ID: <5E377FEF-23E7-4782-BCB1-4A6127BCC81F@Princeton.EDU>

Thanks for all the info.   Thats what I thought, but I have people  
checking on me.

Case closed.


Jeff
On Jun 11, 2009, at 1:13 PM, Peter Rathlev wrote:

> On Thu, 2009-06-11 at 09:44 -0400, Jeff Fitzwater wrote:
>> We have the need to run two 3750 switches with jumbo frames (9000),
>> for a high performance data transfer application.  Both switches will
>> be manages by connections to a NON-JUMBO frame environment.   (That
>> is, if this will work)
>>
>> If I enable jumbo frames (which is a global change) and leave the
>> management interface MTU at 1500 so the switch will use 1500 as  
>> packet
>> size for all management, is there any NEGATIVE ISSUES I should be
>> aware because of them being connected to the non-jumbo environment?
>
> This will not present problems. As David mentions only L2 switched
> frames can be jumbo. Management-traffic wouldn't exceed the routing  
> MTU,
> which is 1500 bytes by default. Changing the "system jumbo mtu"  
> doesn't
> change the L3 MTU.
>
> Any TCP based L3 connection would use the lowest of the two endpoint
> MSSs anyway, so hosts connecting from 1500 byte MTU segments would
> always end up using 1500 byte MTU connections. Even if you could  
> adjust
> routing MTU to 9000 bytes you probably wouldn't face any problems.
>
> IMHO there would never be any negative effects from enabling 9000  
> bytes
> MTU, unless of course you explicitely WANT to limit the MTU.
>
> Regards,
> Peter
>
>


From jared at puck.nether.net  Thu Jun 11 16:48:50 2009
From: jared at puck.nether.net (Jared Mauch)
Date: Thu, 11 Jun 2009 16:48:50 -0400
Subject: [c-nsp] WS-X6148-RJ21 Ethernet Modules
In-Reply-To: <A8A11BA006DA57498FAC0A56686865042AA79799@usilwdex04.spencerstuart.com>
References: <000801c9e9f0$638170a0$2a8451e0$@org>	<20090610180937.GA27437@fusion.opticnetworks.net>	<4A2FFB05.1050709@utc.edu><e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>
	<4A300D69.9060501@gmail.com>
	<A8A11BA006DA57498FAC0A56686865042AA79799@usilwdex04.spencerstuart.com>
Message-ID: <E632AB70-30FB-46F9-9B29-7AEA6B0E3FB0@puck.nether.net>

My biggest comments surround insuring that they're supported in recent  
software.  Cisco pulled some hardware support in the SXI -> SXI1  
rebuild.

You also need to verify that the patch panels being used are the  
"right ones".  It's easy for someone to hand you a T1 patch panel and  
think it's viable for ethernet until you actually trace the wiring.

	- Jared

On Jun 10, 2009, at 3:55 PM, <tkacprzynski at SpencerStuart.com> <tkacprzynski at SpencerStuart.com 
 > wrote:

> Hello
> I was wondering if anyone has any experience using the RJ21 modules  
> for
> 6500 Catalyst? Any good things to say? Any bad things to say?
>
> Regrets deploying it?
>
> This would be for access switches.
>
> Thank you,
>
> Tom
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From cchurc05 at harris.com  Thu Jun 11 17:15:52 2009
From: cchurc05 at harris.com (Church, Charles)
Date: Thu, 11 Jun 2009 16:15:52 -0500
Subject: [c-nsp] WS-X6148-RJ21 Ethernet Modules
In-Reply-To: <E632AB70-30FB-46F9-9B29-7AEA6B0E3FB0@puck.nether.net>
References: <000801c9e9f0$638170a0$2a8451e0$@org>	<20090610180937.GA27437@fusion.opticnetworks.net>	<4A2FFB05.1050709@utc.edu><e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com><4A300D69.9060501@gmail.com><A8A11BA006DA57498FAC0A56686865042AA79799@usilwdex04.spencerstuart.com>
	<E632AB70-30FB-46F9-9B29-7AEA6B0E3FB0@puck.nether.net>
Message-ID: <FA1BA229357DB640B944218F3585FECA025E1577@mspe2k1.cs.myharris.net>

>My biggest comments surround insuring that they're supported in recent

>software.  Cisco pulled some hardware support in the SXI -> SXI1  
>rebuild.

Didn't know about that.  Thought SXH and SXI had the same HW support.
Are there release notes for SXI1 up yet?

Chuck

From rwest at zyedge.com  Thu Jun 11 17:16:48 2009
From: rwest at zyedge.com (Ryan West)
Date: Thu, 11 Jun 2009 17:16:48 -0400
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
	<6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5305@zy-ex1.zyedge.local>

Have you tried a crossover?  Can you post 'show run failover' ?  A console on the standby firewall might reveal something during the replication process too.

-ryan

-----Original Message-----
From: Jeff Wojciechowski [mailto:Jeff.Wojciechowski at midlandpaper.com] 
Sent: Thursday, June 11, 2009 3:16 PM
To: Ryan West
Cc: cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Ryan,

Thx for the heads up on the 8.0(3) bugs.

I blew away the configs on the secondary unit - upgraded to 8.0(4) on both units, re synched and the synch interface goes line protocol down and got this:

OUTPUT FROM SECONDARY:
______________________

        Detected an Active mate
 Beginning configuration replication from mate.
Failover LAN Failed

        Switching to Active

VaultASA(config-if)# sh fail
Failover On
Failover unit Secondary
Failover LAN Interface: failover Ethernet0/3 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 250 maximum
Version: Ours 8.0(4), Mate 8.0(4)
Last Failover at: 14:05:04 CDT Jun 11 2009
        This host: Secondary - Active
                Active time: 53 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Up Sys)
                  Interface outside (172.20.50.16): Normal (Waiting)
                  Interface inside (172.20.40.16): Normal (Waiting)
                slot 1: empty
        Other host: Primary - Failed
                Active time: 204 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Unknown/Unknown)
                  Interface outside (172.20.50.17): Unknown (Waiting)
                  Interface inside (172.20.40.17): Unknown (Waiting)
                slot 1: empty

Stateful Failover Logical Update Statistics
        Link : failover Ethernet0/3 (Failed)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         0          0          0          0
        sys cmd         0          0          0          0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         0          0          0          0
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       0       0
        Xmit Q:         0       0       0

Sh Fail on Primary (after failure):
___________________________________

VaultASA# sh fail
Failover On
Failover unit Primary
Failover LAN Interface: failover Ethernet0/3 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 250 maximum
Version: Ours 8.0(4), Mate 8.0(4)
Last Failover at: 14:01:27 CDT Jun 11 2009
        This host: Primary - Active
                Active time: 387 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Up Sys)
                  Interface outside (172.20.50.16): Normal (Waiting)
                  Interface inside (172.20.40.16): Normal (Waiting)
                slot 1: empty
        Other host: Secondary - Failed
                Active time: 0 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Unknown/Unknown)
                  Interface outside (172.20.50.17): Unknown (Waiting)
                  Interface inside (172.20.40.17): Unknown (Waiting)
                slot 1: empty

Stateful Failover Logical Update Statistics
        Link : failover Ethernet0/3 (Failed)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         0          0          0          0
        sys cmd         0          0          0          0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         0          0          0          0
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       0       0
        Xmit Q:         0       0       0


To answer your question - the failover interfaces are connected directly using a straight thru cable - the interfaces come 'up' long enough to synch and then immediately go down after a synch. And yes we tried different cable(s) on the synch interface :o)


Thanks,

-Jeff


-----Original Message-----
From: Ryan West [mailto:rwest at zyedge.com] 
Sent: Thursday, June 11, 2009 1:16 PM
To: Jeff Wojciechowski; cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Jeff,

It's hard to tell exactly what happened based on your post, can you do a 'show failover'?  When the ASA's are paired, you should only need to do a wr to save config on both.  Try erasing the config on the backup ASA, regenerate your RSA key with your new hostname (on the primary), re-enter the failover commands (on the standby) and see if it sync's up again.  You should consider moving away from 8.0(3), there a number of publicized security risks with it.  The interim releases should have much fewer bugs as well.

As for the failover interface, are you using a crossover or does it connect to a switch?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
Sent: Thursday, June 11, 2009 12:38 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ASA 5510 Configuration Replication Failure

Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
  Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
        Full-Duplex, 100 Mbps
        Description: LAN/STATE Failover Interface
        MAC address 0024.14d3.7b37, MTU 1500
        IP address x.x.x.x, subnet mask 255.255.255.0
        558 packets input, 49468 bytes, 0 no buffer
        Received 3 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        499 packets output, 71296 bytes, 0 underruns
        0 output errors, 0 collisions, 9 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        input queue (curr/max packets): hardware (0/25) software (0/0)
        output queue (curr/max packets): hardware (0/0) software (0/0)
  Traffic Statistics for "failover":
        558 packets input, 39264 bytes
        502 packets output, 59800 bytes
        0 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From Jeff.Wojciechowski at midlandpaper.com  Thu Jun 11 17:24:03 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Thu, 11 Jun 2009 16:24:03 -0500
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5305@zy-ex1.zyedge.local>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
	<6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5305@zy-ex1.zyedge.local>
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AED808@XBOX.midlandpaper.com>

Ryan -

Solved... for now at least...

Still using straight thru cable for synch interface I upgraded to 8.21 - based on the following bug IDs:

CSCsu88174
CSCsw98373
CSCsy21727
CSCsz63217

For the record the sh run | inc fail:

failover lan unit primary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.20.20.6 255.255.255.0 standby 172.20.20.7

and 

failover lan unit secondary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.20.20.6 255.255.255.0 standby 172.20.20.7

Thanks again,

-Jeff


-----Original Message-----
From: Ryan West [mailto:rwest at zyedge.com] 
Sent: Thursday, June 11, 2009 4:17 PM
To: Jeff Wojciechowski
Cc: cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Have you tried a crossover?  Can you post 'show run failover' ?  A console on the standby firewall might reveal something during the replication process too.

-ryan


<snipped>


From kgraham at industrial-marshmallow.com  Thu Jun 11 17:58:19 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Thu, 11 Jun 2009 14:58:19 -0700 (PDT)
Subject: [c-nsp] Location of 67xx rommon (c2lc-rm) images?
In-Reply-To: <4A3081B6.3040102@forthnet.gr>
References: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
	<4A3081B6.3040102@forthnet.gr>
Message-ID: <601566.41451.qm@web1206.biz.mail.gq1.yahoo.com>




> Do a search for "c2lc-rm2.srec.122-18r.S1"

Yep, thanks for the pointer. Wonderful that they made the site
spider-friendly enough that:

   http://www.google.com/search?q=site%3Acisco.com+c2lc-rm2

...returns 1 result. I was mostly trying to confirm that (18r)S1 was
still the most current option so was hoping for a canonical location
over a search result.

> and you'll find many download locations.

Indeed. 3 pages of download links for irrelevant permutations of
supervisors and chassis combinations with release notes as the 
last result of the last page.

Apparently the brilliant decisions for how to deliver support
tools made c2lc is the exclusive "IOS rommon" for "6509E ->
Sup720 w/ 10GbE uplinks"... I admire the effort it must take to
maintain such a friendly facade over such clear contempt for 
anyone actually using it.

From samantha at cairns.net.au  Thu Jun 11 20:13:24 2009
From: samantha at cairns.net.au (Samantha (Regional Connect))
Date: Fri, 12 Jun 2009 10:13:24 +1000
Subject: [c-nsp] Problem with config for 7206 acting as a lns
Message-ID: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>

Hi

I have the radius issuing the following attribute (example)

lcp:interface-config#1=service-policy output 160
lcp:interface-config#1=service-policy input 2560

Now when the user authenticates it closes the connection on the user
If I remove the attributes from radius (shaping after a user has reached a
download limit)
they stay connected




boot system flash disk0:c7200-xxxxxxxxxxxx
aaa new-model
!
!
aaa authentication login default local
aaa authentication enable default enable
aaa authentication ppp default group radius
aaa authorization network l2tp group radius
aaa accounting delay-start
aaa accounting update periodic 5
aaa accounting network default start-stop group radius
aaa accounting network l2tp start-stop group radius
aaa nas port extended
aaa pod server auth-type any server-key xxxxxxxxxxxxxxxxx
aaa session-id common
enable secret 5 $1$BSPX$QS0/XG/J8WmSW7attjsTC/
enable password xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
clock timezone GMT 10
ip subnet-zero
no ip source-route
!
!
ip name-server xxx.xxx.xxx.xxx
ip name-server xxx.xxx.xxx.xxx
ip name-server xxx.xxx.xxx.xxx
!
ip cef
vpdn enable
vpdn multihop
vpdn aaa attribute nas-port vpdn-nas
vpdn logging
vpdn logging local
vpdn logging tunnel-drop
vpdn history failure table-size 50
vpdn session-limit 1000
! Default L2TP VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 1
 lcp renegotiation always
 l2tp tunnel password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
!
!
voice call carrier capacity active
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet1/0
 description LNS Link to Network
 ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
 duplex full
 ipv6 address xxx.xxx.xxx.xxx /48
 ipv6 enable
 no cdp enable
!
interface FastEthernet2/0
 no ip address
 duplex full
 no cdp enable
 no mop enabled
!
interface FastEthernet2/0.1027
 encapsulation dot1Q 1027
 ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
 no cdp enable
!
interface FastEthernet2/0.1028
 encapsulation dot1Q 1028
 ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
 no cdp enable
!
interface Virtual-Template1
 description Customer DSL-Sessions via L2TP
 ip unnumbered FastEthernet1/0
 ip access-group 110 out
 peer default ip address pool default
 ppp authentication pap chap radius
ppp authorization l2tp
 ppp accounting l2tp
 ppp multilink
!
router ospf 1
 router-id 202.xxx.xxx.xxx
 log-adjacency-changes
 redistribute connected subnets
 redistribute static subnets
 passive-interface FastEthernet2/0
 passive-interface FastEthernet2/0.1027
 passive-interface FastEthernet2/0.1028
 network 202.xxx.xxx.xxx 0.0.0.255 area 0.0.0.0
!
ip local pool default xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
ip route xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx FastEthernet1/0
no ip http server
!
!
access-list 110 permit ip any any
no cdp run
ipv6 route xxx.xxx.xxx.xxx 48 FastEthernet1/0
ipv6 route ::/0 xxx.xxx.xxx.xxx
!
snmp-server community public RO 99
snmp-server location Equinix Sydney
snmp-server contact xxx.xxx.xxx.xxx
snmp-server chassis-id lns1.c7206
snmp-server enable traps tty
!
!
radius-server configure-nas
radius-server host xxx.xxx.xxx.xxx auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server key xxxxxxxxxxx
radius-server authorization permit missing Service-Type
radius-server vsa send accounting
radius-server vsa send authentication
no call rsvp-sync
!
!
mgcp profile default
!
dial-peer cor custom
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
!
ntp clock-period 17179650
ntp master 4
ntp server 192.189.54.17
ntp server 202.47.112.1
ntp server 192.189.54.65
!


Thanks


Sam


From BBlackford at nwresd.k12.or.us  Thu Jun 11 22:20:14 2009
From: BBlackford at nwresd.k12.or.us (Bill Blackford)
Date: Thu, 11 Jun 2009 19:20:14 -0700
Subject: [c-nsp] x6148 vs. x6548
Message-ID: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>

I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.

I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.

Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.

-b

--
Bill Blackford                     
Senior Network Engineer            
Technology Systems Group           
Northwest Regional ESD             

my /home away from home


From cphillips at wbsconnect.com  Thu Jun 11 22:31:55 2009
From: cphillips at wbsconnect.com (Chris Phillips)
Date: Thu, 11 Jun 2009 19:31:55 -0700
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
Message-ID: <4A31BE1B.4020702@wbsconnect.com>

Bill,

One caveat that jumps to mind is the max MTU of 1518 instead of the far 
more desirable 9216.  We ran into some MPLS VC issues with MTU mismatch 
that forced us to re-engineer and/or upgrade those blades.

Give this a read before you buy anything:

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/product_data_sheet0900aecd8017376e_ps4835_Products_Data_Sheet.html

Good luck with your decision.

Bill Blackford wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
> 
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
> 
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
> 
> -b
> 
> --
> Bill Blackford                     
> Senior Network Engineer            
> Technology Systems Group           
> Northwest Regional ESD             
> 
> my /home away from home
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

-- 
Chris Phillips


From ayourtch at gmail.com  Thu Jun 11 23:32:26 2009
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Fri, 12 Jun 2009 05:32:26 +0200
Subject: [c-nsp] Cisco IP Phones and IPv6
In-Reply-To: <292AF25E62B8894C921B893B53A19D97394469E4CE@BUSINESSEX.business.ad>
References: <292AF25E62B8894C921B893B53A19D97394469E4CE@BUSINESSEX.business.ad>
Message-ID: <530c5af60906112032u29362a5ej97af9433e6f8c6a4@mail.gmail.com>

On Thu, Jun 11, 2009 at 2:00 PM, Skeeve Stevens<Skeeve at eintellego.net> wrote:
> Does anyone know if any of the SCCP or SIP images for any of the models of Cisco IP Phones support IPv6?

I found these two pointers, HTH:

http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/firmware/8_5_2/english/release/notes/7900_852.html#wp159417
http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/admin/7_1_2/ccmfeat/fsipv6.html

thanks,
andrew

>
> ...Skeeve
>
> --
> Skeeve Stevens, CEO/Technical Director
> eintellego Pty Ltd - The Networking Specialists
> skeeve at eintellego.net / www.eintellego.net
> Phone: 1300 753 383, Fax: (+612) 8572 9954
> Cell +61 (0)414 753 383 / skype://skeeve
> --
> NOC, NOC, who's there?
>
> Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are!
>  virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From mulitskiy at acedsl.com  Fri Jun 12 01:10:09 2009
From: mulitskiy at acedsl.com (Michael Ulitskiy)
Date: Fri, 12 Jun 2009 01:10:09 -0400
Subject: [c-nsp] Problem with config for 7206 acting as a lns
In-Reply-To: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>
References: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>
Message-ID: <200906120110.09722.mulitskiy@acedsl.com>

There's no such policy-maps defined in your config.
If you supply an undefined policy-map in radius VSA then cisco just drops the connection.

Michael

On Thursday 11 June 2009 08:13:24 pm Samantha (Regional Connect) wrote:
> Hi
> 
> I have the radius issuing the following attribute (example)
> 
> lcp:interface-config#1=service-policy output 160
> lcp:interface-config#1=service-policy input 2560
> 
> Now when the user authenticates it closes the connection on the user
> If I remove the attributes from radius (shaping after a user has reached a
> download limit)
> they stay connected
> 
> 
> 
> 
> boot system flash disk0:c7200-xxxxxxxxxxxx
> aaa new-model
> !
> !
> aaa authentication login default local
> aaa authentication enable default enable
> aaa authentication ppp default group radius
> aaa authorization network l2tp group radius
> aaa accounting delay-start
> aaa accounting update periodic 5
> aaa accounting network default start-stop group radius
> aaa accounting network l2tp start-stop group radius
> aaa nas port extended
> aaa pod server auth-type any server-key xxxxxxxxxxxxxxxxx
> aaa session-id common
> enable secret 5 $1$BSPX$QS0/XG/J8WmSW7attjsTC/
> enable password xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> !
> clock timezone GMT 10
> ip subnet-zero
> no ip source-route
> !
> !
> ip name-server xxx.xxx.xxx.xxx
> ip name-server xxx.xxx.xxx.xxx
> ip name-server xxx.xxx.xxx.xxx
> !
> ip cef
> vpdn enable
> vpdn multihop
> vpdn aaa attribute nas-port vpdn-nas
> vpdn logging
> vpdn logging local
> vpdn logging tunnel-drop
> vpdn history failure table-size 50
> vpdn session-limit 1000
> ! Default L2TP VPDN group
>  accept-dialin
>   protocol l2tp
>   virtual-template 1
>  lcp renegotiation always
>  l2tp tunnel password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
> !
> !
> !
> voice call carrier capacity active
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> interface FastEthernet1/0
>  description LNS Link to Network
>  ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
>  duplex full
>  ipv6 address xxx.xxx.xxx.xxx /48
>  ipv6 enable
>  no cdp enable
> !
> interface FastEthernet2/0
>  no ip address
>  duplex full
>  no cdp enable
>  no mop enabled
> !
> interface FastEthernet2/0.1027
>  encapsulation dot1Q 1027
>  ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
>  no cdp enable
> !
> interface FastEthernet2/0.1028
>  encapsulation dot1Q 1028
>  ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
>  no cdp enable
> !
> interface Virtual-Template1
>  description Customer DSL-Sessions via L2TP
>  ip unnumbered FastEthernet1/0
>  ip access-group 110 out
>  peer default ip address pool default
>  ppp authentication pap chap radius
> ppp authorization l2tp
>  ppp accounting l2tp
>  ppp multilink
> !
> router ospf 1
>  router-id 202.xxx.xxx.xxx
>  log-adjacency-changes
>  redistribute connected subnets
>  redistribute static subnets
>  passive-interface FastEthernet2/0
>  passive-interface FastEthernet2/0.1027
>  passive-interface FastEthernet2/0.1028
>  network 202.xxx.xxx.xxx 0.0.0.255 area 0.0.0.0
> !
> ip local pool default xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
> ip classless
> ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
> ip route xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx FastEthernet1/0
> no ip http server
> !
> !
> access-list 110 permit ip any any
> no cdp run
> ipv6 route xxx.xxx.xxx.xxx 48 FastEthernet1/0
> ipv6 route ::/0 xxx.xxx.xxx.xxx
> !
> snmp-server community public RO 99
> snmp-server location Equinix Sydney
> snmp-server contact xxx.xxx.xxx.xxx
> snmp-server chassis-id lns1.c7206
> snmp-server enable traps tty
> !
> !
> radius-server configure-nas
> radius-server host xxx.xxx.xxx.xxx auth-port 1645 acct-port 1646
> radius-server retransmit 3
> radius-server key xxxxxxxxxxx
> radius-server authorization permit missing Service-Type
> radius-server vsa send accounting
> radius-server vsa send authentication
> no call rsvp-sync
> !
> !
> mgcp profile default
> !
> dial-peer cor custom
> !
> !
> !
> !
> gatekeeper
> shutdown
> !
> !
> line con 0
>  stopbits 1
> line aux 0
>  stopbits 1
> line vty 0 4
> !
> ntp clock-period 17179650
> ntp master 4
> ntp server 192.189.54.17
> ntp server 202.47.112.1
> ntp server 192.189.54.65
> !
> 
> 
> Thanks
> 
> 
> Sam
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From tincan at gmail.com  Fri Jun 12 02:41:27 2009
From: tincan at gmail.com (Nate)
Date: Thu, 11 Jun 2009 23:41:27 -0700
Subject: [c-nsp] Nexus 5000 + Qlogic QLE8042 + VMware ESX 3.5?
Message-ID: <f8da69c80906112341s48bae95aq4f02cadcb40301c6@mail.gmail.com>

Has anyone gotten VMware ESX 3.5 Update 4 to recognize the Qlogic
QLE8042 CNA with both the 10G Ethernet interface and FC HBA? We're
trying to get the server with the CNA installed connected to the Nexus
5000 and while the Ethernet interfaces are shown as up on the N5K, the
VFC interfaces are stuck in init state. ESX does not appear to
recognize the Qlogic as an HBA, even though we're using the latest
driver from Qlogic. We contacted VMware tech support and the answer we
got back was that ESX will only recognize the Qlogic as an Ethernet
interface, not HBA. That does not sound right, since I've recalled
hearing others having success. If anyone has successfully gotten the
Qlogic CNA to work under VMware ESX as both an Ethernet and HBA, I
would love to hear your experience.

TIA!
Nate

From erik at infopact.nl  Fri Jun 12 02:54:16 2009
From: erik at infopact.nl (E. Versaevel)
Date: Fri, 12 Jun 2009 08:54:16 +0200
Subject: [c-nsp] Problem with config for 7206 acting as a lns
In-Reply-To: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>
References: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>
Message-ID: <4A31FB98.30008@infopact.nl>

You need to increment the sequence number:

> lcp:interface-config#1=service-policy output 160
> lcp:interface-config#2=service-policy input 2560

also make sure the service policy referred to are in you configuration :)



Samantha (Regional Connect) schreef:
> Hi
> 
> I have the radius issuing the following attribute (example)
> 
> lcp:interface-config#1=service-policy output 160
> lcp:interface-config#1=service-policy input 2560
> 
> Now when the user authenticates it closes the connection on the user
> If I remove the attributes from radius (shaping after a user has reached a
> download limit)
> they stay connected
> 
> 
> 
> 
> boot system flash disk0:c7200-xxxxxxxxxxxx
> aaa new-model
> !
> !
> aaa authentication login default local
> aaa authentication enable default enable
> aaa authentication ppp default group radius
> aaa authorization network l2tp group radius
> aaa accounting delay-start
> aaa accounting update periodic 5
> aaa accounting network default start-stop group radius
> aaa accounting network l2tp start-stop group radius
> aaa nas port extended
> aaa pod server auth-type any server-key xxxxxxxxxxxxxxxxx
> aaa session-id common
> enable secret 5 $1$BSPX$QS0/XG/J8WmSW7attjsTC/
> enable password xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> !
> clock timezone GMT 10
> ip subnet-zero
> no ip source-route
> !
> !
> ip name-server xxx.xxx.xxx.xxx
> ip name-server xxx.xxx.xxx.xxx
> ip name-server xxx.xxx.xxx.xxx
> !
> ip cef
> vpdn enable
> vpdn multihop
> vpdn aaa attribute nas-port vpdn-nas
> vpdn logging
> vpdn logging local
> vpdn logging tunnel-drop
> vpdn history failure table-size 50
> vpdn session-limit 1000
> ! Default L2TP VPDN group
>  accept-dialin
>   protocol l2tp
>   virtual-template 1
>  lcp renegotiation always
>  l2tp tunnel password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
> !
> !
> !
> voice call carrier capacity active
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> interface FastEthernet1/0
>  description LNS Link to Network
>  ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
>  duplex full
>  ipv6 address xxx.xxx.xxx.xxx /48
>  ipv6 enable
>  no cdp enable
> !
> interface FastEthernet2/0
>  no ip address
>  duplex full
>  no cdp enable
>  no mop enabled
> !
> interface FastEthernet2/0.1027
>  encapsulation dot1Q 1027
>  ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
>  no cdp enable
> !
> interface FastEthernet2/0.1028
>  encapsulation dot1Q 1028
>  ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
>  no cdp enable
> !
> interface Virtual-Template1
>  description Customer DSL-Sessions via L2TP
>  ip unnumbered FastEthernet1/0
>  ip access-group 110 out
>  peer default ip address pool default
>  ppp authentication pap chap radius
> ppp authorization l2tp
>  ppp accounting l2tp
>  ppp multilink
> !
> router ospf 1
>  router-id 202.xxx.xxx.xxx
>  log-adjacency-changes
>  redistribute connected subnets
>  redistribute static subnets
>  passive-interface FastEthernet2/0
>  passive-interface FastEthernet2/0.1027
>  passive-interface FastEthernet2/0.1028
>  network 202.xxx.xxx.xxx 0.0.0.255 area 0.0.0.0
> !
> ip local pool default xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
> ip classless
> ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
> ip route xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx FastEthernet1/0
> no ip http server
> !
> !
> access-list 110 permit ip any any
> no cdp run
> ipv6 route xxx.xxx.xxx.xxx 48 FastEthernet1/0
> ipv6 route ::/0 xxx.xxx.xxx.xxx
> !
> snmp-server community public RO 99
> snmp-server location Equinix Sydney
> snmp-server contact xxx.xxx.xxx.xxx
> snmp-server chassis-id lns1.c7206
> snmp-server enable traps tty
> !
> !
> radius-server configure-nas
> radius-server host xxx.xxx.xxx.xxx auth-port 1645 acct-port 1646
> radius-server retransmit 3
> radius-server key xxxxxxxxxxx
> radius-server authorization permit missing Service-Type
> radius-server vsa send accounting
> radius-server vsa send authentication
> no call rsvp-sync
> !
> !
> mgcp profile default
> !
> dial-peer cor custom
> !
> !
> !
> !
> gatekeeper
> shutdown
> !
> !
> line con 0
>  stopbits 1
> line aux 0
>  stopbits 1
> line vty 0 4
> !
> ntp clock-period 17179650
> ntp master 4
> ntp server 192.189.54.17
> ntp server 202.47.112.1
> ntp server 192.189.54.65
> !
> 
> 
> Thanks
> 
> 
> Sam
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/



Erik Versaevel

From narmaw at pertamina-ep.com  Fri Jun 12 03:35:54 2009
From: narmaw at pertamina-ep.com (Narma Wahyuadi)
Date: Fri, 12 Jun 2009 14:35:54 +0700
Subject: [c-nsp] cisco router for internet
Message-ID: <002801c9eb30$6c62c660$45285320$@com>

Could cisco router 2800 series work under BGP protocol for internet ?

 

thx


_____________________________________________________________________

Note: The information contained in this e-mail is intended only for the use of the individual or entity named above and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended party to receive the message and its attachment(s), you are hereby notified that any dissemination, distribution or copy of the message is strictly prohibited. Please immediately notify the sender and delete the message as soon as possible. Thank you for kind attention.
 
Catatan: Informasi yang terdapat dalam e-mail ini ditujukan hanya untuk penggunaan individu atau kelompok yang disebutkan di atas dan mungkin berisi informasi yang istimewa, rahasia dan dikecualikan dari pengungkapan menurut hukum yang berlaku. Jika Anda bukan pihak yang ditujukan untuk menerima pesan ini beserta lampirannya, dengan ini Anda diberitahukan bahwa penyebaran, pendistribusian atau penyalinan pesan ini adalah sangat dilarang. Harap segera memberitahu pengirim dan menghapus pesan ini secepatnya. Terima kasih atas perhatian Anda.

From Skeeve at eintellego.net  Fri Jun 12 04:54:06 2009
From: Skeeve at eintellego.net (Skeeve Stevens)
Date: Fri, 12 Jun 2009 18:54:06 +1000
Subject: [c-nsp] cisco router for internet
In-Reply-To: <002801c9eb30$6c62c660$45285320$@com>
References: <002801c9eb30$6c62c660$45285320$@com>
Message-ID: <292AF25E62B8894C921B893B53A19D97394469E4E3@BUSINESSEX.business.ad>

Yes... just not fast, but if you run a 2821/2852 with a gig of Ram, it can do multiple tables quite fine, it just takes a little while to fully load all the routes.

A 2811 with 768 will also be fine.  I wouldn't try a 2801... even with 512 it will be slow.

...Skeeve

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
--
NOC, NOC, who's there?


> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Narma Wahyuadi
> Sent: Friday, 12 June 2009 5:36 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] cisco router for internet
>
> Could cisco router 2800 series work under BGP protocol for internet ?
>
>
>
> thx
>
>
> _____________________________________________________________________
>
> Note: The information contained in this e-mail is intended only for the
> use of the individual or entity named above and may contain information
> that is privileged, confidential and exempt from disclosure under
> applicable law. If you are not the intended party to receive the
> message and its attachment(s), you are hereby notified that any
> dissemination, distribution or copy of the message is strictly
> prohibited. Please immediately notify the sender and delete the message
> as soon as possible. Thank you for kind attention.
>
> Catatan: Informasi yang terdapat dalam e-mail ini ditujukan hanya untuk
> penggunaan individu atau kelompok yang disebutkan di atas dan mungkin
> berisi informasi yang istimewa, rahasia dan dikecualikan dari
> pengungkapan menurut hukum yang berlaku. Jika Anda bukan pihak yang
> ditujukan untuk menerima pesan ini beserta lampirannya, dengan ini Anda
> diberitahukan bahwa penyebaran, pendistribusian atau penyalinan pesan
> ini adalah sangat dilarang. Harap segera memberitahu pengirim dan
> menghapus pesan ini secepatnya. Terima kasih atas perhatian Anda.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From lukasz at bromirski.net  Fri Jun 12 05:18:35 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Fri, 12 Jun 2009 11:18:35 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A31548E.3080501@imperial.ac.uk>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>	<4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk>
Message-ID: <4A321D6B.4000300@bromirski.net>

On 2009-06-11 21:01, Phil Mayers wrote:

>> I would avoid the sup720, the rsp720 has 2x the ram and more
> Obviously it's worth emphasising that the RSP720 is 7600-only, and from
> posts on this list it's still not in general availability I think?

True, the RSP is 7600-only, but only the RSP720-10GE waits for general
availability until 12.2(33)SRE (due to HA issues, NSF/SSO is not yet
supported). RSP720 is available.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From s.ganschow at buelow-masiak.de  Fri Jun 12 05:54:46 2009
From: s.ganschow at buelow-masiak.de (Sebastian Ganschow)
Date: Fri, 12 Jun 2009 11:54:46 +0200
Subject: [c-nsp] clear ip pool
Message-ID: <H0000084006e1e5f.1244800486.bohr.dbmg.de@MHS>

Hi,

we've got our ciscos configured that ip pool configuration is derived 
from our radius servers.

In order to change the ip pool, I change the pool in the radius config. 
But our ciscos are still using the old ip pool. It seems like some 
caching issue.

Is there any way to let the cisco forget the pool information and get it 
again from the radius server?

Thanks in advance

Sebastian



From rwest at zyedge.com  Fri Jun 12 08:25:24 2009
From: rwest at zyedge.com (Ryan West)
Date: Fri, 12 Jun 2009 08:25:24 -0400
Subject: [c-nsp] cisco router for internet
In-Reply-To: <002801c9eb30$6c62c660$45285320$@com>
References: <002801c9eb30$6c62c660$45285320$@com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C531A@zy-ex1.zyedge.local>

Hi.

Depends on what you mean by work.  A 2811 with 512 megs of RAM will handle multiple full feeds ok.  It chugs when they are first sent, but will handle them fine.  The question is really how many routes do you need from your provider.  You may only need a default from one provider and customer routes from the other, in which case the default amount of RAM (256 on the 2811) would be just fine.

Here is a 2811 with two full feeds:

mcrt01#show memory free
                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)
Processor   44D28460   711818144   304454336   407363808   406062736   406201608

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
x.x.x.x         4   174 2221937   39239  8509486    3    0 2w2d       282799
x.x.x.x         4   174   38978   39247  8509486    0    0 3w6d            1
x.x.x.x         4   701 1511250   78488  8509486    0    0 3w6d       281498

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Narma Wahyuadi
Sent: Friday, June 12, 2009 3:36 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] cisco router for internet

Could cisco router 2800 series work under BGP protocol for internet ?

 

thx


_____________________________________________________________________

Note: The information contained in this e-mail is intended only for the use of the individual or entity named above and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended party to receive the message and its attachment(s), you are hereby notified that any dissemination, distribution or copy of the message is strictly prohibited. Please immediately notify the sender and delete the message as soon as possible. Thank you for kind attention.
 
Catatan: Informasi yang terdapat dalam e-mail ini ditujukan hanya untuk penggunaan individu atau kelompok yang disebutkan di atas dan mungkin berisi informasi yang istimewa, rahasia dan dikecualikan dari pengungkapan menurut hukum yang berlaku. Jika Anda bukan pihak yang ditujukan untuk menerima pesan ini beserta lampirannya, dengan ini Anda diberitahukan bahwa penyebaran, pendistribusian atau penyalinan pesan ini adalah sangat dilarang. Harap segera memberitahu pengirim dan menghapus pesan ini secepatnya. Terima kasih atas perhatian Anda.
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From geoff at pendery.net  Fri Jun 12 09:36:25 2009
From: geoff at pendery.net (Geoffrey Pendery)
Date: Fri, 12 Jun 2009 08:36:25 -0500
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
Message-ID: <d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From will at thoughtcrime.net  Fri Jun 12 09:42:11 2009
From: will at thoughtcrime.net (Byrd, William)
Date: Fri, 12 Jun 2009 08:42:11 -0500 (CDT)
Subject: [c-nsp] A question about TACACS+ and controlling command use
Message-ID: <1244814131.v2.mailanyonewebmail-222491@fuse114>

I've done a lot of thinking and searching on this problem and I haven't
been able to figure out any way to solve it. The rest of the Engineers
here have come to the conclusion it just can't be done.

We have a pretty large deployment of Cisco 7200's with the vast majority
being carded out with PA-MC-2T3 cards. Typically a customer will order a
DS1 or several DS1's which will be delivered MLPPP to the customer.

As we do not currently have any automation tools in place to provision or
remove old provisioning for customers we frequently end up in situations
where a technician building or removing a customer has shutdown a DS3 and
taken down a lot of customers.

The obvious answer is to restrict the use of the shutdown command.
Unfortunately the technicians that often make the mistakes have to be able
to use the command to shut down Serial or Ethernet interfaces in the
course of their work.

As TACACS is setup to basically permit or deny the use of the command I
can't find a way to restrict it on say a T3 controller but permit it for
everything else; example:

        cmd = no
                {
                        permit ^shutdown.<cr>$
                        deny .*

        cmd = shutdown
                {
                        permit .*
                }

Anyone ever deal with a similar problem and find a good solution to it?

-Will

From BBlackford at nwresd.k12.or.us  Fri Jun 12 09:51:17 2009
From: BBlackford at nwresd.k12.or.us (Bill Blackford)
Date: Fri, 12 Jun 2009 06:51:17 -0700
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
Message-ID: <6069A203FD01884885C037F81DD7508016CE1890F4@wsc-mail-01.intra.nwresd.k12.or.us>

Your question is one of mine as well. I plan to from EC's across the 6548 and a 6516-GBIC (yes copper and fiber).

So does this essentially mean that every 6 ports has its own gig ASIC? So, I'd have to stagger like: 1/1, 1/7, 1/13, etc.?

Now, if what you're reporting is correct (I'm sure it is), then I'm not getting much more benefit going with the 6548. I know I can only get a standard MTU with this line card as well. I could consider the 6148A if I really wanted jumbo's, but that's not very high on my list of wants. The 6748 is out of budget range at this time unfortunately.

Thanks for your input.

-b

-----Original Message-----
From: gpendery at gmail.com [mailto:gpendery at gmail.com] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 6:36 AM
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From Ian.Mackinnon at lumison.net  Fri Jun 12 09:54:01 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Fri, 12 Jun 2009 14:54:01 +0100
Subject: [c-nsp] A question about TACACS+ and controlling command use
In-Reply-To: <1244814131.v2.mailanyonewebmail-222491@fuse114>
References: <1244814131.v2.mailanyonewebmail-222491@fuse114>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D9444FD4@nbg01-exch-01.entlstaff.domain.lumison.net>

Don't know if this would work, but why not bar them from the controller command instead
Ie
Conf t
Controller T3 1/0 -----Block this command
shut

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Byrd, William
> Sent: 12 June 2009 14:42
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] A question about TACACS+ and controlling command use
>
> I've done a lot of thinking and searching on this problem and I haven't
> been able to figure out any way to solve it. The rest of the Engineers
> here have come to the conclusion it just can't be done.
>
> We have a pretty large deployment of Cisco 7200's with the vast
> majority
> being carded out with PA-MC-2T3 cards. Typically a customer will order
> a
> DS1 or several DS1's which will be delivered MLPPP to the customer.
>
> As we do not currently have any automation tools in place to provision
> or
> remove old provisioning for customers we frequently end up in
> situations
> where a technician building or removing a customer has shutdown a DS3
> and
> taken down a lot of customers.
>
> The obvious answer is to restrict the use of the shutdown command.
> Unfortunately the technicians that often make the mistakes have to be
> able
> to use the command to shut down Serial or Ethernet interfaces in the
> course of their work.
>
> As TACACS is setup to basically permit or deny the use of the command I
> can't find a way to restrict it on say a T3 controller but permit it
> for
> everything else; example:
>
>         cmd = no
>                 {
>                         permit ^shutdown.<cr>$
>                         deny .*
>
>         cmd = shutdown
>                 {
>                         permit .*
>                 }
>
> Anyone ever deal with a similar problem and find a good solution to it?
>
> -Will
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From will at thoughtcrime.net  Fri Jun 12 09:56:56 2009
From: will at thoughtcrime.net (Byrd, William)
Date: Fri, 12 Jun 2009 08:56:56 -0500 (CDT)
Subject: [c-nsp] A question about TACACS+ and controlling command use
Message-ID: <1244815016.v2.mailanyonewebmail-222491@fuse113>

Unfortunately since they need access to build channel-groups for customer
DS1 transport this isn't an option. :-(

-Will

----- Original Message -----
From: "Ian MacKinnon" <ian.mackinnon at lumison.net>
Sent: Fri, June 12, 2009 9:54
Subject:RE: [c-nsp] A question about TACACS+ and controlling command use


Don't know if this would work, but why not bar them from the controller
command instead
Ie
Conf t
Controller T3 1/0 -----Block this command
shut

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Byrd, William
> Sent: 12 June 2009 14:42
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] A question about TACACS+ and controlling command use
>
> I've done a lot of thinking and searching on this problem and I haven't
> been able to figure out any way to solve it. The rest of the Engineers
> here have come to the conclusion it just can't be done.
>
> We have a pretty large deployment of Cisco 7200's with the vast
> majority
> being carded out with PA-MC-2T3 cards. Typically a customer will order
> a
> DS1 or several DS1's which will be delivered MLPPP to the customer.
>
> As we do not currently have any automation tools in place to provision
> or
> remove old provisioning for customers we frequently end up in
> situations
> where a technician building or removing a customer has shutdown a DS3
> and
> taken down a lot of customers.
>
> The obvious answer is to restrict the use of the shutdown command.
> Unfortunately the technicians that often make the mistakes have to be
> able
> to use the command to shut down Serial or Ethernet interfaces in the
> course of their work.
>
> As TACACS is setup to basically permit or deny the use of the command I
> can't find a way to restrict it on say a T3 controller but permit it
> for
> everything else; example:
>
>         cmd = no
>                 {
>                         permit ^shutdown.<cr>$
>                         deny .*
>
>         cmd = shutdown
>                 {
>                         permit .*
>                 }
>
> Anyone ever deal with a similar problem and find a good solution to it?
>
> -Will
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.



----- End of original message -----


From jared at puck.nether.net  Fri Jun 12 11:33:23 2009
From: jared at puck.nether.net (Jared Mauch)
Date: Fri, 12 Jun 2009 11:33:23 -0400
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <6069A203FD01884885C037F81DD7508016CE1890F4@wsc-mail-01.intra.nwresd.k12.or.us>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<6069A203FD01884885C037F81DD7508016CE1890F4@wsc-mail-01.intra.nwresd.k12.or.us>
Message-ID: <E0495A97-0849-4941-84F2-DD728D39D28D@puck.nether.net>


On Jun 12, 2009, at 9:51 AM, Bill Blackford wrote:

> Your question is one of mine as well. I plan to from EC's across the  
> 6548 and a 6516-GBIC (yes copper and fiber).
>
> So does this essentially mean that every 6 ports has its own gig  
> ASIC? So, I'd have to stagger like: 1/1, 1/7, 1/13, etc.?

You can see the port ASIC mapping with the following command: (note  
the 1-12 or 1-8 grouping)

Router#show interfaces f3/1 capabilities
FastEthernet3/1
   Dot1x:                 yes
   Model:                 WS-X6348-RJ-45
   Type:                  10/100BaseTX
   Speed:                 10,100,auto
   Duplex:                half,full
   Trunk encap. type:     802.1Q,ISL
   Trunk mode:            on,off,desirable,nonegotiate
   Channel:               yes
   Broadcast suppression: percentage(0-100)
   Flowcontrol:           rx-(off,on),tx-(none)
   Membership:            static
   Fast Start:            yes
   QOS scheduling:        rx-(1q4t), tx-(2q2t)
   CoS rewrite:           yes
   ToS rewrite:           yes
   Inline power:          no
   SPAN:                  source/destination
   UDLD                   yes
   Link Debounce:         yes
   Link Debounce Time:    no
   Ports on ASIC:         1-12
   Port-Security:         yes

Router#sh int g1/1 cap
GigabitEthernet1/1
   Model:                 WS-X6416-GBIC
   Type:                  1000BaseSX
   Speed:                 1000
   Duplex:                full
   Trunk encap. type:     802.1Q,ISL
   Trunk mode:            on,off,desirable,nonegotiate
   Channel:               yes
   Broadcast suppression: percentage(0-100)
   Flowcontrol:           rx-(off,on,desired),tx-(off,on,desired)
   Membership:            static
   Fast Start:            yes
   QOS scheduling:        rx-(1p1q4t), tx-(1p2q2t)
   QOS queueing mode:     rx-(cos), tx-(cos)
   CoS rewrite:           yes
   ToS rewrite:           yes
   Inline power:          no
   SPAN:                  source/destination
   UDLD                   yes
   Link Debounce:         yes
   Link Debounce Time:    yes
   Ports on ASIC:         1-8
   Remote switch uplink:  yes
   Dot1x:                 yes
   Port-Security:         yes


From kloch at kl.net  Fri Jun 12 11:42:45 2009
From: kloch at kl.net (Kevin Loch)
Date: Fri, 12 Jun 2009 11:42:45 -0400
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A31548E.3080501@imperial.ac.uk>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
Message-ID: <4A327775.8050800@kl.net>

Phil Mayers wrote:
> Kevin Loch wrote:
> 
>>>
>>> Unfortunately, Cisco's partners are useless.  They propose 6509s 
>>> without the DFCs, which we know will fall over.  
>>
>> Well that depends...
>>
>> The DFC's only do next-hop (tcam) lookups and netflow.  All packets are
>> switched on the centralized PFC.  Each line card has two 20Gbit/s
> 
> ?ukasz has already addressed this; suffice to say he's right, and the 
> above is not correct. A TCAM lookup *is* the forwarding operation, and 
> the DFC has all information required locally to switch the packet (via 
> the fabric) to the output linecard, and does so.

After re-reading this:

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd80673385.html

I shouldn't have said PFC. The fabric is on the supervisor card itself
not the PFC.  What I meant was the packet is always sent to the
centralized switch fabric on the active supervisor card regardless of
where the lookups/acl are done.

The important point is that the lookup limitations (mpps) are
different than the fabric bandwidth limitations (gbps) because of how
these functions are separated on the cef720/dcef720 platform.

A 6509 should not "fall over without DFC's" unless you are doing more
than 30mpps.  That is 15gbit/s of 64 byte packets or 360gbit/s of
1500 byte packets.

- Kevin

From petelists at templin.org  Fri Jun 12 11:34:14 2009
From: petelists at templin.org (Pete Templin)
Date: Fri, 12 Jun 2009 10:34:14 -0500
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
Message-ID: <4A327576.4040004@templin.org>

Geoffrey Pendery wrote:

> I have a question of my own, since this subject has come up a time or
>  two - regarding the 6148's, the statement is made a couple times
> that Etherchannel will get you port redundancy but no extra
> bandwidth, since the ASIC is only a gig.  But if I distribute my
> channel across two slots, say Gig 1/1 and Gig 2/1, does that get me
> around the gig limit?  Or even Gig 1/1 and Gig 1/48, since it's
> separate ASICs? Logic tells me yes, but I've heard the "1 gig limit"
> mentioned as if it's a hard platform limitation, not just a result of
> a particular bottleneck.  My instinctive behavior with channels is to
> span them across blades anyway, to guard against blade failure....

My understanding (since my google-fu won't find a quickie answer at the 
moment) is that 6148s copy any EtherChannel frames to every ASIC on the 
card, so you can get to 2G by spreading over two cards, but you're still 
limited to 1G no matter no many controllers you cover within a 6148.  :(

We've updated the banners on all relevant 6148-loaded chassis to remind 
folks to never build EtherChannels on those cards.  Oh well...

pt

From Jeff.Wojciechowski at midlandpaper.com  Fri Jun 12 12:07:23 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Fri, 12 Jun 2009 11:07:23 -0500
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AED808@XBOX.midlandpaper.com>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
	<6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5305@zy-ex1.zyedge.local>
	<6B8401A83219DF499C34DEAEE9A599921015AED808@XBOX.midlandpaper.com>
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AED811@XBOX.midlandpaper.com>

OK - found the REAL issue now.

My standby unit turned into a brick on me :o) I actually SAW it happen. All the link lights went out at once.

Thanks again for the help.

-Jeff

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
Sent: Thursday, June 11, 2009 4:24 PM
To: Ryan West
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] ASA 5510 Configuration Replication Failure

Ryan -

Solved... for now at least...

Still using straight thru cable for synch interface I upgraded to 8.21 - based on the following bug IDs:

CSCsu88174
CSCsw98373
CSCsy21727
CSCsz63217

For the record the sh run | inc fail:

failover lan unit primary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.20.20.6 255.255.255.0 standby 172.20.20.7

and 

failover lan unit secondary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.20.20.6 255.255.255.0 standby 172.20.20.7

Thanks again,

-Jeff


-----Original Message-----
From: Ryan West [mailto:rwest at zyedge.com] 
Sent: Thursday, June 11, 2009 4:17 PM
To: Jeff Wojciechowski
Cc: cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Have you tried a crossover?  Can you post 'show run failover' ?  A console on the standby firewall might reveal something during the replication process too.

-ryan


<snipped>

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From ip at ioshints.info  Fri Jun 12 12:36:42 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Fri, 12 Jun 2009 18:36:42 +0200
Subject: [c-nsp] A question about TACACS+ and controlling command use
In-Reply-To: <1244814131.v2.mailanyonewebmail-222491@fuse114>
References: <1244814131.v2.mailanyonewebmail-222491@fuse114>
Message-ID: <001201c9eb7b$f89db680$0a00000a@nil.si>

> The obvious answer is to restrict the use of the shutdown command.
> Unfortunately the technicians that often make the mistakes 
> have to be able to use the command to shut down Serial or 
> Ethernet interfaces in the course of their work.

Something along the lines of this EEM Tcl policies:

http://wiki.nil.com/Display_configuration_sections_while_configuring_the_rou
ter

Write one Tcl policy that recognizes the interface name and saves it with
appl_setinfo. The other Tcl policy should recognize the "shutdown" command,
retrieve the saved interface name and check it.

Not too elegant, but working.

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


From mulitskiy at acedsl.com  Fri Jun 12 12:46:01 2009
From: mulitskiy at acedsl.com (Michael Ulitskiy)
Date: Fri, 12 Jun 2009 12:46:01 -0400
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <4A327576.4040004@templin.org>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<4A327576.4040004@templin.org>
Message-ID: <200906121246.01415.mulitskiy@acedsl.com>

On Friday 12 June 2009 11:34:14 am Pete Templin wrote:
> Geoffrey Pendery wrote:
> 
> > I have a question of my own, since this subject has come up a time or
> >  two - regarding the 6148's, the statement is made a couple times
> > that Etherchannel will get you port redundancy but no extra
> > bandwidth, since the ASIC is only a gig.  But if I distribute my
> > channel across two slots, say Gig 1/1 and Gig 2/1, does that get me
> > around the gig limit?  Or even Gig 1/1 and Gig 1/48, since it's
> > separate ASICs? Logic tells me yes, but I've heard the "1 gig limit"
> > mentioned as if it's a hard platform limitation, not just a result of
> > a particular bottleneck.  My instinctive behavior with channels is to
> > span them across blades anyway, to guard against blade failure....
> 
> My understanding (since my google-fu won't find a quickie answer at the 
> moment) is that 6148s copy any EtherChannel frames to every ASIC on the 
> card, so you can get to 2G by spreading over two cards, but you're still 
> limited to 1G no matter no many controllers you cover within a 6148.  :(
> 
> We've updated the banners on all relevant 6148-loaded chassis to remind 
> folks to never build EtherChannels on those cards.  Oh well...

My understanding was that every EtherChannel frame is delivered (by Sup) to every
ASIC involved (has a port) in EtherChannel regardless of which card it is on.
So you can't get more than 1G even if you distribute your EtherChannel over several cards.
Am I wrong?

Michael

From tstevens at cisco.com  Fri Jun 12 14:22:00 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Fri, 12 Jun 2009 11:22:00 -0700
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <200906121246.01415.mulitskiy@acedsl.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<4A327576.4040004@templin.org>
	<200906121246.01415.mulitskiy@acedsl.com>
Message-ID: <200906121822.n5CIM8vC018410@sj-core-2.cisco.com>

You are correct. That only applies to the 6148. Originally it also 
applied to the 6548 as well, but that limitation was removed later by 
s/w optimizations in the LTL programming scheme. So you *can* get 
more than 1G thru an etherchannel with 6548s, but of course, you 
still can only get 1G max thru a given port group on the card.

All the other restrictions of the 6148 (eg, no jumbos) still apply to 6548.

HTH,
Tim


At 09:46 AM 6/12/2009, Michael Ulitskiy muttered:

>On Friday 12 June 2009 11:34:14 am Pete Templin wrote:
> > Geoffrey Pendery wrote:
> >
> > > I have a question of my own, since this subject has come up a time or
> > >  two - regarding the 6148's, the statement is made a couple times
> > > that Etherchannel will get you port redundancy but no extra
> > > bandwidth, since the ASIC is only a gig.  But if I distribute my
> > > channel across two slots, say Gig 1/1 and Gig 2/1, does that get me
> > > around the gig limit?  Or even Gig 1/1 and Gig 1/48, since it's
> > > separate ASICs? Logic tells me yes, but I've heard the "1 gig limit"
> > > mentioned as if it's a hard platform limitation, not just a result of
> > > a particular bottleneck.  My instinctive behavior with channels is to
> > > span them across blades anyway, to guard against blade failure....
> >
> > My understanding (since my google-fu won't find a quickie answer at the
> > moment) is that 6148s copy any EtherChannel frames to every ASIC on the
> > card, so you can get to 2G by spreading over two cards, but you're still
> > limited to 1G no matter no many controllers you cover within a 6148.  :(
> >
> > We've updated the banners on all relevant 6148-loaded chassis to remind
> > folks to never build EtherChannels on those cards.  Oh well...
>
>My understanding was that every EtherChannel frame is delivered (by 
>Sup) to every
>ASIC involved (has a port) in EtherChannel regardless of which card it is on.
>So you can't get more than 1G even if you distribute your 
>EtherChannel over several cards.
>Am I wrong?
>
>Michael
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
><https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at 
><http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From jrhett at netconsonance.com  Fri Jun 12 15:58:36 2009
From: jrhett at netconsonance.com (Jo Rhett)
Date: Fri, 12 Jun 2009 12:58:36 -0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A327775.8050800@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
Message-ID: <AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>

On Jun 12, 2009, at 8:42 AM, Kevin Loch wrote:
>> ?ukasz has already addressed this; suffice to say he's right, and  
>> the above is not correct. A TCAM lookup *is* the forwarding  
>> operation, and the DFC has all information required locally to  
>> switch the packet (via the fabric) to the output linecard, and does  
>> so.
>
> I shouldn't have said PFC. The fabric is on the supervisor card itself
> not the PFC.  What I meant was the packet is always sent to the
> centralized switch fabric on the active supervisor card regardless of
> where the lookups/acl are done.

Just for information, I know very intimately how this stuff works and  
don't need you to explain it to me.  I haven't objected yet because  
others might find this interesting.  (and FYI, your last sentence is  
wrong too if DFCs exist on each card)

> The important point is that the lookup limitations (mpps) are
> different than the fabric bandwidth limitations (gbps) because of how
> these functions are separated on the cef720/dcef720 platform.
>
> A 6509 should not "fall over without DFC's" unless you are doing more
> than 30mpps.  That is 15gbit/s of 64 byte packets or 360gbit/s of
> 1500 byte packets.


Sorry, let me back up and explain again.  I've been dealing with Cisco  
for 20 years now.   And I very well know Cisco's ability to super- 
inflate their packet handling ability.  And specifically, I have run  
6509 systems into the ground with a mere 500mb/sec of traffic.

Their whole MPPS statistics are based on perfect-world scenarios that  
don't exist.  And honestly, I have on 5 different occasions had the  
opportunity to push Cisco to prove those numbers, and they have failed  
to do so IN A LAB THEY DESIGNED JUST TO DO SO.

So ... yeah.   Don't go believing those statistics.

Now let's talk about reality: 1/10 inbound/outbound ratios, 5% of  
received traffic is Internet cruft requiring (wasted) TCAM lookups,  
etc and such forth than any provider peering router observes, and  
you're down to a much lower ratio.  Fail to install DFCs and you'll  
find your 6509s falling over with just a few gigabits of traffic.    
30mpps versus 48mpps gives an illusion that DFCs only give you another  
50%, but that's not reality on the ground.  Don't try and persuade me  
otherwise, I've seen this repeatedly in real life environments.

Now, let's stop talking about non-DFC cards and start talking about  
equipment which can handle uRPF on every port, full Netflow analysis  
of up to 8 ports at a time, every port layer 3, every port filtered,  
colo facility core/peering.

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness




From ross at kallisti.us  Fri Jun 12 16:52:02 2009
From: ross at kallisti.us (Ross Vandegrift)
Date: Fri, 12 Jun 2009 16:52:02 -0400
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A327775.8050800@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
Message-ID: <20090612205202.GC10390@kallisti.us>

On Fri, Jun 12, 2009 at 11:42:45AM -0400, Kevin Loch wrote:
> A 6509 should not "fall over without DFC's" unless you are doing more
> than 30mpps.  That is 15gbit/s of 64 byte packets or 360gbit/s of
> 1500 byte packets.

Hah, keep drinking the cool aid!  I have a pair of 6500s ready to fall
over at about 150kpps.  All WS-67xx LAN cards with DFCs.  CPU averages
60% and often maxes.  TAC says that this is within the parameters of
normal performance given the role as datacenter aggregation routers.

No netflow, no uRPF, no multicast, no IPv6, no BFD, no MPLS, no ACLs
in the forwarding plane.  Very basic OSPF, BGP, and MSTP.  About 2000
VLANs, 80% of which have associated layer 3 SVIs.

On the other hand, I have other 6500s with identical hardware
inventory and almost identical config where performance is a complete
non-issue.  I've seen a 6500 in a near-optimal situation switch
2-3Mpps.  I'll believe 30Mpps when I see a 7200 NPE-G1 hit 1Mpps :)

-- 
Ross Vandegrift
ross at kallisti.us

"If the fight gets hot, the songs get hotter.  If the going gets tough,
the songs get tougher."
	--Woody Guthrie

From scubacuda at gmail.com  Fri Jun 12 17:09:54 2009
From: scubacuda at gmail.com (Rogelio)
Date: Fri, 12 Jun 2009 14:09:54 -0700
Subject: [c-nsp] LACP + Wi-Fi = ghettofabulous big wireless pipes?
Message-ID: <4A32C422.6030509@gmail.com>

I've got several outdoor Wi-Fi radios that I would like to configure in 
a PtP configuration on multiple 802.11a channels.

My question to the list is, "Can I use LACP on each end (via a network 
switch) to aggregate those PtP connections into one virtual connection?"

e.g.

http://www.cisco.com/en/US/tech/tk389/tk213/technologies_configuration_example09186a0080094470.shtml

So, instead of using ethernet to each switch, I'm connecting an ethernet 
cable from my switch into the 100 Mbps LIM of the radio node, creating a 
PtP link across an area, then coming out that other radio's 100 Mbps LIM 
via ethernet into another LACP-friendly switch.

So, on each port, there is something like...

switch->ethernet->radio-> 5 GHz PtP link->radio->ethernet->switch

Any feedback on this?

From peter at rathlev.dk  Fri Jun 12 18:03:13 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Sat, 13 Jun 2009 00:03:13 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
Message-ID: <1244844193.9252.17.camel@localhost.localdomain>

On Fri, 2009-06-12 at 12:58 -0700, Jo Rhett wrote:
> Now let's talk about reality: 1/10 inbound/outbound ratios, 5% of  
> received traffic is Internet cruft requiring (wasted) TCAM lookups,  
> etc and such forth than any provider peering router observes, and  
> you're down to a much lower ratio.  Fail to install DFCs and you'll  
> find your 6509s falling over with just a few gigabits of traffic.    
> 30mpps versus 48mpps gives an illusion that DFCs only give you another  
> 50%, but that's not reality on the ground.  Don't try and persuade me  
> otherwise, I've seen this repeatedly in real life environments.

I tend to agree with this (and your points generally btw), especially
when looking carefully at the subject of this thread. I'd still say "it
depends" though. Sometimes a non DFC enabled box would do the job fine.
It's (mostly) not like the box dies doing nothing. :-)

I would even suspect that many C6k/Sup720s are probably using very
little of their capacity. It's targeted at the enterprise, and I've seen
3BXL boxes in 6 node networks with ~ 50 prefixes in OSPF and nothing
else. I would therefore say that _sometimes_ someone from Cisco or a
partner might upsell a little.

The people that are genuinely worried about the performance would also
know what to do about it and where to look for alternatives.

> Now, let's stop talking about non-DFC cards and start talking about  
> equipment which can handle uRPF on every port, full Netflow analysis  
> of up to 8 ports at a time, every port layer 3, every port filtered,  
> colo facility core/peering.

If this is the target then 6500/7600 isn't really the best tool IMHO.

Regards,
Peter



From irsk.inc at gmail.com  Fri Jun 12 18:20:10 2009
From: irsk.inc at gmail.com (Rishi Kochar)
Date: Fri, 12 Jun 2009 17:20:10 -0500
Subject: [c-nsp] EEM - action syslog working but action cli command working
In-Reply-To: <744b72620906121505o673e2e3cu57dbd973941c2f58@mail.gmail.com>
References: <744b72620906121505o673e2e3cu57dbd973941c2f58@mail.gmail.com>
Message-ID: <744b72620906121520i7c74feb6g5cea15d4a7dfd409@mail.gmail.com>

Hi

I am trying to develop a small EEM applet to test shut a port when an event
on the port occurs.

The script i have written is
event manager applet EMSHUT
event syslog occurs 1 pattern <my pattern>
action 1.0 syslog priority emergencies msg "HELLO"
action 1.1 cli command "enable"
action 1.2 cli command "conf t"
action 1.3 cli command "voice-port 0/1/1"
action 1.4 cli command "shut"


This script is printing HELLO in syslogs but wont shut down the voice-port.

Any help on this will be highly appreciated

Thanks
Inder

From tom at netspot.com.au  Fri Jun 12 22:27:53 2009
From: tom at netspot.com.au (Tom Lanyon)
Date: Sat, 13 Jun 2009 11:57:53 +0930
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <1244844193.9252.17.camel@localhost.localdomain>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
Message-ID: <A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>


On 13/06/2009, at 7:33 AM, Peter Rathlev wrote:
>> Now, let's stop talking about non-DFC cards and start talking about
>> equipment which can handle uRPF on every port, full Netflow analysis
>> of up to 8 ports at a time, every port layer 3, every port filtered,
>> colo facility core/peering.
>
> If this is the target then 6500/7600 isn't really the best tool IMHO.


Was the original intention of this thread not to find out exactly what  
*is* the best tool for the above scenario? :)

Regards,
Tom

From rdobbins at arbor.net  Fri Jun 12 23:40:11 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Sat, 13 Jun 2009 10:40:11 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090612205202.GC10390@kallisti.us>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net> <20090612205202.GC10390@kallisti.us>
Message-ID: <6C53A0D1-AD1F-4365-9125-3EDBA1EB64AC@arbor.net>


On Jun 13, 2009, at 3:52 AM, Ross Vandegrift wrote:

>  I have a pair of 6500s ready to fall over at about 150kpps.


It sounds as if you've a lot of stuff being punted, which should bear  
further investigation.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From rdobbins at arbor.net  Fri Jun 12 23:43:51 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Sat, 13 Jun 2009 10:43:51 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
	<A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
Message-ID: <FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>


On Jun 13, 2009, at 9:27 AM, Tom Lanyon wrote:

> Was the original intention of this thread not to find out exactly  
> what *is* the best tool for the above scenario? :)

GSR w/E3 or E5 LCs, ASR 1K, CRS-1, or N7K, depending upon the  
circumstances (note initial FIB-size limitation on N7K; I don't know  
if newer hardware has yet been introduced which raises this ceiling,  
Tim or someone else with clue will surely clarify).

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From ip at ioshints.info  Sat Jun 13 01:21:07 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Sat, 13 Jun 2009 07:21:07 +0200
Subject: [c-nsp] EEM - action syslog working but action cli command
	working
In-Reply-To: <744b72620906121520i7c74feb6g5cea15d4a7dfd409@mail.gmail.com>
References: <744b72620906121505o673e2e3cu57dbd973941c2f58@mail.gmail.com>
	<744b72620906121520i7c74feb6g5cea15d4a7dfd409@mail.gmail.com>
Message-ID: <005901c9ebe6$c21e4960$0a00000a@nil.si>

Could be yet another prompt-related EEM bug. See

http://blog.ioshints.info/2008/02/fix-bugs-in-eem-action-cli.html
http://blog.ioshints.info/2007/12/execute-cli-commands-with-prompts-in.html
 
Use the EEM debugging (debug event man action cli) to verify what's going
on.

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/

> -----Original Message-----
> From: Rishi Kochar [mailto:irsk.inc at gmail.com] 
> Sent: Saturday, June 13, 2009 12:20 AM
> To: cisco-nsp
> Subject: [c-nsp] EEM - action syslog working but action cli 
> command working
> 
> Hi
> 
> I am trying to develop a small EEM applet to test shut a port 
> when an event on the port occurs.
> 
> The script i have written is
> event manager applet EMSHUT
> event syslog occurs 1 pattern <my pattern> action 1.0 syslog 
> priority emergencies msg "HELLO"
> action 1.1 cli command "enable"
> action 1.2 cli command "conf t"
> action 1.3 cli command "voice-port 0/1/1"
> action 1.4 cli command "shut"
> 
> 
> This script is printing HELLO in syslogs but wont shut down 
> the voice-port.
> 
> Any help on this will be highly appreciated
> 
> Thanks
> Inder
> 
> 


From jrhett at netconsonance.com  Sat Jun 13 01:34:11 2009
From: jrhett at netconsonance.com (Jo Rhett)
Date: Fri, 12 Jun 2009 22:34:11 -0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <1244844193.9252.17.camel@localhost.localdomain>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
Message-ID: <F6821C62-A9D5-4B89-81BB-A20ABB516CA5@netconsonance.com>

>> Now, let's stop talking about non-DFC cards and start talking about
>> equipment which can handle uRPF on every port, full Netflow analysis
>> of up to 8 ports at a time, every port layer 3, every port filtered,
>> colo facility core/peering.

On Jun 12, 2009, at 3:03 PM, Peter Rathlev wrote:
> If this is the target then 6500/7600 isn't really the best tool IMHO.


I suspected as much.  Honestly, I'm aiming for an MX480 ;-)  But I  
need to determine the comparable Cisco product(s) and get them listed  
on the comparison sheet.

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness




From lukasz at bromirski.net  Sat Jun 13 07:20:35 2009
From: lukasz at bromirski.net (=?ISO-8859-2?Q?=A3ukasz_Bromirski?=)
Date: Sat, 13 Jun 2009 13:20:35 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090612205202.GC10390@kallisti.us>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>	<4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk>	<4A327775.8050800@kl.net>
	<20090612205202.GC10390@kallisti.us>
Message-ID: <4A338B83.2010405@bromirski.net>

On 2009-06-12 22:52, Ross Vandegrift wrote:

> No netflow, no uRPF, no multicast, no IPv6, no BFD, no MPLS, no ACLs
> in the forwarding plane.  Very basic OSPF, BGP, and MSTP.  About 2000
> VLANs, 80% of which have associated layer 3 SVIs.

Something is killing the CPU with that config though, just as Roland
remarked. You should escalate that with TAC, or use CoPP to lower the
load RP is taking and look for root cause.

> On the other hand, I have other 6500s with identical hardware
> inventory and almost identical config where performance is a complete
> non-issue.  I've seen a 6500 in a near-optimal situation switch
> 2-3Mpps.  I'll believe 30Mpps when I see a 7200 NPE-G1 hit 1Mpps :)

A couple of people on this list claimed they have 6500s doing a
200-300Mpps without a problem, search the archives. I'm logged via SSH
to a 6500 that is doing over 80Mpps right now and load stays at 2-5%,
with ACLs, uRPF, three full BGP feeds and some QoS.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From lukasz at bromirski.net  Sat Jun 13 07:23:13 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sat, 13 Jun 2009 13:23:13 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A327775.8050800@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>	<4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk> <4A327775.8050800@kl.net>
Message-ID: <4A338C21.1010604@bromirski.net>

On 2009-06-12 17:42, Kevin Loch wrote:

> A 6509 should not "fall over without DFC's" unless you are doing more
> than 30mpps. That is 15gbit/s of 64 byte packets or 360gbit/s of
> 1500 byte packets.

It should 'fall over' even if the traffic will rise, and there won't
be enough PFC Mpps to do the work - simply switch fabric channels
will fill up with traffic going to the PFC. Adding DFCs will increase
the performance in terms of pps in that situation - people do this all
the time when their configs top the performance envelope of the current
setup.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From lukasz at bromirski.net  Sat Jun 13 07:49:46 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sat, 13 Jun 2009 13:49:46 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A338C21.1010604@bromirski.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>	<4A313392.60604@kl.net>	<4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net> <4A338C21.1010604@bromirski.net>
Message-ID: <4A33925A.4030700@bromirski.net>

On 2009-06-13 13:23, ?ukasz Bromirski wrote:

> It should 'fall over'

It *shouldn't* of course. My bad :)

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From arla at rn.dk  Sat Jun 13 08:26:11 2009
From: arla at rn.dk (Arne Larsen / Region Nordjylland)
Date: Sat, 13 Jun 2009 14:26:11 +0200
Subject: [c-nsp] vs tacacs+ on Nexus 5010
Message-ID: <8D68760F464FFD40A01BF2FB374E4A28016554CE82BB@SRVEXC02.aas.its.nja.dk>

Hi Folks.

Does anyone off you have a Nexus 5010 running under tacacs+ freeware.
I can't find any doc. regarding the respond the Nexus need to authorize users.
How does one setup restricted users, like a user that only has the permissions to use show commands.
The box users ether plain pap or chap login, does anyone know why this is different from a "normal" Cisco box.

/Arne

From ltd at cisco.com  Sat Jun 13 10:09:04 2009
From: ltd at cisco.com (Lincoln Dale)
Date: Sun, 14 Jun 2009 00:09:04 +1000
Subject: [c-nsp] vs tacacs+ on Nexus 5010
In-Reply-To: <8D68760F464FFD40A01BF2FB374E4A28016554CE82BB@SRVEXC02.aas.its.nja.dk>
References: <8D68760F464FFD40A01BF2FB374E4A28016554CE82BB@SRVEXC02.aas.its.nja.dk>
Message-ID: <4A33B300.9090601@cisco.com>

Arne Larsen / Region Nordjylland wrote:
> Hi Folks.
>
> Does anyone off you have a Nexus 5010 running under tacacs+ freeware.
> I can't find any doc. regarding the respond the Nexus need to authorize users.
> How does one setup restricted users, like a user that only has the permissions to use show commands.
> The box users ether plain pap or chap login, does anyone know why this is different from a "normal" Cisco box.
>   
NX-OS / Nexus platforms use RBAC.
Nexus 7000 documentation shows this, i'm sure N5K docs do too, but i 
have N7K handy.  see 
http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_tacacsplus.html#wp1511744

see 
http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_tacacsplus.html#wp1511711 
for details on how to specify the role using a VSA.


cheers,

lincoln.

From bacon at walleyesoftware.com  Sat Jun 13 17:41:28 2009
From: bacon at walleyesoftware.com (Jeff Bacon)
Date: Sat, 13 Jun 2009 16:41:28 -0500
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <mailman.61.1244822841.2287.cisco-nsp@puck.nether.net>
References: <mailman.61.1244822841.2287.cisco-nsp@puck.nether.net>
Message-ID: <5A69C25361FED34F83ABF05F5047524505CD804E@wally.walleyetrading.net>



> Date: Fri, 12 Jun 2009 06:51:17 -0700
> From: Bill Blackford <BBlackford at nwresd.k12.or.us>
> To: Geoffrey Pendery <geoff at pendery.net>
> Cc: "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>
> Subject: 
> Message-ID:
> 	<6069A203FD01884885C037F81DD7508016CE1890F4 at wsc-mail-
> 01.intra.nwresd.k12.or.us>
> 
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Your question is one of mine as well. I plan to from EC's across the
6548
> and a 6516-GBIC (yes copper and fiber).
> 
> So does this essentially mean that every 6 ports has its own gig ASIC?
So,
> I'd have to stagger like: 1/1, 1/7, 1/13, etc.?
> 
> Now, if what you're reporting is correct (I'm sure it is), then I'm
not
> getting much more benefit going with the 6548. I know I can only get a
> standard MTU with this line card as well. I could consider the 6148A
if I
> really wanted jumbo's, but that's not very high on my list of wants.
The
> 6748 is out of budget range at this time unfortunately.

I had 6548s. I found out about the ASIC limitation by IOS helpfully
telling me when I created the EC "do this and your bandwidth is going to
be limited". 

I read the docs more closely, after a brief bout of kicking self for
attempting to save a buck without reading all of the docs. My helpful
rep at World Data gave me a decent trade on the 6548s, had 6748s there
shortly thereafter, and that was the end of that.  

Yes you could on a 6548 and just stagger your ports and I believe that
will perform fine, assuming you otherwise stay within the card's
limitations (e.g. CEF256/8G fabric ports). 

I would give some thought to the 6816As over the 65116s. They seem to be
quite cheap refurb, and otherwise appear to be excellent cards, for
which DFC-3Bs don't cost a ton more should you care. Only downside I've
seen so far is that switchport vlan mapping applies to all 8 ports on
the fabric port/controller, but there appears to be a theme there
anyway. 

-bacon
Cisco-using dilettante


From jhigham at epri.com  Sat Jun 13 20:16:20 2009
From: jhigham at epri.com (Higham, Josh)
Date: Sat, 13 Jun 2009 17:16:20 -0700
Subject: [c-nsp] 4506 - disconnected ports generating traffic?
Message-ID: <4C3B8C75B5899943AEC675BA6DD4627301DEE5C1@uspalex02.epri.com>

I have a very strange bug and am not getting much from my ticket with
Cisco.  I have a switch that has physically disconnected interfaces that
show as up, are generating traffic (input, plus output drops), and logs
show MAC addresses flapping between these interfaces.  Plugging a cable
in (whether or not there is a device at the other end), in some cases
stopped this from happening.

 

Has anyone run across this or similar behavior?

 

1     6  Sup II+10GE 10GE (X2), 1000BaseX (SFP) WS-X4013+10GE      

 2    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 3    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 4    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 5    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 6    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 

This interface has nothing connected to it, but not the output drops and
input traffic

 

CLT-ACCESS-B2F1-1#sho int g5/27

GigabitEthernet5/27 is up, line protocol is up (connected)

  Hardware is Gigabit Ethernet Port, address is 0023.5e78.744a (bia
0023.5e78.744a)

  MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec, 

     reliability 255/255, txload 229/255, rxload 229/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 100Mb/s, link type is auto, media type is 10/100/1000-TX

  input flow-control is off, output flow-control is off

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input 05:03:57, output never, output hang never

  Last clearing of "show interface" counters 00:02:41

  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops:
59099365

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  30 second input rate 89862000 bits/sec, 45921 packets/sec

  30 second output rate 89862000 bits/sec, 45921 packets/sec

     6696953 packets input, 1638126423 bytes, 0 no buffer

     Received 6696922 broadcasts (88192 multicasts)

     0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 input packets with dribble condition detected

     6696953 packets output, 1638126423 bytes, 0 underruns

 

These two interfaces have nothing connected:

 

.Jun 14 00:11:35.578 UTC: %C4K_EBM-4-HOSTFLAPPING: Host CI:SC:OX:XX:XX
in vlan 4 is flapping between port Gi5/28 and port Gi5/25

 

(the MAC address that is flapping is from the core switch that this
access switch is linked to)

 

Here is the interface configuration:

 

interface GigabitEthernet5/27

 power inline auto max 7900

 switchport access vlan 4

 switchport trunk encapsulation dot1q

 switchport trunk native vlan 4

 switchport trunk allowed vlan 4,25

 switchport mode access

 load-interval 30

 qos trust dscp

 tx-queue 1

   bandwidth percent 25

 tx-queue 2

   bandwidth percent 25

 tx-queue 3

   bandwidth percent 30

   priority high

   shape percent 30

 tx-queue 4

   bandwidth percent 20

 no cdp enable

 

Thanks for any help or thoughts about what to look at or check.

 

Josh Higham


From avayner at cisco.com  Sat Jun 13 23:48:17 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Sun, 14 Jun 2009 05:48:17 +0200
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C492B2@xmb-ams-331.emea.cisco.com>

Geoffrey,

A small correction. The x6548 is an 8G card, but it has 2 fabric connections, so the limit would be 16G.

As long as you do not use the other 7 ports out of each 8 port group, each port group can give you 1G, but take into consideration that the x6148 is a classic card, so it has no fabric connections, and uses the shared bus.

In general the x6148 is not supposed to be a "core" card. It's for connecting low end desktops etc.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 16:36
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From avayner at cisco.com  Sat Jun 13 23:52:14 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Sun, 14 Jun 2009 05:52:14 +0200
Subject: [c-nsp] x6148 vs. x6548
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com> 
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C492B3@xmb-ams-331.emea.cisco.com>

Guys,

Sorry, I pressed the send button to quickly. The 1Gig limit per etherchannel is still there even between slots for the x6148.

Arie

-----Original Message-----
From: Arie Vayner (avayner) 
Sent: Sunday, June 14, 2009 06:48
To: 'Geoffrey Pendery'; Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] x6148 vs. x6548

Geoffrey,

A small correction. The x6548 is an 8G card, but it has 2 fabric connections, so the limit would be 16G.

As long as you do not use the other 7 ports out of each 8 port group, each port group can give you 1G, but take into consideration that the x6148 is a classic card, so it has no fabric connections, and uses the shared bus.

In general the x6148 is not supposed to be a "core" card. It's for connecting low end desktops etc.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 16:36
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From sagupta at cisco.com  Sun Jun 14 00:00:24 2009
From: sagupta at cisco.com (Sachin Gupta (sagupta))
Date: Sat, 13 Jun 2009 21:00:24 -0700
Subject: [c-nsp] x6148 vs. x6548
Message-ID: <55C7D0A26108FD47BFEDF55BCBFAD93C0806E751@xmb-sjc-229.amer.cisco.com>

The 6548 has a single 8G fabric connection.

Sachin

----- Original Message -----
From: cisco-nsp-bounces at puck.nether.net <cisco-nsp-bounces at puck.nether.net>
To: Geoffrey Pendery <geoff at pendery.net>; Bill Blackford <BBlackford at nwresd.k12.or.us>
Cc: cisco-nsp at puck.nether.net <cisco-nsp at puck.nether.net>
Sent: Sat Jun 13 20:48:17 2009
Subject: Re: [c-nsp] x6148 vs. x6548

Geoffrey,

A small correction. The x6548 is an 8G card, but it has 2 fabric connections, so the limit would be 16G.

As long as you do not use the other 7 ports out of each 8 port group, each port group can give you 1G, but take into consideration that the x6148 is a classic card, so it has no fabric connections, and uses the shared bus.

In general the x6148 is not supposed to be a "core" card. It's for connecting low end desktops etc.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 16:36
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From avayner at cisco.com  Sun Jun 14 02:38:14 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Sun, 14 Jun 2009 08:38:14 +0200
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <55C7D0A26108FD47BFEDF55BCBFAD93C0806E751@xmb-sjc-229.amer.cisco.com>
References: <55C7D0A26108FD47BFEDF55BCBFAD93C0806E751@xmb-sjc-229.amer.cisco.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C492D3@xmb-ams-331.emea.cisco.com>

I stand corrected... I have double checked, and I remembered it all wrong (assumed it's like with the 6748...). Only 1x8G.

BTW, if you want to use an etherchannel with one port on a 65XX and another on a 61XX (or another combination of qos-wise incompatible cards) you need to use the following command "no mls qos channel-consistency"

Arie

-----Original Message-----
From: Sachin Gupta (sagupta) 
Sent: Sunday, June 14, 2009 07:00
To: Arie Vayner (avayner); 'geoff at pendery.net'; 'BBlackford at nwresd.k12.or.us'
Cc: 'cisco-nsp at puck.nether.net'
Subject: Re: [c-nsp] x6148 vs. x6548

The 6548 has a single 8G fabric connection.

Sachin

----- Original Message -----
From: cisco-nsp-bounces at puck.nether.net <cisco-nsp-bounces at puck.nether.net>
To: Geoffrey Pendery <geoff at pendery.net>; Bill Blackford <BBlackford at nwresd.k12.or.us>
Cc: cisco-nsp at puck.nether.net <cisco-nsp at puck.nether.net>
Sent: Sat Jun 13 20:48:17 2009
Subject: Re: [c-nsp] x6148 vs. x6548

Geoffrey,

A small correction. The x6548 is an 8G card, but it has 2 fabric connections, so the limit would be 16G.

As long as you do not use the other 7 ports out of each 8 port group, each port group can give you 1G, but take into consideration that the x6148 is a classic card, so it has no fabric connections, and uses the shared bus.

In general the x6148 is not supposed to be a "core" card. It's for connecting low end desktops etc.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 16:36
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From eng_mssk at hotmail.com  Sun Jun 14 10:37:02 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Sun, 14 Jun 2009 17:37:02 +0300
Subject: [c-nsp] port channel overruns
Message-ID: <BLU102-W5779C0FD81928FFE91E8BFA410@phx.gbl>


hey all 
i have Cisco 7606 and i configured port channel consisting of 5 links 
now the individual ports (Gig) , do not have overruns but the port channel has 
even though the ports in the mentioned port channel have 8 ports spacing to overcome the issue of ASIC
can anyone help ?

Router#sh int po20 | inc overr
     0 input errors, 0 CRC, 0 frame, 468063 overrun, 0 ignored

Thanks in advance

_________________________________________________________________
Drag n? drop?Get easy photo sharing with Windows Live? Photos.

http://www.microsoft.com/windows/windowslive/products/photos.aspx

From sthaug at nethelp.no  Sun Jun 14 11:42:10 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Sun, 14 Jun 2009 17:42:10 +0200 (CEST)
Subject: [c-nsp] port channel overruns
In-Reply-To: <BLU102-W5779C0FD81928FFE91E8BFA410@phx.gbl>
References: <BLU102-W5779C0FD81928FFE91E8BFA410@phx.gbl>
Message-ID: <20090614.174210.74726651.sthaug@nethelp.no>

> i have Cisco 7606 and i configured port channel consisting of 5 links 
> now the individual ports (Gig) , do not have overruns but the port channel has 
> even though the ports in the mentioned port channel have 8 ports spacing to overcome the issue of ASIC
> can anyone help ?

What type of card are your ports on? What type of Supervisor?

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From graham at g-rock.net  Sun Jun 14 18:52:56 2009
From: graham at g-rock.net (Graham Wooden)
Date: Sun, 14 Jun 2009 17:52:56 -0500
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
Message-ID: <C65AE978.5439%graham@g-rock.net>

Hi all,

I just updated the SP?s ROMMON on a Sup32 to the latest,
c6ksup32-rm2.srec.122-18r.SX9.  However, can this same file be applied to
update the RP's ROMMON as well?  While logged into CCO I have only came
across docs that referred to the SP upgrade. I guess no biggie if the SP and
RP have difference ROMMON versions, I was just curious.

Thanks,

-graham



From dale.shaw+cisco-nsp at gmail.com  Sun Jun 14 19:53:57 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Mon, 15 Jun 2009 09:53:57 +1000
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <C65AE978.5439%graham@g-rock.net>
References: <C65AE978.5439%graham@g-rock.net>
Message-ID: <3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>

Hi,

<semi-hijack>

On Mon, Jun 15, 2009 at 8:52 AM, Graham Wooden<graham at g-rock.net> wrote:
>
> I just updated the SP?s ROMMON on a Sup32 to the latest,
> c6ksup32-rm2.srec.122-18r.SX9. ?However, can this same file be applied to
> update the RP's ROMMON as well? ?While logged into CCO I have only came
> across docs that referred to the SP upgrade. I guess no biggie if the SP and
> RP have difference ROMMON versions, I was just curious.

I'm curious about how many people out there manage ROMMON/bootflash
images in the same way the 'main' image is managed.

In one customer network, there are tens of 7200s running 12.4T code
with 12.3-based boot code. The same network has 20+ 6500s
(sup32/sup720) running various 12.2(18)SXF images and I doubt anyone's
ever given a second thought to 'auxiliary' code like ROMMON or any
other flashable components.

So, is stuff like ROMMON a set-and-forget or
never-even-thought-about-it thing for you, or do you actively track
image availability and factor upgrades in to your broader platform
management activities? Is it considered good practice, for example, to
match 7200 series boot flash revs with the main image, or does this
fall into the "if it ain't broke, .." category?

cheers,
Dale

From dcp at dcptech.com  Sun Jun 14 20:07:14 2009
From: dcp at dcptech.com (David Prall)
Date: Sun, 14 Jun 2009 20:07:14 -0400
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
References: <C65AE978.5439%graham@g-rock.net>
	<3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
Message-ID: <006c01c9ed4d$4f0174d0$ed045e70$@com>

The key issue with the boot image is being able to access the flash device
where the real image exists. A number of devices, ie Majority, no longer
need this but in the past upgrading to an ATA Flash card / disk0:, from
linear flash / slot0: meant that you needed a boot image that could support
the flash. The 7500 is an absolute for having the two in sync. 

6500 MSFC3 ROMMON
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/rommon/OL_4497.htm
l

David

--
http://dcp.dcptech.com
 

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Dale Shaw
> Sent: Sunday, June 14, 2009 7:54 PM
> To: Graham Wooden
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
> 
> Hi,
> 
> <semi-hijack>
> 
> On Mon, Jun 15, 2009 at 8:52 AM, Graham Wooden<graham at g-rock.net>
> wrote:
> >
> > I just updated the SP?s ROMMON on a Sup32 to the latest,
> > c6ksup32-rm2.srec.122-18r.SX9. ?However, can this same file be
> applied to
> > update the RP's ROMMON as well? ?While logged into CCO I have only
> came
> > across docs that referred to the SP upgrade. I guess no biggie if the
> SP and
> > RP have difference ROMMON versions, I was just curious.
> 
> I'm curious about how many people out there manage ROMMON/bootflash
> images in the same way the 'main' image is managed.
> 
> In one customer network, there are tens of 7200s running 12.4T code
> with 12.3-based boot code. The same network has 20+ 6500s
> (sup32/sup720) running various 12.2(18)SXF images and I doubt anyone's
> ever given a second thought to 'auxiliary' code like ROMMON or any
> other flashable components.
> 
> So, is stuff like ROMMON a set-and-forget or
> never-even-thought-about-it thing for you, or do you actively track
> image availability and factor upgrades in to your broader platform
> management activities? Is it considered good practice, for example, to
> match 7200 series boot flash revs with the main image, or does this
> fall into the "if it ain't broke, .." category?
> 
> cheers,
> Dale
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From jay at west.net  Sun Jun 14 20:15:07 2009
From: jay at west.net (Jay Hennigan)
Date: Sun, 14 Jun 2009 17:15:07 -0700
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
References: <C65AE978.5439%graham@g-rock.net>
	<3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
Message-ID: <4A35928B.4090907@west.net>

Dale Shaw wrote:

> I'm curious about how many people out there manage ROMMON/bootflash
> images in the same way the 'main' image is managed.
> 
> In one customer network, there are tens of 7200s running 12.4T code
> with 12.3-based boot code. The same network has 20+ 6500s
> (sup32/sup720) running various 12.2(18)SXF images and I doubt anyone's
> ever given a second thought to 'auxiliary' code like ROMMON or any
> other flashable components.
> 
> So, is stuff like ROMMON a set-and-forget or
> never-even-thought-about-it thing for you, or do you actively track
> image availability and factor upgrades in to your broader platform
> management activities? Is it considered good practice, for example, to
> match 7200 series boot flash revs with the main image, or does this
> fall into the "if it ain't broke, .." category?

7200s have three places where code is stored, ROMMON, Bootflash, and the 
main image.

ROMMON is a physical "Yank this chip out of its socket and replace it 
with another chip" so not flashable.   Not DIY unless you have an EPROM 
burner and a factory chip with newer code to dump.

I typically don't worry about bootflash unless there's a compatibility 
issue with that and a newer IOS, but this is indeed flashable and images 
are available on CCO.

On smaller platforms the ROMMON and bootflash are combined onto a single 
BootROM.  This is also a "Yank the physical chip and replace it" type of 
thing.  Occasionally this needs to be upgraded when newer code becomes 
too large for the original design to address, but it's been a long time 
since I've needed to deal with it, IIRC the 2500 and maybe early 2600 
series routers.

In my experience on most platforms these are "set and forget", but I 
don't have a lot of hands-on with the 6500.

--
Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net
Impulse Internet Service  -  http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV

From kgraham at industrial-marshmallow.com  Sun Jun 14 20:27:11 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Sun, 14 Jun 2009 17:27:11 -0700 (PDT)
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <4A35928B.4090907@west.net>
References: <C65AE978.5439%graham@g-rock.net>
	<3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
	<4A35928B.4090907@west.net>
Message-ID: <663794.93579.qm@web1215.biz.mail.gq1.yahoo.com>


> 7200s have three places where code is stored, ROMMON, Bootflash, and the main 

> image.
> 
> ROMMON is a physical "Yank this chip out of its socket and replace it with 
> another chip" so not flashable.   Not DIY unless you have an EPROM burner and a 
> factory chip with newer code to dump.

Depends on the NPE. NPE-G1 rommon can be upgraded, most notably for the short-
lived MPF functionality. 

From graham at g-rock.net  Sun Jun 14 20:30:21 2009
From: graham at g-rock.net (Graham Wooden)
Date: Sun, 14 Jun 2009 19:30:21 -0500
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <006c01c9ed4d$4f0174d0$ed045e70$@com>
Message-ID: <C65B004D.544B%graham@g-rock.net>

Thanks David and Dale for the insights.

SP Rommon was pretty far back, and upgrading it solved an issue I was
having. However, after reading the caveats listed for the MSFC2A, I don't
think I am going to mess with the RP - until I really need to.

Thanks again,

-graham

On 6/14/09 7:07 PM, "David Prall" <dcp at dcptech.com> wrote:

> The key issue with the boot image is being able to access the flash device
> where the real image exists. A number of devices, ie Majority, no longer
> need this but in the past upgrading to an ATA Flash card / disk0:, from
> linear flash / slot0: meant that you needed a boot image that could support
> the flash. The 7500 is an absolute for having the two in sync.
> 
> 6500 MSFC3 ROMMON
> http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/rommon/OL_4497.htm
> l
> 
> David
> 
> --
> http://dcp.dcptech.com
>  
> 
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
>> bounces at puck.nether.net] On Behalf Of Dale Shaw
>> Sent: Sunday, June 14, 2009 7:54 PM
>> To: Graham Wooden
>> Cc: cisco-nsp at puck.nether.net
>> Subject: Re: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
>> 
>> Hi,
>> 
>> <semi-hijack>
>> 
>> On Mon, Jun 15, 2009 at 8:52 AM, Graham Wooden<graham at g-rock.net>
>> wrote:
>>> 
>>> I just updated the SP?s ROMMON on a Sup32 to the latest,
>>> c6ksup32-rm2.srec.122-18r.SX9. ?However, can this same file be
>> applied to
>>> update the RP's ROMMON as well? ?While logged into CCO I have only
>> came
>>> across docs that referred to the SP upgrade. I guess no biggie if the
>> SP and
>>> RP have difference ROMMON versions, I was just curious.
>> 
>> I'm curious about how many people out there manage ROMMON/bootflash
>> images in the same way the 'main' image is managed.
>> 
>> In one customer network, there are tens of 7200s running 12.4T code
>> with 12.3-based boot code. The same network has 20+ 6500s
>> (sup32/sup720) running various 12.2(18)SXF images and I doubt anyone's
>> ever given a second thought to 'auxiliary' code like ROMMON or any
>> other flashable components.
>> 
>> So, is stuff like ROMMON a set-and-forget or
>> never-even-thought-about-it thing for you, or do you actively track
>> image availability and factor upgrades in to your broader platform
>> management activities? Is it considered good practice, for example, to
>> match 7200 series boot flash revs with the main image, or does this
>> fall into the "if it ain't broke, .." category?
>> 
>> cheers,
>> Dale
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 



From irsk.inc at gmail.com  Mon Jun 15 00:57:23 2009
From: irsk.inc at gmail.com (Rishi Kochar)
Date: Sun, 14 Jun 2009 23:57:23 -0500
Subject: [c-nsp] Two events in EEM
Message-ID: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>

hi
i work for cisco in UC technology.
i am very new to EEM. I dont deal with scripting at all but i have to create
one for one of my customers

I have created an event manager applet with an '
#event syslog pattern <pattern>.
Now after matching the pattern i want it wait for a countdown timer and the
execute certain cli commands.
what's the easiest way to do it ?
i think with EEM i cant make my first applet to call another applet which
has a countdown timer because with
#action 1.0 cli command "event manager run <2nd applet>"
in this 2nd applet should have "event none" if i need to call it manually
from 1st applet but thats not the case because 2nd applet will have a
countdown timer as its event.

any help on this would be highly appreciated

thanks and regards
inder

From gert at greenie.muc.de  Mon Jun 15 02:19:48 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Mon, 15 Jun 2009 08:19:48 +0200
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
References: <C65AE978.5439%graham@g-rock.net>
	<3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
Message-ID: <20090615061947.GI290@greenie.muc.de>

Hi,

On Mon, Jun 15, 2009 at 09:53:57AM +1000, Dale Shaw wrote:
> So, is stuff like ROMMON a set-and-forget or
> never-even-thought-about-it thing for you, or do you actively track
> image availability and factor upgrades in to your broader platform
> management activities? 

For us it's "set-and-forget".  There are certain cases where ROMMON
and/or boot IOS updates are needed (like SXH IOS on 6500), but besides 
this, we usually never touch it, on any platform.

> Is it considered good practice, for example, to
> match 7200 series boot flash revs with the main image, or does this
> fall into the "if it ain't broke, .." category?

We always consider it "if it ain't broke..." - and so far, haven't seen
any adverse effects.

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090615/f38692d4/attachment.bin>

From eninja at gmail.com  Mon Jun 15 03:23:33 2009
From: eninja at gmail.com (Eninja)
Date: Mon, 15 Jun 2009 08:23:33 +0100
Subject: [c-nsp] Two events in EEM
In-Reply-To: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
References: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
Message-ID: <84F4B3F8-54F4-4C0F-A8FB-8A99822075A3@gmail.com>

Inder,

Sounds like you're a Cisco software development engineer. Shouldn't  
this be sent to a Cisco internal list rather than a public list?

Eninja ;)



On Jun 15, 2009, at 5:57 AM, Rishi Kochar <irsk.inc at gmail.com> wrote:

> hi
> i work for cisco in UC technology.
> i am very new to EEM. I dont deal with scripting at all but i have  
> to create
> one for one of my customers
>
> I have created an event manager applet with an '
> #event syslog pattern <pattern>.
> Now after matching the pattern i want it wait for a countdown timer  
> and the
> execute certain cli commands.
> what's the easiest way to do it ?
> i think with EEM i cant make my first applet to call another applet  
> which
> has a countdown timer because with
> #action 1.0 cli command "event manager run <2nd applet>"
> in this 2nd applet should have "event none" if i need to call it  
> manually
> from 1st applet but thats not the case because 2nd applet will have a
> countdown timer as its event.
>
> any help on this would be highly appreciated
>
> thanks and regards
> inder
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From dale.shaw+cisco-nsp at gmail.com  Mon Jun 15 03:54:03 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Mon, 15 Jun 2009 17:54:03 +1000
Subject: [c-nsp] Using 'shutdown' versus pulling the cable
Message-ID: <3329cbb40906150054u557e40b2kc102e1d89ebe919@mail.gmail.com>

Hi all,

I'm working on some failover test scenarios and I'm trying to
determine if issuing a 'shutdown' command on a router's Ethernet
interface is effectively identical, from the perspective of the
attached switch, as removing the cable.

Here's a simplified topology:

R1-Fa0/0 -- Fa1/0/1-SW1

Assume R1's Fa0/0 interface is directly connected to SW1's Fa1/0/1
interface, and Fa1/0/1 is configured as a routed port ("no
switchport"). R1 and SW1 are EIGRP neighbours.

Is the 'shutdown' command somehow 'cleaner' or more graceful than
yanking the cable? For example, does IOS do any 'nice' things like
send EIGRP goodbye messages before *really* shutting down the
interface? Anything similar happening at lower layers? This requires
insight into IOS behaviour that I don't have and I'm not sure how to
get within any reasonable time frame (read: without cracking out the
packet capture tool).

We don't have remote power-off/power-on capabilities so this is all
about assessing whether we need an on-site presence to simulate loss
of power. If 'shutdown' on R1 is the same as pulling the cable, and
SW1's response will be the same, that's great. If it's not the same,
it's not a valid simulation.

Hopefully this hasn't been covered before. The key words involved make
it difficult to search on.

Cheers,
Dale

From alan.pashi at gmail.com  Mon Jun 15 04:38:17 2009
From: alan.pashi at gmail.com (Tengiz Alaniya)
Date: Mon, 15 Jun 2009 12:38:17 +0400
Subject: [c-nsp] FWSM failover time
Message-ID: <29c062fe0906150138t4559beddob0205f4f0db2330b@mail.gmail.com>

Hi all, sorry for my eng ;)



Ok, here is  my story about 2 catalyst 6500 boxes, with installed fws
blades. Between fws are configured as transparent with A/A failover. Nodes
are connected with 2x10Tg EC.

When one of boxes filed, initial failover begins, but the time between first
node stops forwarding and the second node begins forwarding is too big,
about ~7 sec.

Any suggestions to how decrease failover time?



*First box failover config:*

*msk-dc-fwm-c2-1/9#    sh run failover *

failover

failover lan unit primary

failover preempt 1

failover lan interface failover-lan Vlan104

failover polltime unit msec 500 holdtime 3

failover link failover-state Vlan105

failover interface ip failover-lan 192.168.255.253 255.255.255.252 standby
192.168.255.254

failover interface ip failover-state 192.168.255.249 255.255.255.252 standby
192.168.255.250

failover group 1

  replication http

  polltime interface 3

failover group 2

  secondary

*msk-dc-fwm-c2-1/9# sh failover *

Failover On

Failover unit Primary

Failover LAN Interface: failover-lan Vlan 104 (up)

Unit Poll frequency 500 milliseconds, holdtime 3 seconds

Interface Poll frequency 15 seconds

Interface Policy 50%

Monitored Interfaces 4 of 250 maximum

Config sync: active

Version: Ours 4.0(3), Mate 4.0(3)

Group 1 last failover at: 14:41:29 UTC Jun 11 2009

Group 2 last failover at: 14:41:29 UTC Jun 11 2009



  This host:    Primary

  Group 1       State:          Standby Ready

                Active time:    0 (sec)

  Group 2       State:          Standby Ready

                Active time:    0 (sec)



                1c Interface outside (0.0.0.0): Normal (Not-Monitored)

                1c Interface inside (0.0.0.0): Normal (Not-Monitored)

                backup Interface outside (0.0.0.0): Normal (Waiting)

                backup Interface inside (0.0.0.0): Normal (Waiting)

                documentum Interface outside (0.0.0.0): Normal
(Not-Monitored)

                documentum Interface inside (0.0.0.0): Normal
(Not-Monitored)

                engineering Interface outside (0.0.0.0): Normal
(Not-Monitored)

                engineering Interface inside (0.0.0.0): Normal
(Not-Monitored)

                ksupr Interface outside (0.0.0.0): Normal (Not-Monitored)

                ksupr Interface inside (0.0.0.0): Normal (Not-Monitored)

                monitoring Interface outside (0.0.0.0): Normal
(Not-Monitored)

                monitoring Interface inside (0.0.0.0): Normal
(Not-Monitored)

                sap Interface outside (0.0.0.0): Normal (Not-Monitored)

                sap Interface inside (0.0.0.0): Normal (Not-Monitored)

                sql Interface outside (0.0.0.0): Normal (Not-Monitored)

                sql Interface inside (0.0.0.0): Normal (Not-Monitored)

                vmware-mng Interface outside (0.0.0.0): Normal (Waiting)

                vmware-mng Interface inside (0.0.0.0): Normal (Waiting)

                vmware-vmotion Interface outside (0.0.0.0): Normal
(Not-Monitored)

                vmware-vmotion Interface inside (0.0.0.0): Normal
(Not-Monitored)



  Other host:   Secondary

  Group 1       State:          Active

                Active time:    326568 (sec)

  Group 2       State:          Active

                Active time:    344824 (sec)



                1c Interface outside (10.42.225.252): Normal (Not-Monitored)

                1c Interface inside (10.42.225.252): Normal (Not-Monitored)

                backup Interface outside (10.42.229.252): Normal (Waiting)

                backup Interface inside (10.42.229.252): Normal (Waiting)

                documentum Interface outside (10.42.226.252): Normal
(Not-Monitored)

                documentum Interface inside (10.42.226.252): Normal
(Not-Monitored)

                engineering Interface outside (10.42.231.252): Normal
(Not-Monitored)

                engineering Interface inside (10.42.231.252): Normal
(Not-Monitored)

                ksupr Interface outside (10.42.228.252): Normal
(Not-Monitored)

                ksupr Interface inside (10.42.228.252): Normal
(Not-Monitored)

                monitoring Interface outside (10.42.230.252): Normal
(Not-Monitored)

                monitoring Interface inside (10.42.230.252): Normal
(Not-Monitored)

                sap Interface outside (10.42.224.252): Normal
(Not-Monitored)

                sap Interface inside (10.42.224.252): Normal (Not-Monitored)

                sql Interface outside (10.42.227.252): Normal
(Not-Monitored)

                sql Interface inside (10.42.227.252): Normal (Not-Monitored)

                vmware-mng Interface outside (10.42.223.124): Normal
(Waiting)

                vmware-mng Interface inside (10.42.223.124): Normal
(Waiting)

                vmware-vmotion Interface outside (10.42.223.252): Normal
(Not-Monitored)

                vmware-vmotion Interface inside (10.42.223.252): Normal
(Not-Monitored)



Stateful Failover Logical Update Statistics

        Link : failover-state Vlan 105 (up)

        Stateful Obj    xmit       xerr       rcv        rerr

        General         41619      0          41940      0

        sys cmd         41619      0          41619      0

        up time         0          0          0          0

        RPC services    0          0          0          0

        TCP conn        0          0          114        0

        UDP conn        0          0          0          0

        ARP tbl         0          0          207        0

        Xlate_Timeout   0          0          0          0

        AAA tbl         0          0          0          0

        DACL            0          0          0          0

        Acl optimization        0          0          0          0

        OSPF Area SeqNo         0          0          0          0



        Logical Update Queue Information

                        Cur     Max     Total

        Recv Q:         0       2       681787

        Xmit Q:         0       0       41619



*Second box config:*

*msk-dc-fwm-c2-1/9# sh run fail*

failover

failover lan unit secondary

failover preempt 1

failover lan interface failover-lan Vlan104

failover polltime unit msec 500 holdtime 3

failover link failover-state Vlan105

failover interface ip failover-lan 192.168.255.253 255.255.255.252 standby
192.168.255.254

failover interface ip failover-state 192.168.255.249 255.255.255.252 standby
192.168.255.250

failover group 1

  replication http

  polltime interface 3

failover group 2

  secondary

*msk-dc-fwm-c2-1/9# sh failover *

Failover On

Failover unit Secondary

Failover LAN Interface: failover-lan Vlan 104 (up)

Unit Poll frequency 500 milliseconds, holdtime 3 seconds

Interface Poll frequency 15 seconds

Interface Policy 50%

Monitored Interfaces 4 of 250 maximum

Config sync: active

Version: Ours 4.0(3), Mate 4.0(3)

Group 1 last failover at: 12:34:47 UTC Jun 11 2009

Group 2 last failover at: 07:30:05 UTC Jun 11 2009



  This host:    Secondary

  Group 1       State:          Active

                Active time:    326640 (sec)

  Group 2       State:          Active

                Active time:    344896 (sec)



                1c Interface outside (10.42.225.252): Normal (Not-Monitored)

                1c Interface inside (10.42.225.252): Normal (Not-Monitored)

                backup Interface outside (10.42.229.252): Normal (Waiting)

                backup Interface inside (10.42.229.252): Normal (Waiting)

                documentum Interface outside (10.42.226.252): Normal
(Not-Monitored)

                documentum Interface inside (10.42.226.252): Normal
(Not-Monitored)

                engineering Interface outside (10.42.231.252): Normal
(Not-Monitored)

                engineering Interface inside (10.42.231.252): Normal
(Not-Monitored)

                ksupr Interface outside (10.42.228.252): Normal
(Not-Monitored)

                ksupr Interface inside (10.42.228.252): Normal
(Not-Monitored)

                monitoring Interface outside (10.42.230.252): Normal
(Not-Monitored)

                monitoring Interface inside (10.42.230.252): Normal
(Not-Monitored)

                sap Interface outside (10.42.224.252): Normal
(Not-Monitored)

                sap Interface inside (10.42.224.252): Normal (Not-Monitored)

                sql Interface outside (10.42.227.252): Normal
(Not-Monitored)

                sql Interface inside (10.42.227.252): Normal (Not-Monitored)

                vmware-mng Interface outside (10.42.223.124): Normal
(Waiting)

                vmware-mng Interface inside (10.42.223.124): Normal
(Waiting)

                vmware-vmotion Interface outside (10.42.223.252): Normal
(Not-Monitored)

                vmware-vmotion Interface inside (10.42.223.252): Normal
(Not-Monitored)



  Other host:   Primary

  Group 1       State:          Standby Ready

                Active time:    0 (sec)

  Group 2       State:          Standby Ready

                Active time:    0 (sec)



                1c Interface outside (0.0.0.0): Normal (Not-Monitored)

                1c Interface inside (0.0.0.0): Normal (Not-Monitored)

                backup Interface outside (0.0.0.0): Normal (Waiting)

                backup Interface inside (0.0.0.0): Normal (Waiting)

                documentum Interface outside (0.0.0.0): Normal
(Not-Monitored)

                documentum Interface inside (0.0.0.0): Normal
(Not-Monitored)

                engineering Interface outside (0.0.0.0): Normal
(Not-Monitored)

                engineering Interface inside (0.0.0.0): Normal
(Not-Monitored)

                ksupr Interface outside (0.0.0.0): Normal (Not-Monitored)

                ksupr Interface inside (0.0.0.0): Normal (Not-Monitored)

                monitoring Interface outside (0.0.0.0): Normal
(Not-Monitored)

                monitoring Interface inside (0.0.0.0): Normal
(Not-Monitored)

                sap Interface outside (0.0.0.0): Normal (Not-Monitored)

                sap Interface inside (0.0.0.0): Normal (Not-Monitored)

                sql Interface outside (0.0.0.0): Normal (Not-Monitored)

                sql Interface inside (0.0.0.0): Normal (Not-Monitored)

                vmware-mng Interface outside (0.0.0.0): Normal (Waiting)

                vmware-mng Interface inside (0.0.0.0): Normal (Waiting)

                vmware-vmotion Interface outside (0.0.0.0): Normal
(Not-Monitored)

                vmware-vmotion Interface inside (0.0.0.0): Normal
(Not-Monitored)



Stateful Failover Logical Update Statistics

        Link : failover-state Vlan 105 (up)

        Stateful Obj    xmit       xerr       rcv        rerr

        General         45207      0          44925      0

        sys cmd         44833      0          44830      0

        up time         0          0          0          0

        RPC services    0          0          0          0

        TCP conn        129        0          74         0

        UDP conn        0          0          0          0

        ARP tbl         245        0          21         0

        Xlate_Timeout   0          0          0          0

        AAA tbl         0          0          0          0

        DACL            0          0          0          0

        Acl optimization        0          0          0          0

        OSPF Area SeqNo         0          0          0          0



        Logical Update Queue Information

                        Cur     Max     Total

        Recv Q:         0       3       715068

        Xmit Q:         0       0       66148


-- 
Kind regards,
Tengiz Alaniya

From Thomas.Sillaber at nextiraone.de  Mon Jun 15 05:03:19 2009
From: Thomas.Sillaber at nextiraone.de (Thomas.Sillaber at nextiraone.de)
Date: Mon, 15 Jun 2009 11:03:19 +0200
Subject: [c-nsp] Using 'shutdown' versus pulling the cable
References: <3329cbb40906150054u557e40b2kc102e1d89ebe919@mail.gmail.com>
Message-ID: <D2A12B44A1003D45A7117D0BBB957A061441E7C6@BER05101.ebdmail.alcatel.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Dale,

using the "shutdown" command is IMHO always cleaner because of "graceful
shutdown" feature. If you plan a failover test physically disconnecting
the link or powering off the device shows the "real" failover time.  

Brgds and have a great day

Thomas Sillaber


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iQEVAwUBSjYOVWZ0NRmWJ+KQAQKS0wf/YD/rJtDi7LsezfRWLdJ6o1dQZM/ngM0l
9yYI/cOX7C4JKHJ4cMgL4R1zT94W07jSJJNbqR9mjrdodJdLSyaFlG7GIVbPgNlu
V3npL7N48pSoZfBKd1OxfpfjHoLLEMntUKsYY7IoSd733XXKJ6+UcwyCfd7R0qdq
CGgJRyMzsJ+mXcs+u0k23i1iDA4p54PiK6y6YkwBWI8zSGvhD4nxOMy2wryaJADn
VOWNgwsct5r/rgUYFPppHNw1joy9W60kvh4BLh508JTr24xGhQYkJgleKdif4wE7
n0OuNhmyqlAPFYqt4KRwomWIQMkQZGXhqX4EH4Ebe2BBLd6ihai4ow==
=rgiN
-----END PGP SIGNATURE-----

From bep at whack.org  Mon Jun 15 05:46:06 2009
From: bep at whack.org (Bruce Pinsky)
Date: Mon, 15 Jun 2009 02:46:06 -0700
Subject: [c-nsp] Using 'shutdown' versus pulling the cable
In-Reply-To: <D2A12B44A1003D45A7117D0BBB957A061441E7C6@BER05101.ebdmail.alcatel.de>
References: <3329cbb40906150054u557e40b2kc102e1d89ebe919@mail.gmail.com>
	<D2A12B44A1003D45A7117D0BBB957A061441E7C6@BER05101.ebdmail.alcatel.de>
Message-ID: <4A36185E.9030103@whack.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thomas.Sillaber at nextiraone.de wrote:
> Hi Dale,
> 
> using the "shutdown" command is IMHO always cleaner because of "graceful
> shutdown" feature. If you plan a failover test physically disconnecting
> the link or powering off the device shows the "real" failover time.  
> 

If you want a less "well behaved failure", pull just the tx or rx side of
the fiber...or introduce 10e-4 errors and see what happens.

- --
=========
bep

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAko2GF4ACgkQE1XcgMgrtyaBmQCgrOYQzV9JEBwWDT5l/853Kk7E
dAoAoPP7d46mAvb0DNaXdcpPv26/lTrg
=KlEo
-----END PGP SIGNATURE-----

From p.mayers at imperial.ac.uk  Mon Jun 15 05:47:40 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Mon, 15 Jun 2009 10:47:40 +0100
Subject: [c-nsp] Two events in EEM
In-Reply-To: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
References: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
Message-ID: <4A3618BC.6060307@imperial.ac.uk>

Use a stub track object with a "delay" parameter?

track 499 stub-object
  ! this delay will occur
  delay down 10

event manager applet test1
  event syslog pattern ".*foo.*"
  action 1.0 track set 499 state down

event manager applet test2
  event track 499 state down
  action 1.0 cli command "your CLI here"

This requires a suitable version of EEM (2.2 I think?)

From rodunn at cisco.com  Mon Jun 15 07:28:46 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Mon, 15 Jun 2009 07:28:46 -0400
Subject: [c-nsp] Two events in EEM
In-Reply-To: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
References: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
Message-ID: <20090615112846.GB8987@rtp-cse-489.cisco.com>

In your first applet that triggers on the syslog pattern have it
actually configure the second EEM applet that then runs on a
countdown timer:

action 4.0 cli command "event timer countodwn 30

Basically, have one applet configure the second and have the
second configure a third that would remove the second after it
runs the commands.

Depending on if you only want it to run once, which a countdown timer
does.

Rodney





On Sun, Jun 14, 2009 at 11:57:23PM -0500, Rishi Kochar wrote:
> hi
> i work for cisco in UC technology.
> i am very new to EEM. I dont deal with scripting at all but i have to create
> one for one of my customers
> 
> I have created an event manager applet with an '
> #event syslog pattern <pattern>.
> Now after matching the pattern i want it wait for a countdown timer and the
> execute certain cli commands.
> what's the easiest way to do it ?
> i think with EEM i cant make my first applet to call another applet which
> has a countdown timer because with
> #action 1.0 cli command "event manager run <2nd applet>"
> in this 2nd applet should have "event none" if i need to call it manually
> from 1st applet but thats not the case because 2nd applet will have a
> countdown timer as its event.
> 
> any help on this would be highly appreciated
> 
> thanks and regards
> inder
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From peter at rathlev.dk  Mon Jun 15 11:05:53 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 15 Jun 2009 17:05:53 +0200
Subject: [c-nsp] BGP Dynamic Neighbors and VPNv4
In-Reply-To: <1240845228.7881.64.camel@localhost.localdomain>
References: <1240845228.7881.64.camel@localhost.localdomain>
Message-ID: <1245078353.6634.8.camel@localhost.localdomain>

As follow-up for the archives. Short version: It doesn't seem to work.

On Mon, 2009-04-27 at 17:13 +0200, Peter Rathlev wrote:
> Reading about BGP Dynamic Neighbors I can see that the 12.2SX
> Configuration Guide[1] states that only IPv4 peering is supported. Would
> anybody know if this actually means "no IPv6" or if it also means "no
> VPNv4"? I don't currently have a SXH/SXI box to test this from I'm
> afraid.

As Phil said it will eat the configuration, but it doesn't seem to work
for VPNv4 when I test it. The RR clients seem stuck in a "(NoNeg)"
state:

 000088: Jun 15 16:10:37.587 CEST: %BGP-5-ADJCHANGE: neighbor 10.85.248.7 Up
 R2(config-router-af)#do sh ip bgp vpnv4 all sum
 BGP router identifier 10.85.248.11, local AS number 65432
 BGP table version is 1, main routing table version 1
 
 Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
 10.85.248.7     4       65432       3       3        0    0    0 00:00:12 (NoNeg)

>From the RR itself:

 000426: Jun 15 16:10:37.591 CEST: %BGP-5-ADJCHANGE: neighbor *10.85.248.11 Up 
 R1(config-router)#do sh ip bgp vpnv4 all sum
 ...
 Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
 10.85.248.1     4       65432  252567  250975     1048    0    0 2w6d           17
 BGP peergroup RM-core-RR listen range group members: 
   10.85.248.0/24 
 R1(config-router)#

It logs an adjacency change saying a dynamic ("*") neighbor is up, but
the sessions is not listen under the summary. (Can anybody tell me what
the "(NoNeg)" is btw?)

I guess this means that VPNv4 isn't a supported AF for dynamic
neighbors. :'(

A regular RR setup of course works fine. That's what we'll do then.

This was tested on 12.2(33)SXI1 AIS.

Regards,
Peter



From felixnkansah at gmail.com  Mon Jun 15 12:39:07 2009
From: felixnkansah at gmail.com (Felix Nkansah)
Date: Mon, 15 Jun 2009 16:39:07 +0000
Subject: [c-nsp] Cisco ITP and SMSC
Message-ID: <18dba4e50906150939kf3d1df4h29f87664cb5ac0ad@mail.gmail.com>

Hi Team,

I would appreciate if any on this list could direct me to useful resources
that go in-depth into SS7 and SS7-over-IP protocols, focusing on using Cisco
ITPs in combination with a SMSC and SS7 network.

Thanks in advance.

Felix

From rick at woofpaws.com  Mon Jun 15 13:24:28 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Mon, 15 Jun 2009 10:24:28 -0700 (PDT)
Subject: [c-nsp] Policing on Catalyst 4948 - Hardware or Software?
Message-ID: <40751.69.30.17.85.1245086669.squirrel@www.woofpaws.com>


The Catalyst 4948 was brought to my attention as a potential collocation
aggregation device; with a specific requirement of bidirectional policing
per port.

I have spent quite a bit of time on Cisco and Google trying to find out
whether policing (independent of marking/classifying) is performed in
hardware or software.  I get some hints that it is hardware, but nothing
the says so outright.  With a 266MHz processor, it doesn't seem like there
is a lot of capacity for bandwidth management.

In an ideal/extreme case, I'd like to be able to have hosts/networks
attempt to push 1Gbs per port and have it throttled to 1Mbs each without
cratering the device.  More realistically, 24 ports populated, each set to
10-500Mbs per customer (port).

I'm looking at a distributed device rather than modular for several
reasons including cable management (a nightmare at high port density) and
incremental expansion (makes the finance people less upset than dropping a
full chassis in with minimal utilization).

As part of the bigger picture; I'm looking at 7206VXR/G2 at the border for
GigE upstreams and BGP endpoints funneled to a pair of 7600/Sup720 for
redundant "glue", feeding multiple legacy aggregation devices and new,
bandwidth managed, ethernet customers.  Current utilization is ~300Mbs
both in and out, but we now have customers looking for 100-300Mbs CIR.

As an aggregation device, I'm also looking for OSPF, BGP, HSRP, and
potentially Layer-3 ACLs.

There are several other vendors touting ASIC-based policing but Cisco
isn't as informative.

Thanks,
Rick

From ygauteron at gmail.com  Mon Jun 15 14:57:43 2009
From: ygauteron at gmail.com (Yann Gauteron)
Date: Mon, 15 Jun 2009 20:57:43 +0200
Subject: [c-nsp] Cisco ITP and SMSC
In-Reply-To: <18dba4e50906150939kf3d1df4h29f87664cb5ac0ad@mail.gmail.com>
References: <18dba4e50906150939kf3d1df4h29f87664cb5ac0ad@mail.gmail.com>
Message-ID: <8097baf0906151157x4a502524v207619c8313216da@mail.gmail.com>

What kind of resources are you specifically interested in?

2009/6/15 Felix Nkansah <felixnkansah at gmail.com>:
> Hi Team,
>
> I would appreciate if any on this list could direct me to useful resources
> that go in-depth into SS7 and SS7-over-IP protocols, focusing on using Cisco
> ITPs in combination with a SMSC and SS7 network.
>
> Thanks in advance.
>
> Felix
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From kgraham at industrial-marshmallow.com  Mon Jun 15 13:59:03 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 15 Jun 2009 10:59:03 -0700 (PDT)
Subject: [c-nsp] heat fins popping loose on WS-X67xx cards
In-Reply-To: <alpine.DEB.2.00.0905290851570.23331@seatpost.its.uiowa.edu>
References: <alpine.DEB.2.00.0905281110020.7239@seatpost.its.uiowa.edu>
	<44417CD2F19FEA4F885088340A71D33201F0DFCB@mail.office.dansketelecom.com>
	<4A1F00C8.9060109@west.net> <4A1F0B39.6040907@forthnet.gr>
	<alpine.DEB.2.00.0905290851570.23331@seatpost.its.uiowa.edu>
Message-ID: <141296.79805.qm@web1212.biz.mail.gq1.yahoo.com>




> The first shows the "Z1" socket in the background with the fuzzy loop in the 

> foreground. The second shows the heat fin & loop in the foregraound with the 
> socket in the background.  The loop is supposed to be in the Z1 socket.

Just unpacked a WS-X6748-GE-TX and found a loose jumped in the bag. Thanks to
this thread, gave a slight push to the heat fin and off it came, with jumper
Z1 suspiciously absent.

> Based on the responses I've received it seems that this is a fairly common 
> failure due to a design flaw.  I got the usual "that's strange; nobody else is 
> having this problem" from Cisco.  I now have ample justification for telling 
> them "bull".

Indeed. Given the number of instances cited here alone, I'm really surprised
there hasn't been a field notice.

From vanormer at gmail.com  Mon Jun 15 14:59:03 2009
From: vanormer at gmail.com (Robert VanOrmer)
Date: Mon, 15 Jun 2009 13:59:03 -0500
Subject: [c-nsp] Qos on IPSec + GRE tunnel with sup720-3bxl
Message-ID: <009101c9edeb$5ac18820$10449860$@com>

I am having an interesting challenge in getting a QoS policy that is
supported / works across a IPSec + GRE tunnel running 12.2(18)SXF
(Sup720-3bxl, ws-svc-ipsec-1, flexwan with DS3).  I am not trying to do
anything overly complex.. really just want to make sure RTP or EF tagged
frames make it, and let the rest of the traffic fend for itself with any
queuing strategy.  Originally, I was just planning to use class/policy maps
with the bandwidth and priority controls to guarantee a certain amount of
bandwidth to dscp ef.  This doesn't seem to be supported..  and my google-fu
is failing me..  Most documentation references the qos pre-qualify features
and auto-qos, which are also unsupported in this configuration.  TAC
recommends policing, but I would rather avoid that unless that is the best
mechanism.  Anybody have any experience with a similar design and willing to
share some pointers?  Any recommendations on the best QoS strategy using GRE
tunnels on the 6500 platform?

 


From felixnkansah at gmail.com  Mon Jun 15 15:11:03 2009
From: felixnkansah at gmail.com (Felix Nkansah)
Date: Mon, 15 Jun 2009 19:11:03 +0000
Subject: [c-nsp] Cisco ITP and SMSC
In-Reply-To: <8097baf0906151157x4a502524v207619c8313216da@mail.gmail.com>
References: <18dba4e50906150939kf3d1df4h29f87664cb5ac0ad@mail.gmail.com>
	<8097baf0906151157x4a502524v207619c8313216da@mail.gmail.com>
Message-ID: <18dba4e50906151211l55f983fdld28d333a441a75f9@mail.gmail.com>

Any that you know on the subject could prove useful to me.
But to be specific, anything that teaches concepts and configurations of
application servers, routing on point codes, global title configuration,
multilayer routing, etc.

Thanks in advance.

On Mon, Jun 15, 2009 at 6:57 PM, Yann Gauteron <ygauteron at gmail.com> wrote:

> What kind of resources are you specifically interested in?
>
> 2009/6/15 Felix Nkansah <felixnkansah at gmail.com>:
> > Hi Team,
> >
> > I would appreciate if any on this list could direct me to useful
> resources
> > that go in-depth into SS7 and SS7-over-IP protocols, focusing on using
> Cisco
> > ITPs in combination with a SMSC and SS7 network.
> >
> > Thanks in advance.
> >
> > Felix
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
>

From kgraham at industrial-marshmallow.com  Mon Jun 15 14:29:10 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 15 Jun 2009 11:29:10 -0700 (PDT)
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
	<A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
	<FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>
Message-ID: <919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>



> > Was the original intention of this thread not to find out exactly what *is* 
> the best tool for the above scenario? :)
> 
> GSR w/E3 or E5 LCs, ASR 1K, CRS-1, or N7K, depending upon the circumstances 

Probably none of them -- N7K seems squarely targeted at enterprise DC, so given
BU turf wars, wouldn't go near it for a SP workload (ie. consider that post-
split, the 6500 and 7600 are clearly diverging). Otherwise, ASR9K or 7600
are going to be the only ones that get close to the port counts that were cited
initially.

Given the 192 ports of 10/100/1000, presumably this is aggregating customers,
in which case it'd be best to roll these up on 7600/RSP720 (along with their
associated BGP, since most of them would probably be suitable for peer-groups).
uRPF wouldn't be a problem, and hopefully ACL's would be uniform enough across
customers to share most of the ACE entries. 

With that compromise (namely loosing customer-customer netflow detail), the 
remaining requirements for full netflow exports and the balance of the BGP
workload are feasible for any of ASR1k, GSR, or CRS-1.

From c.spurgeon at mail.utexas.edu  Mon Jun 15 14:54:18 2009
From: c.spurgeon at mail.utexas.edu (Charles Spurgeon)
Date: Mon, 15 Jun 2009 13:54:18 -0500
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <C65B004D.544B%graham@g-rock.net>
References: <006c01c9ed4d$4f0174d0$ed045e70$@com>
	<C65B004D.544B%graham@g-rock.net>
Message-ID: <20090615185418.GA48691@argus.gw.utexas.edu>

On Sun, Jun 14, 2009 at 07:29:58PM -0500, Graham Wooden wrote:
> Thanks David and Dale for the insights.
> 
> SP Rommon was pretty far back, and upgrading it solved an issue I was
> having. However, after reading the caveats listed for the MSFC2A, I don't
> think I am going to mess with the RP - until I really need to.

Another data point along the lines of "if it ain't broke..."

When we did a SP rommon upgrade to 45 sup720s a while back (to fix
some serious booting bugs) we lost one sup720 when it became bricked
due to a failed rommon upgrade.

Since then the risk of bricking the sup720 has been added to the list
of reasons that we don't mess with the rommon unless we have to.

-Charles

Charles E. Spurgeon / UTnet
UT Austin ITS / Networking
c.spurgeon at its.utexas.edu / 512.475.9265



From dsavage at castleaccess.com  Mon Jun 15 14:49:00 2009
From: dsavage at castleaccess.com (Denis Savage)
Date: Mon, 15 Jun 2009 11:49:00 -0700
Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
In-Reply-To: <mailman.401.1245078433.2287.cisco-nsp@puck.nether.net>
Message-ID: <C65BE5AC.321BE%dsavage@castleaccess.com>

Is there any benefit of going with the 7201 NPE-G2 over the 7204 VXR with
the NPE-G2 engine? They appear to be the exact same, except the 7204 has
four slots as opposed to the 7201 being a 1U appliance. Yet, the 7204 is
cheaper from what I can gather. Am I missing something?

Thanks,

Denis Savage



From kgraham at industrial-marshmallow.com  Mon Jun 15 14:48:26 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 15 Jun 2009 11:48:26 -0700 (PDT)
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090612205202.GC10390@kallisti.us>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net> <20090612205202.GC10390@kallisti.us>
Message-ID: <34850.38269.qm@web1209.biz.mail.gq1.yahoo.com>



> Hah, keep drinking the cool aid!  I have a pair of 6500s ready to fall
> over at about 150kpps.  All WS-67xx LAN cards with DFCs.  CPU averages
> 60% and often maxes.
>
> No netflow, no uRPF, no multicast, no IPv6, no BFD, no MPLS, no ACLs
> in the forwarding plane.  Very basic OSPF, BGP, and MSTP.  About 2000
> VLANs, 80% of which have associated layer 3 SVIs.

...which of course is mostly irrelevant to the forwarding performance.
If its just a handy opportunity to bitch, go for it, but as others 
mentioned, something's not right. "ready to fall over at 150kpps" is
only right if traffic is being entirely software switched on the MSFC3.

Barring that, the main thing that SP/RP would be seeing is mac-learning
and ARP (for which an above-average load would be reasonable assuming
with ~default values and a correspondingly high number of hosts to go
along with those ~2000 vlans).

From mhuff at ox.com  Mon Jun 15 16:05:11 2009
From: mhuff at ox.com (Matthew Huff)
Date: Mon, 15 Jun 2009 16:05:11 -0400
Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
In-Reply-To: <C65BE5AC.321BE%dsavage@castleaccess.com>
References: <mailman.401.1245078433.2287.cisco-nsp@puck.nether.net>
	<C65BE5AC.321BE%dsavage@castleaccess.com>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C1427C@PUR-EXCH07.ox.com>

I believe the deal with the 7201 is that you are paying for the compactness.
Also the 7204 is probably the most mass produced 72xx, so it's probably an
economy of scale, especially if you are looking at refurb.

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Denis Savage
> Sent: Monday, June 15, 2009 2:49 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
> 
> Is there any benefit of going with the 7201 NPE-G2 over the 7204 VXR
> with
> the NPE-G2 engine? They appear to be the exact same, except the 7204
> has
> four slots as opposed to the 7201 being a 1U appliance. Yet, the 7204
> is
> cheaper from what I can gather. Am I missing something?
> 
> Thanks,
> 
> Denis Savage
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090615/84aa7c7e/attachment.bin>

From gert at greenie.muc.de  Mon Jun 15 16:16:56 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Mon, 15 Jun 2009 22:16:56 +0200
Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
In-Reply-To: <C65BE5AC.321BE%dsavage@castleaccess.com>
References: <mailman.401.1245078433.2287.cisco-nsp@puck.nether.net>
	<C65BE5AC.321BE%dsavage@castleaccess.com>
Message-ID: <20090615201656.GV290@greenie.muc.de>

Hi,

On Mon, Jun 15, 2009 at 11:49:00AM -0700, Denis Savage wrote:
> Is there any benefit of going with the 7201 NPE-G2 over the 7204 VXR with
> the NPE-G2 engine? They appear to be the exact same, except the 7204 has
> four slots as opposed to the 7201 being a 1U appliance. Yet, the 7204 is
> cheaper from what I can gather. Am I missing something?

The 7201 is only using 1U of rack space.

Which might seem obvious - but if all you need is "GigE ports" (and maybe
a single PA), but at the same time the amount of rack space you can use 
is limited, 1U beats 4U :-)

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090615/000fb16c/attachment.bin>

From achatz at forthnet.gr  Mon Jun 15 16:21:41 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Mon, 15 Jun 2009 23:21:41 +0300
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <20090615185418.GA48691@argus.gw.utexas.edu>
References: <006c01c9ed4d$4f0174d0$ed045e70$@com>	<C65B004D.544B%graham@g-rock.net>
	<20090615185418.GA48691@argus.gw.utexas.edu>
Message-ID: <4A36AD55.6090101@forthnet.gr>



Charles Spurgeon wrote on 15/06/2009 21:54:
> On Sun, Jun 14, 2009 at 07:29:58PM -0500, Graham Wooden wrote:
>> Thanks David and Dale for the insights.
>>
>> SP Rommon was pretty far back, and upgrading it solved an issue I was
>> having. However, after reading the caveats listed for the MSFC2A, I don't
>> think I am going to mess with the RP - until I really need to.
> 
> Another data point along the lines of "if it ain't broke..."
> 
> When we did a SP rommon upgrade to 45 sup720s a while back (to fix
> some serious booting bugs) we lost one sup720 when it became bricked
> due to a failed rommon upgrade.
> 

Since there is a resident (GOLD) rommon also, couldn't that one be used for "recovery"?

-- 
Tassos

> Since then the risk of bricking the sup720 has been added to the list
> of reasons that we don't mess with the rommon unless we have to.
> 
> -Charles
> 
> Charles E. Spurgeon / UTnet
> UT Austin ITS / Networking
> c.spurgeon at its.utexas.edu / 512.475.9265
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From rdobbins at arbor.net  Mon Jun 15 16:31:58 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Tue, 16 Jun 2009 03:31:58 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <34850.38269.qm@web1209.biz.mail.gq1.yahoo.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net> <20090612205202.GC10390@kallisti.us>
	<34850.38269.qm@web1209.biz.mail.gq1.yahoo.com>
Message-ID: <0F6687DF-1945-4E0D-8815-89402C3AEE19@arbor.net>


On Jun 16, 2009, at 1:48 AM, Kevin Graham wrote:

> "ready to fall over at 150kpps" is only right if traffic is being  
> entirely software switched on the MSFC3.

Concur.  I'd start here:

sh proc c sort | e 0.00

sh fm sum

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From amsoares at netcabo.pt  Mon Jun 15 19:35:37 2009
From: amsoares at netcabo.pt (Antonio Soares)
Date: Tue, 16 Jun 2009 00:35:37 +0100
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
In-Reply-To: <4D58C7B4943F874BA4CB5D68A7924060B0F5F6@Epikserver2.Epik.local>
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
	<153DAD8392C948D6B0E0864E232B909C@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F5F6@Epikserver2.Epik.local>
Message-ID: <9F415B851F1640F5884181C42F35A315@int.convex.pt>

What type of LC's do you have in that router ?

I'm trying to find what is the difference in the architecture between Eng3 vs Eng4 LC's that could justify this problem:

router#show ip cef resource   
Hardware resource allocation status summary
Green (Normal), Yellow (Caution) Red (Alarm)
Slot HW Resource Name        Util     Alert
X    E4_Lookup External SRAM  93        Y         
Y    E3 Rx PLU                26        G         
Y    E3_Rx_TLU                11        G        

Both have the same Route Memory and Packet Memory (512 Mb). 

But all i was able to find is related with Eng0/Eng1/Eng2:

Cisco 12000 Series Internet Router Architecture: Line Card Design

http://www.cisco.com/en/US/products/hw/routers/ps167/products_tech_note09186a00801e1dbd.shtml


Thanks.

Regards,

Antonio Soares, CCIE #18473 (R&S)
amsoares at netcabo.pt

-----Original Message-----
From: Ryan Werber [mailto:RWerber at epiknetworks.com] 
Sent: sexta-feira, 5 de Junho de 2009 20:31
To: Antonio Soares; cisco-nsp
Subject: RE: [c-nsp] 12k Full BGP Feed Memory Requirements




>-----Original Message-----
>From: Antonio Soares [mailto:amsoares at netcabo.pt] 
>Sent: Friday, June 05, 2009 4:14 AM

>Wow, this is unbelievable ! Can you show us your "show proc mem | inc
BGP" ? Do you really have two full BGP feeds (about 284k
>prefixes each) ?




#show proc memory  | i BGP
 169   0 2895956668 1123582500  310165452          0          0 BGP
Router
 172   0    3975400 1008225208       6840      53464          0 BGP I/O
 173   0       4188   12111120      14028          0          0 BGP
Scanner

First one is Cogent (174), the Second one is Tiscali (3257).  There are
4 Ibgp Route-Servers as well. we have ~10 full transit feeds throughout
our asn, as well as a ton of peering.  The only thing changed below are
ip addresses to protect the innocent. We currently have ~130 meg free on
the GRP-B. We also have 1 directly connected eBGP IPv6 peer, and 5
throughout our ASN.

38.103.xx.xx   4   174 3895305   60405 22155189    0    0 5w6d
283503
77.67.xx.xx    4  3257 5813157  139266 22155189    0    0 6w6d
282571
PEER-RS-1      4 21513 2472535 3813308 22155189    0    0 15:25:46
100863
RS-1           4 21513 4092583 3613405 22155189    0    0 6w6d
265775
RS-2           4 21513 3244549 3613398 22155189    0    0 6w6d
267897
RS-3           4 21513 5660680 3711962 22155189    0    0 1w1d
284664

show ip cef summary
IP Distributed CEF with switching (Table Version 8565971), flags=0x0
  288375 routes, 0 reresolve, 0 unresolved (0 old, 0 new), peak 18273
  8561775 instant recursive resolutions, 0 used background process
  12 load sharing elements, 12 references
  1389 in-place/0 aborted modifications
  57883336 bytes allocated to the FIB table data structures
  universal per-destination load sharing algorithm, id 6CE54348
  2(0) CEF resets
  Resolution Timer: Exponential (currently 1s, peak 4s)
  Tree summary:
   8-8-8-8 stride pattern
   short mask protection disabled
   288375 leaves, 14605 nodes using 23265244 bytes
  Transient memory used: 149355436, max: 149395476

  Table epoch: 0 (288375 entries at this epoch)

Adjacency Table has 41 adjacencies
  34 IPv4 adjacencies
  7 IPv6 adjacencies




From jkrejci at usinternet.com  Mon Jun 15 19:08:03 2009
From: jkrejci at usinternet.com (Justin Krejci)
Date: Mon, 15 Jun 2009 18:08:03 -0500
Subject: [c-nsp] LX vs LH Transceivers
Message-ID: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>

There appears to be a fair amount of threads online about using LX and LH
together on a SMF link. I have a situation where there is a 7206VXR with an
NPE-G1 that has a LX GBIC installed that is talking via SMF to a 12000
series router to one of our providers that is using an LX transceiver. This
gigE link has been up and running happily for a while.

 

We are running into some performance issues on the 7200 when under load so
we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
combo port. We have one GLC-LH-SM SFP transceiver installed into the
sfp-only port but when cutting over the above mentioned link from the 7200
to the 6509 we get no eth link at all. We verified fibers are clean, light
levels are within spec and strands connected in the correct tx/rx slots on
the transceiver. A simple hard loop at the FDP causes the gig interface to
come right up on the 6509 so I know the transceiver and gig port are
producing and receiving light at a hardware level but it seemed odd this was
not working when talking to the provider's LX GBIC. 

 

Everywhere online that I could find seems to indicate LX and LH are 100%
compatible with each other and that Cisco even uses these two
interchangeably (to the dismay of some).

http://marc.info/?l=cisco-nsp
<http://marc.info/?l=cisco-nsp&m=120612428712150&w=2> &m=120612428712150&w=2

http://en.wikipedia.org/wiki/Gigabit_Ethernet#1000BASE-LX

 

 

When talking with this provider they are adamant that their Cisco LX
equipment is not at all compatible with regular Cisco LH equipment and
mentioned that they are not using standard IOS but are using some customized
OS on their Cisco which is why there is this incompatibility. This to me
seems very suspicious like they don't want to troubleshoot this problem but
I can't dismiss their claims as invalid since I am not real knowledgeable in
this regard. They also claim they are not able to support LH connectivity
for this circuit due to this compatibility. From what I've read it seems the
LH/LX compatibility is really more of a hardware difference and software
driving the hardware would have no real bearing on this but again I don't
have anything to back up my line of thought. Do I need to press my provider
a little harder on this issue or are their claims true/possible and I am
just going to have to get an actual "LX" SFP for this circuit or figure
something else out.

 

Thanks!

Justin Krejci


From dale.shaw+cisco-nsp at gmail.com  Mon Jun 15 19:57:25 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Tue, 16 Jun 2009 09:57:25 +1000
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
Message-ID: <3329cbb40906151657h4c0ddd38t1eb52223a0ff3656@mail.gmail.com>

Hi Justin,

On Tue, Jun 16, 2009 at 9:08 AM, Justin Krejci<jkrejci at usinternet.com> wrote:
> We are running into some performance issues on the 7200 when under load so
> we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
> combo port. We have one GLC-LH-SM SFP transceiver installed into the
> sfp-only port but when cutting over the above mentioned link from the 7200
> to the 6509 we get no eth link at all.

Sorry if this is offensively obvious, but did your interface config
include "media-type sfp"?

The only other trick I've found with 1000BASE-LX recently was between
a WS-X6724-SFP line card and an Alcatel 1662 -- the link wouldn't come
up without "speed nonegotiate".

Good luck.

Cheers,
Dale

From jkrejci at usinternet.com  Mon Jun 15 20:10:08 2009
From: jkrejci at usinternet.com (Justin Krejci)
Date: Mon, 15 Jun 2009 19:10:08 -0500
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3329cbb40906151657h4c0ddd38t1eb52223a0ff3656@mail.gmail.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
	<3329cbb40906151657h4c0ddd38t1eb52223a0ff3656@mail.gmail.com>
Message-ID: <3D3B02466EFE42EA96616FA1CBD7D798@usicorp.usinternet.com>

Dale,

Thanks for the tip but this particular case I was using the sfp-only
interface so there is not even an option for configuring media-type.

router(config)#int g5/1
router(config-if)#me?   
% Unrecognized command
router(config-if)#int g5/2
router(config-if)#me?
media-type  

router(config-if)#me


Also I did not try the "speed nonegotiate" option, I will definitely have to
try that.

Thanks!

-----Original Message-----
From: dale.shaw at gmail.com [mailto:dale.shaw at gmail.com] On Behalf Of Dale
Shaw
Sent: Monday, June 15, 2009 6:57 PM
To: Justin Krejci
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] LX vs LH Transceivers

Hi Justin,

On Tue, Jun 16, 2009 at 9:08 AM, Justin Krejci<jkrejci at usinternet.com>
wrote:
> We are running into some performance issues on the 7200 when under load so
> we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
> combo port. We have one GLC-LH-SM SFP transceiver installed into the
> sfp-only port but when cutting over the above mentioned link from the 7200
> to the 6509 we get no eth link at all.

Sorry if this is offensively obvious, but did your interface config
include "media-type sfp"?

The only other trick I've found with 1000BASE-LX recently was between
a WS-X6724-SFP line card and an Alcatel 1662 -- the link wouldn't come
up without "speed nonegotiate".

Good luck.

Cheers,
Dale


From fusionfoto at gmail.com  Mon Jun 15 21:33:05 2009
From: fusionfoto at gmail.com (FF)
Date: Mon, 15 Jun 2009 21:33:05 -0400
Subject: [c-nsp] XENPAK packet loss
Message-ID: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>

I've been trying to solve an odd problem and can't seem to make any headway.
I'm in the process of upgrading two DF links that were formerly served
by 1GB/ZX optics to XENPAK-DWDM optics. 1 lamba only on each.

The ZX link for the first span ran fine. When the DWDM XENPAK is
installed, both ends see about -15db receive power and ping fine until
traffic is put on them. At about 200-300 mb/s they start losing 1500
byte packets. The more traffic, the more the problem. At night, when
traffic is lower, the link looks clean. No attenuators are on this
link.

On a longer span (140km) link, I have the same setup, with two EDFAs.
The input power comes in right around -24dbm. It tests clean mostly,
but drops 2 packets out of 10,000 when empty. More traffic, more
drops.  I figured it was a strength problem (-24dbm is right at the
edge). So went in with a some fiber cleaners and rejumpered
everything. Got it down to -22dbm which should be well within the
tolerances. If anything the problem got worse, not better.

There are some input/CRC errors incrementing on one side or the other.
Not as many as there are dropped packets, but clearly some do
correlate to dropped packets (for example 6 input errors out of 25,000
packets).

I looked up the data sheet on the Cisco DWDM transceivers (all the
optics and the EDFAs are Cisco) and they say you may get burst errors
above -15dbm, but nothing about bursts at below. I have no idea how to
diagnose for burst errors anyway. I don't know if this is a signal
strength problem, or something else. On the long span, I could
theoretically be hitting issues like dispersion, but on the short span
I should be running perfectly since everything is within tolerances.
Since they are both seeing the same sort of behavior, I am wondering
if its something I've overlooked.

So now I have two spans, of drastically different lengths, both
dropping packets directly related to the amount of traffic moving over
them. Only BGP and static routes are on these. All are 6500/SUP32 or
SUP720s running 12.22-33SXH5 or SXHI1.

Any help/advice/assistance would be appreciated it. I'm trying to
avoid spending 8+ hrs on the phone with TAC.

Thank you very much.

-- 
My opinions aren't even my own. FF

From swmike at swm.pp.se  Tue Jun 16 02:22:32 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Tue, 16 Jun 2009 08:22:32 +0200 (CEST)
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
Message-ID: <alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>

On Mon, 15 Jun 2009, FF wrote:

> On a longer span (140km) link, I have the same setup, with two EDFAs. 
> The input power comes in right around -24dbm. It tests clean mostly, but 
> drops 2 packets out of 10,000 when empty. More traffic, more drops.  I 
> figured it was a strength problem (-24dbm is right at the edge). So went 
> in with a some fiber cleaners and rejumpered everything. Got it down to 
> -22dbm which should be well within the tolerances. If anything the 
> problem got worse, not better.

Is this link dispersion compensated? Otherwise that is most likely your 
problem, 1GE rarely get chromatic dispersion (CD) problems, 10GE much more 
so.

> So now I have two spans, of drastically different lengths, both dropping 
> packets directly related to the amount of traffic moving over them. Only 
> BGP and static routes are on these. All are 6500/SUP32 or SUP720s 
> running 12.22-33SXH5 or SXHI1.

Which indicates a constant BER (bit error rate) which is consistant with 
CD induced BER.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From andy.saykao at staff.netspace.net.au  Tue Jun 16 02:23:56 2009
From: andy.saykao at staff.netspace.net.au (Andy Saykao)
Date: Tue, 16 Jun 2009 16:23:56 +1000
Subject: [c-nsp] Can you apply crypto map to SVI
Message-ID: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>

Hi All,
 
Got a problem with a site-to-site IPSEC vpn implementation where one end
is using SVI.
 
Does any body know if a crypto map can be applied to a SVI to bring up
the IPSEC tunnel? It accepts the command but I can't pass any traffic
to/from it.
 
interface vlan 10
 crypto map MY-MAP
 
Or do you need to apply the crypto map to a physical interface? 
 
I've gotten it working on a sub-interface (eg: interface
GigabitEthernet0/0.11) but can't find any documentation that talks about
applying it to a SVI and whether this will work.
 
Thanks.
 
Andy

This email and any files transmitted with it are confidential and intended
 solely for the use of the individual or entity to whom they are addressed. 
Please notify the sender immediately by email if you have received this 
email by mistake and delete this email from your system. Please note that
 any views or opinions presented in this email are solely those of the
 author and do not necessarily represent those of the organisation. 
Finally, the recipient should check this email and any attachments for 
the presence of viruses. The organisation accepts no liability for any 
damage caused by any virus transmitted by this email.


From dmitry at dmitry.net  Tue Jun 16 03:03:39 2009
From: dmitry at dmitry.net (Dmitry Kiselev)
Date: Tue, 16 Jun 2009 10:03:39 +0300
Subject: [c-nsp] SVI bandwidth
Message-ID: <20090616070339.GF81381@f17.dmitry.net>

Hello!

Is there any way to configure some sort of "bandwidth inherit"
command, but regarding SVI not sub-interfaces? Or some way
to configure the default bandwidth for all SVIs without own
explicit definition?

Thanks!

P.S. C7600-RSP720 under latest 12.2SRC

-- 
Dmitry Kiselev

From hegedus.gabor at euroway.hu  Tue Jun 16 04:07:37 2009
From: hegedus.gabor at euroway.hu (Hegedus Gabor)
Date: Tue, 16 Jun 2009 10:07:37 +0200
Subject: [c-nsp] mars reinstall
Message-ID: <4A3752C9.2040105@euroway.hu>

Hi all!

I have a problem.
Our Mars doesn't want to  work good.
It not responding remotely.
I need a  good  user guide what tells me how to reinstall the MARS.

we have 4.x version on it and I think i'm going to install 6.x.

how can I do it, pls help

Thank you.

br Gabor

From moua0100 at umn.edu  Tue Jun 16 05:02:49 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Tue, 16 Jun 2009 04:02:49 -0500
Subject: [c-nsp] Can you apply crypto map to SVI
In-Reply-To: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
Message-ID: <4A375FB9.3010305@umn.edu>

Yes, this should work contigent on hw plaform.  If you do a "sh cry 
engine" do you see an active crypto engine in sw or hw?  If not then the 
crypto commands will never be invoked even though legal.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi All,
>  
> Got a problem with a site-to-site IPSEC vpn implementation where one end
> is using SVI.
>  
> Does any body know if a crypto map can be applied to a SVI to bring up
> the IPSEC tunnel? It accepts the command but I can't pass any traffic
> to/from it.
>  
> interface vlan 10
>  crypto map MY-MAP
>  
> Or do you need to apply the crypto map to a physical interface? 
>  
> I've gotten it working on a sub-interface (eg: interface
> GigabitEthernet0/0.11) but can't find any documentation that talks about
> applying it to a SVI and whether this will work.
>  
> Thanks.
>  
> Andy
>
> This email and any files transmitted with it are confidential and intended
>  solely for the use of the individual or entity to whom they are addressed. 
> Please notify the sender immediately by email if you have received this 
> email by mistake and delete this email from your system. Please note that
>  any views or opinions presented in this email are solely those of the
>  author and do not necessarily represent those of the organisation. 
> Finally, the recipient should check this email and any attachments for 
> the presence of viruses. The organisation accepts no liability for any 
> damage caused by any virus transmitted by this email.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From zivl at gilat.net  Tue Jun 16 05:14:39 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Tue, 16 Jun 2009 12:14:39 +0300
Subject: [c-nsp] mars reinstall
In-Reply-To: <4A3752C9.2040105@euroway.hu>
References: <4A3752C9.2040105@euroway.hu>
Message-ID: <EC993E87D960A541A66BF21D62AA42A622FF3A2B69@exch2k7.gilat.local>

Yeah, we had some problems with MARS too so we've upgraded it to SATURN, much greater and robust, and hey, you've gotta love the rings and the 61 moons!
Just kiddin'

Have you look at this link?
http://www.cisco.com/en/US/products/ps6241/prod_installation_guides_list.html
There are a lot of guides there about installation/upgrade/migration
Hope this helps
Ziv





-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Hegedus Gabor
Sent: Tuesday, June 16, 2009 11:08 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] mars reinstall

Hi all!

I have a problem.
Our Mars doesn't want to  work good.
It not responding remotely.
I need a  good  user guide what tells me how to reinstall the MARS.

we have 4.x version on it and I think i'm going to install 6.x.

how can I do it, pls help

Thank you.

br Gabor
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From lists at memetic.org  Tue Jun 16 06:52:50 2009
From: lists at memetic.org (Adam Armstrong)
Date: Tue, 16 Jun 2009 11:52:50 +0100
Subject: [c-nsp] RSP720-10GE & C7606
Message-ID: <4A377982.5070303@memetic.org>

Hi All,

I have a pair of RSP720-10GEs and a 7606 chassis. The RSP datasheet 
suggests they aren't compatible. Does anyone have any evidence either way?

Thanks,
adam.

From eng_mssk at hotmail.com  Tue Jun 16 08:38:58 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Tue, 16 Jun 2009 15:38:58 +0300
Subject: [c-nsp] Double Natting
Message-ID: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>


hey all
i have a wimax CPE which have public IP address
and from the LAN side it has the ip add 192.168.1.1 and its DHCP enabled
now i have tp-link router that is connected to the CPE and got the ip address 192.168.1.100
i connected a laptop to the router and got the ip address 192.168.2.100
can i access the laptop via remote desktop by accessing the public ip address of the CPE ?

thanks

_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

From lowen at pari.edu  Tue Jun 16 09:13:38 2009
From: lowen at pari.edu (Lamar Owen)
Date: Tue, 16 Jun 2009 09:13:38 -0400
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
Message-ID: <200906160913.38353.lowen@pari.edu>

On Monday 15 June 2009 07:08:03 pm Justin Krejci wrote:
> There appears to be a fair amount of threads online about using LX and LH
> together on a SMF link. I have a situation where there is a 7206VXR with an
> NPE-G1 that has a LX GBIC installed that is talking via SMF to a 12000
> series router to one of our providers that is using an LX transceiver. This
> gigE link has been up and running happily for a while.
[snip]
> We are running into some performance issues on the 7200 when under load so
> we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
> combo port. We have one GLC-LH-SM SFP transceiver installed into the
> sfp-only port but when cutting over the above mentioned link from the 7200
> to the 6509 we get no eth link at all. 

I've seen random issues with our 12012 with 1 port GE linecards linking up 
with a Catalyst 5509's GE port before; have no idea if they are related or 
not, but disabling autonegotiation on the Catalyst seemed to fix it.  The link 
would intermittently come up on the Cat 5509, and the link showed up on the 
12012, but would not be stable until disabling negotiation on the 5509.  I 
realize that's old hardware, but even the latest 6500 stuff inherits more from 
the old Catalyst line than it does from the 7200 router line.

In our case, the 12012's LC links up fine with an Extreme Summit1i, with a 
7401ASR's GE port, with a 7507's GEIP and GEIP+, and with a 7200 NPE-G1's 
port. Had issues with the Cat 5509 gig ports (both on the SupIIIG and the 
three port gig card) only.  Haven't tried with our 7609 yet, or with a Cat 
8500, or with a Cat 5500's 9 port gig etherchannel card.


From avayner at cisco.com  Tue Jun 16 09:43:39 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Tue, 16 Jun 2009 15:43:39 +0200
Subject: [c-nsp] Double Natting
In-Reply-To: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
References: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7CCDBD8@xmb-ams-331.emea.cisco.com>

Mohammad,

Yes, you can, but you will have to configure port mapping on both NAT
devices.
RDP should be using port 3389

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Mohammad Khalil
Sent: Tuesday, June 16, 2009 15:39
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Double Natting


hey all
i have a wimax CPE which have public IP address
and from the LAN side it has the ip add 192.168.1.1 and its DHCP enabled
now i have tp-link router that is connected to the CPE and got the ip
address 192.168.1.100
i connected a laptop to the router and got the ip address 192.168.2.100
can i access the laptop via remote desktop by accessing the public ip
address of the CPE ?

thanks

_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live
Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.a
spx&mkt=en-us
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From eng_mssk at hotmail.com  Tue Jun 16 09:56:50 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Tue, 16 Jun 2009 16:56:50 +0300
Subject: [c-nsp] Double Natting
In-Reply-To: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
References: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
Message-ID: <BLU102-W296651969AFD68143F0B1EFA3F0@phx.gbl>


Thanks all for ur assist , i configured port forwarding before submitting my request but the CPE is dump i figured it later that u have to assign port range not a specific port on the CPE :)

> From: eng_mssk at hotmail.com
> To: cisco-nsp at puck.nether.net
> Date: Tue, 16 Jun 2009 15:38:58 +0300
> Subject: [c-nsp] Double Natting
> 
> 
> hey all
> i have a wimax CPE which have public IP address
> and from the LAN side it has the ip add 192.168.1.1 and its DHCP enabled
> now i have tp-link router that is connected to the CPE and got the ip address 192.168.1.100
> i connected a laptop to the router and got the ip address 192.168.2.100
> can i access the laptop via remote desktop by accessing the public ip address of the CPE ?
> 
> thanks
> 
> _________________________________________________________________
> Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
> http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_________________________________________________________________
Show them the way! Add maps and directions to your party invites. 
http://www.microsoft.com/windows/windowslive/products/events.aspx

From lgeyer at gmail.com  Tue Jun 16 10:04:33 2009
From: lgeyer at gmail.com (Laurent Geyer)
Date: Tue, 16 Jun 2009 10:04:33 -0400
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
Message-ID: <39647f4d0906160704t4344824ak13f79e6721f474a7@mail.gmail.com>

On Mon, Jun 15, 2009 at 7:08 PM, Justin Krejci<jkrejci at usinternet.com> wrote:
> Everywhere online that I could find seems to indicate LX and LH are 100%
> compatible with each other and that Cisco even uses these two
> interchangeably (to the dismay of some).

LX and LH interoperability shouldn't be an issue, we mix and match
like that all the time.

Have you attempted to disabled link negotiation on your 6500 yet?

- Laurent

From fusionfoto at gmail.com  Tue Jun 16 10:06:16 2009
From: fusionfoto at gmail.com (FF)
Date: Tue, 16 Jun 2009 10:06:16 -0400
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
Message-ID: <4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>

I thought Chromatic Dispersion is distance related. This is supposed
to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
ps dispersion tolerance). Do you need a DCU even when operating within
that range? One of the links is only about 40-50km.

Is there a Cisco command to pull up the BER the optic is seeing?

Thanks.


On Tue, Jun 16, 2009 at 2:22 AM, Mikael Abrahamsson<swmike at swm.pp.se> wrote:
> On Mon, 15 Jun 2009, FF wrote:
>
>> On a longer span (140km) link, I have the same setup, with two EDFAs. The
>> input power comes in right around -24dbm. It tests clean mostly, but drops 2
>> packets out of 10,000 when empty. More traffic, more drops. ?I figured it
>> was a strength problem (-24dbm is right at the edge). So went in with a some
>> fiber cleaners and rejumpered everything. Got it down to -22dbm which should
>> be well within the tolerances. If anything the problem got worse, not
>> better.
>
> Is this link dispersion compensated? Otherwise that is most likely your
> problem, 1GE rarely get chromatic dispersion (CD) problems, 10GE much more
> so.
>
>> So now I have two spans, of drastically different lengths, both dropping
>> packets directly related to the amount of traffic moving over them. Only BGP
>> and static routes are on these. All are 6500/SUP32 or SUP720s running
>> 12.22-33SXH5 or SXHI1.
>
> Which indicates a constant BER (bit error rate) which is consistant with CD
> induced BER.
>
> --
> Mikael Abrahamsson ? ?email: swmike at swm.pp.se
>



-- 
FF

From drrtuy at ya.ru  Tue Jun 16 09:27:17 2009
From: drrtuy at ya.ru (Roman A. Nozdrin)
Date: Tue, 16 Jun 2009 16:27:17 +0300
Subject: [c-nsp] Double Natting
In-Reply-To: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
References: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
Message-ID: <4A379DB5.8060607@ya.ru>

Mohammad Khalil wrote:
> hey all
> i have a wimax CPE which have public IP address
> and from the LAN side it has the ip add 192.168.1.1 and its DHCP enabled
> now i have tp-link router that is connected to the CPE and got the ip address 192.168.1.100
> i connected a laptop to the router and got the ip address 192.168.2.100
> can i access the laptop via remote desktop by accessing the public ip address of the CPE ?

It seems You can get to the laptop using the topology you described.

For example.
CPE(RDP port) -> TP-LINK(RDP port) -> laptop

Does tp-link router smart enough to manipulate with destination nat? 
What is the actual model of the router?

WBR
Roman A. Nozdrin

From cluestore at gmail.com  Tue Jun 16 10:17:30 2009
From: cluestore at gmail.com (Clue Store)
Date: Tue, 16 Jun 2009 09:17:30 -0500
Subject: [c-nsp] Global Route Leaking on same PE
Message-ID: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>

Hi All,

Looked through the archives but couldn't find anything about this specific
issue. I'm trying to leak a route from the global table on a PE to an
iterface that is on the same PE but I get the folowwing when I try to just
point it to a loopback.....

ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 global
%Invalid next hop address (it's this router)

Also tried to point it to just the interface and it says vpn routes have to
be pointed to next-hop addresses. Anyone have some clue how to get this to
work where the traffic never leaves the same PE and makes a look around the
network??

TIA

From swmike at swm.pp.se  Tue Jun 16 10:19:08 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Tue, 16 Jun 2009 16:19:08 +0200 (CEST)
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
	<4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
Message-ID: <alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>

On Tue, 16 Jun 2009, FF wrote:

> I thought Chromatic Dispersion is distance related. This is supposed

Yes it is.

> to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
> ps dispersion tolerance). Do you need a DCU even when operating within
> that range? One of the links is only about 40-50km.

Well, you didn't say the links were DC or not, and you didn't say how long 
the link was. At 40-50km, CD is most likely not the cause of your 
problems.

According to some info I found, SMF-28 DSF still has 17.1ps/nm/km, meaning 
your 1600ps dispersion tolerance only gets you 94km? I might be wrong 
though, I can't get the whole article, google only displays from its 
cache.

> Is there a Cisco command to pull up the BER the optic is seeing?

No, on GE you can only see it by sending traffic and observing the error 
counters.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From fusionfoto at gmail.com  Tue Jun 16 10:41:09 2009
From: fusionfoto at gmail.com (FF)
Date: Tue, 16 Jun 2009 10:41:09 -0400
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
	<4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
	<alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>
Message-ID: <4522daf90906160741v3090895ekffc76615f5697e11@mail.gmail.com>

On Tue, Jun 16, 2009 at 10:19 AM, Mikael Abrahamsson<swmike at swm.pp.se> wrote:
> On Tue, 16 Jun 2009, FF wrote:
>
>> I thought Chromatic Dispersion is distance related. This is supposed
>
> Yes it is.
>
>> to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
>> ps dispersion tolerance). Do you need a DCU even when operating within
>> that range? One of the links is only about 40-50km.
>
> Well, you didn't say the links were DC or not, and you didn't say how long
> the link was. At 40-50km, CD is most likely not the cause of your problems.

On the shorter link, we are seeing the same kind of problem, but not
the same problem. Any traffic-related issues at that distance that
could explain it?

>
> According to some info I found, SMF-28 DSF still has 17.1ps/nm/km, meaning
> your 1600ps dispersion tolerance only gets you 94km? I might be wrong
> though, I can't get the whole article, google only displays from its cache.


Well, that could explain the longer link, definitely. Is dispersion
something, say I'm +300 ps over my dispersion budget,
I get a -625 ps DCU on each side and I'm good? I'm trying to avoid
upsizing the amplifiers to compensate for the DCU's insertion loss.

>
>> Is there a Cisco command to pull up the BER the optic is seeing?
>
> No, on GE you can only see it by sending traffic and observing the error
> counters.
>

Thank you very much.


-- 
FF

From md at bts.sk  Tue Jun 16 11:50:56 2009
From: md at bts.sk (=?UTF-8?Q?Marian_=C4=8Eurkovi=C4=8D?=)
Date: Tue, 16 Jun 2009 17:50:56 +0200
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <20090616154120.M78569@bts.sk>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
	<4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
	<alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>
	<20090616154120.M78569@bts.sk>
Message-ID: <20090616155020.M58546@bts.sk>

On Tue, 16 Jun 2009 16:19:08 +0200 (CEST), Mikael Abrahamsson wrote
> On Tue, 16 Jun 2009, FF wrote:
> 
> > I thought Chromatic Dispersion is distance related. This is supposed
> 
> Yes it is.
> 
> > to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
> > ps dispersion tolerance). Do you need a DCU even when operating within
> > that range? One of the links is only about 40-50km.
> 
> Well, you didn't say the links were DC or not, and you didn't say how 
> long the link was. At 40-50km, CD is most likely not the cause of your 
> problems.
> 
> According to some info I found, SMF-28 DSF still has 17.1ps/nm/km, 
> meaning your 1600ps dispersion tolerance only gets you 94km? I might 
> be wrong though, I can't get the whole article, google only displays 
> from its cache.

Wait, if it's really DSF, it has zero dispersion at 1550 nm.
But such fiber is unsuitable for DWDM operation.

If it's NZDSF, it should have ~ 4 - 6 ps/nm/km.

    M.


From jeff-kell at utc.edu  Tue Jun 16 13:04:28 2009
From: jeff-kell at utc.edu (Jeff Kell)
Date: Tue, 16 Jun 2009 13:04:28 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
Message-ID: <4A37D09C.7050401@utc.edu>

Clue Store wrote:
> Hi All,
>
> Looked through the archives but couldn't find anything about this specific
> issue. I'm trying to leak a route from the global table on a PE to an
> iterface that is on the same PE but I get the folowwing when I try to just
> point it to a loopback.....
>
> ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 global
> %Invalid next hop address (it's this router)

Sure.  You need a pair of VS 6509s with SUP720-3BXLs, a few FWSMs, and a
CRS-1 backup...

Just kidding.  This seems to come up every few months, and yes, I've
asked myself some time ago.  There is no easy and elegant way to do
this, AFAIK.  And believe me, I've tried. 

VRF-to-VRF, piece of cake.  Global-to-anything else, or anything
else-to-global, it just isn't happening.  The global table is sacred.

If you have redundant PEs, you can point the "next-hops" to each other
and satisfy the criteria to bleed the route.  You can also set an
interface in each endpoint and physically cable them together, as
depressing as that may sound.  I resorted to a FWSM, which also works in
the same manner as the naked cable loop.

What you and most everyone else that asks really wants is import/export
functionality involving the global table to be as straightforward as it
is for VRF route-targets, but so far, it just isn't available.

Jeff



From ip at ioshints.info  Tue Jun 16 13:23:45 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Tue, 16 Jun 2009 19:23:45 +0200
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
Message-ID: <002501c9eea7$34983830$0a00000a@nil.si>

The last time I've seen discussion on this topic, you had to have an
external back-to-back connection between a VRF interface and a global
interface. 

> -----Original Message-----
> From: Clue Store [mailto:cluestore at gmail.com] 
> Sent: Tuesday, June 16, 2009 4:18 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Global Route Leaking on same PE
> 
> Hi All,
> 
> Looked through the archives but couldn't find anything about 
> this specific issue. I'm trying to leak a route from the 
> global table on a PE to an iterface that is on the same PE 
> but I get the folowwing when I try to just point it to a loopback.....
> 
> ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 
> global %Invalid next hop address (it's this router)
> 
> Also tried to point it to just the interface and it says vpn 
> routes have to be pointed to next-hop addresses. Anyone have 
> some clue how to get this to work where the traffic never 
> leaves the same PE and makes a look around the network??
> 
> TIA
> 
> 


From jarruda-cnsp at jarruda.com  Tue Jun 16 13:48:37 2009
From: jarruda-cnsp at jarruda.com (Julio Arruda)
Date: Tue, 16 Jun 2009 13:48:37 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <002501c9eea7$34983830$0a00000a@nil.si>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
Message-ID: <4A37DAF5.1040002@jarruda.com>

Ivan Pepelnjak wrote:
> The last time I've seen discussion on this topic, you had to have an
> external back-to-back connection between a VRF interface and a global
> interface. 

I maybe wrong, but seems this was related to resolving the CEF adjacency 
   to a physical interface ?
I understand that you could then use the ip route vrf command, adding 
the interface in the ip route statement.

> 
>> -----Original Message-----
>> From: Clue Store [mailto:cluestore at gmail.com] 
>> Sent: Tuesday, June 16, 2009 4:18 PM
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] Global Route Leaking on same PE
>>
>> Hi All,
>>
>> Looked through the archives but couldn't find anything about 
>> this specific issue. I'm trying to leak a route from the 
>> global table on a PE to an iterface that is on the same PE 
>> but I get the folowwing when I try to just point it to a loopback.....
>>
>> ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 
>> global %Invalid next hop address (it's this router)
>>
>> Also tried to point it to just the interface and it says vpn 
>> routes have to be pointed to next-hop addresses. Anyone have 
>> some clue how to get this to work where the traffic never 
>> leaves the same PE and makes a look around the network??
>>
>> TIA
>>
>>
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From howard at leadmon.net  Tue Jun 16 13:38:07 2009
From: howard at leadmon.net (Howard Leadmon)
Date: Tue, 16 Jun 2009 13:38:07 -0400
Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
In-Reply-To: <C65BE5AC.321BE%dsavage@castleaccess.com>
References: <mailman.401.1245078433.2287.cisco-nsp@puck.nether.net>
	<C65BE5AC.321BE%dsavage@castleaccess.com>
Message-ID: <007101c9eea9$391ee6e0$ab5cb4a0$@net>

 Well the 7201 comes with 4x GE ports, and with the NPE-G2 your only getting
3x GE ports to start.  To get the same you would have to add a PA-GE to your
router, and probably the Jacket Card and PA-GE if you didn't want to suck up
all the bandwidth points of the slots.

 Personally I went with a 7206VXR (why get 4 slots in the same size chassis
when you can have 6), and the NPE-G2.  I do have to admit to needing a
couple PA slots, as I needed to support a DS3 and a couple DS1 lines as well
in the router.

 I think as others mentioned, the 7201 is smaller if your space tight..


---
Howard Leadmon 


> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Denis Savage
> Sent: Monday, June 15, 2009 2:49 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
> 
> Is there any benefit of going with the 7201 NPE-G2 over the 7204 VXR with
> the NPE-G2 engine? They appear to be the exact same, except the 7204 has
> four slots as opposed to the 7201 being a 1U appliance. Yet, the 7204 is
> cheaper from what I can gather. Am I missing something?
> 
> Thanks,
> 
> Denis Savage
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From rbf+cisco-nsp at panix.com  Tue Jun 16 14:21:35 2009
From: rbf+cisco-nsp at panix.com (Brett Frankenberger)
Date: Tue, 16 Jun 2009 13:21:35 -0500
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <002501c9eea7$34983830$0a00000a@nil.si>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
Message-ID: <20090616182135.GA28410@panix.com>

On Tue, Jun 16, 2009 at 07:23:45PM +0200, Ivan Pepelnjak wrote:
> The last time I've seen discussion on this topic, you had to have an
> external back-to-back connection between a VRF interface and a global
> interface. 

Depending on the platform, you can do it with a GRE tunnel with both
ends on the same router.  (Should be fine on a software-switched
platform; YMMV on a hardware switched platform.)

> > ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 global

int lo888
 ip address 10.0.0.1 255.255.255.255
int lo999
 ip address 10.0.0.2 255.255.255.255
int tun1
 ip address 10.0.0.5 255.255.255.252
 tunnel source lo888
 tunnel destination 10.0.0.2
int tun2
 ip vrf forwarding test
 tunnel source lo999
 tunnel destination 10.0.0.1
ip route vrf test 64.193.x.x 255.255.255.248 tunnel2 10.0.0.5

(Might want to force a larger MTU on the tunnel -- no fragmentation
issues since the tunnel-encapsulated packets never leave the router.)

     -- Brett

From cluestore at gmail.com  Tue Jun 16 14:28:17 2009
From: cluestore at gmail.com (Clue Store)
Date: Tue, 16 Jun 2009 13:28:17 -0500
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <4A37DAF5.1040002@jarruda.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si> <4A37DAF5.1040002@jarruda.com>
Message-ID: <580af3b90906161128v601c5d19oc22f6b462ecd904f@mail.gmail.com>

  Thanks for the replies all.
>
>
> >I maybe wrong, but seems this was related to resolving the CEF adjacency
>  to a physical interface ?
> >I understand that you could then use the ip route vrf command, adding the
> interface in the ip route statement.
>
>>
>>
>
Tried this and it said vpn routes must specify a next hop :(

I have this working pointing it to an adjecent router loop interface making
a nice traffic loop through a dot1q interface. Looks like I might just have
to either move my global boxen to another non-PE terminating router or
extend my vrf downstream to seperate the voice and data out.

Thanks
Max

From luan at netcraftsmen.net  Tue Jun 16 13:39:44 2009
From: luan at netcraftsmen.net (Luan Nguyen)
Date: Tue, 16 Jun 2009 13:39:44 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <002501c9eea7$34983830$0a00000a@nil.si>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
Message-ID: <02d001c9eea9$6f918020$4eb48060$@net>

You could also use a GRE tunnel for the connection as well.
Jeff is right that this topic keeps coming up every so often.  I wonder why
Cisco won't just make this easier for people.

----------------------------------------------
Luan Nguyen
Chesapeake NetCraftsmen, LLC.
http://www.netcraftsmen.net
----------------------------------------------

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ivan Pepelnjak
Sent: Tuesday, June 16, 2009 1:24 PM
To: 'Clue Store'; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Global Route Leaking on same PE

The last time I've seen discussion on this topic, you had to have an
external back-to-back connection between a VRF interface and a global
interface. 

> -----Original Message-----
> From: Clue Store [mailto:cluestore at gmail.com] 
> Sent: Tuesday, June 16, 2009 4:18 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Global Route Leaking on same PE
> 
> Hi All,
> 
> Looked through the archives but couldn't find anything about 
> this specific issue. I'm trying to leak a route from the 
> global table on a PE to an iterface that is on the same PE 
> but I get the folowwing when I try to just point it to a loopback.....
> 
> ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 
> global %Invalid next hop address (it's this router)
> 
> Also tried to point it to just the interface and it says vpn 
> routes have to be pointed to next-hop addresses. Anyone have 
> some clue how to get this to work where the traffic never 
> leaves the same PE and makes a look around the network??
> 
> TIA
> 
> 

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From c.spurgeon at mail.utexas.edu  Tue Jun 16 15:08:45 2009
From: c.spurgeon at mail.utexas.edu (Charles Spurgeon)
Date: Tue, 16 Jun 2009 14:08:45 -0500
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <4A36AD55.6090101@forthnet.gr>
References: <006c01c9ed4d$4f0174d0$ed045e70$@com>
	<C65B004D.544B%graham@g-rock.net>
	<20090615185418.GA48691@argus.gw.utexas.edu>
	<4A36AD55.6090101@forthnet.gr>
Message-ID: <20090616190845.GA16273@argus.gw.utexas.edu>

On Mon, Jun 15, 2009 at 11:21:18PM +0300, Tassos Chatzithomaoglou wrote:
> 
> >When we did a SP rommon upgrade to 45 sup720s a while back (to fix
> >some serious booting bugs) we lost one sup720 when it became bricked
> >due to a failed rommon upgrade.
> >
> 
> Since there is a resident (GOLD) rommon also, couldn't that one be used for 
> "recovery"?

As I recall the sup became unbootable and unrecoverable when the
rommon upgrade wedged during the upgrade process, and the TAC sent a
replacement. I couldn't find any further details in our email archives
on the issue.

-Charles

Charles E. Spurgeon / UTnet
UT Austin ITS / Networking
c.spurgeon at its.utexas.edu / 512.475.9265

From harbor235 at gmail.com  Tue Jun 16 15:45:32 2009
From: harbor235 at gmail.com (harbor235)
Date: Tue, 16 Jun 2009 15:45:32 -0400
Subject: [c-nsp] Network Perefromance
Message-ID: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>

I wanted to ping everyone on tools they were using to understand the
performace of their
network, specifically, measuring packet loss, latency, and jitter.

mike

From jkrejci at usinternet.com  Tue Jun 16 15:46:22 2009
From: jkrejci at usinternet.com (Justin Krejci)
Date: Tue, 16 Jun 2009 14:46:22 -0500
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3D3B02466EFE42EA96616FA1CBD7D798@usicorp.usinternet.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com><3329cbb40906151657h4c0ddd38t1eb52223a0ff3656@mail.gmail.com>
	<3D3B02466EFE42EA96616FA1CBD7D798@usicorp.usinternet.com>
Message-ID: <F361217983AC454587B4C224FBC5E9E9@usicorp.usinternet.com>

For the sake of completeness on this thread I was able to use the LH
transceiver just fine after entering the command "speed nonegotiate" on the
interface. 

I will be interested to hear what the provider has to say about this now,
even though prior to making my config change I double checked with them
again on their point about "LX to LH are not compatible" to make sure they
didn't hear "LH to SX" or something like that.

Thanks for the tips everyone.

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Justin Krejci
Sent: Monday, June 15, 2009 7:10 PM
To: 'Dale Shaw'
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] LX vs LH Transceivers

Dale,

Thanks for the tip but this particular case I was using the sfp-only
interface so there is not even an option for configuring media-type.

router(config)#int g5/1
router(config-if)#me?   
% Unrecognized command
router(config-if)#int g5/2
router(config-if)#me?
media-type  

router(config-if)#me


Also I did not try the "speed nonegotiate" option, I will definitely have to
try that.

Thanks!

-----Original Message-----
From: dale.shaw at gmail.com [mailto:dale.shaw at gmail.com] On Behalf Of Dale
Shaw
Sent: Monday, June 15, 2009 6:57 PM
To: Justin Krejci
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] LX vs LH Transceivers

Hi Justin,

On Tue, Jun 16, 2009 at 9:08 AM, Justin Krejci<jkrejci at usinternet.com>
wrote:
> We are running into some performance issues on the 7200 when under load so
> we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
> combo port. We have one GLC-LH-SM SFP transceiver installed into the
> sfp-only port but when cutting over the above mentioned link from the 7200
> to the 6509 we get no eth link at all.

Sorry if this is offensively obvious, but did your interface config
include "media-type sfp"?

The only other trick I've found with 1000BASE-LX recently was between
a WS-X6724-SFP line card and an Alcatel 1662 -- the link wouldn't come
up without "speed nonegotiate".

Good luck.

Cheers,
Dale

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From tdurack at gmail.com  Tue Jun 16 16:12:13 2009
From: tdurack at gmail.com (Tim Durack)
Date: Tue, 16 Jun 2009 16:12:13 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <02d001c9eea9$6f918020$4eb48060$@net>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
	<02d001c9eea9$6f918020$4eb48060$@net>
Message-ID: <9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>

On Tue, Jun 16, 2009 at 1:39 PM, Luan Nguyen<luan at netcraftsmen.net> wrote:
> You could also use a GRE tunnel for the connection as well.
> Jeff is right that this topic keeps coming up every so often. ?I wonder why
> Cisco won't just make this easier for people.
>
> ----------------------------------------------
> Luan Nguyen
> Chesapeake NetCraftsmen, LLC.
> http://www.netcraftsmen.net
> ----------------------------------------------

Amen to that.

I've played around with the various loopback strategies, including
using a gre tunnel that originates/terminates on the same PE. It
worked, but didn't seem like a scalable solution.

The conclusion I came to is that most MPLS scenarios assume you are
using a separate PE/firewall to move traffic between global and vrfs
(and probably even inter-vrf.)

It would be great to have a simple global-vrf route exchange feature though.

Tim:>

From mhuff at ox.com  Tue Jun 16 16:35:19 2009
From: mhuff at ox.com (Matthew Huff)
Date: Tue, 16 Jun 2009 16:35:19 -0400
Subject: [c-nsp] Network Perefromance
In-Reply-To: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>
References: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C142C3@PUR-EXCH07.ox.com>

We are a Cisco shop, so we use "ip sla" feature of newer IOS releases with
CiscoWorks LMS. Netflow is useful for trafic monitoring, but for latency and
jitter, the cisco featureset is really nice.

For example, between two of our voice gateway boxes (running sip trunking
between them) in NY & SF:

rtr-nyvoip#show ip sla statistics aggregated 1
IPSLAs aggregated statistics

IPSLA operation id: 1
Start Time Index: .16:15:07.749 EDT Tue Jun 16 2009
Type of operation: udp-jitter
Voice Scores:
MinOfICPIF: 11  MaxOfICPIF: 11  MinOfMOS: 4.6   MaxOfMOS: 4.6
RTT Values:
        Number Of RTT: 18000            RTT Min/Avg/Max: 91/91/96
milliseconds
Latency one-way time:
        Number of Latency one-way Samples: 0
        Source to Destination Latency one way Min/Avg/Max: 0/0/0
milliseconds
        Destination to Source Latency one way Min/Avg/Max: 0/0/0
milliseconds
Jitter Time:
        Number of SD Jitter Samples: 17982
        Number of DS Jitter Samples: 17982
        Source to Destination Jitter Min/Avg/Max: 0/1/4 milliseconds
        Destination to Source Jitter Min/Avg/Max: 0/1/4 milliseconds
Packet Loss Values:
        Loss Source to Destination: 0           Loss Destination to Source:
0
        Out Of Sequence: 0      Tail Drop: 0
        Packet Late Arrival: 0  Packet Skipped: 0
Number of successes: 18
Number of failures: 0

Start Time Index: .15:15:07.749 EDT Tue Jun 16 2009
Type of operation: udp-jitter
Voice Scores:
MinOfICPIF: 11  MaxOfICPIF: 11  MinOfMOS: 4.6   MaxOfMOS: 4.6
RTT Values:
        Number Of RTT: 60000            RTT Min/Avg/Max: 91/91/103
milliseconds
Latency one-way time:
        Number of Latency one-way Samples: 0
        Source to Destination Latency one way Min/Avg/Max: 0/0/0
milliseconds
        Destination to Source Latency one way Min/Avg/Max: 0/0/0
milliseconds
Jitter Time:
        Number of SD Jitter Samples: 59940
        Number of DS Jitter Samples: 59940
        Source to Destination Jitter Min/Avg/Max: 0/1/11 milliseconds
        Destination to Source Jitter Min/Avg/Max: 0/1/7 milliseconds
Packet Loss Values:
        Loss Source to Destination: 0           Loss Destination to Source:
0
        Out Of Sequence: 0      Tail Drop: 0
        Packet Late Arrival: 0  Packet Skipped: 0
Number of successes: 60
Number of failures: 0

The config is:

ip sla responder
ip sla logging traps
ip sla 1
 udp-jitter x.x.x.x 12420 source-ip x.x.x.x codec g729a
ip sla schedule 1 life forever start-time now


----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of harbor235
> Sent: Tuesday, June 16, 2009 3:46 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Network Perefromance
> 
> I wanted to ping everyone on tools they were using to understand the
> performace of their
> network, specifically, measuring packet loss, latency, and jitter.
> 
> mike
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090616/5173b555/attachment.bin>

From fusionfoto at gmail.com  Tue Jun 16 16:51:00 2009
From: fusionfoto at gmail.com (FF)
Date: Tue, 16 Jun 2009 16:51:00 -0400
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <20090616155020.M58546@bts.sk>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
	<4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
	<alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>
	<20090616154120.M78569@bts.sk> <20090616155020.M58546@bts.sk>
Message-ID: <4522daf90906161351y5e9053d2ic32c2ef3abde6fe7@mail.gmail.com>

Ok. On the 4-6 ps/nm/km basis we are close but not outside out budget.
The lower number is what  we budgeted for.

We solved the primary traffic problem (which packet loss on two
completely different links). It wasn't related to the hardware
but rather the MPLS FIB being in exception. Supposedly you can't clear
this without a reboot, but clear mpls ldp neigh * seems
to do the trick.

Exactly *why* so many routes were being tagged as MPLS isn't clear yet.

Cisco TAC wasn't more lucid than saying bad things can happen in MPLS
exception state, and you have to reboot to fix it.

Thanks for your assistance everyone! I will be doing some dispersion
measurements on the other leg.


On Tue, Jun 16, 2009 at 11:50 AM, Marian ?urkovi?<md at bts.sk> wrote:
> On Tue, 16 Jun 2009 16:19:08 +0200 (CEST), Mikael Abrahamsson wrote
>> On Tue, 16 Jun 2009, FF wrote:
>>
>> > I thought Chromatic Dispersion is distance related. This is supposed
>>
>> Yes it is.
>>
>> > to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
>> > ps dispersion tolerance). Do you need a DCU even when operating within
>> > that range? One of the links is only about 40-50km.
>>
>> Well, you didn't say the links were DC or not, and you didn't say how
>> long the link was. At 40-50km, CD is most likely not the cause of your
>> problems.
>>
>> According to some info I found, SMF-28 DSF still has 17.1ps/nm/km,
>> meaning your 1600ps dispersion tolerance only gets you 94km? I might
>> be wrong though, I can't get the whole article, google only displays
>> from its cache.
>
> Wait, if it's really DSF, it has zero dispersion at 1550 nm.
> But such fiber is unsuitable for DWDM operation.
>
> If it's NZDSF, it should have ~ 4 - 6 ps/nm/km.
>
> ? ?M.
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
FF

From chris.brown at acsalaska.net  Tue Jun 16 18:49:00 2009
From: chris.brown at acsalaska.net (Christopher E. Brown)
Date: Tue, 16 Jun 2009 14:49:00 -0800
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
Message-ID: <4A38215C.1020707@acsalaska.net>



Can anyone comment on the 2821 as an ethernet fed MPLS PE?


This would require a settable MTU on the GigE ports "ie: mtu 1576", and standard support
for LDP, MP-BGP, standard L3 VPN support.


Spent too much time trolling Cisco site and not finding answers.


-- 
------------------------------------------------------------------------
Christopher E. Brown   <chris.brown at acsalaska.net>   desk (907) 550-8393
                                                     cell (907) 632-8492
IP Engineer - ACS
------------------------------------------------------------------------


From td_miles at yahoo.com  Tue Jun 16 19:29:04 2009
From: td_miles at yahoo.com (Tony)
Date: Tue, 16 Jun 2009 16:29:04 -0700 (PDT)
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
Message-ID: <915014.72951.qm@web110103.mail.gq1.yahoo.com>

Hi Chris,



This link will tell you about the MPLS support (answer = yes, depending):



http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6557/prod_white_paper0900aecd8051fbdc.html





And look here for jumbo frame support on 2800 (answer = yes, up to 9000 bytes):



http://www.cisco.com/en/US/prod/collateral/routers/ps5854/prod_qas0900aecd80169bd6.html





regards,

Tony.

--- On Wed, 17/6/09, Christopher E. Brown <chris.brown at acsalaska.net> wrote:

From: Christopher E. Brown <chris.brown at acsalaska.net>
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
To: "'Cisco-nsp'" <cisco-nsp at puck.nether.net>
Date: Wednesday, 17 June, 2009, 8:49 AM



Can anyone comment on the 2821 as an ethernet fed MPLS PE?


This would require a settable MTU on the GigE ports "ie: mtu 1576", and standard support
for LDP, MP-BGP, standard L3 VPN support.


Spent too much time trolling Cisco site and not finding answers.




      

From CFlint at mt.gov  Tue Jun 16 19:56:23 2009
From: CFlint at mt.gov (Flint, Chris)
Date: Tue, 16 Jun 2009 17:56:23 -0600
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
Message-ID: <169F1B4CBA47CC4F93BF2BD0A504C0552EB157532C@doaisd05222.state.mt.ads>

2821 works as an MPLS PE, the 10/100/1000 interfaces on 2821 support higher MTU.  

If you downsize to a 2811/01, you have to run 12.4(x)T to get a user-settable MTU on the 10/100 interface.  Even then you get an error message, but the MTU command is accepted.  I'm not sure exactly where support started, but (20)T and (22)T both support it.



Flint


--------------------------------------------
Message: 6
Date: Tue, 16 Jun 2009 16:29:04 -0700 (PDT)
From: Tony <td_miles at yahoo.com>
To: "'Cisco-nsp'" <cisco-nsp at puck.nether.net>,	"Christopher E. Brown"
	<chris.brown at acsalaska.net>
Subject: Re: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
Message-ID: <915014.72951.qm at web110103.mail.gq1.yahoo.com>
Content-Type: text/plain; charset=utf-8

Hi Chris,

This link will tell you about the MPLS support (answer = yes, depending):
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6557/prod_white_paper0900aecd8051fbdc.html

And look here for jumbo frame support on 2800 (answer = yes, up to 9000 bytes):
http://www.cisco.com/en/US/prod/collateral/routers/ps5854/prod_qas0900aecd80169bd6.html


regards,

Tony.

--- On Wed, 17/6/09, Christopher E. Brown <chris.brown at acsalaska.net> wrote:

From: Christopher E. Brown <chris.brown at acsalaska.net>
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
To: "'Cisco-nsp'" <cisco-nsp at puck.nether.net>
Date: Wednesday, 17 June, 2009, 8:49 AM



Can anyone comment on the 2821 as an ethernet fed MPLS PE?


This would require a settable MTU on the GigE ports "ie: mtu 1576", and standard support
for LDP, MP-BGP, standard L3 VPN support.


Spent too much time trolling Cisco site and not finding answers.

------------------------------

From danletkeman at gmail.com  Tue Jun 16 20:13:18 2009
From: danletkeman at gmail.com (Dan Letkeman)
Date: Tue, 16 Jun 2009 19:13:18 -0500
Subject: [c-nsp] Dynamic DNS updates to Local DNS Server
Message-ID: <dcbb85870906161713m6180a202r5be4f1ca56ef5b30@mail.gmail.com>

Hello,

I cannot seem to find any information or configuration examples of
using a Cisco IOS DHCP server to update A records on a local dns
server.

I would like to have the router that is running dhcp update the
records for a few windows workstation to a bind dns server.

Any help would be appreciated.

From tseveendorj at gmail.com  Tue Jun 16 20:42:32 2009
From: tseveendorj at gmail.com (Tseveendorj)
Date: Wed, 17 Jun 2009 09:42:32 +0900
Subject: [c-nsp] 3825 memory issue
Message-ID: <4A383BF8.4020705@gmail.com>

Hello,

I'm using 3825 router to provide internet for ADSL customers. Last week 
I configured policy-map to provide different bandwidth usage. Since this 
time my routers memory usage goes up.

border-r#sh processes memory sorted allocated
Processor Pool Total:  143619888 Used:  118621160 Free:   24998728
      I/O Pool Total:   36699648 Used:   10651088 Free:   26048560

 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
   0   0 4186877216 4187728860    1501456     256604          0 *Dead*
 104   0  110901912    6213036   95681064          0          0 PPP IP Route
 224   0   79114360   79153804       8752          0          0 crypto 
sw pk pro
   0   0   45088716   14947936   24508036          0          0 *Init*
 219   0   26739468   26964080      13060          0          0 SNMP ENGINE
 217   0   17194704   16959140      24012          0          0 IP SNMP
   1   0   16815572   15676464    1146168          0          0 Chunk 
Manager
 225   0   12566668   12602840     170956          0          0 
VTEMPLATE Backgr
 213   0    5154176   13760992      38104          0          0 PPP Events
  18   0    4428420    4428088       7392          0          0 ARP 
Background
 210   0    3901896    1455596     422460          0          0 PPPoE 
Discovery
  88   0    3291920    3138964      82928          0          0 IP Input
 109   0    2823624          0      13060          0          0 TCP 
Protocols
 209   0    1489464     320004     606848          0          0 PPPoE 
Background
  83   0    1131888          0       7060          0          0 AAA ACCT 
Proc
 222   0     969124    4249452      67108          0          0 RADIUS
  82   0     953112        252      13664          0          0 AAA Server
 207   0     750732       4252     775844          0          0 L2TP 
mgmt daemon
  59   0     648724       1328     629396          0          0 USB Startup
 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
  95   0     439864     305652     243420          0          0 SSS Manager
  77 578     413692     401112      24988          0          0 Virtual Exec
 178   0     350580    1918340       7060          0          0 AAA SEND 
STOP EV
  25   0     263208          0     272656     113400          0 EEM ED 
Syslog
 198   0     250300     250300      13060          0          0 Syslog
 167   0     247992          0     255052          0          0 
QOS_MODULE_MAIN
 188   0     119396       7344     125844          0          0 EEM Server
 122   0     108244        252     115052          0          0 SCTP 
Main Proces
 120   0     104664        252     103352          0          0 DHCPD 
Receive
  93   0      98112        504      13060          0          0 PPP Hooks
 106   0      73808          0      73808          0          0 CEF process
 142   0      73236        252      72648          0          0 FLEX 
DSPRM MAIN
  17   0      72948      32844      47164          0          0 ARP Input
  24   0      72748          0      79808          0          0 Entity 
MIB API
  40   0      67568       4424       7060          0          0 TTY 
Background
 103   0      66736          0      76796          0          0 IP RIB 
Update
   4   0      65588          0      90648          0          0 EDDRI_MAIN
 152   0      59568      73276       7060          0          0 LOCAL AAA
  54   0      57904        252      64712          0          0 VNM 
DSPRM MAIN
 206   0      56660          0      15868          0          0 SSH 
Event handle
  84   0      49384          0      56444          0          0 ACCT 
Periodic Pr
 226   0      47236      16108      16152          0          0 BGP Router

I have several questions.

1. What is *Dead* process ? it takes many memory why ?
2. Is there any unknown process working ?
3. How do I decrease memory usage ?
4. What is column of memory real usage ?

Sincerely,
Tseveen.

From andy.saykao at staff.netspace.net.au  Tue Jun 16 21:43:27 2009
From: andy.saykao at staff.netspace.net.au (Andy Saykao)
Date: Wed, 17 Jun 2009 11:43:27 +1000
Subject: [c-nsp] Can you apply crypto map to SVI
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
	<4A375FB9.3010305@umn.edu>
Message-ID: <56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>

Hi Ge,

Yes I see an active crypto engine in "software". 

core1#sh cry engine configuration

        crypto engine name:  unknown
        crypto engine type:  software
             serial number:  00016956
       crypto engine state:  installed
     crypto engine in slot:  N/A
                  platform:  Cisco Software Crypto Engine

   Encryption Process Info:
          input queue size:  500
           input queue top:  0
           input queue bot:  0
         input queue count:  0

   Crypto Adjacency Counts:
                Lock Count:  0
              Unlock Count:  0
        crypto lib version:  17.0.0
         ipsec lib version:  2.0.0

Does this mean that if the crypto map is applied to the SVI that the
IPSEC tunnel should be working (considering my IPSEC config is all
good).

Thanks.

Andy

-----Original Message-----
From: Ge Moua [mailto:moua0100 at umn.edu] 
Sent: Tuesday, 16 June 2009 7:03 PM
To: Andy Saykao
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Can you apply crypto map to SVI

Yes, this should work contigent on hw plaform.  If you do a "sh cry
engine" do you see an active crypto engine in sw or hw?  If not then the
crypto commands will never be invoked even though legal.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi All,
>  
> Got a problem with a site-to-site IPSEC vpn implementation where one 
> end is using SVI.
>  
> Does any body know if a crypto map can be applied to a SVI to bring up

> the IPSEC tunnel? It accepts the command but I can't pass any traffic 
> to/from it.
>  
> interface vlan 10
>  crypto map MY-MAP
>  
> Or do you need to apply the crypto map to a physical interface? 
>  
> I've gotten it working on a sub-interface (eg: interface
> GigabitEthernet0/0.11) but can't find any documentation that talks 
> about applying it to a SVI and whether this will work.
>  
> Thanks.
>  
> Andy
>
> This email and any files transmitted with it are confidential and 
> intended  solely for the use of the individual or entity to whom they
are addressed.
> Please notify the sender immediately by email if you have received 
> this email by mistake and delete this email from your system. Please 
> note that  any views or opinions presented in this email are solely 
> those of the  author and do not necessarily represent those of the
organisation.
> Finally, the recipient should check this email and any attachments for

> the presence of viruses. The organisation accepts no liability for any

> damage caused by any virus transmitted by this email.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________

From uugnaa_mns at yahoo.com  Tue Jun 16 22:16:37 2009
From: uugnaa_mns at yahoo.com (uugnaa)
Date: Tue, 16 Jun 2009 19:16:37 -0700 (PDT)
Subject: [c-nsp] 3825 memory issue
Message-ID: <952530.34890.qm@web55102.mail.re4.yahoo.com>

Hello,

*Dead* is nothing but processes as a group that are now dead.


"Holding" is Amount of memory currently allocated to the process.

"Allocated" is Bytes of memory allocated by the process.

"Freed" is Bytes of memory freed by the process, regardless of who originally allocated it.

Please try on following command, you may get glue
#show memory dead 
#show memory debug unused
#show memory
#show processes


--- On Wed, 6/17/09, Tseveendorj <tseveendorj at gmail.com> wrote:

From: Tseveendorj <tseveendorj at gmail.com>
Subject: [c-nsp] 3825 memory issue
To: cisco-nsp at puck.nether.net
Date: Wednesday, June 17, 2009, 6:12 AM

Hello,

I'm using 3825 router to provide internet for ADSL customers. Last week I configured policy-map to provide different bandwidth usage. Since this time my routers memory usage goes up.

border-r#sh processes memory sorted allocated
Processor Pool Total:? 143619888 Used:? 118621160 Free:???24998728
? ???I/O Pool Total:???36699648 Used:???10651088 Free:???26048560

PID TTY? Allocated? ? ? Freed? ? Holding? ? Getbufs? ? Retbufs Process
? 0???0 4186877216 4187728860? ? 1501456? ???256604? ? ? ? ? 0 *Dead*
104???0? 110901912? ? 6213036???95681064? ? ? ? ? 0? ? ? ? ? 0 PPP IP Route
224???0???79114360???79153804? ? ???8752? ? ? ? ? 0? ? ? ? ? 0 crypto sw pk pro
? 0???0???45088716???14947936???24508036? ? ? ? ? 0? ? ? ? ? 0 *Init*
219???0???26739468???26964080? ? ? 13060? ? ? ? ? 0? ? ? ? ? 0 SNMP ENGINE
217???0???17194704???16959140? ? ? 24012? ? ? ? ? 0? ? ? ? ? 0 IP SNMP
? 1???0???16815572???15676464? ? 1146168? ? ? ? ? 0? ? ? ? ? 0 Chunk Manager
225???0???12566668???12602840? ???170956? ? ? ? ? 0? ? ? ? ? 0 VTEMPLATE Backgr
213???0? ? 5154176???13760992? ? ? 38104? ? ? ? ? 0? ? ? ? ? 0 PPP Events
 18???0? ? 4428420? ? 4428088? ? ???7392? ? ? ? ? 0? ? ? ? ? 0 ARP Background
210???0? ? 3901896? ? 1455596? ???422460? ? ? ? ? 0? ? ? ? ? 0 PPPoE Discovery
 88???0? ? 3291920? ? 3138964? ? ? 82928? ? ? ? ? 0? ? ? ? ? 0 IP Input
109???0? ? 2823624? ? ? ? ? 0? ? ? 13060? ? ? ? ? 0? ? ? ? ? 0 TCP Protocols
209???0? ? 1489464? ???320004? ???606848? ? ? ? ? 0? ? ? ? ? 0 PPPoE Background
 83???0? ? 1131888? ? ? ? ? 0? ? ???7060? ? ? ? ? 0? ? ? ? ? 0 AAA ACCT Proc
222???0? ???969124? ? 4249452? ? ? 67108? ? ? ? ? 0? ? ? ? ? 0 RADIUS
 82???0? ???953112? ? ? ? 252? ? ? 13664? ? ? ? ? 0? ? ? ? ? 0 AAA Server
207???0? ???750732? ? ???4252? ???775844? ? ? ? ? 0? ? ? ? ? 0 L2TP mgmt daemon
 59???0? ???648724? ? ???1328? ???629396? ? ? ? ? 0? ? ? ? ? 0 USB Startup
PID TTY? Allocated? ? ? Freed? ? Holding? ? Getbufs? ? Retbufs Process
 95???0? ???439864? ???305652? ???243420? ? ? ? ? 0? ? ? ? ? 0 SSS Manager
 77 578? ???413692? ???401112? ? ? 24988? ? ? ? ? 0? ? ? ? ? 0 Virtual Exec
178???0? ???350580? ? 1918340? ? ???7060? ? ? ? ? 0? ? ? ? ? 0 AAA SEND STOP EV
 25???0? ???263208? ? ? ? ? 0? ???272656? ???113400? ? ? ? ? 0 EEM ED Syslog
198???0? ???250300? ???250300? ? ? 13060? ? ? ? ? 0? ? ? ? ? 0 Syslog
167???0? ???247992? ? ? ? ? 0? ???255052? ? ? ? ? 0? ? ? ? ? 0 QOS_MODULE_MAIN
188???0? ???119396? ? ???7344? ???125844? ? ? ? ? 0? ? ? ? ? 0 EEM Server
122???0? ???108244? ? ? ? 252? ???115052? ? ? ? ? 0? ? ? ? ? 0 SCTP Main Proces
120???0? ???104664? ? ? ? 252? ???103352? ? ? ? ? 0? ? ? ? ? 0 DHCPD Receive
 93???0? ? ? 98112? ? ? ? 504? ? ? 13060? ? ? ? ? 0? ? ? ? ? 0 PPP Hooks
106???0? ? ? 73808? ? ? ? ? 0? ? ? 73808? ? ? ? ? 0? ? ? ? ? 0 CEF process
142???0? ? ? 73236? ? ? ? 252? ? ? 72648? ? ? ? ? 0? ? ? ? ? 0 FLEX DSPRM MAIN
 17???0? ? ? 72948? ? ? 32844? ? ? 47164? ? ? ? ? 0? ? ? ? ? 0 ARP Input
 24???0? ? ? 72748? ? ? ? ? 0? ? ? 79808? ? ? ? ? 0? ? ? ? ? 0 Entity MIB API
 40???0? ? ? 67568? ? ???4424? ? ???7060? ? ? ? ? 0? ? ? ? ? 0 TTY Background
103???0? ? ? 66736? ? ? ? ? 0? ? ? 76796? ? ? ? ? 0? ? ? ? ? 0 IP RIB Update
? 4???0? ? ? 65588? ? ? ? ? 0? ? ? 90648? ? ? ? ? 0? ? ? ? ? 0 EDDRI_MAIN
152???0? ? ? 59568? ? ? 73276? ? ???7060? ? ? ? ? 0? ? ? ? ? 0 LOCAL AAA
 54???0? ? ? 57904? ? ? ? 252? ? ? 64712? ? ? ? ? 0? ? ? ? ? 0 VNM DSPRM MAIN
206???0? ? ? 56660? ? ? ? ? 0? ? ? 15868? ? ? ? ? 0? ? ? ? ? 0 SSH Event handle
 84???0? ? ? 49384? ? ? ? ? 0? ? ? 56444? ? ? ? ? 0? ? ? ? ? 0 ACCT Periodic Pr
226???0? ? ? 47236? ? ? 16108? ? ? 16152? ? ? ? ? 0? ? ? ? ? 0 BGP Router

I have several questions.

1. What is *Dead* process ? it takes many memory why ?
2. Is there any unknown process working ?
3. How do I decrease memory usage ?
4. What is column of memory real usage ?

Sincerely,
Tseveen.
_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



      

From moua0100 at umn.edu  Wed Jun 17 00:15:24 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Tue, 16 Jun 2009 23:15:24 -0500
Subject: [c-nsp] Can you apply crypto map to SVI
In-Reply-To: <56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
	<4A375FB9.3010305@umn.edu>
	<56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>
Message-ID: <4A386DDC.6030302@umn.edu>

Maybe; I've seen a situation with the me-6524 with the crypto commands 
available but functionality disabled.  What hardware platform are you 
running?

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi Ge,
>
> Yes I see an active crypto engine in "software". 
>
> core1#sh cry engine configuration
>
>         crypto engine name:  unknown
>         crypto engine type:  software
>              serial number:  00016956
>        crypto engine state:  installed
>      crypto engine in slot:  N/A
>                   platform:  Cisco Software Crypto Engine
>
>    Encryption Process Info:
>           input queue size:  500
>            input queue top:  0
>            input queue bot:  0
>          input queue count:  0
>
>    Crypto Adjacency Counts:
>                 Lock Count:  0
>               Unlock Count:  0
>         crypto lib version:  17.0.0
>          ipsec lib version:  2.0.0
>
> Does this mean that if the crypto map is applied to the SVI that the
> IPSEC tunnel should be working (considering my IPSEC config is all
> good).
>
> Thanks.
>
> Andy
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu] 
> Sent: Tuesday, 16 June 2009 7:03 PM
> To: Andy Saykao
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Can you apply crypto map to SVI
>
> Yes, this should work contigent on hw plaform.  If you do a "sh cry
> engine" do you see an active crypto engine in sw or hw?  If not then the
> crypto commands will never be invoked even though legal.
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Andy Saykao wrote:
>   
>> Hi All,
>>  
>> Got a problem with a site-to-site IPSEC vpn implementation where one 
>> end is using SVI.
>>  
>> Does any body know if a crypto map can be applied to a SVI to bring up
>>     
>
>   
>> the IPSEC tunnel? It accepts the command but I can't pass any traffic 
>> to/from it.
>>  
>> interface vlan 10
>>  crypto map MY-MAP
>>  
>> Or do you need to apply the crypto map to a physical interface? 
>>  
>> I've gotten it working on a sub-interface (eg: interface
>> GigabitEthernet0/0.11) but can't find any documentation that talks 
>> about applying it to a SVI and whether this will work.
>>  
>> Thanks.
>>  
>> Andy
>>
>> This email and any files transmitted with it are confidential and 
>> intended  solely for the use of the individual or entity to whom they
>>     
> are addressed.
>   
>> Please notify the sender immediately by email if you have received 
>> this email by mistake and delete this email from your system. Please 
>> note that  any views or opinions presented in this email are solely 
>> those of the  author and do not necessarily represent those of the
>>     
> organisation.
>   
>> Finally, the recipient should check this email and any attachments for
>>     
>
>   
>> the presence of viruses. The organisation accepts no liability for any
>>     
>
>   
>> damage caused by any virus transmitted by this email.
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email
> ______________________________________________________________________
>   

From andy.saykao at staff.netspace.net.au  Wed Jun 17 00:17:45 2009
From: andy.saykao at staff.netspace.net.au (Andy Saykao)
Date: Wed, 17 Jun 2009 14:17:45 +1000
Subject: [c-nsp] Can you apply crypto map to SVI
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
	<4A375FB9.3010305@umn.edu>
	<56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>
	<4A386DDC.6030302@umn.edu>
Message-ID: <56F211C5E3F24F47B103EA1B253822BE03654E87@vic-cr-ex1.staff.netspace.net.au>

Hi Ge,

This is being implemented on a Cisco 7606 (SUP720) running
12.2(18)SXF16.

Thanks.

Andy 

-----Original Message-----
From: Ge Moua [mailto:moua0100 at umn.edu] 
Sent: Wednesday, 17 June 2009 2:15 PM
To: Andy Saykao
Cc: cisco-nsp at puck.nether.net
Subject: Re: Can you apply crypto map to SVI

Maybe; I've seen a situation with the me-6524 with the crypto commands
available but functionality disabled.  What hardware platform are you
running?

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi Ge,
>
> Yes I see an active crypto engine in "software". 
>
> core1#sh cry engine configuration
>
>         crypto engine name:  unknown
>         crypto engine type:  software
>              serial number:  00016956
>        crypto engine state:  installed
>      crypto engine in slot:  N/A
>                   platform:  Cisco Software Crypto Engine
>
>    Encryption Process Info:
>           input queue size:  500
>            input queue top:  0
>            input queue bot:  0
>          input queue count:  0
>
>    Crypto Adjacency Counts:
>                 Lock Count:  0
>               Unlock Count:  0
>         crypto lib version:  17.0.0
>          ipsec lib version:  2.0.0
>
> Does this mean that if the crypto map is applied to the SVI that the 
> IPSEC tunnel should be working (considering my IPSEC config is all 
> good).
>
> Thanks.
>
> Andy
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu]
> Sent: Tuesday, 16 June 2009 7:03 PM
> To: Andy Saykao
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Can you apply crypto map to SVI
>
> Yes, this should work contigent on hw plaform.  If you do a "sh cry 
> engine" do you see an active crypto engine in sw or hw?  If not then 
> the crypto commands will never be invoked even though legal.
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Andy Saykao wrote:
>   
>> Hi All,
>>  
>> Got a problem with a site-to-site IPSEC vpn implementation where one 
>> end is using SVI.
>>  
>> Does any body know if a crypto map can be applied to a SVI to bring 
>> up
>>     
>
>   
>> the IPSEC tunnel? It accepts the command but I can't pass any traffic

>> to/from it.
>>  
>> interface vlan 10
>>  crypto map MY-MAP
>>  
>> Or do you need to apply the crypto map to a physical interface? 
>>  
>> I've gotten it working on a sub-interface (eg: interface
>> GigabitEthernet0/0.11) but can't find any documentation that talks 
>> about applying it to a SVI and whether this will work.
>>  
>> Thanks.
>>  
>> Andy
>>
>> This email and any files transmitted with it are confidential and 
>> intended  solely for the use of the individual or entity to whom they
>>     
> are addressed.
>   
>> Please notify the sender immediately by email if you have received 
>> this email by mistake and delete this email from your system. Please 
>> note that  any views or opinions presented in this email are solely 
>> those of the  author and do not necessarily represent those of the
>>     
> organisation.
>   
>> Finally, the recipient should check this email and any attachments 
>> for
>>     
>
>   
>> the presence of viruses. The organisation accepts no liability for 
>> any
>>     
>
>   
>> damage caused by any virus transmitted by this email.
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email 
> ______________________________________________________________________
>   

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________

From moua0100 at umn.edu  Wed Jun 17 00:43:45 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Tue, 16 Jun 2009 23:43:45 -0500
Subject: [c-nsp] Can you apply crypto map to SVI
In-Reply-To: <56F211C5E3F24F47B103EA1B253822BE03654E87@vic-cr-ex1.staff.netspace.net.au>
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
	<4A375FB9.3010305@umn.edu>
	<56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>
	<4A386DDC.6030302@umn.edu>
	<56F211C5E3F24F47B103EA1B253822BE03654E87@vic-cr-ex1.staff.netspace.net.au>
Message-ID: <4A387481.4080403@umn.edu>

I think on the 6500 with Sup720 you may need a IPSec VAM or SPA card for 
IPSec functionality to be active; I wonder if this is the same on the 
7606; you should open a case with Cisco and ask the quesiton.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi Ge,
>
> This is being implemented on a Cisco 7606 (SUP720) running
> 12.2(18)SXF16.
>
> Thanks.
>
> Andy 
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu] 
> Sent: Wednesday, 17 June 2009 2:15 PM
> To: Andy Saykao
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: Can you apply crypto map to SVI
>
> Maybe; I've seen a situation with the me-6524 with the crypto commands
> available but functionality disabled.  What hardware platform are you
> running?
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Andy Saykao wrote:
>   
>> Hi Ge,
>>
>> Yes I see an active crypto engine in "software". 
>>
>> core1#sh cry engine configuration
>>
>>         crypto engine name:  unknown
>>         crypto engine type:  software
>>              serial number:  00016956
>>        crypto engine state:  installed
>>      crypto engine in slot:  N/A
>>                   platform:  Cisco Software Crypto Engine
>>
>>    Encryption Process Info:
>>           input queue size:  500
>>            input queue top:  0
>>            input queue bot:  0
>>          input queue count:  0
>>
>>    Crypto Adjacency Counts:
>>                 Lock Count:  0
>>               Unlock Count:  0
>>         crypto lib version:  17.0.0
>>          ipsec lib version:  2.0.0
>>
>> Does this mean that if the crypto map is applied to the SVI that the 
>> IPSEC tunnel should be working (considering my IPSEC config is all 
>> good).
>>
>> Thanks.
>>
>> Andy
>>
>> -----Original Message-----
>> From: Ge Moua [mailto:moua0100 at umn.edu]
>> Sent: Tuesday, 16 June 2009 7:03 PM
>> To: Andy Saykao
>> Cc: cisco-nsp at puck.nether.net
>> Subject: Re: [c-nsp] Can you apply crypto map to SVI
>>
>> Yes, this should work contigent on hw plaform.  If you do a "sh cry 
>> engine" do you see an active crypto engine in sw or hw?  If not then 
>> the crypto commands will never be invoked even though legal.
>>
>> Regards,
>> Ge Moua | Email: moua0100 at umn.edu
>>
>> Network Design Engineer
>> University of Minnesota | Networking & Telecommunications Services
>>
>>
>>
>> Andy Saykao wrote:
>>   
>>     
>>> Hi All,
>>>  
>>> Got a problem with a site-to-site IPSEC vpn implementation where one 
>>> end is using SVI.
>>>  
>>> Does any body know if a crypto map can be applied to a SVI to bring 
>>> up
>>>     
>>>       
>>   
>>     
>>> the IPSEC tunnel? It accepts the command but I can't pass any traffic
>>>       
>
>   
>>> to/from it.
>>>  
>>> interface vlan 10
>>>  crypto map MY-MAP
>>>  
>>> Or do you need to apply the crypto map to a physical interface? 
>>>  
>>> I've gotten it working on a sub-interface (eg: interface
>>> GigabitEthernet0/0.11) but can't find any documentation that talks 
>>> about applying it to a SVI and whether this will work.
>>>  
>>> Thanks.
>>>  
>>> Andy
>>>
>>> This email and any files transmitted with it are confidential and 
>>> intended  solely for the use of the individual or entity to whom they
>>>     
>>>       
>> are addressed.
>>   
>>     
>>> Please notify the sender immediately by email if you have received 
>>> this email by mistake and delete this email from your system. Please 
>>> note that  any views or opinions presented in this email are solely 
>>> those of the  author and do not necessarily represent those of the
>>>     
>>>       
>> organisation.
>>   
>>     
>>> Finally, the recipient should check this email and any attachments 
>>> for
>>>     
>>>       
>>   
>>     
>>> the presence of viruses. The organisation accepts no liability for 
>>> any
>>>     
>>>       
>>   
>>     
>>> damage caused by any virus transmitted by this email.
>>>
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>   
>>>     
>>>       
>> ______________________________________________________________________
>> This email has been scanned by the MessageLabs Email Security System.
>> For more information please visit http://www.messagelabs.com/email 
>> ______________________________________________________________________
>>   
>>     
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email
> ______________________________________________________________________
>   

From tseveendorj at gmail.com  Wed Jun 17 00:36:10 2009
From: tseveendorj at gmail.com (Tseveendorj)
Date: Wed, 17 Jun 2009 13:36:10 +0900
Subject: [c-nsp] 3825 memory issue
In-Reply-To: <952530.34890.qm@web55102.mail.re4.yahoo.com>
References: <952530.34890.qm@web55102.mail.re4.yahoo.com>
Message-ID: <4A3872BA.9010500@gmail.com>

PPP IP Route process eating a lot of memory and It is keep eating up 
hour by hour.

border-r#sh processes memory sorted holding
Processor Pool Total:  143619888 Used:  120966360 Free:   22653528
      I/O Pool Total:   36699648 Used:   10651088 Free:   26048560

 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
 104   0  113301400    6272240   97988856          0          0 PPP IP Route
   0   0   45088716   14947936   24508036          0          0 *Init*
   0   0   11410388   12182232    1503712     256604          0 *Dead*
   1   0   16854608   15701280    1160388          0          0 Chunk 
Manager


Any clue get out of memory related thing with configuration ?
Other way I have to upgrade RAM.

Sincerely,
Tseveen.



uugnaa wrote:
> Hello,
>
> *Dead* is nothing but processes as a group that are now dead.
>
>
> "Holding" is Amount of memory currently allocated to the process.
>
> "Allocated" is Bytes of memory allocated by the process.
>
> "Freed" is Bytes of memory freed by the process, regardless of who originally allocated it.
>
> Please try on following command, you may get glue
> #show memory dead 
> #show memory debug unused
> #show memory
> #show processes
>
>
> --- On Wed, 6/17/09, Tseveendorj <tseveendorj at gmail.com> wrote:
>
> From: Tseveendorj <tseveendorj at gmail.com>
> Subject: [c-nsp] 3825 memory issue
> To: cisco-nsp at puck.nether.net
> Date: Wednesday, June 17, 2009, 6:12 AM
>
> Hello,
>
> I'm using 3825 router to provide internet for ADSL customers. Last week I configured policy-map to provide different bandwidth usage. Since this time my routers memory usage goes up.
>
> border-r#sh processes memory sorted allocated
> Processor Pool Total:  143619888 Used:  118621160 Free:   24998728
>      I/O Pool Total:   36699648 Used:   10651088 Free:   26048560
>
> PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
>   0   0 4186877216 4187728860    1501456     256604          0 *Dead*
> 104   0  110901912    6213036   95681064          0          0 PPP IP Route
> 224   0   79114360   79153804       8752          0          0 crypto sw pk pro
>   0   0   45088716   14947936   24508036          0          0 *Init*
> 219   0   26739468   26964080      13060          0          0 SNMP ENGINE
> 217   0   17194704   16959140      24012          0          0 IP SNMP
>   1   0   16815572   15676464    1146168          0          0 Chunk Manager
> 225   0   12566668   12602840     170956          0          0 VTEMPLATE Backgr
> 213   0    5154176   13760992      38104          0          0 PPP Events
>  18   0    4428420    4428088       7392          0          0 ARP Background
> 210   0    3901896    1455596     422460          0          0 PPPoE Discovery
>  88   0    3291920    3138964      82928          0          0 IP Input
> 109   0    2823624          0      13060          0          0 TCP Protocols
> 209   0    1489464     320004     606848          0          0 PPPoE Background
>  83   0    1131888          0       7060          0          0 AAA ACCT Proc
> 222   0     969124    4249452      67108          0          0 RADIUS
>  82   0     953112        252      13664          0          0 AAA Server
> 207   0     750732       4252     775844          0          0 L2TP mgmt daemon
>  59   0     648724       1328     629396          0          0 USB Startup
> PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
>  95   0     439864     305652     243420          0          0 SSS Manager
>  77 578     413692     401112      24988          0          0 Virtual Exec
> 178   0     350580    1918340       7060          0          0 AAA SEND STOP EV
>  25   0     263208          0     272656     113400          0 EEM ED Syslog
> 198   0     250300     250300      13060          0          0 Syslog
> 167   0     247992          0     255052          0          0 QOS_MODULE_MAIN
> 188   0     119396       7344     125844          0          0 EEM Server
> 122   0     108244        252     115052          0          0 SCTP Main Proces
> 120   0     104664        252     103352          0          0 DHCPD Receive
>  93   0      98112        504      13060          0          0 PPP Hooks
> 106   0      73808          0      73808          0          0 CEF process
> 142   0      73236        252      72648          0          0 FLEX DSPRM MAIN
>  17   0      72948      32844      47164          0          0 ARP Input
>  24   0      72748          0      79808          0          0 Entity MIB API
>  40   0      67568       4424       7060          0          0 TTY Background
> 103   0      66736          0      76796          0          0 IP RIB Update
>   4   0      65588          0      90648          0          0 EDDRI_MAIN
> 152   0      59568      73276       7060          0          0 LOCAL AAA
>  54   0      57904        252      64712          0          0 VNM DSPRM MAIN
> 206   0      56660          0      15868          0          0 SSH Event handle
>  84   0      49384          0      56444          0          0 ACCT Periodic Pr
> 226   0      47236      16108      16152          0          0 BGP Router
>
> I have several questions.
>
> 1. What is *Dead* process ? it takes many memory why ?
> 2. Is there any unknown process working ?
> 3. How do I decrease memory usage ?
> 4. What is column of memory real usage ?
>
> Sincerely,
> Tseveen.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
>       
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>   


From vitya at list.ru  Wed Jun 17 01:49:44 2009
From: vitya at list.ru (victor)
Date: Wed, 17 Jun 2009 09:49:44 +0400
Subject: [c-nsp] ME-4924-10GE & mgt port
Message-ID: <op.uvnmg6bg2vrlim@localhost.localdomain>

Hi
Please, help. What is the purpose of mgt port on ME-4924-10GE. I somehow  
feel that it's for out-of-band management but there is no corresponding  
entry in the config. Though during the boot it prints "1 Virtual Ethernet  
Interface". Current IOS - ipbase-m 12.2(31) sga5.
How can I use this port?
-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From oboehmer at cisco.com  Wed Jun 17 02:24:01 2009
From: oboehmer at cisco.com (Oliver Boehmer (oboehmer))
Date: Wed, 17 Jun 2009 08:24:01 +0200
Subject: [c-nsp] clear ip pool
In-Reply-To: <H0000084006e1e5f.1244800486.bohr.dbmg.de@MHS>
References: <H0000084006e1e5f.1244800486.bohr.dbmg.de@MHS>
Message-ID: <70B7A1CCBFA5C649BD562B6D9F7ED7840784BF34@xmb-ams-333.emea.cisco.com>

Sebastian Ganschow <> wrote on Friday, June 12, 2009 11:55:

> Hi,
> 
> we've got our ciscos configured that ip pool configuration is derived
> from our radius servers.
> 
> In order to change the ip pool, I change the pool in the radius
> config. But our ciscos are still using the old ip pool. It seems like
> some caching issue.
> 
> Is there any way to let the cisco forget the pool information and get
> it again from the radius server?

Hmm, it's been a while since I dealt with that sort of stuff, and there
is an AVP (cisco-avpair = "ip:pool-timeout=<minutes>") you can (and
should) send along with the pool definition. I fear the default is "no
timeout", and I'm not aware how to manually clear this. Maybe you can
try "no ip local pool <name>" to purge it..

	oli

From avayner at cisco.com  Wed Jun 17 02:31:31 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Wed, 17 Jun 2009 08:31:31 +0200
Subject: [c-nsp] ME-4924-10GE & mgt port
In-Reply-To: <op.uvnmg6bg2vrlim@localhost.localdomain>
References: <op.uvnmg6bg2vrlim@localhost.localdomain>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>

Victor,

Try taking a look here:
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/conf
iguration/guide/sw_int.html#wp1110617

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of victor
Sent: Wednesday, June 17, 2009 08:50
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ME-4924-10GE & mgt port

Hi
Please, help. What is the purpose of mgt port on ME-4924-10GE. I somehow

feel that it's for out-of-band management but there is no corresponding

entry in the config. Though during the boot it prints "1 Virtual
Ethernet  
Interface". Current IOS - ipbase-m 12.2(31) sga5.
How can I use this port?
-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From Ronny.Faessler at srgssrideesuisse.ch  Wed Jun 17 01:59:24 2009
From: Ronny.Faessler at srgssrideesuisse.ch (=?iso-8859-1?Q?F=E4ssler=2C_Ronny?=)
Date: Wed, 17 Jun 2009 07:59:24 +0200
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <mailman.575.1245181541.2287.cisco-nsp@puck.nether.net>
References: <mailman.575.1245181541.2287.cisco-nsp@puck.nether.net>
Message-ID: <4D958EB6FC3CC442B053B06F57497F7E012BF7D2@seginus.GD.AD.PROD>

Just additional Info 
Here's what "my" Cisco Technical sayed last time i looked at it...

You can not point the next-hop to the local routers interface. 
Development does not plan on supporting this configuration.   <---- !!!! 

Looks bad - I did it with a "golden Cable" -  Physcal crossover loop...

Have a great day
Ronny

From vitya at list.ru  Wed Jun 17 03:54:03 2009
From: vitya at list.ru (victor)
Date: Wed, 17 Jun 2009 11:54:03 +0400
Subject: [c-nsp] ME-4924-10GE & mgt port
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>
References: <op.uvnmg6bg2vrlim@localhost.localdomain>
	<78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>
Message-ID: <op.uvnr4mc42vrlim@localhost.localdomain>

Like I said there is nothing like "interface FastEthernet1" in the  
running-config
Maybe I need to enable it somewhere?
When I plug in a patch-cord the link ON THE OTHER SIDE goes up but the  
light beneath mgt port doesn't light up.
BTW, sho int doesn't list Fe1 as a possible option.

On Wed, 17 Jun 2009 10:31:31 +0400, Arie Vayner (avayner)  
<avayner at cisco.com> wrote:

> Victor,
>
> Try taking a look here:
> http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/conf
> iguration/guide/sw_int.html#wp1110617
>
> Arie
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of victor
> Sent: Wednesday, June 17, 2009 08:50
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ME-4924-10GE & mgt port
>
> Hi
> Please, help. What is the purpose of mgt port on ME-4924-10GE. I somehow
>
> feel that it's for out-of-band management but there is no corresponding
>
> entry in the config. Though during the boot it prints "1 Virtual
> Ethernet
> Interface". Current IOS - ipbase-m 12.2(31) sga5.
> How can I use this port?


-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From euang+cisco-nsp at lists.eusahues.co.uk  Wed Jun 17 04:33:08 2009
From: euang+cisco-nsp at lists.eusahues.co.uk (Euan Galloway)
Date: Wed, 17 Jun 2009 09:33:08 +0100
Subject: [c-nsp] ME-4924-10GE & mgt port
In-Reply-To: <op.uvnr4mc42vrlim@localhost.localdomain>
References: <op.uvnmg6bg2vrlim@localhost.localdomain>
	<78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>
	<op.uvnr4mc42vrlim@localhost.localdomain>
Message-ID: <20090617083308.GA20135@hyperion.eusahues.co.uk>

On Wed, Jun 17, 2009 at 11:54:03AM +0400, victor wrote:
> Like I said there is nothing like "interface FastEthernet1" in the 
> running-config
> Maybe I need to enable it somewhere?
> When I plug in a patch-cord the link ON THE OTHER SIDE goes up but the 
> light beneath mgt port doesn't light up.
> BTW, sho int doesn't list Fe1 as a possible option.

Maybe this line (mentioned under "ISSU Model")

"So, you cannot enable the management port on a redundant chassis if one 
of the two supervisor engines is running an IOS image older than 12.2(50)SG 
(where the Management port is not supported)."

-- 
Euan Galloway

From steve.mcnamara at gmail.com  Wed Jun 17 05:53:40 2009
From: steve.mcnamara at gmail.com (Steve McNamara)
Date: Wed, 17 Jun 2009 10:53:40 +0100
Subject: [c-nsp] ME-4924-10GE & mgt port
In-Reply-To: <op.uvnr4mc42vrlim@localhost.localdomain>
References: <op.uvnmg6bg2vrlim@localhost.localdomain>
	<78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>
	<op.uvnr4mc42vrlim@localhost.localdomain>
Message-ID: <494a4f80906170253y51d77059x4bc565f16d80f1eb@mail.gmail.com>

From
http://www.cisco.com/en/US/docs/switches/metro/me4924-10ge/hardware/installation/guide/HIGOVEW.html#wp1161221
 Management Port

The management port is used (in ROMMON mode only) to recover a switch
software image that has been corrupted or destroyed due to a network
catastrophe. This port is not active while the switch is operating normally.


You should designate one of the normalports on your switch as a management
port, used for configuration and monitoring traffic. D o not connect the
management port to this network, it is only intended to be used from a
direct console connection.

Regards

Steve

On Wed, Jun 17, 2009 at 08:54, victor <vitya at list.ru> wrote:

> Like I said there is nothing like "interface FastEthernet1" in the
> running-config
> Maybe I need to enable it somewhere?
> When I plug in a patch-cord the link ON THE OTHER SIDE goes up but the
> light beneath mgt port doesn't light up.
> BTW, sho int doesn't list Fe1 as a possible option.
>
>
> On Wed, 17 Jun 2009 10:31:31 +0400, Arie Vayner (avayner) <
> avayner at cisco.com> wrote:
>
>  Victor,
>>
>> Try taking a look here:
>> http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/conf
>> iguration/guide/sw_int.html#wp1110617
>>
>> Arie
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of victor
>> Sent: Wednesday, June 17, 2009 08:50
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] ME-4924-10GE & mgt port
>>
>> Hi
>> Please, help. What is the purpose of mgt port on ME-4924-10GE. I somehow
>>
>> feel that it's for out-of-band management but there is no corresponding
>>
>> entry in the config. Though during the boot it prints "1 Virtual
>> Ethernet
>> Interface". Current IOS - ipbase-m 12.2(31) sga5.
>> How can I use this port?
>>
>
>
> --
> Using Opera's revolutionary e-mail client: http://www.opera.com/mail/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From jmaimon at ttec.com  Wed Jun 17 06:17:04 2009
From: jmaimon at ttec.com (Joe Maimon)
Date: Wed, 17 Jun 2009 06:17:04 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>	<002501c9eea7$34983830$0a00000a@nil.si>	<02d001c9eea9$6f918020$4eb48060$@net>
	<9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
Message-ID: <4A38C2A0.1010500@ttec.com>



Tim Durack wrote:

> 
> Amen to that.
> 
> I've played around with the various loopback strategies, including
> using a gre tunnel that originates/terminates on the same PE. It
> worked, but didn't seem like a scalable solution.

A dot1q trunk between two ports (if your not using a switch platform as 
your router) or even ATM scales. You just pay 2x pps. And you can scale 
it for however many connections you want. Which is probably faster than 
tunnels, but I havent actually benchmarked it.

> 
> The conclusion I came to is that most MPLS scenarios assume you are
> using a separate PE/firewall to move traffic between global and vrfs
> (and probably even inter-vrf.)
> 
> It would be great to have a simple global-vrf route exchange feature though.

And a way to treat it as an interface on both sides.

> 
> Tim:>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> 

From s.ganschow at buelow-masiak.de  Wed Jun 17 06:49:23 2009
From: s.ganschow at buelow-masiak.de (Sebastian Ganschow)
Date: Wed, 17 Jun 2009 12:49:23 +0200
Subject: [c-nsp] clear ip pool
In-Reply-To: <70B7A1CCBFA5C649BD562B6D9F7ED7840784BF34@xmb-ams-333.emea.cisco.com>
Message-ID: <H0000084006ecdb2.1245235762.bohr.dbmg.de@MHS>

> Hmm, it's been a while since I dealt with that sort of stuff, and 
there
> is an AVP (cisco-avpair = "ip:pool-timeout=<minutes>") you can (and
> should) send along with the pool definition. I fear the default is "no
> timeout", and I'm not aware how to manually clear this. Maybe you can
> try "no ip local pool <name>" to purge it..
> 
> 	oli

You can purge the pool with no ip local pool <name>, but the infos I 
found on CCO are saying, that the information from the radius server is 
only retrieved during a reload.

Sebastian



From oboehmer at cisco.com  Wed Jun 17 06:54:00 2009
From: oboehmer at cisco.com (Oliver Boehmer (oboehmer))
Date: Wed, 17 Jun 2009 12:54:00 +0200
Subject: [c-nsp] clear ip pool
In-Reply-To: <H0000084006ecdb2.1245235762.bohr.dbmg.de@MHS>
References: <70B7A1CCBFA5C649BD562B6D9F7ED7840784BF34@xmb-ams-333.emea.cisco.com>
	<H0000084006ecdb2.1245235762.bohr.dbmg.de@MHS>
Message-ID: <70B7A1CCBFA5C649BD562B6D9F7ED7840784C16D@xmb-ams-333.emea.cisco.com>

Sebastian Ganschow <mailto:s.ganschow at buelow-masiak.de> wrote on
Wednesday, June 17, 2009 12:49:

>> Hmm, it's been a while since I dealt with that sort of stuff, and
>> there is an AVP (cisco-avpair = "ip:pool-timeout=<minutes>") you can
>> (and should) send along with the pool definition. I fear the default
>> is "no timeout", and I'm not aware how to manually clear this. Maybe
>> you can try "no ip local pool <name>" to purge it..
>> 
>> 	oli
> 
> You can purge the pool with no ip local pool <name>, but the infos I
> found on CCO are saying, that the information from the radius server
> is only retrieved during a reload.

hmm, where is this documented? If I recall correctly, the router tries
to fetch the pool from Radius when a user logs in whose authorization
information reference this pool and the pool is not yet defined (or has
expired when you sent "ip:pool-timeout" along with the pool)

	oli

From s.ganschow at buelow-masiak.de  Wed Jun 17 10:17:21 2009
From: s.ganschow at buelow-masiak.de (Sebastian Ganschow)
Date: Wed, 17 Jun 2009 16:17:21 +0200
Subject: [c-nsp] clear ip pool
In-Reply-To: <70B7A1CCBFA5C649BD562B6D9F7ED7840784C16D@xmb-ams-333.emea.cisco.com>
Message-ID: <H0000084006ecdba.1245248240.bohr.dbmg.de@MHS>

> hmm, where is this documented? If I recall correctly, the router tries
> to fetch the pool from Radius when a user logs in whose authorization
> information reference this pool and the pool is not yet defined (or 
has
> expired when you sent "ip:pool-timeout" along with the pool)

We had no timeout configured. I assume, the pool won't time out then.

There was no pool configured on the router, but sh ip local pool, showed 
the pool, which was retrieved via RADIUS. 
When I deleted the local pool with no ip local pool dslin, the pool was 
removed, but hasn't been loaded via RADIUS. So for the moment, I've 
configured the pool locally, till I can reload the router in the next 
maintenance window.

As I don't find the page, where this is documented, I can't send the 
link.

Sebastian 


From cluestore at gmail.com  Wed Jun 17 11:52:33 2009
From: cluestore at gmail.com (Clue Store)
Date: Wed, 17 Jun 2009 10:52:33 -0500
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
	<02d001c9eea9$6f918020$4eb48060$@net>
	<9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
Message-ID: <580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>

> >It would be great to have a simple global-vrf route exchange feature
> though.


Anyone using a vrf for their global tables??  This solution could possibly
work for me but not sure what insane issues would come up by doing this.

From harbor235 at gmail.com  Wed Jun 17 09:57:35 2009
From: harbor235 at gmail.com (harbor235)
Date: Wed, 17 Jun 2009 09:57:35 -0400
Subject: [c-nsp] Network Perefromance
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C381C142C3@PUR-EXCH07.ox.com>
References: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>
	<483E6B0272B0284BA86D7596C40D29F9C381C142C3@PUR-EXCH07.ox.com>
Message-ID: <836bf1f90906170657i74ad129fh212d22c10b3c8687@mail.gmail.com>

I am definitely aware of IP SLA and also agree that it is very useful,
however, this customer's network is Juniper so I will be
unable to uitlize that feature.

MTR looks like it is doable, however, it uses icmp. I doubt that you can get
an accurate picture of the network using
icmp, can it be programed to use TCP or  udp and vary the packet size?

mike

On Tue, Jun 16, 2009 at 4:35 PM, Matthew Huff <mhuff at ox.com> wrote:

> We are a Cisco shop, so we use "ip sla" feature of newer IOS releases with
> CiscoWorks LMS. Netflow is useful for trafic monitoring, but for latency
> and
> jitter, the cisco featureset is really nice.
>
> For example, between two of our voice gateway boxes (running sip trunking
> between them) in NY & SF:
>
> rtr-nyvoip#show ip sla statistics aggregated 1
> IPSLAs aggregated statistics
>
> IPSLA operation id: 1
> Start Time Index: .16:15:07.749 EDT Tue Jun 16 2009
> Type of operation: udp-jitter
> Voice Scores:
> MinOfICPIF: 11  MaxOfICPIF: 11  MinOfMOS: 4.6   MaxOfMOS: 4.6
> RTT Values:
>        Number Of RTT: 18000            RTT Min/Avg/Max: 91/91/96
> milliseconds
> Latency one-way time:
>        Number of Latency one-way Samples: 0
>        Source to Destination Latency one way Min/Avg/Max: 0/0/0
> milliseconds
>        Destination to Source Latency one way Min/Avg/Max: 0/0/0
> milliseconds
> Jitter Time:
>        Number of SD Jitter Samples: 17982
>        Number of DS Jitter Samples: 17982
>        Source to Destination Jitter Min/Avg/Max: 0/1/4 milliseconds
>        Destination to Source Jitter Min/Avg/Max: 0/1/4 milliseconds
> Packet Loss Values:
>        Loss Source to Destination: 0           Loss Destination to Source:
> 0
>        Out Of Sequence: 0      Tail Drop: 0
>        Packet Late Arrival: 0  Packet Skipped: 0
> Number of successes: 18
> Number of failures: 0
>
> Start Time Index: .15:15:07.749 EDT Tue Jun 16 2009
> Type of operation: udp-jitter
> Voice Scores:
> MinOfICPIF: 11  MaxOfICPIF: 11  MinOfMOS: 4.6   MaxOfMOS: 4.6
> RTT Values:
>        Number Of RTT: 60000            RTT Min/Avg/Max: 91/91/103
> milliseconds
> Latency one-way time:
>        Number of Latency one-way Samples: 0
>        Source to Destination Latency one way Min/Avg/Max: 0/0/0
> milliseconds
>        Destination to Source Latency one way Min/Avg/Max: 0/0/0
> milliseconds
> Jitter Time:
>        Number of SD Jitter Samples: 59940
>        Number of DS Jitter Samples: 59940
>        Source to Destination Jitter Min/Avg/Max: 0/1/11 milliseconds
>        Destination to Source Jitter Min/Avg/Max: 0/1/7 milliseconds
> Packet Loss Values:
>        Loss Source to Destination: 0           Loss Destination to Source:
> 0
>        Out Of Sequence: 0      Tail Drop: 0
>        Packet Late Arrival: 0  Packet Skipped: 0
> Number of successes: 60
> Number of failures: 0
>
> The config is:
>
> ip sla responder
> ip sla logging traps
> ip sla 1
>  udp-jitter x.x.x.x 12420 source-ip x.x.x.x codec g729a
> ip sla schedule 1 life forever start-time now
>
>
> ----
> Matthew Huff       | One Manhattanville Rd
> OTA Management LLC | Purchase, NY 10577
> http://www.ox.com  | Phone: 914-460-4039
> aim: matthewbhuff  | Fax:   914-460-4139
>
>
>
> > -----Original Message-----
> > From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> > bounces at puck.nether.net] On Behalf Of harbor235
> > Sent: Tuesday, June 16, 2009 3:46 PM
> > To: cisco-nsp at puck.nether.net
> > Subject: [c-nsp] Network Perefromance
> >
> > I wanted to ping everyone on tools they were using to understand the
> > performace of their
> > network, specifically, measuring packet loss, latency, and jitter.
> >
> > mike
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From jeff-kell at utc.edu  Wed Jun 17 12:19:11 2009
From: jeff-kell at utc.edu (Jeff Kell)
Date: Wed, 17 Jun 2009 12:19:11 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>	<002501c9eea7$34983830$0a00000a@nil.si>	<02d001c9eea9$6f918020$4eb48060$@net>	<9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
	<580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>
Message-ID: <4A39177F.3070403@utc.edu>

Clue Store wrote:
> Anyone using a vrf for their global tables??  This solution could possibly
> work for me but not sure what insane issues would come up by doing this.

After trying several other approaches and failing, "if you can't beat
them, join them..."

We use the "global table" only for infrastructure and network management
(ironically, our "out-of-band" needs).

User traffic is ALL in VRFs.

Jeff

From eric at atlantech.net  Wed Jun 17 12:33:13 2009
From: eric at atlantech.net (Eric Van Tol)
Date: Wed, 17 Jun 2009 12:33:13 -0400
Subject: [c-nsp] Network Perefromance
In-Reply-To: <836bf1f90906170657i74ad129fh212d22c10b3c8687@mail.gmail.com>
References: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>
	<483E6B0272B0284BA86D7596C40D29F9C381C142C3@PUR-EXCH07.ox.com>
	<836bf1f90906170657i74ad129fh212d22c10b3c8687@mail.gmail.com>
Message-ID: <2C05E949E19A9146AF7BDF9D44085B86353E994F23@exchange.aoihq.local>

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of harbor235
> Sent: Wednesday, June 17, 2009 9:58 AM
> To: Matthew Huff
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Network Perefromance
> 
> I am definitely aware of IP SLA and also agree that it is very useful,
> however, this customer's network is Juniper so I will be
> unable to uitlize that feature.
> 

Look into RPM, available in JUNOS:

http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-collections/config-guide-services/id-13352983.html#id-13352983

-evt

From paul at paulstewart.org  Wed Jun 17 13:05:33 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 17 Jun 2009 13:05:33 -0400
Subject: [c-nsp] 10GE blade questions
Message-ID: <000001c9ef6d$e0666350$a13329f0$@org>

We have a 6509 sup2/msfc2 switch which only does layer2 services - is there
10GE options available for this platform?

 

The WS-X6708-10G-3CXL  blades are also of interest for Sup720 platform - if
they are only doing VLAN trunks out to remote switches and any routing would
be done on SVI interfaces on the Sup720 then does it matter if you get only
the 3C version?

 

Thanks,

 

Paul

 

 

 


From rblayzor.bulk at inoc.net  Wed Jun 17 13:12:49 2009
From: rblayzor.bulk at inoc.net (Robert Blayzor)
Date: Wed, 17 Jun 2009 13:12:49 -0400
Subject: [c-nsp] NPE-G2 Management interface limitation
Message-ID: <0BAA3160-87C9-4353-95F6-D607FE811A43@inoc.net>

The NPE-G2 fact states:

Q. Are routing protocols supported on the 10/100BASE-T management  
interface?
A. Yes, routing protocols are supported on the management interface.  
However, the management interface is strictly for management purposes  
only, with limited packet forwarding.


We use management interfaces now on some of the G2's, but need another  
interface to trap some IP exported streams (10 - 20Mbps max).  I  
cannot find anything that states what the "limited packet forwarding"  
is.  Anyone have any more info or real world experience?

TIA

-- 
Robert Blayzor, BOFH
INOC, LLC
rblayzor at inoc.net
http://www.inoc.net/~rblayzor/




From gert at greenie.muc.de  Wed Jun 17 13:29:09 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 17 Jun 2009 19:29:09 +0200
Subject: [c-nsp] 10GE blade questions
In-Reply-To: <000001c9ef6d$e0666350$a13329f0$@org>
References: <000001c9ef6d$e0666350$a13329f0$@org>
Message-ID: <20090617172909.GL290@greenie.muc.de>

Hi,

On Wed, Jun 17, 2009 at 01:05:33PM -0400, Paul Stewart wrote:
> We have a 6509 sup2/msfc2 switch which only does layer2 services - is there
> 10GE options available for this platform?

None of the WS-X67xx boards will work with a Sup2 (they need Sup720
fabric connections).

I seem to remember that there was an earlier 10G blade (something like
"1 ports, no XENPAKs"), but can't find any details about it - the
board name was WS-X6502-10GE, and even that one would require a fabric
board for your Sup2 (CEF256 fabric) - which hardly anybody has.

I'm not sure whether I'd go there...

> The WS-X6708-10G-3CXL  blades are also of interest for Sup720 platform - if
> they are only doing VLAN trunks out to remote switches and any routing would
> be done on SVI interfaces on the Sup720 then does it matter if you get only
> the 3C version?

Yes.  *If* there is a DFC on the board, and it's a non-XL DFC, all the
switching in the system downgrades itself to "non-XL".

I think you could run it as a CFC card (with no DFC), but as far as 
I remember, it's not sold that way and most likely "not supported".

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090617/fe616268/attachment.bin>

From tstevens at cisco.com  Wed Jun 17 13:51:20 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Wed, 17 Jun 2009 10:51:20 -0700
Subject: [c-nsp] 10GE blade questions
In-Reply-To: <20090617172909.GL290@greenie.muc.de>
References: <000001c9ef6d$e0666350$a13329f0$@org>
	<20090617172909.GL290@greenie.muc.de>
Message-ID: <200906171751.n5HHpYTD015448@sj-core-2.cisco.com>

At 10:29 AM 6/17/2009, Gert Doering blurted out:

>Hi,
>
>On Wed, Jun 17, 2009 at 01:05:33PM -0400, Paul Stewart wrote:
> > We have a 6509 sup2/msfc2 switch which only does layer2 services - is there
> > 10GE options available for this platform?
>
>None of the WS-X67xx boards will work with a Sup2 (they need Sup720
>fabric connections).
>
>I seem to remember that there was an earlier 10G blade (something like
>"1 ports, no XENPAKs"), but can't find any details about it - the
>board name was WS-X6502-10GE, and even that one would require a fabric
>board for your Sup2 (CEF256 fabric) - which hardly anybody has.
>
>I'm not sure whether I'd go there...

That card is EOL & will be EOS next month. You are better off 
upgrading the sup to sup720 and buying a 670x 10G card, it'll be 
cheaper & higher performance.

> > The WS-X6708-10G-3CXL  blades are also of interest for Sup720 platform - if
> > they are only doing VLAN trunks out to remote switches and any 
> routing would
> > be done on SVI interfaces on the Sup720 then does it matter if you get only
> > the 3C version?
>
>Yes.  *If* there is a DFC on the board, and it's a non-XL DFC, all the
>switching in the system downgrades itself to "non-XL".
>
>I think you could run it as a CFC card (with no DFC), but as far as
>I remember, it's not sold that way and most likely "not supported".

6708/16 do not have a CFC option, they only run with DFC.


HTH,
Tim


>gert
>--
>USENET is *not* the non-clickable part of WWW!
> 
>//www.muc.de/~gert/
>Gert Doering - Munich, Germany                             gert at greenie.muc.de
>fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From paul at paulstewart.org  Wed Jun 17 13:57:27 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 17 Jun 2009 13:57:27 -0400
Subject: [c-nsp] 10GE blade questions
In-Reply-To: <200906171751.n5HHpYTD015448@sj-core-2.cisco.com>
References: <000001c9ef6d$e0666350$a13329f0$@org>
	<20090617172909.GL290@greenie.muc.de>
	<200906171751.n5HHpYTD015448@sj-core-2.cisco.com>
Message-ID: <000d01c9ef75$212d7890$638869b0$@org>

Thanks folks.. I figured the 720 upgrade would come along as part of
this..;)

 

Cheers,

 

Paul

 

 

From: Tim Stevenson [mailto:tstevens at cisco.com] 
Sent: Wednesday, June 17, 2009 1:51 PM
To: Gert Doering; Paul Stewart
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] 10GE blade questions

 

At 10:29 AM 6/17/2009, Gert Doering blurted out:




Hi,

On Wed, Jun 17, 2009 at 01:05:33PM -0400, Paul Stewart wrote:
> We have a 6509 sup2/msfc2 switch which only does layer2 services - is
there
> 10GE options available for this platform?

None of the WS-X67xx boards will work with a Sup2 (they need Sup720
fabric connections).

I seem to remember that there was an earlier 10G blade (something like
"1 ports, no XENPAKs"), but can't find any details about it - the
board name was WS-X6502-10GE, and even that one would require a fabric
board for your Sup2 (CEF256 fabric) - which hardly anybody has.

I'm not sure whether I'd go there...


That card is EOL & will be EOS next month. You are better off upgrading the
sup to sup720 and buying a 670x 10G card, it'll be cheaper & higher
performance.




> The WS-X6708-10G-3CXL  blades are also of interest for Sup720 platform -
if
> they are only doing VLAN trunks out to remote switches and any routing
would
> be done on SVI interfaces on the Sup720 then does it matter if you get
only
> the 3C version?

Yes.  *If* there is a DFC on the board, and it's a non-XL DFC, all the
switching in the system downgrades itself to "non-XL".

I think you could run it as a CFC card (with no DFC), but as far as
I remember, it's not sold that way and most likely "not supported".


6708/16 do not have a CFC option, they only run with DFC.


HTH,
Tim





gert
--
USENET is *not* the non-clickable part of WWW!
                                                           //
www.muc.de/~gert/ <http://www.muc.de/~gert/> 
Gert Doering - Munich, Germany
gert at greenie.muc.de
fax: +49-89-35655025
gert at net.informatik.tu-muenchen.de

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/







Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com <http://www.cisco.com/> 
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.


From ras at e-gerbil.net  Wed Jun 17 15:21:46 2009
From: ras at e-gerbil.net (Richard A Steenbergen)
Date: Wed, 17 Jun 2009 14:21:46 -0500
Subject: [c-nsp] 10GE blade questions
In-Reply-To: <20090617172909.GL290@greenie.muc.de>
References: <000001c9ef6d$e0666350$a13329f0$@org>
	<20090617172909.GL290@greenie.muc.de>
Message-ID: <20090617192146.GG51443@gerbil.cluepon.net>

On Wed, Jun 17, 2009 at 07:29:09PM +0200, Gert Doering wrote:
> I seem to remember that there was an earlier 10G blade (something like
> "1 ports, no XENPAKs"), but can't find any details about it - the
> board name was WS-X6502-10GE, and even that one would require a fabric
> board for your Sup2 (CEF256 fabric) - which hardly anybody has.
> 
> I'm not sure whether I'd go there...

WS-X6502-10GE, a 1-port CEF256 with proprietary LR optics which has been
End of Sale for about 5 years now. At one point they were the poor man's
alternative to a 6704, but these days they're so rare that they're far
more expensive than a sup720+6704. Of course, if you know the right
people, I bet you could probably still find one via dumpster diving, 
but unless you're trying to complete your museum collection I wouldn't 
recommend wasting the time.

-- 
Richard A Steenbergen <ras at e-gerbil.net>       http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

From ez.c0re at gmail.com  Wed Jun 17 15:55:04 2009
From: ez.c0re at gmail.com (c0re dumped)
Date: Wed, 17 Jun 2009 16:55:04 -0300
Subject: [c-nsp] NAT issue
Message-ID: <6dd8736a0906171255g688a8502keb926cd520d8b51f@mail.gmail.com>

Hello guys,

I have following scenario:

I receive a packet in ATM0/0 interface. The packet has the following
addresses: SRC A.A.A.A and DST B.B.B.B.
I must translate the packet and send it out the *same* interface
(ATM0/0), *but* with the following addresses: SRC X.X.X.X DST Y.Y.Y.Y

What NAT configuration do I have to apply so that will work perfectly ?


thanx,

Fabio

-- 

"To err is human, to blame it on somebody else shows management potential."

From pshem.k at gmail.com  Wed Jun 17 16:39:05 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Thu, 18 Jun 2009 08:39:05 +1200
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com> 
	<002501c9eea7$34983830$0a00000a@nil.si>
	<02d001c9eea9$6f918020$4eb48060$@net> 
	<9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com> 
	<580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>
Message-ID: <20fe625b0906171339u7ecdd242k559728190d6ae9b3@mail.gmail.com>

Hi,

Yes, everything - including internet table, only infrastructure runs
in the global one.  As many have noticed the pain of getting anything
going between the global table and the vrfs is just too much. All I
miss now is ability to do a static route from vrf to another vrf ;-)
but for now vrf import/export seems to do the trick short term ;-)

regards
pshem


2009/6/18 Clue Store <cluestore at gmail.com>:
>> >It would be great to have a simple global-vrf route exchange feature
>> though.
>
>
> Anyone using a vrf for their global tables?? ?This solution could possibly
> work for me but not sure what insane issues would come up by doing this.
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From rodunn at cisco.com  Wed Jun 17 16:58:14 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Wed, 17 Jun 2009 16:58:14 -0400
Subject: [c-nsp] NAT issue
In-Reply-To: <6dd8736a0906171255g688a8502keb926cd520d8b51f@mail.gmail.com>
References: <6dd8736a0906171255g688a8502keb926cd520d8b51f@mail.gmail.com>
Message-ID: <20090617205814.GB3393@rtp-cse-489.cisco.com>

What does your routing look like to get it in/out the same ATM interface?

On Wed, Jun 17, 2009 at 04:55:04PM -0300, c0re dumped wrote:
> Hello guys,
> 
> I have following scenario:
> 
> I receive a packet in ATM0/0 interface. The packet has the following
> addresses: SRC A.A.A.A and DST B.B.B.B.
> I must translate the packet and send it out the *same* interface
> (ATM0/0), *but* with the following addresses: SRC X.X.X.X DST Y.Y.Y.Y
> 
> What NAT configuration do I have to apply so that will work perfectly ?
> 
> 
> thanx,
> 
> Fabio
> 
> -- 
> 
> "To err is human, to blame it on somebody else shows management potential."
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From jrhett at netconsonance.com  Wed Jun 17 19:59:05 2009
From: jrhett at netconsonance.com (Jo Rhett)
Date: Wed, 17 Jun 2009 16:59:05 -0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
	<A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
	<FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>
	<919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>
Message-ID: <28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>

  On Jun 15, 2009, at 11:29 AM, Kevin Graham wrote:
> Given the 192 ports of 10/100/1000, presumably this is aggregating  
> customers,
> in which case it'd be best to roll these up on 7600/RSP720 (along  
> with their
> associated BGP, since most of them would probably be suitable for  
> peer-groups).
> uRPF wouldn't be a problem, and hopefully ACL's would be uniform  
> enough across
> customers to share most of the ACE entries.
>
> With that compromise (namely loosing customer-customer netflow  
> detail), the
> remaining requirements for full netflow exports and the balance of  
> the BGP
> workload are feasible for any of ASR1k, GSR, or CRS-1.

We don't have core and edge -- our switches do both.   Every port on  
the switch is either a BGP peer/uplink/downlink or a customer.  Every  
port layer3-routed with only a few handfuls of customers with dual  
links.

Purchasing a switch to be the edge and then another to handle BGP  
seems a bit of overkill for our fairly small datacenters  (largest  
will have around 300 customers ~ 360 ports).   I'd prefer something  
that can handle both edge and core duties.

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness


From peter at rathlev.dk  Wed Jun 17 20:01:01 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 18 Jun 2009 00:01:01 +0000
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
Message-ID: <1245283261.15106.46.camel@localhost.localdomain>

Hi,

I have the need to introduce some PBR to solve a hopefully temporary
problem. Some of the traffic being routed will leave the same interface
as it arrives on.

My worry is if this would have any performance impact the traffic
arrives on and leaves from the same interface. I could imagine that some
forwarding implementations might penalize this scenario.

The PBR will be performed by two 3560s running IP Services and with HSRP
configuration on all interfaces. It should do PBR in hardware (we're not
using VRF Lite here) but is this also the case for traffic hair-pinning
like this?

To elaborate on the plan:

+---+                     +---+
| X |----             ----| Y |
+---+    \           /    +---+
          \         /
           \       /
          +---------+
          |   PBR   |
          +---------+
               |
               |
             +---+
             | Z |
             +----

The Z<->PBR and PBR<->Y interfaces are members of the same VLAN. The
PBR<->X interface will be in another VLAN.

Traffic from Z currently uses Y as gateway. I need to route some traffic
(based on a policy map) to X instead. Since I have little control over Y
(upstream Internet), and since Z relies on keeping it's current
interface address (it's an ASA using this interface address for VPN
identity) I can't split them.

The plan was to introduce the 3560 in the same subnet and then let Z's
default route be PBR instead of Y. Based on the policy map PBR will
either forward to Y (on the same interface) or X. To assure correct
policy routing I'd of course have to disable sending redirects.

(The "right" solution IMHO would be allocating a new subnet for PBR<->Y
and coordinate this with our upstream, but lack of both time and
cluefulness means that this will have to be some other time.)

Regards,
Peter



From ray at oneunified.net  Wed Jun 17 20:17:08 2009
From: ray at oneunified.net (Ray Burkholder)
Date: Wed, 17 Jun 2009 21:17:08 -0300
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com><4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk><4A327775.8050800@kl.net><AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com><1244844193.9252.17.camel@localhost.localdomain><A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au><FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net><919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>
	<28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
Message-ID: <A06A5ABC0C5945B5A2583B5D5DC95F53@oneunified.local>

> 
> We don't have core and edge -- our switches do both.   Every port on  
> the switch is either a BGP peer/uplink/downlink or a 
> customer.  Every port layer3-routed with only a few handfuls 
> of customers with dual links.
> 
> Purchasing a switch to be the edge and then another to handle 
> BGP seems a bit of overkill for our fairly small datacenters  
> (largest  
> will have around 300 customers ~ 360 ports).   I'd prefer something  
> that can handle both edge and core duties.
> 

Do you put dual Sup's in the switches?  Ie, how do you handle the scenario
of software upgrades (doesn't the whole switch have to go down to do this
type of maintenance, or do you not do that sort of thing) or switch
malfunctions?  Is it a safe bet to put so many customers and links into one
box? Or are you actually using multiple switches?


-- 
Scanned for viruses and dangerous content at 
http://www.oneunified.net and is believed to be clean.


From rdobbins at arbor.net  Wed Jun 17 20:55:13 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 18 Jun 2009 07:55:13 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
	<A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
	<FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>
	<919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>
	<28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
Message-ID: <65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>


On Jun 18, 2009, at 6:59 AM, Jo Rhett wrote:

> I'd prefer something that can handle both edge and core duties.

GSR w/E3 or E5 LCs, CRS-1, or ASR 1K.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From justin at justinshore.com  Wed Jun 17 23:08:48 2009
From: justin at justinshore.com (Justin Shore)
Date: Wed, 17 Jun 2009 22:08:48 -0500
Subject: [c-nsp] BGP quandry
Message-ID: <4A39AFC0.8050101@justinshore.com>

I'm scratching my head on a BGP problem.  I have a pair of core routers 
and a pair of distribution routers in our data center.  The DC routers 
each have a single connection to the core routers (1 connection per 
pair).  Previously the DC routers were configured as route-reflector 
clients with a route-map stripping out all ipv4 routes but the default. 
  The links are MPLS-enabled and I have production MPLS/VPNs on the 
links currently that are working fine.  It's fairly straightforward. 
Upstream of the core routers are a pair of border routers.  The border 
and core routers are in a full mesh.

Now I'm trying to hang a new router off of one of the data center 
routers and extend our BGP environment to it.  I've configured it to be 
part of a confederation (that router will ultimately have a direct 
Internet peer and will need full routes).  I'm currently hopping over 
the DC router and going straight to a core router for that eBGP 
confederation connection.  However I now need to access a MPLS/VPN from 
the new router in our data center.  So it basically looks like this:

A     B
|\   /|
| \ / |
|  /\ |
| /  \|
C-----D
|     |
E     F
       |
       G

A	Border 1
B	Border 2
C	Core 1
D	Core 2
E	DC 1
F	DC 2
G	New Router

A-D are currently a full mesh and I'd like to extend that to A-F.  G is 
the beginning of a confederation and new AS.

I'm taking the opportunity to go back and eliminate the RR design from 
the DC and make those 2 routers part of the full mesh with the core and 
border routers.  I've removed the RR config from one of the DC routers 
and its directly connected core router and replaced it with my standard 
ibgp peer-group.  The session comes up but I'm not getting any vpnv4 
routes over the session.  I can't figure out what I'm overlooking.

Core:
  neighbor ibgp-peer peer-group
  neighbor ibgp-peer remote-as 65001
  neighbor ibgp-peer transport path-mtu-discovery
  neighbor ibgp-peer password 7 monkey
  neighbor ibgp-peer update-source Loopback0
  neighbor ibgp-peer version 4
  neighbor ibgp-peer send-community
  neighbor ibgp-peer soft-reconfiguration inbound
  neighbor ibgp-peer maximum-prefix 350000 80 warning-only
  neighbor 10.64.0.34 peer-group ibgp-peer
  neighbor 10.64.0.34 description iBGP to 7201-1.dc (65001)
  neighbor 10.64.0.34 default-originate
!
  address-family vpnv4
  neighbor ibgp-peer send-community extended
  neighbor 10.64.0.34 activate
  exit-address-family

I added the last activate for grins but it didn't help.  peer-groups are 
auto-activated which is why it's not explicitly spelled out in the vpn4 
statement.

DC:
  neighbor ibgp-peer peer-group
  neighbor ibgp-peer remote-as 65001
  neighbor ibgp-peer transport path-mtu-discovery
  neighbor ibgp-peer password 7 monkey
  neighbor ibgp-peer update-source Loopback0
  neighbor ibgp-peer version 4
  neighbor 10.64.0.20 peer-group ibgp-peer
  neighbor 10.64.0.20 description iBGP to 7613-2.clr (65001)
!
  address-family ipv4
   neighbor ibgp-peer send-community
   neighbor ibgp-peer soft-reconfiguration inbound
   neighbor ibgp-peer maximum-prefix 350000 80 warning-only
   neighbor 10.64.0.20 activate
  exit-address-family
  !
  address-family vpnv4
   neighbor ibgp-peer send-community extended
  exit-address-family


I've removed several things of course.  Does anything jump out at 
anyone?  I'm having difficulty finding a command to see what prefixes 
I'm advertising inside of a vrf to the remote peer.  All I get on the DC 
router is the connected and static prefixes.  Do peer-groups and vpnv4 
routes not mix?

Thanks
  Justin


From justin at justinshore.com  Wed Jun 17 23:54:56 2009
From: justin at justinshore.com (Justin Shore)
Date: Wed, 17 Jun 2009 22:54:56 -0500
Subject: [c-nsp] BGP quandry
In-Reply-To: <4A39AFC0.8050101@justinshore.com>
References: <4A39AFC0.8050101@justinshore.com>
Message-ID: <4A39BA90.4030107@justinshore.com>

Justin Shore wrote:
> Core:
....
> !
>  address-family vpnv4
>  neighbor ibgp-peer send-community extended
>  neighbor 10.64.0.34 activate
>  exit-address-family
> 
> I added the last activate for grins but it didn't help.  peer-groups are 
> auto-activated which is why it's not explicitly spelled out in the vpn4 
> statement.
> 
> DC:
....
>  neighbor 10.64.0.20 peer-group ibgp-peer
>  neighbor 10.64.0.20 description iBGP to 7613-2.clr (65001)
> !
>  address-family vpnv4
>   neighbor ibgp-peer send-community extended
>  exit-address-family

So I did a little more playing around and found that if I added an vpnv4 
activate on the DC #2 router for core #2's IP I got my vpnv4 routes.  I 
only got those connected to core #2 though.  I had to add another 
activate for core #1.  I'm assuming that core #2 sent those BGP routes 
that it learned via iBGP from core #1 to DC #2 because of the RR config. 
  Since I'm eliminating the iBGP RR config I have to complete the full 
mesh to get the full set of routes.  That makes sense.

One thing that doesn't make sense at this point is why the ibgp-peer 
peer-group config in the vpnv4 address-family wasn't sufficient enough 
to enable the learning of vpnv4 routes.  Do peer-groups and vpnv4 config 
not mix?  Trying to add the command "neighbor aaa.bbb.ccc.ddd 
send-community extendeded" to any of the routers involved (where 
aaa.bbb.ccc.ddd is a configured member of a peer-group) results in the 
error:

% Invalid command for a peer-group member

To me that implies that some sort of interaction exists between vpnv4 
config and peer-group config.  Can anyone add any input to this?

Thanks
  Justin



From anderson.levi at gmail.com  Thu Jun 18 03:32:36 2009
From: anderson.levi at gmail.com (Anderson Levi)
Date: Thu, 18 Jun 2009 10:32:36 +0300
Subject: [c-nsp] Cisco SFP
Message-ID: <e22d607d0906180032w42e356ceyd2a9a49a70ebe0cc@mail.gmail.com>

Hi,

I want to buy Cisco's gigabit SFPs for a network rollout and I've realised,
from the info I've gathered on the website, that there's a leap from the <
10km range (GLC-LH-SM) to the < 70km range (GLC-ZX-SM). The distance I have
in mind falls in between 10km and 70km.

What are the implications of using a GLC-ZX-SM module to light a stretch of
20 - 30km? Would I need to add an attenuator, given that 20km is well below
the 70km limit?

Any info would be helpful. Thanks.

From gtb at slac.stanford.edu  Thu Jun 18 03:49:42 2009
From: gtb at slac.stanford.edu (Buhrmaster, Gary)
Date: Thu, 18 Jun 2009 00:49:42 -0700
Subject: [c-nsp] Cisco SFP
In-Reply-To: <e22d607d0906180032w42e356ceyd2a9a49a70ebe0cc@mail.gmail.com>
References: <e22d607d0906180032w42e356ceyd2a9a49a70ebe0cc@mail.gmail.com>
Message-ID: <D0D0330CBD07114D85B70B784E80C2F202CE3465@exch-mail2.win.slac.stanford.edu>

> What are the implications of using a GLC-ZX-SM module to light a
> stretch of 20 - 30km? Would I need to add an attenuator, given that 20km is well
> below the 70km limit?


As always, the answer is "it depends", because
it is the optical power, not distance, but usually
if the link is <~25km you can expect to need an
attenuator.  The typical transmit is ~ 0-5dBm,
and the max receive power is ~ -3dBm.  If you
overload the receiver, you could damage the
device, or shorten is life, or cause various
physical link errors to be reported as the
optics is overloaded.  So, in all cases,
measure the received power, and add in the
needed attenuation.

Reference:  
http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6577/product_data_sheet0900aecd8033f885.html

Gary

From amsoares at netcabo.pt  Thu Jun 18 06:48:57 2009
From: amsoares at netcabo.pt (Antonio Soares)
Date: Thu, 18 Jun 2009 11:48:57 +0100
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com><4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk><4A327775.8050800@kl.net><AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com><1244844193.9252.17.camel@localhost.localdomain><A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au><FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net><919169.94149.qm@web1204.biz.mail.gq1.yahoo.com><28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
	<65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>
Message-ID: <36EC7DC293AA437EB939B1B1D74283DA@int.convex.pt>

Why are you not including E4 or E4+ ? I'm asking this because i saw a E4 hitting the maximum when the number of CEF routes handled
doubled (from 280k to 560k). To the E3, this transition was smooth... And i'm not able to find docs that could explain this...


Thanks.

Regards,

Antonio Soares, CCIE #18473 (R&S)
amsoares at netcabo.pt

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Roland Dobbins
Sent: quinta-feira, 18 de Junho de 2009 1:55
To: Cisco-nsp
Subject: Re: [c-nsp] full routing table / provider-class chassis


On Jun 18, 2009, at 6:59 AM, Jo Rhett wrote:

> I'd prefer something that can handle both edge and core duties.

GSR w/E3 or E5 LCs, CRS-1, or ASR 1K.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From peter at rathlev.dk  Thu Jun 18 06:50:57 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 18 Jun 2009 12:50:57 +0200
Subject: [c-nsp] BGP quandry
In-Reply-To: <4A39BA90.4030107@justinshore.com>
References: <4A39AFC0.8050101@justinshore.com>
	<4A39BA90.4030107@justinshore.com>
Message-ID: <1245322257.20522.9.camel@localhost.localdomain>

On Wed, 2009-06-17 at 22:54 -0500, Justin Shore wrote:
> So I did a little more playing around and found that if I added an vpnv4 
> activate on the DC #2 router for core #2's IP I got my vpnv4 routes.  I 
> only got those connected to core #2 though.  I had to add another 
> activate for core #1.  I'm assuming that core #2 sent those BGP routes 
> that it learned via iBGP from core #1 to DC #2 because of the RR config. 
>   Since I'm eliminating the iBGP RR config I have to complete the full 
> mesh to get the full set of routes.  That makes sense.

Core #2 doesn't have "route-reflector-client" configured towards the new
router, so it only sends it's own prefixes and prefixes from any RR
clients of it's own. That seems to make sense to me too.

> One thing that doesn't make sense at this point is why the ibgp-peer 
> peer-group config in the vpnv4 address-family wasn't sufficient enough 
> to enable the learning of vpnv4 routes.  Do peer-groups and vpnv4 config 
> not mix?  Trying to add the command "neighbor aaa.bbb.ccc.ddd 
> send-community extendeded" to any of the routers involved (where 
> aaa.bbb.ccc.ddd is a configured member of a peer-group) results in the 
> error:
> 
> % Invalid command for a peer-group member
> 
> To me that implies that some sort of interaction exists between vpnv4 
> config and peer-group config.  Can anyone add any input to this?

AFAIK you always have to activate the specific peers in the VPNv4
configuration for VPNv4 functionality. I.e. :

 router bgp 64512
  neighbor PG peer-group
  neighbor PG remote-as 65412
  neghibor 10.0.0.1 activate
  !
  address-family vpnv4
   neighbor 10.0.0.1 activate
   exit-address-family
  ! 
  exit
 !

VPNv4 and IPv4 mixes fine, but the activation is seperated so you can
run some IPv4 only peers, some VPNv4 only peers and some mixed peers.

Regards,
Peter



From rdobbins at arbor.net  Thu Jun 18 07:04:22 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 18 Jun 2009 18:04:22 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <36EC7DC293AA437EB939B1B1D74283DA@int.convex.pt>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com><4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk><4A327775.8050800@kl.net><AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com><1244844193.9252.17.camel@localhost.localdomain><A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au><FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net><919169.94149.qm@web1204.biz.mail.gq1.yahoo.com><28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
	<65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>
	<36EC7DC293AA437EB939B1B1D74283DA@int.convex.pt>
Message-ID: <B0074169-12BA-4A9A-81C2-BB975E4030C4@arbor.net>


On Jun 18, 2009, at 5:48 PM, Antonio Soares wrote:

> Why are you not including E4 or E4+ ?

Because those are intended to be deployed as coreward-facing cards,  
they aren't optimized for edge features like NetFlow, uRPF, and ACLs.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From rdobbins at arbor.net  Thu Jun 18 07:20:40 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 18 Jun 2009 18:20:40 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <B0074169-12BA-4A9A-81C2-BB975E4030C4@arbor.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com><4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk><4A327775.8050800@kl.net><AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com><1244844193.9252.17.camel@localhost.localdomain><A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au><FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net><919169.94149.qm@web1204.biz.mail.gq1.yahoo.com><28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
	<65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>
	<36EC7DC293AA437EB939B1B1D74283DA@int.convex.pt>
	<B0074169-12BA-4A9A-81C2-BB975E4030C4@arbor.net>
Message-ID: <5074CACB-9C4A-4F04-B401-75CD02B797C7@arbor.net>


On Jun 18, 2009, at 6:04 PM, Roland Dobbins wrote:

> Because those are intended to be deployed as coreward-facing cards,  
> they aren't optimized for edge features like NetFlow, uRPF, and ACLs.

To clarify, I mean these cards are for use in core routers only - edge  
routers need the features on the coreward as well as the peering/ 
transit/customer edges, so the northbound and southbound LCs on edge  
routers should be E3 or E5.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From fraglet at gmail.com  Thu Jun 18 07:41:53 2009
From: fraglet at gmail.com (John)
Date: Thu, 18 Jun 2009 12:41:53 +0100
Subject: [c-nsp] Link state propagation / remote port shutdown with EoMPLS
	on 6500
Message-ID: <5c374d9a0906180441h2470630br18efea343f461a0@mail.gmail.com>

Hi All
Im playing around with EoMPLS on 6500`s w/SUP720-3b and 6700 line cards...
No ES hardware.

Everything seems fine, performance is good, scales ok for what we need, what
I`m failing to do is get link state propagation or remote port shutdown to
work.

Anybody have any pointers on this..

Our config is very basic port mode xconnects..


interface GigabitEthernet1/12
 mtu 1560
 no ip address
 xconnect 192.168.1.1 2007 pw-class TEST#1


I notice that in conf mode under the xconnect config you can enter "remote
link failure notification" this seems to be enabled by default, but doesnt
seem to do anything..

I imagine that I need to configure some OAM or CFM or similar, but am at a
loss as to how, anyone thats already done it?

Any help gratefully accepted

From zivl at gilat.net  Thu Jun 18 09:08:22 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Thu, 18 Jun 2009 16:08:22 +0300
Subject: [c-nsp] L2TPv3 and VLANs
Message-ID: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>

Hi,
I'm trying to make sure this following scenario can work.
3 remote sites, one is the HQ which has a switch that handles 2 vlans, let's say vlan 10 and vlan 20.
The other two branches needs to be connected to the HQ and have a flat LAN between them and the HQ, but each branch to it's own vlan, branch 1 to vlan 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
Every site has a switch and a router (C2801 I think) Is it possible to do?
If yes, then I was thinking about L2TPv3, but in this case I'd need to make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
How do I make this happen on the HQ router? I was thinking to bring the vlans via a trunk from the switch and then finishing them on sub-interfaces with dot1q and then xconnecting the sob-interface to each l2tp tunnel to each respective branch. Is it correct or there is a better way?

Will this work?

Thanks in advance for your help
Ziv


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From justin at justinshore.com  Thu Jun 18 10:06:49 2009
From: justin at justinshore.com (Justin Shore)
Date: Thu, 18 Jun 2009 09:06:49 -0500
Subject: [c-nsp] BGP quandry
In-Reply-To: <1245322257.20522.9.camel@localhost.localdomain>
References: <4A39AFC0.8050101@justinshore.com>	
	<4A39BA90.4030107@justinshore.com>
	<1245322257.20522.9.camel@localhost.localdomain>
Message-ID: <4A3A49F9.5090004@justinshore.com>

Peter Rathlev wrote:
> Core #2 doesn't have "route-reflector-client" configured towards the new
> router, so it only sends it's own prefixes and prefixes from any RR
> clients of it's own. That seems to make sense to me too.

It does now that I've thought about it.  With iBGP not forwarding on 
updates it learns from other iBGP speakers, the only way I was receiving 
the routes in the existing environment was with the RR config.  That 
makes sense.  So now I'm building a full mesh between all the speakers. 
  I haven't done a great deal of RR work so I always have to stop and 
research RRs when I work with them.  I was pretty sure that I couldn't 
pull an eBGP confederation speaker off of the RR client which is why I 
was pushing everything back towards the full mesh.

> AFAIK you always have to activate the specific peers in the VPNv4
> configuration for VPNv4 functionality. I.e. :
> 
> VPNv4 and IPv4 mixes fine, but the activation is seperated so you can
> run some IPv4 only peers, some VPNv4 only peers and some mixed peers.

That's good to know.  I assumed that the I could make the change en mass 
by using the peer-group but adding individual activations will work too. 
  That's probably a good thing so I can be more flexible with my 
peer-group use.

Thanks for the input
  Justin



From moua0100 at umn.edu  Thu Jun 18 10:44:05 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 18 Jun 2009 09:44:05 -0500
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
Message-ID: <4A3A52B5.4090509@umn.edu>


 > How do I make this happen on the HQ router?

Each l2tp tunnel will have its own vc:  "sh l2tun all"

You obviously have thoughts this all out as your logic for how it will 
and should work is sound.

We are doing a very similar setup over here at the UofMn and this is 
working well for us.


Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Ziv Leyes wrote:
> Hi,
> I'm trying to make sure this following scenario can work.
> 3 remote sites, one is the HQ which has a switch that handles 2 vlans, let's say vlan 10 and vlan 20.
> The other two branches needs to be connected to the HQ and have a flat LAN between them and the HQ, but each branch to it's own vlan, branch 1 to vlan 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
> Every site has a switch and a router (C2801 I think) Is it possible to do?
> If yes, then I was thinking about L2TPv3, but in this case I'd need to make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
> How do I make this happen on the HQ router? I was thinking to bring the vlans via a trunk from the switch and then finishing them on sub-interfaces with dot1q and then xconnecting the sob-interface to each l2tp tunnel to each respective branch. Is it correct or there is a better way?
>
> Will this work?
>
> Thanks in advance for your help
> Ziv
>
>
>  
>  
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From paul at paulstewart.org  Thu Jun 18 11:08:29 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Thu, 18 Jun 2009 11:08:29 -0400
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <4A3A52B5.4090509@umn.edu>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu>
Message-ID: <000001c9f026$b0bb05c0$12311140$@org>

How did you deal with MTU issues from l2tpv3?  In our testing we would see
packets drop instead of fragmenting where they should... I've been meaning
to followup on this as we have some great l2tpv3 deployments waiting in the
wings...

Paul


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
Sent: Thursday, June 18, 2009 10:44 AM
To: Ziv Leyes
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] L2TPv3 and VLANs


 > How do I make this happen on the HQ router?

Each l2tp tunnel will have its own vc:  "sh l2tun all"

You obviously have thoughts this all out as your logic for how it will 
and should work is sound.

We are doing a very similar setup over here at the UofMn and this is 
working well for us.


Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Ziv Leyes wrote:
> Hi,
> I'm trying to make sure this following scenario can work.
> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
let's say vlan 10 and vlan 20.
> The other two branches needs to be connected to the HQ and have a flat LAN
between them and the HQ, but each branch to it's own vlan, branch 1 to vlan
10 and branch 2 to vlan 20. They must NOT see each other's traffic.
> Every site has a switch and a router (C2801 I think) Is it possible to do?
> If yes, then I was thinking about L2TPv3, but in this case I'd need to
make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
> How do I make this happen on the HQ router? I was thinking to bring the
vlans via a trunk from the switch and then finishing them on sub-interfaces
with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
each respective branch. Is it correct or there is a better way?
>
> Will this work?
>
> Thanks in advance for your help
> Ziv
>
>
>  
>  
>
****************************************************************************
********
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer
viruses.
>
****************************************************************************
********
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From moua0100 at umn.edu  Thu Jun 18 11:33:27 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 18 Jun 2009 10:33:27 -0500
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <000001c9f026$b0bb05c0$12311140$@org>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
Message-ID: <4A3A5E47.1080506@umn.edu>

Yep, ran into  that to; on the upstream layer-3 hop from hosts do 
something like "tcp-mss adjust 1300" which will ensure tcp packets haver 
enough head-room for l2tpv3 headers.  With UDP traffic, this get more 
tricky; I haven't done this yet but one can adjust max segment size on 
end-station hosts to something like 1300 (which of course would affect 
all protocol types); there are open source tools to do this, but 
downside is that all the end-station hosts need to touched for 
consistency; i suppose I'm too lazy : - (

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Paul Stewart wrote:
> How did you deal with MTU issues from l2tpv3?  In our testing we would see
> packets drop instead of fragmenting where they should... I've been meaning
> to followup on this as we have some great l2tpv3 deployments waiting in the
> wings...
>
> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
> Sent: Thursday, June 18, 2009 10:44 AM
> To: Ziv Leyes
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] L2TPv3 and VLANs
>
>
>  > How do I make this happen on the HQ router?
>
> Each l2tp tunnel will have its own vc:  "sh l2tun all"
>
> You obviously have thoughts this all out as your logic for how it will 
> and should work is sound.
>
> We are doing a very similar setup over here at the UofMn and this is 
> working well for us.
>
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Ziv Leyes wrote:
>   
>> Hi,
>> I'm trying to make sure this following scenario can work.
>> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
>>     
> let's say vlan 10 and vlan 20.
>   
>> The other two branches needs to be connected to the HQ and have a flat LAN
>>     
> between them and the HQ, but each branch to it's own vlan, branch 1 to vlan
> 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
>   
>> Every site has a switch and a router (C2801 I think) Is it possible to do?
>> If yes, then I was thinking about L2TPv3, but in this case I'd need to
>>     
> make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
>   
>> How do I make this happen on the HQ router? I was thinking to bring the
>>     
> vlans via a trunk from the switch and then finishing them on sub-interfaces
> with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
> each respective branch. Is it correct or there is a better way?
>   
>> Will this work?
>>
>> Thanks in advance for your help
>> Ziv
>>
>>
>>  
>>  
>>
>>     
> ****************************************************************************
> ********
>   
>> This footnote confirms that this email message has been scanned by
>> PineApp Mail-SeCure for the presence of malicious code, vandals & computer
>>     
> viruses.
>   
> ****************************************************************************
> ********
>   
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>   

From moua0100 at umn.edu  Thu Jun 18 11:39:52 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 18 Jun 2009 10:39:52 -0500
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <4A3A5E47.1080506@umn.edu>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
Message-ID: <4A3A5FC8.6070100@umn.edu>

I"ve also seen "out-of-order" packets get discarded (essentially 
dropped); if fragmentation is clean and in correct order, L2TPv3 as 
implemeted by Cisco seems  to work better; we've open a case with Cisco 
about this re: VTP traffic and their response essentially was to do 
nothing about it and not use VTP (so we are now using VTP transparent 
mode with no VTP updates) and thus no VTP being transmitted over the 
l2tpv3 pseudowire.

I've been meaning to do pseudowire testing using AToM/EoMPLS tunnled 
inside of GRE to see if this works better; Cisco TAC seems to be more 
recpetive in supporting MPLS issues rather than L2TPv3 over native IP.

Let me know if you run into different conclusions as I've been 
struggling with this issue for a few years now.

Good luck.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Ge Moua wrote:
> Yep, ran into  that to; on the upstream layer-3 hop from hosts do 
> something like "tcp-mss adjust 1300" which will ensure tcp packets 
> haver enough head-room for l2tpv3 headers.  With UDP traffic, this get 
> more tricky; I haven't done this yet but one can adjust max segment 
> size on end-station hosts to something like 1300 (which of course 
> would affect all protocol types); there are open source tools to do 
> this, but downside is that all the end-station hosts need to touched 
> for consistency; i suppose I'm too lazy : - (
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Paul Stewart wrote:
>> How did you deal with MTU issues from l2tpv3?  In our testing we 
>> would see
>> packets drop instead of fragmenting where they should... I've been 
>> meaning
>> to followup on this as we have some great l2tpv3 deployments waiting 
>> in the
>> wings...
>>
>> Paul
>>
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
>> Sent: Thursday, June 18, 2009 10:44 AM
>> To: Ziv Leyes
>> Cc: cisco-nsp at puck.nether.net
>> Subject: Re: [c-nsp] L2TPv3 and VLANs
>>
>>
>>  > How do I make this happen on the HQ router?
>>
>> Each l2tp tunnel will have its own vc:  "sh l2tun all"
>>
>> You obviously have thoughts this all out as your logic for how it 
>> will and should work is sound.
>>
>> We are doing a very similar setup over here at the UofMn and this is 
>> working well for us.
>>
>>
>> Regards,
>> Ge Moua | Email: moua0100 at umn.edu
>>
>> Network Design Engineer
>> University of Minnesota | Networking & Telecommunications Services
>>
>>
>>
>> Ziv Leyes wrote:
>>  
>>> Hi,
>>> I'm trying to make sure this following scenario can work.
>>> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
>>>     
>> let's say vlan 10 and vlan 20.
>>  
>>> The other two branches needs to be connected to the HQ and have a 
>>> flat LAN
>>>     
>> between them and the HQ, but each branch to it's own vlan, branch 1 
>> to vlan
>> 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
>>  
>>> Every site has a switch and a router (C2801 I think) Is it possible 
>>> to do?
>>> If yes, then I was thinking about L2TPv3, but in this case I'd need to
>>>     
>> make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
>>  
>>> How do I make this happen on the HQ router? I was thinking to bring the
>>>     
>> vlans via a trunk from the switch and then finishing them on 
>> sub-interfaces
>> with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
>> each respective branch. Is it correct or there is a better way?
>>  
>>> Will this work?
>>>
>>> Thanks in advance for your help
>>> Ziv
>>>
>>>
>>>  
>>>  
>>>
>>>     
>> **************************************************************************** 
>>
>> ********
>>  
>>> This footnote confirms that this email message has been scanned by
>>> PineApp Mail-SeCure for the presence of malicious code, vandals & 
>>> computer
>>>     
>> viruses.
>>   
>> **************************************************************************** 
>>
>> ********
>>  
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>       
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>   
>

From linuxloader at gmail.com  Thu Jun 18 12:32:39 2009
From: linuxloader at gmail.com (Georgi Genov)
Date: Thu, 18 Jun 2009 19:32:39 +0300
Subject: [c-nsp] BGP Load balance for the uplink
Message-ID: <4A3A6C27.1030502@gmail.com>



Here is my scenario , i have 2 uplink providers , one with 2 backup 
sessions on two different vlans with 2x /30 ip addr and other with 
multihop bgp .First provider with the 2 sessions i have 2:1 speed 
compare against the second . I advertise at the both providers same 
prefix lists . ( 2x /18 and one /24 ) . dmzlink-bw is one solution , but 
it didn`t work at multihop bgp . Some other suggestions .

PS: Ruter is RSP720-3CXL-GE with Cisco IOS Software, c7600rsp72043_rp 
Software (c7600rsp72043_rp-ADVIPSERVICES-M), Version 12.2(33)SRB5a, 
RELEASE SOFTWARE (fc1)


From peter at rathlev.dk  Thu Jun 18 13:13:02 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 18 Jun 2009 19:13:02 +0200
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <1245283261.15106.46.camel@localhost.localdomain>
References: <1245283261.15106.46.camel@localhost.localdomain>
Message-ID: <1245345182.26970.13.camel@localhost.localdomain>

On Thu, 2009-06-18 at 00:01 +0000, Peter Rathlev wrote: 
> I have the need to introduce some PBR to solve a hopefully temporary
> problem. Some of the traffic being routed will leave the same interface
> as it arrives on.
> 
> My worry is if this would have any performance impact the traffic
> arrives on and leaves from the same interface. I could imagine that some
> forwarding implementations might penalize this scenario.

Follow up: We've tested this and it works fine. It seems to have some
CPU impact when the unit policy routes, but not much. When pushing 100
mbps traffic through the CPU rises to ~25-30% for a few seconds (spent
on interrupt switching) and then falls down ~5% again.

This might be PBR-specific and have nothing to do with the traffic
arriving on and exiting the same interface though. We will be doing some
more (production) testing soon, with more flows and more bandwidth. I
can't see why the number of flows should matter since the 3560 AFAIK
just pushes packets, but I also can't see why the start of a TCP session
should matter. The "ip route-cache" hasn't been disabled of course; I
assume this would have a detrimental effect on performance.

Regards,
Peter



From rodunn at cisco.com  Thu Jun 18 14:34:33 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Thu, 18 Jun 2009 14:34:33 -0400
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <1245345182.26970.13.camel@localhost.localdomain>
References: <1245283261.15106.46.camel@localhost.localdomain>
	<1245345182.26970.13.camel@localhost.localdomain>
Message-ID: <20090618183433.GB13882@rtp-cse-489.cisco.com>

Curious..I don't know that platform forwarding architecture.

But what does 'sh int stat' give you?

Also, sh ip traffic a couple times once you start the traffic.


On Thu, Jun 18, 2009 at 07:13:02PM +0200, Peter Rathlev wrote:lso

> On Thu, 2009-06-18 at 00:01 +0000, Peter Rathlev wrote: 
> > I have the need to introduce some PBR to solve a hopefully temporary
> > problem. Some of the traffic being routed will leave the same interface
> > as it arrives on.
> > 
> > My worry is if this would have any performance impact the traffic
> > arrives on and leaves from the same interface. I could imagine that some
> > forwarding implementations might penalize this scenario.
> 
> Follow up: We've tested this and it works fine. It seems to have some
> CPU impact when the unit policy routes, but not much. When pushing 100
> mbps traffic through the CPU rises to ~25-30% for a few seconds (spent
> on interrupt switching) and then falls down ~5% again.
> 
> This might be PBR-specific and have nothing to do with the traffic
> arriving on and exiting the same interface though. We will be doing some
> more (production) testing soon, with more flows and more bandwidth. I
> can't see why the number of flows should matter since the 3560 AFAIK
> just pushes packets, but I also can't see why the start of a TCP session
> should matter. The "ip route-cache" hasn't been disabled of course; I
> assume this would have a detrimental effect on performance.
> 
> Regards,
> Peter
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From paul at paulstewart.org  Thu Jun 18 20:31:42 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Thu, 18 Jun 2009 20:31:42 -0400
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <4A3A5E47.1080506@umn.edu>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
Message-ID: <007a01c9f075$5258a1f0$f709e5d0$@org>

Thanks... we don't want to touch each workstation - would involve way too
much time for our installations...;)

With UDP traffic, does anything "normally" break that comes to mind on
larger MTU? I can't think of anything hence why I'm asking...

Cheers,

Paul


-----Original Message-----
From: Ge Moua [mailto:moua0100 at umn.edu] 
Sent: June 18, 2009 11:33 AM
To: Paul Stewart
Cc: 'Ziv Leyes'; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] L2TPv3 and VLANs

Yep, ran into  that to; on the upstream layer-3 hop from hosts do 
something like "tcp-mss adjust 1300" which will ensure tcp packets haver 
enough head-room for l2tpv3 headers.  With UDP traffic, this get more 
tricky; I haven't done this yet but one can adjust max segment size on 
end-station hosts to something like 1300 (which of course would affect 
all protocol types); there are open source tools to do this, but 
downside is that all the end-station hosts need to touched for 
consistency; i suppose I'm too lazy : - (

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Paul Stewart wrote:
> How did you deal with MTU issues from l2tpv3?  In our testing we would see
> packets drop instead of fragmenting where they should... I've been meaning
> to followup on this as we have some great l2tpv3 deployments waiting in
the
> wings...
>
> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
> Sent: Thursday, June 18, 2009 10:44 AM
> To: Ziv Leyes
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] L2TPv3 and VLANs
>
>
>  > How do I make this happen on the HQ router?
>
> Each l2tp tunnel will have its own vc:  "sh l2tun all"
>
> You obviously have thoughts this all out as your logic for how it will 
> and should work is sound.
>
> We are doing a very similar setup over here at the UofMn and this is 
> working well for us.
>
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Ziv Leyes wrote:
>   
>> Hi,
>> I'm trying to make sure this following scenario can work.
>> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
>>     
> let's say vlan 10 and vlan 20.
>   
>> The other two branches needs to be connected to the HQ and have a flat
LAN
>>     
> between them and the HQ, but each branch to it's own vlan, branch 1 to
vlan
> 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
>   
>> Every site has a switch and a router (C2801 I think) Is it possible to
do?
>> If yes, then I was thinking about L2TPv3, but in this case I'd need to
>>     
> make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
>   
>> How do I make this happen on the HQ router? I was thinking to bring the
>>     
> vlans via a trunk from the switch and then finishing them on
sub-interfaces
> with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
> each respective branch. Is it correct or there is a better way?
>   
>> Will this work?
>>
>> Thanks in advance for your help
>> Ziv
>>
>>
>>  
>>  
>>
>>     
>
****************************************************************************
> ********
>   
>> This footnote confirms that this email message has been scanned by
>> PineApp Mail-SeCure for the presence of malicious code, vandals &
computer
>>     
> viruses.
>   
>
****************************************************************************
> ********
>   
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>   



From ml at kenweb.org  Thu Jun 18 20:36:36 2009
From: ml at kenweb.org (ML)
Date: Thu, 18 Jun 2009 20:36:36 -0400
Subject: [c-nsp] Incorrect netflow data from 7600/6500?
Message-ID: <4A3ADD94.7060508@kenweb.org>

I'm trying to export flows from a 6509 to nfcapd/nfdump.

When I sort by protocol and bytes I see a "protocol 0" as the majority 
of the traffic.

Top 20    Protocol ordered by bytes:

Proto 	Protocol   Flows  Packets    Bytes
0       0          7.8 M  296.8 M  229.1 G
TCP     6          2.8 M   82.0 M   35.3 G
UDP     17         3.7 M   21.7 M    4.3 G

<truncated for brevity>

I've seen this result from multiple other Netflow tools: ntop, Orion 
NetFlow and now nfdump.  The only common element is my hardware.
I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both running
12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.

I think I can make the assumption there isn't a protocol in use that 
trumps both UDP and TCP traffic combined.  Have I run into an IOS bug or 
did I misconfigure?

Configuarion:
-----------------------------------
mls aging fast time 1 threshold 1
mls aging long 64
mls aging normal 32
mls flow ip interface-destination-source
no mls flow ipv6
mls nde sender version 5
no mls acl tcam share-global
mls nde sender version 5

ip flow-cache timeout inactive 10
ip flow-cache timeout active 1

"Config for interfaces of interest"
  ip flow ingress
  ip route-cache flow

ip flow-export source Loopback0
ip flow-export version 5
ip flow-export destination x.x.x.x
------------------------------------

Any help is appreciated.







From ayourtch at cisco.com  Thu Jun 18 22:32:12 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Fri, 19 Jun 2009 04:32:12 +0200 (CEST)
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <4A3A5E47.1080506@umn.edu>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
Message-ID: <Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>

Hi Ge,

On Thu, 18 Jun 2009, Ge Moua wrote:

[snip]

> I haven't done this yet but one can adjust max segment size on end-station 
> hosts to something like 1300 (which of course would affect all protocol 
> types); there are open source tools to do this, but downside is that all the 
> end-station hosts need to touched for consistency; i suppose I'm too lazy : - (

Would not the clients honour the DHCP option 26 ?

cheers,
andrew

p.s. of course, if the fragmenting does not take place of the 
pass-through packets with no DF, that deserves a closer look. 
Fragmentation considered harmful and all, still it should work.

From paul at paulstewart.org  Thu Jun 18 22:40:12 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Thu, 18 Jun 2009 22:40:12 -0400
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
Message-ID: <007e01c9f087$45aebae0$d10c30a0$@org>

I must admit  - I didn't know such an option existed... and that's great to
know...

On a related note to the PS below... we have tested lt2tpv3 on a few
different boxes running various IOS images and on each of the devices we did
test we seen the same behavior.  This means something is either broke in the
code in my opinion or that we are doing something wrong.  Typically that
means the second option in our case (lol) but I did get a fair amount of
feedback offline from folks with similar problems....;)

Paul


-----Original Message-----
From: Andrew Yourtchenko [mailto:ayourtch at cisco.com] 
Sent: June 18, 2009 10:32 PM
To: Ge Moua
Cc: Paul Stewart; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] L2TPv3 and VLANs

Hi Ge,

On Thu, 18 Jun 2009, Ge Moua wrote:

[snip]

> I haven't done this yet but one can adjust max segment size on end-station

> hosts to something like 1300 (which of course would affect all protocol 
> types); there are open source tools to do this, but downside is that all
the 
> end-station hosts need to touched for consistency; i suppose I'm too lazy
: - (

Would not the clients honour the DHCP option 26 ?

cheers,
andrew

p.s. of course, if the fragmenting does not take place of the 
pass-through packets with no DF, that deserves a closer look. 
Fragmentation considered harmful and all, still it should work.



From SHughes at GREnergy.com  Thu Jun 18 22:14:43 2009
From: SHughes at GREnergy.com (Hughes, Scott GRE/MG)
Date: Thu, 18 Jun 2009 21:14:43 -0500
Subject: [c-nsp] Incorrect netflow data from 7600/6500?
In-Reply-To: <4A3ADD94.7060508@kenweb.org>
References: <4A3ADD94.7060508@kenweb.org>
Message-ID: <D72AC2E49DA8AB4195DF356ED05663DD29520D3C5F@MNCMS01.intra.grenergy.com>

I had this problem as well, and was able to solve it with the following config:

mls flow ip interface-full


________________________________________
From: cisco-nsp-bounces at puck.nether.net [cisco-nsp-bounces at puck.nether.net] On Behalf Of ML [ml at kenweb.org]
Sent: Thursday, June 18, 2009 7:36 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Incorrect netflow data from 7600/6500?

I'm trying to export flows from a 6509 to nfcapd/nfdump.

When I sort by protocol and bytes I see a "protocol 0" as the majority
of the traffic.

Top 20    Protocol ordered by bytes:

Proto   Protocol   Flows  Packets    Bytes
0       0          7.8 M  296.8 M  229.1 G
TCP     6          2.8 M   82.0 M   35.3 G
UDP     17         3.7 M   21.7 M    4.3 G

<truncated for brevity>

I've seen this result from multiple other Netflow tools: ntop, Orion
NetFlow and now nfdump.  The only common element is my hardware.
I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both running
12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.

I think I can make the assumption there isn't a protocol in use that
trumps both UDP and TCP traffic combined.  Have I run into an IOS bug or
did I misconfigure?

Configuarion:
-----------------------------------
mls aging fast time 1 threshold 1
mls aging long 64
mls aging normal 32
mls flow ip interface-destination-source
no mls flow ipv6
mls nde sender version 5
no mls acl tcam share-global
mls nde sender version 5

ip flow-cache timeout inactive 10
ip flow-cache timeout active 1

"Config for interfaces of interest"
  ip flow ingress
  ip route-cache flow

ip flow-export source Loopback0
ip flow-export version 5
ip flow-export destination x.x.x.x
------------------------------------

Any help is appreciated.






_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From ayourtch at cisco.com  Thu Jun 18 23:15:17 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Fri, 19 Jun 2009 05:15:17 +0200 (CEST)
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <007e01c9f087$45aebae0$d10c30a0$@org>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
	<007e01c9f087$45aebae0$d10c30a0$@org>
Message-ID: <Pine.LNX.4.64.0906190452330.8007@zippy.stdio.be>



On Thu, 18 Jun 2009, Paul Stewart wrote:

> I must admit  - I didn't know such an option existed... and that's great to
> know...

I myself discovered it by accident when I saw the MTU on my linux box to 
be not the 1500 :-)

>
> On a related note to the PS below... we have tested lt2tpv3 on a few
> different boxes running various IOS images and on each of the devices we did
> test we seen the same behavior.  This means something is either broke in the
> code in my opinion or that we are doing something wrong.  Typically that
> means the second option in our case (lol) but I did get a fair amount of
> feedback offline from folks with similar problems....;)

It could be as well that it is the first option but that the tcp 
mss-adjust hack is working "good enough" for anyone to bother - there are 
always "more important battles" to fight. But if someone on the list is 
willing to spend some cycles on this in the lab and subsequently open a 
case to get this to a more definitive status quo - unicast me.

thanks,
andrew

p.s. about the protocols that can break with this scenario, a few things 
come to mind: kerberos, possibly IKE w/certs, SNMP, netflow.


From moua0100 at umn.edu  Fri Jun 19 00:13:01 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 18 Jun 2009 23:13:01 -0500
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <007a01c9f075$5258a1f0$f709e5d0$@org>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu> <007a01c9f075$5258a1f0$f709e5d0$@org>
Message-ID: <4A3B104D.3060003@umn.edu>

RTP, video streaming, h.323, & the like; nothing really breaks, just 
"spongy" response if the pipe is saturated.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Paul Stewart wrote:
> Thanks... we don't want to touch each workstation - would involve way too
> much time for our installations...;)
>
> With UDP traffic, does anything "normally" break that comes to mind on
> larger MTU? I can't think of anything hence why I'm asking...
>
> Cheers,
>
> Paul
>
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu] 
> Sent: June 18, 2009 11:33 AM
> To: Paul Stewart
> Cc: 'Ziv Leyes'; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] L2TPv3 and VLANs
>
> Yep, ran into  that to; on the upstream layer-3 hop from hosts do 
> something like "tcp-mss adjust 1300" which will ensure tcp packets haver 
> enough head-room for l2tpv3 headers.  With UDP traffic, this get more 
> tricky; I haven't done this yet but one can adjust max segment size on 
> end-station hosts to something like 1300 (which of course would affect 
> all protocol types); there are open source tools to do this, but 
> downside is that all the end-station hosts need to touched for 
> consistency; i suppose I'm too lazy : - (
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Paul Stewart wrote:
>   
>> How did you deal with MTU issues from l2tpv3?  In our testing we would see
>> packets drop instead of fragmenting where they should... I've been meaning
>> to followup on this as we have some great l2tpv3 deployments waiting in
>>     
> the
>   
>> wings...
>>
>> Paul
>>
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
>> Sent: Thursday, June 18, 2009 10:44 AM
>> To: Ziv Leyes
>> Cc: cisco-nsp at puck.nether.net
>> Subject: Re: [c-nsp] L2TPv3 and VLANs
>>
>>
>>  > How do I make this happen on the HQ router?
>>
>> Each l2tp tunnel will have its own vc:  "sh l2tun all"
>>
>> You obviously have thoughts this all out as your logic for how it will 
>> and should work is sound.
>>
>> We are doing a very similar setup over here at the UofMn and this is 
>> working well for us.
>>
>>
>> Regards,
>> Ge Moua | Email: moua0100 at umn.edu
>>
>> Network Design Engineer
>> University of Minnesota | Networking & Telecommunications Services
>>
>>
>>
>> Ziv Leyes wrote:
>>   
>>     
>>> Hi,
>>> I'm trying to make sure this following scenario can work.
>>> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
>>>     
>>>       
>> let's say vlan 10 and vlan 20.
>>   
>>     
>>> The other two branches needs to be connected to the HQ and have a flat
>>>       
> LAN
>   
>>>     
>>>       
>> between them and the HQ, but each branch to it's own vlan, branch 1 to
>>     
> vlan
>   
>> 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
>>   
>>     
>>> Every site has a switch and a router (C2801 I think) Is it possible to
>>>       
> do?
>   
>>> If yes, then I was thinking about L2TPv3, but in this case I'd need to
>>>     
>>>       
>> make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
>>   
>>     
>>> How do I make this happen on the HQ router? I was thinking to bring the
>>>     
>>>       
>> vlans via a trunk from the switch and then finishing them on
>>     
> sub-interfaces
>   
>> with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
>> each respective branch. Is it correct or there is a better way?
>>   
>>     
>>> Will this work?
>>>
>>> Thanks in advance for your help
>>> Ziv
>>>
>>>
>>>  
>>>  
>>>
>>>     
>>>       
> ****************************************************************************
>   
>> ********
>>   
>>     
>>> This footnote confirms that this email message has been scanned by
>>> PineApp Mail-SeCure for the presence of malicious code, vandals &
>>>       
> computer
>   
>>>     
>>>       
>> viruses.
>>   
>>
>>     
> ****************************************************************************
>   
>> ********
>>   
>>     
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>   
>>>     
>>>       
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>   
>>     
>
>
>   

From ying-xiang at 163.com  Fri Jun 19 00:58:00 2009
From: ying-xiang at 163.com (ying-xiang)
Date: Fri, 19 Jun 2009 12:58:00 +0800 (CST)
Subject: [c-nsp] the ospf 0*E2 route type can not be redistributed between
 two ospf process
Message-ID: <15453343.191691245387480644.JavaMail.coremail@bj163app61.163.com>


hi,folk
 
anyone knows the reason why i can not redistribute the O*E2 route which generated by one ospf router using default-information originate command to another ospf process?

From anderson.levi at gmail.com  Fri Jun 19 03:12:52 2009
From: anderson.levi at gmail.com (Anderson Levi)
Date: Fri, 19 Jun 2009 10:12:52 +0300
Subject: [c-nsp] Cisco SFP
In-Reply-To: <D0D0330CBD07114D85B70B784E80C2F202CE3465@exch-mail2.win.slac.stanford.edu>
References: <e22d607d0906180032w42e356ceyd2a9a49a70ebe0cc@mail.gmail.com>
	<D0D0330CBD07114D85B70B784E80C2F202CE3465@exch-mail2.win.slac.stanford.edu>
Message-ID: <e22d607d0906190012q4e66a47bm9ada4adff6ddc59c@mail.gmail.com>

Thanks.

On Thu, Jun 18, 2009 at 10:49 AM, Buhrmaster, Gary <gtb at slac.stanford.edu>wrote:

> > What are the implications of using a GLC-ZX-SM module to light a
> > stretch of 20 - 30km? Would I need to add an attenuator, given that 20km
> is well
> > below the 70km limit?
>
>
> As always, the answer is "it depends", because
> it is the optical power, not distance, but usually
> if the link is <~25km you can expect to need an
> attenuator.  The typical transmit is ~ 0-5dBm,
> and the max receive power is ~ -3dBm.  If you
> overload the receiver, you could damage the
> device, or shorten is life, or cause various
> physical link errors to be reported as the
> optics is overloaded.  So, in all cases,
> measure the received power, and add in the
> needed attenuation.
>
> Reference:
>
> http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6577/product_data_sheet0900aecd8033f885.html
>
> Gary
>

From zhuifeng0426 at gmail.com  Fri Jun 19 03:57:34 2009
From: zhuifeng0426 at gmail.com (zhuifeng0426)
Date: Fri, 19 Jun 2009 15:57:34 +0800
Subject: [c-nsp] Hello packets sending on NBMA netwroks
Message-ID: <200906191557329199317@gmail.com>

Hi list:
I have a question about Hello packet sending on NBMA networks:
in page 79 of RFC 2328 it said:
"If the router is eligible to become Designated Router, it
must periodically send Hello Packets to all neighbors that
are also eligible.  In addition, if the router is itself the
Designated Router or Backup Designated Router, it must also
send periodic Hello Packets to all other neighbors."
and:
"If the router is not eligible to become Designated Router, 
it must periodically send Hello Packets to both the
Designated Router and the Backup Designated Router (if they
exist).  It must also send an Hello Packet in reply to an
Hello Packet received from any eligible neighbor (other than
the current Designated Router and Backup Designated Router).
This is needed to establish an initial bidirectional
relationship with any potential Designated Router."
so, here is a question:
since all eligible(other than DR and BDR) router won't send Hello packets to the router that is not eligible to become DR, how can these route reply the eligible(other than DR and BDR) router? 

2009-06-19 



zhuifeng0426 

From benny+usenet at amorsen.dk  Fri Jun 19 04:41:12 2009
From: benny+usenet at amorsen.dk (Benny Amorsen)
Date: Fri, 19 Jun 2009 10:41:12 +0200
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <007e01c9f087$45aebae0$d10c30a0$@org> (Paul Stewart's message of
	"Thu\, 18 Jun 2009 22\:40\:12 -0400")
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
	<007e01c9f087$45aebae0$d10c30a0$@org>
Message-ID: <m3y6ro7h07.fsf@ursa.amorsen.dk>

"Paul Stewart" <paul at paulstewart.org> writes:

> On a related note to the PS below... we have tested lt2tpv3 on a few
> different boxes running various IOS images and on each of the devices we did
> test we seen the same behavior.  This means something is either broke in the
> code in my opinion or that we are doing something wrong.  Typically that
> means the second option in our case (lol) but I did get a fair amount of
> feedback offline from folks with similar problems....;)

Generally problems with PMTU are caused by people blocking ICMP in their
(usually PIX/ASA) firewalls. If you control the whole path, you can make
sure that you're not one of the culprits.

On the other hand, if you're trying to reach the Internet through
tunnels with non-1500-byte MTU, you'll just have to accept that it won't
work. You can MSS adjust for TCP traffic though or you can lower your
interface or route MTU as workarounds. The only real fix is either
PIX/ASA administrators getting a clue, or Cisco getting a clue. Not
particularly likely.


/Benny

(Yes, I'm bitter.)

From drrtuy at ya.ru  Fri Jun 19 05:47:48 2009
From: drrtuy at ya.ru (Roman A. Nozdrin)
Date: Fri, 19 Jun 2009 12:47:48 +0300
Subject: [c-nsp] Hello packets sending on NBMA netwroks
In-Reply-To: <200906191557329199317@gmail.com>
References: <200906191557329199317@gmail.com>
Message-ID: <4A3B5EC4.6010507@ya.ru>

Hello.

> I have a question about Hello packet sending on NBMA networks:
> in page 79 of RFC 2328 it said:
> "If the router is eligible to become Designated Router, it
> must periodically send Hello Packets to all neighbors that
> are also eligible.  In addition, if the router is itself the
> Designated Router or Backup Designated Router, it must also
> send periodic Hello Packets to all other neighbors."
> and:
> "If the router is not eligible to become Designated Router, 
> it must periodically send Hello Packets to both the
> Designated Router and the Backup Designated Router (if they
> exist).  It must also send an Hello Packet in reply to an
> Hello Packet received from any eligible neighbor (other than
> the current Designated Router and Backup Designated Router).
> This is needed to establish an initial bidirectional
> relationship with any potential Designated Router."
> so, here is a question:
> since all eligible(other than DR and BDR) router won't send Hello packets to the router that is not eligible to become DR, how can these route reply the eligible(other than DR and BDR) router? 

OSPF uses neighbor statement to send Hello to unicast IP address in NMBA 
clouds. If eligible router knows target non-eligible router via neighbor 
command, it will send Hello to it. So don't forget to put neccesecery 
neighbor ips configuring eligible router.

WBR
Roman A. Nozdrin

From peter.haag at switch.ch  Fri Jun 19 08:53:59 2009
From: peter.haag at switch.ch (Peter Haag)
Date: Fri, 19 Jun 2009 14:53:59 +0200
Subject: [c-nsp] nfdump 1.6b snapshot available
Message-ID: <4A3B8A67.10801@switch.ch>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,
I'm looking for testers for a new snapshot nfdump-1.6b-snapshot=20090619
which I just put onto Sourceforge. There shouldn't be many changes from
the beta code until final 1.6 stable.
However, I would like users to test the new snapshot and please send
me feedback about potential bugs you found.
Feel also free to send me feature request and other ideas, which can go
into next releases.

The two existing 1.5.x branches on Sourceforge for packeteer and
CISCO NSEL will get merged into 1.6.1.

If you need to read flow files from nfdump-1.5.x do not forget to
run configure with --enable-compat15

What changed and what's new: ( to be read from bottom to top )

o Flow-tools converter updated - supports more common elements.
o Sflow collector updated. Supports more common elements.
o Add sampling to nfdump. Sampling is automatically recognised
  in undocumented v5 header fields and in v9 option templates.
  see nfcapd.1(1)
o Add @include option for filter to include more filter files.
o Add flexible aggregation comparable to Flexible Netflow (FNF)
  over all available v9 tags
o All new tags can be selected in -o fmt:... see nfdump(1)
o topN stat for all new tags is implemented
o Integrate developer code to read from pcap files into stable branch
o Update filter syntax for new tags
o Add flexible storage option for nfcapd. To save disk space, the
  data extensions to be stored in the data file are user selectable.
o Added more v9 tags for netflow v9.
  The detailed tags are listed in nfcapd(1) Beside of MAC addresses
  and VLAN labels, also MPLS labels and many more v9 tags are now
  supported. AS numbers and interface numbers are now 32bit clean.
  Adding new tags also extended the binary file format with
  data block type 2, which is extension based. File format
  for version <= 1.5.* ( Data block format type 1 ) is read
  transparently. ( --enable-compat15 ) Data block type 2 are skipped
  by nfdump 1.5.7.
o Added option for multiple netflow stream to same port.
  -n <Ident,IP,base_directory>
  Example: -n router1,192.168.100.1,/var/nfdump/router1
  So multiple -n options may be given at the command line
  Old style syntax still works for compatibility, ( -I .. -l ... )
  but then only one source is supported.
o Move to automake for building nfdump
o Make nfdump fully 64bit compliant. ( 32/64bit data alignments and access )
  Compiles and runs cleanly on 32/64bit systems
o Switch scaling factor ( k, M, G ) from 1024 to 1000.

Ths snapshot can be used as a drop in replacement for nfdump-1.5.x
and can be used together with NfSen. However, not all new feature can
be used as NfSen does not yet support them.

Feedback is appreciated

Happy playing!

	- Peter

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box,  CH-8021   Zurich, Switzerland
E-mail: peter.haag at switch.ch Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iQCVAwUBSjuKZf5AbZRALNr/AQIrggQAkhFuU273sC0dOtcOYd8IxNLgG1ZsUtHA
r9pHbz+QHjzALH6XDRk1B+GuL8jVgcnAz83DYruJVHiBI34xxpNJJi5p5dX2wUED
pqURfLtHykl0ITA15K2X0f5yQUQkFR8sQsrf8rdGyokeGWglV0u8sEdP1QPq2lLW
ATjp54V/PC8=
=VW7f
-----END PGP SIGNATURE-----

From geoff at pendery.net  Fri Jun 19 08:35:38 2009
From: geoff at pendery.net (Geoffrey Pendery)
Date: Fri, 19 Jun 2009 07:35:38 -0500
Subject: [c-nsp] the ospf 0*E2 route type can not be redistributed
	between two ospf process
In-Reply-To: <15453343.191691245387480644.JavaMail.coremail@bj163app61.163.com>
References: <15453343.191691245387480644.JavaMail.coremail@bj163app61.163.com>
Message-ID: <d6966e4b0906190535o595d07f9jfc7598a569165df5@mail.gmail.com>

Well if you're talking "default-information originate", then the route
in question is 0.0.0.0/0, default.  It's special - you can't just tell
an OSPF process to redistribute 0.0.0.0/0.  If you want both processes
to distribute default, then they both need the "default-information
originate" command.


-Geoff


On Thu, Jun 18, 2009 at 11:58 PM, ying-xiang<ying-xiang at 163.com> wrote:
>
> hi,folk
>
> anyone knows the reason why i can not redistribute the O*E2 route which generated by one ospf router using default-information originate command to another ospf process?
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From peter.haag at switch.ch  Fri Jun 19 09:08:01 2009
From: peter.haag at switch.ch (Peter Haag)
Date: Fri, 19 Jun 2009 15:08:01 +0200
Subject: [c-nsp]  Incorrect netflow data from 7600/6500?
In-Reply-To: <mailman.874.1245381356.2287.cisco-nsp@puck.nether.net>
References: <mailman.874.1245381356.2287.cisco-nsp@puck.nether.net>
Message-ID: <4A3B8DB1.6000009@switch.ch>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> 
> I'm trying to export flows from a 6509 to nfcapd/nfdump.
> 
> When I sort by protocol and bytes I see a "protocol 0" as the majority
> of the traffic.
> 
> Top 20    Protocol ordered by bytes:
> 
> Proto   Protocol   Flows  Packets    Bytes
> 0       0          7.8 M  296.8 M  229.1 G
> TCP     6          2.8 M   82.0 M   35.3 G
> UDP     17         3.7 M   21.7 M    4.3 G
> 
> <truncated for brevity>
> 
> I've seen this result from multiple other Netflow tools: ntop, Orion
> NetFlow and now nfdump.  The only common element is my hardware.
> I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both running
> 12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.
> 
> I think I can make the assumption there isn't a protocol in use that
> trumps both UDP and TCP traffic combined.  Have I run into an IOS bug or
> did I misconfigure?

No - port 0 result from fragmented packets Most likely UDP packets > MTU size.
Since the IP ID field is not tracked in a v5 Netflow record, the router
can not map a fragmented packet to the appropriate flow, and simply
creates a flow with port '0'

	- Peter
> 
> Configuarion:
> -----------------------------------
> mls aging fast time 1 threshold 1
> mls aging long 64
> mls aging normal 32
> mls flow ip interface-destination-source
> no mls flow ipv6
> mls nde sender version 5
> no mls acl tcam share-global
> mls nde sender version 5
> 
> ip flow-cache timeout inactive 10
> ip flow-cache timeout active 1
> 
> "Config for interfaces of interest"
>   ip flow ingress
>   ip route-cache flow
> 
> ip flow-export source Loopback0
> ip flow-export version 5
> ip flow-export destination x.x.x.x
> ------------------------------------
> 
> Any help is appreciated.
> 
> 
> 
> 
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> ------------------------------
> 
> Message: 9
> Date: Fri, 19 Jun 2009 05:15:17 +0200 (CEST)
> From: Andrew Yourtchenko <ayourtch at cisco.com>
> To: Paul Stewart <paul at paulstewart.org>
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] L2TPv3 and VLANs
> Message-ID: <Pine.LNX.4.64.0906190452330.8007 at zippy.stdio.be>
> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
> 
> 
> 
> On Thu, 18 Jun 2009, Paul Stewart wrote:
> 
>> I must admit  - I didn't know such an option existed... and that's great to
>> know...
> 
> I myself discovered it by accident when I saw the MTU on my linux box to 
> be not the 1500 :-)
> 
>> On a related note to the PS below... we have tested lt2tpv3 on a few
>> different boxes running various IOS images and on each of the devices we did
>> test we seen the same behavior.  This means something is either broke in the
>> code in my opinion or that we are doing something wrong.  Typically that
>> means the second option in our case (lol) but I did get a fair amount of
>> feedback offline from folks with similar problems....;)
> 
> It could be as well that it is the first option but that the tcp 
> mss-adjust hack is working "good enough" for anyone to bother - there are 
> always "more important battles" to fight. But if someone on the list is 
> willing to spend some cycles on this in the lab and subsequently open a 
> case to get this to a more definitive status quo - unicast me.
> 
> thanks,
> andrew
> 
> p.s. about the protocols that can break with this scenario, a few things 
> come to mind: kerberos, possibly IKE w/certs, SNMP, netflow.
> 
> 
> 
> ------------------------------
> 
> _______________________________________________
> cisco-nsp mailing list
> cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> 
> End of cisco-nsp Digest, Vol 79, Issue 65
> *****************************************

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box,  CH-8021   Zurich, Switzerland
E-mail: peter.haag at switch.ch Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iQCVAwUBSjuNr/5AbZRALNr/AQJ//wQAmWIig5w5P2kB7uF/4gPMzwAbwJtPyG70
SqBEPKRG/KWat4iudfEwA/789EUNjSVK53mYSm2eWwU4UcLfExAcNHTWl2YAax7o
Sh9TZ4zimwScHrTTXoTAdUVs+qa7eKbhxWmOyrZGhvar/NxUK5B3dqUqiGsA7DBl
Err93Fg3fV0=
=HP1D
-----END PGP SIGNATURE-----

From nic at gblx.net  Fri Jun 19 09:22:14 2009
From: nic at gblx.net (Nic McCartney)
Date: Fri, 19 Jun 2009 14:22:14 +0100
Subject: [c-nsp] Long Uptime
Message-ID: <018201c9f0e0$f65e3740$e31aa5c0$@net>

Not techy, just interesting anyone beat this uptime?

Liverpool_St_A#sho ver
Cisco Internetwork Operating System Software IOS (tm) 3000 Software
(IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c) 1986-1996
by cisco Systems, Inc.
Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
data-base: 0x00001000

ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
SOFTWARE (fc1)

Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
restarted by power-on System image file is "flash:igs-j-l.110-13", booted
via flash

cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of memory.
Processor board ID 04812778, with hardware revision 00000000 Bridging
software.
SuperLAT software copyright 1990 by Meridian Technology Corp).
X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
TN3270 Emulation software (copyright 1994 by TGV Inc).
1 Ethernet/IEEE 802.3 interface.
2 Serial network interfaces.
32K bytes of non-volatile configuration memory.
8192K bytes of processor board System flash (Read ONLY)

Configuration register is 0x2102

Liverpool_St_A#


Thanks

Nic



From ploopster at gmail.com  Fri Jun 19 10:03:17 2009
From: ploopster at gmail.com (Sridhar Ayengar)
Date: Fri, 19 Jun 2009 10:03:17 -0400
Subject: [c-nsp] Long Uptime
In-Reply-To: <018201c9f0e0$f65e3740$e31aa5c0$@net>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
Message-ID: <4A3B9AA5.3080704@gmail.com>

Nic McCartney wrote:
> Not techy, just interesting anyone beat this uptime?

I can, but not on a Cisco.

Peace...  Sridhar

From peter at rathlev.dk  Fri Jun 19 10:08:01 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Fri, 19 Jun 2009 16:08:01 +0200
Subject: [c-nsp] Incorrect netflow data from 7600/6500?
In-Reply-To: <4A3B8DB1.6000009@switch.ch>
References: <mailman.874.1245381356.2287.cisco-nsp@puck.nether.net>
	<4A3B8DB1.6000009@switch.ch>
Message-ID: <1245420481.6873.2.camel@localhost.localdomain>

On Fri, 2009-06-19 at 15:08 +0200, Peter Haag wrote:
> > I've seen this result from multiple other Netflow tools: ntop, Orion
> > NetFlow and now nfdump.  The only common element is my hardware.
> > I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both
> > running 12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.
> > 
> > I think I can make the assumption there isn't a protocol in use that
> > trumps both UDP and TCP traffic combined.  Have I run into an IOS
> > bug or did I misconfigure?
> 
> No - port 0 result from fragmented packets Most likely UDP packets >
> MTU size. Since the IP ID field is not tracked in a v5 Netflow record,
> the router can not map a fragmented packet to the appropriate flow,
> and simply creates a flow with port '0'

Well, that would be for _port_ 0 traffic, with either TCP or UDP in the
protocol field, wouldn't it? OPs traffic is "protocol 0", so IMHO Scotts
point about flow mask is the best bet.

Regards,
Peter



From mustafa.golam at gmail.com  Fri Jun 19 10:19:51 2009
From: mustafa.golam at gmail.com (Mustafa Golam -)
Date: Fri, 19 Jun 2009 15:19:51 +0100
Subject: [c-nsp] Long Uptime
In-Reply-To: <018201c9f0e0$f65e3740$e31aa5c0$@net>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
Message-ID: <c72973e60906190719r66a462b4hedc10883d8771780@mail.gmail.com>

Check this:
http://www.networkworld.com/community/node/18932

Some of them are more stable than yours :P

//Mustafa

On Fri, Jun 19, 2009 at 2:22 PM, Nic McCartney <nic at gblx.net> wrote:

> Not techy, just interesting anyone beat this uptime?
>
> Liverpool_St_A#sho ver
> Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c) 1986-1996
> by cisco Systems, Inc.
> Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> data-base: 0x00001000
>
> ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> SOFTWARE (fc1)
>
> Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> via flash
>
> cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of memory.
> Processor board ID 04812778, with hardware revision 00000000 Bridging
> software.
> SuperLAT software copyright 1990 by Meridian Technology Corp).
> X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> TN3270 Emulation software (copyright 1994 by TGV Inc).
> 1 Ethernet/IEEE 802.3 interface.
> 2 Serial network interfaces.
> 32K bytes of non-volatile configuration memory.
> 8192K bytes of processor board System flash (Read ONLY)
>
> Configuration register is 0x2102
>
> Liverpool_St_A#
>
>
> Thanks
>
> Nic
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
--
*??)
?.???.?*??) ?.?*?)
(?.?? (?.?` *Mustafa Golam,CCIE(..)'.'`,.
-.*.-JNCIS,RHCE,CC{D,I,N,S,V}P`et. al.'.'`,..
    Email  : mustafa.golam at gmail.com
    GSM: ++234-(7034174940)/(7060460120)
      http://journey2ccie.wordpress.com/

From gustavo at nexthop.com.br  Fri Jun 19 10:25:14 2009
From: gustavo at nexthop.com.br (Gustavo Rodrigues Ramos)
Date: Fri, 19 Jun 2009 11:25:14 -0300
Subject: [c-nsp] Long Uptime
In-Reply-To: <018201c9f0e0$f65e3740$e31aa5c0$@net>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
Message-ID: <73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>

Is this suppose to be a good thing? (not patching your systems for
almost 10 years?)...

Gustavo.


On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> Not techy, just interesting anyone beat this uptime?
>
> Liverpool_St_A#sho ver
> Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c) 1986-1996
> by cisco Systems, Inc.
> Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> data-base: 0x00001000
>
> ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> SOFTWARE (fc1)
>
> Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> via flash
>
> cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of memory.
> Processor board ID 04812778, with hardware revision 00000000 Bridging
> software.
> SuperLAT software copyright 1990 by Meridian Technology Corp).
> X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> TN3270 Emulation software (copyright 1994 by TGV Inc).
> 1 Ethernet/IEEE 802.3 interface.
> 2 Serial network interfaces.
> 32K bytes of non-volatile configuration memory.
> 8192K bytes of processor board System flash (Read ONLY)
>
> Configuration register is 0x2102
>
> Liverpool_St_A#
>
>
> Thanks
>
> Nic
>
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From rinse.kloek at isp.solcon.nl  Fri Jun 19 10:49:00 2009
From: rinse.kloek at isp.solcon.nl (Rinse Kloek)
Date: Fri, 19 Jun 2009 16:49:00 +0200
Subject: [c-nsp] ETSI Rack mounts for 4500
In-Reply-To: <73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
Message-ID: <4A3BA55C.6070101@isp.solcon.nl>

All,

I am looking for some ERSI Rack mount ears to place some Cisco 4506's in 
special Telco cabinets. The cabinets are 1,5 inch wider than the normal 
19 inch cabinets.
Does Cisco have these rack ears ?

regards,
Rinse

From rick at woofpaws.com  Fri Jun 19 10:54:55 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Fri, 19 Jun 2009 07:54:55 -0700 (PDT)
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>


I'm not seeing anything jump out at me as different between the
Sup720(3BXL) and RSP.  What am I missing?

The potential deployment is core "glue" (router-reflector, redundancy)
between border and aggregation layers.  Other than BGP and OSPF, it's job
would be essentially to just move packets. uRPF and BGP blackholing would
be at the border, but I'd like to pull NetFlow data from the core.

Thanks,
Rick


From Ian.Mackinnon at lumison.net  Fri Jun 19 10:58:40 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Fri, 19 Jun 2009 15:58:40 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D94456E8@nbg01-exch-01.entlstaff.domain.lumison.net>

The biggie is 7600 only not 6500 :-(
As I am sure Gert will be along shortly to say.

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Rick Ernst
> Sent: 19 June 2009 15:55
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Sup720 vs RSP720 - Difference?
>
>
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?
>
> The potential deployment is core "glue" (router-reflector, redundancy)
> between border and aggregation layers.  Other than BGP and OSPF, it's
> job
> would be essentially to just move packets. uRPF and BGP blackholing
> would
> be at the border, but I'd like to pull NetFlow data from the core.
>
> Thanks,
> Rick
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From ivan.pepelnjak at zaplana.net  Fri Jun 19 11:00:26 2009
From: ivan.pepelnjak at zaplana.net (Ivan Pepelnjak)
Date: Fri, 19 Jun 2009 17:00:26 +0200
Subject: [c-nsp] the ospf 0*E2 route type can not be
	redistributedbetween two ospf process
In-Reply-To: <d6966e4b0906190535o595d07f9jfc7598a569165df5@mail.gmail.com>
References: <15453343.191691245387480644.JavaMail.coremail@bj163app61.163.com>
	<d6966e4b0906190535o595d07f9jfc7598a569165df5@mail.gmail.com>
Message-ID: <010501c9f0ee$ae6d2140$0a00000a@nil.si>

See also http://wiki.nil.com/OSPF_default_routes for more details.

Best regards
Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/ 

> -----Original Message-----
> From: Geoffrey Pendery [mailto:geoff at pendery.net] 
> Sent: Friday, June 19, 2009 2:36 PM
> To: ying-xiang
> Cc: cisco-nsp
> Subject: Re: [c-nsp] the ospf 0*E2 route type can not be 
> redistributedbetween two ospf process
> 
> Well if you're talking "default-information originate", then 
> the route in question is 0.0.0.0/0, default.  It's special - 
> you can't just tell an OSPF process to redistribute 
> 0.0.0.0/0.  If you want both processes to distribute default, 
> then they both need the "default-information originate" command.
> 
> 
> -Geoff
> 
> 
> On Thu, Jun 18, 2009 at 11:58 PM, 
> ying-xiang<ying-xiang at 163.com> wrote:
> >
> > hi,folk
> >
> > anyone knows the reason why i can not redistribute the O*E2 
> route which generated by one ospf router using 
> default-information originate command to another ospf process?
> > _______________________________________________
> > cisco-nsp mailing list ?cisco-nsp at puck.nether.net 
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> 
> 


From p.mayers at imperial.ac.uk  Fri Jun 19 11:06:10 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 19 Jun 2009 16:06:10 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <4A3BA962.2030105@imperial.ac.uk>

Rick Ernst wrote:
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?

The CPU is faster. It's 7600-only. I think it's got resilient EOBC (does 
the EOBC fail in the real world!?!) and there are probably some other 
things.

From Ian.Mackinnon at lumison.net  Fri Jun 19 10:58:40 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Fri, 19 Jun 2009 15:58:40 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D94456E8@nbg01-exch-01.entlstaff.domain.lumison.net>

The biggie is 7600 only not 6500 :-(
As I am sure Gert will be along shortly to say.

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Rick Ernst
> Sent: 19 June 2009 15:55
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Sup720 vs RSP720 - Difference?
>
>
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?
>
> The potential deployment is core "glue" (router-reflector, redundancy)
> between border and aggregation layers.  Other than BGP and OSPF, it's
> job
> would be essentially to just move packets. uRPF and BGP blackholing
> would
> be at the border, but I'd like to pull NetFlow data from the core.
>
> Thanks,
> Rick
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From p.mayers at imperial.ac.uk  Fri Jun 19 11:22:19 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 19 Jun 2009 16:22:19 +0100
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection
Message-ID: <4A3BAD2B.1060602@imperial.ac.uk>

All,

We've recently deployed config on our ACE (blades in 6500s) to provide 
resilient DNS.

However, the ACE seems to be doing some kind of DNS inspection, and is 
(incorrectly I think) closing the SLB session the instant a DNS answer 
comes back. This causes problems with clients that make 2 lookups very 
quickly, from the same source port.

i.e. I am seeing:

client sport=5000 dport=53 query id=2346 hostname A
client sport=5000 dport=53 query id=4646 hostname AAAA
server dport=5000 sport=53 reply id=2346 A=192.168.x.y

...and that's it. The 2nd reply is dropped. If the client makes the 
queries "slowly" they work fine:

client sport=5000 dport=53 query id=2346 hostname A
server dport=5000 sport=53 reply id=2346 A=192.168.x.y
client sport=5000 dport=53 query id=4646 hostname AAAA
server dport=5000 sport=53 reply id=4646 AAAA=...

Our old DNS servers (via static anycast routes) and a different service 
(via eBGP multipath anycast) don't exhibit the problem, so I'm certain 
it's the ACE.

FYI, this causes problems with the glibc changes present in 2.10 & 
Fedora 11 - the glibc always tries two queries in quick succession for A 
and AAAA records, and the timeouts can destroy kerberos/ldap logins...

I'm aware of the "inspect" commands, but they're off by default and I 
can't "no inspect"; it tells me it's already turned off.

Does anyone know if and how I can persuade the ACE to stop being so 
"clever" and just treat the DNS as "plain old UDP"?

version info is:

Software
   loader:    Version 12.2[120]
   system:    Version A2(1.1) [build 3.0(0)A2(1.1) 
adbuild_00:25:02-2008/06/05_/auto/adbu-rel3/rel_a2_1_1_throttle/REL_3_0_0_A2_1_1]
   system image file: [LCP] disk0:c6ace-t1k9-mz.A2_1_1.bin
   installed license: ACE-08G-LIC ACE-SEC-LIC-K9

...and the config we're using is:


serverfarm host RECURSIVE-DNS
   transparent
   predictor leastconns
   probe TCP_53
   rserver xxx 53
     inservice
   rserver yyy 53
     inservice
   rserver www 53
     inservice
   rserver zzz 53
     inservice

class-map match-any VIP_SPONCON-DNS
   2 match virtual-address 192.168.a.b udp eq domain
   3 match virtual-address 192.168.a.b tcp eq domain

policy-map type loadbalance first-match SLB_RECURSIVE-DNS
   class class-default
     serverfarm RECURSIVE-DNS

policy-map multi-match VIPS_VLANxx
   !.. various config, then
   class VIP_SPONCON-DNS
     loadbalance vip inservice
     loadbalance policy SLB_RECURSIVE-DNS
     loadbalance vip icmp-reply
     loadbalance vip advertise


From Thomas.Sillaber at nextiraone.de  Fri Jun 19 11:32:12 2009
From: Thomas.Sillaber at nextiraone.de (Thomas.Sillaber at nextiraone.de)
Date: Fri, 19 Jun 2009 17:32:12 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<B5F945E48C137C49A98BC86DD35939C012D94456E8@nbg01-exch-01.entlstaff.domain.lumison.net>
Message-ID: <D2A12B44A1003D45A7117D0BBB957A061449DCE1@BER05101.ebdmail.alcatel.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Rick,

here's a short overview about the diff:

-
------------------------------------------------------------------------
--
					Sup720		RSP720
MSFC					MSFC3			MSFC4!
DRAM					1G			up to 4G
(DDR2)!
NVRAM					2M			4M!
Bootflash				64M			512M!
PFC					PFCB /BXL		PFC3C
/CXL!
FIB/LFIB Entries			1M			1M
Cam Table Size			32k/64k		80k/96k!
IP Subscriber termination	not available	+32k
IP Forwarding			30Mpps		30Mpps
MPLS Forwarding			20Mpps		20Mpps
-
------------------------------------------------------------------------
--
PFC3CXL!

ACl Masks (Ipv4/Ipv6)			4k/2k 	(PFC3BXL = 4k/1k)
ACL Entries (IPv4/IPv6)			32k/16k	(PFC3BXL = 32k/8k)
Hash of VLAN ID in EtherChannel	yes 		(PFC3BXL = no)
-
------------------------------------------------------------------------
--

==> it's 76 Hw
==> Redundant EOBC is available with S Chassis

Brgds 

Thomas




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iQEVAwUBSjuveWZ0NRmWJ+KQAQJzdAgAnXO1uCowH8BxPCC8MPVDjfqOnIWjl2cS
d1rU2ORhBsct6ZSSIqWC9y4xnjELhhHfXaaMEyJPrTRUX383akhlzuJbyLnolzrw
U+iym8yDyLjlPwnlyGNzM2sGm5TDohlRRh/vtyljyootqLeIHNnb87cYbNUyyX0v
wg552oTLv/BBOv7LHyMYA8SMqs/IkwvveaEzxXSXuQ1JU3B3PG5VgJ8S8+kfatoM
Gd24Mz+8TdNiyieJ6Uy22CT/o2E+yDSj+qBDEnuIkbWG0C5RvHe1iDtFuKyb2mDZ
NU3ImFbyxJzS/0o+94KueTfPkLfDKvE7Z9Ao/i2oy5bcakC2O4QoeQ==
=kmct
-----END PGP SIGNATURE-----

From paul at paulstewart.org  Fri Jun 19 11:31:50 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Fri, 19 Jun 2009 11:31:50 -0400
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <000001c9f0f3$1defbe20$59cf3a60$@org>

I'm not sure about performance numbers but biggest thing I can see is
support for 4GB RAM - for us, this is becoming an issue with BGP tables
chewing up 60% of our memory today in 3BXL's.  I miss the PRP2 platform for
BGP now... thinking of moving back to GSR's in the near future on PRP3's

Paul


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Rick Ernst
Sent: Friday, June 19, 2009 10:55 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Sup720 vs RSP720 - Difference?


I'm not seeing anything jump out at me as different between the
Sup720(3BXL) and RSP.  What am I missing?

The potential deployment is core "glue" (router-reflector, redundancy)
between border and aggregation layers.  Other than BGP and OSPF, it's job
would be essentially to just move packets. uRPF and BGP blackholing would
be at the border, but I'd like to pull NetFlow data from the core.

Thanks,
Rick

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From Thomas.Sillaber at nextiraone.de  Fri Jun 19 11:35:57 2009
From: Thomas.Sillaber at nextiraone.de (Thomas.Sillaber at nextiraone.de)
Date: Fri, 19 Jun 2009 17:35:57 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <D2A12B44A1003D45A7117D0BBB957A061449DCE4@BER05101.ebdmail.alcatel.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Rick,

i forgot the cpu--

			SUP-720		RSP-720
CPU			600Mhz		1.3GHz

Brgds and have a great day


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iQEVAwUBSjuwXWZ0NRmWJ+KQAQI/2Qf/Vv9BANQJM7FF2O3If8m3T/trWrx7nSmR
A4uwexKG9QDHCO9uHkoSdz0w8ko261sdJKLDM5O7GbW7bqqdwuGmhN/nI/CiT8pE
DYt2L53L+DDBIXPdEmiKvL5HvrftAHKYxhqEraTy1hU896WOzvXdj41ZqtMbJH+l
5s9+iRJJdg3CCknkWHRFCIwARjLa2+bwwF+dz7SANsEH17+x1zcp9xAHM+HOYSXo
OayU07LPySo4+lVVgkicx/vIKGc/ucNy76RZhWlme8oTXqC/cY0SOP06QgqBnJk3
NLmtTALim2/QO9897PLyeJvM94TMMj6s1Mq8bXoYgrZ98Abv6MdLuA==
=AYCZ
-----END PGP SIGNATURE-----

From apiasecki at gmail.com  Fri Jun 19 11:42:31 2009
From: apiasecki at gmail.com (Adam Piasecki)
Date: Fri, 19 Jun 2009 11:42:31 -0400
Subject: [c-nsp] Long Uptime
In-Reply-To: <73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
Message-ID: <345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>

Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE
SOFTWARE
(fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Wed 28-Aug-02 10:25 by antonino
Image text-base: 0x80010000, data-base: 0x80528000

ROM: Bootstrap program is CALHOUN boot loader

switch02.kst.dc uptime is 6 years, 4 weeks, 4 days, 48 minutes
System returned to ROM by power-on
System restarted at 11:00:50 EST Tue May 20 2003
System image file is "flash:/c2950-i6q4l2-mz.121-11.EA1.bin"

My longest running switch.


On Fri, Jun 19, 2009 at 10:25 AM, Gustavo Rodrigues Ramos <
gustavo at nexthop.com.br> wrote:

> Is this suppose to be a good thing? (not patching your systems for
> almost 10 years?)...
>
> Gustavo.
>
>
> On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> > Not techy, just interesting anyone beat this uptime?
> >
> > Liverpool_St_A#sho ver
> > Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> > (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c)
> 1986-1996
> > by cisco Systems, Inc.
> > Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> > data-base: 0x00001000
> >
> > ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> > ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> > SOFTWARE (fc1)
> >
> > Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> > restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> > via flash
> >
> > cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of
> memory.
> > Processor board ID 04812778, with hardware revision 00000000 Bridging
> > software.
> > SuperLAT software copyright 1990 by Meridian Technology Corp).
> > X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> > TN3270 Emulation software (copyright 1994 by TGV Inc).
> > 1 Ethernet/IEEE 802.3 interface.
> > 2 Serial network interfaces.
> > 32K bytes of non-volatile configuration memory.
> > 8192K bytes of processor board System flash (Read ONLY)
> >
> > Configuration register is 0x2102
> >
> > Liverpool_St_A#
> >
> >
> > Thanks
> >
> > Nic
> >
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From nic at gblx.net  Fri Jun 19 11:52:54 2009
From: nic at gblx.net (Nic McCartney)
Date: Fri, 19 Jun 2009 16:52:54 +0100
Subject: [c-nsp] Long Uptime
In-Reply-To: <345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>	
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
	<345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>
Message-ID: <024301c9f0f6$02db7e50$08927af0$@net>

Come on guys, 529weeks = 10yrs nobody beat that ? J

 

Nic

 

From: Adam Piasecki [mailto:apiasecki at gmail.com] 
Sent: 19 June 2009 16:43
To: Gustavo Rodrigues Ramos
Cc: Nic McCartney; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Long Uptime

 

Cisco Internetwork Operating System Software

IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE
SOFTWARE
(fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Wed 28-Aug-02 10:25 by antonino
Image text-base: 0x80010000, data-base: 0x80528000

ROM: Bootstrap program is CALHOUN boot loader

switch02.kst.dc uptime is 6 years, 4 weeks, 4 days, 48 minutes
System returned to ROM by power-on
System restarted at 11:00:50 EST Tue May 20 2003
System image file is "flash:/c2950-i6q4l2-mz.121-

11.EA1.bin"

My longest running switch.

 

On Fri, Jun 19, 2009 at 10:25 AM, Gustavo Rodrigues Ramos
<gustavo at nexthop.com.br> wrote:

Is this suppose to be a good thing? (not patching your systems for
almost 10 years?)...

Gustavo.



On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> Not techy, just interesting anyone beat this uptime?
>
> Liverpool_St_A#sho ver
> Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c)
1986-1996
> by cisco Systems, Inc.
> Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> data-base: 0x00001000
>
> ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> SOFTWARE (fc1)
>
> Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> via flash
>
> cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of
memory.
> Processor board ID 04812778, with hardware revision 00000000 Bridging
> software.
> SuperLAT software copyright 1990 by Meridian Technology Corp).
> X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> TN3270 Emulation software (copyright 1994 by TGV Inc).
> 1 Ethernet/IEEE 802.3 interface.
> 2 Serial network interfaces.
> 32K bytes of non-volatile configuration memory.
> 8192K bytes of processor board System flash (Read ONLY)
>
> Configuration register is 0x2102
>
> Liverpool_St_A#
>
>
> Thanks
>
> Nic
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 


From ip at ioshints.info  Fri Jun 19 12:14:31 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Fri, 19 Jun 2009 18:14:31 +0200
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <20090618183433.GB13882@rtp-cse-489.cisco.com>
References: <1245283261.15106.46.camel@localhost.localdomain><1245345182.26970.13.camel@localhost.localdomain>
	<20090618183433.GB13882@rtp-cse-489.cisco.com>
Message-ID: <012401c9f0f9$081226a0$0a00000a@nil.si>

Just guessing: for PBR you need netflow-like TCAM entries, so the first
packet in the flow is always processor-switched and then the subsequent
packets can be hardware-switched. Does this make sense to the switching
gurus?

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/

> -----Original Message-----
> From: Rodney Dunn [mailto:rodunn at cisco.com] 
> Sent: Thursday, June 18, 2009 8:35 PM
> To: Peter Rathlev
> Cc: cisco-nsp
> Subject: Re: [c-nsp] Redirects / hair-pinning traffic vs. performance
> 
> Curious..I don't know that platform forwarding architecture.
> 
> But what does 'sh int stat' give you?
> 
> Also, sh ip traffic a couple times once you start the traffic.
> 
> 
> On Thu, Jun 18, 2009 at 07:13:02PM +0200, Peter Rathlev wrote:lso
> 
> > On Thu, 2009-06-18 at 00:01 +0000, Peter Rathlev wrote: 
> > > I have the need to introduce some PBR to solve a 
> hopefully temporary 
> > > problem. Some of the traffic being routed will leave the same 
> > > interface as it arrives on.
> > > 
> > > My worry is if this would have any performance impact the traffic 
> > > arrives on and leaves from the same interface. I could 
> imagine that 
> > > some forwarding implementations might penalize this scenario.
> > 
> > Follow up: We've tested this and it works fine. It seems to 
> have some 
> > CPU impact when the unit policy routes, but not much. When 
> pushing 100 
> > mbps traffic through the CPU rises to ~25-30% for a few 
> seconds (spent 
> > on interrupt switching) and then falls down ~5% again.
> > 
> > This might be PBR-specific and have nothing to do with the traffic 
> > arriving on and exiting the same interface though. We will be doing 
> > some more (production) testing soon, with more flows and more 
> > bandwidth. I can't see why the number of flows should 
> matter since the 
> > 3560 AFAIK just pushes packets, but I also can't see why 
> the start of 
> > a TCP session should matter. The "ip route-cache" hasn't 
> been disabled 
> > of course; I assume this would have a detrimental effect on 
> performance.
> > 
> > Regards,
> > Peter
> > 
> > 
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> 


From rick at woofpaws.com  Fri Jun 19 12:32:25 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Fri, 19 Jun 2009 09:32:25 -0700 (PDT)
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <000001c9f0f3$1defbe20$59cf3a60$@org>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
Message-ID: <44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>


Thanks to everyone for the feedback so far.

For my situation, the two biggest items that stand out are:
 - 4GB vs 1GB RAM
 - 7600 chassis only, not 6500 (planning on a 7600 chassis, though)

I'm a bit surprised that you are seeing ~60%  memory used by BGP. My
border routers (4 routers, 1 full feed each) and core (route-reflectors)
are both only showing about 25% memory used, total.

Since the Sup720 (spec-wise, at least) capacity is roughly 2 orders of
magnitude higher than I'm currently pushing through the core, it looks
like it should serve for several years.  The RSP720 becomes an upgrade
option if 1GB is no longer big enough for full tables (plus IPv6
roll-out?).

On the subject of memory and DFCs... do the DFCs also support 4GB for the
FIB, or is this an apples vs oranges comparison?

Thanks,


On Fri, June 19, 2009 08:31, Paul Stewart wrote:
> I'm not sure about performance numbers but biggest thing I can see is
> support for 4GB RAM - for us, this is becoming an issue with BGP tables
> chewing up 60% of our memory today in 3BXL's.  I miss the PRP2 platform
> for
> BGP now... thinking of moving back to GSR's in the near future on PRP3's
>
> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Rick Ernst
> Sent: Friday, June 19, 2009 10:55 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Sup720 vs RSP720 - Difference?
>
>
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?
>
> The potential deployment is core "glue" (router-reflector, redundancy)
> between border and aggregation layers.  Other than BGP and OSPF, it's job
> would be essentially to just move packets. uRPF and BGP blackholing would
> be at the border, but I'd like to pull NetFlow data from the core.
>
> Thanks,
> Rick
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>


From p.mayers at imperial.ac.uk  Fri Jun 19 12:43:57 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 19 Jun 2009 17:43:57 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
Message-ID: <4A3BC04D.3090008@imperial.ac.uk>

Rick Ernst wrote:
> Thanks to everyone for the feedback so far.
> 
> For my situation, the two biggest items that stand out are:
>  - 4GB vs 1GB RAM
>  - 7600 chassis only, not 6500 (planning on a 7600 chassis, though)
> 
> I'm a bit surprised that you are seeing ~60%  memory used by BGP. My
> border routers (4 routers, 1 full feed each) and core (route-reflectors)
> are both only showing about 25% memory used, total.

I guess the poster is taking more than one full feed (see below) which 
consumes more ram.

> 
> Since the Sup720 (spec-wise, at least) capacity is roughly 2 orders of
> magnitude higher than I'm currently pushing through the core, it looks

By "spec-wise" I assume you mean forwarding rates? The 6500/7600 
platforms are indeed very fast.

> like it should serve for several years.  The RSP720 becomes an upgrade
> option if 1GB is no longer big enough for full tables (plus IPv6
> roll-out?).
> 
> On the subject of memory and DFCs... do the DFCs also support 4GB for the
> FIB, or is this an apples vs oranges comparison?

It doesn't work that way. FIB is held in TCAM, not RAM.

PFC/DFCs some in two forms - XL and non-XL.

XL can hold ~1M FIB entries, with some commands to divide this up 
between v4, v6 and so on. Notably, this is more than sufficient to hold 
a full table.

non-XL can hold 256k entries, which is not sufficient for a full table.

So, for full-table applications, ensure you get a sup with XL PFC and 
that *all* your linecards have XL DFCs.

Also be aware, as discussed recently - holding >1 full feed on a 
6500/7600 does not consume more FIB entries - it just uses sup RAM, 
since only one FIB entry is installed per prefix.

I see in your original post you mentioned netflow - you will probably 
want to have a look through the archives for the (many, long) threads 
where people document their problems with netflow on this platform. 
Specifically, like the FIB, the DFCs have limited TCAM slots for netflow 
entries (256k/1M on non-XL/XL) and you can over-run this TCAM if you 
have a lot of traffic.

If the netflow is important to you, and you're likely to have >1M flows 
at any given time, you might want to consider alternatives.

From ayourtch at cisco.com  Fri Jun 19 12:52:09 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Fri, 19 Jun 2009 18:52:09 +0200 (CEST)
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <m3y6ro7h07.fsf@ursa.amorsen.dk>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
	<007e01c9f087$45aebae0$d10c30a0$@org> <m3y6ro7h07.fsf@ursa.amorsen.dk>
Message-ID: <Pine.LNX.4.64.0906191509390.8007@zippy.stdio.be>



On Fri, 19 Jun 2009, Benny Amorsen wrote:

> "Paul Stewart" <paul at paulstewart.org> writes:
>
>> On a related note to the PS below... we have tested lt2tpv3 on a few
>> different boxes running various IOS images and on each of the devices we did
>> test we seen the same behavior.  This means something is either broke in the
>> code in my opinion or that we are doing something wrong.  Typically that
>> means the second option in our case (lol) but I did get a fair amount of
>> feedback offline from folks with similar problems....;)
>
> Generally problems with PMTU are caused by people blocking ICMP in their

Somehow yesterday I correlated the original "UDP not working" comment to 
the "replies off list" and was thinking that we don't fragment the 
UDP correctly - since I assumed the PMTUD blackholing problem to be 
reasonably well known. Sorry, my bad.

> (usually PIX/ASA) firewalls. If you control the whole path, you can make
> sure that you're not one of the culprits.
>
> On the other hand, if you're trying to reach the Internet through
> tunnels with non-1500-byte MTU, you'll just have to accept that it won't
> work. You can MSS adjust for TCP traffic though or you can lower your
> interface or route MTU as workarounds. The only real fix is either
> PIX/ASA administrators getting a clue, or Cisco getting a clue. Not
> particularly likely.

Given the existence of http://www.kb.cert.org/vuls/id/222750, it's 
impossible to claim a simple and single answer for all, IMHO. I wish I 
could just say "fix your systems and don't bother to block the type 3 
code 4", and the things would magically work. But there're always 
"more urgent things that need to be done yesterday" - so we are where we 
are.

OTOH, to create a blackhole, you don't need a firewall or a firewall 
administrator, for that reason - "no ip unreachables" does this job pretty 
well too.

>
>
> /Benny
>
> (Yes, I'm bitter.)
>

Have a good weekend.

cheers,
andrew

From paul at paulstewart.org  Fri Jun 19 12:55:17 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Fri, 19 Jun 2009 12:55:17 -0400
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
Message-ID: <000a01c9f0fe$c5fad7c0$51f08740$@org>

Hey there...

Between the two 7206's in question, we have about 280 BGP peers configured
split about 60/40 between them.... ;)

Paul


-----Original Message-----
From: Rick Ernst [mailto:rick at woofpaws.com] 
Sent: Friday, June 19, 2009 12:32 PM
To: Paul Stewart
Cc: cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] Sup720 vs RSP720 - Difference?


Thanks to everyone for the feedback so far.

For my situation, the two biggest items that stand out are:
 - 4GB vs 1GB RAM
 - 7600 chassis only, not 6500 (planning on a 7600 chassis, though)

I'm a bit surprised that you are seeing ~60%  memory used by BGP. My
border routers (4 routers, 1 full feed each) and core (route-reflectors)
are both only showing about 25% memory used, total.

Since the Sup720 (spec-wise, at least) capacity is roughly 2 orders of
magnitude higher than I'm currently pushing through the core, it looks
like it should serve for several years.  The RSP720 becomes an upgrade
option if 1GB is no longer big enough for full tables (plus IPv6
roll-out?).

On the subject of memory and DFCs... do the DFCs also support 4GB for the
FIB, or is this an apples vs oranges comparison?

Thanks,


On Fri, June 19, 2009 08:31, Paul Stewart wrote:
> I'm not sure about performance numbers but biggest thing I can see is
> support for 4GB RAM - for us, this is becoming an issue with BGP tables
> chewing up 60% of our memory today in 3BXL's.  I miss the PRP2 platform
> for
> BGP now... thinking of moving back to GSR's in the near future on PRP3's
>
> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Rick Ernst
> Sent: Friday, June 19, 2009 10:55 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Sup720 vs RSP720 - Difference?
>
>
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?
>
> The potential deployment is core "glue" (router-reflector, redundancy)
> between border and aggregation layers.  Other than BGP and OSPF, it's job
> would be essentially to just move packets. uRPF and BGP blackholing would
> be at the border, but I'd like to pull NetFlow data from the core.
>
> Thanks,
> Rick
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From gert at greenie.muc.de  Fri Jun 19 13:27:47 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 19:27:47 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <20090619172747.GX290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 07:54:55AM -0700, Rick Ernst wrote:
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?

RSP has faster CPU and you are stuck to the bad guys BU.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/306fd935/attachment.bin>

From gert at greenie.muc.de  Fri Jun 19 13:29:30 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 19:29:30 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <D2A12B44A1003D45A7117D0BBB957A061449DCE1@BER05101.ebdmail.alcatel.de>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<B5F945E48C137C49A98BC86DD35939C012D94456E8@nbg01-exch-01.entlstaff.domain.lumison.net>
	<D2A12B44A1003D45A7117D0BBB957A061449DCE1@BER05101.ebdmail.alcatel.de>
Message-ID: <20090619172930.GY290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 05:32:12PM +0200, Thomas.Sillaber at nextiraone.de wrote:
> here's a short overview about the diff:
> -
> ------------------------------------------------------------------------
> --
> 					Sup720		RSP720
> MSFC					MSFC3			MSFC4!
> DRAM					1G			up to 4G
> (DDR2)!
> NVRAM					2M			4M!
> Bootflash				64M			512M!
> PFC					PFCB /BXL		PFC3C
> /CXL!

One should point out that there is also the Sup720-10G/3CXL (or however
it's called correctly in Cisco lingua).  PFC3C/3C-XL with the bigger
MAC table, and 2x 10G + 3x 1G onboard.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/2d22c72a/attachment.bin>

From gert at greenie.muc.de  Fri Jun 19 13:30:40 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 19:30:40 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
Message-ID: <20090619173040.GZ290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 09:32:25AM -0700, Rick Ernst wrote:
> On the subject of memory and DFCs... do the DFCs also support 4GB for the
> FIB, or is this an apples vs oranges comparison?

The DFC is the same, and its FIB memory is limited by TCAM (1 million
entries on the -XL) not by DRAM.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/29fdc10d/attachment-0001.bin>

From gert at greenie.muc.de  Fri Jun 19 13:35:03 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 19:35:03 +0200
Subject: [c-nsp] Long Uptime
In-Reply-To: <024301c9f0f6$02db7e50$08927af0$@net>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
	<345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>
	<024301c9f0f6$02db7e50$08927af0$@net>
Message-ID: <20090619173503.GA290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 04:52:54PM +0100, Nic McCartney wrote:
> Come on guys, 529weeks = 10yrs nobody beat that ? J

Best I have is 

win-gw uptime is 9 years, 37 weeks, 4 days, 5 hours, 26 minutes
System restarted by power-on at 11:32:23 UTC Sat Oct 2 1999
System image file is "flash:c2500-is-l.112-15a.bin.Z", booted via flash

... but that's, well, "not 10 years yet".

OTOH this box was doing production traffic until about two weeks ago
(and is now retired due to "only 10 Mbit/s ethernet and no IPv6").

11.0, wow :-)

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/4679839c/attachment.bin>

From rick at woofpaws.com  Fri Jun 19 13:55:11 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Fri, 19 Jun 2009 10:55:11 -0700 (PDT)
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <20090619173040.GZ290@greenie.muc.de>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
	<20090619173040.GZ290@greenie.muc.de>
Message-ID: <51675.69.30.17.85.1245434111.squirrel@www.woofpaws.com>

Thanks for all the great feedback and information, folks!

So, the Sup720/RSP720 uses DRAM to store RIB + other stuff, and the FIB is
in TCAM either on the Sup (if no DFC), or on the DFC?

It looks like the extra memory on the RSP720 vs Sup720 would be good for
multiple feeds, but the TCAM (potentially divided between IPv4 and IPv6)
is limited to 1 million entries (2 entries per IPv6) regardless of
platform?

IIRC TCAM is also used for ACLs and, as somebody else mentioned, also for
Netflow?  Is there a different set of TCAM between FIB, ACLs, and NetFlow,
or does everything combined have to fit into the same 1M entries?


On Fri, June 19, 2009 10:30, Gert Doering wrote:
> Hi,
>
> On Fri, Jun 19, 2009 at 09:32:25AM -0700, Rick Ernst wrote:
>> On the subject of memory and DFCs... do the DFCs also support 4GB for
>> the
>> FIB, or is this an apples vs oranges comparison?
>
> The DFC is the same, and its FIB memory is limited by TCAM (1 million
> entries on the -XL) not by DRAM.
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                            //www.muc.de/~gert/
> Gert Doering - Munich, Germany
> gert at greenie.muc.de
> fax: +49-89-35655025
> gert at net.informatik.tu-muenchen.de
>


From gert at greenie.muc.de  Fri Jun 19 14:00:19 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 20:00:19 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <51675.69.30.17.85.1245434111.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
	<20090619173040.GZ290@greenie.muc.de>
	<51675.69.30.17.85.1245434111.squirrel@www.woofpaws.com>
Message-ID: <20090619180019.GB290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 10:55:11AM -0700, Rick Ernst wrote:
> So, the Sup720/RSP720 uses DRAM to store RIB + other stuff, and the FIB is
> in TCAM either on the Sup (if no DFC), or on the DFC?

Correct.

> It looks like the extra memory on the RSP720 vs Sup720 would be good for
> multiple feeds, but the TCAM (potentially divided between IPv4 and IPv6)
> is limited to 1 million entries (2 entries per IPv6) regardless of
> platform?

Correct.  (256k entries if non-XL TCAM is used).

> IIRC TCAM is also used for ACLs and, as somebody else mentioned, also for
> Netflow?  Is there a different set of TCAM between FIB, ACLs, and NetFlow,
> or does everything combined have to fit into the same 1M entries?

ACL and Netflow stuff goes "somewhere else" in the TCAM.  The 1M entries
are "just FIB" (IPv4, IPv6, MPLS, multicast).

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/f365fe41/attachment.bin>

From gert at greenie.muc.de  Fri Jun 19 14:23:14 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 20:23:14 +0200
Subject: [c-nsp] Thanks (Re:  Sup720 vs RSP720 - Difference?)
In-Reply-To: <51268.69.30.17.85.1245435043.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
	<20090619173040.GZ290@greenie.muc.de>
	<51675.69.30.17.85.1245434111.squirrel@www.woofpaws.com>
	<20090619180019.GB290@greenie.muc.de>
	<51268.69.30.17.85.1245435043.squirrel@www.woofpaws.com>
Message-ID: <20090619182314.GC290@greenie.muc.de>

Hi,

(I'm copying back my response to c-nsp, because it ended up longer than
intended, and it might be useful to have in the archives)

On Fri, Jun 19, 2009 at 11:10:43AM -0700, Rick Ernst wrote:
> Thanks for the tremendous help you've given on the Sup/RSP question.
> I've been wading through white-papers, spec-sheets, Google, CCO, etc.
> trying to get my brain wrapped around what's going on, and none of it has
> been as useful as the information you've provided.
> 
> As a note, I'm going from all software routing (7206VXR/G1, 7507/RSP16) to
> 7600 series, so my brain is not yet calibrated for proper understanding
> and knowing which questions to ask. :)

There's a tremendous wealth of information in the archives of cisco-nsp,
as "us others" have had the same startup confusion as well.

There are a few important things to keep in mind:

 - if a "software router" is unhappy with something, it will get "somewhat
   slower" because it's going to be executed in a slower software forwarding
   path - but in the end, it's all "software".

 - if a (Cisco) "hardware router" is unhappy with a combination of features 
   you enable, the performance will go down *drastically*, because the
   hardware is extremely fast and the CPU on these boxes is fairly weak
   (the Sup720 is slower than a NPE-G1).  So check the set of desired
   features first - some are just not very suitable for fast-but-dumb
   devices.  NAT is one of the border cases, reflexive ACLs are tricky,
   and one of the worst thing is "tunnels with fragmentation".

   Most of this is documented, though.

 - the 6500/7600 series is "a big switch with extra brains".  This means
   that it will be less flexible in some cases than a "real router" - the
   most notable thing is the global VLAN space.  This means that if you
   have "dot1q vlan 2" on one interface, and "dot1q vlan 2" on another
   interface, it will be the *same* vlan 2.  On a "router", it's two 
   different dot1q subinterfaces, while on the switch, it's "two trunk 
   ports that carry the same VLAN (2)".

   The positive side of this is that you can play much nicer tricks with
   ether-channel aggregation than with "routers" - like the GSR that still
   can't do all possible features on an ether-channel (for the longest time,
   no IPv6 support at all on ether-channels...).

   This is really the most important thing to keep in mind: the 
   architecture is much closer to a switch than to a "classic" router, 
   and this has upsides and downsides.


 - there are the SIP and ES cards that plug into the 6500/7600, and 
   effectively bring their own brains - read: different bugs, different
   features, and different behaviour regarding VLAN space and such.

 - if something you want is not shipping today, don't believe any of the
   promises they are going to make.  Especially regarding combinations of
   line cards, chassis types, and supervisor boards - customers have been
   badly burnt by Cisco internal fights here.  Make them sign that this
   is going to work or else they will be taking back the boxes.


gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/51570910/attachment.bin>

From vijay.ramcharan at verizonbusiness.com  Fri Jun 19 13:52:57 2009
From: vijay.ramcharan at verizonbusiness.com (Ramcharan, Vijay A)
Date: Fri, 19 Jun 2009 17:52:57 +0000
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection
In-Reply-To: <4A3BAD2B.1060602@imperial.ac.uk>
References: <4A3BAD2B.1060602@imperial.ac.uk>
Message-ID: <8171C8272CE8FE4A8F5BFF8A97CE6AB3DD35A6@ASHEVS006.mcilink.com>

Not sure if these are applicable but may be worth looking into. Just a
shot in the dark as I don't have ACEs to test with and I have not run
into this particular problem myself. 

I think each feature is mutually exclusive. 
UDP booster (high connection rates for UDP) and UDP fast-age (UDP
per-packet load balancing) 

http://cco.cisco.com/en/US/docs/app_ntwk_services/data_center_app_servic
es/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1157547
http://cco.cisco.com/en/US/docs/app_ntwk_services/data_center_app_servic
es/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1281598

 
Vijay Ramcharan  
  
-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Phil Mayers
Sent: June 19, 2009 11:22
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection

All,

We've recently deployed config on our ACE (blades in 6500s) to provide 
resilient DNS.

However, the ACE seems to be doing some kind of DNS inspection, and is 
(incorrectly I think) closing the SLB session the instant a DNS answer 
comes back. This causes problems with clients that make 2 lookups very 
quickly, from the same source port.

i.e. I am seeing:

client sport=5000 dport=53 query id=2346 hostname A
client sport=5000 dport=53 query id=4646 hostname AAAA
server dport=5000 sport=53 reply id=2346 A=192.168.x.y

...and that's it. The 2nd reply is dropped. If the client makes the 
queries "slowly" they work fine:

client sport=5000 dport=53 query id=2346 hostname A
server dport=5000 sport=53 reply id=2346 A=192.168.x.y
client sport=5000 dport=53 query id=4646 hostname AAAA
server dport=5000 sport=53 reply id=4646 AAAA=...

Our old DNS servers (via static anycast routes) and a different service 
(via eBGP multipath anycast) don't exhibit the problem, so I'm certain 
it's the ACE.

FYI, this causes problems with the glibc changes present in 2.10 & 
Fedora 11 - the glibc always tries two queries in quick succession for A

and AAAA records, and the timeouts can destroy kerberos/ldap logins...

I'm aware of the "inspect" commands, but they're off by default and I 
can't "no inspect"; it tells me it's already turned off.

Does anyone know if and how I can persuade the ACE to stop being so 
"clever" and just treat the DNS as "plain old UDP"?

version info is:

Software
   loader:    Version 12.2[120]
   system:    Version A2(1.1) [build 3.0(0)A2(1.1) 
adbuild_00:25:02-2008/06/05_/auto/adbu-rel3/rel_a2_1_1_throttle/REL_3_0_
0_A2_1_1]
   system image file: [LCP] disk0:c6ace-t1k9-mz.A2_1_1.bin
   installed license: ACE-08G-LIC ACE-SEC-LIC-K9

...and the config we're using is:


serverfarm host RECURSIVE-DNS
   transparent
   predictor leastconns
   probe TCP_53
   rserver xxx 53
     inservice
   rserver yyy 53
     inservice
   rserver www 53
     inservice
   rserver zzz 53
     inservice

class-map match-any VIP_SPONCON-DNS
   2 match virtual-address 192.168.a.b udp eq domain
   3 match virtual-address 192.168.a.b tcp eq domain

policy-map type loadbalance first-match SLB_RECURSIVE-DNS
   class class-default
     serverfarm RECURSIVE-DNS

policy-map multi-match VIPS_VLANxx
   !.. various config, then
   class VIP_SPONCON-DNS
     loadbalance vip inservice
     loadbalance policy SLB_RECURSIVE-DNS
     loadbalance vip icmp-reply
     loadbalance vip advertise

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

______________________________________________________________________
This e-mail has been scanned by Verizon Managed Email Content Service,
using Skeptic(tm) technology powered by MessageLabs. For more
information on Verizon Managed Email Content Service, visit
http://www.verizonbusiness.com.
______________________________________________________________________

From sthaug at nethelp.no  Fri Jun 19 14:28:36 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Fri, 19 Jun 2009 20:28:36 +0200 (CEST)
Subject: [c-nsp] Long Uptime
In-Reply-To: <20090619173503.GA290@greenie.muc.de>
References: <345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>
	<024301c9f0f6$02db7e50$08927af0$@net>
	<20090619173503.GA290@greenie.muc.de>
Message-ID: <20090619.202836.41666142.sthaug@nethelp.no>

> OTOH this box was doing production traffic until about two weeks ago
> (and is now retired due to "only 10 Mbit/s ethernet and no IPv6").
> 
> 11.0, wow :-)

Some of us have not-so-fond memories of 8.2 - before it was called 
IOS :-)

(Also, before CIDR, before command completion and lots of other good
stuff...)

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From gtb at slac.stanford.edu  Fri Jun 19 15:26:38 2009
From: gtb at slac.stanford.edu (Buhrmaster, Gary)
Date: Fri, 19 Jun 2009 12:26:38 -0700
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <D2A12B44A1003D45A7117D0BBB957A061449DCE4@BER05101.ebdmail.alcatel.de>
References: <D2A12B44A1003D45A7117D0BBB957A061449DCE4@BER05101.ebdmail.alcatel.de>
Message-ID: <D0D0330CBD07114D85B70B784E80C2F202CE34AF@exch-mail2.win.slac.stanford.edu>

> 			SUP-720		RSP-720
> CPU			600Mhz		1.3GHz

  CPU Arch        MIPS based        PPC based
                  SR71000           8548

(comparing cpu "effectiveness" between the two
architecture implementations is a more complex
evaluation than the frequency differences alone.)

From george at mang.gr  Fri Jun 19 15:27:36 2009
From: george at mang.gr (Giorgos Manousakis)
Date: Fri, 19 Jun 2009 22:27:36 +0300
Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
Message-ID: <20090619192738.50C492FF06@geomanous.awmn>

Dear All,

i am trying to apply QoS on my aDsl interface (2048/256) and i need to give
strict priority to voice traffic, including skype and g711.

I suppose that i can match the g711 by using nbar rtp audio protocol or by
using source ports that are know on my asterisk server.

Because of randomness of skype protocol that kind of handling does not
apply. 
I found that skype is included in nbar but only after 12.4 version. 
Unfortunately i cannot upgrade the ios of my 837 cause of lack of DRAM,
which is not upgradable. 
So i tried to find a pdlm addon for skype, but it is not available for stand
alone download (http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm).

Can i found anywhere a skype.pdlm file? Is there any other way that i can
match this traffic? Could i try rtp audio for that one too?

Thanks 


From mhuff at ox.com  Fri Jun 19 15:57:36 2009
From: mhuff at ox.com (Matthew Huff)
Date: Fri, 19 Jun 2009 15:57:36 -0400
Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
In-Reply-To: <20090619192738.50C492FF06@geomanous.awmn>
References: <20090619192738.50C492FF06@geomanous.awmn>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C1434E@PUR-EXCH07.ox.com>

Even with the newest Skype nbar pdlm or built-in nbar in 12.4T(x), it is
pretty useless. The majority of Skype traffic is sent now encrypted over
port 443. The only way I know to monitor/block it is with something like
bluecoat/websense, and then only at the point of origin (since you have to
proxy the ssl traffic at the source). I'd be happy to be proved wrong, but I
believe, at least for now, that Skype has won the war. 

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Giorgos Manousakis
> Sent: Friday, June 19, 2009 3:28 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
> 
> Dear All,
> 
> i am trying to apply QoS on my aDsl interface (2048/256) and i need to
> give
> strict priority to voice traffic, including skype and g711.
> 
> I suppose that i can match the g711 by using nbar rtp audio protocol or
> by
> using source ports that are know on my asterisk server.
> 
> Because of randomness of skype protocol that kind of handling does not
> apply.
> I found that skype is included in nbar but only after 12.4 version.
> Unfortunately i cannot upgrade the ios of my 837 cause of lack of DRAM,
> which is not upgradable.
> So i tried to find a pdlm addon for skype, but it is not available for
> stand
> alone download (http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm).
> 
> Can i found anywhere a skype.pdlm file? Is there any other way that i
> can
> match this traffic? Could i try rtp audio for that one too?
> 
> Thanks
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/711ce0a2/attachment.bin>

From dudepron at gmail.com  Fri Jun 19 19:46:41 2009
From: dudepron at gmail.com (Aaron)
Date: Fri, 19 Jun 2009 19:46:41 -0400
Subject: [c-nsp] Long Uptime
In-Reply-To: <73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
Message-ID: <480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>

If it is an OOB system and it works why not?

Aaron

On Fri, Jun 19, 2009 at 10:25, Gustavo Rodrigues Ramos <
gustavo at nexthop.com.br> wrote:

> Is this suppose to be a good thing? (not patching your systems for
> almost 10 years?)...
>
> Gustavo.
>
>
> On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> > Not techy, just interesting anyone beat this uptime?
> >
> > Liverpool_St_A#sho ver
> > Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> > (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c)
> 1986-1996
> > by cisco Systems, Inc.
> > Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> > data-base: 0x00001000
> >
> > ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> > ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> > SOFTWARE (fc1)
> >
> > Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> > restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> > via flash
> >
> > cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of
> memory.
> > Processor board ID 04812778, with hardware revision 00000000 Bridging
> > software.
> > SuperLAT software copyright 1990 by Meridian Technology Corp).
> > X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> > TN3270 Emulation software (copyright 1994 by TGV Inc).
> > 1 Ethernet/IEEE 802.3 interface.
> > 2 Serial network interfaces.
> > 32K bytes of non-volatile configuration memory.
> > 8192K bytes of processor board System flash (Read ONLY)
> >
> > Configuration register is 0x2102
> >
> > Liverpool_St_A#
> >
> >
> > Thanks
> >
> > Nic
> >
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From ml at kenweb.org  Fri Jun 19 20:18:39 2009
From: ml at kenweb.org (ML)
Date: Fri, 19 Jun 2009 20:18:39 -0400
Subject: [c-nsp] Incorrect netflow data from 7600/6500?
In-Reply-To: <1245420481.6873.2.camel@localhost.localdomain>
References: <mailman.874.1245381356.2287.cisco-nsp@puck.nether.net>	<4A3B8DB1.6000009@switch.ch>
	<1245420481.6873.2.camel@localhost.localdomain>
Message-ID: <4A3C2ADF.10304@kenweb.org>

Peter Rathlev wrote:
> On Fri, 2009-06-19 at 15:08 +0200, Peter Haag wrote:
>>> I've seen this result from multiple other Netflow tools: ntop, Orion
>>> NetFlow and now nfdump.  The only common element is my hardware.
>>> I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both
>>> running 12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.
>>>
>>> I think I can make the assumption there isn't a protocol in use that
>>> trumps both UDP and TCP traffic combined.  Have I run into an IOS
>>> bug or did I misconfigure?
>> No - port 0 result from fragmented packets Most likely UDP packets >
>> MTU size. Since the IP ID field is not tracked in a v5 Netflow record,
>> the router can not map a fragmented packet to the appropriate flow,
>> and simply creates a flow with port '0'
> 
> Well, that would be for _port_ 0 traffic, with either TCP or UDP in the
> protocol field, wouldn't it? OPs traffic is "protocol 0", so IMHO Scotts
> point about flow mask is the best bet.
> 
> Regards,
> Peter


To provide closure to the question Scott's suggestion does work but not 
when the router is doing NAT.





From ayourtch at gmail.com  Fri Jun 19 21:09:11 2009
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Sat, 20 Jun 2009 03:09:11 +0200
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <m3y6ro7h07.fsf@ursa.amorsen.dk>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
	<007e01c9f087$45aebae0$d10c30a0$@org> <m3y6ro7h07.fsf@ursa.amorsen.dk>
Message-ID: <530c5af60906191809l3306da98ja6bb3f37b308fc3c@mail.gmail.com>

On Fri, Jun 19, 2009 at 10:41 AM, Benny Amorsen<benny+usenet at amorsen.dk> wrote:
> "Paul Stewart" <paul at paulstewart.org> writes:

> Generally problems with PMTU are caused by people blocking ICMP in their
> (usually PIX/ASA) firewalls. If you control the whole path, you can make
> sure that you're not one of the culprits.

For the topic of PMTUD blackhole, today evening I wrote up a little bit here:
http://supportwiki.cisco.com/wiki/index.php/PMTUD_blackhole

The aim was to get something that would not only be a collection of
links to the multipage documents, but would also give a quick summary
for the PMTUD. - and also try to view it from both the "network guy"
and "security guy" point of view - and to hopefully get the two to
talk as opposed to fight on who is "right".

Whether I achieved that - you judge. so, any comments, constructive
flames, etc. are very welcome. As it's wiki, it's obviously editable
as well.

cheers,
andrew

From cchurc05 at harris.com  Fri Jun 19 21:22:15 2009
From: cchurc05 at harris.com (Church, Charles)
Date: Fri, 19 Jun 2009 20:22:15 -0500
Subject: [c-nsp] Shaping and dialer ints 12.4(24)T vs. 15T8
Message-ID: <FA1BA229357DB640B944218F3585FECA02647AE6@mspe2k1.cs.myharris.net>

Can anyone confirm for me if some shaping and/or NBAR bugs were fixed
between 24T and older 15T7 or T8?  Platform is 870, interface is
Ethernet doing PPPoE to upstream DSL modem.  Under 15T, a policy applied
to the physical Ethernet int that looked like this:

class-map match-any Hi-Priority
 match protocol rtp
 match protocol sip
 match protocol ssh
!
policy-map Shape-Out
 class Hi-Priority
    priority 200
 class class-default
    shape average 2048000

Didn't seem to have any effect on locally-originated traffic (no matches
on SSH), nor did the shaping on class default seem to work.  End result
was traffic was sent without shaping, SSH wasn't prioritized, and remote
access to router sucked!  I figured it was just the way it worked,
figured you had to apply something to the dialer int.  But can't do GTS
on that int.  Figured I'd trying a later IOS, tried 24T, and it seems to
work fine.  Matching SSH, and the class default counters seem fine now.
Nothing appears to be needed on the dialer int after all.  Just
wondering if that's indeed the cause.

Thanks,

Chuck

From dale.shaw+cisco-nsp at gmail.com  Fri Jun 19 21:52:37 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Sat, 20 Jun 2009 11:52:37 +1000
Subject: [c-nsp] Shaping and dialer ints 12.4(24)T vs. 15T8
In-Reply-To: <FA1BA229357DB640B944218F3585FECA02647AE6@mspe2k1.cs.myharris.net>
References: <FA1BA229357DB640B944218F3585FECA02647AE6@mspe2k1.cs.myharris.net>
Message-ID: <3329cbb40906191852n6056bdd3wa012c2a6a9bf4b9e@mail.gmail.com>

Hi Charles,

On Sat, Jun 20, 2009 at 11:22 AM, Church, Charles<cchurc05 at harris.com> wrote:
> Can anyone confirm for me if some shaping and/or NBAR bugs were fixed
> between 24T and older 15T7 or T8?

Hmm, it doesn't directly match your scenario, but there were some new
QoS features introduced in 12.4(20)T -- most notably "Hierarchical
Queuing Framework (HQF)" -- that may have had an effect on your
configuration.

http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/qos_frhqf_support.html
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6558/white_paper_c11-481499.html

I have a similar configuration to yours on my home router, but I use a
top-level shaper to introduce backpressure. Partial config follows:

policy-map aardvark-queue
 class voice-sip
  bandwidth 20
 class voice-packet
  priority 96
 class class-default
  fair-queue
  random-detect
!
policy-map aardvark-shape
 class class-default
  shape average 1177000 11770 0
  service-policy aardvark-queue
!
interface FastEthernet0/1
 pppoe enable group global
 pppoe-client dial-pool-number 1
 service-policy output aardvark-shape
!
interface Dialer1
 bandwidth 1000
 bandwidth receive 12000
 ip address negotiated
 ip mtu 1492
 dialer pool 1
 dialer idle-timeout 0
 dialer persistent
 dialer-group 1

NB: I am running 12.4(15)T9.

cheers,
Dale

From alex at digriz.org.uk  Sat Jun 20 08:50:43 2009
From: alex at digriz.org.uk (Alexander Clouter)
Date: Sat, 20 Jun 2009 13:50:43 +0100
Subject: [c-nsp] ipv4 link-local for eigrp
Message-ID: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>

Hi,

After an organisational switch refresh last year we have been 
fortunately enough to end up with surrounded by nothing but 3750 stacks 
(c3750-ipbasek9-mz.122-50.SE1.bin) at the edge of the network; the core 
is made up by a pair of 6509's (s72033-ipservicesk9-mz.122-33.SXI.bin).  
As we were overhauling the network we decided to have some fun and 
rollout L3 to the edge to obliterate spanning-tree where-ever we can.  
As Cisco boxen are a pain and don't let you have true 'hybrid' L2+L3 
links (we still have some L2 action at the edge) and assign IP addresses 
to trunk links we use 'native' VLAN's to route the L3 stuff through the 
link.

This all works great and we are happy with it, however now things are 
working, I hoping to now have a 'lessons learned' fixup of the bits that 
niggle at me.  This ties in with the IPv6 rollout we are doing over the 
next few months and I thought it's worth fixing up the IPv4 stuff at the 
same time.

The biggest issue is all the rfc1918 usage used in the /30 used to force 
the L3 routes out to the edge of the network which make traceroutes 
ugly.  I really do not want to put aside publicly routable addresses 
that are just used to pass EIGRP data around, as that would involve 
soaking up over 50 /30's, a bit of a waste.

So what to use, I am pretty keen to use link-local IPv4 addresses 
(169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
point-to-point links and they are perfect for this situation.  The 
downside is that I run into the following issues:
 1. 169.254.0.0/16 can start to appear in the distributed EIGRP listings
 2. traceroutes have 169.254.0.0/16 addresses in them
 3. 169.254.0.0/16 is pingable by edge hosts as the switch they are
        plugged into knows of at least one 169.254.0.0/16 address.
	These addresses should never escape the local subnet

Now apparently I can solve the first issue by properly fixing up the way 
we use EIGRP, possibly involving liberal use of 'ip prefix-list' 
filtering or something similar?

There is *very* little online about if the second issue can even be 
solved on Cisco kit, but I did stumble on a suggestion to use 
NAT/route-map's (that would work perfectly for us as the Loopback0 
interface on are kit is a non-rfc1918 address):

https://cisco.hosted.jivesoftware.com/message/4910

I could not get this to work, but I was only tinkering with it for a 
couple of hours.  If only IOS had a 'ip icmp source interface...' 
command :)

I do have no idea on how I could fix the third issue or if it is even 
possible.  I would have hoped the kit would have a way to say "don't 
route where the source, or dest, IP address is in this ACL list".  I 
guess I could build ACL lists and place them on all the edge switches 
and just throw these packets into oblivion, however that would not be a 
global setting, instead a messy per-vlan settings surely?

So, I'm hoping someone can make any suggestions on how I could go about 
doing this.  Suggestions on how to tackle all three issues would be 
great as I'm not 100% on that I do know how to solve the first two 
issues.  Has anyone else done or heard of anyone using local-link 
addresses for routing between...erm...routers and then fixed the ICMP 
issue.

Even if the advice is "well if you had xy software you could do z".

Thanks in advance for any clue you can impart onto me.

Cheers

-- 
Alexander Clouter
.sigmonster says: The life of a repo man is always intense.


From gert at greenie.muc.de  Sat Jun 20 11:49:53 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Sat, 20 Jun 2009 17:49:53 +0200
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
Message-ID: <20090620154953.GM290@greenie.muc.de>

Hi,

On Sat, Jun 20, 2009 at 01:50:43PM +0100, Alexander Clouter wrote:
> The biggest issue is all the rfc1918 usage used in the /30 used to force 
> the L3 routes out to the edge of the network which make traceroutes 
> ugly.  I really do not want to put aside publicly routable addresses 
> that are just used to pass EIGRP data around, as that would involve 
> soaking up over 50 /30's, a bit of a waste.
> 
> So what to use, I am pretty keen to use link-local IPv4 addresses 
> (169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
> point-to-point links and they are perfect for this situation.  

Using 169.254.x addresses is no better or worse than RFC1918 addresses.

Just don't go there.  If your routers are going to source packets from
those addresses (traceroute responses or - much worse! - ICMP packet too
big messages), use public addresses.  That's what they are there for.

On non-ethernet point-to-point links, you could use "ip unnumbered"...

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090620/dfbe0045/attachment.bin>

From alex at digriz.org.uk  Sat Jun 20 11:19:24 2009
From: alex at digriz.org.uk (Alexander Clouter)
Date: Sat, 20 Jun 2009 16:19:24 +0100
Subject: [c-nsp] ipv4 link-local for eigrp
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
Message-ID: <s8bvg6-951.ln1@woodchuck.wormnet.eu>

Alexander Clouter <alex at digriz.org.uk> wrote:
> 
> [snipped]
> 
> So what to use, I am pretty keen to use link-local IPv4 addresses 
> (169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
> point-to-point links and they are perfect for this situation.  The 
> downside is that I run into the following issues:
> 1. 169.254.0.0/16 can start to appear in the distributed EIGRP listings
> 2. traceroutes have 169.254.0.0/16 addresses in them
> 3. 169.254.0.0/16 is pingable by edge hosts as the switch they are
>        plugged into knows of at least one 169.254.0.0/16 address.
>        These addresses should never escape the local subnet
> 
I see in the archives the first two points have been lightly touched 
upon before, with prefix-list filterings and some NAT.  Of course I'm 
interested in other possible solutions or sound advice.

Cheers

-- 
Alexander Clouter
.sigmonster says: <Manoj> I *like* the chicken


From dcp at dcptech.com  Sat Jun 20 12:32:59 2009
From: dcp at dcptech.com (David Prall)
Date: Sat, 20 Jun 2009 12:32:59 -0400
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <s8bvg6-951.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
	<s8bvg6-951.ln1@woodchuck.wormnet.eu>
Message-ID: <000901c9f1c4$de71be10$9b553a30$@com>

Use public addresses on the links and use outbound distribute-lists to stop
the propagation of point-to-point links. Traceroute will continue to work,
unless you use uRPF. 

David

--
http://dcp.dcptech.com
 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Alexander Clouter
> Sent: Saturday, June 20, 2009 11:19 AM
> To: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] ipv4 link-local for eigrp
> 
> Alexander Clouter <alex at digriz.org.uk> wrote:
> >
> > [snipped]
> >
> > So what to use, I am pretty keen to use link-local IPv4 addresses
> > (169.254.0.0/16) much like I plan to for IPv6 to build up the L3
> > point-to-point links and they are perfect for this situation.  The
> > downside is that I run into the following issues:
> > 1. 169.254.0.0/16 can start to appear in the distributed EIGRP
> listings
> > 2. traceroutes have 169.254.0.0/16 addresses in them
> > 3. 169.254.0.0/16 is pingable by edge hosts as the switch they are
> >        plugged into knows of at least one 169.254.0.0/16 address.
> >        These addresses should never escape the local subnet
> >
> I see in the archives the first two points have been lightly touched
> upon before, with prefix-list filterings and some NAT.  Of course I'm
> interested in other possible solutions or sound advice.
> 
> Cheers
> 
> --
> Alexander Clouter
> .sigmonster says: <Manoj> I *like* the chicken
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From ip at ioshints.info  Sat Jun 20 13:00:57 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Sat, 20 Jun 2009 19:00:57 +0200
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
Message-ID: <004a01c9f1c8$aef42980$0a00000a@nil.si>

You could use unnumbered Ethernet VLAN subinterfaces assuming your IOS
release supports them (or you could get your gear upgraded to a release that
does ... I am utterly confused when faced with Catalyst IOS releases):

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtunvlan.html

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/

> -----Original Message-----
> From: Alexander Clouter [mailto:alex at digriz.org.uk] 
> Sent: Saturday, June 20, 2009 2:51 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ipv4 link-local for eigrp
> 
> Hi,
> 
> After an organisational switch refresh last year we have been 
> fortunately enough to end up with surrounded by nothing but 
> 3750 stacks
> (c3750-ipbasek9-mz.122-50.SE1.bin) at the edge of the 
> network; the core is made up by a pair of 6509's 
> (s72033-ipservicesk9-mz.122-33.SXI.bin).  

[...]

> The biggest issue is all the rfc1918 usage used in the /30 
> used to force the L3 routes out to the edge of the network 
> which make traceroutes ugly.  I really do not want to put 
> aside publicly routable addresses that are just used to pass 
> EIGRP data around, as that would involve soaking up over 50 
> /30's, a bit of a waste.
> 
> So what to use, I am pretty keen to use link-local IPv4 addresses
> (169.254.0.0/16) much like I plan to for IPv6 to build up the 
> L3 point-to-point links and they are perfect for this 
> situation.  The downside is that I run into the following issues:
>  1. 169.254.0.0/16 can start to appear in the distributed 
> EIGRP listings  2. traceroutes have 169.254.0.0/16 addresses 
> in them  3. 169.254.0.0/16 is pingable by edge hosts as the 
> switch they are
>         plugged into knows of at least one 169.254.0.0/16 address.
> 	These addresses should never escape the local subnet
> 
> Now apparently I can solve the first issue by properly fixing 
> up the way we use EIGRP, possibly involving liberal use of 
> 'ip prefix-list' 
> filtering or something similar?
> 
> There is *very* little online about if the second issue can 
> even be solved on Cisco kit, but I did stumble on a 
> suggestion to use NAT/route-map's (that would work perfectly 
> for us as the Loopback0 interface on are kit is a non-rfc1918 
> address):
> 
> https://cisco.hosted.jivesoftware.com/message/4910
> 
> I could not get this to work, but I was only tinkering with 
> it for a couple of hours.  If only IOS had a 'ip icmp source 
> interface...' 
> command :)


From alex at digriz.org.uk  Sat Jun 20 12:32:13 2009
From: alex at digriz.org.uk (Alexander Clouter)
Date: Sat, 20 Jun 2009 17:32:13 +0100
Subject: [c-nsp] ipv4 link-local for eigrp
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
	<20090620154953.GM290@greenie.muc.de>
Message-ID: <dhfvg6-nf1.ln1@woodchuck.wormnet.eu>

Gert Doering <gert at greenie.muc.de> wrote:
> 
> Hi,
> 
> On Sat, Jun 20, 2009 at 01:50:43PM +0100, Alexander Clouter wrote:
>> The biggest issue is all the rfc1918 usage used in the /30 used to force 
>> the L3 routes out to the edge of the network which make traceroutes 
>> ugly.  I really do not want to put aside publicly routable addresses 
>> that are just used to pass EIGRP data around, as that would involve 
>> soaking up over 50 /30's, a bit of a waste.
>> 
>> So what to use, I am pretty keen to use link-local IPv4 addresses 
>> (169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
>> point-to-point links and they are perfect for this situation.  
> 
> Using 169.254.x addresses is no better or worse than RFC1918 addresses.
>
Well yes, I agree but...
 
> Just don't go there.  If your routers are going to source packets from
> those addresses (traceroute responses or - much worse! - ICMP packet too
> big messages), use public addresses.  That's what they are there for.
> 
I just don't want to burn public routable addresses on point-to-point 
links needlessly when there is a perfectly good routable address on 
Loopback0.  These link are there just to steer traffic down and 
distribute routing tables, the kit should not be responding with these 
addresses for anything...I don't want them to.

I was hoping someone knew of some cunningness and/or magic trick I could 
call upon?

> On non-ethernet point-to-point links, you could use "ip unnumbered"...
> 
Alas, it's all Ethernet here.

Cheers

-- 
Alexander Clouter
.sigmonster says: To err is human, but I can REALLY foul things up.


From lukasz at bromirski.net  Sat Jun 20 14:19:29 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sat, 20 Jun 2009 20:19:29 +0200
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <dhfvg6-nf1.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>	<20090620154953.GM290@greenie.muc.de>
	<dhfvg6-nf1.ln1@woodchuck.wormnet.eu>
Message-ID: <4A3D2831.2030801@bromirski.net>

On 2009-06-20 18:32, Alexander Clouter wrote:

> I just don't want to burn public routable addresses on point-to-point
> links needlessly when there is a perfectly good routable address on
> Loopback0.

You can easily run /31 on p2p links instead of /30.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From roger.wiklund at gmail.com  Sat Jun 20 16:42:54 2009
From: roger.wiklund at gmail.com (Roger Wiklund)
Date: Sat, 20 Jun 2009 22:42:54 +0200
Subject: [c-nsp] BGP Load balance for the uplink
In-Reply-To: <4A3A6C27.1030502@gmail.com>
References: <4A3A6C27.1030502@gmail.com>
Message-ID: <c960e2120906201342h104bb19dqff0d7438fd7c4638@mail.gmail.com>

How about just using
maximum-path x, and then do some route maps forcing only
some traffic to only use the faster link unless its down. Then you can
loadbalance on evetyhing else but the specific traffic. Then you might
get a more even utilization of the links.

Or perhaps if you can try the disable-connected-check, but it probably wont
work with dmzlink-bw

Regards
Roger

On Thu, Jun 18, 2009 at 6:32 PM, Georgi Genov <linuxloader at gmail.com> wrote:

>
>
> Here is my scenario , i have 2 uplink providers , one with 2 backup
> sessions on two different vlans with 2x /30 ip addr and other with multihop
> bgp .First provider with the 2 sessions i have 2:1 speed compare against the
> second . I advertise at the both providers same prefix lists . ( 2x /18 and
> one /24 ) . dmzlink-bw is one solution , but it didn`t work at multihop bgp
> . Some other suggestions .
>
> PS: Ruter is RSP720-3CXL-GE with Cisco IOS Software, c7600rsp72043_rp
> Software (c7600rsp72043_rp-ADVIPSERVICES-M), Version 12.2(33)SRB5a, RELEASE
> SOFTWARE (fc1)
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From copse at xy.org  Sat Jun 20 16:43:58 2009
From: copse at xy.org (Roger Wiklund)
Date: Sat, 20 Jun 2009 22:43:58 +0200
Subject: [c-nsp] BGP Load balance for the uplink
In-Reply-To: <c960e2120906201342h104bb19dqff0d7438fd7c4638@mail.gmail.com>
References: <4A3A6C27.1030502@gmail.com>
	<c960e2120906201342h104bb19dqff0d7438fd7c4638@mail.gmail.com>
Message-ID: <c960e2120906201343w2f203f5dt1142dc1f027f4d3e@mail.gmail.com>

How about just using
maximum-path x, and then do some route maps forcing only
some traffic to only use the faster link unless its down. Then you can
loadbalance on evetyhing else but the specific traffic. Then you might
get a more even utilization of the links.

Or perhaps if you can try the disable-connected-check, but it probably wont
work with dmzlink-bw

Regards
Roger

On Sat, Jun 20, 2009 at 10:42 PM, Roger Wiklund <roger.wiklund at gmail.com>wrote:

> How about just using
> maximum-path x, and then do some route maps forcing only
> some traffic to only use the faster link unless its down. Then you can
> loadbalance on evetyhing else but the specific traffic. Then you might
> get a more even utilization of the links.
>
> Or perhaps if you can try the disable-connected-check, but it probably wont
> work with dmzlink-bw
>
> Regards
> Roger
>
> On Thu, Jun 18, 2009 at 6:32 PM, Georgi Genov <linuxloader at gmail.com>wrote:
>
>>
>>
>> Here is my scenario , i have 2 uplink providers , one with 2 backup
>> sessions on two different vlans with 2x /30 ip addr and other with multihop
>> bgp .First provider with the 2 sessions i have 2:1 speed compare against the
>> second . I advertise at the both providers same prefix lists . ( 2x /18 and
>> one /24 ) . dmzlink-bw is one solution , but it didn`t work at multihop bgp
>> . Some other suggestions .
>>
>> PS: Ruter is RSP720-3CXL-GE with Cisco IOS Software, c7600rsp72043_rp
>> Software (c7600rsp72043_rp-ADVIPSERVICES-M), Version 12.2(33)SRB5a, RELEASE
>> SOFTWARE (fc1)
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
>

From rekordmeister at gmail.com  Sat Jun 20 17:44:22 2009
From: rekordmeister at gmail.com (MKS)
Date: Sat, 20 Jun 2009 21:44:22 +0000
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <fad2fb270906201444m26b4652u85a5128fd5d71c69@mail.gmail.com>

>I see in your original post you mentioned netflow - you will probably
>want to have a look through the archives for the (many, long) threads
>where people document their problems with netflow on this platform.
>Specifically, like the FIB, the DFCs have limited TCAM slots for netflow
>entries (256k/1M on non-XL/XL) and you can over-run this TCAM if you
>have a lot of traffic.
>
>If the netflow is important to you, and you're likely to have >1M flows
>at any given time, you might want to consider alternatives.

What alternatives are out there for a similar amount of money?

Regards
MKS

From lists at memetic.org  Sat Jun 20 17:54:03 2009
From: lists at memetic.org (Adam Armstrong)
Date: Sat, 20 Jun 2009 22:54:03 +0100
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
Message-ID: <4A3D5A7B.6050506@memetic.org>

Alexander Clouter wrote:
> Hi,
>
>
> The biggest issue is all the rfc1918 usage used in the /30 used to force 
> the L3 routes out to the edge of the network which make traceroutes 
> ugly.  I really do not want to put aside publicly routable addresses 
> that are just used to pass EIGRP data around, as that would involve 
> soaking up over 50 /30's, a bit of a waste.
>
> So what to use, I am pretty keen to use link-local IPv4 addresses 
> (169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
> point-to-point links and they are perfect for this situation.  The 
> downside is that I run into the following issues:
>  1. 169.254.0.0/16 can start to appear in the distributed EIGRP listings
>  2. traceroutes have 169.254.0.0/16 addresses in them
>  3. 169.254.0.0/16 is pingable by edge hosts as the switch they are
>         plugged into knows of at least one 169.254.0.0/16 address.
> 	These addresses should never escape the local subnet
>   
Using rfc addressing space for links that internet traffic traverse is a 
little bit filthy, imo. It makes a mess of traceroute and potentially 
sources traffic onto the internet from those addresses (which, 
hopefully, is subsequently dropped by filters/urpf).

If you're really worried about an wasting a couple of addresses, switch 
all of your links to /31s and bask in the knowledge that you've done 
more than most.

We've just migrated all of our linknets from 10/8 space to publicly 
addressable space, partly because i believe "it's the right thing to do" 
and partly because it irritated customers.

IMO, using RFC space gives you no benefits, other than having saved a 
few addresses (it does not give *you* more addresses, it saves teh world 
some addresses). It does, however, have a number of drawbacks.

adam.

From amolsapkal at gmail.com  Sat Jun 20 18:46:48 2009
From: amolsapkal at gmail.com (Amol Sapkal)
Date: Sun, 21 Jun 2009 02:46:48 +0400
Subject: [c-nsp] PoE switches and biometric devices (strange behaviour)
Message-ID: <ef4028ae0906201546x5d101c87tab76dba72129bf98@mail.gmail.com>

Hi all,

Here is the setup:
I have a PoE switch, which is connected to 2 other PoE switches.
All switches are cat 3560 switches (WS-C3560G-48PS)
Biometric devices (Finger-printers) connect on to one port of each downlink
switches (there are 2 downlink switches)
I have disabled inline power on all the ports of these 3 switches, as there
are no PoE devices connected
The uplink cables for the downlink switches are CAT6 and under 20m.
All access ports are marked as portfast (including the biometric device's
port)
IOS: 12.2(35)SE5 (IP Services)

Before the inline power was disabled, one of the switches displayed an
inline power error for the biometric device's port, which on further checks
with cisco.com, pointed to the bug CSCeb24148 (related to Electro-static
Discharge). Since then, I have upgraded the IOS, as per the recommendations.

The problem:
Before inline power was disabled, the biometric device port went down,
without any logs (apart from the inline power error, which was generated
only once in multiple port checks).  Also, the reliability of the port goes
down to 254/255. After the IOS upgrade, the switch no longer throws up the
inline power issue. As a precaution, I disabled inline power on all ports
using the 'power inline never' command.

Still, the biometric device disconnected.

Post that, the following was done:
Cabling was changed/verified
Trunking was disabled (as this was a cascade environment with no vlans, it
did not make any difference - all 3 switches belong to a single broadcast
domain)
Various duplex/speed combinations were tested
Non-PoE switches were tested in standalone modes, and they did not
disconnect the biometric device.
 Non-PoE switches were tested in standalone modes, and in the same cabling
closet and they did not disconnect the biometric device (to verify static
charges issues)
When cascaded with PoE switches, the non-PoE switched disconnected the
biometric device!
The switches were configured to NOT errdisable a port on detecting a
loopback

None of the above helped.

Now, I get the following logs on the non-PoE switch (3560), before the
biometric device's port disconnects:

04:19:26: ILP Start PHY Cisco IP phone detection ( Fa0/48 ) Okay
04:19:27: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/48,
changed state to down
04:19:28: %LINK-3-UPDOWN: Interface FastEthernet0/48, changed state to down

I fail to understand as to why the non-PoE switch is trying to detect a
cisco IP phone, on a port to which the biometric device connects (port
fa0/48). This is inspite the fact that the uplink switch has been configured
to disable inline power on all ports, including the downlink port. Even, the
other downlink switch is configured to disable inline power.

Question: Can anyone kindly help me to understand the above behaviour?
Question 2: How can I disable the detection of the Cisco IP phone on any
PoE/non-PoE switch?

Another thing that I am unable to figure out is the possibility of static
charge generation in the cabling closet.


-- 
Warm regards,

Amol Sapkal

-------------------------------------------------------------------
"When I'm not in my right mind, my left mind
gets pretty crowded"
-------------------------------------------------------------------

From lukasz at bromirski.net  Sun Jun 21 02:50:32 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sun, 21 Jun 2009 08:50:32 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <fad2fb270906201444m26b4652u85a5128fd5d71c69@mail.gmail.com>
References: <fad2fb270906201444m26b4652u85a5128fd5d71c69@mail.gmail.com>
Message-ID: <4A3DD838.5000405@bromirski.net>

On 2009-06-20 23:44, MKS wrote:

> What alternatives are out there for a similar amount of money?

For example ASR 1k with RP1 or RP2 end properly sized ESP. Look for the
cisco.com site for details.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From lukasz at bromirski.net  Sun Jun 21 02:58:45 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sun, 21 Jun 2009 08:58:45 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <4A3BC04D.3090008@imperial.ac.uk>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>	<000001c9f0f3$1defbe20$59cf3a60$@org>	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
	<4A3BC04D.3090008@imperial.ac.uk>
Message-ID: <4A3DDA25.5050407@bromirski.net>

On 2009-06-19 18:43, Phil Mayers wrote:

> I see in your original post you mentioned netflow - you will probably
> want to have a look through the archives for the (many, long) threads
> where people document their problems with netflow on this platform.
> Specifically, like the FIB, the DFCs have limited TCAM slots for netflow
> entries (256k/1M on non-XL/XL) and you can over-run this TCAM if you
> have a lot of traffic.

Correction: NetFlow entries are 128k on non-XL and 256k on XL PFCs/DFCs.
However, it's worth to note, that if the chassis is equipped with
DFCs, the collection of NetFlow entries happens independently - so,
theoretically, each of DFC-equipped LCs could go up to 128k if that
would be DFC3B/C, or up to 256k for DFC3BXL/3CXL.

http://cisco.com/en/US/prod/collateral/switches/ps5718/ps708/product_data_sheet09186a0080159856.html

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From zivl at gilat.net  Sun Jun 21 03:37:05 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Sun, 21 Jun 2009 10:37:05 +0300
Subject: [c-nsp] Long Uptime
In-Reply-To: <480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
	<480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>
Message-ID: <EC993E87D960A541A66BF21D62AA42A623012385CA@exch2k7.gilat.local>

I second that, besides, back then, there were not so many bugs as today, as with every new feature and more complex technology comes also a lot of bugs.
When systems were simpler, there were less problems, how many times do you remember having to hard reset your PC when using DOS 6.2 because it "hanged" and nothing else could be done?? 
Also, the exploits that might be there on such an old device are SO old that nobody will think to try, is like to try to find a computer with "Netbus" Trojan open for you to just hack in... heheh






-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Aaron
Sent: Saturday, June 20, 2009 2:47 AM
To: Gustavo Rodrigues Ramos
Cc: Nic McCartney; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Long Uptime

If it is an OOB system and it works why not?

Aaron

On Fri, Jun 19, 2009 at 10:25, Gustavo Rodrigues Ramos <
gustavo at nexthop.com.br> wrote:

> Is this suppose to be a good thing? (not patching your systems for
> almost 10 years?)...
>
> Gustavo.
>
>
> On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> > Not techy, just interesting anyone beat this uptime?
> >
> > Liverpool_St_A#sho ver
> > Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> > (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c)
> 1986-1996
> > by cisco Systems, Inc.
> > Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> > data-base: 0x00001000
> >
> > ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> > ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> > SOFTWARE (fc1)
> >
> > Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> > restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> > via flash
> >
> > cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of
> memory.
> > Processor board ID 04812778, with hardware revision 00000000 Bridging
> > software.
> > SuperLAT software copyright 1990 by Meridian Technology Corp).
> > X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> > TN3270 Emulation software (copyright 1994 by TGV Inc).
> > 1 Ethernet/IEEE 802.3 interface.
> > 2 Serial network interfaces.
> > 32K bytes of non-volatile configuration memory.
> > 8192K bytes of processor board System flash (Read ONLY)
> >
> > Configuration register is 0x2102
> >
> > Liverpool_St_A#
> >
> >
> > Thanks
> >
> > Nic
> >
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From p.mayers at imperial.ac.uk  Sun Jun 21 04:13:59 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Sun, 21 Jun 2009 09:13:59 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <b3tMhzlyZxTR.PskfzRhB@smtp.cc.ic.ac.uk>

Oops. Yes of course, thanks for that! The point about distributed netflow is a good one - we'd certainly exceed the tcam limits without it

-original message-
Subject: Re: [c-nsp] Sup720 vs RSP720 - Difference?
From: ?ukasz Bromirski <lukasz at bromirski.net>
Date: 21/06/2009 07:58

On 2009-06-19 18:43, Phil Mayers wrote:

> I see in your original post you mentioned netflow - you will probably
> want to have a look through the archives for the (many, long) threads
> where people document their problems with netflow on this platform.
> Specifically, like the FIB, the DFCs have limited TCAM slots for netflow
> entries (256k/1M on non-XL/XL) and you can over-run this TCAM if you
> have a lot of traffic.

Correction: NetFlow entries are 128k on non-XL and 256k on XL PFCs/DFCs.
However, it's worth to note, that if the chassis is equipped with
DFCs, the collection of NetFlow entries happens independently - so,
theoretically, each of DFC-equipped LCs could go up to 128k if that
would be DFC3B/C, or up to 256k for DFC3BXL/3CXL.

http://cisco.com/en/US/prod/collateral/switches/ps5718/ps708/product_data_sheet09186a0080159856.html

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net


From eng_mssk at hotmail.com  Sun Jun 21 04:14:27 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Sun, 21 Jun 2009 11:14:27 +0300
Subject: [c-nsp] OSPF
Message-ID: <BLU102-W18CAFFFFF111606A7458DAFA380@phx.gbl>


hey all 
i have ring of 11 routers and i have access routers connected to these core routers
if i have for example a device (name it x) connected directly to core 2 and the access number 1 is connected directly to core 2 
if the link is failed between the device x and core 2 
how much time will need access 1 to reach the device x across the ring ??
the network is based on OSPF

Thanks



_________________________________________________________________
Drag n? drop?Get easy photo sharing with Windows Live? Photos.

http://www.microsoft.com/windows/windowslive/products/photos.aspx

From george at mang.gr  Sun Jun 21 06:51:34 2009
From: george at mang.gr (Giorgos Manousakis)
Date: Sun, 21 Jun 2009 13:51:34 +0300
Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C381C1434E@PUR-EXCH07.ox.com>
Message-ID: <20090621105141.437A82FF06@geomanous.awmn>

Thanks for the reply,

Still there must be a way to prioritize (or block) skype traffic. In my
scenario just because of the small uplink bandwidth I need to give it
priority. 
I tried a packet capture on my pc and random ports were used. 
But maybe I can give priority to traffic destined to Level 3
communications... if I can define any prefixes on that... 

Can I download (from anywhere) skype nbar pdlm to give a shot? I cannot find
it.

BR

-----Original Message-----
From: Matthew Huff [mailto:mhuff at ox.com] 
Sent: Friday, June 19, 2009 10:58 PM
To: 'Giorgos Manousakis'; 'cisco-nsp at puck.nether.net'
Subject: RE: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2

Even with the newest Skype nbar pdlm or built-in nbar in 12.4T(x), it is
pretty useless. The majority of Skype traffic is sent now encrypted over
port 443. The only way I know to monitor/block it is with something like
bluecoat/websense, and then only at the point of origin (since you have to
proxy the ssl traffic at the source). I'd be happy to be proved wrong, but I
believe, at least for now, that Skype has won the war. 

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Giorgos Manousakis
> Sent: Friday, June 19, 2009 3:28 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
> 
> Dear All,
> 
> i am trying to apply QoS on my aDsl interface (2048/256) and i need to
> give
> strict priority to voice traffic, including skype and g711.
> 
> I suppose that i can match the g711 by using nbar rtp audio protocol or
> by
> using source ports that are know on my asterisk server.
> 
> Because of randomness of skype protocol that kind of handling does not
> apply.
> I found that skype is included in nbar but only after 12.4 version.
> Unfortunately i cannot upgrade the ios of my 837 cause of lack of DRAM,
> which is not upgradable.
> So i tried to find a pdlm addon for skype, but it is not available for
> stand
> alone download (http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm).
> 
> Can i found anywhere a skype.pdlm file? Is there any other way that i
> can
> match this traffic? Could i try rtp audio for that one too?
> 
> Thanks
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From drrtuy at ya.ru  Sun Jun 21 07:59:26 2009
From: drrtuy at ya.ru (Roman A. Nozdrin)
Date: Sun, 21 Jun 2009 14:59:26 +0300
Subject: [c-nsp] OSPF
In-Reply-To: <BLU102-W18CAFFFFF111606A7458DAFA380@phx.gbl>
References: <BLU102-W18CAFFFFF111606A7458DAFA380@phx.gbl>
Message-ID: <4A3E209E.2060502@ya.ru>

Hello.

> i have ring of 11 routers and i have access routers connected to these core routers
> if i have for example a device (name it x) connected directly to core 2 and the access number 1 is connected directly to core 2 
> if the link is failed between the device x and core 2 
> how much time will need access 1 to reach the device x across the ring ??
> the network is based on OSPF

Are you talking about OSPF reconverge time it the situation? If you are, 
  the answer is 4 x OSPF hello timer configured on interfaces.( by 
default: 40 secs for  broadcast-multiaccess and point-to-point and 120 
secs for NBMA links).

WBR
Roman A. Nozdrin

From rinse.kloek at isp.solcon.nl  Sun Jun 21 08:19:16 2009
From: rinse.kloek at isp.solcon.nl (Rinse Kloek)
Date: Sun, 21 Jun 2009 14:19:16 +0200
Subject: [c-nsp] ETSI Rack mounts for 4500
In-Reply-To: <91dee5fc0906200524l22d6c5d2gdf358306e67e7eec@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>	
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>	
	<4A3BA55C.6070101@isp.solcon.nl>
	<91dee5fc0906200524l22d6c5d2gdf358306e67e7eec@mail.gmail.com>
Message-ID: <4A3E2544.3020305@isp.solcon.nl>

Those ETSI racks are about 20.5 inch width (From mounting hole to 
mounting  hole). So the 23 inch convertors won't fit.

Rinse


Jeremy Parr schreef:
> You can purchase generic rack extenders for 23" racks at racksolutions.com
>
> On 6/19/09, Rinse Kloek <rinse.kloek at isp.solcon.nl> wrote:
>   
>> All,
>>
>> I am looking for some ERSI Rack mount ears to place some Cisco 4506's in
>> special Telco cabinets. The cabinets are 1,5 inch wider than the normal
>> 19 inch cabinets.
>> Does Cisco have these rack ears ?
>>
>> regards,
>> Rinse
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>     
>
>   

From ip at ioshints.info  Sun Jun 21 08:19:23 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Sun, 21 Jun 2009 14:19:23 +0200
Subject: [c-nsp] OSPF
In-Reply-To: <4A3E209E.2060502@ya.ru>
References: <BLU102-W18CAFFFFF111606A7458DAFA380@phx.gbl>
	<4A3E209E.2060502@ya.ru>
Message-ID: <000e01c9f26a$8421e9c0$0a00000a@nil.si>

> Are you talking about OSPF reconverge time it the situation? 
> If you are,
>   the answer is 4 x OSPF hello timer configured on interfaces.( by
> default: 40 secs for  broadcast-multiaccess and 
> point-to-point and 120 secs for NBMA links).

Plus (worst case) the LSA origination timer (default: 5 seconds) + LSA
flooding timer + SPF interval (which could be exponential, default maximum
value is 10 seconds). In most cases, unless you've tuned your network, you
can add a few seconds to the hello timers calculation due to initial SPF
delay (default: 5 seconds)

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


From oboehmer at cisco.com  Sun Jun 21 09:47:27 2009
From: oboehmer at cisco.com (Oliver Boehmer (oboehmer))
Date: Sun, 21 Jun 2009 15:47:27 +0200
Subject: [c-nsp] OSPF LSA timers
In-Reply-To: <OF603BD14F.B6929832-ONCC2575C9.0020532A-CC2575C9.0021EB3B@nz1.ibm.com>
References: <OF603BD14F.B6929832-ONCC2575C9.0020532A-CC2575C9.0021EB3B@nz1.ibm.com>
Message-ID: <70B7A1CCBFA5C649BD562B6D9F7ED7840789F869@xmb-ams-333.emea.cisco.com>

Raymond Lucas <> wrote on Tuesday, June 02, 2009 08:10:

> Hi,
> 
> I have been gradually rolling out OSPF across a network including the
> following bit of config:
> 
> router ospf 172
>  ispf
>  timers throttle lsa all 10 100 5000
>  timers lsa arrival 80
> 
> Which was fine until I arrived at a couple of 6506s with SUP2/MSFC2
> running 12.2(17d)SXB9 which don't support those commands.  Seems they
were
> only introduced in 12.2(18)SXF according to Software Advisor.
> 
> We can't upgrade to 12.2(18)SXF due to a lack of memory on the switch
> processors.  I'm not too worried by the "ispf" business, but I have a
> bad feeling about having a couple of devices different from their
> neighbours with the LSA stuff.  To really up the nerves, these 6506s
> are are part of the core.  I can imagine it working well most of the
> time but then failing badly when the pressure is on.
> 
> So I guess my questions are:
> 
> - Am I right to be worried, or will things work fine if I miss these
> commands from these devices?

It'll work most of the time, until you run into situation where you need
to issue more than one LSA update per second (for the very same LSA id).
As the other devices will ignore the 2nd LSA update, you'll have to
retransmit and convergence will be delayed.

> - Since these timers can only be set on a per device basis, as
> opposed to per interface, is there an elegant way to deal with this
> scenario? Obviously I would not be keen to remove the modified timers
> from the rest of the network!

Well, if you really need these timers to meet your convergence targets,
you're out of luck and need to upgrade the devices. I would argue,
however, that you'll be able to get away with less aggressive LSA update
timers (i.e. timers throttle lsa update 10 1000 5000) in most scenarios.
Tuning SPF timers is usually more important..

	oli

From ploopster at gmail.com  Sun Jun 21 13:19:58 2009
From: ploopster at gmail.com (Sridhar Ayengar)
Date: Sun, 21 Jun 2009 13:19:58 -0400
Subject: [c-nsp] Long Uptime
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A623012385CA@exch2k7.gilat.local>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>	<480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>
	<EC993E87D960A541A66BF21D62AA42A623012385CA@exch2k7.gilat.local>
Message-ID: <4A3E6BBE.4090401@gmail.com>

Ziv Leyes wrote:
> I second that, besides, back then, there were not so many bugs as today, as with every new feature and more complex technology comes also a lot of bugs.
> When systems were simpler, there were less problems, how many times do you remember having to hard reset your PC when using DOS 6.2 because it "hanged" and nothing else could be done?? 
> Also, the exploits that might be there on such an old device are SO old that nobody will think to try, is like to try to find a computer with "Netbus" Trojan open for you to just hack in... heheh

Besides that, there are operating systems that can be updated without a 
reboot.

Peace...  Sridhar

From mhuff at ox.com  Sun Jun 21 16:47:11 2009
From: mhuff at ox.com (Matthew Huff)
Date: Sun, 21 Jun 2009 16:47:11 -0400
Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
In-Reply-To: <20090621105141.437A82FF06@geomanous.awmn>
References: <483E6B0272B0284BA86D7596C40D29F9C381C1434E@PUR-EXCH07.ox.com>
	<20090621105141.437A82FF06@geomanous.awmn>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C14352@PUR-EXCH07.ox.com>

I'm afraid you are out of look. In order to get skype 3.0 into IOS, Cisco had to leave behind PDLM and hard code it. Even then it's pretty useless. Only solution is to get to 12.4(22)T+



----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com? | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139

-----Original Message-----
From: Giorgos Manousakis [mailto:george at mang.gr] 
Sent: Sunday, June 21, 2009 6:52 AM
To: Matthew Huff; cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2

Thanks for the reply,

Still there must be a way to prioritize (or block) skype traffic. In my
scenario just because of the small uplink bandwidth I need to give it
priority. 
I tried a packet capture on my pc and random ports were used. 
But maybe I can give priority to traffic destined to Level 3
communications... if I can define any prefixes on that... 

Can I download (from anywhere) skype nbar pdlm to give a shot? I cannot find
it.

BR

-----Original Message-----
From: Matthew Huff [mailto:mhuff at ox.com] 
Sent: Friday, June 19, 2009 10:58 PM
To: 'Giorgos Manousakis'; 'cisco-nsp at puck.nether.net'
Subject: RE: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2

Even with the newest Skype nbar pdlm or built-in nbar in 12.4T(x), it is
pretty useless. The majority of Skype traffic is sent now encrypted over
port 443. The only way I know to monitor/block it is with something like
bluecoat/websense, and then only at the point of origin (since you have to
proxy the ssl traffic at the source). I'd be happy to be proved wrong, but I
believe, at least for now, that Skype has won the war. 

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Giorgos Manousakis
> Sent: Friday, June 19, 2009 3:28 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
> 
> Dear All,
> 
> i am trying to apply QoS on my aDsl interface (2048/256) and i need to
> give
> strict priority to voice traffic, including skype and g711.
> 
> I suppose that i can match the g711 by using nbar rtp audio protocol or
> by
> using source ports that are know on my asterisk server.
> 
> Because of randomness of skype protocol that kind of handling does not
> apply.
> I found that skype is included in nbar but only after 12.4 version.
> Unfortunately i cannot upgrade the ios of my 837 cause of lack of DRAM,
> which is not upgradable.
> So i tried to find a pdlm addon for skype, but it is not available for
> stand
> alone download (http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm).
> 
> Can i found anywhere a skype.pdlm file? Is there any other way that i
> can
> match this traffic? Could i try rtp audio for that one too?
> 
> Thanks
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From peter at rathlev.dk  Sun Jun 21 17:05:55 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Sun, 21 Jun 2009 23:05:55 +0200
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <20090618183433.GB13882@rtp-cse-489.cisco.com>
References: <1245283261.15106.46.camel@localhost.localdomain>
	<1245345182.26970.13.camel@localhost.localdomain>
	<20090618183433.GB13882@rtp-cse-489.cisco.com>
Message-ID: <1245618355.2946.63.camel@localhost.localdomain>

On Thu, 2009-06-18 at 14:34 -0400, Rodney Dunn wrote: 
> Curious..I don't know that platform forwarding architecture.
> 
> But what does 'sh int stat' give you?

We've begun running some production traffic through the box now and it
doesn't seem to be overly loaded by more flows, but maybe it really has
to process switch "first packets". I thought the TCAM thingy was able to
do a hashed lookup based on source and destination IP and thus no need
to "install" flows.

Interface stats for the two relevant interfaces (policy map attached to
Vlan2176, policy routed traffic exits via Vlan507, non policy routed
exist via next hop on same interface as it arrived):

Vlan507
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor      73750    4426830     314407   20751714
             Route cache          1         90          0          0
                   Total      73751    4426920     314407   20751714
Vlan2176
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor     210884   13340863     323420   21776624
             Route cache         23       5081         24       5267
                   Total     210907   13345944     323444   21781891

And "show interfaces accounting":

Vlan507 XXX Internet
                Protocol    Pkts In   Chars In   Pkts Out  Chars Out
                      IP         41       3546     315061   19534782
                     ARP      73840    4431144         74       4440
Vlan2176 YYY Internet
                Protocol    Pkts In   Chars In   Pkts Out  Chars Out
                      IP     211382   13383337     324400   20584065
                     ARP        571      34260        131       7860

The processor switched "Pkts In" from Vlan507 are mostly ARP. The unit
has been live for a couple of days with light production traffic.

And the route-map:

route-map Inet_PBR, permit, sequence 10
  Match clauses:
    ip address (access-lists): RMIT_XXX_sources 
  Set clauses:
    ip next-hop A.B.C.D
  Policy routing matches: 0 packets, 0 bytes
route-map Inet_PBR, permit, sequence 20
  Match clauses:
    ip address (access-lists): RMIT_YYY_sources 
  Set clauses:
    ip next-hop A.B.C.E
  Policy routing matches: 3 packets, 216 bytes


> Also, sh ip traffic a couple times once you start the traffic.

The "show ip traffic" seems only to show traffic received. Should it
also show policy routed traffic?

IP statistics:
  Rcvd:  211589 total, 211565 local destination
         0 format errors, 0 checksum errors, 24 bad hop count
         0 unknown protocol, 0 not a gateway
         0 security failures, 0 bad options, 0 with options
  Opts:  0 end, 0 nop, 0 basic security, 0 loose source route
         0 timestamp, 0 extended security, 0 record route
         0 stream ID, 0 strict source route, 0 alert, 0 cipso, 0 ump
         0 other
  Frags: 0 reassembled, 0 timeouts, 0 couldn't reassemble
         0 fragmented, 0 couldn't fragment
  Bcast: 0 received, 0 sent
  Mcast: 201383 received, 630608 sent
  Sent:  639832 generated, 255251197 forwarded
  Drop:  0 encapsulation failed, 0 unresolved, 0 no adjacency
         0 no route, 0 unicast RPF, 0 forced drop
         0 options denied, 0 source IP address zero

ICMP statistics:
  Rcvd: 0 format errors, 0 checksum errors, 1 redirects, 0 unreachable
        144 echo, 24 echo reply, 0 mask requests, 0 mask replies, 0
quench
        0 parameter, 0 timestamp, 0 info request, 0 other
        0 irdp solicitations, 0 irdp advertisements
  Sent: 0 redirects, 108 unreachable, 25 echo, 144 echo reply
        0 mask requests, 0 mask replies, 0 quench, 0 timestamp
        0 info reply, 386 time exceeded, 0 parameter problem
        0 irdp solicitations, 0 irdp advertisements

TCP statistics:
  Rcvd: 6307 total, 26 checksum errors, 30 no port
  Sent: 4655 total

UDP statistics:
  Rcvd: 205062 total, 0 checksum errors, 117 no port
  Sent: 634518 total, 0 forwarded broadcasts

(... snipped irrelevant protocol counters, all zero ...)

ARP statistics:
  Rcvd: 74386 requests, 60 replies, 0 reverse, 0 other
  Sent: 68 requests, 152 replies (60 proxy), 0 reverse
  Drop due to input queue full: 0


The number of ARP requests is relatively high (considering it has been
live for about a day connected a /20 prefix. This might explain the non
interrupt CPU load (~5-10% most of the time) and is due to a
semi-retarded legacy setup on one of the legs. That's actually the
reason we needed the PBR: transitioning away from that.

(And why does it say "(60 proxy)" in sent ARP statistics? We have "no ip
proxy-arp" on all interfaces of course.)

Regards,
Peter



From dean at eatworms.org.uk  Sun Jun 21 17:22:36 2009
From: dean at eatworms.org.uk (Dean Smith)
Date: Sun, 21 Jun 2009 22:22:36 +0100
Subject: [c-nsp] 7600 ES+ Advanced Licence
Message-ID: <004801c9f2b6$6660f650$3322e2f0$@org.uk>

Do I need to buy the advanced ES line card licence to support a couple of
manually configured VRFs on 7600 using ES+ cards ?

 

The only info on CCO I can find to explain the Advanced Licence is below and
doesn't really make it clear is its exclusively for MPLS. (In my case the
ES+ cards are primarily for HQoS on subrate gigabit WAN connections)

 

The Advance IP license entitles you to use the Cisco IOS Software Release
12.2SR on the Cisco 7600 ES Plus line cards with the following functions in
addition to the Basic license:

. 6VPE

. IPv6

. Layer 3 IP/MPLS VPN

. MVPN

https://www.cisco.com/en/US/prod/collateral/routers/ps368/data_sheet_c78-491
52.html
Thanks
Dean


From rlucas at nz1.ibm.com  Sun Jun 21 18:27:25 2009
From: rlucas at nz1.ibm.com (Raymond Lucas)
Date: Mon, 22 Jun 2009 10:27:25 +1200
Subject: [c-nsp] OSPF LSA timers
In-Reply-To: <70B7A1CCBFA5C649BD562B6D9F7ED7840789F869@xmb-ams-333.emea.cisco.com>
References: <OF603BD14F.B6929832-ONCC2575C9.0020532A-CC2575C9.0021EB3B@nz1.ibm.com>
	<70B7A1CCBFA5C649BD562B6D9F7ED7840789F869@xmb-ams-333.emea.cisco.com>
Message-ID: <OF7608A091.13475FCD-ONCC2575DC.007ABC4F-CC2575DC.007B5C5E@nz1.ibm.com>

"Oliver Boehmer (oboehmer)" <oboehmer at cisco.com> wrote on 22/06/2009
01:47:27 a.m.:

> RE: [c-nsp] OSPF LSA timers
> Oliver Boehmer (oboehmer)
> to: Raymond Lucas, cisco-nsp
> 22/06/2009 01:47 a.m.
>
> Raymond Lucas <> wrote on Tuesday, June 02, 2009 08:10:
>
> > Hi,
> >
> > I have been gradually rolling out OSPF across a network including the
> > following bit of config:
> >
> > router ospf 172
> >  ispf
> >  timers throttle lsa all 10 100 5000
> >  timers lsa arrival 80
> >
> > Which was fine until I arrived at a couple of 6506s with SUP2/MSFC2
> > running 12.2(17d)SXB9 which don't support those commands.  Seems they
> were
> > only introduced in 12.2(18)SXF according to Software Advisor.
> >
> > We can't upgrade to 12.2(18)SXF due to a lack of memory on the switch
> > processors.  I'm not too worried by the "ispf" business, but I have a
> > bad feeling about having a couple of devices different from their
> > neighbours with the LSA stuff.  To really up the nerves, these 6506s
> > are are part of the core.  I can imagine it working well most of the
> > time but then failing badly when the pressure is on.
> >
> > So I guess my questions are:
> >
> > - Am I right to be worried, or will things work fine if I miss these
> > commands from these devices?
>
> It'll work most of the time, until you run into situation where you need
> to issue more than one LSA update per second (for the very same LSA id).
> As the other devices will ignore the 2nd LSA update, you'll have to
> retransmit and convergence will be delayed.

Yeah, did some testing and figured the same thing myself.  My local SE
provided similar feedback and also a hidden command that would stop these
devices ignoring those 2nd LSA updates.  I would rather not use hidden
commands if I can help it though.

> > - Since these timers can only be set on a per device basis, as
> > opposed to per interface, is there an elegant way to deal with this
> > scenario? Obviously I would not be keen to remove the modified timers
> > from the rest of the network!
>
> Well, if you really need these timers to meet your convergence targets,
> you're out of luck and need to upgrade the devices. I would argue,
> however, that you'll be able to get away with less aggressive LSA update
> timers (i.e. timers throttle lsa update 10 1000 5000) in most scenarios.
> Tuning SPF timers is usually more important..

Nice to know.

In this particular scenario, it is currently not so important to have quick
convergence in Area 0 where we have this problem.  We don't have the
problem in other areas which is important to us.

Thanks heaps for the feedback,

Ray


From adrian at creative.net.au  Sun Jun 21 22:47:10 2009
From: adrian at creative.net.au (Adrian Chadd)
Date: Mon, 22 Jun 2009 10:47:10 +0800
Subject: [c-nsp] Cisco 3750, WCCPv2, CPU switched?
Message-ID: <20090622024710.GC1012@skywalker.creative.net.au>

G'day,

I'm trying to configure up bi-directional WCCPv2 on a Cisco 3750
with redirect lists to limit the traffic being redirected.
I'm trying it on 12.2(50)SE2 ipservicesk9.

If I add a redirect list to the wccpv2 service definitions the
traffic becomes CPU processed.

If I remove the redirect lists, the traffic is 100% hardware processed.

Is there some bug or platform caveat which isn't mentioned anywhere?

Thanks,


Adrian


From adrian at creative.net.au  Sun Jun 21 23:03:14 2009
From: adrian at creative.net.au (Adrian Chadd)
Date: Mon, 22 Jun 2009 11:03:14 +0800
Subject: [c-nsp] Cisco 3750, WCCPv2, CPU switched?
In-Reply-To: <20090622024710.GC1012@skywalker.creative.net.au>
References: <20090622024710.GC1012@skywalker.creative.net.au>
Message-ID: <20090622030314.GD1012@skywalker.creative.net.au>

On Mon, Jun 22, 2009, Adrian Chadd wrote:
> G'day,
> 
> I'm trying to configure up bi-directional WCCPv2 on a Cisco 3750
> with redirect lists to limit the traffic being redirected.
> I'm trying it on 12.2(50)SE2 ipservicesk9.
> 
> If I add a redirect list to the wccpv2 service definitions the
> traffic becomes CPU processed.
> 
> If I remove the redirect lists, the traffic is 100% hardware processed.
> 
> Is there some bug or platform caveat which isn't mentioned anywhere?

Two things:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_37_se/configuration/guide/swwccp.html
at least mentions the redirect ACL but apparently has it backwards:

"To disable caching for specific clients, servers, or client/server pairs, you can use a WCCP
 redirect access control list (ACL). Packets that match the redirect ACL bypass the cache and
 are forwarded normally."

The redirect ACL is "match == redirect", rather than "match == bypass."

Secondly, I can't see any mention of what is/isn't permitted in the redirect ACL.
Only in this article: http://wireless.itworld.com/networking/55658/wccp-refresh
where the author mentions that only permit entries are supported.

Sure enough, removing the explicit deny entries from the ACLs removes the CPU
punting and I'm happily fully transparently intercepting a gigabit of HTTP.

My question is - where in the Cisco documentation is this configuration caveat mentioned?

thanks,


Adrian


From uugnaa_mns at yahoo.com  Sun Jun 21 23:16:28 2009
From: uugnaa_mns at yahoo.com (uugnaa)
Date: Sun, 21 Jun 2009 20:16:28 -0700 (PDT)
Subject: [c-nsp] AIM-VPN/SSL-3 on 3825 router
Message-ID: <536151.56794.qm@web55101.mail.re4.yahoo.com>

Hello all,

I have Cisco router 3825, and I am thinking of to upgrade it with AIM-VPN/SSL-3 VPN module. 
If anyone has worked on AIM-VPN/SSL-3 module, What is the prerequisite to install this module on 3825.

Please advice me should I to upgrade the IOS. Now it is IP Base.

Thank you in advance

--- On Mon, 6/22/09, Adrian Chadd <adrian at creative.net.au> wrote:

From: Adrian Chadd <adrian at creative.net.au>
Subject: [c-nsp] Cisco 3750, WCCPv2, CPU switched?
To: cisco-nsp at puck.nether.net
Date: Monday, June 22, 2009, 8:17 AM

G'day,

I'm trying to configure up bi-directional WCCPv2 on a Cisco 3750
with redirect lists to limit the traffic being redirected.
I'm trying it on 12.2(50)SE2 ipservicesk9.

If I add a redirect list to the wccpv2 service definitions the
traffic becomes CPU processed.

If I remove the redirect lists, the traffic is 100% hardware processed.

Is there some bug or platform caveat which isn't mentioned anywhere?

Thanks,


Adrian

_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



      

From madunix at gmail.com  Mon Jun 22 01:53:12 2009
From: madunix at gmail.com (madunix)
Date: Mon, 22 Jun 2009 07:53:12 +0200
Subject: [c-nsp] MPLS
In-Reply-To: <4d3f56c90906080850j5eef041cua8abd4938698d177@mail.gmail.com>
References: <4d3f56c90906080850j5eef041cua8abd4938698d177@mail.gmail.com>
Message-ID: <4d3f56c90906212253l142a43d6v59b83c2f0062c895@mail.gmail.com>

I was thinking to ask the following question to my provider, hoping to
get an answer
How robustly architected is the MP-BGP?
How fast is convergence?BGP times ? scan timeres in and out?
What IGP is the provider using in their core?
What bandwidth they gonna guaranteed ?
As you said the convergence time is a real factor?

madunix


On Mon, Jun 8, 2009 at 5:50 PM, madunix<madunix at gmail.com> wrote:
> agree with you security concern and latency, the overhead to make the
> routing work in an MPLS network will
> slow the traffic down, this will ?creates latency concerns for the customer.
>
>>madunix wrote:
>>> I have 3x sites with DS8100 SAN Storage at each side, I will be
>>> replicating data from one side to another (A - B, synchronous,
>>> distance 100Km) and (B-C, asynchronous, 300Km). Am thinking to use
>>> MPLS based on IP-VPN ?since its secure and not visible to other
>>> customers or internet.
>>> Out of your experience ...what do you think about ?
>>>
>>
>>Well, it's not "secure", it's simply routing isolated. ?If you want
>>security, as in encryption, you will need to do that on your own.
>>
>>If you need low convergence times, MPLS/VPN is probably not your best
>>choice. ?I don't know of many (if any) providers who will guarantee the
>>convergence times through their network. ?You should expect convergence
>>times in the 10's of seconds or more for certain types of failures.
>>
>>You may want to consider getting an L2VPN solution such as VPWS or VPLS and
>>running your own routing protocol and failure detection methods.
>>
>
>
> madunix
>

From linux.yahoo at gmail.com  Mon Jun 22 06:10:58 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Mon, 22 Jun 2009 12:10:58 +0200
Subject: [c-nsp] Link state propagation / remote port shutdown with
	EoMPLS on 6500
In-Reply-To: <5c374d9a0906180441h2470630br18efea343f461a0@mail.gmail.com>
References: <5c374d9a0906180441h2470630br18efea343f461a0@mail.gmail.com>
Message-ID: <7100ed370906220310m57ce1fpc63b1d6d1be4724b@mail.gmail.com>

AToM Remote Ethernet Port Shutdown Feature supported on CRS-1, XR 12K, 10K,
12K, 7200 NPE-G2
-> not supported on 6500
On Thu, Jun 18, 2009 at 1:41 PM, John <fraglet at gmail.com> wrote:

> Hi All
> Im playing around with EoMPLS on 6500`s w/SUP720-3b and 6700 line cards...
> No ES hardware.
>
> Everything seems fine, performance is good, scales ok for what we need,
> what
> I`m failing to do is get link state propagation or remote port shutdown to
> work.
>
> Anybody have any pointers on this..
>
> Our config is very basic port mode xconnects..
>
>
> interface GigabitEthernet1/12
>  mtu 1560
>  no ip address
>  xconnect 192.168.1.1 2007 pw-class TEST#1
>
>
> I notice that in conf mode under the xconnect config you can enter "remote
> link failure notification" this seems to be enabled by default, but doesnt
> seem to do anything..
>
> I imagine that I need to configure some OAM or CFM or similar, but am at a
> loss as to how, anyone thats already done it?
>
> Any help gratefully accepted
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From tseveendorj at gmail.com  Mon Jun 22 05:42:45 2009
From: tseveendorj at gmail.com (Tseveendorj)
Date: Mon, 22 Jun 2009 18:42:45 +0900
Subject: [c-nsp] Need help on IOS
Message-ID: <4A3F5215.5050500@gmail.com>

Hello,

Can you provide me below IOS please.

c3825-ipbasek9-mz.124-24.T.bin

If someone have this IOS please send me by email 
tseveendorj2006 at yahoo.com or assign my CCO account named otseveendorj 
without access privilege any resources of Cisco.

Then I really appreciate.

Thank you.
Tseveen.


From sam_mailinglists at spacething.org  Mon Jun 22 07:45:14 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Mon, 22 Jun 2009 12:45:14 +0100
Subject: [c-nsp] Cisco 4900M onboard X2 and twingig convertors
Message-ID: <4A3F6ECA.2030001@spacething.org>

Hi,

Is anyone able to confirm whether the onboard X2 slots on the 4900M 
support the twin-gig modules?

Some of the documentation suggests they are only supported on the 8-Port 
(2:1) 10 Gigabit Ethernet (X2) Half Card, but I haven't seen any that 
definitively rules out there use on the onboard slots.

Thanks,

Sam

From biged7600 at gmail.com  Mon Jun 22 08:02:32 2009
From: biged7600 at gmail.com (James Edmondson)
Date: Mon, 22 Jun 2009 07:02:32 -0500
Subject: [c-nsp] Cisco 4900M onboard X2 and twingig convertors
In-Reply-To: <4A3F6ECA.2030001@spacething.org>
References: <4A3F6ECA.2030001@spacething.org>
Message-ID: <d35a6baf0906220502ga060bbcg18794db1b27f3a26@mail.gmail.com>

They do not, i have 24 of them up in production, you have to use the half
cards.  I was unsure of this as well and had to work with my Cisco Rep to
verify this before buying them.  Documentation below must be updated it
shows Table 1, that the Twin Gig is only supported on the 8 port and 10
gig Ethernet half cards.
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps6021/ps9310/Data_Sheet_Cat_4900M.html


On Mon, Jun 22, 2009 at 6:45 AM, Sam Stickland <
sam_mailinglists at spacething.org> wrote:

> Hi,
>
> Is anyone able to confirm whether the onboard X2 slots on the 4900M support
> the twin-gig modules?
>
> Some of the documentation suggests they are only supported on the 8-Port
> (2:1) 10 Gigabit Ethernet (X2) Half Card, but I haven't seen any that
> definitively rules out there use on the onboard slots.
>
> Thanks,
>
> Sam
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
James

From tom at netspot.com.au  Mon Jun 22 08:03:22 2009
From: tom at netspot.com.au (Tom Lanyon)
Date: Mon, 22 Jun 2009 21:33:22 +0930
Subject: [c-nsp] Cisco 4900M onboard X2 and twingig convertors
In-Reply-To: <4A3F6ECA.2030001@spacething.org>
References: <4A3F6ECA.2030001@spacething.org>
Message-ID: <4F297F93-A405-414B-9E07-394737D7F396@netspot.com.au>

On 22/06/2009, at 9:15 PM, Sam Stickland wrote:

> Hi,
>
> Is anyone able to confirm whether the onboard X2 slots on the 4900M  
> support the twin-gig modules?
>
> Some of the documentation suggests they are only supported on the 8- 
> Port (2:1) 10 Gigabit Ethernet (X2) Half Card, but I haven't seen  
> any that definitively rules out there use on the onboard slots.
>
> Thanks,
>
> Sam

All the documentation for the 4900M insists that they only work in the  
8-port card, but I've not tested them in any of the other cards or in  
the base chassis.

-Tom


From gulerozgur at yahoo.co.uk  Mon Jun 22 08:58:53 2009
From: gulerozgur at yahoo.co.uk (Ozgur Guler)
Date: Mon, 22 Jun 2009 12:58:53 +0000 (GMT)
Subject: [c-nsp] Cisco 4900M onboard X2 and twingig convertors
Message-ID: <858632.34933.qm@web25508.mail.ukl.yahoo.com>


The 10GE baseboard ports and the 4 port half cards do not support the TwinGig converter. Only 8 port half cards can support the TwinGig converter.

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps6021/ps9310/Data_Sheet_Cat_4900M.html
Check under Table 2.
This will show the Ports Using Cisco TwinGig Converter Module.

We started using media converters for fiber links as I did not want to waste a slot with the expensive 8port half card module.

Thanks
Ozgur
--- On Mon, 22/6/09, Sam Stickland <sam_mailinglists at spacething.org> wrote:

> From: Sam Stickland <sam_mailinglists at spacething.org>
> Subject: [c-nsp] Cisco 4900M onboard X2 and twingig convertors
> To: "Cisco-nsp" <cisco-nsp at puck.nether.net>
> Date: Monday, 22 June, 2009, 12:45 PM
> Hi,
> 
> Is anyone able to confirm whether the onboard X2 slots on
> the 4900M support the twin-gig modules?
> 
> Some of the documentation suggests they are only supported
> on the 8-Port (2:1) 10 Gigabit Ethernet (X2) Half Card, but
> I haven't seen any that definitively rules out there use on
> the onboard slots.
> 
> Thanks,
> 
> Sam
> _______________________________________________
> cisco-nsp mailing list? cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


      

From rwest at zyedge.com  Mon Jun 22 09:22:33 2009
From: rwest at zyedge.com (Ryan West)
Date: Mon, 22 Jun 2009 09:22:33 -0400
Subject: [c-nsp] AIM-VPN/SSL-3 on 3825 router
In-Reply-To: <536151.56794.qm@web55101.mail.re4.yahoo.com>
References: <536151.56794.qm@web55101.mail.re4.yahoo.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5694@zy-ex1.zyedge.local>

So, you hijacked a thread, didn't remove the old text and then asked a question that could have been answered by going to www.cisco.com and searching for AIM-VPN/SSL-3?  

http://tools.cisco.com/search/JSP/search-results.get?strQueryText=AIM-VPN%2FSSL-3&x=0&y=0&Search+All+cisco.com=cisco.com&language=en&country=US&thissection=f&accessLevel=Guest

http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htvpnssl.html#wp1066359

You'll need an advanced feature set (IP Services / Ent / Security) for WebVPN, which will include the other enhancements as well.  It will have to 12.4(9)T or higher.

http://www.cisco.com/go/fn

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of uugnaa
Sent: Sunday, June 21, 2009 11:16 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] AIM-VPN/SSL-3 on 3825 router

Hello all,

I have Cisco router 3825, and I am thinking of to upgrade it with AIM-VPN/SSL-3 VPN module. 
If anyone has worked on AIM-VPN/SSL-3 module, What is the prerequisite to install this module on 3825.

Please advice me should I to upgrade the IOS. Now it is IP Base.

Thank you in advance

--- On Mon, 6/22/09, Adrian Chadd <adrian at creative.net.au> wrote:

From: Adrian Chadd <adrian at creative.net.au>
Subject: [c-nsp] Cisco 3750, WCCPv2, CPU switched?
To: cisco-nsp at puck.nether.net
Date: Monday, June 22, 2009, 8:17 AM




From jluke at truarx.com  Mon Jun 22 10:35:33 2009
From: jluke at truarx.com (Jason Luke)
Date: Mon, 22 Jun 2009 10:35:33 -0400
Subject: [c-nsp] Layer 2 vs Layer 3 Performance Question
Message-ID: <C6650EF5.9B70%jluke@truarx.com>

I'm not sure if it matters but if it does, I would like to know.

I have two buildings, connected via fiber (1 Gig speed only). In bldg one, I have my core switch (6509) and that core switch has the default route for everything in bldg 2. In other words, bldg 2 does not have a router, just a switch.
In bldg one, I have my SAN, storing all my virtual machines, all talking iSCSI  to each other on VLAN 5.
In bldg two, I have my backup server and my data duplication (DD) storage device on VLAN 10.

I could just as easily trunk VLAN 5 over to the switch at bldg two and put the backup server and DD box on the iSCSI VLAN 5. This would mean that ALL backup comms only happen on that same VLAN, no routing/traversal of that VLAN.
Or I could leave it as is and route the traffic. The actual physical paths are no different.

So the question is, is there a difference?  I have hundreds of GB's to backup so if there is a performance difference one way or the other, I would want to know.  The only thing I can see as a difference is if I trunk the iSCSI vlan, then the traffic never hits the 6509's routing module. Maybe that helps performance?


From mh+cisco-nsp at zugschlus.de  Mon Jun 22 09:59:14 2009
From: mh+cisco-nsp at zugschlus.de (Marc Haber)
Date: Mon, 22 Jun 2009 15:59:14 +0200
Subject: [c-nsp] VPN-Client,
	how to work around ISPs faking NXDOMAIN responses
Message-ID: <20090622135914.GA22802@torres.zugschlus.de>

Hi,

in Germany, it has become common that the major consumer ISPs do not
answer DNS requests for non-existing hostnames with NXDOMAIN, but
deliver a fake A record instead which points to a web server which
delivers a web page which says helpful things like "the page you
requested does not exists, why don't you try the search engine of our
partner vendor".

Unfortunately, this breaks setups that rely on searchdomains. For
example, if Example Inc. has its Clients configured to search inside
domains ".example.com", a user which just enters "intranet" into her
browser was correctly led to intranet.example.com. With a "modern"
ISP, the non-qualified domain name "intranet" will lead to the ISP
search help page.

Same thing happens when a Windows box is connected to a corporate
network via the Cisco VPN client since the DNS servers configured from
the VPN tunnel obviously do not override the DNS servers that are
assigned to the LAN link, but only amend them. So, the ISPs "search
help" breaks the use of unqualified domain names via searchdomains
even when the client is connected to the VPN and the default route
points to the VPN tunnel.

Can I somehow configure the Cisco router so that the VPN Client
actually _overrides_ the DNS servers that are configured on the Client
so that the ISPs name servers are never queried as long as the tunnel
is up?

Actually, how does the client reach the ISP's name servers if the
default route points into the tunnel?

Any hints will be appreciated.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 3221 2323190

From p.mayers at imperial.ac.uk  Mon Jun 22 11:32:35 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Mon, 22 Jun 2009 16:32:35 +0100
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection
In-Reply-To: <4A3BAD2B.1060602@imperial.ac.uk>
References: <4A3BAD2B.1060602@imperial.ac.uk>
Message-ID: <4A3FA413.6080302@imperial.ac.uk>

Phil Mayers wrote:
> All,
> 
> We've recently deployed config on our ACE (blades in 6500s) to provide 
> resilient DNS.
> 
> However, the ACE seems to be doing some kind of DNS inspection, and is 
> (incorrectly I think) closing the SLB session the instant a DNS answer 
> comes back. This causes problems with clients that make 2 lookups very 
> quickly, from the same source port.
> 
> i.e. I am seeing:
> 
> client sport=5000 dport=53 query id=2346 hostname A
> client sport=5000 dport=53 query id=4646 hostname AAAA
> server dport=5000 sport=53 reply id=2346 A=192.168.x.y
> 
> ...and that's it. The 2nd reply is dropped. If the client makes the 
> queries "slowly" they work fine:

Just a follow-on.

The specific issue seems to be that the ACE *requires* at least one UDP 
reply packet from the server before fully "opening" the UDP session. 
Monitoring at the "rserver" end shows for the above:

client sport=5000 dport=53 query id=2346 hostname A
server dport=5000 sport=53 reply id=2346 A=192.168.x.y

i.e. the 2nd *request* is dropped.

Once that 1st reply is sent, you can send as many queries as you want:

client sport=5000 dport=53 query id=2346 hostname A
server dport=5000 sport=53 reply id=2346 A=192.168.x.y
client sport=5000 dport=53 query id=2346 hostname1 A
client sport=5000 dport=53 query id=2346 hostname1 A
client sport=5000 dport=53 query id=2346 hostname1 A
client sport=5000 dport=53 query id=2346 hostname1 A
server dport=5000 sport=53 reply id=2346 A=192.168.x.y



> 
> client sport=5000 dport=53 query id=2346 hostname A
> server dport=5000 sport=53 reply id=2346 A=192.168.x.y
> client sport=5000 dport=53 query id=4646 hostname AAAA
> server dport=5000 sport=53 reply id=4646 AAAA=...
> 
> Our old DNS servers (via static anycast routes) and a different service 
> (via eBGP multipath anycast) don't exhibit the problem, so I'm certain 
> it's the ACE.
> 
> FYI, this causes problems with the glibc changes present in 2.10 & 
> Fedora 11 - the glibc always tries two queries in quick succession for A 
> and AAAA records, and the timeouts can destroy kerberos/ldap logins...
> 
> I'm aware of the "inspect" commands, but they're off by default and I 
> can't "no inspect"; it tells me it's already turned off.
> 
> Does anyone know if and how I can persuade the ACE to stop being so 
> "clever" and just treat the DNS as "plain old UDP"?
> 
> version info is:
> 
> Software
>    loader:    Version 12.2[120]
>    system:    Version A2(1.1) [build 3.0(0)A2(1.1) 
> adbuild_00:25:02-2008/06/05_/auto/adbu-rel3/rel_a2_1_1_throttle/REL_3_0_0_A2_1_1]
>    system image file: [LCP] disk0:c6ace-t1k9-mz.A2_1_1.bin
>    installed license: ACE-08G-LIC ACE-SEC-LIC-K9
> 
> ...and the config we're using is:
> 
> 
> serverfarm host RECURSIVE-DNS
>    transparent
>    predictor leastconns
>    probe TCP_53
>    rserver xxx 53
>      inservice
>    rserver yyy 53
>      inservice
>    rserver www 53
>      inservice
>    rserver zzz 53
>      inservice
> 
> class-map match-any VIP_SPONCON-DNS
>    2 match virtual-address 192.168.a.b udp eq domain
>    3 match virtual-address 192.168.a.b tcp eq domain
> 
> policy-map type loadbalance first-match SLB_RECURSIVE-DNS
>    class class-default
>      serverfarm RECURSIVE-DNS
> 
> policy-map multi-match VIPS_VLANxx
>    !.. various config, then
>    class VIP_SPONCON-DNS
>      loadbalance vip inservice
>      loadbalance policy SLB_RECURSIVE-DNS
>      loadbalance vip icmp-reply
>      loadbalance vip advertise
> 


From p.mayers at imperial.ac.uk  Mon Jun 22 11:37:14 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Mon, 22 Jun 2009 16:37:14 +0100
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection
In-Reply-To: <4A3FA413.6080302@imperial.ac.uk>
References: <4A3BAD2B.1060602@imperial.ac.uk> <4A3FA413.6080302@imperial.ac.uk>
Message-ID: <4A3FA52A.5020400@imperial.ac.uk>

>>
>> i.e. I am seeing:
>>
>> client sport=5000 dport=53 query id=2346 hostname A
>> client sport=5000 dport=53 query id=4646 hostname AAAA
>> server dport=5000 sport=53 reply id=2346 A=192.168.x.y
>>
>> ...and that's it. The 2nd reply is dropped. If the client makes the 
>> queries "slowly" they work fine:
> 
> Just a follow-on.

Bah. Stupid mailer. Apologies for the partial send:

> 
> The specific issue seems to be that the ACE *requires* at least one UDP 
> reply packet from the server before fully "opening" the UDP session. 
> Monitoring at the "rserver" end shows for the above:
> 
> client sport=5000 dport=53 query id=2346 hostname A
> server dport=5000 sport=53 reply id=2346 A=192.168.x.y
> 
> i.e. the 2nd *request* is dropped.
> 
> 

Once that 1st reply is sent, you can send as many queries as you want:

client sport=5000 dport=53 query id=2346 hostname A
server dport=5000 sport=53 reply id=2346 A=192.168.x.y
client sport=5000 dport=53 query id=2347 hostname1
client sport=5000 dport=53 query id=2348 hostname2
client sport=5000 dport=53 query id=2349 hostname3
server dport=5000 sport=53 reply id=2347 A=192.168.c.d
server dport=5000 sport=53 reply id=2348 A=192.168.w.v
server dport=5000 sport=53 reply id=2349 A=192.168.a.b

So, it seems to be some kind of analogous feature to TCP SYN protect or 
such like, to protect a client flooding a server.

Many thanks for all the suggestions; I have tried many combinations:

  * an "ip only" VIP i.e. not UDP-specific in the policy-map
  * UDP fast age
  * different application port/protocol

None helped. I have not yet been willing to make the (per-vlan) change 
to UDP boost since the box is in (critical) service, but it could well 
solve the problem.

So, in summary - the issue is not DNS-specific, it's some kind of UDP 
session-awareness that requires 1 reply packet before permitting 
subsequent request packets.

From p.mayers at imperial.ac.uk  Mon Jun 22 11:40:55 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Mon, 22 Jun 2009 16:40:55 +0100
Subject: [c-nsp] Layer 2 vs Layer 3 Performance Question
In-Reply-To: <C6650EF5.9B70%jluke@truarx.com>
References: <C6650EF5.9B70%jluke@truarx.com>
Message-ID: <4A3FA607.3080203@imperial.ac.uk>

> 
> So the question is, is there a difference?  I have hundreds of GB's
> to backup so if there is a performance difference one way or the
> other, I would want to know.  The only thing I can see as a
> difference is if I trunk the iSCSI vlan, then the traffic never hits
> the 6509's routing module. Maybe that helps performance?
> 

If I've understood you correctly, then there's no difference - the 6500 
will forward 1gig layer2 just as quick as 1gig layer3.

There are some possible differences if the linecard does not have a DFC, 
or is a bus-linecard and the bus is contended; it would depend on what 
other traffic was flowing through the box.

From ross at kallisti.us  Mon Jun 22 11:06:13 2009
From: ross at kallisti.us (Ross Vandegrift)
Date: Mon, 22 Jun 2009 11:06:13 -0400
Subject: [c-nsp] 6500 service modules and process switching
Message-ID: <20090622150613.GB12517@kallisti.us>

Hey everyone,

Last week's converstaion on 6500 scalaibility numbers prompted me to
dig back into the performance issues I have on a pair of boxes.  I
discovered two issues, both related to the presence of CSMs in the
chassis.  An important note about my scenario - I have two basically
identical installations, one which performs brilliantly, one which
doesn't.

The first is a semi-documented bridged mode issue.  The CSM is not
enough of a bridge to bridge traffic that stays on the server VLAN.
It must be bridged onto the client VLAN, handled by the MSFC, and then
bridged back.  (I don't have the cisco.com reference for this, but
could find it.)  It seems that if the two endpoints are
directly-connected to the client SVI, that traffic is software
switched.  This only affects servers without a direct layer 2 path on
a downstream access switch.

The second issue is a complete mystery to me.  Many flows directed at
VIPs (every flow?) on the CSM have their first packet switched in
software.  This adds up to an enormous amount of traffic for us.
We also have a well-performing pair of 6500s that do *not* display
this behavior.

I always thought that service module internal interfaces behaved just
like normal interfaces, except that they traversed the bus and not
the fabric.  Clearly, this isn't the case - there's something else
going on.

Anyone know anything about process switching the first packet of flows
to service modules?

-- 
Ross Vandegrift
ross at kallisti.us

"If the fight gets hot, the songs get hotter.  If the going gets tough,
the songs get tougher."
	--Woody Guthrie

From p.mayers at imperial.ac.uk  Mon Jun 22 11:59:08 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Mon, 22 Jun 2009 16:59:08 +0100
Subject: [c-nsp] Layer 2 vs Layer 3 Performance Question
In-Reply-To: <C665209C.9B8F%jluke@truarx.com>
References: <C665209C.9B8F%jluke@truarx.com>
Message-ID: <4A3FAA4C.2080003@imperial.ac.uk>

Jason Luke wrote:
> I actually don?t know if the linecard has a DFC. It?s an old 6509 and 
> keeping any hardware information straight on this proves to be confusing 
> to me.
> This is what I have.
> L3 Switching Engine II  WS-F6K-PFC2
> 
> 1000BaseX Supervisor      WS-X6K-SUP2-2GE    
> Multilayer Switch Feature WS-F6K-MSFC2        
> Switch Fabric Module      WS-C6500-SFM          
> 
> When you say ?some difference,? are we talking significant differences 
> here?  This is basically the singular router for the entire organization 
> (3000+ computers) so EVERYTHING flows through it. If the difference 
> might be 2 or 3 times faster, then its worth it. But if the difference 
> is marginal or a few meg per second, then its kind of irrelevant.

Hmm. I'm more familiar with the sup720/PFC3 hardware than the earlier stuff.

What IOS version are you running? Can you "show mod"?

Are the servers & backup kit on the same linecard? If the linecard lacks 
a DFC, then it's possible having them on the same VLAN would buy you 
local layer2 switching, versus a (potentially contended) layer3 lookup 
on the PFC/sup.

I can't be sure about that though - anyone know if the gigE linecards 
for sup2 switch layer2 locally?

From jluke at truarx.com  Mon Jun 22 11:50:52 2009
From: jluke at truarx.com (Jason Luke)
Date: Mon, 22 Jun 2009 11:50:52 -0400
Subject: [c-nsp] Layer 2 vs Layer 3 Performance Question
In-Reply-To: <4A3FA607.3080203@imperial.ac.uk>
Message-ID: <C665209C.9B8F%jluke@truarx.com>

I actually don't know if the linecard has a DFC. It's an old 6509 and keeping any hardware information straight on this proves to be confusing to me.
This is what I have.
L3 Switching Engine II  WS-F6K-PFC2

1000BaseX Supervisor      WS-X6K-SUP2-2GE
Multilayer Switch Feature WS-F6K-MSFC2
Switch Fabric Module      WS-C6500-SFM

When you say "some difference," are we talking significant differences here?  This is basically the singular router for the entire organization (3000+ computers) so EVERYTHING flows through it. If the difference might be 2 or 3 times faster, then its worth it. But if the difference is marginal or a few meg per second, then its kind of irrelevant.

Thanks,
Jason


On 6/22/09 11:40 AM, "Phil Mayers" <p.mayers at imperial.ac.uk> wrote:

>
> So the question is, is there a difference?  I have hundreds of GB's
> to backup so if there is a performance difference one way or the
> other, I would want to know.  The only thing I can see as a
> difference is if I trunk the iSCSI vlan, then the traffic never hits
> the 6509's routing module. Maybe that helps performance?
>

If I've understood you correctly, then there's no difference - the 6500
will forward 1gig layer2 just as quick as 1gig layer3.

There are some possible differences if the linecard does not have a DFC,
or is a bus-linecard and the bus is contended; it would depend on what
other traffic was flowing through the box.


From p.mayers at imperial.ac.uk  Mon Jun 22 12:29:26 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Mon, 22 Jun 2009 17:29:26 +0100
Subject: [c-nsp] Layer 2 vs Layer 3 Performance Question
In-Reply-To: <472702.67254.qm@web1210.biz.mail.gq1.yahoo.com>
References: <C665209C.9B8F%jluke@truarx.com> <4A3FAA4C.2080003@imperial.ac.uk>
	<472702.67254.qm@web1210.biz.mail.gq1.yahoo.com>
Message-ID: <4A3FB166.4030000@imperial.ac.uk>

Kevin Graham wrote:
> 
> 
>> Hmm. I'm more familiar with the sup720/PFC3 hardware than the earlier stuff.
> 
> Sup2/MSFC2 is same switching paths as 720, only major difference is the common
> lack of a switch fabric.
> 
>> What IOS version are you running? Can you "show mod"?
>>
>> Are the servers & backup kit on the same linecard? If the linecard lacks a DFC, 
>> then it's possible having them on the same VLAN would buy you local layer2 
>> switching, versus a (potentially contended) layer3 lookup on the PFC/sup.
> 
> What local lookup are you expecting to occur on a non-DFC linecard? Unless I'm
> missing something, you're looking at the exact same switching path for L2 or
> L3. In terms of forwarding performance, the only major difference would be an
> extreme edge case on overburdened hardware such saving a double-lookup for IPv6
> by reverting to a single lookup for L2.

To be honest, I'm not sure why I wrote that; perhaps someone more awake 
should answer ;o)

From tstevens at cisco.com  Mon Jun 22 12:44:55 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Mon, 22 Jun 2009 09:44:55 -0700
Subject: [c-nsp] Layer 2 vs Layer 3 Performance Question
In-Reply-To: <4A3FAA4C.2080003@imperial.ac.uk>
References: <C665209C.9B8F%jluke@truarx.com> <4A3FAA4C.2080003@imperial.ac.uk>
Message-ID: <200906221644.n5MGiuIH009867@sj-core-5.cisco.com>

If you have DFC on the linecard, then *everything* is distributed for 
traffic ingress on that linecard - L2, L3, ACLs, QoS, Netflow. If 
not, then it's centrally processed by the PFC for traffic ingress on 
that linecard. There is no "local L2 switching" (or any other local 
forwarding decisions) without DFC.

Based on the description and h/w list you provided (though you didn't 
provide any linecard details), there would be zero difference in 
performance of the system for L2 vs L3.

HTH,
Tim

At 08:59 AM 6/22/2009, Phil Mayers stated:

>Jason Luke wrote:
> > I actually don't know if the linecard has a DFC. It's an old 6509 and
> > keeping any hardware information straight on this proves to be confusing
> > to me.
> > This is what I have.
> > L3 Switching Engine II  WS-F6K-PFC2
> >
> > 1000BaseX Supervisor      WS-X6K-SUP2-2GE
> > Multilayer Switch Feature WS-F6K-MSFC2
> > Switch Fabric Module      WS-C6500-SFM
> >
> > When you say "some difference," are we talking significant differences
> > here?  This is basically the singular router for the entire organization
> > (3000+ computers) so EVERYTHING flows through it. If the difference
> > might be 2 or 3 times faster, then its worth it. But if the difference
> > is marginal or a few meg per second, then its kind of irrelevant.
>
>Hmm. I'm more familiar with the sup720/PFC3 hardware than the earlier stuff.
>
>What IOS version are you running? Can you "show mod"?
>
>Are the servers & backup kit on the same linecard? If the linecard lacks
>a DFC, then it's possible having them on the same VLAN would buy you
>local layer2 switching, versus a (potentially contended) layer3 lookup
>on the PFC/sup.
>
>I can't be sure about that though - anyone know if the gigE linecards
>for sup2 switch layer2 locally?
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
><https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at 
><http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From kgraham at industrial-marshmallow.com  Mon Jun 22 11:58:03 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 22 Jun 2009 08:58:03 -0700 (PDT)
Subject: [c-nsp] Layer 2 vs Layer 3 Performance Question
In-Reply-To: <C6650EF5.9B70%jluke@truarx.com>
References: <C6650EF5.9B70%jluke@truarx.com>
Message-ID: <357739.26404.qm@web1203.biz.mail.gq1.yahoo.com>




> The only thing I can see as a difference is if I trunk the iSCSI vlan, 

> then the traffic never hits the 6509's routing module. Maybe that helps 
> performance?

No. Assuming the 6500 isn't a relic with an MSM or Sup1/Sup1A, there
should be no difference in L2 and L3 forwarding performance (PFC does
both) -- if you're seeing anything but trivial CPU utilization on the
MSFC (presuming from your description that there isn't any heavy BGP
involved), then something is misconfigured.

The routed approach you have now is preferable -- namely, no unknown
unicast flooding between buildings and obvious traffic patterns between
the two.

From kgraham at industrial-marshmallow.com  Mon Jun 22 12:23:26 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 22 Jun 2009 09:23:26 -0700 (PDT)
Subject: [c-nsp] Layer 2 vs Layer 3 Performance Question
In-Reply-To: <4A3FAA4C.2080003@imperial.ac.uk>
References: <C665209C.9B8F%jluke@truarx.com> <4A3FAA4C.2080003@imperial.ac.uk>
Message-ID: <472702.67254.qm@web1210.biz.mail.gq1.yahoo.com>




> Hmm. I'm more familiar with the sup720/PFC3 hardware than the earlier stuff.

Sup2/MSFC2 is same switching paths as 720, only major difference is the common
lack of a switch fabric.

> What IOS version are you running? Can you "show mod"?
> 
> Are the servers & backup kit on the same linecard? If the linecard lacks a DFC, 
> then it's possible having them on the same VLAN would buy you local layer2 
> switching, versus a (potentially contended) layer3 lookup on the PFC/sup.

What local lookup are you expecting to occur on a non-DFC linecard? Unless I'm
missing something, you're looking at the exact same switching path for L2 or
L3. In terms of forwarding performance, the only major difference would be an
extreme edge case on overburdened hardware such saving a double-lookup for IPv6
by reverting to a single lookup for L2.

From kgraham at industrial-marshmallow.com  Mon Jun 22 12:37:56 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 22 Jun 2009 09:37:56 -0700 (PDT)
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <200906121822.n5CIM8vC018410@sj-core-2.cisco.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<4A327576.4040004@templin.org>
	<200906121246.01415.mulitskiy@acedsl.com>
	<200906121822.n5CIM8vC018410@sj-core-2.cisco.com>
Message-ID: <552214.4458.qm@web1216.biz.mail.gq1.yahoo.com>


> You are correct. That only applies to the 6148. Originally it also 

> applied to the 6548 as well, but that limitation was removed later by 
> s/w optimizations in the LTL programming scheme. So you *can* get 
> more than 1G thru an etherchannel with 6548s, but of course, you 
> still can only get 1G max thru a given port group on the card.

Does it hold though that etherchannel traffic gets replicated to all
modules with bundle members? (ie. does a bundle spanning two 6724's
consume bandwidth on both module's fabric connections, irrespective
of the egress port?) Would this also be true for ports behind
different fabrics of a dual fabric card (ie. opposite ends of a
6748)?

From tstevens at cisco.com  Mon Jun 22 13:45:59 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Mon, 22 Jun 2009 10:45:59 -0700
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <552214.4458.qm@web1216.biz.mail.gq1.yahoo.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<4A327576.4040004@templin.org>
	<200906121246.01415.mulitskiy@acedsl.com>
	<200906121822.n5CIM8vC018410@sj-core-2.cisco.com>
	<552214.4458.qm@web1216.biz.mail.gq1.yahoo.com>
Message-ID: <200906221746.n5MHk1xD007539@sj-core-2.cisco.com>

At 09:37 AM 6/22/2009, Kevin Graham stated:

> > You are correct. That only applies to the 6148. Originally it also
>
> > applied to the 6548 as well, but that limitation was removed later by
> > s/w optimizations in the LTL programming scheme. So you *can* get
> > more than 1G thru an etherchannel with 6548s, but of course, you
> > still can only get 1G max thru a given port group on the card.
>
>Does it hold though that etherchannel traffic gets replicated to all
>modules with bundle members?

No.

>  (ie. does a bundle spanning two 6724's
>consume bandwidth on both module's fabric connections, irrespective
>of the egress port?)

No, it is filtered on ingress to the fabric by the LTL/FPOE logic.

>  Would this also be true for ports behind
>different fabrics of a dual fabric card (ie. opposite ends of a
>6748)?

The filtering is effective on a per fabric channel basis, so only the 
half of the card w/the member port selected to actually tx the packet 
will get the packet over the fabric.

HTH,
Tim




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From kgraham at industrial-marshmallow.com  Mon Jun 22 14:06:40 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 22 Jun 2009 11:06:40 -0700 (PDT)
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <200906221746.n5MHk1xD007539@sj-core-2.cisco.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<4A327576.4040004@templin.org>
	<200906121246.01415.mulitskiy@acedsl.com>
	<200906121822.n5CIM8vC018410@sj-core-2.cisco.com>
	<552214.4458.qm@web1216.biz.mail.gq1.yahoo.com>
	<200906221746.n5MHk1xD007539@sj-core-2.cisco.com>
Message-ID: <277682.36796.qm@web1209.biz.mail.gq1.yahoo.com>



>> Does it hold though that etherchannel traffic gets replicated to all
>> modules with bundle members?
> No.

Got it, so the issue is only for bus traffic and whether all port asic's
grab it (6148 as discussed) or just the tx asic (as you clarified for
6548)?

> The filtering is effective on a per fabric channel basis, so only the
> half of the card w/the member port selected to actually tx the packet
> will get the packet over the fabric.

Thanks for the clarification -- I was thinking I had missed something
(bigger than usual) and had a lot of interface shuffling ahead.

From peter at rathlev.dk  Mon Jun 22 15:36:10 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 22 Jun 2009 21:36:10 +0200
Subject: [c-nsp] MPLS L3VPN w/ OSPF PE-CE
Message-ID: <1245699370.6065.180.camel@localhost.localdomain>

Hi,

We're about to expand our use of OSPF PE-CE connections in some
redundant setups, and in that regard I'd be happy to know more precisely
if I can expect all (most) customer devices to repect the DN bit.

As I understand OSPF, all customer routers should just not care about
the DN bit in all LSAs but of course propagate it. From skimming RFC2328
I can't seem to find the place where it says the "MUST" preserve all
option bits, which I guess would also exclude what a PE does according
to RFC4576.

I might just lack a general understanding of OSPF, but I'd hate to run
into some specific software/hardware version of something and not know
what's happening. So far it "just worked" where we've used it, but if
anybody can share any experiences regarding this I'd love to know. :-)


Regards,
Peter



From rekordmeister at gmail.com  Mon Jun 22 17:12:07 2009
From: rekordmeister at gmail.com (MKS)
Date: Mon, 22 Jun 2009 21:12:07 +0000
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <fad2fb270906221412j329f33d6g3f9c40981e3620e5@mail.gmail.com>

>> What alternatives are out there for a similar amount of money?

>For example ASR 1k with RP1 or RP2 end properly sized ESP. Look for the
>cisco.com site for details.

Does someone as some performance reference regarding the netflow
implementation for the ASR1K ?
How dues it scale and that sampling options are there?

Regards
MKS

From bacon at walleyesoftware.com  Mon Jun 22 17:44:46 2009
From: bacon at walleyesoftware.com (Jeff Bacon)
Date: Mon, 22 Jun 2009 16:44:46 -0500
Subject: [c-nsp] IP SLA accuracy
Message-ID: <5A69C25361FED34F83ABF05F504752450611B930@wally.walleyetrading.net>


How accurate is the new(ish) IP SLA measurement system? For local metro links with RT times in the 300-500usec range, can it monitor for variations of 100-200usec in some reasonable fashion? 

(Yes it can vary that much just dependent on queueing, load, etc. I am just curious what people's experience with it has been on fast metro links.)

-bacon

From lukasz at bromirski.net  Mon Jun 22 17:52:51 2009
From: lukasz at bromirski.net (Lukasz Bromirski)
Date: Mon, 22 Jun 2009 23:52:51 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <fad2fb270906221412j329f33d6g3f9c40981e3620e5@mail.gmail.com>
References: <fad2fb270906221412j329f33d6g3f9c40981e3620e5@mail.gmail.com>
Message-ID: <4A3FFD33.9040908@bromirski.net>

On 2009-06-22 23:12, MKS wrote:

>> For example ASR 1k with RP1 or RP2 end properly sized ESP. Look for the
>> cisco.com site for details.
> Does someone as some performance reference regarding the netflow
> implementation for the ASR1K ?
> How dues it scale and that sampling options are there?

The size of flow cache is dependent upon the ESP used.
For ESP5 it's 512k entries, for ESP10 it's 1M and for ESP20 it's 2M,
essentially the QFP is doing all the processing, RP is responsible
only for export. Sampling up to 1:1 is supported, with v5/v8/v9.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From tom at netspot.com.au  Mon Jun 22 20:05:45 2009
From: tom at netspot.com.au (Tom Lanyon)
Date: Tue, 23 Jun 2009 09:35:45 +0930
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <4A3FFD33.9040908@bromirski.net>
References: <fad2fb270906221412j329f33d6g3f9c40981e3620e5@mail.gmail.com>
	<4A3FFD33.9040908@bromirski.net>
Message-ID: <A76C129B-762E-410F-927B-593255449016@netspot.com.au>

On 23/06/2009, at 7:22 AM, Lukasz Bromirski wrote:

> On 2009-06-22 23:12, MKS wrote:
>
>>> For example ASR 1k with RP1 or RP2 end properly sized ESP. Look  
>>> for the
>>> cisco.com site for details.
>> Does someone as some performance reference regarding the netflow
>> implementation for the ASR1K ?
>> How dues it scale and that sampling options are there?
>
> The size of flow cache is dependent upon the ESP used.
> For ESP5 it's 512k entries, for ESP10 it's 1M and for ESP20 it's 2M,
> essentially the QFP is doing all the processing, RP is responsible
> only for export. Sampling up to 1:1 is supported, with v5/v8/v9.

Does anyone know how the newer architecture of the ASR1k ESP compares  
to a 7200 NPE-G2 in regards to 'all services enabled' performance? If  
I recall previous discussions on this list, it's fairly easy to  
overload the CPU on the NPE when you start enabling QoS, NetFlow,  
WCCP, FPM, etc. Do the ASR1k ESPs do this any better?

The ESP data sheets show a 50-60% pps performance decrease with  
'commonly-used features' enabled so I assume its fairly similar, but  
the ESP provides a higher maximum throughput so enabling features is  
not so much of an issue? At least with the ESP, Cisco are providing  
some theoretical maximum vs standard performance figures.

-Tom

From shinejoseph at dodo.com.au  Mon Jun 22 23:12:44 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Tue, 23 Jun 2009 11:12:44 +0800
Subject: [c-nsp] MPLS QoS
Message-ID: <4F686D7B53ED4916B07F57DBC1E0CE00@au.didata.local>

Hi,

Can anyone with SP experience state why would one choose pipe model over short pipe model or vice versa for deploying MPLS QoS?

I have been searching the cisco site and other places a for a while to get an answer.

Any pointers suggests welcome.

Thanks in advance,
Shine

From swmike at swm.pp.se  Tue Jun 23 01:24:21 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Tue, 23 Jun 2009 07:24:21 +0200 (CEST)
Subject: [c-nsp] IP SLA accuracy
In-Reply-To: <5A69C25361FED34F83ABF05F504752450611B930@wally.walleyetrading.net>
References: <5A69C25361FED34F83ABF05F504752450611B930@wally.walleyetrading.net>
Message-ID: <alpine.DEB.1.10.0906230723060.22851@uplift.swm.pp.se>

On Mon, 22 Jun 2009, Jeff Bacon wrote:

> How accurate is the new(ish) IP SLA measurement system? For local metro 
> links with RT times in the 300-500usec range, can it monitor for 
> variations of 100-200usec in some reasonable fashion?

Short answer is "no". My experience is that measurements normally varies 
by several milliseconds, and sometimes much more than that.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From zivl at gilat.net  Tue Jun 23 02:37:43 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Tue, 23 Jun 2009 09:37:43 +0300
Subject: [c-nsp] Long Uptime
In-Reply-To: <4A4054E5.8050508@mittelstaedt.us>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
	<480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>
	<EC993E87D960A541A66BF21D62AA42A623012385CA@exch2k7.gilat.local>
	<4A3E6BBE.4090401@gmail.com> <4A4054E5.8050508@mittelstaedt.us>
Message-ID: <EC993E87D960A541A66BF21D62AA42A62301238A2F@exch2k7.gilat.local>

Hey Ted, (off topic) why would you sell such a nice car? It's a classic! I'd love to get one and pimp it!


-----Original Message-----
From: Ted Mittelstaedt [mailto:tedm at mittelstaedt.us] 
Sent: Tuesday, June 23, 2009 7:07 AM
To: Sridhar Ayengar
Cc: Ziv Leyes; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Long Uptime

Sridhar Ayengar wrote:
> Ziv Leyes wrote:
>> I second that, besides, back then, there were not so many bugs as 
>> today, as with every new feature and more complex technology comes 
>> also a lot of bugs.
>> When systems were simpler, there were less problems, how many times do 
>> you remember having to hard reset your PC when using DOS 6.2 because 
>> it "hanged" and nothing else could be done?? Also, the exploits that 
>> might be there on such an old device are SO old that nobody will think 
>> to try, is like to try to find a computer with "Netbus" Trojan open 
>> for you to just hack in... heheh
> 
> Besides that, there are operating systems that can be updated without a 
> reboot.
> 

I once had a FreeBSD system at a customer site acting as a NAT router, a
486/33 with 200MB disk drive - uptime of 3 years on it.

This was before the days of sub-$100  1605's on Ebay.

The biggest obstacle to the super-long uptimes is electrical power,
IMHO.  You have to have a pretty expensive UPS that will allow
hot-swapping to even get into the game.

Speaking of long-running times for computers - I sold a 1984 Chevy
2 years ago that had a computer-controlled carb in it - while it
wasn't running continuously for 23 years, I have no doubt the thing
is still trundling along the highways today.

Ted

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************




 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************




From rdobbins at arbor.net  Tue Jun 23 02:44:01 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Tue, 23 Jun 2009 13:44:01 +0700
Subject: [c-nsp] IP SLA accuracy
In-Reply-To: <alpine.DEB.1.10.0906230723060.22851@uplift.swm.pp.se>
References: <5A69C25361FED34F83ABF05F504752450611B930@wally.walleyetrading.net>
	<alpine.DEB.1.10.0906230723060.22851@uplift.swm.pp.se>
Message-ID: <7AB5E78A-429A-4D00-A693-4A663C671C13@arbor.net>


On Jun 23, 2009, at 12:24 PM, Mikael Abrahamsson wrote:

> Short answer is "no". My experience is that measurements normally  
> varies by several milliseconds, and sometimes much more than that.


Correct, it's in the ms range.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From jr at xor.at  Tue Jun 23 02:23:11 2009
From: jr at xor.at (Johannes Resch)
Date: Tue, 23 Jun 2009 08:23:11 +0200 (CEST)
Subject: [c-nsp] MPLS QoS
In-Reply-To: <4F686D7B53ED4916B07F57DBC1E0CE00@au.didata.local>
References: <4F686D7B53ED4916B07F57DBC1E0CE00@au.didata.local>
Message-ID: <d02a5824f6e25fd315702f00922080ad.squirrel@and.xor.at>

On Tue, June 23, 2009 05:12, Shine Joseph wrote:
> Hi,
>
> Can anyone with SP experience state why would one choose pipe model over
> short pipe model or vice versa for deploying MPLS QoS?

With full pipe you get some nice benefits like the ability to classify all
user traffic only based on MPLS EXP (since traffic will always be
transported labelled only), and giving your end customers the option to
transport their customer-set DSCP value transparently through your
network.
(you can fully decouple your core QoS handling from customer-set DSCP
values).

However, there are also a few issues here:

Full pipe model requires ultimate hop popping, which has a performance
penalty on many platforms. (e.g., on 7600 with SUP720/RSP720 it forces a
recirculation of the traffic on the egress PE, effectively halving the PPS
rate of the box). On that platform, supposedly EARL8 will have the HW
capabilities of doing a label pop operation plus IP lookup at the same
time without recirculation.

Also, be sure to test HW platforms you are using well before making this
decision. We found quite a few nasty bugs related to UHP on multiple
vendors' products in the process, which lead me to think that UHP is not
really commonly used (yet).

One example - due to a HW bug on 6500/7600 3B/3BXL cards, full pipe mode
does not work at all on any 6500/7600 chassis if it is in 3B/3BXL mode (if
activated regardless, it leads to wrong imposed EXP values for traffic
IP->MPLS). This has been fixed in 3C/3CXL HW.


HTH,
-jr

From gulerozgur at yahoo.co.uk  Tue Jun 23 04:21:29 2009
From: gulerozgur at yahoo.co.uk (Ozgur Guler)
Date: Tue, 23 Jun 2009 08:21:29 +0000 (GMT)
Subject: [c-nsp] IP SLA accuracy
Message-ID: <813986.85336.qm@web25505.mail.ukl.yahoo.com>


Microseconds level precision is possible with the precision keyword.

http://www.cisco.com/en/US/docs/ios/ipsla/command/reference/sla_02.html#wp1064123

-Ozgur


--- On Mon, 22/6/09, Jeff Bacon <bacon at walleyesoftware.com> wrote:

> From: Jeff Bacon <bacon at walleyesoftware.com>
> Subject: [c-nsp] IP SLA accuracy
> To: cisco-nsp at puck.nether.net
> Date: Monday, 22 June, 2009, 10:44 PM
> 
> How accurate is the new(ish) IP SLA measurement system? For
> local metro links with RT times in the 300-500usec range,
> can it monitor for variations of 100-200usec in some
> reasonable fashion? 
> 
> (Yes it can vary that much just dependent on queueing,
> load, etc. I am just curious what people's experience with
> it has been on fast metro links.)
> 
> -bacon
> _______________________________________________
> cisco-nsp mailing list? cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


      

From rdobbins at arbor.net  Tue Jun 23 04:34:31 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Tue, 23 Jun 2009 15:34:31 +0700
Subject: [c-nsp] IP SLA accuracy
In-Reply-To: <813986.85336.qm@web25505.mail.ukl.yahoo.com>
References: <813986.85336.qm@web25505.mail.ukl.yahoo.com>
Message-ID: <FD209BDF-870C-40CC-9E75-4AB54ED674AC@arbor.net>


On Jun 23, 2009, at 3:21 PM, Ozgur Guler wrote:

> Microseconds level precision is possible with the precision keyword.


I'd urge examining its results with caution, especially on software- 
based platforms.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From swmike at swm.pp.se  Tue Jun 23 05:04:13 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Tue, 23 Jun 2009 11:04:13 +0200 (CEST)
Subject: [c-nsp] IP SLA accuracy
In-Reply-To: <813986.85336.qm@web25505.mail.ukl.yahoo.com>
References: <813986.85336.qm@web25505.mail.ukl.yahoo.com>
Message-ID: <alpine.DEB.1.10.0906231100540.22851@uplift.swm.pp.se>

On Tue, 23 Jun 2009, Ozgur Guler wrote:

>
> Microseconds level precision is possible with the precision keyword.
>
> http://www.cisco.com/en/US/docs/ios/ipsla/command/reference/sla_02.html#wp1064123

Setting the reporting to microseconds instead of milliseconds doesn't 
improve the measurement accuracy, it just moves the decimal point.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From asturluismi at gmail.com  Tue Jun 23 07:52:20 2009
From: asturluismi at gmail.com (luismi)
Date: Tue, 23 Jun 2009 13:52:20 +0200
Subject: [c-nsp] maybe a buffers issue, code to apply?
Message-ID: <1245757940.7903.3.camel@dsba-ipso>

Hi all,

We have some packet here in a 7206vxr -just moving around 60mbps-, it
shows some problems with "sh buffers"

I was using the output interpreter but it doesn't report the code
neccesary to apply to the router, neither I can use "buffer tune
automatic" since it is not supported in this IOS
(7200p-ik91s-mz.122-31.SB13.bin)

So, is there anyone with a program or with the neccesary access level to
the output interpreter to generate the buffers code to apply to the
config?

if not, well, thanks anyway :-D


From linux.yahoo at gmail.com  Tue Jun 23 09:51:48 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 23 Jun 2009 15:51:48 +0200
Subject: [c-nsp] MPLS L3VPN w/ OSPF PE-CE
In-Reply-To: <1245699370.6065.180.camel@localhost.localdomain>
References: <1245699370.6065.180.camel@localhost.localdomain>
Message-ID: <7100ed370906230651o2aa2a963vd7edd6c769e3600@mail.gmail.com>

 DN bit is not part of OSPF v2 rfc then the "MUST" is the "DEFAULT"

Why not just using RT to control your L3VPN? Do you need DN bit?

On Mon, Jun 22, 2009 at 9:36 PM, Peter Rathlev <peter at rathlev.dk> wrote:

> Hi,
>
> We're about to expand our use of OSPF PE-CE connections in some
> redundant setups, and in that regard I'd be happy to know more precisely
> if I can expect all (most) customer devices to repect the DN bit.
>
> As I understand OSPF, all customer routers should just not care about
> the DN bit in all LSAs but of course propagate it. From skimming RFC2328
> I can't seem to find the place where it says the "MUST" preserve all
> option bits, which I guess would also exclude what a PE does according
> to RFC4576.
>
> I might just lack a general understanding of OSPF, but I'd hate to run
> into some specific software/hardware version of something and not know
> what's happening. So far it "just worked" where we've used it, but if
> anybody can share any experiences regarding this I'd love to know. :-)
>
>
> Regards,
> Peter
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From wllmjbs at gmail.com  Tue Jun 23 10:37:37 2009
From: wllmjbs at gmail.com (William Jobs)
Date: Tue, 23 Jun 2009 17:37:37 +0300
Subject: [c-nsp] Cisco ME 3400s
Message-ID: <cb473160906230737h2aa7e081le4b78bf4655a5e5d@mail.gmail.com>

Hi,

I'm trying to gather information on management (add, delete, assign a port
to) of VLANs on the ME 3400 switches via SNMP. I've tried going through the
Cisco site and I've only came across the following document so far:

http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00801c6035.shtml

 but it appears some of the OIDs specified in that document don't exist on
the ME 3400 e.g. vtpVlanEditTable.

Could someone please tell me if this possible and if so where I can get more
information on how to go about it?

Thanks.

From rodunn at cisco.com  Tue Jun 23 11:11:09 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Tue, 23 Jun 2009 11:11:09 -0400
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <1245618355.2946.63.camel@localhost.localdomain>
References: <1245283261.15106.46.camel@localhost.localdomain>
	<1245345182.26970.13.camel@localhost.localdomain>
	<20090618183433.GB13882@rtp-cse-489.cisco.com>
	<1245618355.2946.63.camel@localhost.localdomain>
Message-ID: <20090623151109.GJ24837@rtp-cse-489.cisco.com>

On Sun, Jun 21, 2009 at 11:05:55PM +0200, Peter Rathlev wrote:
> On Thu, 2009-06-18 at 14:34 -0400, Rodney Dunn wrote: 
> > Curious..I don't know that platform forwarding architecture.
> > 
> > But what does 'sh int stat' give you?
> 
> We've begun running some production traffic through the box now and it
> doesn't seem to be overly loaded by more flows, but maybe it really has
> to process switch "first packets". I thought the TCAM thingy was able to
> do a hashed lookup based on source and destination IP and thus no need
> to "install" flows.
> 
> Interface stats for the two relevant interfaces (policy map attached to
> Vlan2176, policy routed traffic exits via Vlan507, non policy routed
> exist via next hop on same interface as it arrived):
> 
> Vlan507
>           Switching path    Pkts In   Chars In   Pkts Out  Chars Out
>                Processor      73750    4426830     314407   20751714
>              Route cache          1         90          0          0
>                    Total      73751    4426920     314407   20751714
> Vlan2176
>           Switching path    Pkts In   Chars In   Pkts Out  Chars Out
>                Processor     210884   13340863     323420   21776624
>              Route cache         23       5081         24       5267
>                    Total     210907   13345944     323444   21781891

I thought the newew sup/rp's would show a distributed cache line that
would show the hw forwarded counters.

> 
> And "show interfaces accounting":
> 
> Vlan507 XXX Internet
>                 Protocol    Pkts In   Chars In   Pkts Out  Chars Out
>                       IP         41       3546     315061   19534782
>                      ARP      73840    4431144         74       4440
> Vlan2176 YYY Internet
>                 Protocol    Pkts In   Chars In   Pkts Out  Chars Out
>                       IP     211382   13383337     324400   20584065
>                      ARP        571      34260        131       7860
> 
> The processor switched "Pkts In" from Vlan507 are mostly ARP. The unit
> has been live for a couple of days with light production traffic.
> 
> And the route-map:
> 
> route-map Inet_PBR, permit, sequence 10
>   Match clauses:
>     ip address (access-lists): RMIT_XXX_sources 
>   Set clauses:
>     ip next-hop A.B.C.D
>   Policy routing matches: 0 packets, 0 bytes
> route-map Inet_PBR, permit, sequence 20
>   Match clauses:
>     ip address (access-lists): RMIT_YYY_sources 
>   Set clauses:
>     ip next-hop A.B.C.E
>   Policy routing matches: 3 packets, 216 bytes
> 
> 
> > Also, sh ip traffic a couple times once you start the traffic.
> 
> The "show ip traffic" seems only to show traffic received. Should it
> also show policy routed traffic?

No. I was looking to see if there were a bunch of ICMP generated frames.

> 
> IP statistics:
>   Rcvd:  211589 total, 211565 local destination
>          0 format errors, 0 checksum errors, 24 bad hop count
>          0 unknown protocol, 0 not a gateway
>          0 security failures, 0 bad options, 0 with options
>   Opts:  0 end, 0 nop, 0 basic security, 0 loose source route
>          0 timestamp, 0 extended security, 0 record route
>          0 stream ID, 0 strict source route, 0 alert, 0 cipso, 0 ump
>          0 other
>   Frags: 0 reassembled, 0 timeouts, 0 couldn't reassemble
>          0 fragmented, 0 couldn't fragment
>   Bcast: 0 received, 0 sent
>   Mcast: 201383 received, 630608 sent
>   Sent:  639832 generated, 255251197 forwarded
>   Drop:  0 encapsulation failed, 0 unresolved, 0 no adjacency
>          0 no route, 0 unicast RPF, 0 forced drop
>          0 options denied, 0 source IP address zero
> 
> ICMP statistics:
>   Rcvd: 0 format errors, 0 checksum errors, 1 redirects, 0 unreachable
>         144 echo, 24 echo reply, 0 mask requests, 0 mask replies, 0
> quench
>         0 parameter, 0 timestamp, 0 info request, 0 other
>         0 irdp solicitations, 0 irdp advertisements
>   Sent: 0 redirects, 108 unreachable, 25 echo, 144 echo reply
>         0 mask requests, 0 mask replies, 0 quench, 0 timestamp
>         0 info reply, 386 time exceeded, 0 parameter problem
>         0 irdp solicitations, 0 irdp advertisements
> 
> TCP statistics:
>   Rcvd: 6307 total, 26 checksum errors, 30 no port
>   Sent: 4655 total
> 
> UDP statistics:
>   Rcvd: 205062 total, 0 checksum errors, 117 no port
>   Sent: 634518 total, 0 forwarded broadcasts
> 
> (... snipped irrelevant protocol counters, all zero ...)
> 
> ARP statistics:
>   Rcvd: 74386 requests, 60 replies, 0 reverse, 0 other
>   Sent: 68 requests, 152 replies (60 proxy), 0 reverse
>   Drop due to input queue full: 0
> 
> 
> The number of ARP requests is relatively high (considering it has been
> live for about a day connected a /20 prefix. This might explain the non
> interrupt CPU load (~5-10% most of the time) and is due to a
> semi-retarded legacy setup on one of the legs. That's actually the
> reason we needed the PBR: transitioning away from that.
> 
> (And why does it say "(60 proxy)" in sent ARP statistics? We have "no ip
> proxy-arp" on all interfaces of course.)

Don't know.

Rodney

> 
> Regards,
> Peter
> 

From gordon.bezzina at bell.net.mt  Tue Jun 23 12:38:30 2009
From: gordon.bezzina at bell.net.mt (Gordon Bezzina)
Date: Tue, 23 Jun 2009 18:38:30 +0200
Subject: [c-nsp] QinQ on SRB4
In-Reply-To: <mailman.1.1245772802.11229.cisco-nsp@puck.nether.net>
References: <mailman.1.1245772802.11229.cisco-nsp@puck.nether.net>
Message-ID: <001c01c9f421$0acc0250$206406f0$@bezzina@bell.net.mt>

Hi,

Has anyone got dot1q-tunnel to work on SRC, because
Same config but between 6500 (12.1(27b)E3) and 7600 (12.2(33)SRB) works
fine,
But when I try to do it between 7600 (12.2(33)SRB) and 7600 (12.2(33)SRC).

Any ideas?




From nrauhauser at gmail.com  Tue Jun 23 14:48:10 2009
From: nrauhauser at gmail.com (neal rauhauser)
Date: Tue, 23 Jun 2009 13:48:10 -0500
Subject: [c-nsp] PA-POS-OC3 to Juniper, how to configure?
Message-ID: <9515c62d0906231148j3c9a0536m48bcc30da07120c4@mail.gmail.com>

  I have a Cisco 7507 with a PA-POS-OC3 in a VIP. This is attached to some
sonet transport that ends at some sort of Juniper router. I think the tech I
got is pretty new to the large boxes and we've spent some time wrestling
with turn up. I don't know Juniper but this is what I've been sent as the
config and I follow with one of the several things I've tried with our
Cisco. Does anyone have a suggestion as to what might be missing here?


show configuration interfaces so-2/0/0
clocking external;
encapsulation ppp;
sonet-options {
    fcs 16;
    payload-scrambler;
}
unit 0 {
    family inet {
        policer {
            input 30mb-Customer;
            output 30mb-Customer;
        }
        address 192.168.81.237/30;


interface POS4/1/0
 ip address 192.168.81.238 255.255.255.252
 encapsulation ppp
 ip route-cache flow
 clock source internal
 pos scramble-atm
 pos flag c2 22



-- 
mailto:Neal at layer3arts.com //
GoogleTalk: nrauhauser at gmail.com
IM: nealrauhauser

From justin at justinshore.com  Tue Jun 23 15:06:09 2009
From: justin at justinshore.com (Justin Shore)
Date: Tue, 23 Jun 2009 14:06:09 -0500
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <A76C129B-762E-410F-927B-593255449016@netspot.com.au>
References: <fad2fb270906221412j329f33d6g3f9c40981e3620e5@mail.gmail.com>	<4A3FFD33.9040908@bromirski.net>
	<A76C129B-762E-410F-927B-593255449016@netspot.com.au>
Message-ID: <4A4127A1.6050808@justinshore.com>

Tom Lanyon wrote:

> Does anyone know how the newer architecture of the ASR1k ESP compares to 
> a 7200 NPE-G2 in regards to 'all services enabled' performance? If I 
> recall previous discussions on this list, it's fairly easy to overload 
> the CPU on the NPE when you start enabling QoS, NetFlow, WCCP, FPM, etc. 
> Do the ASR1k ESPs do this any better?

Since the ASR does most things in hardware, most of the basic features 
shouldn't hit the RP unless something is configured wrong.  Normal QoS 
and NetFlow shouldn't be a strain on the RP (except for Netflow 
exporting).  I don't know about the more unusual features like WCCP. 
You would probably fair far better on the ASR than the 7600 or 7200 for 
those I imagine.  That's my limited understanding of the ASR though. 
I'm looking at them as a replacement/upgrade for a few 7200s on our network.

Justin

From synack at live.com  Tue Jun 23 15:24:33 2009
From: synack at live.com (Darin Herteen)
Date: Tue, 23 Jun 2009 14:24:33 -0500
Subject: [c-nsp] FW:  PA-POS-OC3 to Juniper, how to configure?
In-Reply-To: <9515c62d0906231148j3c9a0536m48bcc30da07120c4@mail.gmail.com>
References: <9515c62d0906231148j3c9a0536m48bcc30da07120c4@mail.gmail.com>
Message-ID: <BLU129-W93D07D52D497F68769E62AE360@phx.gbl>




From: synack at live.com
To: nrauhauser at gmail.com
Subject: RE: [c-nsp] PA-POS-OC3 to Juniper, how to configure?
Date: Tue, 23 Jun 2009 14:19:22 -0500








I would try adding the following under the POS interface:

crc 32

That has worked for me in the past.

> Date: Tue, 23 Jun 2009 13:48:10 -0500
> From: nrauhauser at gmail.com
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] PA-POS-OC3 to Juniper, how to configure?
> 
>   I have a Cisco 7507 with a PA-POS-OC3 in a VIP. This is attached to some
> sonet transport that ends at some sort of Juniper router. I think the tech I
> got is pretty new to the large boxes and we've spent some time wrestling
> with turn up. I don't know Juniper but this is what I've been sent as the
> config and I follow with one of the several things I've tried with our
> Cisco. Does anyone have a suggestion as to what might be missing here?
> 
> 
> show configuration interfaces so-2/0/0
> clocking external;
> encapsulation ppp;
> sonet-options {
>     fcs 16;
>     payload-scrambler;
> }
> unit 0 {
>     family inet {
>         policer {
>             input 30mb-Customer;
>             output 30mb-Customer;
>         }
>         address 192.168.81.237/30;
> 
> 
> interface POS4/1/0
>  ip address 192.168.81.238 255.255.255.252
>  encapsulation ppp
>  ip route-cache flow
>  clock source internal
>  pos scramble-atm
>  pos flag c2 22
> 
> 
> 
> -- 
> mailto:Neal at layer3arts.com //
> GoogleTalk: nrauhauser at gmail.com
> IM: nealrauhauser
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

Hotmail? has ever-growing storage! Don?t worry about storage limits. Check it out.
_________________________________________________________________
Hotmail? has ever-growing storage! Don?t worry about storage limits.
http://windowslive.com/Tutorial/Hotmail/Storage?ocid=TXT_TAGLM_WL_HM_Tutorial_Storage_062009

From alasdairm at gmail.com  Tue Jun 23 15:35:35 2009
From: alasdairm at gmail.com (Alasdair McWilliam)
Date: Tue, 23 Jun 2009 20:35:35 +0100
Subject: [c-nsp] Long Uptime
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A62301238A2F@exch2k7.gilat.local>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
	<480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>
	<EC993E87D960A541A66BF21D62AA42A623012385CA@exch2k7.gilat.local>
	<4A3E6BBE.4090401@gmail.com> <4A4054E5.8050508@mittelstaedt.us>
	<EC993E87D960A541A66BF21D62AA42A62301238A2F@exch2k7.gilat.local>
Message-ID: <24D7C5A5-FBE5-4A0D-98F4-1F65ED4FE5C7@gmail.com>

We recently (within the last year) decommissioned a Cisco 5505 chassis  
that had an uptime of just over 1700 days.

The power has failed several times since the removal of the chassis  
which we found quite ironic!


On 23 Jun 2009, at 07:37, Ziv Leyes wrote:

> Hey Ted, (off topic) why would you sell such a nice car? It's a  
> classic! I'd love to get one and pimp it!
>
>
> -----Original Message-----
> From: Ted Mittelstaedt [mailto:tedm at mittelstaedt.us]
> Sent: Tuesday, June 23, 2009 7:07 AM
> To: Sridhar Ayengar
> Cc: Ziv Leyes; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Long Uptime
>
> Sridhar Ayengar wrote:
>> Ziv Leyes wrote:
>>> I second that, besides, back then, there were not so many bugs as
>>> today, as with every new feature and more complex technology comes
>>> also a lot of bugs.
>>> When systems were simpler, there were less problems, how many  
>>> times do
>>> you remember having to hard reset your PC when using DOS 6.2 because
>>> it "hanged" and nothing else could be done?? Also, the exploits that
>>> might be there on such an old device are SO old that nobody will  
>>> think
>>> to try, is like to try to find a computer with "Netbus" Trojan open
>>> for you to just hack in... heheh
>>
>> Besides that, there are operating systems that can be updated  
>> without a
>> reboot.
>>
>
> I once had a FreeBSD system at a customer site acting as a NAT  
> router, a
> 486/33 with 200MB disk drive - uptime of 3 years on it.
>
> This was before the days of sub-$100  1605's on Ebay.
>
> The biggest obstacle to the super-long uptimes is electrical power,
> IMHO.  You have to have a pretty expensive UPS that will allow
> hot-swapping to even get into the game.
>
> Speaking of long-running times for computers - I sold a 1984 Chevy
> 2 years ago that had a computer-controlled carb in it - while it
> wasn't running continuously for 23 years, I have no doubt the thing
> is still trundling along the highways today.
>
> Ted
>
>
>
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals &  
> computer viruses.
> ************************************************************************************
>
>
>
>
>
>
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals &  
> computer viruses.
> ************************************************************************************
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From sgranger at randfinancial.com  Tue Jun 23 15:13:32 2009
From: sgranger at randfinancial.com (Sean Granger)
Date: Tue, 23 Jun 2009 14:13:32 -0500
Subject: [c-nsp] NAT-able?
Message-ID: <4A40E30C020000D9000027A3@mail.randfinancial.com>

I have a customer passing traffic to me through a network we have no control over.
They don't allow private addressing, yet have only assigned a /29 for transit traffic.
Due to these addressing requirements, he is translating his internally private source addresses by overloading the address of the interface facing me.
His destinations are static deNATed by me, one to one (6 hosts).
 
The traffic is getting through the shared network and my NAT table is setting up the translation properly, short of one thing.
His destinations are on another network that I have no control over, so I need to overload the address of my interface facing it, for the return traffic to be routable.
 
So if his destination A translates to my local address B is coming from his source X which I need to retranslate to Y.
 
Looking at the NAT debug, it appears to setup correctly :
 6/23/2009 14:07 router.address Debug 3463: Jun 23 14:05:33.477 CDT: NAT*: s=y.y.y.y, d=a.a.a.a->b.b.b.b [3356]
 6/23/2009 14:07 router.address Debug 3462: Jun 23 14:05:33.477 CDT: NAT*: s=x.x.x.x->y.y.y.y, d=a.a.a.a [3356]
 6/23/2009 14:07 router.address Debug 3461: Jun 23 14:05:33.477 CDT: NAT*: o: icmp (x.x.x.x, 23609) -> (a.a.a.a, 23609) [3356]
 
'sho ip nat trans' confirms it :
Pro Inside global      Inside local       Outside local      Outside global
icmp a.a.a.a:23609 b.b.b.b:23609 y.y.y.y:23609 x.x.x.x:23609

 
Although I get a ping response from local address B from within the router (using the same address as Y, which is the neighbor interface address) ... I'm not sending a response back to my customer, even though the translation appears to be correct ... it's getting lost somewhere and I can't find the error.
 
Any thoughts?

From rick at woofpaws.com  Tue Jun 23 17:30:43 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Tue, 23 Jun 2009 14:30:43 -0700 (PDT)
Subject: [c-nsp] Policing on Catalyst 4948 (update)
Message-ID: <45575.69.30.17.85.1245792643.squirrel@www.woofpaws.com>


I posted an earlier question on whether policing on the Catalyst 4948 is
done in hardware or software.  I had a couple of non-committal "hardware"
responses.

I set up a lab with a 4948 and two hosts attached to different VLANs/SVIs
with a policy-map with class-default attached to the physical interfaces. 
Both hosts can push ~500Mbs back-to-back with iperf.

Without policing, the hosts had the same performance as back-to-back.  I
added a 5Mbs policer and let iperf run for an hour.  The CPU on the 4948
stayed at the same level as while quiescent and iperf dropped to 5Mbs.

I also added a simple ACL to a class-map and got the same results.

I want to throw a few more hosts at it for testing, but initial results
look promising.



From peter at rathlev.dk  Tue Jun 23 17:47:47 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Tue, 23 Jun 2009 23:47:47 +0200
Subject: [c-nsp] MPLS L3VPN w/ OSPF PE-CE
In-Reply-To: <7100ed370906230651o2aa2a963vd7edd6c769e3600@mail.gmail.com>
References: <1245699370.6065.180.camel@localhost.localdomain>
	<7100ed370906230651o2aa2a963vd7edd6c769e3600@mail.gmail.com>
Message-ID: <1245793667.3373.7.camel@localhost.localdomain>

On Tue, 2009-06-23 at 15:51 +0200, Manu Chao wrote:
> DN bit is not part of OSPF v2 rfc then the "MUST" is the "DEFAULT"

Some devices might think that the "unused, reserved for future use" bit
should actually be interpreted as "must be 0". I vaguely remember e.g.
PIX devices doing this for some "unused" bits somewhere in some
protocol. It would IMO be a violation of the RFC if anything were to
reset the DN bit, but RFC 4576 section 5 explicitly mentions this as a
security consideration. My worry was that some devices might
inadverently do this.

> Why not just using RT to control your L3VPN? Do you need DN bit?

I'm worried about the part the traverses the customer OSPF network. RT
doesn't propagate through the customer network.

As far as I can find out it seems like this always "just works", so I'll
put my worries to rest for now. :-)

Regards,
Peter




From peter at rathlev.dk  Tue Jun 23 17:53:51 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Tue, 23 Jun 2009 23:53:51 +0200
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <20090623151109.GJ24837@rtp-cse-489.cisco.com>
References: <1245283261.15106.46.camel@localhost.localdomain>
	<1245345182.26970.13.camel@localhost.localdomain>
	<20090618183433.GB13882@rtp-cse-489.cisco.com>
	<1245618355.2946.63.camel@localhost.localdomain>
	<20090623151109.GJ24837@rtp-cse-489.cisco.com>
Message-ID: <1245794031.3373.13.camel@localhost.localdomain>

On Tue, 2009-06-23 at 11:11 -0400, Rodney Dunn wrote:
> On Sun, Jun 21, 2009 at 11:05:55PM +0200, Peter Rathlev wrote:
> > Interface stats for the two relevant interfaces (policy map attached to
> > Vlan2176, policy routed traffic exits via Vlan507, non policy routed
> > exist via next hop on same interface as it arrived):
> > 
> > Vlan507
> >           Switching path    Pkts In   Chars In   Pkts Out  Chars Out
> >                Processor      73750    4426830     314407   20751714
> >              Route cache          1         90          0          0
> >                    Total      73751    4426920     314407   20751714
> > Vlan2176
> >           Switching path    Pkts In   Chars In   Pkts Out  Chars Out
> >                Processor     210884   13340863     323420   21776624
> >              Route cache         23       5081         24       5267
> >                    Total     210907   13345944     323444   21781891
> 
> I thought the newew sup/rp's would show a distributed cache line that
> would show the hw forwarded counters.

Well, this is a 3560 IP Services which was chosen as a relatively
inexpensive device capable of doing PBR "in hardware". So no distributed
cache for us.

> > The "show ip traffic" seems only to show traffic received. Should it
> > also show policy routed traffic?
> 
> No. I was looking to see if there were a bunch of ICMP generated frames.

Ah, ok.

I've looked more at the load of the unit as we throw more traffic at it.
It might actually be that the peaks we see are only ARP and other
traffic destined for the processor. Since it's placed on directly on teh
intar-tubes it does receive it's fair share.

I'll monitor it closely, but it actually seems to do the job very well.
Compared to a NPE-225 doing basically the same job in another but
comparable place it looks positively relaxed. :-)

Regards,
Peter



From shinejoseph at dodo.com.au  Tue Jun 23 18:05:43 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Wed, 24 Jun 2009 06:05:43 +0800
Subject: [c-nsp] MPLS QoS
References: <4F686D7B53ED4916B07F57DBC1E0CE00@au.didata.local>
	<d02a5824f6e25fd315702f00922080ad.squirrel@and.xor.at>
Message-ID: <B6F91518F9D441DCA882F1260F56627E@au.didata.local>

Thanks guys. Much apprecitaed.

Shine

----- Original Message ----- 
From: "Johannes Resch" <jr at xor.at>
To: "Shine Joseph" <shinejoseph at dodo.com.au>
Cc: <cisco-nsp at puck.nether.net>
Sent: Tuesday, June 23, 2009 2:23 PM
Subject: Re: [c-nsp] MPLS QoS


On Tue, June 23, 2009 05:12, Shine Joseph wrote:
> Hi,
>
> Can anyone with SP experience state why would one choose pipe model over
> short pipe model or vice versa for deploying MPLS QoS?

With full pipe you get some nice benefits like the ability to classify all
user traffic only based on MPLS EXP (since traffic will always be
transported labelled only), and giving your end customers the option to
transport their customer-set DSCP value transparently through your
network.
(you can fully decouple your core QoS handling from customer-set DSCP
values).

However, there are also a few issues here:

Full pipe model requires ultimate hop popping, which has a performance
penalty on many platforms. (e.g., on 7600 with SUP720/RSP720 it forces a
recirculation of the traffic on the egress PE, effectively halving the PPS
rate of the box). On that platform, supposedly EARL8 will have the HW
capabilities of doing a label pop operation plus IP lookup at the same
time without recirculation.

Also, be sure to test HW platforms you are using well before making this
decision. We found quite a few nasty bugs related to UHP on multiple
vendors' products in the process, which lead me to think that UHP is not
really commonly used (yet).

One example - due to a HW bug on 6500/7600 3B/3BXL cards, full pipe mode
does not work at all on any 6500/7600 chassis if it is in 3B/3BXL mode (if
activated regardless, it leads to wrong imposed EXP values for traffic
IP->MPLS). This has been fixed in 3C/3CXL HW.


HTH,
-jr

From frosya84 at mail.ru  Tue Jun 23 09:29:25 2009
From: frosya84 at mail.ru (=?koi8-r?Q?=EF=CC=D8=C7=C1_=F2=D5=D6=C1=CE=D3=CB=C1=D1?=)
Date: Tue, 23 Jun 2009 17:29:25 +0400
Subject: [c-nsp] SNMP MIB for EVC monitoring (Ruzhanskaya Olga)
Message-ID: <E1MJ63x-0005ZQ-00.frosya84-mail-ru@f235.mail.ru>


Hello List!
 
In our MPLS network we are planning to deploy "scalable EoMPLS" instead of "EoMPLS based on PFC (subinterfaces)".
For example, we had:
  interface gigabitethernet <ID>.subint
   encapsulation dot1q <vlanID>
   xconnect <remote loopback> <VC ID> encapsulation mpls

and we want to deploy:
   interface gigabitethernet <ID>.
     service instance <ID> ethernet
     encapsulation dot1q <vlanID>
     rewrite ingress tag pop 1 symmetric
     xconnect <remote loopback> <VC ID> encapsulation mpls
 

The main platform - 7600 (RSP720), IOS 12.2(33)SRC4.
Currently, there is no CISCO-EVC-MIB support for this IOS, and we have no opportunity to test other IOS (SRD, for example) on production network.

So, the question: does anyone have already tried to monitor the traffic load via these MIB (CISCO-EVC-MIB )? Or maybe there are other ways?


Best regards, 
Olga

 



From achatz at forthnet.gr  Wed Jun 24 02:44:43 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 24 Jun 2009 09:44:43 +0300
Subject: [c-nsp] SNMP MIB for EVC monitoring (Ruzhanskaya Olga)
In-Reply-To: <E1MJ63x-0005ZQ-00.frosya84-mail-ru@f235.mail.ru>
References: <E1MJ63x-0005ZQ-00.frosya84-mail-ru@f235.mail.ru>
Message-ID: <4A41CB5B.50503@forthnet.gr>

We're monitoring the traffic of service instances (under SRD2) just like the traffic of 
subinterfaces, ifInOctets/ifOutOctets, etc (in the latest IF-MIB, service instances are 
represented as subinterfaces and associated with an ifIndex).

No issues so far, except that we can't configure the bandwidth of service instances 
through the cli.

--
Tassos

????? ????????? wrote on 23/06/2009 16:29:
> Hello List!
>  
> In our MPLS network we are planning to deploy "scalable EoMPLS" instead of "EoMPLS based on PFC (subinterfaces)".
> For example, we had:
>   interface gigabitethernet <ID>.subint
>    encapsulation dot1q <vlanID>
>    xconnect <remote loopback> <VC ID> encapsulation mpls
> 
> and we want to deploy:
>    interface gigabitethernet <ID>.
>      service instance <ID> ethernet
>      encapsulation dot1q <vlanID>
>      rewrite ingress tag pop 1 symmetric
>      xconnect <remote loopback> <VC ID> encapsulation mpls
>  
> 
> The main platform - 7600 (RSP720), IOS 12.2(33)SRC4.
> Currently, there is no CISCO-EVC-MIB support for this IOS, and we have no opportunity to test other IOS (SRD, for example) on production network.
> 
> So, the question: does anyone have already tried to monitor the traffic load via these MIB (CISCO-EVC-MIB )? Or maybe there are other ways?
> 
> 
> Best regards, 
> Olga
> 
>  
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 

-- 
Tassos

From almog.purepeak at gmail.com  Wed Jun 24 03:35:05 2009
From: almog.purepeak at gmail.com (almog ohayon)
Date: Wed, 24 Jun 2009 10:35:05 +0300
Subject: [c-nsp] Cisco ASA digital certificate
Message-ID: <3b53747c0906240035q41470221gd9092926e0bfae02@mail.gmail.com>

Hello Everyone,I have the following requirements for small integration
project and it's not working:
1. Remote access VPN for only 1-2 users.
2. Remote users can get access to the internal network only with certificate
- software or hardware.
3. the gateway is Cisco ASA 5510.

*notes:*
1. i don't want to use Microsoft CA server or any dedicated CA server for
certificate enrollment.
2. i want to install the ASA as standalone device and the certificates will
be installed on it.
3. i can use both Cisco IPsec client or Cisco anyconnect client.


if someone has solution for me or recommendation it will be great.
if anyone think of a better security authetication solution also be great.

thanks.
--
Almog Ohayon.

From eng_mssk at hotmail.com  Wed Jun 24 04:31:32 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Wed, 24 Jun 2009 11:31:32 +0300
Subject: [c-nsp] Load sharing
Message-ID: <BLU102-W6D215E98D16037CB87534FA370@phx.gbl>


I have router 1841
and i connected leased line 4M
from the LAN side i connected 3COm switch
then ASA and another router comes 
there is a server connected to another firewall connected to the 3COM switch
now the case i want to divide the 4M between the ASA and the other router
and i want at the same time the server to have upload priority only for example 3M


_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

From eng_mssk at hotmail.com  Wed Jun 24 04:32:46 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Wed, 24 Jun 2009 11:32:46 +0300
Subject: [c-nsp] Load sharing
Message-ID: <BLU102-W27717B38955BE7381ACF49FA370@phx.gbl>


I have router 1841
and i connected leased line 4M
from the LAN side i connected 3COm switch
then ASA and another router comes 
there is a server connected to another firewall connected to the 3COM switch
now the case i want to divide the 4M between the ASA and the other router
and i want at the same time the server to have upload priority only for example 3M


_________________________________________________________________
More than messages?check out the rest of the Windows Live?.
http://www.microsoft.com/windows/windowslive/

From peter at linkstate.dk  Wed Jun 24 04:11:15 2009
From: peter at linkstate.dk (=?ISO-8859-1?Q?Peter_Kr=FCpl?=)
Date: Wed, 24 Jun 2009 10:11:15 +0200
Subject: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)
Message-ID: <58A4A6F7-6F23-4A2B-8067-5673E72CDA7F@linkstate.dk>

Hi Group,

I am currently considdering to replace a couple of juniper ERX310's,
with cisco ASR1002's. The junipers, are doing PPPoE termination for
both OinQ vlans and ATM pvc's and also DHCP for some subscribers.
The ATM part will remain on the juniper routers, as this will be
decomissioned in the near future.

We have approx. 1000 subscribers on each ERX right now, and that
stays the same for the ASR's. Maybe 2000 subscribers per box, in
2 years time.

So the task for the ASR's is to terminate QinQ and provide PPPoE
or DHCP servcies to each subscriber in order to provide them with
internet access. The ASR should also be a part of our MPLS network,
that contains Cat6500/Sup720 and Cat7600/Rsp720 boxes. As we have
some connections terminated into different VRF's, but in that case the  
service
is static confiured on the routers, so no DHCP, PPP or other stuff  
just plain IP.

It is also a reuirement that it is possible to build EoMPLS circuits  
from either
a single or double tagged vlan on the ASR to a vlan subinterface on a
Cat6500/7600.

The juniper routers today provide the DHCP service via RADIUS,
has cisco something simillar ? You can get lot's of radius servers  
that use
a database as their backend, but no decent DHCP server. This makes
subscriber  provisioning harder to do on the fly. So it would be a shame
to loose this feature. All of our subscribers have static IP's.

I have made the following shopping list:
ASR1002- 5G/K9 ASR1002 w/ESP 5G,AESK9,4GB DRAM
FLASR1- BB- RTU Broadband Right To Use Feature Lic for ASR1000 Series
FLASR1- BB- 4K Broadband 4K Sessions Feature Lic for ASR1000 Series
SASR1R1- AIS-K9 -21SR Cisco ASR 1000 Series RP1 ADVANCED IP SERVICES
SPA- 8X1GE- V2 Cisco 8 Port Gigabit Ethernet Shared Port Adapter

Would this solution workout fine ?
Any alternatives.... ?

Kind Regards,
Peter Kr?pl
















From rodunn at cisco.com  Wed Jun 24 08:17:22 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Wed, 24 Jun 2009 08:17:22 -0400
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <1245794031.3373.13.camel@localhost.localdomain>
References: <1245283261.15106.46.camel@localhost.localdomain>
	<1245345182.26970.13.camel@localhost.localdomain>
	<20090618183433.GB13882@rtp-cse-489.cisco.com>
	<1245618355.2946.63.camel@localhost.localdomain>
	<20090623151109.GJ24837@rtp-cse-489.cisco.com>
	<1245794031.3373.13.camel@localhost.localdomain>
Message-ID: <20090624121722.GG4243@rtp-cse-489.cisco.com>

I agree then. There probably is a platform level command that would
show the hw switched traffic I just don't know what it is for that
platform.

Rodney

On Tue, Jun 23, 2009 at 11:53:51PM +0200, Peter Rathlev wrote:
> On Tue, 2009-06-23 at 11:11 -0400, Rodney Dunn wrote:
> > On Sun, Jun 21, 2009 at 11:05:55PM +0200, Peter Rathlev wrote:
> > > Interface stats for the two relevant interfaces (policy map attached to
> > > Vlan2176, policy routed traffic exits via Vlan507, non policy routed
> > > exist via next hop on same interface as it arrived):
> > > 
> > > Vlan507
> > >           Switching path    Pkts In   Chars In   Pkts Out  Chars Out
> > >                Processor      73750    4426830     314407   20751714
> > >              Route cache          1         90          0          0
> > >                    Total      73751    4426920     314407   20751714
> > > Vlan2176
> > >           Switching path    Pkts In   Chars In   Pkts Out  Chars Out
> > >                Processor     210884   13340863     323420   21776624
> > >              Route cache         23       5081         24       5267
> > >                    Total     210907   13345944     323444   21781891
> > 
> > I thought the newew sup/rp's would show a distributed cache line that
> > would show the hw forwarded counters.
> 
> Well, this is a 3560 IP Services which was chosen as a relatively
> inexpensive device capable of doing PBR "in hardware". So no distributed
> cache for us.
> 
> > > The "show ip traffic" seems only to show traffic received. Should it
> > > also show policy routed traffic?
> > 
> > No. I was looking to see if there were a bunch of ICMP generated frames.
> 
> Ah, ok.
> 
> I've looked more at the load of the unit as we throw more traffic at it.
> It might actually be that the peaks we see are only ARP and other
> traffic destined for the processor. Since it's placed on directly on teh
> intar-tubes it does receive it's fair share.
> 
> I'll monitor it closely, but it actually seems to do the job very well.
> Compared to a NPE-225 doing basically the same job in another but
> comparable place it looks positively relaxed. :-)
> 
> Regards,
> Peter
> 

From david.freedman at uk.clara.net  Wed Jun 24 08:25:45 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 24 Jun 2009 13:25:45 +0100
Subject: [c-nsp] Reload without confirmation
Message-ID: <h1t609$oic$1@ger.gmane.org>

Am trying to reload a low end IOS device (c800 in this case) without
displaying a confirmation prompt.

My issue is that the platform needing to issue the command can not "see"
the VTY output so could not be expected to respond to a confirmation
prompt, looked in vain for some kind of "/noconfirm" flag but didn't
find one...

Does not appear to be possible with SNMP (even though it accepts the
snmp-server shutdown command).

My current solution is to use an EEM applet called manually with a
single action of "reload" , unfortunately this only applies to 800
images with EEM (I would guess ADV images only)

Anybody come up with a better solution?

TIA

Dave.


From david.freedman at uk.clara.net  Wed Jun 24 08:34:15 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 24 Jun 2009 13:34:15 +0100
Subject: [c-nsp] Reload without confirmation
In-Reply-To: <h1t609$oic$1@ger.gmane.org>
References: <h1t609$oic$1@ger.gmane.org>
Message-ID: <h1t6g7$ppl$1@ger.gmane.org>

Actually, seems I can just send a "reload\ny" via my vty and it accepts
it, a much simpler (if not ugly) solution.

Dave.

> 


From achatz at forthnet.gr  Wed Jun 24 08:35:01 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 24 Jun 2009 15:35:01 +0300
Subject: [c-nsp] QinQ on SRB4
In-Reply-To: <001c01c9f421$0acc0250$206406f0$@bezzina@bell.net.mt>
References: <mailman.1.1245772802.11229.cisco-nsp@puck.nether.net>
	<001c01c9f421$0acc0250$206406f0$@bezzina@bell.net.mt>
Message-ID: <4A421D75.1050701@forthnet.gr>

I have dot1q-tunnel working fine on SRB4, SRB5, SRD2.
QinQ is somewhat different from dot1q-tunnel, because it usually refers to the termination of double-tagged traffic (vs 
dot1q-tunnel which refers to the addition of an extra tag), something that is not supported on the 67xx cards.

--
Tassos

Gordon Bezzina wrote on 23/06/2009 19:38:
> Hi,
> 
> Has anyone got dot1q-tunnel to work on SRC, because
> Same config but between 6500 (12.1(27b)E3) and 7600 (12.2(33)SRB) works
> fine,
> But when I try to do it between 7600 (12.2(33)SRB) and 7600 (12.2(33)SRC).
> 
> Any ideas?
> 
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From vitya at list.ru  Wed Jun 24 08:37:43 2009
From: vitya at list.ru (victor)
Date: Wed, 24 Jun 2009 16:37:43 +0400
Subject: [c-nsp] WS-X6724+CFC and ES20 line cards
Message-ID: <op.uv0305j12vrlim@localhost.localdomain>

Hello
Regarding Cisco 7600 platform what is the difference between WS-X6724+CFC  
and ES20 line cards? I found some specs about latter but nothing useful  
about X6724.
The problem that I'm facing now is with given small ISP network blueprint  
to implement and the lack of some specified parts. I.e. I need two  
mentioned ES20 to build a domain to interconnect 2 Cisco 7600 with 2  
BRASes, 2 BRs and 2 c3750 switches for servers. Right now I only have two  
WS-X6724 and no ES20.
On the positive side on  each WS-X6724 I'm going to use no more than 8  
ports. The rest is not populated so is it a good idea to use them for my  
purpose?

wbr
Victor

-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From ip at ioshints.info  Wed Jun 24 08:56:17 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Wed, 24 Jun 2009 14:56:17 +0200
Subject: [c-nsp] Reload without confirmation
In-Reply-To: <h1t609$oic$1@ger.gmane.org>
References: <h1t609$oic$1@ger.gmane.org>
Message-ID: <001701c9f4cb$2ac3c020$0a00000a@nil.si>

I wanted to propose the EEM solution :)

How about Tclsh with "typeahead" command?

http://wiki.nil.com/Insert_responses_to_command_prompts_in_Tclsh

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/ 

> -----Original Message-----
> From: David Freedman [mailto:david.freedman at uk.clara.net] 
> Sent: Wednesday, June 24, 2009 2:26 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Reload without confirmation
> 
> Am trying to reload a low end IOS device (c800 in this case) 
> without displaying a confirmation prompt.
> 
> My issue is that the platform needing to issue the command 
> can not "see"
> the VTY output so could not be expected to respond to a 
> confirmation prompt, looked in vain for some kind of 
> "/noconfirm" flag but didn't find one...
> 
> Does not appear to be possible with SNMP (even though it 
> accepts the snmp-server shutdown command).
> 
> My current solution is to use an EEM applet called manually 
> with a single action of "reload" , unfortunately this only 
> applies to 800 images with EEM (I would guess ADV images only)
> 
> Anybody come up with a better solution?
> 
> TIA
> 
> Dave.
> 
> 
> 


From david.freedman at uk.clara.net  Wed Jun 24 08:58:36 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 24 Jun 2009 13:58:36 +0100
Subject: [c-nsp] Reload without confirmation
In-Reply-To: <001701c9f4cb$2ac3c020$0a00000a@nil.si>
References: <h1t609$oic$1@ger.gmane.org>
	<001701c9f4cb$2ac3c020$0a00000a@nil.si>
Message-ID: <4A4222FC.8020804@uk.clara.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ah, that's nice, but I really wanted something as feature independent as
possible, such a shame that the SNMP remote shutdown does not work on
this platform :(

Thanks,

Dave.


Ivan Pepelnjak wrote:
> I wanted to propose the EEM solution :)
> 
> How about Tclsh with "typeahead" command?
> 
> http://wiki.nil.com/Insert_responses_to_command_prompts_in_Tclsh
> 
> Ivan
>  
> http://www.ioshints.info/about
> http://blog.ioshints.info/ 
> 
>> -----Original Message-----
>> From: David Freedman [mailto:david.freedman at uk.clara.net] 
>> Sent: Wednesday, June 24, 2009 2:26 PM
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] Reload without confirmation
>>
>> Am trying to reload a low end IOS device (c800 in this case) 
>> without displaying a confirmation prompt.
>>
>> My issue is that the platform needing to issue the command 
>> can not "see"
>> the VTY output so could not be expected to respond to a 
>> confirmation prompt, looked in vain for some kind of 
>> "/noconfirm" flag but didn't find one...
>>
>> Does not appear to be possible with SNMP (even though it 
>> accepts the snmp-server shutdown command).
>>
>> My current solution is to use an EEM applet called manually 
>> with a single action of "reload" , unfortunately this only 
>> applies to 800 images with EEM (I would guess ADV images only)
>>
>> Anybody come up with a better solution?
>>
>> TIA
>>
>> Dave.
>>
>>
>>
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpCIvwACgkQtFWeqpgEZrLVAgCdFEMkiApM8MWX/mAmAbVULl5C
oHAAoLiJVAHaY0kvuAGn6bJxAl1q1g2a
=zVAg
-----END PGP SIGNATURE-----

From jared at puck.nether.net  Wed Jun 24 09:07:48 2009
From: jared at puck.nether.net (Jared Mauch)
Date: Wed, 24 Jun 2009 09:07:48 -0400
Subject: [c-nsp] Reload without confirmation
In-Reply-To: <h1t609$oic$1@ger.gmane.org>
References: <h1t609$oic$1@ger.gmane.org>
Message-ID: <88996DEF-CF64-4FEF-9605-E4D84B44EC02@puck.nether.net>

You can't use reload at to meet your needs?

Jared Mauch

On Jun 24, 2009, at 8:25 AM, David Freedman  
<david.freedman at uk.clara.net> wrote:

> Am trying to reload a low end IOS device (c800 in this case) without
> displaying a confirmation prompt.
>
> My issue is that the platform needing to issue the command can not  
> "see"
> the VTY output so could not be expected to respond to a confirmation
> prompt, looked in vain for some kind of "/noconfirm" flag but didn't
> find one...
>
> Does not appear to be possible with SNMP (even though it accepts the
> snmp-server shutdown command).
>
> My current solution is to use an EEM applet called manually with a
> single action of "reload" , unfortunately this only applies to 800
> images with EEM (I would guess ADV images only)
>
> Anybody come up with a better solution?
>
> TIA
>
> Dave.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From david.freedman at uk.clara.net  Wed Jun 24 09:10:51 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 24 Jun 2009 14:10:51 +0100
Subject: [c-nsp] Reload without confirmation
In-Reply-To: <88996DEF-CF64-4FEF-9605-E4D84B44EC02@puck.nether.net>
References: <h1t609$oic$1@ger.gmane.org>
	<88996DEF-CF64-4FEF-9605-E4D84B44EC02@puck.nether.net>
Message-ID: <4A4225DB.6030509@uk.clara.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

No, same problem :

#reload at 01:00
Reload scheduled for 01:00:00 BST Thu Jun 25 2009 (in 10 hours and 50
minutes) by user on vty0 (10.0.0.1)
Reload reason: Reload Command
Proceed with reload? [confirm]

#reload in 5
Reload scheduled for 14:15:10 BST Wed Jun 24 2009 (in 5 minutes) by
user on vty0 (10.0.0.1)
Reload reason: Reload Command
Proceed with reload? [confirm]

Dave.

Jared Mauch wrote:
> You can't use reload at to meet your needs?
> 
> Jared Mauch
> 
> On Jun 24, 2009, at 8:25 AM, David Freedman
> <david.freedman at uk.clara.net> wrote:
> 
>> Am trying to reload a low end IOS device (c800 in this case) without
>> displaying a confirmation prompt.
>>
>> My issue is that the platform needing to issue the command can not "see"
>> the VTY output so could not be expected to respond to a confirmation
>> prompt, looked in vain for some kind of "/noconfirm" flag but didn't
>> find one...
>>
>> Does not appear to be possible with SNMP (even though it accepts the
>> snmp-server shutdown command).
>>
>> My current solution is to use an EEM applet called manually with a
>> single action of "reload" , unfortunately this only applies to 800
>> images with EEM (I would guess ADV images only)
>>
>> Anybody come up with a better solution?
>>
>> TIA
>>
>> Dave.
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpCJdsACgkQtFWeqpgEZrKvBACfbYQtmF5uafzBsT5a5/PKG+yc
F9AAn3FACyAOtutlm5IsjA0RBe/DDsFW
=wWko
-----END PGP SIGNATURE-----

From david.freedman at uk.clara.net  Wed Jun 24 10:03:47 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 24 Jun 2009 15:03:47 +0100
Subject: [c-nsp] Reload without confirmation
In-Reply-To: <F2207DB22012F94E92D7030F81A2629402297CEC@twt-exch.milano.twt>
References: <h1t609$oic$1@ger.gmane.org><88996DEF-CF64-4FEF-9605-E4D84B44EC02@puck.nether.net>
	<4A4225DB.6030509@uk.clara.net>
	<F2207DB22012F94E92D7030F81A2629402297CEC@twt-exch.milano.twt>
Message-ID: <4A423243.5040302@uk.clara.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yes, unfortunately it does take the command but alas does not work:

Router(config)#snmp-server system-shutdown
Router(config)#end
Router#
Router#sh run | in shutdown
snmp-server system-shutdown

$ snmpset -v2c -c private 10.0.0.2 1.3.6.1.4.1.9.2.9.9.0 i 2
Error in packet.
Reason: noCreation (That table does not support row creation or that
object can not ever be created)
Failed object: SNMPv2-SMI::enterprises.9.2.9.9.0

$ snmpwalk -v2c -c private 10.0.0.2 .1.3.6.1.4.1.9.2.9
SNMPv2-SMI::enterprises.9.2.9 = No Such Object available on this agent
at this OID

Router# sh ver
Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version
12.4(20)T1, RELEASE SOFTWARE (fc3)

so using modern 12.4(T) and ADVIP image , perhaps I'm using outdated MIB?

Dave.


Brian Turnbow wrote:
> In the past I used snmp dto do this, you need to enable
> snmp-server system-shutdown 
> Before it is possible, and it is not possible on all platforms, but is it takes this command it should work
> I don't have the mib handy , but can dig for it if you can't find it
> 
> 
> Brian  
> 
> 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of David Freedman
> Sent: mercoled? 24 giugno 2009 15.11
> To: Jared Mauch; 'Cisco-nsp'
> Subject: Re: [c-nsp] Reload without confirmation
> 
> No, same problem :
> 
> #reload at 01:00
> Reload scheduled for 01:00:00 BST Thu Jun 25 2009 (in 10 hours and 50
> minutes) by user on vty0 (10.0.0.1)
> Reload reason: Reload Command
> Proceed with reload? [confirm]
> 
> #reload in 5
> Reload scheduled for 14:15:10 BST Wed Jun 24 2009 (in 5 minutes) by
> user on vty0 (10.0.0.1)
> Reload reason: Reload Command
> Proceed with reload? [confirm]
> 
> Dave.
> 
> Jared Mauch wrote:
>> You can't use reload at to meet your needs?
> 
>> Jared Mauch
> 
>> On Jun 24, 2009, at 8:25 AM, David Freedman
>> <david.freedman at uk.clara.net> wrote:
> 
>>> Am trying to reload a low end IOS device (c800 in this case) without
>>> displaying a confirmation prompt.
>>>
>>> My issue is that the platform needing to issue the command can not "see"
>>> the VTY output so could not be expected to respond to a confirmation
>>> prompt, looked in vain for some kind of "/noconfirm" flag but didn't
>>> find one...
>>>
>>> Does not appear to be possible with SNMP (even though it accepts the
>>> snmp-server shutdown command).
>>>
>>> My current solution is to use an EEM applet called manually with a
>>> single action of "reload" , unfortunately this only applies to 800
>>> images with EEM (I would guess ADV images only)
>>>
>>> Anybody come up with a better solution?
>>>
>>> TIA
>>>
>>> Dave.
>>>
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpCMkMACgkQtFWeqpgEZrJtBQCg1GyFyviPBeBATJK4NVfGCQtZ
EWYAoImBYeLufvWu5/VciSpFBAAjVwBM
=B9D1
-----END PGP SIGNATURE-----

From mhuff at ox.com  Wed Jun 24 10:16:31 2009
From: mhuff at ox.com (Matthew Huff)
Date: Wed, 24 Jun 2009 10:16:31 -0400
Subject: [c-nsp] C6509/Sup7203B QoS Visibility
In-Reply-To: <4A423243.5040302@uk.clara.net>
References: <h1t609$oic$1@ger.gmane.org><88996DEF-CF64-4FEF-9605-E4D84B44EC02@puck.nether.net>
	<4A4225DB.6030509@uk.clara.net>
	<F2207DB22012F94E92D7030F81A2629402297CEC@twt-exch.milano.twt>
	<4A423243.5040302@uk.clara.net>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C143FE@PUR-EXCH07.ox.com>

Is there any way with a C6509/Sup3203B with X6548 or X6748 linecards to show a counter of each dscp ingress value? For example, with trust dscp, I would like to know how many EF packets have inbound on a port. Any suggestions? Netflow export appears to be inconsistent, but I'm investigating.



----
Matthew Huff       | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff  | Fax:   914-460-4139

From gert at greenie.muc.de  Wed Jun 24 10:25:48 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 24 Jun 2009 16:25:48 +0200
Subject: [c-nsp] WS-X6724+CFC and ES20 line cards
In-Reply-To: <op.uv0305j12vrlim@localhost.localdomain>
References: <op.uv0305j12vrlim@localhost.localdomain>
Message-ID: <20090624142548.GF290@greenie.muc.de>

Hi,

On Wed, Jun 24, 2009 at 04:37:43PM +0400, victor wrote:
> Regarding Cisco 7600 platform what is the difference between WS-X6724+CFC  
> and ES20 line cards? 

Price, and features.  Especially price.  And a bit price.

Extra features of ES20 as compared to 6724 are:

 - VPLS
 - QinQ termination (and re-sorting and stuff)
 - independent VLAN numbers
 - much more powerful QoS

> I found some specs about latter but nothing useful  
> about X6724.
> The problem that I'm facing now is with given small ISP network blueprint  
> to implement and the lack of some specified parts. I.e. I need two  
> mentioned ES20 to build a domain to interconnect 2 Cisco 7600 with 2  
> BRASes, 2 BRs and 2 c3750 switches for servers. Right now I only have two  
> WS-X6724 and no ES20.

Why do you think you need ES20s here?

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090624/e9a09e42/attachment-0001.bin>

From braaen at zcorum.com  Wed Jun 24 10:27:29 2009
From: braaen at zcorum.com (Brian Raaen)
Date: Wed, 24 Jun 2009 10:27:29 -0400
Subject: [c-nsp] Cisco ASA digital certificate
In-Reply-To: <3b53747c0906240035q41470221gd9092926e0bfae02@mail.gmail.com>
References: <3b53747c0906240035q41470221gd9092926e0bfae02@mail.gmail.com>
Message-ID: <4A4237D1.1000502@zcorum.com>

You can try openca.  http://www.openca.org/

almog ohayon wrote:
> Hello Everyone,I have the following requirements for small integration
> project and it's not working:
> 1. Remote access VPN for only 1-2 users.
> 2. Remote users can get access to the internal network only with certificate
> - software or hardware.
> 3. the gateway is Cisco ASA 5510.
>
> *notes:*
> 1. i don't want to use Microsoft CA server or any dedicated CA server for
> certificate enrollment.
> 2. i want to install the ASA as standalone device and the certificates will
> be installed on it.
> 3. i can use both Cisco IPsec client or Cisco anyconnect client.
>
>
> if someone has solution for me or recommendation it will be great.
> if anyone think of a better security authetication solution also be great.
>
> thanks.
> --
> Almog Ohayon.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

-- 
-----------------
Brian Raaen
Network Engineer
email: /braaen at zcorum.com/ <mailto:braaen at zcorum.com>
Telephone /678-507-5000x5574/

From p.mayers at imperial.ac.uk  Wed Jun 24 10:31:57 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Wed, 24 Jun 2009 15:31:57 +0100
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection
In-Reply-To: <4A3FA52A.5020400@imperial.ac.uk>
References: <4A3BAD2B.1060602@imperial.ac.uk> <4A3FA413.6080302@imperial.ac.uk>
	<4A3FA52A.5020400@imperial.ac.uk>
Message-ID: <4A4238DD.8030307@imperial.ac.uk>

> So, it seems to be some kind of analogous feature to TCP SYN protect or 
> such like, to protect a client flooding a server.

All,

Cisco have identified this as a bug, fixed in 1.5 - CSCsw52831 / 
CSCsu42225 "udp packets are dropped by ace". It's a timing-related issue 
in session setup.

Many thanks to the guys at TAC, who were extremely quick and effective 
on this, and thanks to all who gave suggestions on the list.

From b.turnbow at twt.it  Wed Jun 24 09:41:53 2009
From: b.turnbow at twt.it (Brian Turnbow)
Date: Wed, 24 Jun 2009 15:41:53 +0200
Subject: [c-nsp] Reload without confirmation
In-Reply-To: <4A4225DB.6030509@uk.clara.net>
References: <h1t609$oic$1@ger.gmane.org><88996DEF-CF64-4FEF-9605-E4D84B44EC02@puck.nether.net>
	<4A4225DB.6030509@uk.clara.net>
Message-ID: <F2207DB22012F94E92D7030F81A2629402297CEC@twt-exch.milano.twt>

In the past I used snmp dto do this, you need to enable
snmp-server system-shutdown 
Before it is possible, and it is not possible on all platforms, but is it takes this command it should work
I don't have the mib handy , but can dig for it if you can't find it


Brian  


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of David Freedman
Sent: mercoled? 24 giugno 2009 15.11
To: Jared Mauch; 'Cisco-nsp'
Subject: Re: [c-nsp] Reload without confirmation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

No, same problem :

#reload at 01:00
Reload scheduled for 01:00:00 BST Thu Jun 25 2009 (in 10 hours and 50
minutes) by user on vty0 (10.0.0.1)
Reload reason: Reload Command
Proceed with reload? [confirm]

#reload in 5
Reload scheduled for 14:15:10 BST Wed Jun 24 2009 (in 5 minutes) by
user on vty0 (10.0.0.1)
Reload reason: Reload Command
Proceed with reload? [confirm]

Dave.

Jared Mauch wrote:
> You can't use reload at to meet your needs?
> 
> Jared Mauch
> 
> On Jun 24, 2009, at 8:25 AM, David Freedman
> <david.freedman at uk.clara.net> wrote:
> 
>> Am trying to reload a low end IOS device (c800 in this case) without
>> displaying a confirmation prompt.
>>
>> My issue is that the platform needing to issue the command can not "see"
>> the VTY output so could not be expected to respond to a confirmation
>> prompt, looked in vain for some kind of "/noconfirm" flag but didn't
>> find one...
>>
>> Does not appear to be possible with SNMP (even though it accepts the
>> snmp-server shutdown command).
>>
>> My current solution is to use an EEM applet called manually with a
>> single action of "reload" , unfortunately this only applies to 800
>> images with EEM (I would guess ADV images only)
>>
>> Anybody come up with a better solution?
>>
>> TIA
>>
>> Dave.
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpCJdsACgkQtFWeqpgEZrKvBACfbYQtmF5uafzBsT5a5/PKG+yc
F9AAn3FACyAOtutlm5IsjA0RBe/DDsFW
=wWko
-----END PGP SIGNATURE-----
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From bitkraft at gmail.com  Wed Jun 24 11:26:56 2009
From: bitkraft at gmail.com (Brian Spade)
Date: Wed, 24 Jun 2009 08:26:56 -0700
Subject: [c-nsp] no negotiation on the ASR
Message-ID: <505b616c0906240826m2ed4e29fu960c920cb16623ad@mail.gmail.com>

Hi,

I need to move a link tonight from a 6500 to an ASR.  This link requires no
negotiation per the carrier.  On the 6500, this is currently configured --
"speed nonegotiate".

However, the ASR does not have this option:

tk-rtr1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
tk-rtr1(config)#int gig0/0/3
tk-rtr1(config-if)#no shut

tk-rtr1(config-if)#speed ?
% Unrecognized command

tk-rtr1(config-if)#negotiation ?
  auto  Perform link autonegotiation

Am I mistaken that the ASR can't do this??

Thanks,
/bs

From bitkraft at gmail.com  Wed Jun 24 11:31:40 2009
From: bitkraft at gmail.com (Brian Spade)
Date: Wed, 24 Jun 2009 08:31:40 -0700
Subject: [c-nsp] no negotiation on the ASR
In-Reply-To: <505b616c0906240826m2ed4e29fu960c920cb16623ad@mail.gmail.com>
References: <505b616c0906240826m2ed4e29fu960c920cb16623ad@mail.gmail.com>
Message-ID: <505b616c0906240831r69235701r683f8525028a26ca@mail.gmail.com>

Hmm.. looks like I am answering my own question... :-)

Seems like the command is 'no negotiation auto'

If you beg to differ, please speak up! :-)

/bs

On Wed, Jun 24, 2009 at 8:26 AM, Brian Spade <bitkraft at gmail.com> wrote:

> Hi,
>
> I need to move a link tonight from a 6500 to an ASR.  This link requires no
> negotiation per the carrier.  On the 6500, this is currently configured --
> "speed nonegotiate".
>
> However, the ASR does not have this option:
>
> tk-rtr1#conf t
> Enter configuration commands, one per line.  End with CNTL/Z.
> tk-rtr1(config)#int gig0/0/3
> tk-rtr1(config-if)#no shut
>
> tk-rtr1(config-if)#speed ?
> % Unrecognized command
>
> tk-rtr1(config-if)#negotiation ?
>   auto  Perform link autonegotiation
>
> Am I mistaken that the ASR can't do this??
>
> Thanks,
> /bs
>

From achatz at forthnet.gr  Wed Jun 24 11:36:16 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 24 Jun 2009 18:36:16 +0300
Subject: [c-nsp] C6509/Sup7203B QoS Visibility
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C381C143FE@PUR-EXCH07.ox.com>
References: <h1t609$oic$1@ger.gmane.org><88996DEF-CF64-4FEF-9605-E4D84B44EC02@puck.nether.net>	<4A4225DB.6030509@uk.clara.net>	<F2207DB22012F94E92D7030F81A2629402297CEC@twt-exch.milano.twt>	<4A423243.5040302@uk.clara.net>
	<483E6B0272B0284BA86D7596C40D29F9C381C143FE@PUR-EXCH07.ox.com>
Message-ID: <4A4247F0.5020904@forthnet.gr>

Maybe you can create an acl with all values and (if using the right supervisor) you can check the acl hits.

I wish there was something like the "sh mls qos int stat" that exists on the 3750s.

--
Tassos

Matthew Huff wrote on 24/06/2009 17:16:
> Is there any way with a C6509/Sup3203B with X6548 or X6748 linecards to show a counter of each dscp ingress value? For example, with trust dscp, I would like to know how many EF packets have inbound on a port. Any suggestions? Netflow export appears to be inconsistent, but I'm investigating.
> 
> 
> 
> ----
> Matthew Huff       | One Manhattanville Rd
> OTA Management LLC | Purchase, NY 10577
> http://www.ox.com  | Phone: 914-460-4039
> aim: matthewbhuff  | Fax:   914-460-4139
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From psirt at cisco.com  Wed Jun 24 12:00:00 2009
From: psirt at cisco.com (Cisco Systems Product Security Incident Response Team)
Date: Wednesday, 24 June 2009 11:00:00 -0500
Subject: [c-nsp] Cisco Security Advisory: Cisco Physical Access Gateway
	Denial of Service Vulnerability
Message-ID: <200906241100.gateway@psirt.cisco.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Cisco Physical Access Gateway Denial of
Service Vulnerability

Advisory ID: cisco-sa-20090624-gateway

Revision 1.0

For Public Release 2009 June 24 1600 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A denial of service (DoS) vulnerability exists in the Cisco Physical
Access Gateway. There are no workarounds available to mitigate the
vulnerability. This vulnerability has been corrected in Cisco
Physical Access Gateway software version 1.1. Cisco has released free
software updates that address this vulnerability.

This advisory is posted at:

 http://www.cisco.com/warp/public/707/cisco-sa-20090624-gateway.shtml

Affected Products
=================

Vulnerable Products
+------------------

Cisco Physical Access Gateway running software versions prior to 1.1
are vulnerable.

Products Confirmed Not Vulnerable
+--------------------------------

Cisco Physical Access Gateway running software versions 1.1 or later
are not vulnerable. No other Cisco products are currently known to be
affected by this vulnerability.

Details
=======

The Cisco Physical Access Gateway is the primary means for the Cisco
Physical Access Control solution to connect door hardware, such as
locks and readers, to an IP network. Certain crafted TCP port 443
packets may cause a memory leak that could lead to a denial of
service (DoS) condition in the Cisco Physical Access Gateway. A TCP
three-way handshake is needed to exploit this vulnerability.

This vulnerability is documented in Cisco Bug ID CSCsu95864 and has
been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2009-1163.

Vulnerability Scoring Details
=============================

Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding
CVSS at:

http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html

Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:

http://intellishield.cisco.com/security/alertmanager/cvss

CSCsu95864 - Memory leak with certain IP packets

CVSS Base Score - 7.8

Access Vector           - Network
Access Complexity       - Low
Authentication          - None
Confidentiality Impact  - None
Integrity Impact        - None
Availability Impact     - Complete

CVSS Temporal Score - 6.4

Exploitability          - Functional
Remediation Level       - Official-Fix
Report Confidence       - Confirmed

Impact
======

Successful exploitation of the vulnerability described in this
document may result in a memory leak. The issue could be repeatedly
exploited to cause an extended DoS condition. Connected door
hardware, such as card readers, locks, and other input/output devices
will function intermittently during extended DoS exploitation. Doors
will remain open or locked depending on the gateway's configuration.

Software Versions and Fixes
===========================

When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.

This vulnerability has been corrected in Cisco Physical Access
Gateway software version 1.1 and can be downloaded from the following
link:

http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=280588231

Workarounds
===========

No workarounds are available; however, mitigations that can be
deployed on Cisco devices within the network are available in the
Cisco Applied Mitigation Bulletin companion document for this
advisory, which is available at the following link:

http://www.cisco.com/warp/public/707/cisco-amb-20090624-gateway.shtml

Obtaining Fixed Software
========================

Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing, or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:

http:/ www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html

or as otherwise set forth at Cisco.com Downloads at:

http://www.cisco.com/public/sw-center/sw-usingswc.shtml

Do not contact psirt at cisco.com or security-alert at cisco.com for
software upgrades.

Customers with Service Contracts
+-------------------------------

Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.

Customers using Third Party Support Organizations
+------------------------------------------------

Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.

Customers without Service Contracts
+----------------------------------

Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac at cisco.com

Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.

Refer to:

http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html

for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various languages.

Exploitation and Public Announcements
=====================================

The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.

This vulnerability was found during internal testing.

Status of this Notice: FINAL
============================

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.

Distribution
============

This advisory is posted on Cisco's worldwide website at :

http://www.cisco.com/warp/public/707/cisco-sa-20090624-gateway.shtml

In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.

  * cust-security-announce at cisco.com
  * first-bulletins at lists.first.org
  * bugtraq at securityfocus.com
  * vulnwatch at vulnwatch.org
  * cisco at spot.colorado.edu
  * cisco-nsp at puck.nether.net
  * full-disclosure at lists.grok.org.uk
  * comp.dcom.sys.cisco at newsgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.

Revision History
================

+---------------------------------------+
| Revision |              | Initial     |
| 1.0      | 2009-June-24 | public      |
|          |              | release     |
+---------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

This includes instructions for press inquiries regarding Cisco security notices.
All Cisco security advisories are available at:

http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----

iD8DBQFKQkn886n/Gc8U/uARArPGAJ9nfApuGoc+vhDOdoMMsmJCQCYlewCgmNk3
Fumou3/8V80HhnX9X+i8HUw=
=8C2N
-----END PGP SIGNATURE-----

From psirt at cisco.com  Wed Jun 24 11:30:00 2009
From: psirt at cisco.com (Cisco Systems Product Security Incident Response Team)
Date: Wedenesday, 24 June 2009 10:30:00 -0500 
Subject: [c-nsp] Cisco Security Advisory: Vulnerabilities in Cisco Video
	Surveillance Products
Message-ID: <200906241030.video@psirt.cisco.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Vulnerabilities in Cisco Video Surveillance
Products

Advisory ID: cisco-sa-20090624-video

Revision 1.0

For Public Release 2009 June 24 1600 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

Cisco Video Surveillance Stream Manager firmware for the Cisco Video
Surveillance Services Platforms and Cisco Video Surveillance
Integrated Services Platforms contain a denial of service (DoS)
vulnerability that could result in a reboot on systems that receive a
crafted packet.

Cisco Video Surveillance 2500 Series IP Cameras contain an
information disclosure vulnerability that could allow an
authenticated user to view any file on a vulnerable camera.

Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.

This advisory is posted at:

http://www.cisco.com/warp/public/707/cisco-sa-20090624-video.shtml

Affected Products
=================

Vulnerable Products
+------------------

The following products are vulnerable:

  * Cisco Video Surveillance Stream Manager firmware for the Cisco
    Video Surveillance Services Platform versions prior to 5.3
  * Cisco Video Surveillance Stream Manager firmware for the Cisco
    Video Surveillance Integrated Services Platform versions prior to
    5.3
  * Cisco Video Surveillance 2500 Series IP Camera firmware versions
    prior to 2.1

Products Confirmed Not Vulnerable
+--------------------------------

No other Cisco products are currently known to be affected by these
vulnerabilities.

Details
=======

Cisco Video Surveillance Services Platforms and Cisco Video
Surveillance Integrated Services Platforms are vulnerable to a DoS
condition. An attacker could exploit this vulnerability by sending a
crafted packet to UDP port 37000, which could cause the crash of a
critical process and result in a system reboot. This vulnerability is
documented in Cisco Bug ID CSCsj47924 and has been assigned Common
Vulnerabilities and Exposures (CVE) identifier CVE-2009-2045.

Cisco Video Surveillance 2500 Series IP Cameras contain an
information disclosure vulnerability. An authenticated user may be
able to access a vulnerable camera and view any file through the
embedded web server on TCP ports 80 (HTTP) and/or 443 (HTTPS),
depending on the camera configuration. This vulnerability is
documented in Cisco Bug IDs CSCsu05515 and CSCsr96497 (Wireless
Cameras) and has been assigned Common Vulnerabilities and Exposures
(CVE) identifier CVE-2009-2046.

Vulnerability Scoring Details
=============================

Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding
CVSS at:

http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html

Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:

http://intellishield.cisco.com/security/alertmanager/cvss


CSCsj47924 - Malformed payload to xvcrman process causes reboot

CVSS Base Score - 7.8

Access Vector           - Network
Access Complexity       - Low
Authentication          - None
Confidentiality Impact  - None
Integrity Impact        - None
Availability Impact     - Complete

CVSS Temporal Score - 6.4

Exploitability          - Functional
Remediation Level       - Official-Fix
Report Confidence       - Confirmed

CSCsu05515 - SD Camera Web Server Will Display any File on System

CVSS Base Score - 6.8

Access Vector           - Network
Access Complexity       - Low
Authentication          - Single
Confidentiality Impact  - Complete
Integrity Impact        - None
Availability Impact     - None

CVSS Temporal Score - 5.6

Exploitability          - Functional
Remediation Level       - Official-Fix
Report Confidence       - Confirmed

CSCsr96497 - Wireless Camera HTTP Server Will Display any File on System

CVSS Base Score - 6.8

Access Vector           - Network
Access Complexity       - Low
Authentication          - Single
Confidentiality Impact  - Complete
Integrity Impact        - None
Availability Impact     - None

CVSS Temporal Score - 5.6

Exploitability          - Functional
Remediation Level       - Official-Fix
Report Confidence       - Confirmed

Impact
======

Successful exploitation of the Cisco Video Surveillance Stream
Manager firmware vulnerability could cause a system reboot. Repeated
exploitation may result in an extended DoS condition, which could
prevent administrators from viewing video surveillance feeds.

Successful exploitation of the Cisco Video Surveillance 2500 Series
IP Cameras vulnerability could allow an authenticated user to view
any file on a vulnerable camera. This vulnerability could allow a
non-privileged user to obtain privileged access.

Software Versions and Fixes
===========================

When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.

Cisco Video Surveillance Stream Manager firmware for the Cisco Video
Surveillance Services Platform version 5.3 is available for download
here:

http://tools.cisco.com/support/downloads/go/ReleaseType.x?optPlat=Linux&isPlatform=Y&mdfid=281158836&sftType=Video+Surveillance+Stream+Manager+Services+Platform+Firmware&treeName=Cisco+Physical+Security&modelName=Cisco+Video+Surveillance+Services+Platform&mdfLevel=Model&treeMdfId=280588231&modifmdfid=null&imname=&hybrid=Y&imst=N

Cisco Video Surveillance Stream Manager firmware for the Cisco Video
Surveillance Integrated Services Platform version 5.3 is available
for download here:

http://tools.cisco.com/support/downloads/go/ReleaseType.x?optPlat=Linux&isPlatform=Y&mdfid=281158834&sftType=Video+Surveillance+Stream+Manager+Services+Platform+Firmware&treeName=Cisco+Physical+Security&modelName=Cisco+Video+Surveillance+Integrated+Services+Platform&mdfLevel=Model&treeMdfId=280588231&modifmdfid=null&imname=&hybrid=Y&imst=N

Cisco Video Surveillance 2500 Series IP Camera firmware version 2.1
is available for download here:

http://tools.cisco.com/support/downloads/go/ReleaseType.x?optPlat=Linux&isPlatform=Y&mdfid=282052803&sftType=Video+Surveillance+IP+Camera+Firmware&treeName=Cisco+Physical+Security&modelName=Cisco+Video+Surveillance+2500+IP+Camera&mdfLevel=Model&treeMdfId=280588231&modifmdfid=null&imname=&hybrid=null&imst=null

Workarounds
===========

Although there are no workarounds for these vulnerabilities, it is
possible to mitigate the vulnerabilities through the use of network
filters. Administrators are advised to restrict access to UDP port
37000 on vulnerable Cisco Video Surveillance Services Platform and
Integrated Services Platform systems to trusted hosts. On Cisco Video
Surveillance 2500 Series IP Cameras, administrators are advised to
restrict access to TCP ports 80 and 443 to trusted hosts.

Additional mitigations that can be deployed on Cisco devices within
the network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:

http://www.cisco.com/warp/public/707/cisco-amb-20090624-video.shtml

Obtaining Fixed Software
========================

Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing, or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:

http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html

or as otherwise set forth at Cisco.com Downloads at:

http://www.cisco.com/public/sw-center/sw-usingswc.shtml

Do not contact psirt at cisco.com or security-alert at cisco.com for
software upgrades.

Customers with Service Contracts
+-------------------------------

Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.

Customers using Third Party Support Organizations
+------------------------------------------------

Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.

Customers without Service Contracts
+----------------------------------

Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac at cisco.com

Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.

Refer to:

http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html

for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various languages.

Exploitation and Public Announcements
=====================================

The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.

These vulnerabilities were discovered by Cisco.

Status of this Notice: FINAL
============================

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.

Distribution
============

This advisory is posted on Cisco's worldwide website at:

http://www.cisco.com/warp/public/707/cisco-sa-20090624-video.shtml

In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.

  * cust-security-announce at cisco.com
  * first-bulletins at lists.first.org
  * bugtraq at securityfocus.com
  * vulnwatch at vulnwatch.org
  * cisco at spot.colorado.edu
  * cisco-nsp at puck.nether.net
  * full-disclosure at lists.grok.org.uk
  * comp.dcom.sys.cisco at newsgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.

Revision History
================

+---------------------------------------+
| Revision |              | Initial     |
| 1.0      | 2009-June-24 | public      |
|          |              | release     |
+---------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:

http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----

iD8DBQFKQkGx86n/Gc8U/uARAv9aAJ98pru089mBxS+23qKumIpdlUdl9QCeMtnx
K6USkfYe27MzZyC0XLW4U5s=
=CjER
-----END PGP SIGNATURE-----

From rodunn at cisco.com  Wed Jun 24 13:45:40 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Wed, 24 Jun 2009 13:45:40 -0400
Subject: [c-nsp] Load sharing
In-Reply-To: <BLU102-W27717B38955BE7381ACF49FA370@phx.gbl>
References: <BLU102-W27717B38955BE7381ACF49FA370@phx.gbl>
Message-ID: <20090624174540.GO4919@rtp-cse-489.cisco.com>

On Wed, Jun 24, 2009 at 11:32:46AM +0300, Mohammad Khalil wrote:
> 
> I have router 1841
> and i connected leased line 4M
> from the LAN side i connected 3COm switch
> then ASA and another router comes 
> there is a server connected to another firewall connected to the 3COM switch
> now the case i want to divide the 4M between the ASA and the other router
> and i want at the same time the server to have upload priority only for example 3M

Define a QOS policy and apply it to the 4M line.

You can allocate BW to each class and "police" it too if you want to cap it.

Rodney

> 
> 
> _________________________________________________________________
> More than messages?check out the rest of the Windows Live?.
> http://www.microsoft.com/windows/windowslive/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From A.L.M.Buxey at lboro.ac.uk  Wed Jun 24 14:06:49 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Wed, 24 Jun 2009 19:06:49 +0100
Subject: [c-nsp] Reload without confirmation
In-Reply-To: <4A423243.5040302@uk.clara.net>
References: <4A4225DB.6030509@uk.clara.net>
	<F2207DB22012F94E92D7030F81A2629402297CEC@twt-exch.milano.twt>
	<4A423243.5040302@uk.clara.net>
Message-ID: <20090624180649.GA22544@lboro.ac.uk>

Hi,

> $ snmpset -v2c -c private 10.0.0.2 1.3.6.1.4.1.9.2.9.9.0 i 2
> Error in packet.
> Reason: noCreation (That table does not support row creation or that
> object can not ever be created)
> Failed object: SNMPv2-SMI::enterprises.9.2.9.9.0

hmmm, wonder if you've got some SNMP ACLs or community problem? thats
the correct command and MIB (having had to do remote reloads a few times
using SNMP)

alan

From ayourtch at cisco.com  Wed Jun 24 15:33:13 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Wed, 24 Jun 2009 21:33:13 +0200 (CEST)
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection
In-Reply-To: <4A4238DD.8030307@imperial.ac.uk>
References: <4A3BAD2B.1060602@imperial.ac.uk> <4A3FA413.6080302@imperial.ac.uk>
	<4A3FA52A.5020400@imperial.ac.uk> <4A4238DD.8030307@imperial.ac.uk>
Message-ID: <Pine.LNX.4.64.0906242105130.5106@zippy.stdio.be>

On Wed, 24 Jun 2009, Phil Mayers wrote:

>>  So, it seems to be some kind of analogous feature to TCP SYN protect or
>>  such like, to protect a client flooding a server.
>
> All,
>
> Cisco have identified this as a bug, fixed in 1.5 - CSCsw52831 / CSCsu42225 
> "udp packets are dropped by ace". It's a timing-related issue in session 
> setup.
>
> Many thanks to the guys at TAC, who were extremely quick and effective on 
> this, and thanks to all who gave suggestions on the list.

Kudos to Phil for excellent work together! It was a very good bug hunt. 
Luckily it was even already fixed, and was not something burnt in 
hardware.

As I've blatantly self-appointed myself to track the ipv6-related 
matters in TAC as much as I can, if anyone on the list has something on 
the topic, feel free to drop an email to me with the case#, I'll ensure I 
keep an eye on it. (disclaimer for the archives: this statement may no 
longer be applicable in 2020 :)

looking a bit further -  to all:

1) If the A/AAAA bang-bang lookup over a single 4-tuple is an issue for 
anyone with other our other devices, I'd like to know ASAP.

2) what if the endboxes were doing the A and AAAA from two separate ports 
? I see two clear disadvantages - doubling the state on the "dumber NAPT" 
boxes, and "more work for glibc folks" - assuming the biggest problem is 
the first, how big is it for real-life deployments ?

thanks,
andrew

From david.freedman at uk.clara.net  Wed Jun 24 15:38:57 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 24 Jun 2009 20:38:57 +0100
Subject: [c-nsp] Reload without confirmation
References: <4A4225DB.6030509@uk.clara.net>
	<F2207DB22012F94E92D7030F81A2629402297CEC@twt-exch.milano.twt>
	<4A423243.5040302@uk.clara.net>
	<20090624180649.GA22544@lboro.ac.uk>
Message-ID: <7B8B0D6F623C3A40A0D0A80A66756E2B0D7CAC@EXVS01.claranet.local>

yes, I have tried with v2, the 800 series simply does *not* support remote SNMP reloads despite 
having the command in place, I can happily perform this on an 7200 just not an 800 series,
tried 12.4(15)T and 12.4(20)T ADVIPSERVICES.

$ snmpset -v2c -c private 10.0.0.2 1.3.6.1.4.1.9.2.9.9.0 i 2
Error in packet.
Reason: noCreation (That table does not support row creation or that object can not ever be created)
Failed object: SNMPv2-SMI::enterprises.9.2.9.9.0

Router#sh run | in snmp
snmp-server community private RW
snmp-server system-shutdown



------------------------------------------------
David Freedman
Group Network Engineering 
Claranet Limited
http://www.clara.net



-----Original Message-----
From: A.L.M.Buxey at lboro.ac.uk [mailto:A.L.M.Buxey at lboro.ac.uk]
Sent: Wed 6/24/2009 19:06
To: David Freedman
Cc: Brian Turnbow; Cisco-nsp; Jared Mauch
Subject: Re: [c-nsp] Reload without confirmation
 
Hi,

> $ snmpset -v2c -c private 10.0.0.2 1.3.6.1.4.1.9.2.9.9.0 i 2
> Error in packet.
> Reason: noCreation (That table does not support row creation or that
> object can not ever be created)
> Failed object: SNMPv2-SMI::enterprises.9.2.9.9.0

hmmm, wonder if you've got some SNMP ACLs or community problem? thats
the correct command and MIB (having had to do remote reloads a few times
using SNMP)

alan


From shinejoseph at dodo.com.au  Wed Jun 24 16:40:19 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 25 Jun 2009 04:40:19 +0800
Subject: [c-nsp] ME6524 MPLS QoS
Message-ID: <CBE8147BE8FA42079BC5B0E8C7B056E4@au.didata.local>

Hi,

ME6524 is used as the PE devices in my topology. The P devices (6506) are in a remote locations and hence the link between PE and P are limited to 30Mbps. As the traffic enters the network, I can mark them with EXP bits, but I haven't found a way on ME6524 to prioritise the traffic as it leaves towards the P.

Have anyone successfully deployed MPLS QoS on ME6524s?

All pointers and suggestions welcome.

Thanks in advance.

Shine


From sgranger at randfinancial.com  Wed Jun 24 17:41:22 2009
From: sgranger at randfinancial.com (Sean Granger)
Date: Wed, 24 Jun 2009 16:41:22 -0500
Subject: [c-nsp] NAT-able?
In-Reply-To: <4A40E30C020000D9000027A3@mail.randfinancial.com>
References: <4A40E30C020000D9000027A3@mail.randfinancial.com>
Message-ID: <4A425732020000D900002804@mail.randfinancial.com>

Believe me, I'm well aware how bad it is.
They won't assign a larger subnet to this PVC.
 
I'm thinking this is a pretty tailor-made situation for MPLS / VRFs, but I have to get my customer to play ball.
We can keep our existing address space, use separate routing tables per instance and I can still translate overload to each interface, if still necessary.
Though, I have to hope the provider isn't going to have any strange label / tag reqs.
Just digging into that now.
 
Another thing I've just finished is restructuring the table so that my customer's interface is viewed as the inside, and my and the 3rd party interfaces are the outside. This way I can translate based on destination lists and just overload based on a pool of one address (the same as the respective interfaces anyway). But again, this is wishful thinking here. They should be initiating traffic within the hour, so we'll see what turns up.
 
Basically, from the debugs earlier, it doesn't appear that any return traffic ever hit my router, leaving us to wonder if anything was ever sent out, after the NATs were bounced around.
 
Thanks for the input, anything is better than nothing and mostly, the sounding board helps.
Regards,
Sean

>>> "Sean Granger" <sgranger at randfinancial.com> 6/23/2009 2:13 PM >>>
I have a customer passing traffic to me through a network we have no control over.
They don't allow private addressing, yet have only assigned a /29 for transit traffic.
Due to these addressing requirements, he is translating his internally private source addresses by overloading the address of the interface facing me.
His destinations are static deNATed by me, one to one (6 hosts).

The traffic is getting through the shared network and my NAT table is setting up the translation properly, short of one thing.
His destinations are on another network that I have no control over, so I need to overload the address of my interface facing it, for the return traffic to be routable.

So if his destination A translates to my local address B is coming from his source X which I need to retranslate to Y.

Looking at the NAT debug, it appears to setup correctly :
6/23/2009 14:07 router.address Debug 3463: Jun 23 14:05:33.477 CDT: NAT*: s=y.y.y.y, d=a.a.a.a->b.b.b.b [3356]
6/23/2009 14:07 router.address Debug 3462: Jun 23 14:05:33.477 CDT: NAT*: s=x.x.x.x->y.y.y.y, d=a.a.a.a [3356]
6/23/2009 14:07 router.address Debug 3461: Jun 23 14:05:33.477 CDT: NAT*: o: icmp (x.x.x.x, 23609) -> (a.a.a.a, 23609) [3356]

'sho ip nat trans' confirms it :
Pro Inside global      Inside local       Outside local      Outside global
icmp a.a.a.a:23609 b.b.b.b:23609 y.y.y.y:23609 x.x.x.x:23609


Although I get a ping response from local address B from within the router (using the same address as Y, which is the neighbor interface address) ... I'm not sending a response back to my customer, even though the translation appears to be correct ... it's getting lost somewhere and I can't find the error.

Any thoughts?

From frnkblk at iname.com  Wed Jun 24 21:06:31 2009
From: frnkblk at iname.com (Frank Bulk)
Date: Wed, 24 Jun 2009 20:06:31 -0500
Subject: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)
In-Reply-To: <58A4A6F7-6F23-4A2B-8067-5673E72CDA7F@linkstate.dk>
References: <58A4A6F7-6F23-4A2B-8067-5673E72CDA7F@linkstate.dk>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABftgbjvFBLS78PXSgL3NhsAQAAAAA=@iname.com>

The ASR1002 seems overkill for 2000 subs, but perhaps a certain feature or
PPS is not supported on a 7200 platform.

Yes, RADIUS can hand out a Framed-IP just fine.  We do it all the time.

Frank

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Kr?pl
Sent: Wednesday, June 24, 2009 3:11 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)

Hi Group,

I am currently considdering to replace a couple of juniper ERX310's,
with cisco ASR1002's. The junipers, are doing PPPoE termination for
both OinQ vlans and ATM pvc's and also DHCP for some subscribers.
The ATM part will remain on the juniper routers, as this will be
decomissioned in the near future.

We have approx. 1000 subscribers on each ERX right now, and that
stays the same for the ASR's. Maybe 2000 subscribers per box, in
2 years time.

So the task for the ASR's is to terminate QinQ and provide PPPoE
or DHCP servcies to each subscriber in order to provide them with
internet access. The ASR should also be a part of our MPLS network,
that contains Cat6500/Sup720 and Cat7600/Rsp720 boxes. As we have
some connections terminated into different VRF's, but in that case the  
service
is static confiured on the routers, so no DHCP, PPP or other stuff  
just plain IP.

It is also a reuirement that it is possible to build EoMPLS circuits  
from either
a single or double tagged vlan on the ASR to a vlan subinterface on a
Cat6500/7600.

The juniper routers today provide the DHCP service via RADIUS,
has cisco something simillar ? You can get lot's of radius servers  
that use
a database as their backend, but no decent DHCP server. This makes
subscriber  provisioning harder to do on the fly. So it would be a shame
to loose this feature. All of our subscribers have static IP's.

I have made the following shopping list:
ASR1002- 5G/K9 ASR1002 w/ESP 5G,AESK9,4GB DRAM
FLASR1- BB- RTU Broadband Right To Use Feature Lic for ASR1000 Series
FLASR1- BB- 4K Broadband 4K Sessions Feature Lic for ASR1000 Series
SASR1R1- AIS-K9 -21SR Cisco ASR 1000 Series RP1 ADVANCED IP SERVICES
SPA- 8X1GE- V2 Cisco 8 Port Gigabit Ethernet Shared Port Adapter

Would this solution workout fine ?
Any alternatives.... ?

Kind Regards,
Peter Kr?pl















_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From peter at linkstate.dk  Thu Jun 25 02:18:54 2009
From: peter at linkstate.dk (=?ISO-8859-1?Q?Peter_Kr=FCpl?=)
Date: Thu, 25 Jun 2009 08:18:54 +0200
Subject: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABftgbjvFBLS78PXSgL3NhsAQAAAAA=@iname.com>
References: <58A4A6F7-6F23-4A2B-8067-5673E72CDA7F@linkstate.dk>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABftgbjvFBLS78PXSgL3NhsAQAAAAA=@iname.com>
Message-ID: <4A4316CE.30703@linkstate.dk>

Hi Frank,

The reason for choosing the ASR it that it also has to terminate some 
bigger access connections
delivered to us as OinQ ethernet, but thats plain stuff and is not a 
speciffic BBRAS function.

Just to clarify, are you using radius for DHCP subscribers or only for PPP ?

One last thing that came to my mind is juniper's abillity to hasve local 
xconnects/EoMPLS circuits,
so you can connect port a vlan x to port b vlan y, very usefull when 
providing point to point  L2
services, eg. when the access circuits are delivered on the same 
interface in different vlans.

Kind Regards,
Peter Kr?pl


Frank Bulk wrote:
> The ASR1002 seems overkill for 2000 subs, but perhaps a certain feature or
> PPS is not supported on a 7200 platform.
>
> Yes, RADIUS can hand out a Framed-IP just fine.  We do it all the time.
>
> Frank
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Kr?pl
> Sent: Wednesday, June 24, 2009 3:11 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)
>
> Hi Group,
>
> I am currently considdering to replace a couple of juniper ERX310's,
> with cisco ASR1002's. The junipers, are doing PPPoE termination for
> both OinQ vlans and ATM pvc's and also DHCP for some subscribers.
> The ATM part will remain on the juniper routers, as this will be
> decomissioned in the near future.
>
> We have approx. 1000 subscribers on each ERX right now, and that
> stays the same for the ASR's. Maybe 2000 subscribers per box, in
> 2 years time.
>
> So the task for the ASR's is to terminate QinQ and provide PPPoE
> or DHCP servcies to each subscriber in order to provide them with
> internet access. The ASR should also be a part of our MPLS network,
> that contains Cat6500/Sup720 and Cat7600/Rsp720 boxes. As we have
> some connections terminated into different VRF's, but in that case the  
> service
> is static confiured on the routers, so no DHCP, PPP or other stuff  
> just plain IP.
>
> It is also a reuirement that it is possible to build EoMPLS circuits  
> from either
> a single or double tagged vlan on the ASR to a vlan subinterface on a
> Cat6500/7600.
>
> The juniper routers today provide the DHCP service via RADIUS,
> has cisco something simillar ? You can get lot's of radius servers  
> that use
> a database as their backend, but no decent DHCP server. This makes
> subscriber  provisioning harder to do on the fly. So it would be a shame
> to loose this feature. All of our subscribers have static IP's.
>
> I have made the following shopping list:
> ASR1002- 5G/K9 ASR1002 w/ESP 5G,AESK9,4GB DRAM
> FLASR1- BB- RTU Broadband Right To Use Feature Lic for ASR1000 Series
> FLASR1- BB- 4K Broadband 4K Sessions Feature Lic for ASR1000 Series
> SASR1R1- AIS-K9 -21SR Cisco ASR 1000 Series RP1 ADVANCED IP SERVICES
> SPA- 8X1GE- V2 Cisco 8 Port Gigabit Ethernet Shared Port Adapter
>
> Would this solution workout fine ?
> Any alternatives.... ?
>
> Kind Regards,
> Peter Kr?pl
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>   


From mark.kelsay at confused.com  Thu Jun 25 04:21:05 2009
From: mark.kelsay at confused.com (Kelsay, Mark)
Date: Thu, 25 Jun 2009 09:21:05 +0100
Subject: [c-nsp] PIX/ASA Change Control
Message-ID: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>

I have recently taken over management of about 10 Firewalls.  We have a
mix of ASA and PIX's.  I am currently using a text file to track changes
I make to the firewalls.  I would like to find a piece of software that
is geared to doing this more efficiently.  I have Googled and did not
find anything that fits the bill.

 

What are you using that you would recommend?

 

 

Thanks,

 

Mark

 

 


****** This email is sent for and on behalf of Inspop.com Limited ****** 
Authorised and regulated by the Financial Services Authority.  Registration no. 310635.
Inspop.com Limited [also trading as "Confused.com"] is registered in England and Wales at 2nd Floor, Friary House, Greyfriars Road, Cardiff, CF10 3AE [Reg. No. 03857130].  Any opinions expressed in this email are those of the individual and not necessarily the  company. This email and any files transmitted with it, including replies and forwarded copies  [which may contain alterations] subsequently transmitted from the Company, are confidential  and solely for the use of the intended recipient. It may contain material protected by  attorney-client privilege. If you are not the intended recipient or the person responsible for  delivering to the intended recipient, be advised that you have received this email in error  and that any use is strictly prohibited. 
If you have received this email in error please notify the Information Security Officer by  telephone on +44 [0] 29 2043 4372. Please then delete this email and destroy any copies of it.   This email has been swept for viruses before leaving our system.
Security Warning: Please note that this email has been created in the knowledge that Internet  email is not a 100% secure communications medium.  We advise that you understand and accept  this lack of security when emailing us.
Viruses: Although we have taken steps to ensure that this email and any attachments are free  from any virus, we advise that in keeping with good computing practice the recipient should  ensure they are actually virus free.
We may monitor the content of E-mails sent and received via our network for viruses or  unauthorised use and for other lawful business purposes.


________________________________________________________________________
This e-mail has been scanned for all viruses by Messagelabs. The
service is powered by MessageLabs. ________________________________________________________________________

From rdobbins at arbor.net  Thu Jun 25 04:31:24 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 25 Jun 2009 15:31:24 +0700
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
References: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
Message-ID: <36336E16-7265-49D3-B7F8-79C4736D3001@arbor.net>


On Jun 25, 2009, at 3:21 PM, Kelsay, Mark wrote:

> What are you using that you would recommend?


<http://en.wikipedia.org/wiki/Revision_Control_System>

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From Kiran.Oddiraju at cbre.com  Thu Jun 25 05:02:25 2009
From: Kiran.Oddiraju at cbre.com (Oddiraju, Kiran @ London SMC)
Date: Thu, 25 Jun 2009 10:02:25 +0100
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
References: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
Message-ID: <B5CFB919B5EEF345969F51FAFE6360D57903@GBLDCXMB10.emea.cbre.net>

Have you looked at SolarWinds Network Configuration Manager (Cirrus),
you can track changes very easily.

Regards,
Kiran

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Kelsay, Mark
Sent: 25 June 2009 09:21
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] PIX/ASA Change Control

I have recently taken over management of about 10 Firewalls.  We have a
mix of ASA and PIX's.  I am currently using a text file to track changes
I make to the firewalls.  I would like to find a piece of software that
is geared to doing this more efficiently.  I have Googled and did not
find anything that fits the bill.

 

What are you using that you would recommend?

 

 

Thanks,

 

Mark

 

 


****** This email is sent for and on behalf of Inspop.com Limited ******

Authorised and regulated by the Financial Services Authority.
Registration no. 310635.
Inspop.com Limited [also trading as "Confused.com"] is registered in
England and Wales at 2nd Floor, Friary House, Greyfriars Road, Cardiff,
CF10 3AE [Reg. No. 03857130].  Any opinions expressed in this email are
those of the individual and not necessarily the  company. This email and
any files transmitted with it, including replies and forwarded copies
[which may contain alterations] subsequently transmitted from the
Company, are confidential  and solely for the use of the intended
recipient. It may contain material protected by  attorney-client
privilege. If you are not the intended recipient or the person
responsible for  delivering to the intended recipient, be advised that
you have received this email in error  and that any use is strictly
prohibited. 
If you have received this email in error please notify the Information
Security Officer by  telephone on +44 [0] 29 2043 4372. Please then
delete this email and destroy any copies of it.   This email has been
swept for viruses before leaving our system.
Security Warning: Please note that this email has been created in the
knowledge that Internet  email is not a 100% secure communications
medium.  We advise that you understand and accept  this lack of security
when emailing us.
Viruses: Although we have taken steps to ensure that this email and any
attachments are free  from any virus, we advise that in keeping with
good computing practice the recipient should  ensure they are actually
virus free.
We may monitor the content of E-mails sent and received via our network
for viruses or  unauthorised use and for other lawful business purposes.


________________________________________________________________________
This e-mail has been scanned for all viruses by Messagelabs. The
service is powered by MessageLabs.
________________________________________________________________________
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
CB Richard Ellis Limited, Registered Office: St Martin's Court, 
10 Paternoster Row, London, EC4M 7HP, registered in England and Wales No. 3536032. 
Regulated by the RICS and an appointed representative of CB Richard Ellis 
Indirect Investment Services Limited which is authorised and regulated by the Financial Services Authority.

This communication is from CB Richard Ellis Limited or one of its 
associated/subsidiary companies. This communication contains information 
which is confidential and may be privileged. If you are not the intended recipient, 
please contact the sender immediately. Any use of its contents is strictly prohibited 
and you must not copy, send or disclose it, or rely on its contents in any way whatsoever. 
Reasonable care has been taken to ensure that this communication 
(and any attachments or hyperlinks contained within it) is free from computer viruses. 
No responsibility is accepted by CB Richard Ellis Limited or its associated/subsidiary 
companies and the recipient should carry out any appropriate virus checks.


From willay at gmail.com  Thu Jun 25 05:14:25 2009
From: willay at gmail.com (William)
Date: Thu, 25 Jun 2009 10:14:25 +0100
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
References: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
Message-ID: <a24358fb0906250214s406b6126ia8627996d757956b@mail.gmail.com>

Hi Mark,

Try RANCID (http://www.shrubbery.net/rancid/) - its free and awesome!

Cheers,

Will

2009/6/25 Kelsay, Mark <mark.kelsay at confused.com>:
> I have recently taken over management of about 10 Firewalls. ?We have a
> mix of ASA and PIX's. ?I am currently using a text file to track changes
> I make to the firewalls. ?I would like to find a piece of software that
> is geared to doing this more efficiently. ?I have Googled and did not
> find anything that fits the bill.
>
>
>
> What are you using that you would recommend?
>
>
>
>
>
> Thanks,
>
>
>
> Mark
>
>
>
>
>
>
> ****** This email is sent for and on behalf of Inspop.com Limited ******
> Authorised and regulated by the Financial Services Authority. ?Registration no. 310635.
> Inspop.com Limited [also trading as "Confused.com"] is registered in England and Wales at 2nd Floor, Friary House, Greyfriars Road, Cardiff, CF10 3AE [Reg. No. 03857130]. ?Any opinions expressed in this email are those of the individual and not necessarily the ?company. This email and any files transmitted with it, including replies and forwarded copies ?[which may contain alterations] subsequently transmitted from the Company, are confidential ?and solely for the use of the intended recipient. It may contain material protected by ?attorney-client privilege. If you are not the intended recipient or the person responsible for ?delivering to the intended recipient, be advised that you have received this email in error ?and that any use is strictly prohibited.
> If you have received this email in error please notify the Information Security Officer by ?telephone on +44 [0] 29 2043 4372. Please then delete this email and destroy any copies of it. ? This email has been swept for viruses before leaving our system.
> Security Warning: Please note that this email has been created in the knowledge that Internet ?email is not a 100% secure communications medium. ?We advise that you understand and accept ?this lack of security when emailing us.
> Viruses: Although we have taken steps to ensure that this email and any attachments are free ?from any virus, we advise that in keeping with good computing practice the recipient should ?ensure they are actually virus free.
> We may monitor the content of E-mails sent and received via our network for viruses or ?unauthorised use and for other lawful business purposes.
>
>
> ________________________________________________________________________
> This e-mail has been scanned for all viruses by Messagelabs. The
> service is powered by MessageLabs. ________________________________________________________________________
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From hk at netuse.de  Thu Jun 25 04:44:33 2009
From: hk at netuse.de (Hauke Krull)
Date: Thu, 25 Jun 2009 10:44:33 +0200
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
References: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
Message-ID: <20090625084433.GB10238@netuse.de>

Hi,

Kelsay, Mark schrieb:
> I have recently taken over management of about 10 Firewalls.  We have a
> mix of ASA and PIX's.  I am currently using a text file to track changes
> I make to the firewalls.  I would like to find a piece of software that
> is geared to doing this more efficiently.  I have Googled and did not
> find anything that fits the bill.

A commercial solution for Management of Firewall-Policies comes from Tufin.

You can find a list of supported vendors under:
http://www.tufin.com/products_requirements.php

We're selling and implementing this solution for quiet some time but if you
need more details please contact me off-list.

Regards
 Hauke Krull
-- 
Dipl.-Phys. Hauke Krull

NetUSE AG
Dr.-Hell-Stra?e 6
D-24107 Kiel
Tel: +49 431 2390 400
Fax: +49 431 2390 499
http://www.NetUSE.DE/

Vorstand: Andreas Seeger (Vorsitz), Dr. Roland Kaltefleiter, Dr. Joerg Posewang
Aufsichtsrat: Detlev Huebner (Vorsitz)
Sitz der AG: Kiel, HRB 5358 USt.ID: DE156073942

Diese E-Mail enthaelt vertrauliche oder rechtlich geschuetzte Informationen.
Das unbefugte Kopieren dieser E-Mail oder die unbefugte Weitergabe der
enthaltenen Informationen ist nicht gestattet.

The information contained in this message is confidential or protected by
law. Any unauthorised copying of this message or unauthorised distribution
of the information contained herein is prohibited.


From nuskov at mail.ru  Thu Jun 25 01:44:56 2009
From: nuskov at mail.ru (=?koi8-r?Q?=EE=C9=CB=C9=D4=C1__=F5=D3=CB=CF=D7?=)
Date: Thu, 25 Jun 2009 09:44:56 +0400
Subject: [c-nsp]
	=?koi8-r?b?Q2lzY28gQVNSIGFzIEJCUkFTLi4uID8gKGlzIHRoaXMg?=
	=?koi8-r?b?YSBzYW5lIHNvbHV0aW9uKQ==?=
In-Reply-To: <&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABftgbjvFBLS78PXSgL3NhsAQAAAAA=@iname.com>
References: <&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABftgbjvFBLS78PXSgL3NhsAQAAAAA=@iname.com>
Message-ID: <E1MJhlY-0001ER-00.nuskov-mail-ru@f242.mail.ru>

I think, ASR quite good solutoin for your case because ERX is too big and too expensive for 2K subscribers.
Planing inmplementation you should remember that you need ISG for CoA support and your Radius servers should support Cisco AVPairs for service activation.

Nik

> 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Kr?pl
> Sent: Wednesday, June 24, 2009 3:11 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)
> 
> Hi Group,
> 
> I am currently considdering to replace a couple of juniper ERX310's,
> with cisco ASR1002's. The junipers, are doing PPPoE termination for
> both OinQ vlans and ATM pvc's and also DHCP for some subscribers.
> The ATM part will remain on the juniper routers, as this will be
> decomissioned in the near future.
> 
> We have approx. 1000 subscribers on each ERX right now, and that
> stays the same for the ASR's. Maybe 2000 subscribers per box, in
> 2 years time.
> 
> So the task for the ASR's is to terminate QinQ and provide PPPoE
> or DHCP servcies to each subscriber in order to provide them with
> internet access. The ASR should also be a part of our MPLS network,
> that contains Cat6500/Sup720 and Cat7600/Rsp720 boxes. As we have
> some connections terminated into different VRF's, but in that case the  
> service
> is static confiured on the routers, so no DHCP, PPP or other stuff  
> just plain IP.
> 
> It is also a reuirement that it is possible to build EoMPLS circuits  
> from either
> a single or double tagged vlan on the ASR to a vlan subinterface on a
> Cat6500/7600.
> 
> The juniper routers today provide the DHCP service via RADIUS,
> has cisco something simillar ? You can get lot's of radius servers  
> that use
> a database as their backend, but no decent DHCP server. This makes
> subscriber  provisioning harder to do on the fly. So it would be a shame
> to loose this feature. All of our subscribers have static IP's.
> 
> I have made the following shopping list:
> ASR1002- 5G/K9 ASR1002 w/ESP 5G,AESK9,4GB DRAM
> FLASR1- BB- RTU Broadband Right To Use Feature Lic for ASR1000 Series
> FLASR1- BB- 4K Broadband 4K Sessions Feature Lic for ASR1000 Series
> SASR1R1- AIS-K9 -21SR Cisco ASR 1000 Series RP1 ADVANCED IP SERVICES
> SPA- 8X1GE- V2 Cisco 8 Port Gigabit Ethernet Shared Port Adapter
> 
> Would this solution workout fine ?
> Any alternatives.... ?
> 
> Kind Regards,
> Peter Kr?pl
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From roy.otto.kleiv at nc-spectrum.no  Thu Jun 25 07:02:54 2009
From: roy.otto.kleiv at nc-spectrum.no (Roy Otto Kleiv)
Date: Thu, 25 Jun 2009 13:02:54 +0200
Subject: [c-nsp] PIX/ASA Change Control
Message-ID: <6D71A63222BFF4448D02E7C0E9AC37B401A9E4FF@origo.smarti.no>

I can truly recommend NCM, works like a charm, although it does cost a
bit

Mvh,
Roy Otto Kleiv
NC-Spectrum


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Oddiraju, Kiran
@ London SMC
Sent: 25. juni 2009 11:02
To: Kelsay, Mark; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] PIX/ASA Change Control

Have you looked at SolarWinds Network Configuration Manager (Cirrus),
you can track changes very easily.

Regards,
Kiran

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Kelsay, Mark
Sent: 25 June 2009 09:21
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] PIX/ASA Change Control

I have recently taken over management of about 10 Firewalls.  We have a
mix of ASA and PIX's.  I am currently using a text file to track changes
I make to the firewalls.  I would like to find a piece of software that
is geared to doing this more efficiently.  I have Googled and did not
find anything that fits the bill.

 

What are you using that you would recommend?

 

 

Thanks,

 

Mark

 

 


****** This email is sent for and on behalf of Inspop.com Limited ******

Authorised and regulated by the Financial Services Authority.
Registration no. 310635.
Inspop.com Limited [also trading as "Confused.com"] is registered in
England and Wales at 2nd Floor, Friary House, Greyfriars Road, Cardiff,
CF10 3AE [Reg. No. 03857130].  Any opinions expressed in this email are
those of the individual and not necessarily the  company. This email and
any files transmitted with it, including replies and forwarded copies
[which may contain alterations] subsequently transmitted from the
Company, are confidential  and solely for the use of the intended
recipient. It may contain material protected by  attorney-client
privilege. If you are not the intended recipient or the person
responsible for  delivering to the intended recipient, be advised that
you have received this email in error  and that any use is strictly
prohibited. 
If you have received this email in error please notify the Information
Security Officer by  telephone on +44 [0] 29 2043 4372. Please then
delete this email and destroy any copies of it.   This email has been
swept for viruses before leaving our system.
Security Warning: Please note that this email has been created in the
knowledge that Internet  email is not a 100% secure communications
medium.  We advise that you understand and accept  this lack of security
when emailing us.
Viruses: Although we have taken steps to ensure that this email and any
attachments are free  from any virus, we advise that in keeping with
good computing practice the recipient should  ensure they are actually
virus free.
We may monitor the content of E-mails sent and received via our network
for viruses or  unauthorised use and for other lawful business purposes.


________________________________________________________________________
This e-mail has been scanned for all viruses by Messagelabs. The
service is powered by MessageLabs.
________________________________________________________________________
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
CB Richard Ellis Limited, Registered Office: St Martin's Court, 
10 Paternoster Row, London, EC4M 7HP, registered in England and Wales
No. 3536032. 
Regulated by the RICS and an appointed representative of CB Richard
Ellis 
Indirect Investment Services Limited which is authorised and regulated
by the Financial Services Authority.

This communication is from CB Richard Ellis Limited or one of its 
associated/subsidiary companies. This communication contains information

which is confidential and may be privileged. If you are not the intended
recipient, 
please contact the sender immediately. Any use of its contents is
strictly prohibited 
and you must not copy, send or disclose it, or rely on its contents in
any way whatsoever. 
Reasonable care has been taken to ensure that this communication 
(and any attachments or hyperlinks contained within it) is free from
computer viruses. 
No responsibility is accepted by CB Richard Ellis Limited or its
associated/subsidiary 
companies and the recipient should carry out any appropriate virus
checks.

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From dale.shaw+cisco-nsp at gmail.com  Thu Jun 25 07:32:16 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Thu, 25 Jun 2009 21:32:16 +1000
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <6D71A63222BFF4448D02E7C0E9AC37B401A9E4FF@origo.smarti.no>
References: <6D71A63222BFF4448D02E7C0E9AC37B401A9E4FF@origo.smarti.no>
Message-ID: <3329cbb40906250432k83df98u8351c332f32aa258@mail.gmail.com>

Hi,

On Thu, Jun 25, 2009 at 9:02 PM, Roy Otto
Kleiv<roy.otto.kleiv at nc-spectrum.no> wrote:
> I can truly recommend NCM, works like a charm, although it does cost a
> bit

I've heard good things about NCM, and was given an extra boost of
confidence once I discovered it wasn't a Cisco software product (it's
OEM'd from Opsware)

http://tinyurl.com/45m88q

:-)

cheers,
Dale

From rwest at zyedge.com  Thu Jun 25 07:33:12 2009
From: rwest at zyedge.com (Ryan West)
Date: Thu, 25 Jun 2009 07:33:12 -0400
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <a24358fb0906250214s406b6126ia8627996d757956b@mail.gmail.com>
References: <62D8ECFDF835A648AD4FB4328B15F36404E8B3D6@mud.admiral.uk>
	<a24358fb0906250214s406b6126ia8627996d757956b@mail.gmail.com>
Message-ID: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com>

No. It's really awesome.

Sent from handheld.

On Jun 25, 2009, at 5:19 AM, "William" <willay at gmail.com> wrote:

> Hi Mark,
>
> Try RANCID (http://www.shrubbery.net/rancid/) - its free and awesome!
>
> Cheers,
>
> Will
>
> 2009/6/25 Kelsay, Mark <mark.kelsay at confused.com>:
>> I have recently taken over management of about 10 Firewalls.  We  
>> have a
>> mix of ASA and PIX's.  I am currently using a text file to track  
>> changes
>> I make to the firewalls.  I would like to find a piece of software  
>> that
>> is geared to doing this more efficiently.  I have Googled and did not
>> find anything that fits the bill.
>>
>>
>>
>> What are you using that you would recommend?
>>
>>
>>
>>
>>
>> Thanks,
>>
>>
>>
>> Mark
>>
>>
>>
>>
>>
>>
>> ****** This email is sent for and on behalf of Inspop.com Limited  
>> ******
>> Authorised and regulated by the Financial Services Authority.   
>> Registration no. 310635.
>> Inspop.com Limited [also trading as "Confused.com"] is registered  
>> in England and Wales at 2nd Floor, Friary House, Greyfriars Road,  
>> Cardiff, CF10 3AE [Reg. No. 03857130].  Any opinions expressed in  
>> this email are those of the individual and not necessarily the   
>> company. This email and any files transmitted with it, including  
>> replies and forwarded copies  [which may contain alterations]  
>> subsequently transmitted from the Company, are confidential  and  
>> solely for the use of the intended recipient. It may contain  
>> material protected by  attorney-client privilege. If you are not  
>> the intended recipient or the person responsible for  delivering to  
>> the intended recipient, be advised that you have received this  
>> email in error  and that any use is strictly prohibited.
>> If you have received this email in error please notify the  
>> Information Security Officer by  telephone on +44 [0] 29 2043 4372.  
>> Please then delete this email and destroy any copies of it.   This  
>> email has been swept for viruses before leaving our system.
>> Security Warning: Please note that this email has been created in  
>> the knowledge that Internet  email is not a 100% secure  
>> communications medium.  We advise that you understand and accept   
>> this lack of security when emailing us.
>> Viruses: Although we have taken steps to ensure that this email and  
>> any attachments are free  from any virus, we advise that in keeping  
>> with good computing practice the recipient should  ensure they are  
>> actually virus free.
>> We may monitor the content of E-mails sent and received via our  
>> network for viruses or  unauthorised use and for other lawful  
>> business purposes.
>>
>>
>> ________________________________________________________________________
 

>> This e-mail has been scanned for all viruses by Messagelabs. The
>> service is powered by MessageLabs.  
>> ________________________________________________________________________
 

>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From vitya at list.ru  Thu Jun 25 11:23:44 2009
From: vitya at list.ru (victor)
Date: Thu, 25 Jun 2009 19:23:44 +0400
Subject: [c-nsp] WS-X6724+CFC and ES20 line cards
In-Reply-To: <20090624142548.GF290@greenie.muc.de>
References: <op.uv0305j12vrlim@localhost.localdomain>
	<20090624142548.GF290@greenie.muc.de>
Message-ID: <op.uv26du1c2vrlim@localhost.localdomain>

On Wed, 24 Jun 2009 18:25:48 +0400, Gert Doering <gert at greenie.muc.de>  
wrote:

>> I found some specs about latter but nothing useful
>> about X6724.
>> The problem that I'm facing now is with given small ISP network  
>> blueprint
>> to implement and the lack of some specified parts. I.e. I need two
>> mentioned ES20 to build a domain to interconnect 2 Cisco 7600 with 2
>> BRASes, 2 BRs and 2 c3750 switches for servers. Right now I only have  
>> two
>> WS-X6724 and no ES20.
>
> Why do you think you need ES20s here?

Thank you, Gert
I'd very much like to ask the same question my head-office which  
distributes this kind of reference material. The only purpose ES20 serve  
in their design is to establish VPLS connection between two (four in the  
future) core c7604.
I think this setup hardly justifies the efforts and money that's been  
invested into it. Correct me if I'm wrong but for 2 MLS switches sitting  
in the same rack it is too much of an overhead to configure VPLS. A trunk  
link would be considerably simpler and more reliable in this case.


-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From gert at greenie.muc.de  Thu Jun 25 11:30:54 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Thu, 25 Jun 2009 17:30:54 +0200
Subject: [c-nsp] WS-X6724+CFC and ES20 line cards
In-Reply-To: <op.uv26du1c2vrlim@localhost.localdomain>
References: <op.uv0305j12vrlim@localhost.localdomain>
	<20090624142548.GF290@greenie.muc.de>
	<op.uv26du1c2vrlim@localhost.localdomain>
Message-ID: <20090625153054.GL290@greenie.muc.de>

Hi,

On Thu, Jun 25, 2009 at 07:23:44PM +0400, victor wrote:
> I'd very much like to ask the same question my head-office which  
> distributes this kind of reference material. The only purpose ES20 serve  
> in their design is to establish VPLS connection between two (four in the  
> future) core c7604.

Well, yes.  If you do VPLS, you need the ES20 (or SIP+SPA).

> I think this setup hardly justifies the efforts and money that's been  
> invested into it. Correct me if I'm wrong but for 2 MLS switches sitting  
> in the same rack it is too much of an overhead to configure VPLS. A trunk  
> link would be considerably simpler and more reliable in this case.

If they sit in the very same rack, just bridge the traffic directly, 
and leave MPLS out of the question.  Yes.

(But then you are not fully buzzword compliant... bad for marketing)

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090625/21d00574/attachment.bin>

From sigurbjornl at vodafone.is  Thu Jun 25 11:01:59 2009
From: sigurbjornl at vodafone.is (=?ISO-8859-1?B?U2lndXJiavZybg==?= Birkir =?ISO-8859-1?B?TOFydXNzb24=?=)
Date: Thu, 25 Jun 2009 15:01:59 +0000
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com>
Message-ID: <C66941E7.164CF%sigurbjornl@vodafone.is>

I'm using rancid with good results for the same purpose

The only problem I've seen is that with the ASA when you make changes there
is sometimes re-ordering in the config, or a slight difference in tabulation
(I've seen missing spaces in network-object groups for example) between the
configs so the config diff is slightly bigger than it should be, isn't
really a big problem though.

And yeah, rancid is awesome.

BR,

----------------------------------------------------------------------

      `./syso//-.         Sigurbjorn B. Larusson
    .omMNy:`.sNMNh/`      Network Specialist
  `+NMMd-   /hNMMMMd-     Routing and Transmission
  +MMMd.      `oMMMMN.    sigurbjornl at vodafone.is
  MMMM+         oMMMM/    +354 599 9000
  MMMMy`        +MMMM/
  oMMMMy`     `+MMMMN.    Vodafone
  `oNMMMMhsosyNMMMMm:     Skutuvogi 2
    -sNMMMMMMMMMMmo.      104 Reykjavik
      `:ssyhhys+-`        Iceland
                          www.vodafone.is
        vodafone          DISCLAIMER: http://www.vodafone.is/disclaimer



On 25.6.2009 11:33, "Ryan West" <rwest at zyedge.com> wrote:

> No. It's really awesome.
> 
> Sent from handheld.
> 
> On Jun 25, 2009, at 5:19 AM, "William" <willay at gmail.com> wrote:
> 
>> Hi Mark,
>> 
>> Try RANCID (http://www.shrubbery.net/rancid/) - its free and awesome!
>> 
>> Cheers,
>> 
>> Will
>> 
>> 2009/6/25 Kelsay, Mark <mark.kelsay at confused.com>:
>>> I have recently taken over management of about 10 Firewalls.  We
>>> have a
>>> mix of ASA and PIX's.  I am currently using a text file to track
>>> changes
>>> I make to the firewalls.  I would like to find a piece of software
>>> that
>>> is geared to doing this more efficiently.  I have Googled and did not
>>> find anything that fits the bill.
>>> 
>>> 
>>> 
>>> What are you using that you would recommend?
>>> 
>>> 
>>> 
>>> 
>>> 
>>> Thanks,
>>> 
>>> 
>>> 
>>> Mark
>>> 
>>> 
>>> 
>>> 
>>> 
>>> 
>>> ****** This email is sent for and on behalf of Inspop.com Limited
>>> ******
>>> Authorised and regulated by the Financial Services Authority.
>>> Registration no. 310635.
>>> Inspop.com Limited [also trading as "Confused.com"] is registered
>>> in England and Wales at 2nd Floor, Friary House, Greyfriars Road,
>>> Cardiff, CF10 3AE [Reg. No. 03857130].  Any opinions expressed in
>>> this email are those of the individual and not necessarily the
>>> company. This email and any files transmitted with it, including
>>> replies and forwarded copies  [which may contain alterations]
>>> subsequently transmitted from the Company, are confidential  and
>>> solely for the use of the intended recipient. It may contain
>>> material protected by  attorney-client privilege. If you are not
>>> the intended recipient or the person responsible for  delivering to
>>> the intended recipient, be advised that you have received this
>>> email in error  and that any use is strictly prohibited.
>>> If you have received this email in error please notify the
>>> Information Security Officer by  telephone on +44 [0] 29 2043 4372.
>>> Please then delete this email and destroy any copies of it.   This
>>> email has been swept for viruses before leaving our system.
>>> Security Warning: Please note that this email has been created in
>>> the knowledge that Internet  email is not a 100% secure
>>> communications medium.  We advise that you understand and accept
>>> this lack of security when emailing us.
>>> Viruses: Although we have taken steps to ensure that this email and
>>> any attachments are free  from any virus, we advise that in keeping
>>> with good computing practice the recipient should  ensure they are
>>> actually virus free.
>>> We may monitor the content of E-mails sent and received via our
>>> network for viruses or  unauthorised use and for other lawful
>>> business purposes.
>>> 
>>> 
>>> ________________________________________________________________________
>  
> 
>>> This e-mail has been scanned for all viruses by Messagelabs. The
>>> service is powered by MessageLabs.
>>> ________________________________________________________________________
>  
> 
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>> 
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From madunix at gmail.com  Thu Jun 25 11:55:29 2009
From: madunix at gmail.com (madunix)
Date: Thu, 25 Jun 2009 17:55:29 +0200
Subject: [c-nsp] NAT
Message-ID: <4d3f56c90906250855oe88a0c8o9109ec04c79083a1@mail.gmail.com>

I have a RAC 2xnodes (CRS) setup behind a NAT Firewall (IP nating 1:1), when
the clients connect to DB they only connect to first IP and not using
the second IP. How should I configure my RAC/NAT/TNSnames to give the
clients the option to connect both IP's inorder to have Load balance?
since am not able to get the clients to swap between the 2x nodes

The NAT is made on a ROUTER

R1#sh ver
Cisco Internetwork Operating System Software
IOS (tm) 3600 Software (C3660-IK2O3S-M), Version 12.0(7)XK1, EARLY
DEPLOYMENT RELEASE SOFTWARE (fc1)
TAC:Home:SW:IOS:Specials for info
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Fri 17-Mar-00 19:37 by phanguye
Image text-base: 0x60008900, data-base: 0x611AC000
ROM: System Bootstrap, Version 12.0(6r)T, RELEASE SOFTWARE (fc1)
ROM: 3600 Software (C3660-IK2O3S-M), Version 12.0(7)XK1, EARLY
DEPLOYMENT RELEASE SOFTWARE (fc1)


on the clients:
node=
   (DESCRIPTION =
   (FAILOVER=ON)
   (LOAD_BALANCE=YES)
   (ADDRESS = (PROTOCOL = TCP)(HOST = 10.5.1.X)(PORT = 1521))
   (ADDRESS = (PROTOCOL = TCP)(HOST = 10.5.1.Y)(PORT = 1521))
   (CONNECT_DATA =
   (SERVICE_NAME = CO)
   (FAILOVER_MODE=(TYPE=SELECT)(METHOD=BASIC))
   )
   )

 on the server:
########## Public Network ##############
10.4.1.X       node1
10.4.1.Y       node2

########## Virtual IP Address ########
10.4.1.XX      node1_vip
10.4.1.YY      node2_vip


regards,
madunix

From vitya at list.ru  Thu Jun 25 12:20:26 2009
From: vitya at list.ru (victor)
Date: Thu, 25 Jun 2009 20:20:26 +0400
Subject: [c-nsp] WS-X6724+CFC and ES20 line cards
In-Reply-To: <20090625153054.GL290@greenie.muc.de>
References: <op.uv0305j12vrlim@localhost.localdomain>
	<20090624142548.GF290@greenie.muc.de>
	<op.uv26du1c2vrlim@localhost.localdomain>
	<20090625153054.GL290@greenie.muc.de>
Message-ID: <op.uv280cp32vrlim@localhost.localdomain>

On Thu, 25 Jun 2009 19:30:54 +0400, Gert Doering <gert at greenie.muc.de>  
wrote:

> On Thu, Jun 25, 2009 at 07:23:44PM +0400, victor wrote:
>> I'd very much like to ask the same question my head-office which
>> distributes this kind of reference material. The only purpose ES20 serve
>> in their design is to establish VPLS connection between two (four in the
>> future) core c7604.
>
> Well, yes.  If you do VPLS, you need the ES20 (or SIP+SPA).
>
>> I think this setup hardly justifies the efforts and money that's been
>> invested into it. Correct me if I'm wrong but for 2 MLS switches sitting
>> in the same rack it is too much of an overhead to configure VPLS. A  
>> trunk
>> link would be considerably simpler and more reliable in this case.
>
> If they sit in the very same rack, just bridge the traffic directly,
> and leave MPLS out of the question.  Yes.
>
> (But then you are not fully buzzword compliant... bad for marketing)
>
Even more than that :) because the design was verified, simulated and  
approved by a Cisco Systems lab in Raleigh (NC)
Insubordination regarding this matter may result in an unpleasant  
conversation with my boss. I should probably insist on ordering ES20 :)))


-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From A.L.M.Buxey at lboro.ac.uk  Thu Jun 25 12:38:51 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Thu, 25 Jun 2009 17:38:51 +0100
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <C66941E7.164CF%sigurbjornl@vodafone.is>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com>
	<C66941E7.164CF%sigurbjornl@vodafone.is>
Message-ID: <20090625163851.GB25366@lboro.ac.uk>

hi,

regarding RANCID and Cisco ASAs - are there common
scripts etc for logging/scraping such devices as there
are for cisco (clogin), foundry (flogin) etc?

..or does it all just magically work with clogin
(looking at the clogin and rancid code it seems to
be that way...but theres so many CLI quirks with
it and TACACS+ login doesnt autoenable no matter what
we seem to send back in the priv etc)

alan

From rwest at zyedge.com  Thu Jun 25 13:07:04 2009
From: rwest at zyedge.com (Ryan West)
Date: Thu, 25 Jun 2009 13:07:04 -0400
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <20090625163851.GB25366@lboro.ac.uk>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com>
	<C66941E7.164CF%sigurbjornl@vodafone.is>
	<20090625163851.GB25366@lboro.ac.uk>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local>

It handles it fine.  This is basically all you have to do to get it work with ASA/PIXen:

add user customer-fw1             admin
add password customer-fw1         mypassword    mypassword
add autoenable customer-fw1       0
add method customer-fw1           ssh telnet

We did a very minor tweak to allow netscreen's to be backed up and parsed as well and configured cvsweb to manage the diffs / revision control.

-ryan

-----Original Message-----
From: A.L.M.Buxey at lboro.ac.uk [mailto:A.L.M.Buxey at lboro.ac.uk] 
Sent: Thursday, June 25, 2009 12:39 PM
To: Sigurbj?rn Birkir L?russon
Cc: Ryan West; William; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] PIX/ASA Change Control

hi,

regarding RANCID and Cisco ASAs - are there common
scripts etc for logging/scraping such devices as there
are for cisco (clogin), foundry (flogin) etc?

..or does it all just magically work with clogin
(looking at the clogin and rancid code it seems to
be that way...but theres so many CLI quirks with
it and TACACS+ login doesnt autoenable no matter what
we seem to send back in the priv etc)

alan

From dnightin at wellesley.edu  Thu Jun 25 12:52:33 2009
From: dnightin at wellesley.edu (Don Nightingale)
Date: Thu, 25 Jun 2009 12:52:33 -0400
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <20090625163851.GB25366@lboro.ac.uk>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com>	<C66941E7.164CF%sigurbjornl@vodafone.is>
	<20090625163851.GB25366@lboro.ac.uk>
Message-ID: <4A43AB51.8050600@wellesley.edu>

I use rancid with my asa5540's, works like a charm with clogin.

A.L.M.Buxey at lboro.ac.uk wrote:
> hi,
>
> regarding RANCID and Cisco ASAs - are there common
> scripts etc for logging/scraping such devices as there
> are for cisco (clogin), foundry (flogin) etc?
>
> ..or does it all just magically work with clogin
> (looking at the clogin and rancid code it seems to
> be that way...but theres so many CLI quirks with
> it and TACACS+ login doesnt autoenable no matter what
> we seem to send back in the priv etc)
>
> alan
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   


-- 
Don Nightingale
Systems and Networks Manager
Wellesley College
781-283-3271


From mduksa at gmail.com  Thu Jun 25 14:45:49 2009
From: mduksa at gmail.com (Marlon Duksa)
Date: Thu, 25 Jun 2009 11:45:49 -0700
Subject: [c-nsp] number of broadband sessions on ESR10K and 7600
Message-ID: <a89d89ac0906251145h5a1143c5x5ae0395106cb476a@mail.gmail.com>

Hi - does anyone know how many PPPoE and IPoE sessions can 7600 support PER
CHASSIS with ES+40 cards (no interested in SIP-400)?
Also how many PPPoX sessions can support ESR 10K - I see in the
documentation that the number per chassis is 32K but then Cisco is selling
licenses for 64K sessions. WHich one is true?

Thanks,
Marlon

From ray at oneunified.net  Thu Jun 25 16:28:47 2009
From: ray at oneunified.net (Ray Burkholder)
Date: Thu, 25 Jun 2009 17:28:47 -0300
Subject: [c-nsp] Network Address Response
Message-ID: <01c501c9f5d3$a9740f70$fc5c2e50$@net>

I was wondering the reasoning for routers/switches to respond for the
network portion of an ip-address range.

For example, a router interface A with 10.0.0.1/30 and interface B with
10.0.0.5/30.

Generate a ping from a device several hops away on the A side to the B side
network address of 10.0.0.4.  The router will respond with an echo reply
with an address of 10.0.0.1.

Is this expected behaviour?  And the reason?

Ray



-- 
Scanned for viruses and dangerous content at 
http://www.oneunified.net and is believed to be clean.


From cklam at ias.edu  Thu Jun 25 16:00:10 2009
From: cklam at ias.edu (Christina Klam)
Date: Thu, 25 Jun 2009 16:00:10 -0400
Subject: [c-nsp] Mac OSX WakeOnLan
Message-ID: <4A43D74A.80600@ias.edu>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
Hello,

We have been trying to get WakeOnLan for Mac OSX to work reliably
across subnets without success.  I have added "ip directed-broadcast
[access-list#]" to the interface VLANs for those buildings/users with
Mac Minis.  However, it works only part of the time.  On the same
switch, some Minis work all the time, while others work only part of
the time.   I have done a a couple of packet capture but nothing jumps
out at me.   In addition, using the cable-diagnostics tdr on the
switches, I have verified that all of the cabling is good.

We are using Cisco 3750G/E stacks (version 12.2(44)SE1) and Cisco
4507R-E (cat4500e-ipbasek9-mz.122-46.SG.bin).

Anyone else had similar issues?

Thank you,
Christina

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
 
iQEVAwUBSkPXSt9pUgshfvqBAQI5QggAg0yXzdwy6tCMUBmwt8puuGYA6j74S1q7
hJxrMlRmoovGJDjEBENVlFmmNRo9NiOS797OtRNmYl68P/dHR5EqtaKLkr+FBUNl
C/xOAXnCYzdSSXxMfNx6o0cISslD0rZhUouYZB14HDiN9NmQNIN1QTvhM67CwLsA
Y9VNzLodv5CzMdJsNcvZNjN3WOUwOtwWeKhm62dDxA0ZX+nw+tZDZveaKSjeQAbs
NJOcIQgChGvgtwbzkWiKX/oTa+CZikeX0G7oyZFVq5o0KCqdUUSOYeCTqK9/k7pE
ung0+wG6YzkZEWC6QtoLh0k1/hM4KtaFBQ1g1aJU1bGSnwmx+c2xcg==
=3fXS
-----END PGP SIGNATURE-----


From josh.fleishman at gmail.com  Thu Jun 25 17:29:03 2009
From: josh.fleishman at gmail.com (Josh Fleishman)
Date: Thu, 25 Jun 2009 17:29:03 -0400
Subject: [c-nsp] VRF-AWARE MBGP
Message-ID: <31f82fd80906251429h1e30462ai71c598ce0f9f0c41@mail.gmail.com>

I'm looking for a way to advertise vrf routes via MBGP.  I would expect it
to look something like this:

router bgp AS#
address-family ipv4 vrf NAME multicast

or

address-family ipv4 multicast vrf NAME

But neither of these are valid options. Any suggestions?

From alex at digriz.org.uk  Thu Jun 25 18:02:16 2009
From: alex at digriz.org.uk (Alexander Clouter)
Date: Thu, 25 Jun 2009 23:02:16 +0100
Subject: [c-nsp] Mac OSX WakeOnLan
References: <4A43D74A.80600@ias.edu>
Message-ID: <8o8dh6-43u.ln1@woodchuck.wormnet.eu>

Christina Klam <cklam at ias.edu> wrote:
> 
> We have been trying to get WakeOnLan for Mac OSX to work reliably
> across subnets without success.  I have added "ip directed-broadcast
> [access-list#]" to the interface VLANs for those buildings/users with
> Mac Minis.  However, it works only part of the time.  On the same
> switch, some Minis work all the time, while others work only part of
> the time.   I have done a a couple of packet capture but nothing jumps
> out at me.   In addition, using the cable-diagnostics tdr on the
> switches, I have verified that all of the cabling is good.
> 
> We are using Cisco 3750G/E stacks (version 12.2(44)SE1) and Cisco
> 4507R-E (cat4500e-ipbasek9-mz.122-46.SG.bin).
> 
We are 12.2(50)SEish

> Anyone else had similar issues?
> 
Not bothered trying to wake up the fruits here, but PeeCee's have been 
sulking.  I thought it was just typical borked Dull kit however even 
packet sniffing off the port I fail to get the magic packets.  That on 
the same switch on other identically configured ports it works :-/

We have the 'extra fun' of it being an 802.1X port but the 
'dot1x direction in' bits are in there and it *can* work...occasionally.

>From my experience, I don't have hard and fast info and it was a while 
back, the issue is linked to the switch thinking there is no spanning 
tree edge port action.  You can see a difference on working/non-working 
ports when you type 'show dot1x int <whatever> detail' and querying 
about what spanning tree is making of the situation too.

Sorry it's all vague, I looked into this about three months ago (when we 
were using 12.2(44)ish) and it's on my books for revisiting this 
summer.

At least you know you are not alone :)

Cheers

-- 
Alexander Clouter
.sigmonster says: 42


From skoal at skoal.name  Thu Jun 25 17:53:29 2009
From: skoal at skoal.name (Gergely Antal)
Date: Thu, 25 Jun 2009 23:53:29 +0200
Subject: [c-nsp] VRF-AWARE MBGP
In-Reply-To: <31f82fd80906251429h1e30462ai71c598ce0f9f0c41@mail.gmail.com>
References: <31f82fd80906251429h1e30462ai71c598ce0f9f0c41@mail.gmail.com>
Message-ID: <4A43F1D9.1030706@skoal.name>

you need address-family ipv4 mdt
and a separate vrf to carry the traffic

Josh Fleishman wrote:
> I'm looking for a way to advertise vrf routes via MBGP.  I would expect it
> to look something like this:
> 
> router bgp AS#
> address-family ipv4 vrf NAME multicast
> 
> or
> 
> address-family ipv4 multicast vrf NAME
> 
> But neither of these are valid options. Any suggestions?
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 260 bytes
Desc: OpenPGP digital signature
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090625/af506ef3/attachment-0001.bin>

From nsp at myzionetworks.com  Thu Jun 25 22:51:56 2009
From: nsp at myzionetworks.com (Todd Shipway)
Date: Thu, 25 Jun 2009 22:51:56 -0400
Subject: [c-nsp] Can't ping outside network over T1
Message-ID: <6dde6e570906251951m55484893w49fcfd34d80790ef@mail.gmail.com>

I've got a weird issue that I can't seem to solve.
Overview.  Network is running on a core router which is a 7513 with
channelized DS3's split into ds1's to customers.  I have one customer who
has 2 T1's bonded using multilink ppp.  I can ping everything on our
network, including other customers.  But nothing is making it out of our
network to our peers.  I've moved the t1 to multiple cards and interfaces.
 Separating the T1's works fine, but multilink kills the public routing side
of it, even when the source IP is a public address that routes fine on a
single interface.

Any ideas what may cause something like this?  I've got a ton of other
customers setup with this identical hardware and configuration working fine.
 I've also swapped out hardware at the remote end as well.

From nsp at myzionetworks.com  Thu Jun 25 23:31:29 2009
From: nsp at myzionetworks.com (Todd Shipway)
Date: Thu, 25 Jun 2009 23:31:29 -0400
Subject: [c-nsp] Can't ping outside network over T1
In-Reply-To: <1330512058-1245986973-cardhu_decombobulator_blackberry.rim.net-1398872956-@bxe1086.bisx.prod.on.blackberry>
References: <1330512058-1245986973-cardhu_decombobulator_blackberry.rim.net-1398872956-@bxe1086.bisx.prod.on.blackberry>
Message-ID: <6dde6e570906252031k7be48088k6f52f204ff1ffd80@mail.gmail.com>

Nope.  No filtering at all on the entire path for this customer.

On Thu, Jun 25, 2009 at 11:28 PM, <rgolodner at infratection.com> wrote:

> Todd, any egress filtering to the customer in place that is different from
> your other configs?
> Richard
> ------Original Message------
> From: Todd Shipway
> Sender: cisco-nsp-bounces at puck.nether.net
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Can't ping outside network over T1
> Sent: Jun 25, 2009 9:51 PM
>
> I've got a weird issue that I can't seem to solve.
> Overview.  Network is running on a core router which is a 7513 with
> channelized DS3's split into ds1's to customers.  I have one customer who
> has 2 T1's bonded using multilink ppp.  I can ping everything on our
> network, including other customers.  But nothing is making it out of our
> network to our peers.  I've moved the t1 to multiple cards and interfaces.
>  Separating the T1's works fine, but multilink kills the public routing
> side
> of it, even when the source IP is a public address that routes fine on a
> single interface.
>
> Any ideas what may cause something like this?  I've got a ton of other
> customers setup with this identical hardware and configuration working
> fine.
>  I've also swapped out hardware at the remote end as well.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> Sent via BlackBerry from T-Mobile

From frnkblk at iname.com  Fri Jun 26 00:15:04 2009
From: frnkblk at iname.com (Frank Bulk)
Date: Thu, 25 Jun 2009 23:15:04 -0500
Subject: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)
In-Reply-To: <4A4316CE.30703@linkstate.dk>
References: <58A4A6F7-6F23-4A2B-8067-5673E72CDA7F@linkstate.dk>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABftgbjvFBLS78PXSgL3NhsAQAAAAA=@iname.com>
	<4A4316CE.30703@linkstate.dk>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAB0eLVBxOWJQIx26KTN+8KEAQAAAAA=@iname.com>

Ah, so there's non-BBRAS traffic you need to push around -- then the ASR
makes more sense.

We're using RADIUS for those who need static IPs -- all others get it via
DHCP.  There's no difference in the VC creation, but what happens with those
who have a Framed-IP entry, they get that IP address assigned during the PPP
process.

Yes, VLAN translation support among Cisco's gear is mixed, at best.

Frank

-----Original Message-----
From: Peter Kr?pl [mailto:peter at linkstate.dk] 
Sent: Thursday, June 25, 2009 1:19 AM
To: Frank Bulk
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)

Hi Frank,

The reason for choosing the ASR it that it also has to terminate some 
bigger access connections
delivered to us as OinQ ethernet, but thats plain stuff and is not a 
speciffic BBRAS function.

Just to clarify, are you using radius for DHCP subscribers or only for PPP ?

One last thing that came to my mind is juniper's abillity to hasve local 
xconnects/EoMPLS circuits,
so you can connect port a vlan x to port b vlan y, very usefull when 
providing point to point  L2
services, eg. when the access circuits are delivered on the same 
interface in different vlans.

Kind Regards,
Peter Kr?pl


Frank Bulk wrote:
> The ASR1002 seems overkill for 2000 subs, but perhaps a certain feature or
> PPS is not supported on a 7200 platform.
>
> Yes, RADIUS can hand out a Framed-IP just fine.  We do it all the time.
>
> Frank
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Kr?pl
> Sent: Wednesday, June 24, 2009 3:11 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco ASR as BBRAS... ? (is this a sane solution)
>
> Hi Group,
>
> I am currently considdering to replace a couple of juniper ERX310's,
> with cisco ASR1002's. The junipers, are doing PPPoE termination for
> both OinQ vlans and ATM pvc's and also DHCP for some subscribers.
> The ATM part will remain on the juniper routers, as this will be
> decomissioned in the near future.
>
> We have approx. 1000 subscribers on each ERX right now, and that
> stays the same for the ASR's. Maybe 2000 subscribers per box, in
> 2 years time.
>
> So the task for the ASR's is to terminate QinQ and provide PPPoE
> or DHCP servcies to each subscriber in order to provide them with
> internet access. The ASR should also be a part of our MPLS network,
> that contains Cat6500/Sup720 and Cat7600/Rsp720 boxes. As we have
> some connections terminated into different VRF's, but in that case the  
> service
> is static confiured on the routers, so no DHCP, PPP or other stuff  
> just plain IP.
>
> It is also a reuirement that it is possible to build EoMPLS circuits  
> from either
> a single or double tagged vlan on the ASR to a vlan subinterface on a
> Cat6500/7600.
>
> The juniper routers today provide the DHCP service via RADIUS,
> has cisco something simillar ? You can get lot's of radius servers  
> that use
> a database as their backend, but no decent DHCP server. This makes
> subscriber  provisioning harder to do on the fly. So it would be a shame
> to loose this feature. All of our subscribers have static IP's.
>
> I have made the following shopping list:
> ASR1002- 5G/K9 ASR1002 w/ESP 5G,AESK9,4GB DRAM
> FLASR1- BB- RTU Broadband Right To Use Feature Lic for ASR1000 Series
> FLASR1- BB- 4K Broadband 4K Sessions Feature Lic for ASR1000 Series
> SASR1R1- AIS-K9 -21SR Cisco ASR 1000 Series RP1 ADVANCED IP SERVICES
> SPA- 8X1GE- V2 Cisco 8 Port Gigabit Ethernet Shared Port Adapter
>
> Would this solution workout fine ?
> Any alternatives.... ?
>
> Kind Regards,
> Peter Kr?pl
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>   



From justin at justinshore.com  Fri Jun 26 01:17:40 2009
From: justin at justinshore.com (Justin Shore)
Date: Fri, 26 Jun 2009 00:17:40 -0500
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com>	<C66941E7.164CF%sigurbjornl@vodafone.is>	<20090625163851.GB25366@lboro.ac.uk>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local>
Message-ID: <4A4459F4.4030908@justinshore.com>

Like Ryan said, clogin takes care of it.  The only problem I've run into 
is with v8.2 of the ASA code.  Some nimrod programmer thought it would 
be a good idea to store config related to the new core dump option in 
v8.2 in a text file on the flash volume.  The programmer also decided to 
update this file every time 'sh run' is executed.  So every time RANCID 
would run against at v8.2 ASA it would execute 'sh run' (write term 
actually) which would cause the text file to be regenrated (though 
nothing in the file changed) with a new timestamp; then when RANCID 
extracted the contents of 'dir all' it would alert you that a timestamp 
had changed on a file on the flash volume.  Genius!  I worked with TAC 
to get that identified as a bug.  Earlier this week my TAC engineer 
posted a interim release that is supposed to fix the issue.  I haven't 
had a chance to apply it just yet.  If anyone wants the BugID so you can 
request the fixed image from TAC let me know; it hasn't been rolled into 
a publicly-accessible interim release yet.

Other than that RANCID is fantastic.  I unleash RANCID on my equipment 
once an hour.  In a way it's also like a TripWire check for my network 
devices.  If something changes that I know I didn't change then I have 
cause to investigate.  This actually led me to discover a compromised 
router about 3 years ago.  Someone set up a GRE tunnel out of a router 
I'd recently taken control over (but hadn't migrated AAA yet or hardened 
to my standards).  The tunnel hit a server in Korea.  They pointed 
several statics across the tunnel including some that covered Paypal and 
Amazon.  I'm assuming they were trying to steal credit card info.  I 
found the RANCID diff emails the next morning when I got to work and had 
the router cleaned up inside of an hour.  RANCID has been an absolute 
life saver for me several dozen times.

Justin


Ryan West wrote:
> It handles it fine.  This is basically all you have to do to get it work with ASA/PIXen:
> 
> add user customer-fw1             admin
> add password customer-fw1         mypassword    mypassword
> add autoenable customer-fw1       0
> add method customer-fw1           ssh telnet
> 
> We did a very minor tweak to allow netscreen's to be backed up and parsed as well and configured cvsweb to manage the diffs / revision control.
> 
> -ryan
> 
> -----Original Message-----
> From: A.L.M.Buxey at lboro.ac.uk [mailto:A.L.M.Buxey at lboro.ac.uk] 
> Sent: Thursday, June 25, 2009 12:39 PM
> To: Sigurbj?rn Birkir L?russon
> Cc: Ryan West; William; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] PIX/ASA Change Control
> 
> hi,
> 
> regarding RANCID and Cisco ASAs - are there common
> scripts etc for logging/scraping such devices as there
> are for cisco (clogin), foundry (flogin) etc

From swmike at swm.pp.se  Fri Jun 26 01:51:23 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Fri, 26 Jun 2009 07:51:23 +0200 (CEST)
Subject: [c-nsp] Can't ping outside network over T1
In-Reply-To: <6dde6e570906251951m55484893w49fcfd34d80790ef@mail.gmail.com>
References: <6dde6e570906251951m55484893w49fcfd34d80790ef@mail.gmail.com>
Message-ID: <alpine.DEB.1.10.0906260750440.22851@uplift.swm.pp.se>

On Thu, 25 Jun 2009, Todd Shipway wrote:

> Any ideas what may cause something like this?  I've got a ton of other
> customers setup with this identical hardware and configuration working fine.
> I've also swapped out hardware at the remote end as well.

If you traceroute from the peer, how far do you get towards the customer? 
Do you even get to the 7500?

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From lukas at spritelink.net  Fri Jun 26 03:06:53 2009
From: lukas at spritelink.net (Lukas Garberg)
Date: Fri, 26 Jun 2009 09:06:53 +0200
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
Message-ID: <4A44738D.306@spritelink.net>

Hi all,

while configuring an OSPF process for a VRF on a Cisco 3550-12G
(running 12.2(25)SE) I notice that the command "passive-interface"
is unavailable. How can this be? Is there another way I can suppress
routing updates on an interface?

Relevant parts of the configuration:
!
ip vrf SAN
 rd 29468:1
!
interface Loopback1
 ip vrf forwarding SAN
 ip address 172.17.0.242 255.255.255.255
!
interface Vlan390
 ip vrf forwarding SAN
 ip address 172.17.0.30 255.255.255.252
!        
interface Vlan391
 ip vrf forwarding SAN
 ip address 172.16.8.1 255.255.252.0
!        
router ospf 64512 vrf SAN
 log-adjacency-changes
 auto-cost reference-bandwidth 10000
 capability vrf-lite
 area 0 authentication message-digest
 network 172.16.0.0 0.15.255.255 area 0
!

Regards,
Lukas Garberg

From achatz at forthnet.gr  Fri Jun 26 04:02:40 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Fri, 26 Jun 2009 11:02:40 +0300
Subject: [c-nsp] number of broadband sessions on ESR10K and 7600
In-Reply-To: <a89d89ac0906251145h5a1143c5x5ae0395106cb476a@mail.gmail.com>
References: <a89d89ac0906251145h5a1143c5x5ae0395106cb476a@mail.gmail.com>
Message-ID: <4A4480A0.7000103@forthnet.gr>



Marlon Duksa wrote on 25/06/2009 21:45:
> Hi - does anyone know how many PPPoE and IPoE sessions can 7600 support PER
> CHASSIS with ES+40 cards (no interested in SIP-400)?
> Also how many PPPoX sessions can support ESR 10K - I see in the
> documentation that the number per chassis is 32K but then Cisco is selling
> licenses for 64K sessions. WHich one is true?

I can't tell for the 7600/ES+ (we're still testing it), but the C10k4 numbers are surely exaggerated (they most probably 
refer to the max hw/sw resources, but the cpu will reach its limit much sooner).
The ASR1k numbers are much closer to the reality.

--
Tassos

> 
> Thanks,
> Marlon
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From A.L.M.Buxey at lboro.ac.uk  Fri Jun 26 04:27:36 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Fri, 26 Jun 2009 09:27:36 +0100
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <4A4459F4.4030908@justinshore.com>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com>
	<C66941E7.164CF%sigurbjornl@vodafone.is>
	<20090625163851.GB25366@lboro.ac.uk>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local>
	<4A4459F4.4030908@justinshore.com>
Message-ID: <20090626082736.GC26638@lboro.ac.uk>

Hi,

> Like Ryan said, clogin takes care of it.  The only problem I've run into  
> is with v8.2 of the ASA code.  Some nimrod programmer thought it would  

yes - I've been reading those threads (the joy of the internet eh? ;-) )
which is why I was wondering about a special script...

> had a chance to apply it just yet.  If anyone wants the BugID so you can  
> request the fixed image from TAC let me know; it hasn't been rolled into  
> a publicly-accessible interim release yet.

ok, thanks for the update

> Other than that RANCID is fantastic.  I unleash RANCID on my equipment  
> once an hour.  In a way it's also like a TripWire check for my network  
> devices.  If something changes that I know I didn't change then I have  
> cause to investigate.  This actually led me to discover a compromised  

oh i know. I love RANCID a lot - we have it doing all of our systems
so i get to see interesting VLAN changes generally before a helpdesk call
even gets in  :-)

alan

From mark.kelsay at confused.com  Fri Jun 26 04:56:41 2009
From: mark.kelsay at confused.com (Kelsay, Mark)
Date: Fri, 26 Jun 2009 09:56:41 +0100
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <20090626082736.GC26638@lboro.ac.uk>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>
	<20090626082736.GC26638@lboro.ac.uk>
Message-ID: <62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>

Thank you very much for all the suggestions.  I have compiled a list and
will be testing in the near future.


Mark

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of
A.L.M.Buxey at lboro.ac.uk
Sent: 26 June 2009 09:28
To: Justin Shore
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] PIX/ASA Change Control

Hi,

> Like Ryan said, clogin takes care of it.  The only problem I've run
into  
> is with v8.2 of the ASA code.  Some nimrod programmer thought it would


yes - I've been reading those threads (the joy of the internet eh? ;-) )
which is why I was wondering about a special script...

> had a chance to apply it just yet.  If anyone wants the BugID so you
can  
> request the fixed image from TAC let me know; it hasn't been rolled
into  
> a publicly-accessible interim release yet.

ok, thanks for the update

> Other than that RANCID is fantastic.  I unleash RANCID on my equipment

> once an hour.  In a way it's also like a TripWire check for my network

> devices.  If something changes that I know I didn't change then I have

> cause to investigate.  This actually led me to discover a compromised


oh i know. I love RANCID a lot - we have it doing all of our systems
so i get to see interesting VLAN changes generally before a helpdesk
call
even gets in  :-)

alan
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

_____________________________________________________________________
This message has been checked for all known viruses by bluesource. For
further information visit www.blue-source.com  

powered by Messagelabs

****** This email is sent for and on behalf of Inspop.com Limited ****** 
Authorised and regulated by the Financial Services Authority.  Registration no. 310635.
Inspop.com Limited [also trading as "Confused.com"] is registered in England and Wales at 2nd Floor, Friary House, Greyfriars Road, Cardiff, CF10 3AE [Reg. No. 03857130].  Any opinions expressed in this email are those of the individual and not necessarily the  company. This email and any files transmitted with it, including replies and forwarded copies  [which may contain alterations] subsequently transmitted from the Company, are confidential  and solely for the use of the intended recipient. It may contain material protected by  attorney-client privilege. If you are not the intended recipient or the person responsible for  delivering to the intended recipient, be advised that you have received this email in error  and that any use is strictly prohibited. 
If you have received this email in error please notify the Information Security Officer by  telephone on +44 [0] 29 2043 4372. Please then delete this email and destroy any copies of it.   This email has been swept for viruses before leaving our system.
Security Warning: Please note that this email has been created in the knowledge that Internet  email is not a 100% secure communications medium.  We advise that you understand and accept  this lack of security when emailing us.
Viruses: Although we have taken steps to ensure that this email and any attachments are free  from any virus, we advise that in keeping with good computing practice the recipient should  ensure they are actually virus free.
We may monitor the content of E-mails sent and received via our network for viruses or  unauthorised use and for other lawful business purposes.



________________________________________________________________________
This e-mail has been scanned for all viruses by Messagelabs. The
service is powered by MessageLabs. ________________________________________________________________________

From drrtuy at ya.ru  Fri Jun 26 05:22:52 2009
From: drrtuy at ya.ru (Roman A. Nozdrin)
Date: Fri, 26 Jun 2009 12:22:52 +0300
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
In-Reply-To: <4A44738D.306@spritelink.net>
References: <4A44738D.306@spritelink.net>
Message-ID: <4A44936C.30501@ya.ru>

Lukas Garberg wrote:
> Hi all,
> 
> while configuring an OSPF process for a VRF on a Cisco 3550-12G
> (running 12.2(25)SE) I notice that the command "passive-interface"
> is unavailable. How can this be? Is there another way I can suppress
> routing updates on an interface?

You can put actual network commands in ospf configuration section. For 
example:

network 172.16.8.1 0.0.0.0
network 172.17.0.30 0.0.0.0
network 172.17.0.242 0.0.0.0

It will activate interfaces in the target VRF only. You can redistribute 
  any other routes you need to announce.

WBR
Roman A. Nozdrin

> Relevant parts of the configuration:
> !
> ip vrf SAN
> rd 29468:1
> !
> interface Loopback1
> ip vrf forwarding SAN
> ip address 172.17.0.242 255.255.255.255
> !
> interface Vlan390
> ip vrf forwarding SAN
> ip address 172.17.0.30 255.255.255.252
> !        interface Vlan391
> ip vrf forwarding SAN
> ip address 172.16.8.1 255.255.252.0
> !        router ospf 64512 vrf SAN
> log-adjacency-changes
> auto-cost reference-bandwidth 10000
> capability vrf-lite
> area 0 authentication message-digest
> network 172.16.0.0 0.15.255.255 area 0
> !
> 
> Regards,
> Lukas Garberg
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From ip at ioshints.info  Fri Jun 26 05:35:41 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Fri, 26 Jun 2009 11:35:41 +0200
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
In-Reply-To: <4A44738D.306@spritelink.net>
References: <4A44738D.306@spritelink.net>
Message-ID: <000c01c9f641$79c831c0$0a00000a@nil.si>

> while configuring an OSPF process for a VRF on a Cisco 
> 3550-12G (running 12.2(25)SE) I notice that the command 
> "passive-interface"
> is unavailable. How can this be?

Interesting ...

> Is there another way I can 
> suppress routing updates on an interface?

Sure - filter inbound OSPF packets. If there's no adjacency (and there will
be none if you are not receiving HELLO packets), there are no routing
updates.

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


From p.mayers at imperial.ac.uk  Fri Jun 26 06:57:57 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 26 Jun 2009 11:57:57 +0100
Subject: [c-nsp] VRF-AWARE MBGP
In-Reply-To: <4A43F1D9.1030706@skoal.name>
References: <31f82fd80906251429h1e30462ai71c598ce0f9f0c41@mail.gmail.com>
	<4A43F1D9.1030706@skoal.name>
Message-ID: <4A44A9B5.10108@imperial.ac.uk>

Gergely Antal wrote:
> you need address-family ipv4 mdt
> and a separate vrf to carry the traffic

I don't think that's what the OP wants. I think he wants a different 
multicast RPF routing table for a VRF.

I don't think you can do this (annoyingly)

From p.mayers at imperial.ac.uk  Fri Jun 26 07:04:20 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 26 Jun 2009 12:04:20 +0100
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
In-Reply-To: <4A44738D.306@spritelink.net>
References: <4A44738D.306@spritelink.net>
Message-ID: <4A44AB34.5010902@imperial.ac.uk>

Lukas Garberg wrote:
> Hi all,
> 
> while configuring an OSPF process for a VRF on a Cisco 3550-12G
> (running 12.2(25)SE) I notice that the command "passive-interface"
> is unavailable. How can this be? Is there another way I can suppress
> routing updates on an interface?

It's a bug. IIRC you can put the "passive-interface" statement in a 
non-VRF OSPF process and it work e.g.

router ospf 1
   passive-interface Vlan390
   passive-interface Vlan391

router ospf 64512 vrf SAN
   network ...

The other option would be to use "redis connected subnets" and change 
your network statement to only cover p2p e.g.

router ospf 64512 vrf SAN
   redistribute connected subnets
   network 172.17.0.0 0.0.0.255 area 0

...but this'll change the routes to be OSPF E2s. I used to think this 
was advantageous (incremental SPF works better on routes changes at leaf 
nodes of the tree i.e. E1/E2 routes) but have since been convinced that 
the increased time it takes to sync LSDB outweighs that advantage on 
modern routers.

From linux.yahoo at gmail.com  Fri Jun 26 08:03:36 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Fri, 26 Jun 2009 14:03:36 +0200
Subject: [c-nsp] RSP 720
Message-ID: <7100ed370906260503h4a25fb99r6dcbb8680c47e84a@mail.gmail.com>

Is it possible to install RSP 720 on a 6509-V-E chassis?

Any experiences?

Just for some tests, no production

From gert at greenie.muc.de  Fri Jun 26 08:17:25 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 26 Jun 2009 14:17:25 +0200
Subject: [c-nsp] RSP 720
In-Reply-To: <7100ed370906260503h4a25fb99r6dcbb8680c47e84a@mail.gmail.com>
References: <7100ed370906260503h4a25fb99r6dcbb8680c47e84a@mail.gmail.com>
Message-ID: <20090626121725.GV290@greenie.muc.de>

Hi,

On Fri, Jun 26, 2009 at 02:03:36PM +0200, Manu Chao wrote:
> Is it possible to install RSP 720 on a 6509-V-E chassis?
> 
> Any experiences?
> 
> Just for some tests, no production

You'll get quite some test results, but no production...

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090626/be92ce07/attachment.bin>

From Jeff.Wojciechowski at midlandpaper.com  Fri Jun 26 08:35:26 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Fri, 26 Jun 2009 07:35:26 -0500
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>
	<20090626082736.GC26638@lboro.ac.uk>
	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>

Hi All,

Has anyone got a particular flavor of Linux/BSD whatever to run RANCID on? Any luck virtualizing inside M$ Hyper-V/Virtual Box/Virtual PC/Etc? We have a few production Hyper-V servers so would like to go that route if possible. Our overall plan is to reduce the number of physical boxes acting as utility servers so would rather not have to have a physical box dedicated to RANCID.

Thanks,

-Jeff


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Kelsay, Mark
Sent: Friday, June 26, 2009 3:57 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] PIX/ASA Change Control

Thank you very much for all the suggestions.  I have compiled a list and
will be testing in the near future.


Mark




From rdobbins at arbor.net  Fri Jun 26 08:52:00 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Fri, 26 Jun 2009 19:52:00 +0700
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>
	<20090626082736.GC26638@lboro.ac.uk>
	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>
Message-ID: <A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>


On Jun 26, 2009, at 7:35 PM, Jeff Wojciechowski wrote:

> flavor of Linux/BSD whatever to run RANCID on?

It'll run on just about anything, and has no special requirements  
which would preclude it running on a virtual server; just do a bit of  
testing and scale CPU/RAM/storage in order to meet your requirements  
(note that RANCID is pretty lightweight).

In point of fact, OSS tools like RANCID and others are a great way to  
dip one's toes into virtualization and gain operational experience  
with same prior to rolling out end-user-facing applications and  
services.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From rwest at zyedge.com  Fri Jun 26 09:01:11 2009
From: rwest at zyedge.com (Ryan West)
Date: Fri, 26 Jun 2009 09:01:11 -0400
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>
	<20090626082736.GC26638@lboro.ac.uk>
	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>
	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>

If you're ever run a ./configure script on a *nix system, you'll be more than qualified to install RANCID.  It's pretty straightforward.  

I'm curious to see what others are using for a frontend to RANCID.  Besides the emailing of the diff's that take place, what are others using to browse the repository?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Roland Dobbins
Sent: Friday, June 26, 2009 8:52 AM
To: Cisco-nsp
Subject: Re: [c-nsp] PIX/ASA Change Control


On Jun 26, 2009, at 7:35 PM, Jeff Wojciechowski wrote:

> flavor of Linux/BSD whatever to run RANCID on?

It'll run on just about anything, and has no special requirements  
which would preclude it running on a virtual server; just do a bit of  
testing and scale CPU/RAM/storage in order to meet your requirements  
(note that RANCID is pretty lightweight).

In point of fact, OSS tools like RANCID and others are a great way to  
dip one's toes into virtualization and gain operational experience  
with same prior to rolling out end-user-facing applications and  
services.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From msgeekgirl at gmail.com  Fri Jun 26 09:11:10 2009
From: msgeekgirl at gmail.com (Ms Geekgirl)
Date: Fri, 26 Jun 2009 09:11:10 -0400
Subject: [c-nsp] Network Address Response
In-Reply-To: <01c501c9f5d3$a9740f70$fc5c2e50$@net>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>
Message-ID: <253238b70906260611kc6b98aj4dde9137463ed2cc@mail.gmail.com>

On Thu, Jun 25, 2009 at 4:28 PM, Ray Burkholder<ray at oneunified.net> wrote:
> I was wondering the reasoning for routers/switches to respond for the
> network portion of an ip-address range.
>
> For example, a router interface A with 10.0.0.1/30 and interface B with
> 10.0.0.5/30.
>
> Generate a ping from a device several hops away on the A side to the B side
> network address of 10.0.0.4. The router will respond with an echo reply
> with an address of 10.0.0.1.
>
> Is this expected behaviour? And the reason?
>
> Ray

Yes.

By default. you will almost always get a response from the closest interface
to the source of the ping (*unless instructed otherwise in each hop's
configuration.)

In your example, this is what that looks like. Somewhat simplistic and others
may have a better response, but here goes...

The echo-request is sent from c1 to the IP 10.0.0.5 assigned to intB
on dest-rtr.
dest-rtr will receive the echo-request on intA, forward to intB.

dest-rtr will lookup the best return route to your network. The return route
chosen is towards hop2, via intA and the packet is sent out through intA.


 |    >     >     >     >    >    path of echo request > |
 ^                                                       v
[c1-B]----[A-hop1-B]----[A-hop2-B]----[(intA) dest-rtr (intB)]----[A-c2]
 ^                                       v
 | <    <    <    path of reply  <    <  |


If you were to ping c2, the response would come from c2's IP (since this
node only has one IP and is the closest to you :)

In anticipation of a possible traceroute question, the same applies.

If you were to trace to c2, the responses* would all come from the closest
interface towards c1. In the above, all the responses would come from the
_A_ interfaces of each hop.

If c2 were to ping/trace to c1, the responses would come from the _B_
interfaces of each hop.

I hope that I haven't confused anything and that this was helpful for you.

- - -
mgg

Like a seedling in the Spring, green and vulnerable.

From josh.fleishman at gmail.com  Fri Jun 26 09:30:13 2009
From: josh.fleishman at gmail.com (Josh Fleishman)
Date: Fri, 26 Jun 2009 09:30:13 -0400
Subject: [c-nsp] VRF-AWARE MBGP
In-Reply-To: <4A44A9B5.10108@imperial.ac.uk>
References: <31f82fd80906251429h1e30462ai71c598ce0f9f0c41@mail.gmail.com>
	<4A43F1D9.1030706@skoal.name> <4A44A9B5.10108@imperial.ac.uk>
Message-ID: <31f82fd80906260630p54130eabk93480de7e1296752@mail.gmail.com>

Indeed it is.  I'm exchanging vrf routes with a router in another AS, and I
want to enable RPF checks via a different path than the EBGP learned unicast
path.  The only other option I see is using static mroutes in the upstream
router.  Not exactly ideal.

-Josh



On Fri, Jun 26, 2009 at 6:57 AM, Phil Mayers <p.mayers at imperial.ac.uk>wrote:

> Gergely Antal wrote:
>
>> you need address-family ipv4 mdt
>> and a separate vrf to carry the traffic
>>
>
> I don't think that's what the OP wants. I think he wants a different
> multicast RPF routing table for a VRF.
>
> I don't think you can do this (annoyingly)
>

From ip at ioshints.info  Fri Jun 26 09:32:34 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Fri, 26 Jun 2009 15:32:34 +0200
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
In-Reply-To: <4A44936C.30501@ya.ru>
References: <4A44738D.306@spritelink.net> <4A44936C.30501@ya.ru>
Message-ID: <003501c9f662$91179700$0a00000a@nil.si>

> > while configuring an OSPF process for a VRF on a Cisco 3550-12G 
> > (running 12.2(25)SE) I notice that the command "passive-interface"
> > is unavailable. How can this be? Is there another way I can 
> suppress 
> > routing updates on an interface?
> 
> You can put actual network commands in ospf configuration section. For
> example:
> 
> network 172.16.8.1 0.0.0.0
> network 172.17.0.30 0.0.0.0
> network 172.17.0.242 0.0.0.0
> 
> It will activate interfaces in the target VRF only. You can 
> redistribute
>   any other routes you need to announce.

... And we're back to the neverending question: ignoring the obvious
implications for stub areas, is it better to advertise connected subnets as
parts of router (type-1) LSA or as individual external (type-5) routes?

Any thoughts or preferences?
Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


From linux.yahoo at gmail.com  Fri Jun 26 09:52:27 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Fri, 26 Jun 2009 15:52:27 +0200
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
In-Reply-To: <003501c9f662$91179700$0a00000a@nil.si>
References: <4A44738D.306@spritelink.net> <4A44936C.30501@ya.ru>
	<003501c9f662$91179700$0a00000a@nil.si>
Message-ID: <7100ed370906260652k479d66a9v6c7f0fa9c60214d3@mail.gmail.com>

type-2 ;)

On Fri, Jun 26, 2009 at 3:32 PM, Ivan Pepelnjak <ip at ioshints.info> wrote:

> > > while configuring an OSPF process for a VRF on a Cisco 3550-12G
> > > (running 12.2(25)SE) I notice that the command "passive-interface"
> > > is unavailable. How can this be? Is there another way I can
> > suppress
> > > routing updates on an interface?
> >
> > You can put actual network commands in ospf configuration section. For
> > example:
> >
> > network 172.16.8.1 0.0.0.0
> > network 172.17.0.30 0.0.0.0
> > network 172.17.0.242 0.0.0.0
> >
> > It will activate interfaces in the target VRF only. You can
> > redistribute
> >   any other routes you need to announce.
>
> ... And we're back to the neverending question: ignoring the obvious
> implications for stub areas, is it better to advertise connected subnets as
> parts of router (type-1) LSA or as individual external (type-5) routes?
>
> Any thoughts or preferences?
> Ivan
>
> http://www.ioshints.info/about
> http://blog.ioshints.info/
>
> _______________________________________________
>  cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From geoff at pendery.net  Fri Jun 26 10:04:39 2009
From: geoff at pendery.net (Geoffrey Pendery)
Date: Fri, 26 Jun 2009 09:04:39 -0500
Subject: [c-nsp] Network Address Response
In-Reply-To: <253238b70906260611kc6b98aj4dde9137463ed2cc@mail.gmail.com>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>
	<253238b70906260611kc6b98aj4dde9137463ed2cc@mail.gmail.com>
Message-ID: <d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>

No, I think he's asking why the router with address 10.0.0.5 responds
to pings that have a destination IP of 10.0.0.4.  The echo request is
targeted at a network address, not at the router.

I've also observed this behavior (more than ICMP though - I have a
router responding to SNMP and being discovered by our configuration
management team, on the network address of one of its interfaces) and
would like to know more about why...


-Geoff


On Fri, Jun 26, 2009 at 8:11 AM, Ms Geekgirl<msgeekgirl at gmail.com> wrote:
> On Thu, Jun 25, 2009 at 4:28 PM, Ray Burkholder<ray at oneunified.net> wrote:
>> I was wondering the reasoning for routers/switches to respond for the
>> network portion of an ip-address range.
>>
>> For example, a router interface A with 10.0.0.1/30 and interface B with
>> 10.0.0.5/30.
>>
>> Generate a ping from a device several hops away on the A side to the B side
>> network address of 10.0.0.4. The router will respond with an echo reply
>> with an address of 10.0.0.1.
>>
>> Is this expected behaviour? And the reason?
>>
>> Ray
>
> Yes.
>
> By default. you will almost always get a response from the closest interface
> to the source of the ping (*unless instructed otherwise in each hop's
> configuration.)
>
> In your example, this is what that looks like. Somewhat simplistic and others
> may have a better response, but here goes...
>
> The echo-request is sent from c1 to the IP 10.0.0.5 assigned to intB
> on dest-rtr.
> dest-rtr will receive the echo-request on intA, forward to intB.
>
> dest-rtr will lookup the best return route to your network. The return route
> chosen is towards hop2, via intA and the packet is sent out through intA.
>
>
> ?| ? ?> ? ? > ? ? > ? ? > ? ?> ? ?path of echo request > |
> ?^ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? v
> [c1-B]----[A-hop1-B]----[A-hop2-B]----[(intA) dest-rtr (intB)]----[A-c2]
> ?^ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? v
> ?| < ? ?< ? ?< ? ?path of reply ?< ? ?< ?|
>
>
> If you were to ping c2, the response would come from c2's IP (since this
> node only has one IP and is the closest to you :)
>
> In anticipation of a possible traceroute question, the same applies.
>
> If you were to trace to c2, the responses* would all come from the closest
> interface towards c1. In the above, all the responses would come from the
> _A_ interfaces of each hop.
>
> If c2 were to ping/trace to c1, the responses would come from the _B_
> interfaces of each hop.
>
> I hope that I haven't confused anything and that this was helpful for you.
>
> - - -
> mgg
>
> Like a seedling in the Spring, green and vulnerable.
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From ray at oneunified.net  Fri Jun 26 10:12:35 2009
From: ray at oneunified.net (Ray Burkholder)
Date: Fri, 26 Jun 2009 11:12:35 -0300
Subject: [c-nsp] Network Address Response
In-Reply-To: <d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>	
	<253238b70906260611kc6b98aj4dde9137463ed2cc@mail.gmail.com>
	<d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>
Message-ID: <043601c9f668$45e05050$d1a0f0f0$@net>

> 
> No, I think he's asking why the router with address 10.0.0.5 responds
> to pings that have a destination IP of 10.0.0.4.  The echo request is
> targeted at a network address, not at the router.

Yes, that is the basis for my question.  I suppose to clarify further, a /30
has four addresses:

* network portion
* link ip 1
* link ip 2
* broadcast

Pings to the device originating on the ingress side but destined to the
network portion of the egress side 
are responded to back out the ingress side with the link ip of the ingress
side.

It appears that the router listens to the 'network address' portion of a
subnet.  Is this
good, bad, or ugly?  Should-it/can-it be turned off?

> 
> I've also observed this behavior (more than ICMP though - I have a
> router responding to SNMP and being discovered by our configuration
> management team, on the network address of one of its interfaces) and
> would like to know more about why...
> 

Ah, good, someone else has the same experience.


-- 
Scanned for viruses and dangerous content at 
http://www.oneunified.net and is believed to be clean.


From A.L.M.Buxey at lboro.ac.uk  Fri Jun 26 10:17:00 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Fri, 26 Jun 2009 15:17:00 +0100
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
References: <20090626082736.GC26638@lboro.ac.uk>
	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>
	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
Message-ID: <20090626141700.GB27270@lboro.ac.uk>

Hi,

> I'm curious to see what others are using for a frontend to RANCID.  Besides the emailing of the diff's that take place, what are others using to browse the repository?

I've been toying with some web-based CVS tools/viewers...but nothing serious yet.

alan

From justin at justinshore.com  Fri Jun 26 10:25:04 2009
From: justin at justinshore.com (Justin Shore)
Date: Fri, 26 Jun 2009 09:25:04 -0500
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>	<20090626082736.GC26638@lboro.ac.uk>	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
Message-ID: <4A44DA40.1010809@justinshore.com>

Ryan West wrote:
> I'm curious to see what others are using for a frontend to RANCID.  Besides the emailing of the diff's that take place, what are others using to browse the repository?

I'm not a CVS buff so I'm sure someone that falls into that category 
would have a better solution.  I currently just use the standard cvsweb 
CGI.  It works well enough.  I keep it in a password protected directory 
on my servers.  Not overly elegant but it works well enough.

Does anyone else have any other suggestions for a web GUI front-end to 
CVS for RANCID use?

Justin

From sthaug at nethelp.no  Fri Jun 26 10:39:55 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Fri, 26 Jun 2009 16:39:55 +0200 (CEST)
Subject: [c-nsp] Network Address Response
In-Reply-To: <d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>
	<253238b70906260611kc6b98aj4dde9137463ed2cc@mail.gmail.com>
	<d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>
Message-ID: <20090626.163955.74716325.sthaug@nethelp.no>

> No, I think he's asking why the router with address 10.0.0.5 responds
> to pings that have a destination IP of 10.0.0.4.  The echo request is
> targeted at a network address, not at the router.
> 
> I've also observed this behavior (more than ICMP though - I have a
> router responding to SNMP and being discovered by our configuration
> management team, on the network address of one of its interfaces) and
> would like to know more about why...

History. It *used to be* the subnet broadcast address, at least for
BSD Unix boxes and a bunch of other equipment.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From MatlockK at exempla.org  Fri Jun 26 10:42:19 2009
From: MatlockK at exempla.org (Matlock, Kenneth L)
Date: Fri, 26 Jun 2009 08:42:19 -0600
Subject: [c-nsp] Network Address Response
In-Reply-To: <043601c9f668$45e05050$d1a0f0f0$@net>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>	<253238b70906260611kc6b98aj4dde9137463ed2cc@mail.gmail.com><d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>
	<043601c9f668$45e05050$d1a0f0f0$@net>
Message-ID: <4288131ED5E3024C9CD4782CECCAD2C7065D37CA@LMC-MAIL2.exempla.org>

I don't have a test box handy I can try it on, but does it still exhibit
that behavior if you put a 'no ip directed-broadcast' in the interface
config of the 10.0.0.5 interface?

By default it's on, so it takes anything for the network or broadcast
Layer 3 addresses and spits them out as Layer 2 broadcasts, which the
router may be seeing/processing.

Ken Matlock
Network Analyst
Exempla Healthcare
(303) 467-4671
matlockk at exempla.org



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ray Burkholder
Sent: Friday, June 26, 2009 8:13 AM
To: 'Geoffrey Pendery'; 'Ms Geekgirl'
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Network Address Response

> 
> No, I think he's asking why the router with address 10.0.0.5 responds
> to pings that have a destination IP of 10.0.0.4.  The echo request is
> targeted at a network address, not at the router.

Yes, that is the basis for my question.  I suppose to clarify further, a
/30
has four addresses:

* network portion
* link ip 1
* link ip 2
* broadcast

Pings to the device originating on the ingress side but destined to the
network portion of the egress side 
are responded to back out the ingress side with the link ip of the
ingress
side.

It appears that the router listens to the 'network address' portion of a
subnet.  Is this
good, bad, or ugly?  Should-it/can-it be turned off?

> 
> I've also observed this behavior (more than ICMP though - I have a
> router responding to SNMP and being discovered by our configuration
> management team, on the network address of one of its interfaces) and
> would like to know more about why...
> 

Ah, good, someone else has the same experience.


-- 
Scanned for viruses and dangerous content at 
http://www.oneunified.net and is believed to be clean.

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From jmkeller at houseofzen.org  Fri Jun 26 10:12:19 2009
From: jmkeller at houseofzen.org (James Michael Keller)
Date: Fri, 26 Jun 2009 10:12:19 -0400
Subject: [c-nsp] OT: Cisco WAAS Setup Scenario
In-Reply-To: <18dba4e50905181342y6cb3c34bs275715c38338b8ff@mail.gmail.com>
References: <18dba4e50905181342y6cb3c34bs275715c38338b8ff@mail.gmail.com>
Message-ID: <4A44D743.9000504@houseofzen.org>

Felix,

As the SYN packet for a new tcp session passes through the WAE unit 
(in-line or via wccp) the WAE uses the tcp option fields of the SYN 
packet to tag the packet with it's unique ID and it's capabilities (CIFS 
Acceleration, DRE, TFO, etc).   If the flow doesn't encounter another 
WAE unit, it is processed by the other end of the connection as a normal 
(outside of firewalls/IDP blocking it for unknown tcp options).    If 
passing through a another WAE unit, the return SYN/ACK is tagged by that 
WAE and any matching capabilities are enabled for that flow on the 
return path WAE and the source WAE.

The use of the TCP options fields for the 'WAAS magic' is where you run 
into problems with firewalls and IDS systems, they either drop packets 
completely or strip the TCP 'unknown' options from the packets.   Which 
prevents any optimizations from engaging (if stripping) or the 
connections being blocked (if dropping packet).

ASA/PIX's where updated to pass WAE tagged traffic, other vendors may 
have issues passing the traffic.   It depends on what your WAN network 
is connected with.   In the case I had to get it working via a 
Checkpoint->Checkpoint IPSEC VPN, the wire-mode VPN feature worked to 
avoid any packet mangling of the TCP options and we got full optimization.

I would also make sure you are on the latest and greatest release.   
There have been a lot of improvements and general bug / crash fixes in 
the  in the last year.

---
James Michael Keller



Felix Nkansah wrote:
> Hi Team,
> Pardon me for the OT.
>
> I want to deploy Cisco WAAS as a proof of concept to a client with several
> sites connected in a hub-n-spoke topology.
>
> I would deploy only one WAE (and a CM) at the hub/head office and one WAE at
> a selected spoke, in production.
>
> I intend on setting the WAEs Inline for simplicity. However, I have some
> doubts that I hope you could help clear.
>
> If the WAE at the head office accelerates traffic going to a spoke site
> without a WAE, would the traffic be dropped?
>
> If the hub site receives non-accelerated traffic from spoke sites without
> WAE, would the head office WAE drop the traffic?
>
> I am concerned because I know the acceleration process utilizes compression
> schemes which may require decompression at the other site by a WAE.
>
> Labbing this up would give me the answers, but I felt I could leverage your
> skills for quick answers to these :-)
>
> Your responses are appreciated.
>
> Felix
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From BBlackford at nwresd.k12.or.us  Fri Jun 26 10:53:47 2009
From: BBlackford at nwresd.k12.or.us (Bill Blackford)
Date: Fri, 26 Jun 2009 07:53:47 -0700
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <4A44DA40.1010809@justinshore.com>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>
	<20090626082736.GC26638@lboro.ac.uk>
	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>
	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
	<4A44DA40.1010809@justinshore.com>
Message-ID: <6069A203FD01884885C037F81DD7508016CF591C8F@wsc-mail-01.intra.nwresd.k12.or.us>

Webmin, but that's probably overkill

-b

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Justin Shore
Sent: Friday, June 26, 2009 7:25 AM
To: Ryan West
Cc: Cisco-nsp; rancid-discuss at shrubbery.net
Subject: Re: [c-nsp] PIX/ASA Change Control

Ryan West wrote:
> I'm curious to see what others are using for a frontend to RANCID.  Besides the emailing of the diff's that take place, what are others using to browse the repository?

I'm not a CVS buff so I'm sure someone that falls into that category 
would have a better solution.  I currently just use the standard cvsweb 
CGI.  It works well enough.  I keep it in a password protected directory 
on my servers.  Not overly elegant but it works well enough.

Does anyone else have any other suggestions for a web GUI front-end to 
CVS for RANCID use?

Justin
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From p.mayers at imperial.ac.uk  Fri Jun 26 10:58:12 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 26 Jun 2009 15:58:12 +0100
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
In-Reply-To: <7100ed370906260652k479d66a9v6c7f0fa9c60214d3@mail.gmail.com>
References: <4A44738D.306@spritelink.net>
	<4A44936C.30501@ya.ru>	<003501c9f662$91179700$0a00000a@nil.si>
	<7100ed370906260652k479d66a9v6c7f0fa9c60214d3@mail.gmail.com>
Message-ID: <4A44E204.6040905@imperial.ac.uk>

Manu Chao wrote:
> type-2 ;)
> 
> On Fri, Jun 26, 2009 at 3:32 PM, Ivan Pepelnjak <ip at ioshints.info> wrote:
> 
>>>> while configuring an OSPF process for a VRF on a Cisco 3550-12G
>>>> (running 12.2(25)SE) I notice that the command "passive-interface"
>>>> is unavailable. How can this be? Is there another way I can
>>> suppress
>>>> routing updates on an interface?
>>> You can put actual network commands in ospf configuration section. For
>>> example:
>>>
>>> network 172.16.8.1 0.0.0.0
>>> network 172.17.0.30 0.0.0.0
>>> network 172.17.0.242 0.0.0.0
>>>
>>> It will activate interfaces in the target VRF only. You can
>>> redistribute
>>>   any other routes you need to announce.
>> ... And we're back to the neverending question: ignoring the obvious
>> implications for stub areas, is it better to advertise connected subnets as
>> parts of router (type-1) LSA or as individual external (type-5) routes?

I used to be definitely in favour of type-5, then Bruce Pinsky was kind 
enough to reply to an email on this list:

http://puck.nether.net/pipermail/cisco-nsp/2006-November/035851.html

Nowadays, we're all BGP so it's moot!

From ip at ioshints.info  Fri Jun 26 11:01:14 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Fri, 26 Jun 2009 17:01:14 +0200
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
In-Reply-To: <7100ed370906260652k479d66a9v6c7f0fa9c60214d3@mail.gmail.com>
References: <4A44738D.306@spritelink.net> <4A44936C.30501@ya.ru>
	<003501c9f662$91179700$0a00000a@nil.si>
	<7100ed370906260652k479d66a9v6c7f0fa9c60214d3@mail.gmail.com>
Message-ID: <003f01c9f66e$f4aaa7b0$0a00000a@nil.si>

Getting way off topic ...
 
Transit interface (more than one router) => Type 2 LSA
Stub interface (no OSPF neighbors) => stub network within Type 1 LSA
 
Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


  _____  

From: Manu Chao [mailto:linux.yahoo at gmail.com] 
Sent: Friday, June 26, 2009 3:52 PM
To: Ivan Pepelnjak
Cc: Roman A. Nozdrin; Lukas Garberg; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] passive-interface on VRF-specific OSPF process


type-2 ;)


On Fri, Jun 26, 2009 at 3:32 PM, Ivan Pepelnjak <ip at ioshints.info> wrote:


> > while configuring an OSPF process for a VRF on a Cisco 3550-12G
> > (running 12.2(25)SE) I notice that the command "passive-interface"
> > is unavailable. How can this be? Is there another way I can
> suppress
> > routing updates on an interface?
>
> You can put actual network commands in ospf configuration section. For
> example:
>
> network 172.16.8.1 0.0.0.0
> network 172.17.0.30 0.0.0.0
> network 172.17.0.242 0.0.0.0
>
> It will activate interfaces in the target VRF only. You can
> redistribute
>   any other routes you need to announce.


... And we're back to the neverending question: ignoring the obvious
implications for stub areas, is it better to advertise connected subnets as
parts of router (type-1) LSA or as individual external (type-5) routes?

Any thoughts or preferences?

Ivan

http://www.ioshints.info/about
http://blog.ioshints.info/

_______________________________________________

cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/




From msgeekgirl at gmail.com  Fri Jun 26 11:36:42 2009
From: msgeekgirl at gmail.com (Ms Geekgirl)
Date: Fri, 26 Jun 2009 11:36:42 -0400
Subject: [c-nsp] Network Address Response
In-Reply-To: <d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>
	<253238b70906260611kc6b98aj4dde9137463ed2cc@mail.gmail.com>
	<d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>
Message-ID: <253238b70906260836l4bb84aa3u9bf2506d08d159d0@mail.gmail.com>

> On Fri, Jun 26, 2009 at 8:11 AM, Ms Geekgirl<msgeekgirl at gmail.com> wrote:
>> On Thu, Jun 25, 2009 at 4:28 PM, Ray Burkholder<ray at oneunified.net> wrote:
>>> I was wondering the reasoning for routers/switches to respond for the
>>> network portion of an ip-address range.
>>>
>>> For example, a router interface A with 10.0.0.1/30 and interface B with
>>> 10.0.0.5/30.
>>>
>>> Generate a ping from a device several hops away on the A side to the B side
>>> network address of 10.0.0.4. The router will respond with an echo reply
>>> with an address of 10.0.0.1.
>>>
>>> Is this expected behaviour? And the reason?
>>>
>>> Ray
>>
>> Yes.
>>
>> By default. you will almost always get a response from the closest interface
>> to the source of the ping (*unless instructed otherwise in each hop's
>> configuration.)
>>
>> In your example, this is what that looks like. Somewhat simplistic and others
>> may have a better response, but here goes...
>>
>> The echo-request is sent from c1 to the IP 10.0.0.5 assigned to intB
>> on dest-rtr.
>> dest-rtr will receive the echo-request on intA, forward to intB.
>>
>> dest-rtr will lookup the best return route to your network. The return route
>> chosen is towards hop2, via intA and the packet is sent out through intA.
>>
>>
>> ?| ? ?> ? ? > ? ? > ? ? > ? ?> ? ?path of echo request > |
>> ?^ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? v
>> [c1-B]----[A-hop1-B]----[A-hop2-B]----[(intA) dest-rtr (intB)]----[A-c2]
>> ?^ ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? v
>> ?| < ? ?< ? ?< ? ?path of reply ?< ? ?< ?|
>>
>>
>> If you were to ping c2, the response would come from c2's IP (since this
>> node only has one IP and is the closest to you :)
>>
>> In anticipation of a possible traceroute question, the same applies.
>>
>> If you were to trace to c2, the responses* would all come from the closest
>> interface towards c1. In the above, all the responses would come from the
>> _A_ interfaces of each hop.
>>
>> If c2 were to ping/trace to c1, the responses would come from the _B_
>> interfaces of each hop.
>>
>> I hope that I haven't confused anything and that this was helpful for you.
>>

On Fri, Jun 26, 2009 at 10:04 AM, Geoffrey Pendery<geoff at pendery.net> wrote:
> No, I think he's asking why the router with address 10.0.0.5 responds
> to pings that have a destination IP of 10.0.0.4.  The echo request is
> targeted at a network address, not at the router.
>
> I've also observed this behavior (more than ICMP though - I have a
> router responding to SNMP and being discovered by our configuration
> management team, on the network address of one of its interfaces) and
> would like to know more about why...
>
> -Geoff
>

My apologies. But it still *seems* that I partially answered the
question that was asked.

>>>> Generate a ping from a device several hops away on the A side to the B side
>>>> network address of 10.0.0.4. The router will respond with an echo reply
>>>> with an address of 10.0.0.1.

My noobness is now showing...what did you use to view the replies(just
the router's display response or a sniffer?) The reason I ask is,
wouldn't all devices in network B respond to the broadcast request and
it appears to be from the router's intA (unless they were configured
not to respond??)

Thanks.

- - -
mgg

Like a seedling in the Spring, green and vulnerable.

From nicotine at warningg.com  Fri Jun 26 11:28:34 2009
From: nicotine at warningg.com (Brandon Ewing)
Date: Fri, 26 Jun 2009 10:28:34 -0500
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
References: <20090626082736.GC26638@lboro.ac.uk>
	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>
	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
Message-ID: <20090626152834.GA10834@radiological.warningg.com>

On Fri, Jun 26, 2009 at 09:01:11AM -0400, Ryan West wrote:
> 
> I'm curious to see what others are using for a frontend to RANCID.  Besides the emailing of the diff's that take place, what are others using to browse the repository?
> 
> -ryan
> 

I set my latest RANCID installation up with SVN instead of a CVS backend.
I needed to apply a patch to correct an issue where RANCID doesn't
gracefully handle SVN telling it to do an update prior to a commit, but
other than that, it's a drop-in replacement.

Hooking WebSVN into the repository RANCID maintains places a nice web
interface on it, allowing one to see when/how/why changes were made to the
configurations.

Maintaining a working directory locally on the server where you can check
out revisions and perform "svn diff" on is also useful.

-- 
Brandon Ewing                                        (nicotine at warningg.com)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090626/4e588c62/attachment.bin>

From ptimmins at clearrate.com  Fri Jun 26 12:57:14 2009
From: ptimmins at clearrate.com (Paul G. Timmins)
Date: Fri, 26 Jun 2009 12:57:14 -0400
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <4A44DA40.1010809@justinshore.com>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>	<20090626082736.GC26638@lboro.ac.uk>	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
	<4A44DA40.1010809@justinshore.com>
Message-ID: <B98837F93D40A74D8656EAE7C1F57C56917885@EXCHANGE1.corp.clearrate.net>

We use subversion, and giving web access to the repository through the
normal subversion frontend, no special additions, works for us, but our
needs have been basically just to get a last known good configuration to
blow onto a customer's replacement unit prior to dispatching a
technician. Works pretty well, as you can just download the file from
the repository, put it on the unit with xmodem over the serial port as
the startup-config, reboot, and you've got an identical copy of what was
there.

We do this with Adtran Total Access 900 and Netvanta gear and our Cisco
CPE using the same config in Rancid (using "cisco" as the type works
just fine for Adtran AOS based gear) and it's a lifesaver.

-Paul

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Justin Shore
> Sent: Friday, June 26, 2009 10:25 AM
> To: Ryan West
> Cc: Cisco-nsp; rancid-discuss at shrubbery.net
> Subject: Re: [c-nsp] PIX/ASA Change Control
> 
> Ryan West wrote:
> > I'm curious to see what others are using for a frontend to RANCID.
> Besides the emailing of the diff's that take place, what are others
> using to browse the repository?
> 
> I'm not a CVS buff so I'm sure someone that falls into that category
> would have a better solution.  I currently just use the standard
cvsweb
> CGI.  It works well enough.  I keep it in a password protected
> directory
> on my servers.  Not overly elegant but it works well enough.
> 
> Does anyone else have any other suggestions for a web GUI front-end to
> CVS for RANCID use?
> 
> Justin
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From SHughes at GREnergy.com  Fri Jun 26 13:01:16 2009
From: SHughes at GREnergy.com (Hughes, Scott GRE/MG)
Date: Fri, 26 Jun 2009 12:01:16 -0500
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>
	<20090626082736.GC26638@lboro.ac.uk>
	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>
	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
Message-ID: <1E3D2B26-616D-417F-9B26-980ED5855809@GREnergy.com>

Websvn is very slick. RSS feeds, colorized diffs.


On Jun 26, 2009, at 8:04 AM, "Ryan West" <rwest at zyedge.com> wrote:

> If you're ever run a ./configure script on a *nix system, you'll be  
> more than qualified to install RANCID.  It's pretty straightforward.
>
> I'm curious to see what others are using for a frontend to RANCID.   
> Besides the emailing of the diff's that take place, what are others  
> using to browse the repository?
>
> -ryan
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp- 
> bounces at puck.nether.net] On Behalf Of Roland Dobbins
> Sent: Friday, June 26, 2009 8:52 AM
> To: Cisco-nsp
> Subject: Re: [c-nsp] PIX/ASA Change Control
>
>
> On Jun 26, 2009, at 7:35 PM, Jeff Wojciechowski wrote:
>
>> flavor of Linux/BSD whatever to run RANCID on?
>
> It'll run on just about anything, and has no special requirements
> which would preclude it running on a virtual server; just do a bit of
> testing and scale CPU/RAM/storage in order to meet your requirements
> (note that RANCID is pretty lightweight).
>
> In point of fact, OSS tools like RANCID and others are a great way to
> dip one's toes into virtualization and gain operational experience
> with same prior to rolling out end-user-facing applications and
> services.
>
> --- 
> --------------------------------------------------------------------
> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>
>         Unfortunately, inefficiency scales really well.
>
>           -- Kevin Lawton
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
NOTICE TO RECIPIENT: The information contained in this message from Great River Energy and any attachments is confidential and intended only for the named recipient(s). If you have received this message in error, you are prohibited from copying, distributing or using the information. Please contact the sender immediately by return email and delete the original message.
 


From eric at atlantech.net  Fri Jun 26 13:35:50 2009
From: eric at atlantech.net (Eric Van Tol)
Date: Fri, 26 Jun 2009 13:35:50 -0400
Subject: [c-nsp] REP
Message-ID: <2C05E949E19A9146AF7BDF9D44085B86353E994F73@exchange.aoihq.local>

I'm looking at REP for use in a metro ethernet environment and am looking for some real world opinions on its effectiveness.  The available white paper and documentation aren't 100% clear to me that STP can be disabled completely, or whether it should still run in addition to REP.  My preference is to remove STP from any switch in our network, then burn it, spread its ashes in a field, let cattle graze on the grass, then burn the cattle and shoot their remains into space on a collision course with the sun.  Apologies to animal rights activists, but this should give you an idea of how I really feel about Spanning Tree Protocol.

Can anyone share any experiences they've had using REP?  We primarily use ME3400s in a ring topology with each end of the ring terminating in a pair of 6509s.  The 6509s, however, will be repurposed over the next few months as we replace them with an alternate vendor's equipment.  Not sure if this matters, but figured I'd mention it.  Right now, we use strictly layer 3 on all links between nodes on a ring, preventing us from taking advantage of the more advanced layer 2 and vrf-lite features of the ME3400s.  This probably poor design decision was made due to previously perceived limitations with REP some years ago.

Thanks in advance,
evt

From ler762 at gmail.com  Fri Jun 26 13:52:33 2009
From: ler762 at gmail.com (Lee)
Date: Fri, 26 Jun 2009 13:52:33 -0400
Subject: [c-nsp] Network Address Response
In-Reply-To: <01c501c9f5d3$a9740f70$fc5c2e50$@net>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>
Message-ID: <dd5f2deb0906261052y2bd8865q6fa7a791e90c70ac@mail.gmail.com>

On 6/25/09, Ray Burkholder <ray at oneunified.net> wrote:

> I was wondering the reasoning for routers/switches to respond for the
> network portion of an ip-address range.
>
> For example, a router interface A with 10.0.0.1/30 and interface B with
> 10.0.0.5/30.
>
> Generate a ping from a device several hops away on the A side to the B side
> network address of 10.0.0.4.  The router will respond with an echo reply
> with an address of 10.0.0.1.
>
> Is this expected behaviour?  And the reason?

Standards compliance?  From RFC-1122
   3.3.6  Broadcasts

         There is a class of hosts* that use non-standard broadcast
         address forms, substituting 0 for -1.  All hosts SHOULD
         recognize and accept any of these non-standard broadcast
         addresses as the destination address of an incoming datagram.
         A host MAY optionally have a configuration option to choose the
         0 or the -1 form of broadcast address, for each physical
         interface, but this option SHOULD default to the standard (-1)
         form.

So {network, 0} is a broadcast address, same as {network, -1}.
Combine that with

   3.2.1.3  Addressing: RFC-791 Section 3.2

             ...   An incoming datagram is destined
            for the host if the datagram's destination address field is:

            (1)  (one of) the host's IP address(es); or

            (2)  an IP broadcast address valid for the connected
                 network; or

and you get the router answering a ping to 10.0.0.4

Off the top of my head, I don't know if it's a ciscoism or 'standard'
behavior to use the IP address of the outgoing interface as the source
address of the ping reply, but that's why you get the response from
10.0.0.1 instead of 10.0.0.5

Regards,
Lee

From quinn at activehost.com  Fri Jun 26 13:37:11 2009
From: quinn at activehost.com (Quinn Mahoney)
Date: Fri, 26 Jun 2009 13:37:11 -0400
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <6069A203FD01884885C037F81DD7508016CF591C8F@wsc-mail-01.intra.nwresd.k12.or.us>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com><20090626082736.GC26638@lboro.ac.uk><62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk><6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com><A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local><4A44DA40.1010809@justinshore.com>
	<6069A203FD01884885C037F81DD7508016CF591C8F@wsc-mail-01.intra.nwresd.k12.or.us>
Message-ID: <8685783A8C22C640AD1361E78659B7D76976EA@ahex02.activehost.local>

FreeBSD-CVSweb can be a front-end for rancid since it uses CVS, you can
also use grep.  If you are grepping it is probably a good idea to do so
as the user rancid runs as.

You can use the .deb's to install these for debian/ubuntu, or installing
from source works well and is straightforward.

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Bill Blackford
Sent: Friday, June 26, 2009 10:54 AM
To: Justin Shore; Ryan West
Cc: Cisco-nsp; rancid-discuss at shrubbery.net
Subject: Re: [c-nsp] PIX/ASA Change Control

Webmin, but that's probably overkill

-b

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Justin Shore
Sent: Friday, June 26, 2009 7:25 AM
To: Ryan West
Cc: Cisco-nsp; rancid-discuss at shrubbery.net
Subject: Re: [c-nsp] PIX/ASA Change Control

Ryan West wrote:
> I'm curious to see what others are using for a frontend to RANCID.
Besides the emailing of the diff's that take place, what are others
using to browse the repository?

I'm not a CVS buff so I'm sure someone that falls into that category 
would have a better solution.  I currently just use the standard cvsweb 
CGI.  It works well enough.  I keep it in a password protected directory

on my servers.  Not overly elegant but it works well enough.

Does anyone else have any other suggestions for a web GUI front-end to 
CVS for RANCID use?

Justin
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From geoff at pendery.net  Fri Jun 26 14:17:19 2009
From: geoff at pendery.net (Geoffrey Pendery)
Date: Fri, 26 Jun 2009 13:17:19 -0500
Subject: [c-nsp] Network Address Response
In-Reply-To: <dd5f2deb0906261052y2bd8865q6fa7a791e90c70ac@mail.gmail.com>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>
	<dd5f2deb0906261052y2bd8865q6fa7a791e90c70ac@mail.gmail.com>
Message-ID: <d6966e4b0906261117j4840dd19teca9ca226afeaf1b@mail.gmail.com>

Fascinating.  Thanks, that answers another question I've always had -
why do lots of systems require you to manually enter the broadcast
address?  I always figured they should be able to determine that from
the address and mask you've already entered, and assumed they were
being lazy or obtuse.  But it makes more sense now - they were asking
if you'd prefer to use the 0 address as the broadcast, rather than the
usual "all ones".

Thanks to Ray for the question, and Lee for the answer.


-Geoff


On Fri, Jun 26, 2009 at 12:52 PM, Lee<ler762 at gmail.com> wrote:
> On 6/25/09, Ray Burkholder <ray at oneunified.net> wrote:
>
>> I was wondering the reasoning for routers/switches to respond for the
>> network portion of an ip-address range.
>>
>> For example, a router interface A with 10.0.0.1/30 and interface B with
>> 10.0.0.5/30.
>>
>> Generate a ping from a device several hops away on the A side to the B side
>> network address of 10.0.0.4. ?The router will respond with an echo reply
>> with an address of 10.0.0.1.
>>
>> Is this expected behaviour? ?And the reason?
>
> Standards compliance? ?From RFC-1122
> ? 3.3.6 ?Broadcasts
>
> ? ? ? ? There is a class of hosts* that use non-standard broadcast
> ? ? ? ? address forms, substituting 0 for -1. ?All hosts SHOULD
> ? ? ? ? recognize and accept any of these non-standard broadcast
> ? ? ? ? addresses as the destination address of an incoming datagram.
> ? ? ? ? A host MAY optionally have a configuration option to choose the
> ? ? ? ? 0 or the -1 form of broadcast address, for each physical
> ? ? ? ? interface, but this option SHOULD default to the standard (-1)
> ? ? ? ? form.
>
> So {network, 0} is a broadcast address, same as {network, -1}.
> Combine that with
>
> ? 3.2.1.3 ?Addressing: RFC-791 Section 3.2
>
> ? ? ? ? ? ? ... ? An incoming datagram is destined
> ? ? ? ? ? ?for the host if the datagram's destination address field is:
>
> ? ? ? ? ? ?(1) ?(one of) the host's IP address(es); or
>
> ? ? ? ? ? ?(2) ?an IP broadcast address valid for the connected
> ? ? ? ? ? ? ? ? network; or
>
> and you get the router answering a ping to 10.0.0.4
>
> Off the top of my head, I don't know if it's a ciscoism or 'standard'
> behavior to use the IP address of the outgoing interface as the source
> address of the ping reply, but that's why you get the response from
> 10.0.0.1 instead of 10.0.0.5
>
> Regards,
> Lee
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From svalliap at cisco.com  Fri Jun 26 16:38:36 2009
From: svalliap at cisco.com (Siva Valliappan)
Date: Fri, 26 Jun 2009 13:38:36 -0700 (PDT)
Subject: [c-nsp] REP
In-Reply-To: <2C05E949E19A9146AF7BDF9D44085B86353E994F73@exchange.aoihq.local>
References: <2C05E949E19A9146AF7BDF9D44085B86353E994F73@exchange.aoihq.local>
Message-ID: <Pine.GSO.4.64.0906261333420.10247@sj-cse-717.cisco.com>

Hi Eric,

    REP and STP are incompatible with each other.  if you are running REP
on a set of links, you cannot run STP on them.  that said we have the 
capability for a node that is running STP on a different set of links to
work with the REP running on other links via the REP edge node neighbor 
feature.  REP is able to generate Spanning Tree Change Notifications to send
into the STP part of the network and propagate changes coming from the SPT
domain into the REP domain.

regards
.siva

On Fri, 26 Jun 2009, Eric Van Tol wrote:

> I'm looking at REP for use in a metro ethernet environment and am looking for some real world opinions on its effectiveness.  The available white paper and documentation aren't 100% clear to me that STP can be disabled completely, or whether it should still run in addition to REP.  My preference is to remove STP from any switch in our network, then burn it, spread its ashes in a field, let cattle graze on the grass, then burn the cattle and shoot their remains into space on a collision course with the sun.  Apologies to animal rights activists, but this should give you an idea of how I really feel about Spanning Tree Protocol.
>
> Can anyone share any experiences they've had using REP?  We primarily use ME3400s in a ring topology with each end of the ring terminating in a pair of 6509s.  The 6509s, however, will be repurposed over the next few months as we replace them with an alternate vendor's equipment.  Not sure if this matters, but figured I'd mention it.  Right now, we use strictly layer 3 on all links between nodes on a ring, preventing us from taking advantage of the more advanced layer 2 and vrf-lite features of the ME3400s.  This probably poor design decision was made due to previously perceived limitations with REP some years ago.
>
> Thanks in advance,
> evt
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From mumetahh at yahoo.co.id  Fri Jun 26 21:13:34 2009
From: mumetahh at yahoo.co.id (==N==)
Date: Sat, 27 Jun 2009 09:13:34 +0800 (SGT)
Subject: [c-nsp] Free NMS Tools
Message-ID: <461308.822.qm@web76301.mail.sg1.yahoo.com>

Dear All,

Currently I looking for NMS ( Network Monitoring) tools which is Free Open source base.
I need you suggestion. Currently I have more then 100 Cisco Routers and some for L3 3com Switches. 

I thank you in advanced for any sugesstion.

Regards,



suryantofang
http://suryantofang.wordpress.com

" Fly Higher - Run Faster "


      Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya sekarang! http://id.mail.yahoo.com

From randy_94108 at yahoo.com  Fri Jun 26 23:00:58 2009
From: randy_94108 at yahoo.com (Randy)
Date: Fri, 26 Jun 2009 20:00:58 -0700 (PDT)
Subject: [c-nsp] Free NMS Tools
Message-ID: <809824.72276.qm@web80504.mail.mud.yahoo.com>

NMS-DUDE comes to mind. Cat tools for backup of configs.

--- On Fri, 6/26/09, ==N== <mumetahh at yahoo.co.id> wrote:


From: ==N== <mumetahh at yahoo.co.id>
Subject: [c-nsp] Free NMS Tools
To: cisco-nsp at puck.nether.net
Date: Friday, June 26, 2009, 6:13 PM


Dear All,

Currently I looking for NMS ( Network Monitoring) tools which is Free Open source base.
I need you suggestion. Currently I have more then 100 Cisco Routers and some for L3 3com Switches. 

I thank you in advanced for any sugesstion.

Regards,



suryantofang
http://suryantofang.wordpress.com

" Fly Higher - Run Faster "


? ? ? Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya sekarang! http://id.mail.yahoo.com
_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From ariemer at wesenergy.com.au  Sat Jun 27 00:39:10 2009
From: ariemer at wesenergy.com.au (Aaron Riemer)
Date: Sat, 27 Jun 2009 12:39:10 +0800
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <461308.822.qm@web76301.mail.sg1.yahoo.com>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
Message-ID: <86BE309E-62B5-4D36-8A5F-012026CAB484@wesenergy.com.au>

Take a look at flow-tools for netflow and cacti for snmp graphing.  
Nedi is also good for network management.


Sent from my iPod

On 27/06/2009, at 10:13 AM, "==N==" <mumetahh at yahoo.co.id> wrote:

> Dear All,
>
> Currently I looking for NMS ( Network Monitoring) tools which is  
> Free Open source base.
> I need you suggestion. Currently I have more then 100 Cisco Routers  
> and some for L3 3com Switches.
>
> I thank you in advanced for any sugesstion.
>
> Regards,
>
>
>
> suryantofang
> http://suryantofang.wordpress.com
>
> " Fly Higher - Run Faster "
>
>
>       Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya  
> sekarang! http://id.mail.yahoo.com
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


LEGAL DISCLAIMER: This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

From dotblu at dotblu.com  Sat Jun 27 01:55:01 2009
From: dotblu at dotblu.com (Ram Krishna Pariyar at dotblu)
Date: Fri, 26 Jun 2009 22:55:01 -0700
Subject: [c-nsp] Ram Krishna P has added you as a friend on dotblu
Message-ID: <CHILKAT-MID-00000000-0000-0000-0000-000000000000@web101>

I challenge you to dotblu!

https://www.dotblu.com/invitepath/rg-4j/0abd20c462df11deae6402bf43dda48c

Ram Krishna P


---
This email was sent to you by dotblu user Ram Krishna P (rkitsolution at yahoo.com).

If you do not want to receive future emails from dotblu, 
click below:
http://www.dotblu.com/optout.aspx?emailid=0abd20c562df11deae6402bf43dda48c

dotblu, inc., 360 Ritch Street, Suite 205, San Francisco, CA 94107, USA.

From rwest at zyedge.com  Sat Jun 27 08:55:12 2009
From: rwest at zyedge.com (Ryan West)
Date: Sat, 27 Jun 2009 08:55:12 -0400
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <86BE309E-62B5-4D36-8A5F-012026CAB484@wesenergy.com.au>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
	<86BE309E-62B5-4D36-8A5F-012026CAB484@wesenergy.com.au>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C59D0@zy-ex1.zyedge.local>

Oreon, Nagios, Cacti (combined with plugins like Thold, Manage, and MacTrack), Zabbix.

Zabbix is coming of age and looks very promising for their next release.

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Aaron Riemer
Sent: Saturday, June 27, 2009 12:39 AM
To: ==N==
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Free NMS Tools

Take a look at flow-tools for netflow and cacti for snmp graphing.  
Nedi is also good for network management.


Sent from my iPod

On 27/06/2009, at 10:13 AM, "==N==" <mumetahh at yahoo.co.id> wrote:

> Dear All,
>
> Currently I looking for NMS ( Network Monitoring) tools which is  
> Free Open source base.
> I need you suggestion. Currently I have more then 100 Cisco Routers  
> and some for L3 3com Switches.
>
> I thank you in advanced for any sugesstion.
>
> Regards,
>
>
>
> suryantofang
> http://suryantofang.wordpress.com
>
> " Fly Higher - Run Faster "
>
>
>       Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya  
> sekarang! http://id.mail.yahoo.com
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


LEGAL DISCLAIMER: This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From william.mccall at gmail.com  Sat Jun 27 09:25:38 2009
From: william.mccall at gmail.com (William McCall)
Date: Sat, 27 Jun 2009 08:25:38 -0500
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <461308.822.qm@web76301.mail.sg1.yahoo.com>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
Message-ID: <f9a8f300906270625q7e10aa56l9585e4ae875b7868@mail.gmail.com>

I have to agree with Randy. The Dude. No learning curve and you can get it
up and running in about 45 min (hand entering your nodes) and of course, it
will do discovery if you tell it the subnets to search.

A lot of cool stuff to do for links, maps, etc. Its powerful, not open
source, but still free. I implemented it for a set of switches and routers
plus some VMware boxes.

--William

On Fri, Jun 26, 2009 at 8:13 PM, ==N== <mumetahh at yahoo.co.id> wrote:

> Dear All,
>
> Currently I looking for NMS ( Network Monitoring) tools which is Free Open
> source base.
> I need you suggestion. Currently I have more then 100 Cisco Routers and
> some for L3 3com Switches.
>
> I thank you in advanced for any sugesstion.
>
> Regards,
>
>
>
> suryantofang
> http://suryantofang.wordpress.com
>
> " Fly Higher - Run Faster "
>
>
>      Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya
> sekarang! http://id.mail.yahoo.com
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From allan.eising at gmail.com  Sat Jun 27 09:30:52 2009
From: allan.eising at gmail.com (Allan Eising)
Date: Sat, 27 Jun 2009 15:30:52 +0200
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C59D0@zy-ex1.zyedge.local>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
	<86BE309E-62B5-4D36-8A5F-012026CAB484@wesenergy.com.au>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C59D0@zy-ex1.zyedge.local>
Message-ID: <f7b7d3c40906270630kf38a087n449d1577debfd64b@mail.gmail.com>

On Sat, Jun 27, 2009 at 2:55 PM, Ryan West<rwest at zyedge.com> wrote:
> Oreon, Nagios, Cacti (combined with plugins like Thold, Manage, and MacTrack), Zabbix.
>
> Zabbix is coming of age and looks very promising for their next release.
>
> -ryan
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Aaron Riemer
> Sent: Saturday, June 27, 2009 12:39 AM
> To: ==N==
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Free NMS Tools
>
> Take a look at flow-tools for netflow and cacti for snmp graphing.
> Nedi is also good for network management.
>
>
> Sent from my iPod
>
> On 27/06/2009, at 10:13 AM, "==N==" <mumetahh at yahoo.co.id> wrote:
>
>> Dear All,
>>
>> Currently I looking for NMS ( Network Monitoring) tools which is
>> Free Open source base.
>> I need you suggestion. Currently I have more then 100 Cisco Routers
>> and some for L3 3com Switches.
>>
>> I thank you in advanced for any sugesstion.
>>
>> Regards,
>>
>>
>>
>> suryantofang
>> http://suryantofang.wordpress.com
>>
>> " Fly Higher - Run Faster "
>>
>>
>> ? ? ? Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya
>> sekarang! http://id.mail.yahoo.com
>> _______________________________________________
>> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
> LEGAL DISCLAIMER: This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

Hi,

I'm a fan of OpenNMS, and the next version of it, to be released in a
not too distant future, will, among other very interesting features,
give you RANCID reporting, which can be very handy with a large number
of Cisco devices.

/Allan

From david.freedman at uk.clara.net  Sat Jun 27 10:09:53 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Sat, 27 Jun 2009 15:09:53 +0100
Subject: [c-nsp] 65k SXH2a + internal VLAN brokenness?
Message-ID: <7B8B0D6F623C3A40A0D0A80A66756E2B0D7CD6@EXVS01.claranet.local>

Hey,

 Have an odd problem with a 65K (SXH2a) where a particular VRF appears to be "broken" (not passing IP traffic) despite it being deleted and recreated, all other (and new) VRFs work fine, I suspect it is down to the internal VLAN it is getting assigned (it keeps getting the same int-vlan each time)

Looking at the CEF adj counters from the aggregate labelled traffic as it comes in (and gets recirculated) I can see traffic passing through the adjacency and into the internal vlan (so it is not dropping the aggregate label traffic)

I decided to do an ELAM capture at this point and found the following differences
(note, in both cases, the destination IP on this box I'm pinging is a loopback)

Working VRF:
< SEQ_NUM                          [5] = 0x17
< CCC                              [3] = b100 [L3_RW]

Broken VRF:

> SEQ_NUM                          [5] = 0x9
> CCC                              [3] = b101 [L2_POLICE]

Working VRF:

< DEST_INDEX                       [19] = 0x380
< VLAN                             [12] = 1022
< RBH                              [3] = b110
< RDT                              [1] = 0

Broken VRF:

> DEST_INDEX                       [19] = 0x7E00
> VLAN                             [12] = 1184 (this is the broken int-vlan)
> RBH                              [3] = b101
> RDT                              [1] = 1

Working VRF:

< L2                               [1] = 1

Broken VRF:

> L2                               [1] = 0


Not quite sure what to make of that, there is a valid cef receive adjacency
for the loopbacks in the VRF so it should punt from internal VLAN to CPU
(but the counters on the loopback of the broken VRF are 0/0 so obviously not)

My current theory is based on reading the contents of CSCsm84073 which suggest
that under some circumstances there is a default deny acl in place on the int-vlan
and it is not programmed with a permit acl on creation, however I can't directly
verify this because I can't use the "show tcam int" command since the internal
vlan doesn't have a real named port, despite appearing as an SWIDB :( 

If anybody has seen this before and could comment I would be most appreciative 
before taking this to TAC.

Regards,

------------------------------------------------
David Freedman
Group Network Engineering 
Claranet Limited
http://www.clara.net


From peter at rathlev.dk  Sat Jun 27 10:20:55 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Sat, 27 Jun 2009 16:20:55 +0200
Subject: [c-nsp] 6500 12.2(18)SXF EoL notice?
In-Reply-To: <1241472335.7357.2.camel@localhost.localdomain>
References: <1241472335.7357.2.camel@localhost.localdomain>
Message-ID: <1246112455.4048.1.camel@localhost.localdomain>

On Mon, 2009-05-04 at 23:25 +0200, Peter Rathlev wrote:
> Does anybody know what happened to the EoL notice about 12.2(18)SXF from
> end of april? The link from the FN doesn't seem to work for me anymore.
> Now I only have the mail.

And wow the EoL notice has been retracted. :-)

Regards,
Peter



From lists at memetic.org  Sat Jun 27 13:11:28 2009
From: lists at memetic.org (Adam Armstrong)
Date: Sat, 27 Jun 2009 18:11:28 +0100
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <461308.822.qm@web76301.mail.sg1.yahoo.com>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
Message-ID: <4A4652C0.7010309@memetic.org>


> Dear All,
>
> Currently I looking for NMS ( Network Monitoring) tools which is Free Open source base.
> I need you suggestion. Currently I have more then 100 Cisco Routers and some for L3 3com Switches. 
>
> I thank you in advanced for any sugesstion.
>   
JFFNMS, OpenNMS, Cacti, Nagios, Cricket and Weathermap are all are 
useful bits of network management software.

I develop ObserverNMS (http://www.observernms.org) which I use here at 
Jersey Telecom. I also use RANCID, NFSEN and Smokeping.

adam.

From r.engehausen at gmail.com  Sat Jun 27 15:08:20 2009
From: r.engehausen at gmail.com (Roy)
Date: Sat, 27 Jun 2009 12:08:20 -0700
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <4A4652C0.7010309@memetic.org>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
	<4A4652C0.7010309@memetic.org>
Message-ID: <4A466E24.90907@gmail.com>

Opsview

http://www.opsview.org/

From graham at g-rock.net  Sat Jun 27 16:40:03 2009
From: graham at g-rock.net (Graham Wooden)
Date: Sat, 27 Jun 2009 15:40:03 -0500
Subject: [c-nsp] L3 image for 3550 (SMI versus EMI)
Message-ID: <C66BEDD3.5F54%graham@g-rock.net>

Hi list,

Can the SMI version of the C3550 take the Layer3 image? I know it would be
preferred on many fronts to run the L3 on the EMI hardware ? but curious if
the SMI will be OK.  Only some EIGRP routes and traffic policing on certain
ports and SVI (~15-20Mb).  Would like to know about some past experiences
from folks on this...

Thanks,

-graham

From rwest at zyedge.com  Sat Jun 27 17:22:42 2009
From: rwest at zyedge.com (Ryan West)
Date: Sat, 27 Jun 2009 17:22:42 -0400
Subject: [c-nsp] L3 image for 3550 (SMI versus EMI)
In-Reply-To: <C66BEDD3.5F54%graham@g-rock.net>
References: <C66BEDD3.5F54%graham@g-rock.net>
Message-ID: <07A2C0B8-3629-4192-9B68-FFBB033021DF@zyedge.com>

Ipservices works fine on SMI.

Sent from handheld.

On Jun 27, 2009, at 4:48 PM, "Graham Wooden" <graham at g-rock.net> wrote:

> Hi list,
>
> Can the SMI version of the C3550 take the Layer3 image? I know it  
> would be
> preferred on many fronts to run the L3 on the EMI hardware ? but cur 
> ious if
> the SMI will be OK.  Only some EIGRP routes and traffic policing on  
> certain
> ports and SVI (~15-20Mb).  Would like to know about some past  
> experiences
> from folks on this...
>
> Thanks,
>
> -graham
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From peter at rathlev.dk  Sat Jun 27 17:23:08 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Sat, 27 Jun 2009 23:23:08 +0200
Subject: [c-nsp] L3 image for 3550 (SMI versus EMI)
In-Reply-To: <C66BEDD3.5F54%graham@g-rock.net>
References: <C66BEDD3.5F54%graham@g-rock.net>
Message-ID: <1246137788.6199.5.camel@localhost.localdomain>

On Sat, 2009-06-27 at 15:40 -0500, Graham Wooden wrote:
> Can the SMI version of the C3550 take the Layer3 image? I know it
> would be preferred on many fronts to run the L3 on the EMI hardware ?
> but curious if the SMI will be OK.  Only some EIGRP routes and traffic
> policing on certain ports and SVI (~15-20Mb).  Would like to know
> about some past experiences from folks on this...

AFAIK the EMI and SMI versions are exactly the same hardware. When
upgrading to an IP Services image you would of course have to buy a
relevant license for this.

I have tried this a few times on both C3550, C3560 and C3750. The new
E-models (3560E and 3750) use a "Universal" image containing all
features and activate these based on the license file.

Regards,
Peter



From ray at oneunified.net  Sat Jun 27 17:40:05 2009
From: ray at oneunified.net (Ray Burkholder)
Date: Sat, 27 Jun 2009 18:40:05 -0300
Subject: [c-nsp] Network Address Response
In-Reply-To: <4288131ED5E3024C9CD4782CECCAD2C7065D37CA@LMC-MAIL2.exempla.org>
References: <01c501c9f5d3$a9740f70$fc5c2e50$@net>	<253238b70906260611kc6b98aj4dde9137463ed2cc@mail.gmail.com><d6966e4b0906260704x4dd5bee8j5a2ff8cc5b19f9d8@mail.gmail.com>
	<043601c9f668$45e05050$d1a0f0f0$@net>
	<4288131ED5E3024C9CD4782CECCAD2C7065D37CA@LMC-MAIL2.exempla.org>
Message-ID: <68164D2E085D4A2289338613CE76A02E@oneunified.local>

> 
> I don't have a test box handy I can try it on, but does it 
> still exhibit that behavior if you put a 'no ip 
> directed-broadcast' in the interface config of the 10.0.0.5 interface?
> 
> By default it's on, so it takes anything for the network or 
> broadcast Layer 3 addresses and spits them out as Layer 2 
> broadcasts, which the router may be seeing/processing.
> 

One correction to set the record straight, current Cisco configurations 
have the 'no ip directed-broadcast' on by default.  

Therefore, what I was seeing, based upon Lee's reference, was an acceptable
response:
the router responded with a echo reply as it saw a packet destined to one of
its
network addresses, and due to the default setting of 'no ip
directed-broadcast', it 
did not forward the packet.


-- 
Scanned for viruses and dangerous content at 
http://www.oneunified.net and is believed to be clean.


From lists at memetic.org  Sat Jun 27 18:23:55 2009
From: lists at memetic.org (Adam Armstrong)
Date: Sat, 27 Jun 2009 23:23:55 +0100
Subject: [c-nsp] REP
In-Reply-To: <Pine.GSO.4.64.0906261333420.10247@sj-cse-717.cisco.com>
References: <2C05E949E19A9146AF7BDF9D44085B86353E994F73@exchange.aoihq.local>
	<Pine.GSO.4.64.0906261333420.10247@sj-cse-717.cisco.com>
Message-ID: <4A469BFB.2030102@memetic.org>

What platforms is REP available on? How low on the product line does it go?

adam.
> Hi Eric,
>
>    REP and STP are incompatible with each other.  if you are running REP
> on a set of links, you cannot run STP on them.  that said we have the 
> capability for a node that is running STP on a different set of links to
> work with the REP running on other links via the REP edge node 
> neighbor feature.  REP is able to generate Spanning Tree Change 
> Notifications to send
> into the STP part of the network and propagate changes coming from the 
> SPT
> domain into the REP domain.
>
> regards
> .siva
>
> On Fri, 26 Jun 2009, Eric Van Tol wrote:
>
>> I'm looking at REP for use in a metro ethernet environment and am 
>> looking for some real world opinions on its effectiveness.  The 
>> available white paper and documentation aren't 100% clear to me that 
>> STP can be disabled completely, or whether it should still run in 
>> addition to REP.  My preference is to remove STP from any switch in 
>> our network, then burn it, spread its ashes in a field, let cattle 
>> graze on the grass, then burn the cattle and shoot their remains into 
>> space on a collision course with the sun.  Apologies to animal rights 
>> activists, but this should give you an idea of how I really feel 
>> about Spanning Tree Protocol.
>>
>> Can anyone share any experiences they've had using REP?  We primarily 
>> use ME3400s in a ring topology with each end of the ring terminating 
>> in a pair of 6509s.  The 6509s, however, will be repurposed over the 
>> next few months as we replace them with an alternate vendor's 
>> equipment.  Not sure if this matters, but figured I'd mention it.  
>> Right now, we use strictly layer 3 on all links between nodes on a 
>> ring, preventing us from taking advantage of the more advanced layer 
>> 2 and vrf-lite features of the ME3400s.  This probably poor design 
>> decision was made due to previously perceived limitations with REP 
>> some years ago.
>>
>> Thanks in advance,
>> evt
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From david.freedman at uk.clara.net  Sat Jun 27 18:37:02 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Sat, 27 Jun 2009 23:37:02 +0100
Subject: [c-nsp] 65k SXH2a + internal VLAN brokenness?
References: <7B8B0D6F623C3A40A0D0A80A66756E2B0D7CD6@EXVS01.claranet.local>
	<5EB9799F396A304686962AFFF740ED0C012AC27DB4@NOOSLEXCH001.adno.local>
Message-ID: <7B8B0D6F623C3A40A0D0A80A66756E2B0D7CD7@EXVS01.claranet.local>

No, not a rate limiter it seems:

#remote command switch show mls rate-limit hw-detail | in 0x7 
      5    Enabled         100     10    0x7F0A    LTL  
      6    Enabled        2000      1    0x7E06    LTL  
      9    Enabled      100000    100    0x7F08    LTL  
     10    Enabled      100000    100    0x7F09    LTL  

Dave.



------------------------------------------------
David Freedman
Group Network Engineering 
Claranet Limited
http://www.clara.net



-----Original Message-----
From: Stig Johansen [mailto:Stig.Johansen at atea.no]
Sent: Sat 6/27/2009 23:29
To: David Freedman; cisco-nsp at puck.nether.net
Subject: RE: 65k SXH2a + internal VLAN brokenness?
 
David Freedman wrote:
>Broken VRF:
>> CCC                              [3] = b101 [L2_POLICE]
>> DEST_INDEX                       [19] = 0x7E00

Not sure, but it seems to me like you are possibly hitting a rate-limiter (L2_POLICE).
Try finding which rate-limiter it's hitting by searching for the 0x7E00-index in the output from this command (if it's there in SXH2a.. I have it in SXF and SXI):

remote command switch show mls rate-limit hw-detail

If it's there, you can find the corresponding rate limiter by matching the Hw ID from the last command here:

show mls rate-limit usage

Just an idea...

/Stig


From Stig.Johansen at atea.no  Sat Jun 27 18:29:58 2009
From: Stig.Johansen at atea.no (Stig Johansen)
Date: Sun, 28 Jun 2009 00:29:58 +0200
Subject: [c-nsp] 65k SXH2a + internal VLAN brokenness?
In-Reply-To: <7B8B0D6F623C3A40A0D0A80A66756E2B0D7CD6@EXVS01.claranet.local>
References: <7B8B0D6F623C3A40A0D0A80A66756E2B0D7CD6@EXVS01.claranet.local>
Message-ID: <5EB9799F396A304686962AFFF740ED0C012AC27DB4@NOOSLEXCH001.adno.local>

David Freedman wrote:
>Broken VRF:
>> CCC                              [3] = b101 [L2_POLICE]
>> DEST_INDEX                       [19] = 0x7E00

Not sure, but it seems to me like you are possibly hitting a rate-limiter (L2_POLICE).
Try finding which rate-limiter it's hitting by searching for the 0x7E00-index in the output from this command (if it's there in SXH2a.. I have it in SXF and SXI):

remote command switch show mls rate-limit hw-detail

If it's there, you can find the corresponding rate limiter by matching the Hw ID from the last command here:

show mls rate-limit usage

Just an idea...

/Stig

From hnyhus at gmail.com  Sat Jun 27 19:15:06 2009
From: hnyhus at gmail.com (=?UTF-8?Q?H=C3=A5vard_Nyhus?=)
Date: Sun, 28 Jun 2009 01:15:06 +0200
Subject: [c-nsp] REP
In-Reply-To: <6bc4a240906271614s2c1f39e8ufe3292443cc4ae94@mail.gmail.com>
References: <2C05E949E19A9146AF7BDF9D44085B86353E994F73@exchange.aoihq.local>
	<Pine.GSO.4.64.0906261333420.10247@sj-cse-717.cisco.com>
	<4A469BFB.2030102@memetic.org>
	<6bc4a240906271614s2c1f39e8ufe3292443cc4ae94@mail.gmail.com>
Message-ID: <6bc4a240906271615m41555244s6c9482f65cac5d33@mail.gmail.com>

REP is available on the ME3400, ME3400E, 3750 Metro, 4500, 4900M, IE3000 and
7600 (not 6500, it's afaik only available in the SRC and SRD software
trains) platforms.


-- 
H?vard Staub Nyhus

From Skeeve at eintellego.net  Sat Jun 27 21:02:48 2009
From: Skeeve at eintellego.net (Skeeve Stevens)
Date: Sun, 28 Jun 2009 11:02:48 +1000
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C59D0@zy-ex1.zyedge.local>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
	<86BE309E-62B5-4D36-8A5F-012026CAB484@wesenergy.com.au>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C59D0@zy-ex1.zyedge.local>
Message-ID: <292AF25E62B8894C921B893B53A19D97394469E61A@BUSINESSEX.business.ad>

Zabbix is doing very well by us.

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
www.linkedin.com/in/skeeve ; facebook.com/eintellego
--
NOC, NOC, who's there?


> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Ryan West
> Sent: Saturday, 27 June 2009 10:55 PM
> To: Aaron Riemer; ==N==
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Free NMS Tools
>
> Oreon, Nagios, Cacti (combined with plugins like Thold, Manage, and
> MacTrack), Zabbix.
>
> Zabbix is coming of age and looks very promising for their next
> release.
>
> -ryan
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Aaron Riemer
> Sent: Saturday, June 27, 2009 12:39 AM
> To: ==N==
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Free NMS Tools
>
> Take a look at flow-tools for netflow and cacti for snmp graphing.
> Nedi is also good for network management.
>
>
> Sent from my iPod
>
> On 27/06/2009, at 10:13 AM, "==N==" <mumetahh at yahoo.co.id> wrote:
>
> > Dear All,
> >
> > Currently I looking for NMS ( Network Monitoring) tools which is
> > Free Open source base.
> > I need you suggestion. Currently I have more then 100 Cisco Routers
> > and some for L3 3com Switches.
> >
> > I thank you in advanced for any sugesstion.
> >
> > Regards,
> >
> >
> >
> > suryantofang
> > http://suryantofang.wordpress.com
> >
> > " Fly Higher - Run Faster "
> >
> >
> >       Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya
> > sekarang! http://id.mail.yahoo.com
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
> LEGAL DISCLAIMER: This message contains confidential information and is
> intended only for the individual named. If you are not the named
> addressee you should not disseminate, distribute or copy this e-mail.
> Please notify the sender immediately by e-mail if you have received
> this e-mail by mistake and delete this e-mail from your system. If you
> are not the intended recipient you are notified that disclosing,
> copying, distributing or taking any action in reliance on the contents
> of this information is strictly prohibited.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From Skeeve at eintellego.net  Sat Jun 27 21:16:13 2009
From: Skeeve at eintellego.net (Skeeve Stevens)
Date: Sun, 28 Jun 2009 11:16:13 +1000
Subject: [c-nsp] BGP Simulator - world feed
Message-ID: <292AF25E62B8894C921B893B53A19D97394469E61B@BUSINESSEX.business.ad>

Hey all,

What I am looking for is a box or tool that I can configure to connect to our bgp core as a peer, which will suck down a full table and then either stay online or be able to be taken offline but which would keep it's feed.

Then, I would like some interface (cli/gui?) to have downstream feeds off of it, and be able to manipulate feeds to simulate changes, convergence times and so on for lab environments.

I would really like something that could simulate the full AS Path and not just something mocked up with static routes or some such.

Is there anything like this out there? Or do I have to get my programmers to knock it up? ;-)

...Skeeve

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
www.linkedin.com/in/skeeve ; facebook.com/eintellego
--
NOC, NOC, who's there?

Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.


From jlewis at packetnexus.com  Sat Jun 27 23:25:10 2009
From: jlewis at packetnexus.com (Jason Lewis)
Date: Sat, 27 Jun 2009 23:25:10 -0400
Subject: [c-nsp] BGP Simulator - world feed
In-Reply-To: <292AF25E62B8894C921B893B53A19D97394469E61B@BUSINESSEX.business.ad>
References: <292AF25E62B8894C921B893B53A19D97394469E61B@BUSINESSEX.business.ad>
Message-ID: <4A46E296.30906@packetnexus.com>

I talked to Dan Massey previously about BGPMon and he's confident it 
would do something like this.  I haven't been able to get the code to 
actually test it out, you may have better luck. 
http://bgpmon.netsec.colostate.edu/

I've looked for a tool that would do similar work. I'd like to take a 
BGP dump and put it on a test network for testing large *real world* 
route tables in a environment I could reproduce.  I haven't had much 
luck. Most tools are designed to pull out the route table, not many have 
the ability to pull one in.  I ended up writing some huge route add 
statements and peering with a box with a full table of static routes... 
It's messy and more trouble than it was worth.

jas

On 6/27/09 9:16 PM, Skeeve Stevens wrote:
> Spam detection software, running on the system "spunkymail-mx7.dreamhost.com", has
> identified this incoming email as possible spam.  The original message
> has been attached to this so you can view it (if it isn't spam) or label
> similar future email.  If you have any questions, see
> the administrator of that system for details.
>
> Content preview:  Hey all, What I am looking for is a box or tool that I can
>     configure to connect to our bgp core as a peer, which will suck down a full
>     table and then either stay online or be able to be taken offline but which
>     would keep it's feed. [...]
>
> Content analysis details:   (6.0 points, 5.0 required)
>
>   pts rule name              description
> ---- ---------------------- --------------------------------------------------
> -1.0 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
>                              trust
>                              [204.42.254.5 listed in list.dnswl.org]
>   7.0 RCVD_ILLEGAL_IP        Received: contains illegal IP address
>
>

From oboehmer at cisco.com  Sun Jun 28 01:47:47 2009
From: oboehmer at cisco.com (Oliver Boehmer (oboehmer))
Date: Sun, 28 Jun 2009 07:47:47 +0200
Subject: [c-nsp] passive-interface on VRF-specific OSPF process
In-Reply-To: <000c01c9f641$79c831c0$0a00000a@nil.si>
References: <4A44738D.306@spritelink.net>
	<000c01c9f641$79c831c0$0a00000a@nil.si>
Message-ID: <70B7A1CCBFA5C649BD562B6D9F7ED7840793395B@xmb-ams-333.emea.cisco.com>

Ivan Pepelnjak <> wrote on Friday, June 26, 2009 11:36:

>> while configuring an OSPF process for a VRF on a Cisco
>> 3550-12G (running 12.2(25)SE) I notice that the command
>> "passive-interface" is unavailable. How can this be?
> 
> Interesting ...

it's a bug (CSCeb86068), fixed on this platform in 12.2(35)SE and later
releases..

	oli
 

From jml at packetpimp.org  Sun Jun 28 09:30:32 2009
From: jml at packetpimp.org (Jason LeBlanc)
Date: Sun, 28 Jun 2009 09:30:32 -0400
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <1E3D2B26-616D-417F-9B26-980ED5855809@GREnergy.com>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>	<20090626082736.GC26638@lboro.ac.uk>	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
	<1E3D2B26-616D-417F-9B26-980ED5855809@GREnergy.com>
Message-ID: <4A477078.8000504@packetpimp.org>

We've moved to this as well, much nicer and easier to get running than 
cvsweb.

Hughes, Scott GRE/MG wrote:
> Websvn is very slick. RSS feeds, colorized diffs.
>
>
> On Jun 26, 2009, at 8:04 AM, "Ryan West" <rwest at zyedge.com> wrote:
>
>   
>> If you're ever run a ./configure script on a *nix system, you'll be  
>> more than qualified to install RANCID.  It's pretty straightforward.
>>
>> I'm curious to see what others are using for a frontend to RANCID.   
>> Besides the emailing of the diff's that take place, what are others  
>> using to browse the repository?
>>
>> -ryan
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp- 
>> bounces at puck.nether.net] On Behalf Of Roland Dobbins
>> Sent: Friday, June 26, 2009 8:52 AM
>> To: Cisco-nsp
>> Subject: Re: [c-nsp] PIX/ASA Change Control
>>
>>
>> On Jun 26, 2009, at 7:35 PM, Jeff Wojciechowski wrote:
>>
>>     
>>> flavor of Linux/BSD whatever to run RANCID on?
>>>       
>> It'll run on just about anything, and has no special requirements
>> which would preclude it running on a virtual server; just do a bit of
>> testing and scale CPU/RAM/storage in order to meet your requirements
>> (note that RANCID is pretty lightweight).
>>
>> In point of fact, OSS tools like RANCID and others are a great way to
>> dip one's toes into virtualization and gain operational experience
>> with same prior to rolling out end-user-facing applications and
>> services.
>>
>> --- 
>> --------------------------------------------------------------------
>> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>>
>>         Unfortunately, inefficiency scales really well.
>>
>>           -- Kevin Lawton
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>     
> NOTICE TO RECIPIENT: The information contained in this message from Great River Energy and any attachments is confidential and intended only for the named recipient(s). If you have received this message in error, you are prohibited from copying, distributing or using the information. Please contact the sender immediately by return email and delete the original message.
>  
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   


From gsgranados at comcast.net  Sun Jun 28 11:54:13 2009
From: gsgranados at comcast.net (Scott Granados)
Date: Sun, 28 Jun 2009 08:54:13 -0700
Subject: [c-nsp] VPN 3000 to ASA5500 migration?
Message-ID: <924FD33C6CD140F7872A53D5714530D9@Toshiba>

We presently use a VPN 3000 concentrator.  I'm not sure what Cisco was thinking but this device ranks up there with the worst user interfaces ever.  The CLI has the numbered menu thing and the web interface is just painful as most web interfaces are.  I did notice that the tool saves its config in XML.  Is there a good tool for migrating from the VPN3000 to ASA5500 that might read in that XML file and spit out properly formatted IOS commands?  If not can someone suggest a good strategy for migrating from one device to another.  For the most part I'd like to preserve the features and configurations as is so I don't have to modify a bunch of clients in the field.  I'd open to suggestions for good methods of doing this work by hand or a tool to assist in the migration.

Thank you
Scott



From ip at ioshints.info  Sun Jun 28 12:11:27 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Sun, 28 Jun 2009 18:11:27 +0200
Subject: [c-nsp] BGP Simulator - world feed
In-Reply-To: <292AF25E62B8894C921B893B53A19D97394469E61B@BUSINESSEX.business.ad>
References: <292AF25E62B8894C921B893B53A19D97394469E61B@BUSINESSEX.business.ad>
Message-ID: <002e01c9f80b$17d47ca0$0a00000a@nil.si>

> Is there anything like this out there? Or do I have to get my 
> programmers to knock it up? ;-)

Dump the BGP table, process it with PERL, generate Quagga configuration and
you're done ... and don't forget to post the script when it works ;) 

Here's a sample very simple Quagga configuration:

http://wiki.nil.com/Use_Quagga_to_generate_BGP_routes

Best regards
Ivan


From arl at nordicom.tele.dk  Sun Jun 28 16:24:18 2009
From: arl at nordicom.tele.dk (Arne Larsen)
Date: Sun, 28 Jun 2009 22:24:18 +0200
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <461308.822.qm@web76301.mail.sg1.yahoo.com>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
Message-ID: <4A47D172.8020600@nordicom.tele.dk>

==N== wrote:

>Dear All,
>
>Currently I looking for NMS ( Network Monitoring) tools which is Free Open source base.
>I need you suggestion. Currently I have more then 100 Cisco Routers and some for L3 3com Switches. 
>
>I thank you in advanced for any sugesstion.
>
>Regards,
>
>
>
>suryantofang
>http://suryantofang.wordpress.com
>
>" Fly Higher - Run Faster "
>
>
>      Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya sekarang! http://id.mail.yahoo.com
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>  
>
http://www.zenoss.com/

/Arne

From jason at lixfeld.ca  Mon Jun 29 00:17:28 2009
From: jason at lixfeld.ca (Jason Lixfeld)
Date: Mon, 29 Jun 2009 00:17:28 -0400
Subject: [c-nsp] Would an MTU mis-match cause one-way ICMP over EoMPLS VC?
Message-ID: <C37B3F86-A515-4EA7-8D0F-7D44DDEEA631@lixfeld.ca>

Diagram:

  siteA CE
     ||
+---++---+
| 7206PE |
+---++---+
    f2/0 (mtu 1500)
     ||
    f0/1 (mtu 1504)
+---++---+
| ME3400 |
+---++---+
    g0/1 (mtu 1504)
     ||
    g1/1 (mtu 9216)
+---++---+
|  7609  |
+---++---+
    g7/2 (mtu 9216)
     ||
    g0/0 (mtu 9216)
+---++---+
| 7301PE |
+---++---+
     ||
  siteB CE

I'm getting one-way ICMP over a VC that is terminated on the 7206PE;  
meaning ICMP echo requests sourced from siteA CE to siteB CE cannot be  
seen on the siteB CE.  However, ICMP echo requests sourced from the  
siteB CE can be seen on the siteA CE (but the echo reply packest are  
not seen by siteB CE).

I understand that MTU issues would most certainly cause problems if  
the packet size was closer to the 1500 byte mark (1474 or there about,  
depending, maybe), but would this particular MTU mis-match even cause  
issues with such small ICMP packets?

If MTU wouldn't cause this, then I'm back to square one with trying to  
figure out this one-way traffic thing I've got going on here.

Thanks in advance..

From christian at automatick.net  Mon Jun 29 01:20:06 2009
From: christian at automatick.net (Christian Koch)
Date: Sun, 28 Jun 2009 22:20:06 -0700
Subject: [c-nsp] BGP Simulator - world feed
In-Reply-To: <002e01c9f80b$17d47ca0$0a00000a@nil.si>
References: <292AF25E62B8894C921B893B53A19D97394469E61B@BUSINESSEX.business.ad>
	<002e01c9f80b$17d47ca0$0a00000a@nil.si>
Message-ID: <c4d480f60906282220s491ff647g50c29f640e15f014@mail.gmail.com>

Been playing this for the same purpose in the lab and it works pretty well..


http://code.google.com/p/bgpsimple/



On Sun, Jun 28, 2009 at 9:11 AM, Ivan Pepelnjak <ip at ioshints.info> wrote:

> > Is there anything like this out there? Or do I have to get my
> > programmers to knock it up? ;-)
>
> Dump the BGP table, process it with PERL, generate Quagga configuration and
> you're done ... and don't forget to post the script when it works ;)
>
> Here's a sample very simple Quagga configuration:
>
> http://wiki.nil.com/Use_Quagga_to_generate_BGP_routes
>
> Best regards
> Ivan
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From ying-xiang at 163.com  Mon Jun 29 02:13:15 2009
From: ying-xiang at 163.com (ying-xiang)
Date: Mon, 29 Jun 2009 14:13:15 +0800 (CST)
Subject: [c-nsp] "ipsec over mpls vpn"
Message-ID: <8380499.236501246255995357.JavaMail.coremail@bj163app55.163.com>


hi,everyone
 
is there possible to terminate a ipsec tunnel on a VRF enabled interface on PE routers?

From Stig.Johansen at atea.no  Mon Jun 29 03:50:48 2009
From: Stig.Johansen at atea.no (Stig Johansen)
Date: Mon, 29 Jun 2009 09:50:48 +0200
Subject: [c-nsp] "ipsec over mpls vpn"
In-Reply-To: <8380499.236501246255995357.JavaMail.coremail@bj163app55.163.com>
References: <8380499.236501246255995357.JavaMail.coremail@bj163app55.163.com>
Message-ID: <5EB9799F396A304686962AFFF740ED0C012AC27DFB@NOOSLEXCH001.adno.local>

ying-xiang wrote:
>hi,everyone
>is there possible to terminate a ipsec tunnel on a VRF enabled interface on PE routers?

Check out FVRF (Front VRF) and IVRF (Inside VRF) to see which if these you want to use. Here's a link to a paper about terminating a DMVPN on these:

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6660/prod_white_paper0900aecd8034be03_ps6658_Products_White_Paper.html 

/Stig

From magamo79 at gmail.com  Mon Jun 29 03:57:30 2009
From: magamo79 at gmail.com (=?ISO-8859-1?Q?Manuel_Garc=EDa_Montero?=)
Date: Mon, 29 Jun 2009 09:57:30 +0200
Subject: [c-nsp]  Applying output rate limit at 6500/SUP720 platform
Message-ID: <2dd999e30906290057j6b74a02t61de9b6353ae38e5@mail.gmail.com>

Hi,

we are facing difficulties trying to limit the rate at an interfaz in a
6509/SUP720 (IOS image s72033-pk9sv-mz.122-18.SXD1.bin).

We want to limite the output rate at a Gigabit port connected directly to
Customer Equipment. That port is configured at swithport mode, and we have
all level 3 configuration at VLAN interface (1)

In that vlan interface we have try 3 different configurations (2)  to
establish the output rate limit, and while all of them should work, they
dont, beacause the rate seen at the vlan interface is lower than the Gigabit
interface, which is correct:


6.2#sh interfaces GigabitEthernet 1/11 | i rate
  Queueing strategy: fifo
  30 second input rate 221436000 bits/sec, 60004 packets/sec
  30 second output rate 456426000 bits/sec, 67772 packets/sec
6.2#sh interfaces vlan20 | i rate
  Queueing strategy: fifo
  30 second input rate 228770000 bits/sec, 61961 packets/sec
  30 second output rate 89869000 bits/sec, 23914 packets/sec


As your can see, input rates are more or less the same in both interfaces,
but output rate at vlan is a lot lower than the real value (shown at
physical port), so all packets are getting conform policy applied, transmit,
with no drops to reduce the rate.

Which can be the cause of this issue?

Theres also the chance to move layer3 config to physical interface, which
would solve the issue as that interface can see correct rates.



*******************************************
(1) Relevant interface / general configuration
*******************************************

interface GigabitEthernet1/11
 description CUSTOMER_Principal
 no ip address
 load-interval 30
 switchport
 switchport access vlan 20
 switchport mode access
end
interface Vlan20
 ip address 10.160.0.19 255.255.255.240
 ip access-group 122 in
 no ip redirects
 ip wccp 97 redirect in
 ip wccp 98 redirect in
 ip multicast netflow egress
 ip route-cache flow
 no ip mroute-cache
 load-interval 30
 standby 55 ip 10.160.0.17
 standby 55 priority 150
 standby 55 preempt
end

mls ip multicast flow-stat-timer 9
mls aging long 64
mls aging normal 60
mls flow ip destination-source
no mls flow ipv6
mls qos
mls cef error action freeze

*******************************************
(2) Configuration to limit the output rate:
*******************************************

1. rate-limit

interface Vlan20
  rate-limit output 425000000 212500 212500 conform-action transmit
exceed-action drop

2. service-policy with rate-limit

policy-map CUSTOMER_OUT
class class-default
police 425000000 conform-action transmit exceed-action drop
!apply police to interfaz
interface vlan20
  service-policy output CUSTOMER

3. service-policy with aggregate policer

mls qos aggregate-policer CUSTOMER_OUT 425000000 106250 conform-action
transmit exceed-action drop
!
policy-map CUSTOMER_OUT
  class class-default
  police aggregate CUSTOMER_OUT
!apply police to interfaz
interface vlan20
  service-policy output CUSTOMER

Regards,

From linux.yahoo at gmail.com  Mon Jun 29 05:20:59 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Mon, 29 Jun 2009 11:20:59 +0200
Subject: [c-nsp] Applying output rate limit at 6500/SUP720 platform
In-Reply-To: <2dd999e30906290057j6b74a02t61de9b6353ae38e5@mail.gmail.com>
References: <2dd999e30906290057j6b74a02t61de9b6353ae38e5@mail.gmail.com>
Message-ID: <7100ed370906290220h5a659699wcc9c1ab6fd51aef@mail.gmail.com>

I think your burst-normal and burst-max values are badly estimated:

burst-normal is the burst size in byte during 1 second of burst
burst max = burst-normal x2

Try that:

interface Vlan20
 rate-limit output 425000000 80000000 160000000 conform-action transmit
exceed-action drop
R/
Manu
2009/6/29 Manuel Garc?a Montero <magamo79 at gmail.com>

> Hi,
>
> we are facing difficulties trying to limit the rate at an interfaz in a
> 6509/SUP720 (IOS image s72033-pk9sv-mz.122-18.SXD1.bin).
>
> We want to limite the output rate at a Gigabit port connected directly to
> Customer Equipment. That port is configured at swithport mode, and we have
> all level 3 configuration at VLAN interface (1)
>
> In that vlan interface we have try 3 different configurations (2)  to
> establish the output rate limit, and while all of them should work, they
> dont, beacause the rate seen at the vlan interface is lower than the
> Gigabit
> interface, which is correct:
>
>
> 6.2#sh interfaces GigabitEthernet 1/11 | i rate
>  Queueing strategy: fifo
>  30 second input rate 221436000 bits/sec, 60004 packets/sec
>  30 second output rate 456426000 bits/sec, 67772 packets/sec
> 6.2#sh interfaces vlan20 | i rate
>  Queueing strategy: fifo
>  30 second input rate 228770000 bits/sec, 61961 packets/sec
>  30 second output rate 89869000 bits/sec, 23914 packets/sec
>
>
> As your can see, input rates are more or less the same in both interfaces,
> but output rate at vlan is a lot lower than the real value (shown at
> physical port), so all packets are getting conform policy applied,
> transmit,
> with no drops to reduce the rate.
>
> Which can be the cause of this issue?
>
> Theres also the chance to move layer3 config to physical interface, which
> would solve the issue as that interface can see correct rates.
>
>
>
> *******************************************
> (1) Relevant interface / general configuration
> *******************************************
>
> interface GigabitEthernet1/11
>  description CUSTOMER_Principal
>  no ip address
>  load-interval 30
>  switchport
>  switchport access vlan 20
>  switchport mode access
> end
> interface Vlan20
>  ip address 10.160.0.19 255.255.255.240
>  ip access-group 122 in
>  no ip redirects
>  ip wccp 97 redirect in
>  ip wccp 98 redirect in
>  ip multicast netflow egress
>  ip route-cache flow
>  no ip mroute-cache
>  load-interval 30
>  standby 55 ip 10.160.0.17
>  standby 55 priority 150
>  standby 55 preempt
> end
>
> mls ip multicast flow-stat-timer 9
> mls aging long 64
> mls aging normal 60
> mls flow ip destination-source
> no mls flow ipv6
> mls qos
> mls cef error action freeze
>
> *******************************************
> (2) Configuration to limit the output rate:
> *******************************************
>
> 1. rate-limit
>
> interface Vlan20
>  rate-limit output 425000000 212500 212500 conform-action transmit
> exceed-action drop
>
> 2. service-policy with rate-limit
>
> policy-map CUSTOMER_OUT
> class class-default
> police 425000000 conform-action transmit exceed-action drop
> !apply police to interfaz
> interface vlan20
>  service-policy output CUSTOMER
>
> 3. service-policy with aggregate policer
>
> mls qos aggregate-policer CUSTOMER_OUT 425000000 106250 conform-action
> transmit exceed-action drop
> !
> policy-map CUSTOMER_OUT
>  class class-default
>  police aggregate CUSTOMER_OUT
> !apply police to interfaz
> interface vlan20
>  service-policy output CUSTOMER
>
> Regards,
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From zivl at gilat.net  Mon Jun 29 05:58:07 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Mon, 29 Jun 2009 12:58:07 +0300
Subject: [c-nsp] Applying output rate limit at 6500/SUP720 platform
In-Reply-To: <7100ed370906290220h5a659699wcc9c1ab6fd51aef@mail.gmail.com>
References: <2dd999e30906290057j6b74a02t61de9b6353ae38e5@mail.gmail.com>
	<7100ed370906290220h5a659699wcc9c1ab6fd51aef@mail.gmail.com>
Message-ID: <EC993E87D960A541A66BF21D62AA42A623012394B5@exch2k7.gilat.local>

I've found that the best results are obtained by using the following formulas
BC = BW / 8 * 1.5
BE = BC
In your case it will be 
425000000 / 8 * 1.5 = 79687500
So your rate-limit will look like this:

interface Vlan20
 rate-limit output 425000000 79687500 79687500 conform-action transmit exceed-action drop

Hope this helps,
Ziv

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Manu Chao
Sent: Monday, June 29, 2009 12:21 PM
To: Manuel Garc?a Montero
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Applying output rate limit at 6500/SUP720 platform

I think your burst-normal and burst-max values are badly estimated:

burst-normal is the burst size in byte during 1 second of burst
burst max = burst-normal x2

Try that:

interface Vlan20
 rate-limit output 425000000 80000000 160000000 conform-action transmit
exceed-action drop
R/
Manu
2009/6/29 Manuel Garc?a Montero <magamo79 at gmail.com>

> Hi,
>
> we are facing difficulties trying to limit the rate at an interfaz in a
> 6509/SUP720 (IOS image s72033-pk9sv-mz.122-18.SXD1.bin).
>
> We want to limite the output rate at a Gigabit port connected directly to
> Customer Equipment. That port is configured at swithport mode, and we have
> all level 3 configuration at VLAN interface (1)
>
> In that vlan interface we have try 3 different configurations (2)  to
> establish the output rate limit, and while all of them should work, they
> dont, beacause the rate seen at the vlan interface is lower than the
> Gigabit
> interface, which is correct:
>
>
> 6.2#sh interfaces GigabitEthernet 1/11 | i rate
>  Queueing strategy: fifo
>  30 second input rate 221436000 bits/sec, 60004 packets/sec
>  30 second output rate 456426000 bits/sec, 67772 packets/sec
> 6.2#sh interfaces vlan20 | i rate
>  Queueing strategy: fifo
>  30 second input rate 228770000 bits/sec, 61961 packets/sec
>  30 second output rate 89869000 bits/sec, 23914 packets/sec
>
>
> As your can see, input rates are more or less the same in both interfaces,
> but output rate at vlan is a lot lower than the real value (shown at
> physical port), so all packets are getting conform policy applied,
> transmit,
> with no drops to reduce the rate.
>
> Which can be the cause of this issue?
>
> Theres also the chance to move layer3 config to physical interface, which
> would solve the issue as that interface can see correct rates.
>
>
>
> *******************************************
> (1) Relevant interface / general configuration
> *******************************************
>
> interface GigabitEthernet1/11
>  description CUSTOMER_Principal
>  no ip address
>  load-interval 30
>  switchport
>  switchport access vlan 20
>  switchport mode access
> end
> interface Vlan20
>  ip address 10.160.0.19 255.255.255.240
>  ip access-group 122 in
>  no ip redirects
>  ip wccp 97 redirect in
>  ip wccp 98 redirect in
>  ip multicast netflow egress
>  ip route-cache flow
>  no ip mroute-cache
>  load-interval 30
>  standby 55 ip 10.160.0.17
>  standby 55 priority 150
>  standby 55 preempt
> end
>
> mls ip multicast flow-stat-timer 9
> mls aging long 64
> mls aging normal 60
> mls flow ip destination-source
> no mls flow ipv6
> mls qos
> mls cef error action freeze
>
> *******************************************
> (2) Configuration to limit the output rate:
> *******************************************
>
> 1. rate-limit
>
> interface Vlan20
>  rate-limit output 425000000 212500 212500 conform-action transmit
> exceed-action drop
>
> 2. service-policy with rate-limit
>
> policy-map CUSTOMER_OUT
> class class-default
> police 425000000 conform-action transmit exceed-action drop
> !apply police to interfaz
> interface vlan20
>  service-policy output CUSTOMER
>
> 3. service-policy with aggregate policer
>
> mls qos aggregate-policer CUSTOMER_OUT 425000000 106250 conform-action
> transmit exceed-action drop
> !
> policy-map CUSTOMER_OUT
>  class class-default
>  police aggregate CUSTOMER_OUT
> !apply police to interfaz
> interface vlan20
>  service-policy output CUSTOMER
>
> Regards,
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************




 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From Ian.Mackinnon at lumison.net  Mon Jun 29 06:26:32 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Mon, 29 Jun 2009 11:26:32 +0100
Subject: [c-nsp] Applying output rate limit at 6500/SUP720 platform
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A623012394B5@exch2k7.gilat.local>
References: <2dd999e30906290057j6b74a02t61de9b6353ae38e5@mail.gmail.com>
	<7100ed370906290220h5a659699wcc9c1ab6fd51aef@mail.gmail.com>
	<EC993E87D960A541A66BF21D62AA42A623012394B5@exch2k7.gilat.local>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012DAC821F1@nbg01-exch-01.entlstaff.domain.lumison.net>

Watch out!
If your bc and be are the same it might not apply to the tcam properly :-
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/ol_14271.html#wp4208036

With Release 12.2(33)SXI and later releases where CSCso97991 is not resolved, you must configure an appropriate burst size when you configure QoS policing on WAN ports. Do not rely on the burst size calculated by QoS

Ian

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ziv Leyes
Sent: 29 June 2009 10:58
To: Manu Chao; Manuel Garc?a Montero
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Applying output rate limit at 6500/SUP720 platform

I've found that the best results are obtained by using the following formulas
BC = BW / 8 * 1.5
BE = BC
In your case it will be
425000000 / 8 * 1.5 = 79687500
So your rate-limit will look like this:

interface Vlan20
 rate-limit output 425000000 79687500 79687500 conform-action transmit exceed-action drop

Hope this helps,
Ziv

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Manu Chao
Sent: Monday, June 29, 2009 12:21 PM
To: Manuel Garc?a Montero
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Applying output rate limit at 6500/SUP720 platform

I think your burst-normal and burst-max values are badly estimated:

burst-normal is the burst size in byte during 1 second of burst
burst max = burst-normal x2

Try that:

interface Vlan20
 rate-limit output 425000000 80000000 160000000 conform-action transmit
exceed-action drop
R/
Manu
2009/6/29 Manuel Garc?a Montero <magamo79 at gmail.com>

> Hi,
>
> we are facing difficulties trying to limit the rate at an interfaz in a
> 6509/SUP720 (IOS image s72033-pk9sv-mz.122-18.SXD1.bin).
>
> We want to limite the output rate at a Gigabit port connected directly to
> Customer Equipment. That port is configured at swithport mode, and we have
> all level 3 configuration at VLAN interface (1)
>
> In that vlan interface we have try 3 different configurations (2)  to
> establish the output rate limit, and while all of them should work, they
> dont, beacause the rate seen at the vlan interface is lower than the
> Gigabit
> interface, which is correct:
>
>
> 6.2#sh interfaces GigabitEthernet 1/11 | i rate
>  Queueing strategy: fifo
>  30 second input rate 221436000 bits/sec, 60004 packets/sec
>  30 second output rate 456426000 bits/sec, 67772 packets/sec
> 6.2#sh interfaces vlan20 | i rate
>  Queueing strategy: fifo
>  30 second input rate 228770000 bits/sec, 61961 packets/sec
>  30 second output rate 89869000 bits/sec, 23914 packets/sec
>
>
> As your can see, input rates are more or less the same in both interfaces,
> but output rate at vlan is a lot lower than the real value (shown at
> physical port), so all packets are getting conform policy applied,
> transmit,
> with no drops to reduce the rate.
>
> Which can be the cause of this issue?
>
> Theres also the chance to move layer3 config to physical interface, which
> would solve the issue as that interface can see correct rates.
>
>
>
> *******************************************
> (1) Relevant interface / general configuration
> *******************************************
>
> interface GigabitEthernet1/11
>  description CUSTOMER_Principal
>  no ip address
>  load-interval 30
>  switchport
>  switchport access vlan 20
>  switchport mode access
> end
> interface Vlan20
>  ip address 10.160.0.19 255.255.255.240
>  ip access-group 122 in
>  no ip redirects
>  ip wccp 97 redirect in
>  ip wccp 98 redirect in
>  ip multicast netflow egress
>  ip route-cache flow
>  no ip mroute-cache
>  load-interval 30
>  standby 55 ip 10.160.0.17
>  standby 55 priority 150
>  standby 55 preempt
> end
>
> mls ip multicast flow-stat-timer 9
> mls aging long 64
> mls aging normal 60
> mls flow ip destination-source
> no mls flow ipv6
> mls qos
> mls cef error action freeze
>
> *******************************************
> (2) Configuration to limit the output rate:
> *******************************************
>
> 1. rate-limit
>
> interface Vlan20
>  rate-limit output 425000000 212500 212500 conform-action transmit
> exceed-action drop
>
> 2. service-policy with rate-limit
>
> policy-map CUSTOMER_OUT
> class class-default
> police 425000000 conform-action transmit exceed-action drop
> !apply police to interfaz
> interface vlan20
>  service-policy output CUSTOMER
>
> 3. service-policy with aggregate policer
>
> mls qos aggregate-policer CUSTOMER_OUT 425000000 106250 conform-action
> transmit exceed-action drop
> !
> policy-map CUSTOMER_OUT
>  class class-default
>  police aggregate CUSTOMER_OUT
> !apply police to interfaz
> interface vlan20
>  service-policy output CUSTOMER
>
> Regards,
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************






************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From magamo79 at gmail.com  Mon Jun 29 07:13:59 2009
From: magamo79 at gmail.com (=?ISO-8859-1?Q?Manuel_Garc=EDa_Montero?=)
Date: Mon, 29 Jun 2009 13:13:59 +0200
Subject: [c-nsp] Fwd:  Applying output rate limit at 6500/SUP720 platform
In-Reply-To: <2dd999e30906290335s439f433bu2f46afca280ec747@mail.gmail.com>
References: <2dd999e30906290057j6b74a02t61de9b6353ae38e5@mail.gmail.com> 
	<7100ed370906290220h5a659699wcc9c1ab6fd51aef@mail.gmail.com> 
	<EC993E87D960A541A66BF21D62AA42A623012394B5@exch2k7.gilat.local> 
	<2dd999e30906290335s439f433bu2f46afca280ec747@mail.gmail.com>
Message-ID: <2dd999e30906290413p31ba5a77pae4d9d1e93135774@mail.gmail.com>

Thanks for your answers,

i corrected the rates again (burst sizes in the mail where the last
ones configured after trying both 1.5 and 1 sec slots).

Still the? same, without any ratelimit applied:

6.2#sh interfaces GigabitEthernet 1/11 | i rate
? Queueing strategy: fifo
? 30 second input rate 261948000 bits/sec, 65584 packets/sec
? 30 second output rate 428618000 bits/sec, 71798 packets/sec
6.2#sh interfaces vlan20 | i rate
? Queueing strategy: fifo
? 30 second input rate 255650000 bits/sec, 63221 packets/sec
? 30 second output rate 54892000 bits/sec, 18180 packets/sec

428Mbps at Gigabit vs 55Mbps at VLAN reported rates (this is without
ratelimit configured)

i have try the same in another cisco WS-C6509, this one running
s72033-advipservicesk9_wan-mz.122-18.SXF4.bin (equip with problems
runs s72033-pk9sv-mz.122-18.SXD1.bin):

6.1_2#sh interfaces GigabitEthernet 1/1 | i rate
? Queueing strategy: fifo
? 5 minute input rate 21408000 bits/sec, 18199 packets/sec
? 5 minute output rate 168652000 bits/sec, 21165 packets/sec
6.1_2#sh interfaces vlan20 | i rate
? Queueing strategy: fifo
? 5 minute input rate 21759000 bits/sec, 18313 packets/sec
? 5 minute output rate 167289000 bits/sec, 21033 packets/sec

this time reported rates are coherent.

Thanks again for your help.


On Mon, Jun 29, 2009 at 11:58 AM, Ziv Leyes <zivl at gilat.net> wrote:
>
> I've found that the best results are obtained by using the following formulas
> BC = BW / 8 * 1.5
> BE = BC
> In your case it will be
> 425000000 / 8 * 1.5 = 79687500
> So your rate-limit will look like this:
>
> interface Vlan20
> ?rate-limit output 425000000 79687500 79687500 conform-action transmit exceed-action drop
>
> Hope this helps,
> Ziv
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Manu Chao
> Sent: Monday, June 29, 2009 12:21 PM
> To: Manuel Garc?a Montero
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Applying output rate limit at 6500/SUP720 platform
>
> I think your burst-normal and burst-max values are badly estimated:
>
> burst-normal is the burst size in byte during 1 second of burst
> burst max = burst-normal x2
>
> Try that:
>
> interface Vlan20
> ?rate-limit output 425000000 80000000 160000000 conform-action transmit
> exceed-action drop
> R/
> Manu
> 2009/6/29 Manuel Garc?a Montero <magamo79 at gmail.com>
>
> > Hi,
> >
> > we are facing difficulties trying to limit the rate at an interfaz in a
> > 6509/SUP720 (IOS image s72033-pk9sv-mz.122-18.SXD1.bin).
> >
> > We want to limite the output rate at a Gigabit port connected directly to
> > Customer Equipment. That port is configured at swithport mode, and we have
> > all level 3 configuration at VLAN interface (1)
> >
> > In that vlan interface we have try 3 different configurations (2) ?to
> > establish the output rate limit, and while all of them should work, they
> > dont, beacause the rate seen at the vlan interface is lower than the
> > Gigabit
> > interface, which is correct:
> >
> >
> > 6.2#sh interfaces GigabitEthernet 1/11 | i rate
> > ?Queueing strategy: fifo
> > ?30 second input rate 221436000 bits/sec, 60004 packets/sec
> > ?30 second output rate 456426000 bits/sec, 67772 packets/sec
> > 6.2#sh interfaces vlan20 | i rate
> > ?Queueing strategy: fifo
> > ?30 second input rate 228770000 bits/sec, 61961 packets/sec
> > ?30 second output rate 89869000 bits/sec, 23914 packets/sec
> >
> >
> > As your can see, input rates are more or less the same in both interfaces,
> > but output rate at vlan is a lot lower than the real value (shown at
> > physical port), so all packets are getting conform policy applied,
> > transmit,
> > with no drops to reduce the rate.
> >
> > Which can be the cause of this issue?
> >
> > Theres also the chance to move layer3 config to physical interface, which
> > would solve the issue as that interface can see correct rates.
> >
> >
> >
> > *******************************************
> > (1) Relevant interface / general configuration
> > *******************************************
> >
> > interface GigabitEthernet1/11
> > ?description CUSTOMER_Principal
> > ?no ip address
> > ?load-interval 30
> > ?switchport
> > ?switchport access vlan 20
> > ?switchport mode access
> > end
> > interface Vlan20
> > ?ip address 10.160.0.19 255.255.255.240
> > ?ip access-group 122 in
> > ?no ip redirects
> > ?ip wccp 97 redirect in
> > ?ip wccp 98 redirect in
> > ?ip multicast netflow egress
> > ?ip route-cache flow
> > ?no ip mroute-cache
> > ?load-interval 30
> > ?standby 55 ip 10.160.0.17
> > ?standby 55 priority 150
> > ?standby 55 preempt
> > end
> >
> > mls ip multicast flow-stat-timer 9
> > mls aging long 64
> > mls aging normal 60
> > mls flow ip destination-source
> > no mls flow ipv6
> > mls qos
> > mls cef error action freeze
> >
> > *******************************************
> > (2) Configuration to limit the output rate:
> > *******************************************
> >
> > 1. rate-limit
> >
> > interface Vlan20
> > ?rate-limit output 425000000 212500 212500 conform-action transmit
> > exceed-action drop
> >
> > 2. service-policy with rate-limit
> >
> > policy-map CUSTOMER_OUT
> > class class-default
> > police 425000000 conform-action transmit exceed-action drop
> > !apply police to interfaz
> > interface vlan20
> > ?service-policy output CUSTOMER
> >
> > 3. service-policy with aggregate policer
> >
> > mls qos aggregate-policer CUSTOMER_OUT 425000000 106250 conform-action
> > transmit exceed-action drop
> > !
> > policy-map CUSTOMER_OUT
> > ?class class-default
> > ?police aggregate CUSTOMER_OUT
> > !apply police to interfaz
> > interface vlan20
> > ?service-policy output CUSTOMER
> >
> > Regards,
> > _______________________________________________
> > cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
>
>
>
>
>
>
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
>

From tony at cambiumdata.com  Mon Jun 29 09:47:34 2009
From: tony at cambiumdata.com (Tony Underwood)
Date: Mon, 29 Jun 2009 06:47:34 -0700
Subject: [c-nsp] Free NMS Tools
In-Reply-To: <4A47D172.8020600@nordicom.tele.dk>
References: <461308.822.qm@web76301.mail.sg1.yahoo.com>
	<4A47D172.8020600@nordicom.tele.dk>
Message-ID: <0F205F18DCB4724DB15EAF8FF93E0A21129EAEEA21@P3PW5EX1MB04.EX1.SECURESERVER.NET>

I'm a big fan of NMIS
http://www.sins.com.au/nmis/

Tony Underwood CCIE #7112
Sr. Network Engineer
Cambium Data Inc.
5050 So. 111th St.
Omaha, NE 68137
(402) 556-1388
http://CambiumData.com

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Arne Larsen
Sent: Sunday, June 28, 2009 3:24 PM
To: ==N==
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Free NMS Tools

==N== wrote:

>Dear All,
>
>Currently I looking for NMS ( Network Monitoring) tools which is Free Open source base.
>I need you suggestion. Currently I have more then 100 Cisco Routers and some for L3 3com Switches. 
>
>I thank you in advanced for any sugesstion.
>
>Regards,
>
>
>
>suryantofang
>http://suryantofang.wordpress.com
>
>" Fly Higher - Run Faster "
>
>
>      Yahoo! Mail Kini Lebih Cepat dan Lebih Bersih. Rasakan bedanya sekarang! http://id.mail.yahoo.com
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>  
>
http://www.zenoss.com/

/Arne
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From Jonathan.Brashear at hq.speakeasy.net  Mon Jun 29 09:33:02 2009
From: Jonathan.Brashear at hq.speakeasy.net (Jonathan Brashear)
Date: Mon, 29 Jun 2009 06:33:02 -0700
Subject: [c-nsp] DNS rewrite & global capabilities
Message-ID: <725755F5E728EE4086DAAF1A54DACF4F150AD905@sea5exbe1.speakeasy.hq>

I recently went through a Cisco security course and learned about the ASA's 'DNS Rewrite' function which seems like a handy tool internally.  I'm curious if there's ever been an effort to re-work that function outward; it seems like the ability to rewrite DNS against certain DDoS attacks(like, re-writing the IP to 127.0.0.1 when replying to the attacker for example) could be a good tool in the arsenal against attacks.  Has anyone attempted to use something like DNS re-write in this manner, and if so what were the results?

Network Engineer, JNCIS-M
> 214-981-1954 (office) 
> 214-642-4075 (cell)
> jbrashear at hq.speakeasy.net 
http://www.speakeasy.net

From rdobbins at arbor.net  Mon Jun 29 10:17:28 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Mon, 29 Jun 2009 21:17:28 +0700
Subject: [c-nsp] DNS rewrite & global capabilities
In-Reply-To: <725755F5E728EE4086DAAF1A54DACF4F150AD905@sea5exbe1.speakeasy.hq>
References: <725755F5E728EE4086DAAF1A54DACF4F150AD905@sea5exbe1.speakeasy.hq>
Message-ID: <44385206-0907-4D3D-87A2-0073FCF2D1AA@arbor.net>


On Jun 29, 2009, at 8:33 PM, Jonathan Brashear wrote:

> t seems like the ability to rewrite DNS against certain DDoS attacks

Marketing claims aside, firewalls have no utility whatsoever in terms  
of defending against DDoS attacks, and actually tend to make the  
situation worse and the server behind them *more* vulnerable to DDoS,  
and not less, due to the limitations of the stateful capacity they  
embody.

You'd be far better off using S/RTBH as a reaction tool, and depending  
upon your application and its importance/scale, may wish to  
investigate other tools intended to protect firewalls and the things  
behind them from DDoS (full disclosure; I work for a company which  
makes such tools).

But even more than that, putting your public-facing DNS (or any other  
kind of server) behind a firewall is a very serious architectural  
mistake; firewalls in front of public-facing servers provide no  
security value whatsoever, and degrade the overall security posture  
due to the issues denoted above.  Far, far better to bring your public- 
facing DNS servers out from behind the firewall, employ all the  
various host- and application-/service-specific BCPs, ensure your DNS  
architecture is properly designed and scaled, and make use of S/RTBH,  
et. al. to deal with DDoS.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From sam_mailinglists at spacething.org  Mon Jun 29 10:23:14 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Mon, 29 Jun 2009 15:23:14 +0100
Subject: [c-nsp] DNS rewrite & global capabilities
In-Reply-To: <44385206-0907-4D3D-87A2-0073FCF2D1AA@arbor.net>
References: <725755F5E728EE4086DAAF1A54DACF4F150AD905@sea5exbe1.speakeasy.hq>
	<44385206-0907-4D3D-87A2-0073FCF2D1AA@arbor.net>
Message-ID: <4A48CE52.6020207@spacething.org>

Roland Dobbins wrote:
> But even more than that, putting your public-facing DNS (or any other 
> kind of server) behind a firewall is a very serious architectural 
> mistake; firewalls in front of public-facing servers provide no 
> security value whatsoever, and degrade the overall security posture 
> due to the issues denoted above.
Roland,

This seems to imply that the servers would need a second interface for 
management, with static routes over-riding the default? Is this your 
preferred approach?

Sam

From sthaug at nethelp.no  Mon Jun 29 10:40:33 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Mon, 29 Jun 2009 16:40:33 +0200 (CEST)
Subject: [c-nsp] DNS rewrite & global capabilities
In-Reply-To: <4A48CE52.6020207@spacething.org>
References: <725755F5E728EE4086DAAF1A54DACF4F150AD905@sea5exbe1.speakeasy.hq>
	<44385206-0907-4D3D-87A2-0073FCF2D1AA@arbor.net>
	<4A48CE52.6020207@spacething.org>
Message-ID: <20090629.164033.74657689.sthaug@nethelp.no>

> > But even more than that, putting your public-facing DNS (or any other 
> > kind of server) behind a firewall is a very serious architectural 
> > mistake; firewalls in front of public-facing servers provide no 
> > security value whatsoever, and degrade the overall security posture 
> > due to the issues denoted above.
> 
> This seems to imply that the servers would need a second interface for 
> management, with static routes over-riding the default? Is this your 
> preferred approach?

SSH through the regular Internet-facing interface, with appropriate
restrictions (hosts.allow or similar) also works very well. We have
our DNS servers configured this way, and see no problems.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From rdobbins at arbor.net  Mon Jun 29 10:56:17 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Mon, 29 Jun 2009 21:56:17 +0700
Subject: [c-nsp] DNS rewrite & global capabilities
In-Reply-To: <20090629.164033.74657689.sthaug@nethelp.no>
References: <725755F5E728EE4086DAAF1A54DACF4F150AD905@sea5exbe1.speakeasy.hq>
	<44385206-0907-4D3D-87A2-0073FCF2D1AA@arbor.net>
	<4A48CE52.6020207@spacething.org>
	<20090629.164033.74657689.sthaug@nethelp.no>
Message-ID: <374A17A6-C564-4233-906D-79CE4BD8309D@arbor.net>


On Jun 29, 2009, at 9:40 PM, sthaug at nethelp.no wrote:

> SSH through the regular Internet-facing interface, with appropriate
> restrictions (hosts.allow or similar) also works very well. We have
> our DNS servers configured this way, and see no problems.

OOB management through a dedicated DCN has many advantages for both  
interactive access via ssh as well as telemetry polling/export via  
SNMP, NetFlow, et. al.  If in-band access is the only mechanism  
available, iACLs at the edge should ensure that administrative/ 
management operations can be performed in without interference from  
incoming traffic on the production network.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From blahu77 at gmail.com  Mon Jun 29 11:17:05 2009
From: blahu77 at gmail.com (Mateusz Blaszczyk)
Date: Mon, 29 Jun 2009 16:17:05 +0100
Subject: [c-nsp] [c3560g] Not in truth table when modyfing ACL
Message-ID: <383357750906290817x6eb1acf8nb12c457d44b89f88@mail.gmail.com>

This error message shows up every now end then when adding or modyfing
an ACL (with or without access-group config on the SVI):

Jun  4 03:33:23.347: %ACLMGR-3-INTTABLE: Not in truth table: VLMAP 9
RACL 9 Rtprot 9 Mcb 13 Feat 3
Jun  4 03:33:23.347: %ACLMGR-3-INTTABLE: Not in truth table: VLMAP 9
RACL 9 Rtprot 9 Mcb 13 Feat 3
Jun  4 03:33:23.355: %ACLMGR-3-INTTABLE: Not in truth table: VLMAP 9
RACL 9 Rtprot 9 Mcb 13 Feat 3
Jun  4 03:33:23.355: %ACLMGR-3-INTTABLE: Not in truth table: VLMAP 9
RACL 9 Rtprot 9 Mcb 13 Feat 3

Can anyone tell me what is the severity of that problem? google is
quite quiet apart from link to cisco's error messages list, which is
not really helpful.

=-=-
Error Message    ACLMGR-3-INTTABLE: Not in truth table: VLMAP [dec]
RACL [dec] Mcb [dec]
Feat [dec].

Explanation    This message means that an unrecoverable software error
occurred while trying to merge the configured input features. [dec]
are internal action codes.

Recommended Action    Copy the message exactly as it appears on the
console or in the system log. Research and attempt to resolve the
error by using the Output Interpreter. Enter the show running-config
user EXEC command to gather data that might help identify the nature
of the error. Use the Bug Toolkit to look for similar reported
problems. If you still require assistance, open a case with the TAC,
or contact your Cisco technical support representative, and provide
the representative with the gathered information. For more information
about these online tools and about contacting Cisco, see the "Error
Message Traceback Reports" section.
=-=-

The only time this error message could be linked to a buggy behaviour
was when an acl on input have to be removed because it didnt allow bgp
session to come up between switch and server connected directly to it.
Even "permit any any" was somehow blocking the packets through and
only complete removal of "ip access-group acl in" config, helped to
resolve the problem.

Any ideas?

#sh ver | in IOS
Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version
12.2(50)SE1, RELEASE SOFTWARE (fc2)

#sh sdm prefer
 The current template is "desktop routing" template.
 The selected template optimizes the resources in
 the switch to support this level of features for
 8 routed interfaces and 1024 VLANs.

  number of unicast mac addresses:                  3K
  number of IPv4 IGMP groups + multicast routes:    1K
  number of IPv4 unicast routes:                    11K
    number of directly-connected IPv4 hosts:        3K
    number of indirect IPv4 routes:                 8K
  number of IPv4 policy based routing aces:         0.5K
  number of IPv4/MAC qos aces:                      0.5K
  number of IPv4/MAC security aces:                 1K

#sh platform tcam utilization

CAM Utilization for ASIC# 0                      Max            Used
                                             Masks/Values    Masks/values

 Unicast mac addresses:                        400/3200         53/330
 IPv4 IGMP groups + multicast routes:          144/1152         12/40
 IPv4 unicast directly-connected routes:       400/3200         53/330
 IPv4 unicast indirectly-connected routes:    1040/8320         49/327
 IPv4 policy based routing aces:               384/512           1/2
 IPv4 qos aces:                                768/768         324/324
 IPv4 security aces:                          1024/1024        223/223

From jmaimon at ttec.com  Mon Jun 29 11:56:47 2009
From: jmaimon at ttec.com (Joe Maimon)
Date: Mon, 29 Jun 2009 11:56:47 -0400
Subject: [c-nsp] DNS rewrite & global capabilities
In-Reply-To: <4A48CE52.6020207@spacething.org>
References: <725755F5E728EE4086DAAF1A54DACF4F150AD905@sea5exbe1.speakeasy.hq>	<44385206-0907-4D3D-87A2-0073FCF2D1AA@arbor.net>
	<4A48CE52.6020207@spacething.org>
Message-ID: <4A48E43F.1030804@ttec.com>



Sam Stickland wrote:
> Roland Dobbins wrote:
>> But even more than that, putting your public-facing DNS (or any other 
>> kind of server) behind a firewall is a very serious architectural 
>> mistake; firewalls in front of public-facing servers provide no 
>> security value whatsoever, and degrade the overall security posture 
>> due to the issues denoted above.
> Roland,
> 
> This seems to imply that the servers would need a second interface for 
> management, with static routes over-riding the default? Is this your 
> preferred approach?
> 
> Sam

If you are using a linux host, not only is it simple enough to use dot1q 
subinterfaces for internal vs. external interfaces, its also fairly 
elegant to use policy routing.

http://www.policyrouting.org/PolicyRoutingBook/ONLINE/CH03.web.html

And while you are at it, you should consider adopting the approach that 
all service addresses are to be only service addresses, put it on a 
loopback interface.

Here is a simple little init.d script that makes linux pbr convenient.

#!/bin/sh
PATH=/sbin

# table needs to be defined in /etc/iproute2/rt_tables
table="special-exit"

function policyroute
{
   if [[ "$1" != "" ]]; then
     ip route $1 0.0.0.0/0 table $table via 192.168.0.14
     ip route $1 192.168.0.0/28 table $table dev eth0
     ip rule $1 from 192.168.0.0/28 table $table
   fi
}

case "$1" in

  delete | stop)
         policyroute del
         ;;
  add | start)
         policyroute add
         ;;
  restart | reload)
         policyroute del
         policyroute add
         ;;
  *)
         exit
         ;;

esac

From shinejoseph at dodo.com.au  Mon Jun 29 16:28:25 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Tue, 30 Jun 2009 04:28:25 +0800
Subject: [c-nsp] Data Centre Best pratices
Message-ID: <D2C89F6581D84EA584B901F846B8E57D@au.didata.local>

Hi,

I am at the beginning of building a best practices document for data centre design. I am wondering if anyone can poiunt me to the right document that I can start with. I am looking at a Cisco centric solution. Following documents are currently being looked at.

http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DC_Infra2_5/DCI_SRND_2_5_book.html
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd804be7e2_ps2706_Products_White_Paper.html

Any pointers and help would be highly appreciated.

Thanks in advance.
Shine

From rwest at zyedge.com  Mon Jun 29 16:51:50 2009
From: rwest at zyedge.com (Ryan West)
Date: Mon, 29 Jun 2009 16:51:50 -0400
Subject: [c-nsp] PIX/ASA Change Control
In-Reply-To: <4A477078.8000504@packetpimp.org>
References: <76D38BC6-4D21-4143-BF75-1C22C3A7BA88@zyedge.com><C66941E7.164CF%sigurbjornl@vodafone.is><20090625163851.GB25366@lboro.ac.uk><6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5905@zy-ex1.zyedge.local><4A4459F4.4030908@justinshore.com>
	<20090626082736.GC26638@lboro.ac.uk>
	<62D8ECFDF835A648AD4FB4328B15F36404E8B3F5@mud.admiral.uk>
	<6B8401A83219DF499C34DEAEE9A599921015AEDBBB@XBOX.midlandpaper.com>
	<A35222FB-82A9-41FD-86B9-66C60280F3AC@arbor.net>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5952@zy-ex1.zyedge.local>
	<1E3D2B26-616D-417F-9B26-980ED5855809@GREnergy.com>
	<4A477078.8000504@packetpimp.org>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5AAA@zy-ex1.zyedge.local>

Thanks for the feedback.  Did the migration from CVS to SVN and cvsweb to websvn and pulled backend authentication through LDAP.  If anyone is interested in the migration, I found a good post in the archives of the RANCID mailing list:

http://www.shrubbery.net/pipermail/rancid-discuss/2007-July/002365.html

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jason LeBlanc
Sent: Sunday, June 28, 2009 9:31 AM
Cc: Cisco-nsp
Subject: Re: [c-nsp] PIX/ASA Change Control

We've moved to this as well, much nicer and easier to get running than 
cvsweb.

Hughes, Scott GRE/MG wrote:
> Websvn is very slick. RSS feeds, colorized diffs.
>
>
> On Jun 26, 2009, at 8:04 AM, "Ryan West" <rwest at zyedge.com> wrote:
>
>   
>> If you're ever run a ./configure script on a *nix system, you'll be  
>> more than qualified to install RANCID.  It's pretty straightforward.
>>
>> I'm curious to see what others are using for a frontend to RANCID.   
>> Besides the emailing of the diff's that take place, what are others  
>> using to browse the repository?
>>
>> -ryan
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp- 
>> bounces at puck.nether.net] On Behalf Of Roland Dobbins
>> Sent: Friday, June 26, 2009 8:52 AM
>> To: Cisco-nsp
>> Subject: Re: [c-nsp] PIX/ASA Change Control
>>
>>
>> On Jun 26, 2009, at 7:35 PM, Jeff Wojciechowski wrote:
>>
>>     
>>> flavor of Linux/BSD whatever to run RANCID on?
>>>       
>> It'll run on just about anything, and has no special requirements
>> which would preclude it running on a virtual server; just do a bit of
>> testing and scale CPU/RAM/storage in order to meet your requirements
>> (note that RANCID is pretty lightweight).
>>
>> In point of fact, OSS tools like RANCID and others are a great way to
>> dip one's toes into virtualization and gain operational experience
>> with same prior to rolling out end-user-facing applications and
>> services.
>>
>> --- 
>> --------------------------------------------------------------------
>> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>>
>>         Unfortunately, inefficiency scales really well.
>>
>>           -- Kevin Lawton
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>     
> NOTICE TO RECIPIENT: The information contained in this message from Great River Energy and any attachments is confidential and intended only for the named recipient(s). If you have received this message in error, you are prohibited from copying, distributing or using the information. Please contact the sender immediately by return email and delete the original message.
>  
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From matt at iseek.com.au  Mon Jun 29 20:18:48 2009
From: matt at iseek.com.au (Matt Carter)
Date: Tue, 30 Jun 2009 10:18:48 +1000
Subject: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
Message-ID: <ABE427719F549048B7700DD004BAA83048C6355D@exchange2.intranet.iseek.com.au>

Hi All,

Trying to work out whether I am hitting bugs here or can't see the forest for the trees or what. My situation is I need to advertise prefix X when either prefix A or prefix B disappears from the BGP table. My original design was to have two Conditional BGP statements under my peer group each with a unique non-exist & advertise-map such that each condition can be watched independently of the other. The problem I am experiencing is that it seems that whichever statement is entered first appears to work and whichever statement
which was entered last does not work. Removing and reversing the input of the statements results in a reversal of which Condition appears to work. I am using 12.2(33)SRC3. (The fact that Cisco coders can't even spell "BGP" properly in the debugs doesn't give me a great deal of confidence in this feature..)

Eg; Withdrawing 192.168.2.0/24 should result in 10.1.86.0/24 being advertised

We can see in the BGP debug log the prefix matches the advertise map and the condition has changed from withdraw to 'advertise' ( which is also reflected in the show ip bgp neighbor under Condition status) ... but i never get a BGP 'send update' ..

Jun 29 14:52:23.766 AEST: BGP(0): no valid path for 192.168.2.0/24
Jun 29 14:52:57.533 AEST: BPG(0): Condition conditional-nonexist-syd changes to Advertise
Jun 29 14:53:02.085 AEST: BGP(0): net 10.1.86.0/24 matches ADV MAP conditional-advertise-syd: bump version to 4442619

If I remove and re-enter the conditional bgp statements such that this one is entered first and then repeat the test - we get a send update

Jun 29 12:42:45.122 AEST: BGP(0): no valid path for 192.168.2.0/24
Jun 29 12:43:31.950 AEST: BPG(0): Condition conditional-nonexist-syd changes to Advertise
Jun 29 12:43:38.913 AEST: BGP(0): 192.168.99.99 10.1.86.0/24 matches advertise map conditional-advertise-syd, state: Advertise
Jun 29 12:43:38.913 AEST: BGP(0): 192.168.99.99 send UPDATE (prepend, chgflags: 0x0) 10.1.86.0/24, next 192.168.99.98, metric 0, path 65530, extended community

Now this seemed a bit wierd to me so I had another thought, in my case the advertise map is really the same for conditions, I just need to have either non exist prefix A or non exist prefix B, I thought of using a common advertise-map and put both prefix A and B in the same non-exist-map with an "OR" condition in the route-map, however this doesn't seem to work either. I have read there is special behaviour regarding AND / OR operations with non-exist and conditional BGP? does anyone know whether this is or isn't the case ?? I don't seem to be getting either !!

Eg; two prefixes each in it's own prefix list
ip prefix-list prefix_A seq 5 permit 192.168.0.0/24
ip prefix-list prefix_B seq 5 permit 192.168.2.0/24

placed in the same route-map sub block so they are treated with "OR" semantics
route-map telstra-bne-domestic-prefsec-conditional-nonexist permit 10
 match ip address prefix-list prefix_B prefix_A

removal of prefix_A condition is true

Jun 29 16:38:02.578 AEST: BGP(0): nettable_walker 192.168.0.0/24 no best path

Jun 29 16:38:19.354 AEST: BPG(0): Condition conditional-nonexist changes to Advertise

removal of prefix_B doesnt do anything
Jun 29 16:44:44.705 AEST: BGP(0): nettable_walker 192.168.2.0/24 no best path

Seems I don't appear to have "OR" operation nor do I have "AND" operation. Somewhat confused right now. Maybe have been looking at this for too long. :)

Anyone played with conditional BGP and has multiple prefixes OR'ed as the trigger ?




From randy_94108 at yahoo.com  Mon Jun 29 23:35:22 2009
From: randy_94108 at yahoo.com (Randy)
Date: Mon, 29 Jun 2009 20:35:22 -0700 (PDT)
Subject: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
Message-ID: <84237.10994.qm@web80506.mail.mud.yahoo.com>



--- On Mon, 6/29/09, Randy <randy_94108 at yahoo.com> wrote:


From: Randy <randy_94108 at yahoo.com>
Subject: Re: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
To: "Cisco Mailing list" <cisco-nsp at puck.nether.net>, "Matt Carter" <matt at iseek.com.au>
Date: Monday, June 29, 2009, 7:56 PM








--- On Mon, 6/29/09, Matt Carter <matt at iseek.com.au> wrote:


From: Matt Carter <matt at iseek.com.au>
Subject: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
To: "Cisco Mailing list" <cisco-nsp at puck.nether.net>
Date: Monday, June 29, 2009, 5:18 PM


Hi All,

Trying to work out whether I am hitting bugs here or can't see the forest for the trees or what. My situation is I need to advertise prefix X when either prefix A or prefix B disappears from the BGP table. My original design was to have two Conditional BGP statements under my peer group each with a unique non-exist & advertise-map such that each condition can be watched independently of the other. The problem I am experiencing is that it seems that whichever statement is entered first appears to work and whichever statement
which was entered last does not work. Removing and reversing the input of the statements results in a reversal of which Condition appears to work. I am using 12.2(33)SRC3. (The fact that Cisco coders can't even spell "BGP" properly in the debugs doesn't give me a great deal of confidence in this feature..)

Eg; Withdrawing 192.168.2.0/24 should result in 10.1.86.0/24 being advertised

We can see in the BGP debug log the prefix matches the advertise map and the condition has changed from withdraw to 'advertise' ( which is also reflected in the show ip bgp neighbor under Condition status) ... but i never get a BGP 'send update' ..

Jun 29 14:52:23.766 AEST: BGP(0): no valid path for 192.168.2.0/24
Jun 29 14:52:57.533 AEST: BPG(0): Condition conditional-nonexist-syd changes to Advertise
Jun 29 14:53:02.085 AEST: BGP(0): net 10.1.86.0/24 matches ADV MAP conditional-advertise-syd: bump version to 4442619

If I remove and re-enter the conditional bgp statements such that this one is entered first and then repeat the test - we get a send update

Jun 29 12:42:45.122 AEST: BGP(0): no valid path for 192.168.2.0/24
Jun 29 12:43:31.950 AEST: BPG(0): Condition conditional-nonexist-syd changes to Advertise
Jun 29 12:43:38.913 AEST: BGP(0): 192.168.99.99 10.1.86.0/24 matches advertise map conditional-advertise-syd, state: Advertise
Jun 29 12:43:38.913 AEST: BGP(0): 192.168.99.99 send UPDATE (prepend, chgflags: 0x0) 10.1.86.0/24, next 192.168.99.98, metric 0, path 65530, extended community

Now this seemed a bit wierd to me so I had another thought, in my case the advertise map is really the same for conditions, I just need to have either non exist prefix A or non exist prefix B, I thought of using a common advertise-map and put both prefix A and B in the same non-exist-map with an "OR" condition in the route-map, however this doesn't seem to work either. I have read there is special behaviour regarding AND / OR operations with non-exist and conditional BGP? does anyone know whether this is or isn't the case ?? I don't seem to be getting either !!

Eg; two prefixes each in it's own prefix list
ip prefix-list prefix_A seq 5 permit 192.168.0.0/24
ip prefix-list prefix_B seq 5 permit 192.168.2.0/24

placed in the same route-map sub block so they are treated with "OR" semantics
route-map telstra-bne-domestic-prefsec-conditional-nonexist permit 10
match ip address prefix-list prefix_B prefix_A

removal of prefix_A condition is true

Jun 29 16:38:02.578 AEST: BGP(0): nettable_walker 192.168.0.0/24 no best path

Jun 29 16:38:19.354 AEST: BPG(0): Condition conditional-nonexist changes to Advertise

removal of prefix_B doesnt do anything
Jun 29 16:44:44.705 AEST: BGP(0): nettable_walker 192.168.2.0/24 no best path

Seems I don't appear to have "OR" operation nor do I have "AND" operation. Somewhat confused right now. Maybe have been looking at this for too long. :)

Anyone played with conditional BGP and has multiple prefixes OR'ed as the trigger ?
?
?
a version of IOS that supports route-maps with the *continue* clause will more that likely work for you.
see BGP Route-map Continue
Regards,
./Randy
?
?
...I?haven't tried this but a regular fall-through route-map should be able to accomplish this as well.
?
Your non-exist routemap( for the corresponding advertise-map) ?will have two sequences.
?
eg:
?
route-map non-exist? 5
match ip-addr prefix-list a
match as-path?1
?
route-map non-exist 10
match ip addr prefix-list? b
match as-path 2
?
ip prefix-list a permit 172.27.100.0/22
ip prefix-list b permit? 172.28.0.0/23
?
ip as-path?access-list?1 permit? ^65420
ip as-path access-list 2 permit _65534$
?
?
(addresses and ASN's used in example are *private*)
?
Regards,
./Randy

?

From randy_94108 at yahoo.com  Mon Jun 29 22:56:42 2009
From: randy_94108 at yahoo.com (Randy)
Date: Mon, 29 Jun 2009 19:56:42 -0700 (PDT)
Subject: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
Message-ID: <645603.92332.qm@web80505.mail.mud.yahoo.com>



--- On Mon, 6/29/09, Matt Carter <matt at iseek.com.au> wrote:


From: Matt Carter <matt at iseek.com.au>
Subject: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
To: "Cisco Mailing list" <cisco-nsp at puck.nether.net>
Date: Monday, June 29, 2009, 5:18 PM


Hi All,

Trying to work out whether I am hitting bugs here or can't see the forest for the trees or what. My situation is I need to advertise prefix X when either prefix A or prefix B disappears from the BGP table. My original design was to have two Conditional BGP statements under my peer group each with a unique non-exist & advertise-map such that each condition can be watched independently of the other. The problem I am experiencing is that it seems that whichever statement is entered first appears to work and whichever statement
which was entered last does not work. Removing and reversing the input of the statements results in a reversal of which Condition appears to work. I am using 12.2(33)SRC3. (The fact that Cisco coders can't even spell "BGP" properly in the debugs doesn't give me a great deal of confidence in this feature..)

Eg; Withdrawing 192.168.2.0/24 should result in 10.1.86.0/24 being advertised

We can see in the BGP debug log the prefix matches the advertise map and the condition has changed from withdraw to 'advertise' ( which is also reflected in the show ip bgp neighbor under Condition status) ... but i never get a BGP 'send update' ..

Jun 29 14:52:23.766 AEST: BGP(0): no valid path for 192.168.2.0/24
Jun 29 14:52:57.533 AEST: BPG(0): Condition conditional-nonexist-syd changes to Advertise
Jun 29 14:53:02.085 AEST: BGP(0): net 10.1.86.0/24 matches ADV MAP conditional-advertise-syd: bump version to 4442619

If I remove and re-enter the conditional bgp statements such that this one is entered first and then repeat the test - we get a send update

Jun 29 12:42:45.122 AEST: BGP(0): no valid path for 192.168.2.0/24
Jun 29 12:43:31.950 AEST: BPG(0): Condition conditional-nonexist-syd changes to Advertise
Jun 29 12:43:38.913 AEST: BGP(0): 192.168.99.99 10.1.86.0/24 matches advertise map conditional-advertise-syd, state: Advertise
Jun 29 12:43:38.913 AEST: BGP(0): 192.168.99.99 send UPDATE (prepend, chgflags: 0x0) 10.1.86.0/24, next 192.168.99.98, metric 0, path 65530, extended community

Now this seemed a bit wierd to me so I had another thought, in my case the advertise map is really the same for conditions, I just need to have either non exist prefix A or non exist prefix B, I thought of using a common advertise-map and put both prefix A and B in the same non-exist-map with an "OR" condition in the route-map, however this doesn't seem to work either. I have read there is special behaviour regarding AND / OR operations with non-exist and conditional BGP? does anyone know whether this is or isn't the case ?? I don't seem to be getting either !!

Eg; two prefixes each in it's own prefix list
ip prefix-list prefix_A seq 5 permit 192.168.0.0/24
ip prefix-list prefix_B seq 5 permit 192.168.2.0/24

placed in the same route-map sub block so they are treated with "OR" semantics
route-map telstra-bne-domestic-prefsec-conditional-nonexist permit 10
match ip address prefix-list prefix_B prefix_A

removal of prefix_A condition is true

Jun 29 16:38:02.578 AEST: BGP(0): nettable_walker 192.168.0.0/24 no best path

Jun 29 16:38:19.354 AEST: BPG(0): Condition conditional-nonexist changes to Advertise

removal of prefix_B doesnt do anything
Jun 29 16:44:44.705 AEST: BGP(0): nettable_walker 192.168.2.0/24 no best path

Seems I don't appear to have "OR" operation nor do I have "AND" operation. Somewhat confused right now. Maybe have been looking at this for too long. :)

Anyone played with conditional BGP and has multiple prefixes OR'ed as the trigger ?
?
?
a version of IOS that supports route-maps with the *continue* clause will more that likely work for you.
see BGP Route-map Continue
Regards,
./Randy
?




?

From matt at iseek.com.au  Tue Jun 30 00:45:52 2009
From: matt at iseek.com.au (Matt Carter)
Date: Tue, 30 Jun 2009 14:45:52 +1000
Subject: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
In-Reply-To: <645603.92332.qm@web80505.mail.mud.yahoo.com>
References: <645603.92332.qm@web80505.mail.mud.yahoo.com>
Message-ID: <ABE427719F549048B7700DD004BAA83048C6356E@exchange2.intranet.iseek.com.au>

Hi Randy,



Thank you for your speedy reply :) It was my first choice to use the "continue" clause and regular fall-through but despite the fact there is nothing listed under the "Restrictions for BGP Route-Map continue", it appears unsupported by the Conditional BGP feature. Can configure the route-map just fine, but when Conditional BGP comes along you will get



% "conditional-nonexist" used as BGP condition route-map, continue match not supported



:(



I have worked out that basically if I try to "OR" the prefixes in a route-map sub block, only the first prefix list will be evaluated



ie if we have prefix list A before prefix list B

route-map FOO

 match ip address prefix A B



and then use that as a non-exist map for conditional BGP;

- removal of A from BGP table will trigger state change

- removal of B from BGP table will not do anything



if you reverse the positioning in the route-map sub block such that B is before A

route-map FOO

 match ip address prefix B A



i then get reversed behaviour for conditional BGP
- removal of A from BGP table will do nothing

- removal of B from BGP table will trigger state change



which is an aweful lot like the behaviour i was getting when i had two completely separate conditional BGP setups and only the first one that is entered appears to work, reversing the order they are entered reverses which one works and which one doesnt.



strange.





>

> a version of IOS that supports route-maps with the *continue* clause will

> more that likely work for you.

> see BGP Route-map Continue

> Regards,

> ./Randy

>

>

> ...I haven't tried this but a regular fall-through route-map should be

> able to accomplish this as well.

>

> Your non-exist routemap( for the corresponding advertise-map)  will have

> two sequences.

>

> eg:

>

> route-map non-exist  5

> match ip-addr prefix-list a

> match as-path 1

>

> route-map non-exist 10

> match ip addr prefix-list  b

> match as-path 2

>

> ip prefix-list a permit 172.27.100.0/22

> ip prefix-list b permit  172.28.0.0/23

>

> ip as-path access-list 1 permit  ^65420

> ip as-path access-list 2 permit _65534$

>

>

> (addresses and ASN's used in example are *private*)

>

> Regards,

> ./Randy

From jfitz at Princeton.EDU  Tue Jun 30 09:59:35 2009
From: jfitz at Princeton.EDU (Jeff Fitzwater)
Date: Tue, 30 Jun 2009 09:59:35 -0400
Subject: [c-nsp] UDLD ?
Message-ID: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>

We have had a few strange unidirectional link problems and I thought  
that I could detect them using UDLD.   So I thought I knew how it  
worked.   I


I have a 6500 with a gig SFP LH mod connected to a 3750 with the same  
SFP.    I enabled UDLD AGGRESSIVE mode on bot ends and they both  
reported seeing each other as neighbors.

So I thought that if I disconnected one of the fibers that the UDLD  
would detect the unidirectional transition but instead both ends just  
reported link down.

I thought that breaking on side of the fiber would only bring down one  
end LINK since the other still thought it was connected.


I then disabled the UDLD and disconnect the fiber again and still had  
both ends show link failure.



Q>   So why does both ends go down?   Is this a new code feature for  
gig fiber ports or did I miss something?




Jeff Fitzwater
OIT Network Systems
Princeton University





From vitya at list.ru  Tue Jun 30 10:56:17 2009
From: vitya at list.ru (victor)
Date: Tue, 30 Jun 2009 18:56:17 +0400
Subject: [c-nsp] WS-X6724+CFC and ES20 line cards
In-Reply-To: <20090630134905.GE81220@is.co.za>
References: <op.uv0305j12vrlim@localhost.localdomain>
	<20090624142548.GF290@greenie.muc.de>
	<op.uv26du1c2vrlim@localhost.localdomain>
	<20090625153054.GL290@greenie.muc.de>
	<op.uv280cp32vrlim@localhost.localdomain>
	<20090630134905.GE81220@is.co.za>
Message-ID: <op.uwcef3i12vrlim@localhost.localdomain>

On Tue, 30 Jun 2009 17:49:05 +0400, nishal goburdhan <nishal at is.co.za>  
wrote:

> On Thu, Jun 25, 2009 at 08:20:26PM +0400, victor wrote:
>
>> Even more than that :) because the design was verified, simulated and
>> approved by a Cisco Systems lab in Raleigh (NC)
>> Insubordination regarding this matter may result in an unpleasant
>> conversation with my boss. I should probably insist on ordering ES20  
>> :)))
>
>
> as a note, if you *are* thinking of ordering ES20 cards, don't.  get the  
> ES20+ cards instead.
>
Do you mean 7600-ES+20G3C? I think it's just a next generation of  
7600-ES20-GE3C. Please, explain.


-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From peter at rathlev.dk  Tue Jun 30 10:57:50 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Tue, 30 Jun 2009 16:57:50 +0200
Subject: [c-nsp] UDLD ?
In-Reply-To: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>
References: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>
Message-ID: <1246373870.8937.34.camel@localhost.localdomain>

On Tue, 2009-06-30 at 09:59 -0400, Jeff Fitzwater wrote: 
> We have had a few strange unidirectional link problems and I thought  
> that I could detect them using UDLD.   So I thought I knew how it  
> worked.   I
... 
> I thought that breaking on side of the fiber would only bring down one  
> end LINK since the other still thought it was connected.
> 
> I then disabled the UDLD and disconnect the fiber again and still had  
> both ends show link failure.

Just tried this between a 3560 12.2(35)SE5 and a 2970 12.2(25)SEC2 with
the same symptoms as you describe; disconnecting one fiber doesn't
trigger UDLD but does give link down in both ends. This is also contrary
to what I expected.

UDLD is useful in another case though: Media converters and EoMPLS
xconnected ports are transparent to UDLD but might not have link
poisoning enabled. With UDLD you would discover the loss of connectivity
to the neighbor even though the link doesn't go down.

As long as the link actually goes down the UDLD isn't needed anyway. :-)

Regards,
Peter




From tdurack at gmail.com  Tue Jun 30 10:28:23 2009
From: tdurack at gmail.com (Tim Durack)
Date: Tue, 30 Jun 2009 10:28:23 -0400
Subject: [c-nsp] UDLD ?
In-Reply-To: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>
References: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>
Message-ID: <9e246b4d0906300728o9a3597bh8db599839fa7f30f@mail.gmail.com>

>
> I then disabled the UDLD and disconnect the fiber again and still had both
> ends show link failure.
>
>
>
> Q> ? So why does both ends go down? ? Is this a new code feature for gig
> fiber ports or did I miss something?
>

Are the ports set to auto? Auto-neg will notice one-way link, and not
bring up the link.

Tim:>

From md at bts.sk  Tue Jun 30 11:13:33 2009
From: md at bts.sk (Marian =?utf-8?B?xI51cmtvdmnEjQ==?=)
Date: Tue, 30 Jun 2009 17:13:33 +0200
Subject: [c-nsp] UDLD ?
In-Reply-To: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>
References: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>
Message-ID: <20090630151333.GA3697@bts.sk>

On Tue, Jun 30, 2009 at 09:59:35AM -0400, Jeff Fitzwater wrote:
> Q>   So why does both ends go down?   Is this a new code feature for  
> gig fiber ports or did I miss something?

GigE autonegotiation reports remote-fault to the other end.

   M.

From tstevens at cisco.com  Tue Jun 30 11:25:52 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Tue, 30 Jun 2009 08:25:52 -0700
Subject: [c-nsp] UDLD ?
In-Reply-To: <1246373870.8937.34.camel@localhost.localdomain>
References: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>
	<1246373870.8937.34.camel@localhost.localdomain>
Message-ID: <200906301526.n5UFQOL2023722@sj-core-5.cisco.com>

GE/10G can detect a physical unidirectional fiber link itself, UDLD 
is not necessary to detect this type of failure.

UDLD is needed for exactly the case you mention, or for cases where 
one side of the link is "braindead" but does not bring the physical 
link down (ie, software problem).


HTH,
Tim


At 07:57 AM 6/30/2009, Peter Rathlev stated:

>On Tue, 2009-06-30 at 09:59 -0400, Jeff Fitzwater wrote:
> > We have had a few strange unidirectional link problems and I thought
> > that I could detect them using UDLD.   So I thought I knew how it
> > worked.   I
>...
> > I thought that breaking on side of the fiber would only bring down one
> > end LINK since the other still thought it was connected.
> >
> > I then disabled the UDLD and disconnect the fiber again and still had
> > both ends show link failure.
>
>Just tried this between a 3560 12.2(35)SE5 and a 2970 12.2(25)SEC2 with
>the same symptoms as you describe; disconnecting one fiber doesn't
>trigger UDLD but does give link down in both ends. This is also contrary
>to what I expected.
>
>UDLD is useful in another case though: Media converters and EoMPLS
>xconnected ports are transparent to UDLD but might not have link
>poisoning enabled. With UDLD you would discover the loss of connectivity
>to the neighbor even though the link doesn't go down.
>
>As long as the link actually goes down the UDLD isn't needed anyway. :-)
>
>Regards,
>Peter
>
>
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
><https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at 
><http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From jfitz at Princeton.EDU  Tue Jun 30 11:49:51 2009
From: jfitz at Princeton.EDU (Jeff Fitzwater)
Date: Tue, 30 Jun 2009 11:49:51 -0400
Subject: [c-nsp] UDLD ?
In-Reply-To: <200906301526.n5UFQOL2023722@sj-core-5.cisco.com>
References: <AC255DE5-0467-4F53-A929-9BFF4A949E15@Princeton.EDU>
	<1246373870.8937.34.camel@localhost.localdomain>
	<200906301526.n5UFQOL2023722@sj-core-5.cisco.com>
Message-ID: <6B70703C-059F-4CBA-A88D-1490F9666265@Princeton.EDU>

Thanks all for the info on UDLD.   In my case the test did not work as  
expected because the port was in auto-negotiate, as it should be.    
Disabling it allowed the port to stay up even if the other end was  
down (no light).
Enabling the UDLD worked as I would expect in this case.   But in the  
end the auto should be enabled and the UDLD will detect converter  
issues or patch panel issues.

The one thing I am curious about is, what happens if the other end is  
not CISCO but the next hop L2 is.  Does the UDLD packet (01-00-0C-CC- 
CC-CC) pass thru? ( I would say yes).  I would guess this could cause  
strange link failures and is why UDLD is not on by default.

The best reference for UDLD is the rfc 5171


Jeff



On Jun 30, 2009, at 11:25 AM, Tim Stevenson wrote:

> GE/10G can detect a physical unidirectional fiber link itself, UDLD  
> is not necessary to detect this type of failure.
>
> UDLD is needed for exactly the case you mention, or for cases where  
> one side of the link is "braindead" but does not bring the physical  
> link down (ie, software problem).
>
>
> HTH,
> Tim
>
>
> At 07:57 AM 6/30/2009, Peter Rathlev stated:
>
>> On Tue, 2009-06-30 at 09:59 -0400, Jeff Fitzwater wrote:
>> > We have had a few strange unidirectional link problems and I  
>> thought
>> > that I could detect them using UDLD.   So I thought I knew how it
>> > worked.   I
>> ...
>> > I thought that breaking on side of the fiber would only bring  
>> down one
>> > end LINK since the other still thought it was connected.
>> >
>> > I then disabled the UDLD and disconnect the fiber again and still  
>> had
>> > both ends show link failure.
>>
>> Just tried this between a 3560 12.2(35)SE5 and a 2970 12.2(25)SEC2  
>> with
>> the same symptoms as you describe; disconnecting one fiber doesn't
>> trigger UDLD but does give link down in both ends. This is also  
>> contrary
>> to what I expected.
>>
>> UDLD is useful in another case though: Media converters and EoMPLS
>> xconnected ports are transparent to UDLD but might not have link
>> poisoning enabled. With UDLD you would discover the loss of  
>> connectivity
>> to the neighbor even though the link doesn't go down.
>>
>> As long as the link actually goes down the UDLD isn't needed  
>> anyway. :-)
>>
>> Regards,
>> Peter
>>
>>
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> Tim Stevenson, tstevens at cisco.com
> Routing & Switching CCIE #5561
> Technical Marketing Engineer, Cisco Nexus 7000
> Cisco - http://www.cisco.com
> IP Phone: 408-526-6759
> ********************************************************
> The contents of this message may be *Cisco Confidential*
> and are intended for the specified recipients only.


From vitya at list.ru  Tue Jun 30 11:54:56 2009
From: vitya at list.ru (victor)
Date: Tue, 30 Jun 2009 19:54:56 +0400
Subject: [c-nsp] WS-X6724+CFC and ES20 line cards
In-Reply-To: <op.uwcef3i12vrlim@localhost.localdomain>
References: <op.uv0305j12vrlim@localhost.localdomain>
	<20090624142548.GF290@greenie.muc.de>
	<op.uv26du1c2vrlim@localhost.localdomain>
	<20090625153054.GL290@greenie.muc.de>
	<op.uv280cp32vrlim@localhost.localdomain>
	<20090630134905.GE81220@is.co.za>
	<op.uwcef3i12vrlim@localhost.localdomain>
Message-ID: <op.uwcg5uur2vrlim@localhost.localdomain>

On Tue, 30 Jun 2009 18:56:17 +0400, victor <vitya at list.ru> wrote:

> On Tue, 30 Jun 2009 17:49:05 +0400, nishal goburdhan <nishal at is.co.za>  
> wrote:
>
>> On Thu, Jun 25, 2009 at 08:20:26PM +0400, victor wrote:
>>
>>> Even more than that :) because the design was verified, simulated and
>>> approved by a Cisco Systems lab in Raleigh (NC)
>>> Insubordination regarding this matter may result in an unpleasant
>>> conversation with my boss. I should probably insist on ordering ES20  
>>> :)))
>>
>>
>> as a note, if you *are* thinking of ordering ES20 cards, don't.  get  
>> the ES20+ cards instead.
>>
> Do you mean 7600-ES+20G3C? I think it's just a next generation of  
> 7600-ES20-GE3C. Please, explain.
He-he. Didn't notice the period after "don't". For me it was "don't  get  
the ES20+ cards instead." :)


-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From arla at rn.dk  Tue Jun 30 13:47:19 2009
From: arla at rn.dk (Arne Larsen / Region Nordjylland)
Date: Tue, 30 Jun 2009 19:47:19 +0200
Subject: [c-nsp] tacacs+ an nexus 5010
Message-ID: <8D68760F464FFD40A01BF2FB374E4A2801CC19061CB7@SRVEXC02.aas.its.nja.dk>

Hi all.

Can someone help me out here.
I'm having trouble getting tacacs+ to work an a nexus 5010.
When ever I'm trying to access the nexus the debug prints.:  Skipping DEAD TACACS+ server 10.0.100.233
I can ping and telnet to the tac-server from the nexus. Am I missiing somthing in my config ??

my conf.

vrf context management
  ip name-server 10.2.4.63 10.2.4.64 10.2.4.65
ip host aasnxu1 10.2.8.14
ip host helios 10.0.100.233
tacacs-server key 7 "xxxxxxxxx"
tacacs-server host 10.0.100.233
aaa group server tacacs+ REG_TAC
    server 10.0.100.233
    deadtime 5
    use-vrf management
aaa authentication login default group REG_TAC
aaa authentication login error-enable
tacacs-server directed-request
vrf context management
  ip route 0.0.0.0/0 10.2.8.1
  


aasnxu1# sh tacacs-server
Global TACACS+ shared secret:********
timeout value:5
deadtime value:0
total number of servers:1

following TACACS+ servers are configured:
        10.0.100.233:
                available on port:49

following TACACS+ server groups are configured:
        group REG_TAC:
                server 10.0.100.233 on port 49
                deadtime is 5
                vrf is management


/Arne

From drew.weaver at thenap.com  Tue Jun 30 17:59:00 2009
From: drew.weaver at thenap.com (Drew Weaver)
Date: Tue, 30 Jun 2009 14:59:00 -0700
Subject: [c-nsp] Fun with interface counters.
Message-ID: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>

I assume this is either a bug, or something else equally enjoyable.

Today, I noticed that one of our switches was acting up, so I logged into it and did the usual show interfaces, sh proc cpu sort, etc etc.

I noticed that the switch's uplink interface indicated that it was doing 700Mbps to the router it is connected to, the router indicated that it was only getting 200Mbps from the switch.

So either there is a counter bug, or the switch was sending traffic that was being dropped by the router or dropped later by the switch (after it was counted?), or something else equally amusing?

Does anyone have any thoughts on this/seen this before?

Thanks!

From jlewis at lewis.org  Tue Jun 30 15:37:40 2009
From: jlewis at lewis.org (Jon Lewis)
Date: Tue, 30 Jun 2009 15:37:40 -0400 (EDT)
Subject: [c-nsp] Fun with interface counters.
In-Reply-To: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
References: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
Message-ID: <Pine.LNX.4.61.0906301535510.6312@soloth.lewis.org>

On Tue, 30 Jun 2009, Drew Weaver wrote:

> I noticed that the switch's uplink interface indicated that it was doing 
> 700Mbps to the router it is connected to, the router indicated that it 
> was only getting 200Mbps from the switch.

I've seen similar discrepancies with 3550s gigabit uplinked to 6509s, just 
not enough times or long lasting enough to spend any time investigating.


----------------------------------------------------------------------
  Jon Lewis                   |  I route
  Senior Network Engineer     |  therefore you are
  Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

From chris at chrisserafin.com  Tue Jun 30 15:11:42 2009
From: chris at chrisserafin.com (ChrisSerafin)
Date: Tue, 30 Jun 2009 14:11:42 -0500
Subject: [c-nsp] MPLS/BGP - want to add backup IPSEC VPN
Message-ID: <4A4A636E.4090301@chrisserafin.com>

I have a few MPLS routers running BGP as the routing protocol.

I added a public IP'ed interface on a free ports on the same router, and 
I'm able to get to it and use it for Internet bound traffic if I wish. I 
would like to configure an IPSEC VPN to provide backup if the MPLS 
provider fails. I'm having a hard time with Cisco TAC on this, mainly 
them getting back to me.

dumb'ed down diagram is at: http://chrisserafin.com/design.jpg

I just want a basic split tunnel VPN in the event the primary MPLS/BGP 
link goes down. I'm assuming let BGP take care of the MPLS side and add 
static routes with a very high weight for the VPN failover?


All comments welcome...looking for help on this.

--chris


From mhuff at ox.com  Tue Jun 30 15:50:18 2009
From: mhuff at ox.com (Matthew Huff)
Date: Tue, 30 Jun 2009 15:50:18 -0400
Subject: [c-nsp] Non export of netflow  of dscp bits from PCF3A
In-Reply-To: <Pine.LNX.4.61.0906301535510.6312@soloth.lewis.org>
References: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
	<Pine.LNX.4.61.0906301535510.6312@soloth.lewis.org>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9D122127DF0@PUR-EXCH07.ox.com>

We use Fluke's Netflow Tracker for netflow analysis. I've run into a weird one though. Our netflow export from our distribution switches which are running 12.2(33)SXI1 does not seem to export the dscp bits, but our core switches running 12.2(33)SXI1 as well, do export the dscp bits. The difference is the distribution switch is a PFC3A where the core switches are PFC3Bs. Anyone seen this issue before? I've verified that the netflow configurations are identical, and that the packets do have the attributes set as they pass throught he distribution.



----
Matthew Huff       | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff  | Fax:   914-460-4139


From felixnkansah at gmail.com  Tue Jun 30 15:54:26 2009
From: felixnkansah at gmail.com (Felix Nkansah)
Date: Tue, 30 Jun 2009 19:54:26 +0000
Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3
In-Reply-To: <18dba4e50906301253k6878883ueddda75ee052bb46@mail.gmail.com>
References: <18dba4e50906301253k6878883ueddda75ee052bb46@mail.gmail.com>
Message-ID: <18dba4e50906301254i1ea16f25ne88858631fc47b1b@mail.gmail.com>

Hello,

I am trying to download the Cisco ITP configuration guide for the *
12.4(11)SW3* software release.

The file can be seen in the ITP configuration guides list
http://www.cisco.com/en/US/products/sw/wirelssw/ps1862/products_feature_guides_list.html
.

Unfortunately, it keeps on prompting me for a CCO login. I have provided
several valid CCO credentials (some with service contract privileges), but
the file cannot be obtained.

I would appreciate if you could help me obtain this file.

I am migrating the configuration on some Cisco ITPs with 12.2(33)IRC, but it
appears Cisco has changed the command syntax altogether on the new platform.
The popular *cs7* commands are no longer recognized.

Your urgent assistance is deeply appreciated.
Felix

From geoff at pendery.net  Tue Jun 30 16:24:30 2009
From: geoff at pendery.net (Geoffrey Pendery)
Date: Tue, 30 Jun 2009 15:24:30 -0500
Subject: [c-nsp] Fun with interface counters.
In-Reply-To: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
References: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
Message-ID: <d6966e4b0906301324h31fdbbf8s9fe8fb6e68d6c472@mail.gmail.com>

Trunk port or access port?

One of the main places I've seen mismatching amounts of tx/rx is on
trunk ports, where either the "switchport trunk allowed vlan" doesn't
match on both sides, or in the case of the router interface, you only
have .1Q subinterfaces configured for certain VLANs, but other VLANs
are flooding across the link.


-Geoff


On Tue, Jun 30, 2009 at 4:59 PM, Drew Weaver<drew.weaver at thenap.com> wrote:
> I assume this is either a bug, or something else equally enjoyable.
>
> Today, I noticed that one of our switches was acting up, so I logged into it and did the usual show interfaces, sh proc cpu sort, etc etc.
>
> I noticed that the switch's uplink interface indicated that it was doing 700Mbps to the router it is connected to, the router indicated that it was only getting 200Mbps from the switch.
>
> So either there is a counter bug, or the switch was sending traffic that was being dropped by the router or dropped later by the switch (after it was counted?), or something else equally amusing?
>
> Does anyone have any thoughts on this/seen this before?
>
> Thanks!
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From denyipanyany at gmail.com  Tue Jun 30 15:44:35 2009
From: denyipanyany at gmail.com (Deny IP Any Any)
Date: Tue, 30 Jun 2009 15:44:35 -0400
Subject: [c-nsp] using a /29 mask on a /30 point-to-point
Message-ID: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>

I have a new ISP for one of our locations, and we currently have a
pair of Cisco PIXs in an active/standby config. The new ISP wants to
give us a /30 for this MetroE WAN link, with one of the IPs being used
for their equipment on their side of the circuit (aka, our default
gateway). This only gives us one IP address for our Primary's external
interface, and none left over for the secondary firewall's external
int (which it requires to be in the same subnet as Primary's ext int).
The ISP refuses to issue a /29 instead, due a corp policy stemming
from a mis-configured customer many years ago.

What are my options to get this to work? I really don't want to lose
my redundant firewalls, and adding a router (a single point of
failure) to just get redundant firewalls seems self-defeating.

Could I configure the subnet on my side of the WAN as a /29? My
broadcast address would be wrong, but since its basically a
point-to-point anyway, I shouldn't need broadcasts. I realize this is
semi-evil, and might get my Internet drivers license revoked, but what
would I break by doing this?



-- 
deny ip any any (4393649193 matches)

From panocisco77 at gmail.com  Tue Jun 30 16:36:48 2009
From: panocisco77 at gmail.com (Renelson Panosky)
Date: Tue, 30 Jun 2009 16:36:48 -0400
Subject: [c-nsp] ASA, FWSM
Message-ID: <16e2ac180906301336s776fb38bid3d187edb15a1a7a@mail.gmail.com>

By any chance does anybody here know the new terminology used for ASA and
FWSM?


Renelson

From gert at greenie.muc.de  Tue Jun 30 16:45:54 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Tue, 30 Jun 2009 22:45:54 +0200
Subject: [c-nsp] using a /29 mask on a /30 point-to-point
In-Reply-To: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>
References: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>
Message-ID: <20090630204554.GJ290@greenie.muc.de>

Hi,

On Tue, Jun 30, 2009 at 03:44:35PM -0400, Deny IP Any Any wrote:
> What are my options to get this to work? 

Change ISPs.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090630/a0f35fe0/attachment.bin>

From randy_94108 at yahoo.com  Tue Jun 30 17:01:58 2009
From: randy_94108 at yahoo.com (Randy)
Date: Tue, 30 Jun 2009 14:01:58 -0700 (PDT)
Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3
Message-ID: <230885.1548.qm@web80506.mail.mud.yahoo.com>



--- On Tue, 6/30/09, Felix Nkansah <felixnkansah at gmail.com> wrote:


From: Felix Nkansah <felixnkansah at gmail.com>
Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3
To: cisco-nsp at puck.nether.net
Date: Tuesday, June 30, 2009, 12:54 PM


Hello,

I am trying to download the Cisco ITP configuration guide for the *
12.4(11)SW3* software release.

The file can be seen in the ITP configuration guides list
http://www.cisco.com/en/US/products/sw/wirelssw/ps1862/products_feature_guides_list.html
.

Unfortunately, it keeps on prompting me for a CCO login. I have provided
several valid CCO credentials (some with service contract privileges), but
the file cannot be obtained.

I would appreciate if you could help me obtain this file.

I am migrating the configuration on some Cisco ITPs with 12.2(33)IRC, but it
appears Cisco has changed the command syntax altogether on the new platform.
The popular *cs7* commands are no longer recognized.

Your urgent assistance is deeply appreciated.
Felix
_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
?
?
...tried but I keep getting prompted for my cco login as well.
-Randy

From rwest at zyedge.com  Tue Jun 30 17:07:14 2009
From: rwest at zyedge.com (Ryan West)
Date: Tue, 30 Jun 2009 17:07:14 -0400
Subject: [c-nsp] using a /29 mask on a /30 point-to-point
In-Reply-To: <20090630204554.GJ290@greenie.muc.de>
References: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>
	<20090630204554.GJ290@greenie.muc.de>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5B56@zy-ex1.zyedge.local>

If switching ISPs is not a choice, although I agree it is a good one, then I need a little more information.

Are you running PIX's that are pre 7.x or 6.3(5)?

I have not tried this before on the 6.3(5) line, but you might be able to leave off this line:

failover ip address outside x.x.x.x

If you're using 7.x +, you can leave off the standby command.  As long as you're monitoring and accessing the device from the inside of your network, you can get by with the single address on the outside.  

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Gert Doering
Sent: Tuesday, June 30, 2009 4:46 PM
To: Deny IP Any Any
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] using a /29 mask on a /30 point-to-point

Hi,

On Tue, Jun 30, 2009 at 03:44:35PM -0400, Deny IP Any Any wrote:
> What are my options to get this to work? 

Change ISPs.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de

From Jeff.Wojciechowski at midlandpaper.com  Tue Jun 30 17:08:41 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Tue, 30 Jun 2009 16:08:41 -0500
Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3
In-Reply-To: <230885.1548.qm@web80506.mail.mud.yahoo.com>
References: <230885.1548.qm@web80506.mail.mud.yahoo.com>
Message-ID: <6B8401A83219DF499C34DEAEE9A599921256117FD1@XBOX.midlandpaper.com>

Same here...

-Jeff

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Randy
Sent: Tuesday, June 30, 2009 4:02 PM
To: cisco-nsp at puck.nether.net; Felix Nkansah
Subject: Re: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3



--- On Tue, 6/30/09, Felix Nkansah <felixnkansah at gmail.com> wrote:


From: Felix Nkansah <felixnkansah at gmail.com>
Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3
To: cisco-nsp at puck.nether.net
Date: Tuesday, June 30, 2009, 12:54 PM


Hello,

I am trying to download the Cisco ITP configuration guide for the *
12.4(11)SW3* software release.

The file can be seen in the ITP configuration guides list
http://www.cisco.com/en/US/products/sw/wirelssw/ps1862/products_feature_guides_list.html
.

Unfortunately, it keeps on prompting me for a CCO login. I have provided
several valid CCO credentials (some with service contract privileges), but
the file cannot be obtained.

I would appreciate if you could help me obtain this file.

I am migrating the configuration on some Cisco ITPs with 12.2(33)IRC, but it
appears Cisco has changed the command syntax altogether on the new platform.
The popular *cs7* commands are no longer recognized.

Your urgent assistance is deeply appreciated.
Felix
_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
?
?
...tried but I keep getting prompted for my cco login as well.
-Randy
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From avayner at cisco.com  Tue Jun 30 17:17:32 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Tue, 30 Jun 2009 23:17:32 +0200
Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3
In-Reply-To: <18dba4e50906301254i1ea16f25ne88858631fc47b1b@mail.gmail.com>
References: <18dba4e50906301253k6878883ueddda75ee052bb46@mail.gmail.com>
	<18dba4e50906301254i1ea16f25ne88858631fc47b1b@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7E6B57A@xmb-ams-331.emea.cisco.com>

At the location below there is a file called "Access to Cisco IP
Transfer Point (ITP) User Documentation and Release Notes", which
contains the following text:

"Cisco restricts the use and distribution of Cisco IP Transfer Point
(ITP) user documentation
and release notes. If you desire access and are a current or prospective
Cisco ITP customer
or a Cisco employee, please e-mail: itp-user-doc-request at cisco.com with
your Cisco.com user ID."


Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Felix Nkansah
Sent: Tuesday, June 30, 2009 22:54
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3

Hello,

I am trying to download the Cisco ITP configuration guide for the *
12.4(11)SW3* software release.

The file can be seen in the ITP configuration guides list
http://www.cisco.com/en/US/products/sw/wirelssw/ps1862/products_feature_
guides_list.html
.

Unfortunately, it keeps on prompting me for a CCO login. I have provided
several valid CCO credentials (some with service contract privileges),
but
the file cannot be obtained.

I would appreciate if you could help me obtain this file.

I am migrating the configuration on some Cisco ITPs with 12.2(33)IRC,
but it
appears Cisco has changed the command syntax altogether on the new
platform.
The popular *cs7* commands are no longer recognized.

Your urgent assistance is deeply appreciated.
Felix
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From pshem.k at gmail.com  Tue Jun 30 17:45:02 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Wed, 1 Jul 2009 09:45:02 +1200
Subject: [c-nsp] SNMP query to get status of a bgp peer in a vrf
Message-ID: <20fe625b0906301445xf1f7572jbb8b658bf87563d@mail.gmail.com>

Hi,

I've spent some time already trying to locate the mib that has the
status (and admin status) of bgp peer that is in a vrf. There is
cbgpPeerPrevState oid but it only seems to cover ipv4 peers (at least
when I query the ASRs we try to monitor). I can get the number of
prefixes learnt from a peer using cbgpPeerAcceptedPrefixes oid, but
not the status.

Any ideas if it's possible at all? And if so - which MIB contains that
information?

kind regads
Pshem

From avayner at cisco.com  Tue Jun 30 17:45:30 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Tue, 30 Jun 2009 23:45:30 +0200
Subject: [c-nsp] using a /29 mask on a /30 point-to-point
In-Reply-To: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>
References: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7E6B580@xmb-ams-331.emea.cisco.com>

I am not sure exactly how you are trying to configure the PIX, but I
guess you need to have an IP for each PIX, and then a VIP in the same
subnet used for real traffic forwarding.

You can tell your SP to use /30, so for example, they allocate
192.168.1.1 for their side, and 192.168.1.2 for your side.

You can configure on your devices a /28 subnet, allocating PIX #1
192.168.1.4/28, and PIX #2 192.168.1.5/28, then configure the VIP to be
192.168.1.2, as you SP is expecting you to do...

Set your default gateway to point at 192.168.1.1, and you are done.

The only caveat I see is that if for some reason you would need to reach
the other (public) IP's on the /28 you have "abused", you won't be able
to reach it...

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Deny IP Any Any
Sent: Tuesday, June 30, 2009 22:45
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] using a /29 mask on a /30 point-to-point

I have a new ISP for one of our locations, and we currently have a
pair of Cisco PIXs in an active/standby config. The new ISP wants to
give us a /30 for this MetroE WAN link, with one of the IPs being used
for their equipment on their side of the circuit (aka, our default
gateway). This only gives us one IP address for our Primary's external
interface, and none left over for the secondary firewall's external
int (which it requires to be in the same subnet as Primary's ext int).
The ISP refuses to issue a /29 instead, due a corp policy stemming
from a mis-configured customer many years ago.

What are my options to get this to work? I really don't want to lose
my redundant firewalls, and adding a router (a single point of
failure) to just get redundant firewalls seems self-defeating.

Could I configure the subnet on my side of the WAN as a /29? My
broadcast address would be wrong, but since its basically a
point-to-point anyway, I shouldn't need broadcasts. I realize this is
semi-evil, and might get my Internet drivers license revoked, but what
would I break by doing this?



-- 
deny ip any any (4393649193 matches)
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From shinejoseph at dodo.com.au  Tue Jun 30 17:47:30 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Wed, 1 Jul 2009 05:47:30 +0800
Subject: [c-nsp] Fw:  Data Centre Best pratices
Message-ID: <4562B9F74A3A452B8024F20CC22E078D@au.didata.local>

Would anyone like to have a stab at this????



> Hi,
>
> I am at the beginning of building a best practices document for data 
> centre design. I am wondering if anyone can poiunt me to the right 
> document that I can start with. I am looking at a Cisco centric solution. 
> Following documents are currently being looked at.
>
> http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DC_Infra2_5/DCI_SRND_2_5_book.html
> http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd804be7e2_ps2706_Products_White_Paper.html
>
> Any pointers and help would be highly appreciated.
>
> Thanks in advance.
> Shine
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/ 


From peter at rathlev.dk  Tue Jun 30 17:50:42 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Tue, 30 Jun 2009 23:50:42 +0200
Subject: [c-nsp] MPLS/BGP - want to add backup IPSEC VPN
In-Reply-To: <4A4A636E.4090301@chrisserafin.com>
References: <4A4A636E.4090301@chrisserafin.com>
Message-ID: <1246398642.6267.85.camel@localhost.localdomain>

On Tue, 2009-06-30 at 14:11 -0500, ChrisSerafin wrote:
> I have a few MPLS routers running BGP as the routing protocol.
> 
> I added a public IP'ed interface on a free ports on the same router, and 
> I'm able to get to it and use it for Internet bound traffic if I wish. I 
> would like to configure an IPSEC VPN to provide backup if the MPLS 
> provider fails. I'm having a hard time with Cisco TAC on this, mainly 
> them getting back to me.
> 
> dumb'ed down diagram is at: http://chrisserafin.com/design.jpg
> 
> I just want a basic split tunnel VPN in the event the primary MPLS/BGP 
> link goes down. I'm assuming let BGP take care of the MPLS side and add 
> static routes with a very high weight for the VPN failover?

And the VPN-link needs to carry MPLS traffic too? MPLSoGRE could be an
option, but support is very limited AFAIK.

Otherwise some extra equipment doing L2TPv3 might work. Performance
limitations might very well rule this out.

If MPLS isn't needed a simple GRE tunnel would of course do. You could
even create a new tunnel per VRF if you need reachability in several of
these. It scales bad concerning administration though.


Regards,
Peter



From jay at west.net  Tue Jun 30 17:55:37 2009
From: jay at west.net (Jay Hennigan)
Date: Tue, 30 Jun 2009 14:55:37 -0700
Subject: [c-nsp] Fun with interface counters.
In-Reply-To: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
References: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
Message-ID: <4A4A89D9.2040100@west.net>

Drew Weaver wrote:
> I assume this is either a bug, or something else equally enjoyable.
> 
> Today, I noticed that one of our switches was acting up, so I logged into it and did the usual show interfaces, sh proc cpu sort, etc etc.
> 
> I noticed that the switch's uplink interface indicated that it was doing 700Mbps to the router it is connected to, the router indicated that it was only getting 200Mbps from the switch.
> 
> So either there is a counter bug, or the switch was sending traffic that was being dropped by the router or dropped later by the switch (after it was counted?), or something else equally amusing?
> 
> Does anyone have any thoughts on this/seen this before?

The default interval for updating the counters is five minutes.  If the 
traffic is bursty it isn't unusual for the interface counters to 
disagree, sometimes substantially.  I believe that the load interval 
timer starts on boot or when counters are cleared on the interface so 
don't expect them to line up with NTP.

For faster response and better granularity you can use the 
"load-interval [seconds]" interface-level command.  Minimum supported 
value is 30 seconds.

--
Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net
Impulse Internet Service  -  http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV

From felixnkansah at gmail.com  Tue Jun 30 17:56:46 2009
From: felixnkansah at gmail.com (Felix Nkansah)
Date: Tue, 30 Jun 2009 21:56:46 +0000
Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7E6B57A@xmb-ams-331.emea.cisco.com>
References: <18dba4e50906301253k6878883ueddda75ee052bb46@mail.gmail.com>
	<18dba4e50906301254i1ea16f25ne88858631fc47b1b@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7E6B57A@xmb-ams-331.emea.cisco.com>
Message-ID: <18dba4e50906301456r2be4c2e6y261d98504af2ccb@mail.gmail.com>

Thanks Arie. I guess that explains it.
I would write to them immediately.

On Tue, Jun 30, 2009 at 9:17 PM, Arie Vayner (avayner) <avayner at cisco.com>wrote:

> At the location below there is a file called "Access to Cisco IP
> Transfer Point (ITP) User Documentation and Release Notes", which
> contains the following text:
>
> "Cisco restricts the use and distribution of Cisco IP Transfer Point
> (ITP) user documentation
> and release notes. If you desire access and are a current or prospective
> Cisco ITP customer
> or a Cisco employee, please e-mail: itp-user-doc-request at cisco.com with
> your Cisco.com user ID."
>
>
> Arie
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Felix Nkansah
> Sent: Tuesday, June 30, 2009 22:54
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] OT: Help on Cisco ITP Configuration Guide - 12.4(11)SW3
>
> Hello,
>
> I am trying to download the Cisco ITP configuration guide for the *
> 12.4(11)SW3* software release.
>
> The file can be seen in the ITP configuration guides list
> http://www.cisco.com/en/US/products/sw/wirelssw/ps1862/products_feature_
> guides_list.html
> .
>
> Unfortunately, it keeps on prompting me for a CCO login. I have provided
> several valid CCO credentials (some with service contract privileges),
> but
> the file cannot be obtained.
>
> I would appreciate if you could help me obtain this file.
>
> I am migrating the configuration on some Cisco ITPs with 12.2(33)IRC,
> but it
> appears Cisco has changed the command syntax altogether on the new
> platform.
> The popular *cs7* commands are no longer recognized.
>
> Your urgent assistance is deeply appreciated.
> Felix
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From chris at lavin-llc.com  Tue Jun 30 17:34:07 2009
From: chris at lavin-llc.com (chris at lavin-llc.com)
Date: Tue, 30 Jun 2009 17:34:07 -0400
Subject: [c-nsp] tacacs+ an nexus 5010
Message-ID: <59083.1246397647@lavin-llc.com>

On Tue Jun 30 13:47 , Arne Larsen / Region Nordjylland  sent:

>Hi all.
>
>Can someone help me out here.
>I'm having trouble getting tacacs+ to work an a nexus 5010.
>When ever I'm trying to access the nexus the debug prints.:  Skipping DEAD TACACS+ server 10.0.100.233
>I can ping and telnet to the tac-server from the nexus. Am I missiing somthing in my config ??
>
>my conf.
>
>vrf context management
>  ip name-server 10.2.4.63 10.2.4.64 10.2.4.65
>ip host aasnxu1 10.2.8.14
>ip host helios 10.0.100.233
>tacacs-server key 7 "xxxxxxxxx"
>tacacs-server host 10.0.100.233
>aaa group server tacacs+ REG_TAC
>    server 10.0.100.233
>    deadtime 5
>    use-vrf management
>aaa authentication login default group REG_TAC
>aaa authentication login error-enable
>tacacs-server directed-request
>vrf context management
>  ip route 0.0.0.0/0 10.2.8.1
>  
>
>
>aasnxu1# sh tacacs-server
>Global TACACS+ shared secret:********
>timeout value:5
>deadtime value:0
>total number of servers:1
>
>following TACACS+ servers are configured:
>        10.0.100.233:
>                available on port:49
>
>following TACACS+ server groups are configured:
>        group REG_TAC:
>                server 10.0.100.233 on port 49
>                deadtime is 5
>                vrf is management
>

Is there a chance you have a mismatch TACACS key? 

-chris


From randy_94108 at yahoo.com  Tue Jun 30 17:11:13 2009
From: randy_94108 at yahoo.com (Randy)
Date: Tue, 30 Jun 2009 14:11:13 -0700 (PDT)
Subject: [c-nsp] using a /29 mask on a /30 point-to-point
Message-ID: <110625.18853.qm@web80501.mail.mud.yahoo.com>



--- On Tue, 6/30/09, Deny IP Any Any <denyipanyany at gmail.com> wrote:


From: Deny IP Any Any <denyipanyany at gmail.com>
Subject: [c-nsp] using a /29 mask on a /30 point-to-point
To: cisco-nsp at puck.nether.net
Date: Tuesday, June 30, 2009, 12:44 PM


I have a new ISP for one of our locations, and we currently have a
pair of Cisco PIXs in an active/standby config. The new ISP wants to
give us a /30 for this MetroE WAN link, with one of the IPs being used
for their equipment on their side of the circuit (aka, our default
gateway). This only gives us one IP address for our Primary's external
interface, and none left over for the secondary firewall's external
int (which it requires to be in the same subnet as Primary's ext int).
The ISP refuses to issue a /29 instead, due a corp policy stemming
from a mis-configured customer many years ago.

What are my options to get this to work? I really don't want to lose
my redundant firewalls, and adding a router (a single point of
failure) to just get redundant firewalls seems self-defeating.

Could I configure the subnet on my side of the WAN as a /29? My
broadcast address would be wrong, but since its basically a
point-to-point anyway, I shouldn't need broadcasts. I realize this is
semi-evil, and might get my Internet drivers license revoked, but what
would I break by doing this?



-- 
deny ip any any (4393649193 matches)
_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

?
...well for one thing, in the event the active pix died, the standby would source outbound PAT'd traffic from an address that doesn't belong to you.
I agree with gert - change ISP's
-Randy

From mksmith at adhost.com  Tue Jun 30 18:16:25 2009
From: mksmith at adhost.com (Michael K. Smith - Adhost)
Date: Tue, 30 Jun 2009 15:16:25 -0700
Subject: [c-nsp] Fw:  Data Centre Best pratices
In-Reply-To: <4562B9F74A3A452B8024F20CC22E078D@au.didata.local>
References: <4562B9F74A3A452B8024F20CC22E078D@au.didata.local>
Message-ID: <17838240D9A5544AAA5FF95F8D5203160638B713@ad-exh01.adhost.lan>

Hello:

> > Hi,
> >
> > I am at the beginning of building a best practices document for data
> > centre design. I am wondering if anyone can poiunt me to the right
> > document that I can start with. I am looking at a Cisco centric
> solution.
> > Following documents are currently being looked at.
> >
> >
Not Cisco-specific, but I would check out The Uptime Institute.  They
have a wealth of information about Data Center design.
http://www.uptimeinstitute.org

Regards,

Mike

From leonardo.souza at nec.com.br  Tue Jun 30 17:44:31 2009
From: leonardo.souza at nec.com.br (Leonardo Gama Souza)
Date: Tue, 30 Jun 2009 18:44:31 -0300
Subject: [c-nsp] RES:  Fun with interface counters.
In-Reply-To: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
References: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
Message-ID: <9E07F8717FE8BC4FBAE6860F61EA6C1D026A094B@spsrvmail03.nec.br>

Are both interfaces configured with 'load-interval 30'?
Furthermore that could be due to lack of 64-bit interface counter support on the router.

-----Mensagem original-----
De: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] Em nome de Drew Weaver
Enviada em: ter?a-feira, 30 de junho de 2009 18:59
Para: 'cisco-nsp at puck.nether.net'
Assunto: [c-nsp] Fun with interface counters.

I assume this is either a bug, or something else equally enjoyable.

Today, I noticed that one of our switches was acting up, so I logged into it and did the usual show interfaces, sh proc cpu sort, etc etc.

I noticed that the switch's uplink interface indicated that it was doing 700Mbps to the router it is connected to, the router indicated that it was only getting 200Mbps from the switch.

So either there is a counter bug, or the switch was sending traffic that was being dropped by the router or dropped later by the switch (after it was counted?), or something else equally amusing?

Does anyone have any thoughts on this/seen this before?

Thanks!
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From cordmacleod at gmail.com  Tue Jun 30 18:19:06 2009
From: cordmacleod at gmail.com (Cord MacLeod)
Date: Tue, 30 Jun 2009 15:19:06 -0700
Subject: [c-nsp] Fw:  Data Centre Best pratices
In-Reply-To: <4562B9F74A3A452B8024F20CC22E078D@au.didata.local>
References: <4562B9F74A3A452B8024F20CC22E078D@au.didata.local>
Message-ID: <8387BFC7-F06F-4337-B449-F42968BEF0EF@gmail.com>

Data center best practices?  Are you a content house?  Are you an  
ISP?  Are you a colo provider?  Given that there are multiple best  
practices for those scenarios alone not to mention if you are a  
content house your network is built to support your application...  
that's one hell of a long paper you are writing.  Don't forget to add  
the EU/US differences...  Why not just publish a book?

Second, and not to be rude, but if you don't know where to find  
necessary starting points for a document of this nature, are you sure  
you are the best person to be writing it?

On Jun 30, 2009, at 2:47 PM, Shine Joseph wrote:

> Would anyone like to have a stab at this????
>
>
>
>> Hi,
>>
>> I am at the beginning of building a best practices document for  
>> data centre design. I am wondering if anyone can poiunt me to the  
>> right document that I can start with. I am looking at a Cisco  
>> centric solution. Following documents are currently being looked at.
>>
>> http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DC_Infra2_5/DCI_SRND_2_5_book.html
>> http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd804be7e2_ps2706_Products_White_Paper.html
>>
>> Any pointers and help would be highly appreciated.
>>
>> Thanks in advance.
>> Shine
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From felixnkansah at gmail.com  Tue Jun 30 18:56:58 2009
From: felixnkansah at gmail.com (Felix Nkansah)
Date: Tue, 30 Jun 2009 22:56:58 +0000
Subject: [c-nsp] OT: Best Online Antispam Service
In-Reply-To: <18dba4e50906301555j1b0d8c85j68259fe320f024c3@mail.gmail.com>
References: <18dba4e50906301555j1b0d8c85j68259fe320f024c3@mail.gmail.com>
Message-ID: <18dba4e50906301556o5c9d66b1p6737642e36a45e4c@mail.gmail.com>

Hi Team,
I am interested in subscribing to a GOOD online email filtering service,
through which all emails destined to an enterprise domain transit, are
scanned and filtered for spam and viruses, before legitimate mails relayed
to the destination mail server.

As a bonus, the service should also store emails for some time if the
destination mail server is down.

Much as IronPort and Barracuda appliances do a good antispam job, they are
typically placed onsite for which reason the network bandwidth still gets
chocked with arriving spam.

Please share your experienced recommendations with me on this one. It's
better for me than following google search.

Felix

From jlewis at lewis.org  Tue Jun 30 18:57:05 2009
From: jlewis at lewis.org (Jon Lewis)
Date: Tue, 30 Jun 2009 18:57:05 -0400 (EDT)
Subject: [c-nsp] RES:  Fun with interface counters.
In-Reply-To: <9E07F8717FE8BC4FBAE6860F61EA6C1D026A094B@spsrvmail03.nec.br>
References: <F3318834F1F89D46857972DD4B411D7011C3D3A4@EXCHANGE.thenap.com>
	<9E07F8717FE8BC4FBAE6860F61EA6C1D026A094B@spsrvmail03.nec.br>
Message-ID: <Pine.LNX.4.61.0906301855300.6312@soloth.lewis.org>

On Tue, 30 Jun 2009, Leonardo Gama Souza wrote:

> Are both interfaces configured with 'load-interval 30'?

In my case yes.

> Furthermore that could be due to lack of 64-bit interface counter 
> support on the router.

I've seen that via SNMP, but never noticed the CLI interface rate counters 
having such issues.

----------------------------------------------------------------------
  Jon Lewis                   |  I route
  Senior Network Engineer     |  therefore you are
  Atlantic Net                |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

From randy_94108 at yahoo.com  Tue Jun 30 19:40:16 2009
From: randy_94108 at yahoo.com (Randy)
Date: Tue, 30 Jun 2009 16:40:16 -0700 (PDT)
Subject: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
Message-ID: <217968.38858.qm@web80504.mail.mud.yahoo.com>

Hi Matt,
Interesting, I was unaware that conditional adv didn't support route-maps with the continue-clause.
?
I don't have boxes handy to try it but what if you were to have two sequences in you non-exist route map -
?
route-map?non-exist permit 5
?match ip-address prefix-list ?A
?
route-map?non-exist permit 10
?match ip-address prefix-list??B
?
(the advertise route map still has only one seq.)
during the non-exist eval process, if there is a hit against seq 5, you break out of the route-map. Conversely if there isn't a hit against 5, 10 would be evaluated? - if a hit break out, if no hits, still break out.
?
-Randy


--- On Mon, 6/29/09, Matt Carter <matt at iseek.com.au> wrote:


From: Matt Carter <matt at iseek.com.au>
Subject: RE: [c-nsp] Conditional BGP w/ multiple non-exist prefixes - bug?
To: "'Randy'" <randy_94108 at yahoo.com>, "Cisco Mailing list" <cisco-nsp at puck.nether.net>
Date: Monday, June 29, 2009, 9:45 PM








Hi Randy,
?
Thank you for your speedy reply :) It was my first choice to use the "continue" clause and regular fall-through but despite the fact there is nothing listed under the "Restrictions for BGP Route-Map continue", it appears unsupported by the Conditional BGP feature. Can configure the route-map just fine, but when Conditional BGP comes along you will get
?
% "conditional-nonexist" used as BGP condition route-map, continue match not supported
?
:(
?
I have worked out that basically if I try to "OR" the prefixes in a route-map sub block, only the first prefix list will be evaluated
?
ie if we have prefix list A before prefix list B
route-map FOO
?match ip address prefix A B
?
and then use that as a non-exist map for conditional BGP;
- removal of A from BGP table will trigger state change
- removal of B from BGP table will not do anything
?
if you reverse the positioning in the route-map sub block such that B is before A
route-map FOO
?match ip address prefix B A
?
i then get reversed behaviour for conditional BGP
- removal of A from BGP table will do nothing
- removal of B from BGP table will trigger state change
?
which is an aweful lot like the behaviour i was getting when i had two completely separate conditional BGP setups and only the first one that is entered appears to work, reversing the order they are entered reverses which one works and which one doesnt.
?
strange.
?
?
> 
> a version of IOS that supports route-maps with the *continue* clause will
> more that likely work for you.
> see BGP Route-map Continue
> Regards,
> ./Randy
> 
> 
> ...I?haven't tried this but a regular fall-through route-map should be
> able to accomplish this as well.
> 
> Your non-exist routemap( for the corresponding advertise-map) ?will have
> two sequences.
> 
> eg:
> 
> route-map non-exist? 5
> match ip-addr prefix-list a
> match as-path?1
> 
> route-map non-exist 10
> match ip addr prefix-list? b
> match as-path 2
> 
> ip prefix-list a permit 172.27.100.0/22
> ip prefix-list b permit? 172.28.0.0/23
> 
> ip as-path?access-list?1 permit? ^65420
> ip as-path access-list 2 permit _65534$
> 
> 
> (addresses and ASN's used in example are *private*)
> 
> Regards,
> ./Randy

From jared at corp.sonic.net  Tue Jun 30 19:56:44 2009
From: jared at corp.sonic.net (Jared Gillis)
Date: Tue, 30 Jun 2009 16:56:44 -0700
Subject: [c-nsp] Question about Cisco PIX VPN
Message-ID: <4A4AA63C.7000609@corp.sonic.net>

Hi all,

I'm configuring a PIX 501 running v6.3.5 code to terminate VPN connections from
remote users. I've got the config intact, but need to learn how the PIX handles
these connections internally.
Here's the relevant config:

access-list nonatvpn permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
ip pool vpnswclient 192.168.1.2-192.168.1.254
nat (inside) 0 access-list nonatvpn

and I've got vpngroups defined per-user to pull from the vpnswclient pool and
split-tunnel based on the nonatvpn acl.

So my "inside" network is 192.168.0.0/24, and the vpnclients will get addressed
into 192.168.1.0/24 (correct?), and there will be no NAT on communication
between them. My question is, are my vpn clients in the same broadcast domain as
my "inside" interface, or will they be required to unicast to 192.168.0.x
addresses? Is there a way to influence how they can communicate?

I've been looking all over Cisco's website and can find plenty of configuration
examples, but nothing explaining how communication between the inside and vpn
clients is handled.

-- 
Jared Gillis - jared at corp.sonic.net       Sonic.net, Inc.
Network Operations                        2260 Apollo Way
707.522.1000 (Voice)                      Santa Rosa, CA 95407
707.547.3400 (Support)                    http://www.sonic.net/

From peter at rathlev.dk  Tue Jun 30 20:25:16 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Wed, 01 Jul 2009 02:25:16 +0200
Subject: [c-nsp] using a /29 mask on a /30 point-to-point
In-Reply-To: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>
References: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>
Message-ID: <1246407916.7941.10.camel@localhost.localdomain>

On Tue, 2009-06-30 at 15:44 -0400, Deny IP Any Any wrote:
> Could I configure the subnet on my side of the WAN as a /29? My
> broadcast address would be wrong, but since its basically a
> point-to-point anyway, I shouldn't need broadcasts. I realize this is
> semi-evil, and might get my Internet drivers license revoked, but what
> would I break by doing this?

To clear up: The PIX uses only two addresses, one for the active unit
and one for the standby unit. The address for the standby unit is only
used to reach the standby when the primary is still active/live. Upon
failover the standby unit becomes active and takes over the IP adress of
the former active. Every NAT/PAT is carried over statefully between the
pair. A failover is pratically "invisible" for neighbors.

If you couldn't change ISP and absolutely _had_ to do something that
would almost certainly make your successor hate you, then you _could_
configure the PIX with a /29 mask where the addressing is thus:

- PIX primary address is "your" side of the ISP assigned /30
- PIX secondary address is one of the broadcast addresses from the ISP
assigned /30 (the one that is a valid host address in the /29)
- Insert a static /30 route for the other part of the /29.

Example, if the ISP assigned 10.0.0.0/30 for your link and took 10.0.0.1
for themselves (in v7+ format):

! *** pix ***
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 10.0.0.2 255.255.255.248 standby 10.0.0.3
!
route outside 10.0.0.4 255.255.255.252 10.0.0.1
!

Please just change ISP. :-)

Regards,
Peter



From peter at rathlev.dk  Tue Jun 30 20:51:46 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Wed, 01 Jul 2009 02:51:46 +0200
Subject: [c-nsp] Question about Cisco PIX VPN
In-Reply-To: <4A4AA63C.7000609@corp.sonic.net>
References: <4A4AA63C.7000609@corp.sonic.net>
Message-ID: <1246409506.7941.34.camel@localhost.localdomain>

On Tue, 2009-06-30 at 16:56 -0700, Jared Gillis wrote:
> So my "inside" network is 192.168.0.0/24, and the vpnclients will get
> addressed into 192.168.1.0/24 (correct?), and there will be no NAT on
> communication between them.

Correct, your "nat (inside) 0 acccess-list nonatvpn" 

> My question is, are my vpn clients in the same broadcast domain as
> my "inside" interface, or will they be required to unicast to
> 192.168.0.x addresses? Is there a way to influence how they can
> communicate?

No, they're not in the same broadcast domain. The PIX sort of
"terminates" the clients on the "outside" interface. Ex: assigned IP
addresses must be routed to the outside.

With the "sysopt connection permit-ipsec" you implicitly allow all
traffic from VPN users. Alternatively you open up your "outside" ACL to
permit relevant traffic. PIX/ASA v7 and newer have the "vpn-filter"
feature for fine grained control of what VPN users can and cannot reach.

> I've been looking all over Cisco's website and can find plenty of
> configuration examples, but nothing explaining how communication
> between the inside and vpn clients is handled.

"Product support" lists some configuration examples that might be of
interest:

http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html


Regards,
Peter



From rwest at zyedge.com  Tue Jun 30 20:53:08 2009
From: rwest at zyedge.com (Ryan West)
Date: Tue, 30 Jun 2009 20:53:08 -0400
Subject: [c-nsp] using a /29 mask on a /30 point-to-point
In-Reply-To: <1246407916.7941.10.camel@localhost.localdomain>
References: <c979a8a40906301244i17c81955v9693b2f501af6f76@mail.gmail.com>
	<1246407916.7941.10.camel@localhost.localdomain>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5B6B@zy-ex1.zyedge.local>

Using Peter's example below, just leave off the 10.0.0.3 standby address.  The failover and state information will still be passed between the firewalls and you can get by with a /30.  If for some reason you're running 6.3(5), go to Kingston.com and buy yourself 2 sets of (2) 64MB CL2 100Mhz low profile DRAM and upgrade to 7.x.  6.3 code is a disaster to troubleshoot.

-ryan


Example, if the ISP assigned 10.0.0.0/30 for your link and took 10.0.0.1
for themselves (in v7+ format):

! *** pix ***
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 10.0.0.2 255.255.255.248 standby 10.0.0.3
!
route outside 10.0.0.4 255.255.255.252 10.0.0.1
!

Please just change ISP. :-)

Regards,
Peter


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From streiner at cluebyfour.org  Tue Jun 30 21:23:43 2009
From: streiner at cluebyfour.org (Justin M. Streiner)
Date: Tue, 30 Jun 2009 21:23:43 -0400 (EDT)
Subject: [c-nsp] ASA, FWSM
In-Reply-To: <16e2ac180906301336s776fb38bid3d187edb15a1a7a@mail.gmail.com>
References: <16e2ac180906301336s776fb38bid3d187edb15a1a7a@mail.gmail.com>
Message-ID: <Pine.LNX.4.64.0906302122580.16955@whammy.cluebyfour.org>

On Tue, 30 Jun 2009, Renelson Panosky wrote:

> By any chance does anybody here know the new terminology used for ASA and
> FWSM?

Could you clarify what you mean by "new terminology"?

Thanks
jms

From fwissue at gmail.com  Tue Jun 30 22:30:40 2009
From: fwissue at gmail.com (Michael Lee)
Date: Tue, 30 Jun 2009 19:30:40 -0700
Subject: [c-nsp] ASA, FWSM
In-Reply-To: <Pine.LNX.4.64.0906302122580.16955@whammy.cluebyfour.org>
References: <16e2ac180906301336s776fb38bid3d187edb15a1a7a@mail.gmail.com>
	<Pine.LNX.4.64.0906302122580.16955@whammy.cluebyfour.org>
Message-ID: <AB8FC3C2-6E8F-4657-B407-1149C500AFC7@gmail.com>

I don't think it is virtual context? There are some limiltations

Regards

-mike

On Jun 30, 2009, at 6:23 PM, "Justin M. Streiner" <streiner at cluebyfour.org 
 > wrote:

> On Tue, 30 Jun 2009, Renelson Panosky wrote:
>
>> By any chance does anybody here know the new terminology used for  
>> ASA and
>> FWSM?
>
> Could you clarify what you mean by "new terminology"?
>
> Thanks
> jms
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/