From zhqasmi at cyber.net.pk  Mon Jun  1 00:34:11 2009
From: zhqasmi at cyber.net.pk (Amjad Ul Hasnain Qasmi)
Date: Mon, 01 Jun 2009 10:34:11 +0600
Subject: [c-nsp] strange behavior over MPLS network -
 remote	desktopwon't work
In-Reply-To: <db092ca60905311942j78008f3ew7f39db9a578fa6fc@mail.gmail.com>
References: <db092ca60905311301p13e05985q2d3442be7aba6fc@mail.gmail.com>
	<4A22E68F.4010605@wbsconnect.com>
	<db092ca60905311404j2ae21a00ve1017a4060285d@mail.gmail.com>
	<alpine.DEB.1.10.0905312320090.21799@locus>
	<db092ca60905311654u11afa2ddncfdcc0f5b77f43f4@mail.gmail.com>
	<E5C9EC8A665E4CFFAA1BFB99DE34E678@oneunified.local>
	<db092ca60905311942j78008f3ew7f39db9a578fa6fc@mail.gmail.com>
Message-ID: <004c01c9e272$36ff9b40$a4fed1c0$@net.pk>

If your PE-PE is not a trunk port, which is normaly the case, and you want
to successfully transport a payload of 1500 bytes, you should consider
setting IP MTU as 1500 + 20 = 1520 bytes. mostly two labeled are stacked for
vpn traffic but there are cases when 3 label may also be used so you should
consider 12 bytes for mpls header ( 4bytes each), it will make the mpls mtu
as 1532. Your physical interface mtu should be equal or larger than 1532 +
18(Ethernet header) bytes.
Try this out and share the results.

/AHQ

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Chris Hale
Sent: Monday, June 01, 2009 8:42 AM
To: cisco-nsp
Subject: Re: [c-nsp] strange behavior over MPLS network - remote
desktopwon't work

On Sun, May 31, 2009 at 9:04 PM, Ray Burkholder <ray at oneunified.net> wrote:

> >
> >
> > What does that indicate to you?  1472 + VLAN tag plus MPLS < 1500?
> >
>
> When provisioning MPLS circuits, one has to be careful.  Basic MPLS will
> attach one or more 4 byte labels on to each packet.  Psuedowires attach
> additional bytes onto each packet.  WAN circuits running MPLS need to be
> provisioned such that the interface MTU is set to 1500 PLUS any pseudowire
> overhead plus any MPLS label overhead.  If you try to run MPLS stuff
across
> a standard 1500 MTU WAN interface, you get the problems you are now
> encountering: fragmentation, drops, corruption, ...  Some protocols can
> handle it, but I've read that RDP sets the no-fragment bit, thus dropping
> the packets.
>
> STM-1 and DS3 circuits run by default at 4470 bytes so easily accommodate
> MPLS overhead.  Ethernet circuits are at 1500, and you have to work with
> upstream vendors to ensure their networks can handle MTU's greater than
> 1500.  Cisco switches need a reboot after setting a system mtu setting.
> Routers can change interface mtu settings on the fly.
>
> You could try setting your MTU setting on your pc to 1300 and see if
things
> work.  If they do, then you know you have an upstream mtu problem.
>

I have an available DS3 interface on each of the POP H routers.  Maybe I
will set that up tomorrow and push the MPLS traffic across this interconnect
to see if that helps.  Maybe the mpls mtu setting on the PA-FE-TX interfaces
just isn't working.  I have also forced the GigE MPLS MTU settings on the
backbone link between the POPs to 1538 as they were at the default of 1500
before.

Thanks again,
Chris
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From tom at snnap.net  Mon Jun  1 00:57:16 2009
From: tom at snnap.net (Tom Storey)
Date: Mon, 1 Jun 2009 13:57:16 +0900 (EIT)
Subject: [c-nsp] Ingress policing on a 3560
Message-ID: <61575.172.25.144.4.1243832236.squirrel@imap.snnap.net>

Thanks to those who have responded so far.

To answer a couple of so far common questions:

"mls qos" is enabled:

sw2#sh mls qos
QoS is enabled
QoS ip packet dscp rewrite is enabled

And I dont appear to be counting any hits against my MAC ACL, which may
explain part of the problem:

sw2#sh access-lists mac-any-any

Extended MAC access list mac-any-any
    permit any any 0x0 0xFFFF

I tried applying the ACL inbound on the interface to see if it would count
any hits, and there are zero hits on there too. I also modified the ACL
rule to what you see above based on an example I found.

So something is definitely up there, considering I am pumping 12000+ pps
through it each way with iperf. :-)

Back to the drawing board.

Cheers,
Tom

> Hi all.
>
> What I'm trying to do is police ingress on a port, using a MAC ACL to
> match traffic to police (just a "permit any any" to match all traffic).
>
> But what I'm getting is that the switch doesnt appear to be matching any
> traffic at all.
>
> sw2#sh int gi0/14 | inc put rate
>   30 second input rate 20449000 bits/sec, 1688 packets/sec
>   30 second output rate 2620000 bits/sec, 1690 packets/sec
> sw2#sh policy-map int gi0/14
>  GigabitEthernet0/14
>
>   Service-policy input: police-10mbit-in
>
>     Class-map: mac-any-any (match-any)
>       0 packets, 0 bytes
>       30 second offered rate 0 bps, drop rate 0 bps
>       Match: access-group name mac-any-any
>         0 packets, 0 bytes
>         30 second rate 0 bps
>
>     Class-map: class-default (match-any)
>       0 packets, 0 bytes
>       30 second offered rate 0 bps, drop rate 0 bps
>       Match: any
>         0 packets, 0 bytes
>         30 second rate 0 bps
>
> Does anyone have any pointers as to what I'm doing wrong? Below is my
> config.
>
> mac access-list extended mac-any-any
>  permit any any
> !
> class-map match-any mac-any-any
>  match access-group name mac-any-any
> !
> policy-map police-10mbit-in
>  class mac-any-any
>   police 10000000 1000000 exceed-action drop
> !
> interface GigabitEthernet0/14
>  service-policy input police-10mbit-in
> !
>
> Ive also tried with just class-default, but got the same result.
>
> I am currently using the "vlan" SDM profile, if that makes any difference.
>
> Cheers,
> Tom
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From achatz at forthnet.gr  Mon Jun  1 03:48:42 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Mon, 01 Jun 2009 10:48:42 +0300
Subject: [c-nsp] Ingress policing on a 3560
In-Reply-To: <61575.172.25.144.4.1243832236.squirrel@imap.snnap.net>
References: <61575.172.25.144.4.1243832236.squirrel@imap.snnap.net>
Message-ID: <4A2387DA.7030108@forthnet.gr>

Tom,

If i remember right, in 3560/3750 MAC ACLs are used only for classification of non ip 
traffic. So if you're testing with ip (like iperf) you won't be able to match it.

Also, use "sh mls qos int gi0/14 stat" to check for drops due to policing.

-- 
Tassos

Tom Storey wrote on 01/06/2009 07:57:
> Thanks to those who have responded so far.
> 
> To answer a couple of so far common questions:
> 
> "mls qos" is enabled:
> 
> sw2#sh mls qos
> QoS is enabled
> QoS ip packet dscp rewrite is enabled
> 
> And I dont appear to be counting any hits against my MAC ACL, which may
> explain part of the problem:
> 
> sw2#sh access-lists mac-any-any
> 
> Extended MAC access list mac-any-any
>     permit any any 0x0 0xFFFF
> 
> I tried applying the ACL inbound on the interface to see if it would count
> any hits, and there are zero hits on there too. I also modified the ACL
> rule to what you see above based on an example I found.
> 
> So something is definitely up there, considering I am pumping 12000+ pps
> through it each way with iperf. :-)
> 
> Back to the drawing board.
> 
> Cheers,
> Tom
> 
>> Hi all.
>>
>> What I'm trying to do is police ingress on a port, using a MAC ACL to
>> match traffic to police (just a "permit any any" to match all traffic).
>>
>> But what I'm getting is that the switch doesnt appear to be matching any
>> traffic at all.
>>
>> sw2#sh int gi0/14 | inc put rate
>>   30 second input rate 20449000 bits/sec, 1688 packets/sec
>>   30 second output rate 2620000 bits/sec, 1690 packets/sec
>> sw2#sh policy-map int gi0/14
>>  GigabitEthernet0/14
>>
>>   Service-policy input: police-10mbit-in
>>
>>     Class-map: mac-any-any (match-any)
>>       0 packets, 0 bytes
>>       30 second offered rate 0 bps, drop rate 0 bps
>>       Match: access-group name mac-any-any
>>         0 packets, 0 bytes
>>         30 second rate 0 bps
>>
>>     Class-map: class-default (match-any)
>>       0 packets, 0 bytes
>>       30 second offered rate 0 bps, drop rate 0 bps
>>       Match: any
>>         0 packets, 0 bytes
>>         30 second rate 0 bps
>>
>> Does anyone have any pointers as to what I'm doing wrong? Below is my
>> config.
>>
>> mac access-list extended mac-any-any
>>  permit any any
>> !
>> class-map match-any mac-any-any
>>  match access-group name mac-any-any
>> !
>> policy-map police-10mbit-in
>>  class mac-any-any
>>   police 10000000 1000000 exceed-action drop
>> !
>> interface GigabitEthernet0/14
>>  service-policy input police-10mbit-in
>> !
>>
>> Ive also tried with just class-default, but got the same result.
>>
>> I am currently using the "vlan" SDM profile, if that makes any difference.
>>
>> Cheers,
>> Tom
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 

From peter at rathlev.dk  Mon Jun  1 06:35:50 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 01 Jun 2009 12:35:50 +0200
Subject: [c-nsp] strange behavior over MPLS network - remote desktop
 won't work
In-Reply-To: <db092ca60905311654u11afa2ddncfdcc0f5b77f43f4@mail.gmail.com>
References: <db092ca60905311301p13e05985q2d3442be7aba6fc@mail.gmail.com>
	<4A22E68F.4010605@wbsconnect.com>
	<db092ca60905311404j2ae21a00ve1017a4060285d@mail.gmail.com>
	<alpine.DEB.1.10.0905312320090.21799@locus>
	<db092ca60905311654u11afa2ddncfdcc0f5b77f43f4@mail.gmail.com>
Message-ID: <1243852550.3428.2.camel@localhost.localdomain>

On Sun, 2009-05-31 at 19:54 -0400, Chris Hale wrote:
> ping do-not-fragment detail size 1473 192.168.3.254
> PING 192.168.3.254 (192.168.3.254): 1473 data bytes
> ping: sendto: Message too long
...
> What does that indicate to you?  1472 + VLAN tag plus MPLS < 1500?

To me this indicates that the Juniper doesn't wan't to send the packet.
As others mentioned 1472 is the largest ICMP payload to expect on a
regularr 1500 byte MTU link.

The "sendto: Message too long" is what I would assume if the IP stack of
the sending host refuses to accept the packet. So the packet never
leaves the CE.

Regards,
Peter



From doraemonheng at yahoo.com.sg  Mon Jun  1 06:17:38 2009
From: doraemonheng at yahoo.com.sg (Doraemon Heng)
Date: Mon, 1 Jun 2009 18:17:38 +0800 (SGT)
Subject: [c-nsp] 4x E1 MLPPP max throughput?
Message-ID: <701771.79941.qm@web76013.mail.sg1.yahoo.com>

Dear All,

We are experiencing packet loss when ping from PE1 to CE2 when the traffic above 7.2Mbps.
CE1 - PE1 ? PE2 ? CE2 
Type of point-to-point between PE2 and CE2 is 4x E1 multilink (bandwidth 8192Kbit).

Note*** (PE1 to PE2 no packet loss)

We do see the Total output drops keep increasing even the traffic is low. Is it a normal behavior or does this caused the packet loss when PE1 ping to CE2?

Also, what is the maximum throughput can the 4x E1 multilink handle without any packet loss?

PE2#show interfaces multilink 10
Multilink10 is up, line protocol is up
  Hardware is multilink group interface
  Internet address is 10.19.60..9/30
  MTU 1500 bytes, BW 8192 Kbit, DLY 100000 usec,
     reliability 255/255, txload 180/255, rxload 107/255
  Encapsulation PPP, LCP Open, multilink Open
  Open: IPCP, loopback not set
  Keepalive set (10 sec)
  DTR is pulsed for 2 seconds on reset
  Last input 01:17:03, output never, output hang never
  Last clearing of "show interface" counters 05:24:17
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 31000
  Queueing strategy: fifo
  Output queue: 31/300 (size/max)
  30 second input rate 3440000 bits/sec, 1226 packets/sec
  30 second output rate 5802000 bits/sec, 1212 packets/sec
     22649490 packets input, 598130070 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     22368689 packets output, 2467487460 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out
     0 carrier transitions


Thanks & Regards,



      New Email addresses available on Yahoo!
Get the Email name you&#39;ve always wanted on the new @ymail and @rocketmail. 
Hurry before someone else does!
http://mail.promotions.yahoo.com/newdomains/sg/

From dloughlin at otc.fsu.edu  Mon Jun  1 10:12:56 2009
From: dloughlin at otc.fsu.edu (Loughlin, Daniel J.)
Date: Mon, 1 Jun 2009 10:12:56 -0400
Subject: [c-nsp] Ingress policing on a 3560
In-Reply-To: <4A2387DA.7030108@forthnet.gr>
References: <61575.172.25.144.4.1243832236.squirrel@imap.snnap.net>
	<4A2387DA.7030108@forthnet.gr>
Message-ID: <0B5DA805D198954F8E6160D2AB3B43A595CE24@fsu-exch-11.fsu.edu>

Yeah, that's correct. Mac acls only match non-IP traffic. 

-Danny

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Tassos
Chatzithomaoglou
Sent: Monday, June 01, 2009 3:49 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Ingress policing on a 3560

Tom,

If i remember right, in 3560/3750 MAC ACLs are used only for
classification of non ip 
traffic. So if you're testing with ip (like iperf) you won't be able to
match it.

Also, use "sh mls qos int gi0/14 stat" to check for drops due to
policing.

-- 
Tassos

Tom Storey wrote on 01/06/2009 07:57:
> Thanks to those who have responded so far.
> 
> To answer a couple of so far common questions:
> 
> "mls qos" is enabled:
> 
> sw2#sh mls qos
> QoS is enabled
> QoS ip packet dscp rewrite is enabled
> 
> And I dont appear to be counting any hits against my MAC ACL, which
may
> explain part of the problem:
> 
> sw2#sh access-lists mac-any-any
> 
> Extended MAC access list mac-any-any
>     permit any any 0x0 0xFFFF
> 
> I tried applying the ACL inbound on the interface to see if it would
count
> any hits, and there are zero hits on there too. I also modified the
ACL
> rule to what you see above based on an example I found.
> 
> So something is definitely up there, considering I am pumping 12000+
pps
> through it each way with iperf. :-)
> 
> Back to the drawing board.
> 
> Cheers,
> Tom
> 
>> Hi all.
>>
>> What I'm trying to do is police ingress on a port, using a MAC ACL to
>> match traffic to police (just a "permit any any" to match all
traffic).
>>
>> But what I'm getting is that the switch doesnt appear to be matching
any
>> traffic at all.
>>
>> sw2#sh int gi0/14 | inc put rate
>>   30 second input rate 20449000 bits/sec, 1688 packets/sec
>>   30 second output rate 2620000 bits/sec, 1690 packets/sec
>> sw2#sh policy-map int gi0/14
>>  GigabitEthernet0/14
>>
>>   Service-policy input: police-10mbit-in
>>
>>     Class-map: mac-any-any (match-any)
>>       0 packets, 0 bytes
>>       30 second offered rate 0 bps, drop rate 0 bps
>>       Match: access-group name mac-any-any
>>         0 packets, 0 bytes
>>         30 second rate 0 bps
>>
>>     Class-map: class-default (match-any)
>>       0 packets, 0 bytes
>>       30 second offered rate 0 bps, drop rate 0 bps
>>       Match: any
>>         0 packets, 0 bytes
>>         30 second rate 0 bps
>>
>> Does anyone have any pointers as to what I'm doing wrong? Below is my
>> config.
>>
>> mac access-list extended mac-any-any
>>  permit any any
>> !
>> class-map match-any mac-any-any
>>  match access-group name mac-any-any
>> !
>> policy-map police-10mbit-in
>>  class mac-any-any
>>   police 10000000 1000000 exceed-action drop
>> !
>> interface GigabitEthernet0/14
>>  service-policy input police-10mbit-in
>> !
>>
>> Ive also tried with just class-default, but got the same result.
>>
>> I am currently using the "vlan" SDM profile, if that makes any
difference.
>>
>> Cheers,
>> Tom
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From ying-xiang at 163.com  Mon Jun  1 10:29:46 2009
From: ying-xiang at 163.com (ying-xiang)
Date: Mon, 1 Jun 2009 22:29:46 +0800 (CST)
Subject: [c-nsp] even Eompls "vc" is up but can not work
Message-ID: <30733322.938901243866586761.JavaMail.coremail@bj163app25.163.com>

 hi
the vc still is up,but the eompls does't work suddenly.
i got the show message on the cli
 

Local interface: VFI SDH-NEC VFI up

  MPLS VC type is VFI, interworking type is Ethernet

  Destination address: 192.168.4.16, VC ID: 807, VC status: up

    Output interface: Te2/0/0, imposed label stack {185 188}

    Preferred path: not configured

    Default path: active

    Next hop: 192.168.128.14

  Create time: 19w4d, last status change time: 17:31:07

  Signaling protocol: LDP, peer 192.168.4.16:0 up

    Targeted Hello: 192.168.0.1(LDP Id) -> 192.168.4.16

    MPLS VC labels: local 336, remote 188

    Group ID: local 0, remote 0

    MTU: local 1500, remote 1500

    Remote interface description:

  Sequencing: receive disabled, send disabled

  VC statistics:

    packet totals: receive 4016946, send 9576394

    byte totals:   receive 427480129, send 2838427498

    packet drops:  receive 0, send 0

 

sh mpls l2transport vc

VFI SDH-NEC    VFI                        192.168.4.16    807        UP

 

seems it does not have any issue here, except tunnel lable can not be found .what should i do for the further troubleshooting?

From sam_mailinglists at spacething.org  Mon Jun  1 11:27:54 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Mon, 01 Jun 2009 16:27:54 +0100
Subject: [c-nsp] Nexus V1000 - Feedback?
Message-ID: <4A23F37A.60008@spacething.org>

Hi,

Has anyone here deployed the Nexus V1000? I'm interested in feedback 
(good, back or indifferent).

Thanks,

Sam

From wireless at starbeam.com  Mon Jun  1 11:46:44 2009
From: wireless at starbeam.com (Jerry Bacon)
Date: Mon, 1 Jun 2009 08:46:44 -0700
Subject: [c-nsp] even Eompls "vc" is up but can not work
References: <30733322.938901243866586761.JavaMail.coremail@bj163app25.163.com>
Message-ID: <1C46AB7345A44FD48211917490E2E9C4@user6006cfcba1>

Check the other end and make sure it is also up. I've seen cases where the 
PE router on one side shows the circuit as "up", but the other PE router 
will show it as "down".

-- 
Jerry B.


----- Original Message ----- 

> the vc still is up,but the eompls does't work suddenly.
> i got the show message on the cli
>
>
> Local interface: VFI SDH-NEC VFI up
>
[snip]
>
> sh mpls l2transport vc
>
> VFI SDH-NEC    VFI                        192.168.4.16    807        UP
>
> seems it does not have any issue here, except tunnel lable can not be 
> found .what should i do for the further troubleshooting?


From gert at greenie.muc.de  Mon Jun  1 13:20:18 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Mon, 1 Jun 2009 19:20:18 +0200
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A23F37A.60008@spacething.org>
References: <4A23F37A.60008@spacething.org>
Message-ID: <20090601172018.GN290@greenie.muc.de>

Hi,

On Mon, Jun 01, 2009 at 04:27:54PM +0100, Sam Stickland wrote:
> Has anyone here deployed the Nexus V1000? I'm interested in feedback 
> (good, back or indifferent).

We haven't deployed it yet, but what I was demonstrated at Networkers
in Barcelona was definitely Way Cool.  "The Cisco way" to configure
and monitor switches, not the VMware web-thingie...

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090601/0b515b6f/attachment.bin>

From gert at greenie.muc.de  Mon Jun  1 16:35:06 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Mon, 1 Jun 2009 22:35:06 +0200
Subject: [c-nsp] strange behavior over MPLS network - remote desktop
	won't work
In-Reply-To: <alpine.DEB.1.10.0905312320090.21799@locus>
References: <db092ca60905311301p13e05985q2d3442be7aba6fc@mail.gmail.com>
	<4A22E68F.4010605@wbsconnect.com>
	<db092ca60905311404j2ae21a00ve1017a4060285d@mail.gmail.com>
	<alpine.DEB.1.10.0905312320090.21799@locus>
Message-ID: <20090601203506.GO290@greenie.muc.de>

Hi,

On Sun, May 31, 2009 at 11:22:08PM +0200, Sascha E. Pollok wrote:
> Also, what kind of FE boards do you use on the 7206?
> I am currently unsure whether e.g. PA-FE-TX support
> larger MTUs needed for MPLS/VPN.

"Sort of".  There was a lengthy discussion on this list, about two years
ago - as far as I remember, the single-port FEs for the 7200s are bugged
and can only do an MTU up to 1530 bytes.

... but this still works nicely for simple L3 VPN stuff (1500+4+4).

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090601/4a0845ff/attachment.bin>

From ml at kenweb.org  Mon Jun  1 20:44:04 2009
From: ml at kenweb.org (ML)
Date: Mon, 01 Jun 2009 20:44:04 -0400
Subject: [c-nsp] uRPF on ME3400
Message-ID: <4A2475D4.8000006@kenweb.org>

With the IOS available today it's apparent that uRPF is only available 
in VRFs on the ME3400.

Like some people I've run across, I want uRPF not in a VRF.  Has anyone 
found a workaround to this limitation?

Or should I hold my horses and hope it's in 12.2(52)SE?


Thanks


From n03ri at telkom.co.id  Mon Jun  1 22:15:02 2009
From: n03ri at telkom.co.id (Nur Wahid)
Date: Tue, 02 Jun 2009 09:15:02 +0700
Subject: [c-nsp] Cos to DSCP mapping in Cisco 7600 series
In-Reply-To: <mailman.3.1243872001.64973.cisco-nsp@puck.nether.net>
References: <mailman.3.1243872001.64973.cisco-nsp@puck.nether.net>
Message-ID: <4A248B26.7020405@telkom.co.id>

Hi All,
I want to do configuring policy map in Cisco 7600 series:
1. The ingress DSCP to CoS mapping
2. The egress CoS to DSCP mapping
Does anyone have template this mapping in both ingress or egress interface?

-- 
Thanks and Best Regards,
 
Abdul Wahid


====================================
Mau GRATIS TELPON LOKAL, DISCOUNT 50% SMS, 
DISCOUNT 20% SLJJ, dan DISCOUNT FLEXI MILIS? 
Ikuti Dahsyatnya FLEXI KOMUNITAS. 
Ketik CREATE<spasi>[NAMA GRUP], sms ke 345. 
Contoh: CREATE SMU2, sms ke 345. 
Informasi selanjutnya:
- hubungi 147
- http://www.telkomflexi.com
- ketik INFO, sms ke 345.

From rlucas at nz1.ibm.com  Tue Jun  2 02:10:29 2009
From: rlucas at nz1.ibm.com (Raymond Lucas)
Date: Tue, 2 Jun 2009 18:10:29 +1200
Subject: [c-nsp] OSPF LSA timers
Message-ID: <OF603BD14F.B6929832-ONCC2575C9.0020532A-CC2575C9.0021EB3B@nz1.ibm.com>


Hi,

I have been gradually rolling out OSPF across a network including the
following bit of config:

router ospf 172
 ispf
 timers throttle lsa all 10 100 5000
 timers lsa arrival 80

Which was fine until I arrived at a couple of 6506s with SUP2/MSFC2 running
12.2(17d)SXB9 which don't support those commands.  Seems they were only
introduced in 12.2(18)SXF according to Software Advisor.

We can't upgrade to 12.2(18)SXF due to a lack of memory on the switch
processors.  I'm not too worried by the "ispf" business, but I have a bad
feeling about having a couple of devices different from their neighbours
with the LSA stuff.  To really up the nerves, these 6506s are are part of
the core.  I can imagine it working well most of the time but then failing
badly when the pressure is on.

So I guess my questions are:

- Am I right to be worried, or will things work fine if I miss these
commands from these devices?

- Since these timers can only be set on a per device basis, as opposed to
per interface, is there an elegant way to deal with this scenario?
Obviously I would not be keen to remove the modified timers from the rest
of the network!

Thanks,
Ray


From tom at netspot.com.au  Tue Jun  2 03:15:25 2009
From: tom at netspot.com.au (Tom Lanyon)
Date: Tue, 2 Jun 2009 16:45:25 +0930
Subject: [c-nsp] Any problems w/ 3750 IOS 12.2(46)SE?
Message-ID: <A77B4558-D03A-439D-B6F9-60169E9CCF83@netspot.com.au>


We are seeing consistent low TCP throughput over a dual gig  
etherchannel between two stacks of 3x 3750G + 1x 3750E and  
intermittent delays (ie. random slow ICMP ping times) on another 2x  
3750G stack, all on 12.2(46)SE. All switches are doing L2/L3  
forwarding and a small amount of EIGRP.

The stack with delayed ICMP has seemingly random high CPU load and  
this seems to correlate with the delayed ICMP packets; example:
	5Min Processes: 27% CPU
	Interrupts: 0% CPU
	Sum of all processes: 1.88% CPU

The other stacks haven't shown signs of ICMP delayed packets but still  
list high (40-100%) peaks of CPU utilisation. Can't see any  
indications of TCAM exhaustion on any switch (all desktop default SDM  
template).

Just thought I'd throw this to the list to see if anyone else has had  
something similar?

Tom

From blahu77 at gmail.com  Tue Jun  2 03:48:38 2009
From: blahu77 at gmail.com (Mateusz Blaszczyk)
Date: Tue, 2 Jun 2009 08:48:38 +0100
Subject: [c-nsp] uRPF on ME3400
In-Reply-To: <4A2475D4.8000006@kenweb.org>
References: <4A2475D4.8000006@kenweb.org>
Message-ID: <383357750906020048r63eccb30u38b54e2ff1353b61@mail.gmail.com>

2009/6/2 ML <ml at kenweb.org>:
> With the IOS available today it's apparent that uRPF is only available in
> VRFs on the ME3400.
>
> Like some people I've run across, I want uRPF not in a VRF. ?Has anyone
> found a workaround to this limitation?

if you are running vrf-lite i could create vrf global and put any
interface in that vrf.

BRs,

-mat

From jp at softnet.si  Tue Jun  2 03:33:06 2009
From: jp at softnet.si (Primoz Jeroncic)
Date: Tue, 2 Jun 2009 09:33:06 +0200 (CEST)
Subject: [c-nsp] MPLS PE on Cisco L3 switches
Message-ID: <Pine.GSO.4.44.0906020918270.8930-100000@jessie>

Hi guys

I'm looking for solution of relatively cheap L3 switch, which could
also be configured as MPLS PE device. As far as I know, until now
cheapest option was Cisco 3750 Metro. Now I was reading whitepapers
for Cisco ME3400, and to be honest I didn't find any certain info
about this. Does anyone know if ME3400 (with proper IOS image) supports
MPLS (as I wrote before, I basically want to configure it as PE device)
or it still doesn't?


Thanks for any info you might have.

Have fun,
Primoz Jeroncic
Support - IP Connectivity & Routing
-------------------------------------------------------------------
Softnet d.o.o.  tel:  +386 1 562 31 40   |
Borovec 2       fax:  +386 1 562 18 55   |       1 + 1 = 3
1236 Trzin      primoz(at)softnet.si     | for larger values of 1
Slovenija       http://flea.softnet.si/
-------------------------------------------------------------------


From elmi at 4ever.de  Tue Jun  2 05:23:28 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Tue, 2 Jun 2009 11:23:28 +0200
Subject: [c-nsp] ASR 1000 series again: Netflow export
In-Reply-To: <20090514125033.GZ29526@ronin.4ever.de>
References: <20090514090638.GQ29526@ronin.4ever.de>
	<F308ED42-9A78-48E3-B125-A2B225C2FC74@puck.nether.net>
	<20090514125033.GZ29526@ronin.4ever.de>
Message-ID: <20090602092328.GO6911@ronin.4ever.de>

I must follow up on that one...

As a lot of people pointed out, the mgt if is out of the question,
so I configured another mgt vrf to be able to put an interface
into that (no, you cannot get another interface into the default
mgt-vrf...it's only for gi0).

I set the static route to null0 in the default vrf in order to see

  VRF ID : Default
      Source(1)       172.16.202.5 (Unknown)
      Destination(1)  172.16.31.250 (12001)
  Version 5 flow records, origin-as
  Cache for as aggregation:
    Flow export is disabled
  2609363 flows exported in 122960 udp datagrams


...instead of the external address as the source.

Still, I see no packets going out.

Does anyone have a hint to get this running?

Thanks for any input,
			Elmar.


From sthaug at nethelp.no  Tue Jun  2 04:23:40 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Tue, 02 Jun 2009 10:23:40 +0200 (CEST)
Subject: [c-nsp] MPLS PE on Cisco L3 switches
In-Reply-To: <Pine.GSO.4.44.0906020918270.8930-100000@jessie>
References: <Pine.GSO.4.44.0906020918270.8930-100000@jessie>
Message-ID: <20090602.102340.74688870.sthaug@nethelp.no>

> I'm looking for solution of relatively cheap L3 switch, which could
> also be configured as MPLS PE device. As far as I know, until now
> cheapest option was Cisco 3750 Metro. Now I was reading whitepapers
> for Cisco ME3400, and to be honest I didn't find any certain info
> about this. Does anyone know if ME3400 (with proper IOS image) supports
> MPLS (as I wrote before, I basically want to configure it as PE device)
> or it still doesn't?

It does not.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From zivl at gilat.net  Tue Jun  2 08:43:03 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Tue, 2 Jun 2009 15:43:03 +0300
Subject: [c-nsp] Ingress policing on a 3560
In-Reply-To: <63266.172.25.144.4.1243823930.squirrel@imap.snnap.net>
References: <63266.172.25.144.4.1243823930.squirrel@imap.snnap.net>
Message-ID: <EC993E87D960A541A66BF21D62AA42A622FF0389D9@exch2k7.gilat.local>

I'm applying the same you need using dscp instead of mac for "all traffic" and it's working good, here's a sample:

class-map match-all ALL-TRAFFIC
  match ip dscp 0
!
policy-map 7-MEGA
  class ALL-TRAFFIC
    police 7168000 1344000 exceed-action drop

!
interface FastEthernet0/1
description 7 Megabit rated interface sample
service-policy input 7-MEGA
!



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Tom Storey
Sent: Monday, June 01, 2009 5:39 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Ingress policing on a 3560

Hi all.

What I'm trying to do is police ingress on a port, using a MAC ACL to
match traffic to police (just a "permit any any" to match all traffic).

But what I'm getting is that the switch doesnt appear to be matching any
traffic at all.

sw2#sh int gi0/14 | inc put rate
  30 second input rate 20449000 bits/sec, 1688 packets/sec
  30 second output rate 2620000 bits/sec, 1690 packets/sec
sw2#sh policy-map int gi0/14
 GigabitEthernet0/14

  Service-policy input: police-10mbit-in

    Class-map: mac-any-any (match-any)
      0 packets, 0 bytes
      30 second offered rate 0 bps, drop rate 0 bps
      Match: access-group name mac-any-any
        0 packets, 0 bytes
        30 second rate 0 bps

    Class-map: class-default (match-any)
      0 packets, 0 bytes
      30 second offered rate 0 bps, drop rate 0 bps
      Match: any
        0 packets, 0 bytes
        30 second rate 0 bps

Does anyone have any pointers as to what I'm doing wrong? Below is my config.

mac access-list extended mac-any-any
 permit any any
!
class-map match-any mac-any-any
 match access-group name mac-any-any
!
policy-map police-10mbit-in
 class mac-any-any
  police 10000000 1000000 exceed-action drop
!
interface GigabitEthernet0/14
 service-policy input police-10mbit-in
!

Ive also tried with just class-default, but got the same result.

I am currently using the "vlan" SDM profile, if that makes any difference.

Cheers,
Tom

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From uugnaa_mns at yahoo.com  Tue Jun  2 07:52:25 2009
From: uugnaa_mns at yahoo.com (uugnaa)
Date: Tue, 2 Jun 2009 04:52:25 -0700 (PDT)
Subject: [c-nsp] Optical Transceiver Module
Message-ID: <268079.75440.qm@web55102.mail.re4.yahoo.com>

Hello all,

Is there any Cisco or third party Optical Transceiver SFP module which goes up to 80km, up to 15km and up to 20km.

Please help me on this.

thank you in advance.



      

From johnny at johnnykarmspedersen.dk  Tue Jun  2 09:55:08 2009
From: johnny at johnnykarmspedersen.dk (Johnny Karms Pedersen)
Date: Tue, 2 Jun 2009 15:55:08 +0200
Subject: [c-nsp] Cisco 3640 flash installation issue.
Message-ID: <kkm6nw.91b8kg@webmail.servnet.dk>

Hi,

I've just installed two 16 MB flash modules in one of my Cisco 3640 with bootstrap v. 11.1(20)AA2.
After I've installed the modules I boot the router up using an external flash card, the modules are recognized and I can partition them as one 32 MB partition. I can also succesfully copy an IOS image to it (checksum verification says everything is ok).

But I reload the router I get the following error messages:

-------------
get_man_dev: Unknown device - probably NOT formatted.
unknown flash device - mandev code = 0x89aa
cannot read flash info
getdevnum warning: device "flash" has size of zero
get_man_dev: Unknown device - probably NOT formatted.
unknown flash device - mandev code = 0x89aa
cannot read flash info
getdevnum warning: device "flash" has size of zero
get_man_dev: Unknown device - probably NOT formatted.
unknown flash device - mandev code = 0x89aa
cannot read flash info
getdevnum warning: device "flash" has size of zero
get_man_dev: Unknown device - probably NOT formatted.
unknown flash device - mandev code = 0x89aa
cannot read flash info
getdevnum warning: device "flash" has size of zero
open: read error...requested 0x4 bytes, got 0x0
trouble reading device magic number
dir: cannot open device "flash:"
------------

I've got several others running the exact same setup with same bootstrap version.

Any clues to why this doesn't seem to work when booting up, and how to solve it?


Best regards
Johnny Karms Pedersen


From pavel.skovajsa at gmail.com  Tue Jun  2 11:21:21 2009
From: pavel.skovajsa at gmail.com (Pavel Skovajsa)
Date: Tue, 2 Jun 2009 17:21:21 +0200
Subject: [c-nsp] Dot1x stuck in guest-vlan
Message-ID: <323aca890906020821m4d89c879rdaddd5ebe636f0f8@mail.gmail.com>

Hello all,

I am struggling with the way the Guest Vlan is handled in dot1x.
All the port states work just fine, except during workstation boot-up
the switch does not receive dot1x packets from workstation dot1x
client hence forcing the port to fall into Guest Vlan, as below:

=============================================
C3560#sh authentication sessions interface fa0/38
            Interface:  FastEthernet0/38
          MAC Address:  Unknown
           IP Address:  Unknown
            User-Name:  UNRESPONSIVE
               Status:  Authz Success
               Domain:  DATA
       Oper host mode:  multi-host
     Oper control dir:  both
        Authorized By:  Guest Vlan
          Vlan Policy:  330
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0A821A5C00003727DE21D3A1
      Acct Session ID:  0x000045A8
               Handle:  0x63000727

Runnable methods list:
       Method   State
       dot1x    Failed over
==============================================

Once PC and its dot1x client or supplicant is up and running the port
status does not change as I would expect - to production Vlan.
The only remedy here is to shut / no shut the port.

port config:
====================
interface FastEthernet0/38
 switchport access vlan 100
 switchport mode access
 switchport voice vlan 500
 priority-queue out
 authentication event fail action authorize vlan 330
 authentication event server dead action authorize vlan 100
 authentication event no-response action authorize vlan 330         <=
it works without this command for compliant users, however
non-compliant guest machines would not be allowed any network
connectivity at all
 authentication event server alive action reinitialize
 authentication port-control auto
 authentication periodic
 authentication timer restart 20
 authentication timer reauthenticate 20
 authentication timer inactivity 120
 mls qos trust device cisco-phone
 mls qos trust cos
 dot1x pae authenticator
 dot1x timeout server-timeout 100
 dot1x timeout tx-period 2
 dot1x timeout supp-timeout 10
 spanning-tree portfast
end
===========================

Many thanks for any hints,

Pavel Skovajsa

From Michael.Balasko at cityofhenderson.com  Tue Jun  2 14:24:47 2009
From: Michael.Balasko at cityofhenderson.com (Michael Balasko)
Date: Tue, 2 Jun 2009 11:24:47 -0700
Subject: [c-nsp] Optical Transceiver Module
In-Reply-To: <268079.75440.qm@web55102.mail.re4.yahoo.com>
References: <268079.75440.qm@web55102.mail.re4.yahoo.com>
Message-ID: <9AF22D15085E7D409ED5710CBC779E930A870DCE@COHNTCS09.ci.henderson.nv.us>

Distance is irrelevant - it's all about optical budget and the quality
of your SM fiber number of splices/patches etc... but you're looking for
a zx spec optic. 

http://www.google.com/search?hl=en&q=sfp+zx&aq=f&oq=&aqi=

Michael Balasko
CCNP,CCSP,MCSE,MCNE
Network Specialist II
City of Henderson, Nevada
240 Water St. 
Henderson, NV 89015
702-267-4337 (single number reach)


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of uugnaa
Sent: Tuesday, June 02, 2009 4:52 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Optical Transceiver Module

Hello all,

Is there any Cisco or third party Optical Transceiver SFP module which
goes up to 80km, up to 15km and up to 20km.

Please help me on this.

thank you in advance.



      
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From pdavis at i2k.com  Tue Jun  2 14:43:41 2009
From: pdavis at i2k.com (Phil Davis)
Date: Tue, 02 Jun 2009 14:43:41 -0400
Subject: [c-nsp] PA-A3-T3 FEBE and LOS
Message-ID: <4A2572DD.3000506@i2k.com>

Hello,

  I have an ATM DS3 coming through a PA-A3-T3. The last few days it 
would abruptly go down for 5-10 minutes, perhaps every 12 hours on 
average. During these times, the interface would show rapidly growing 
carrier signal loss (about 10-20/sec.) I also saw incrementing FEBE 
errors. However, neither the provider, nor a third-party transport 
provider was detecting LOS on the line. However, the far side did see a 
relatively small number of FEBE errors.
  I swapped the interface and it's been quiet for last few hours, though 
it remains to be seen if that's the last of the issue. Does this make 
sense to anybody? I don't understand why an erroring PA would detect LOS 
without LOS being present. Could it have been bouncing in and out of 
loopback?

sh run int ATM1/0:
interface ATM1/0
 no ip address
 no ip mroute-cache
 atm scrambling cell-payload
 atm framing cbitplcp
 no atm auto-configuration
 no atm ilmi-keepalive
 no atm address-registration
 no atm ilmi-enable
 no clns route-cache
end

sh diag 1:
ATM WAN DS3 Port adapter, 1 port
        Port adapter is analyzed
        Port adapter insertion time 02:39:05 ago
        EEPROM contents at hardware discovery:
        Hardware revision 2.0           Board revision A0
        Serial number     23121181      Part number    73-2432-04
        FRU Part Number:  PA-A3-T3=

        Test history      0x0           RMA number     00-00-00
        EEPROM format version 1
        EEPROM contents (hex):
          0x00: 01 5B 02 00 01 60 CD 1D 49 09 80 04 00 00 00 00
          0x10: 50 00 00 00 00 09 17 00 FF FF FF FF FF FF FF FF

sh contr atm1/0:
Slot 1:
        ATM WAN DS3 Port adapter, 1 port
        Port adapter is analyzed
        Port adapter insertion time 02:39:05 ago
        EEPROM contents at hardware discovery:
        Hardware revision 2.0           Board revision A0
        Serial number     23121181      Part number    73-2432-04
        FRU Part Number:  PA-A3-T3=

        Test history      0x0           RMA number     00-00-00
        EEPROM format version 1
        EEPROM contents (hex):
          0x00: 01 5B 02 00 01 60 CD 1D 49 09 80 04 00 00 00 00
          0x10: 50 00 00 00 00 09 17 00 FF FF FF FF FF FF FF FF

sh contr atm1/0:
Interface ATM1/0 is up
Hardware is ENHANCED ATM PA - DS3 (45000Kbps)
Framer is PMC PM7345 S/UNI-PDH, SAR is LSI ATMIZER II
Firmware rev: G153, Framer rev: 1, ATMIZER II rev: 3
  idb=0x63A1F0D4, ds=0x63A491E0, vc=0x63A572E0
  slot 1, unit 1, subunit 0, fci_type 0x005B, ticks 9682
  1200 rx buffers: size=512, encap=64, trailer=28, magic=4
Curr Stats:
  VCC count: current=32, peak=32
  AAL2 VCC count: 0
  AAL2 TX no buffer count: 0
  AAL2 RX no buffer count: 0
  SAR crashes: Rx SAR=0, Tx SAR=0
  rx_cell_lost=0, rx_no_buffer=0, rx_crc_10=0, rx_no_mem=0
  rx_cell_len=0, rx_no_vcd=313, rx_cell_throttle=0, tx_aci_err=0
Rx Free Ring status:
  base=0x3CA7C040, size=2048, write=1016
Rx Compl Ring status:
  base=0x7E4DB7E0, size=2048, read=834
Tx Ring status:
  base=0x3CF13A40, size=8192, write=2205
Tx Compl Ring status:
  base=0x0E1B3840, size=4096, read=1101
BFD Cache status:
  base=0x65F45940, size=6144, read=6140
Rx Cache status:
  base=0x64458360, size=16, write=2
Tx Shadow status:
  base=0x66691E60, size=8192, read=2191, write=2205
Control data:
  rx_max_spins=22, max_tx_count=144, tx_count=14
  rx_threshold=800, rx_count=2, tx_threshold=4608
  tx bfd write indx=0x47C, rx_pool_info=0x63A208C0
Control data base address:
       rx_buf_base = 0x0E3A6C80        rx_p_base = 0x66802E80
            rx_pak = 0x639727DC              cmd = 0x64752080
            framer = 0x60479798        framer_cb = 0x6474FB80
       framer_base = 0x3C900000     pci_pa_stats = 0x7E391900
    device_base[0] = 0x3C800000   device_base[1] = 0x3CC00000
     ssram_base[0] = 0x3CA00000    ssram_base[1] = 0x3CE00000
     sdram_base[0] = 0x3CB00000    sdram_base[1] = 0x3CF00000
     pa_cmd_buf[0] = 0x3CA7FC00    pa_cmd_buf[1] = 0x3CE7FC00
       vcd_base[0] = 0x3CA00000      vcd_base[1] = 0x3CE18000
      chip_dump[0] = 0x0E39192C     chip_dump[1] = 0x0E391A2C
   sar_buf_base[0] = 0x3CB24000  sar_buf_base[1] = 0x3CF1C000
       bfd_base[0] = 0x3CA64000      bfd_base[1] = 0x3CE00000
       acd_base[0] = 0x3CA22080      acd_base[1] = 0x3CE38240
Framer Information:
 Framing mode: DS3 C-bit PLCP
 No alarm detected
Facility statistics: current interval elapsed 682 seconds
          lcv       fbe       ezd        pe       ppe      febe      hcse
   ----------------------------------------------------------------------
 0          1         0         1         1         1         0         0

PLCP Errors:
         bipe       fbe      febe
    -----------------------------
 0          1         0         0

   lcv:  Line Code Violation
   fbe:  Framing Bit Error
   ezd:  Summed Excessive Zeros
   pe:   Parity Error
   ppe:  Path Parity Error
   febe: Far-end Block Error
   hcse: Rx Cell HCS Error
   bipe: Bit Interleave Parity (B1) Error

Thanks!
Phil

From andy at xecu.net  Tue Jun  2 15:21:12 2009
From: andy at xecu.net (Andy Dills)
Date: Tue, 2 Jun 2009 15:21:12 -0400 (EDT)
Subject: [c-nsp] Netflow analyzer suggestions
Message-ID: <20090602150859.H38689@shell.xecu.net>


Hi there,

Apologies for the non-cisco specific post, but I couldn't think of a 
better list to post to off of the top of my head.

A friend of mine is looking to get some better visibility into their 
network usage (low bandwidth, T1 type scenario). I got them setup with an 
IOS that supports netflow v9, and since they had a freebsd box being 
barely used, I built ntop to be their collector/analyzer.

It works reasonably well, but it's perhaps not quite...user friendly 
enough for them.

What they're looking for is a graphical representation at the host level. 
In essence, they're looking for something like cricket/mrtg but with each 
IP having its own graph (rather than each interface). Additional features, 
such as protocol breakdown and so forth are helpful, but the primary 
desire is to be able to see how much bandwidth a given IP address is using 
currently and was using in the past.

They're open to commercial solutions, but would prefer to keep costs down. 
Host operating system requirements for the collector/analyzer aren't 
important.

Does anybody have any suggestions they could pass along?

Thanks,
Andy

---
Andy Dills
Xecunet, Inc.
www.xecu.net
301-682-9972
---

From florinb at teksavvy.com  Tue Jun  2 16:59:41 2009
From: florinb at teksavvy.com (florinb at teksavvy.com)
Date: Tue, 02 Jun 2009 16:59:41 -0400
Subject: [c-nsp] Cisco 7204 Ethernet LMI Question
Message-ID: <d180e9ff1a12883c8c839bbabc956346@teksavvy.com>

Hi, 
I would like to ask your opinion on an issue I see in a configuration where a 7204 acts as a CE and it is running Ethernet LMI on an FastE interface: 

interface FastEthernet2/0
no ip address
logging event subif-link-status
duplex full
no keepalive
ethernet lmi interface
ethernet lmi t391 10
ethernet lmi n393 4
!
interface FastEthernet2/0.10
encapsulation dot1Q 10
ip address 10.0.11.12 255.255.255.0

As soon as the PE is sending an Ethernet LMI Status Full Status message with one EVC MAP entry indicating that EVC10 (mapped to VLAN 10 )is new and active in the MEN, the line protocol on interface Fast 2/0 changes status to down, the subinterface Fast 2/0.10 stays up (because LMI indicated the EVC associated to VLAN 10 is active). 
c7204#show int fast 2/0
FastEthernet2/0 is up, line protocol is down
Hardware is AmdFE, address is 0005.dd6e.9038 (bia 0005.dd6e.9038)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set
Keepalive not set
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:12, output 00:00:04, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/40/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
842 packets input, 62128 bytes
Received 0 broadcasts, 0 runts, 0 giants, 1 throttles
1 input errors, 1 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog
0 input packets with dribble condition detected
17244 packets output, 1683765 bytes, 0 underruns
0 output errors, 0 collisions, 35 interface resets
57 unknown protocol drops
57 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out

My take is the line protocol status on interface fast 2/0 changes to down because there was no indication from PE of an active EVC associated with VLAN 1 (native VLAN the system associates by default with interface fast 2/0). 
At this point the interface Fast 2/0 keeps sending Ethernet LMI PDUs (as expected by LMI protocol) but it does not accept any Ethernet LMI PDUs from PE ( Ethernet LMI PDUs are untagged ). 
If the PE includes the VLAN 1 in the CE-VLAN map it sends (or if I set the VLAN 10 as native on CE ) the Ethernet LMI PDUs exchange will be successful. 

I wonder if I miss something in CE configuration as it looks unusual to me the Ethernet LMI has to "enable" the data path it will use to send owns PDUs. 
Please let me know your opinion. 
Thanks, 
Florin 



From scott at labyrinth.org  Tue Jun  2 19:58:52 2009
From: scott at labyrinth.org (Scott Keoseyan)
Date: Tue, 2 Jun 2009 19:58:52 -0400
Subject: [c-nsp] Dot1x stuck in guest-vlan
In-Reply-To: <323aca890906020821m4d89c879rdaddd5ebe636f0f8@mail.gmail.com>
References: <323aca890906020821m4d89c879rdaddd5ebe636f0f8@mail.gmail.com>
Message-ID: <88985CB2-7E54-48EB-A397-4826D0283693@labyrinth.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

If you're using the Microsoft supplicant, you may need to make a  
registry change to force the supplicant to issue an EAPOL start to  
initialize the state machine on the port.

See:

http://technet.microsoft.com/en-us/network/cc987603.aspx


The SupplicantMode registry value (HKEY_LOCAL_MACHINE\Software 
\Microsoft\EAPOL\Parameters \General\Global\SupplicantMode) affects  
the behavior of an 802.1X supplicant when sending EAP over LAN (EAPOL)- 
Start packets during 802.1X authentication. The SupplicantMode value  
can be set to the following:

     * 0 - Disable IEEE 802.1X operation.
     * 1 - Never send an EAPOL-Start packet.
     * 2 - Automatically determine when to initiate the transmission  
of EAPOL-Start packets. This is the default value for wired connections.
     * 3 - Send an EAPOL-Start message upon association to initiate  
the 802.1X authentication process, for compliance with the IEEE 802.1X  
specification.



On Jun 2, 2009, at 11:21 AM, Pavel Skovajsa wrote:

> Hello all,
>
> I am struggling with the way the Guest Vlan is handled in dot1x.
> All the port states work just fine, except during workstation boot-up
> the switch does not receive dot1x packets from workstation dot1x
> client hence forcing the port to fall into Guest Vlan, as below:
>
> =============================================
> C3560#sh authentication sessions interface fa0/38
>            Interface:  FastEthernet0/38
>          MAC Address:  Unknown
>           IP Address:  Unknown
>            User-Name:  UNRESPONSIVE
>               Status:  Authz Success
>               Domain:  DATA
>       Oper host mode:  multi-host
>     Oper control dir:  both
>        Authorized By:  Guest Vlan
>          Vlan Policy:  330
>      Session timeout:  N/A
>         Idle timeout:  N/A
>    Common Session ID:  0A821A5C00003727DE21D3A1
>      Acct Session ID:  0x000045A8
>               Handle:  0x63000727
>
> Runnable methods list:
>       Method   State
>       dot1x    Failed over
> ==============================================
>
> Once PC and its dot1x client or supplicant is up and running the port
> status does not change as I would expect - to production Vlan.
> The only remedy here is to shut / no shut the port.
>
> port config:
> ====================
> interface FastEthernet0/38
> switchport access vlan 100
> switchport mode access
> switchport voice vlan 500
> priority-queue out
> authentication event fail action authorize vlan 330
> authentication event server dead action authorize vlan 100
> authentication event no-response action authorize vlan 330         <=
> it works without this command for compliant users, however
> non-compliant guest machines would not be allowed any network
> connectivity at all
> authentication event server alive action reinitialize
> authentication port-control auto
> authentication periodic
> authentication timer restart 20
> authentication timer reauthenticate 20
> authentication timer inactivity 120
> mls qos trust device cisco-phone
> mls qos trust cos
> dot1x pae authenticator
> dot1x timeout server-timeout 100
> dot1x timeout tx-period 2
> dot1x timeout supp-timeout 10
> spanning-tree portfast
> end
> ===========================
>
> Many thanks for any hints,
>
> Pavel Skovajsa
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

- --
Scott Keoseyan
scott at labyrinth.org
Homepage - http://www.labyrinth.org/homepages/scott
Blog - http://www.labyrinth.org/wp1
PGP Key - http://www.labyrinth.org/homepages/scott/pgp.html




-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.11 (Darwin)

iEYEARECAAYFAkolvMAACgkQA7TpMPAlvEdl1gCeOKWRQybwDsfo+rJ5sqX/cXs1
MZYAn1X37ReSSi1zIkGcELpLeaMv1yqp
=X0L3
-----END PGP SIGNATURE-----

From ltd at cisco.com  Tue Jun  2 20:12:42 2009
From: ltd at cisco.com (Lincoln Dale)
Date: Wed, 03 Jun 2009 10:12:42 +1000
Subject: [c-nsp] Optical Transceiver Module
In-Reply-To: <268079.75440.qm@web55102.mail.re4.yahoo.com>
References: <268079.75440.qm@web55102.mail.re4.yahoo.com>
Message-ID: <4A25BFFA.4040406@cisco.com>

in Cisco terms:
    80km would be covered by DWDM, CWDM and ZX optics.
    20km would be covered by DWDM, CWDM, ZX and ER/ER+ optics
    15km may be covered by LR optics at a pinch. would have to be very 
good fiber, few patches etc.  you'd need to know exact fiber 
charactieristcs as to whether its possible.  but if not, then it'll be 
the same as 20km above.

http://www.cisco.com/en/US/prod/collateral/modules/ps5455/white_paper_c11-463661.html 
provides all the details you're looking for.
as others have indicated "distance" is more of a 'typical' thing rather 
than an absolute science.


cheers,

lincoln.

uugnaa wrote:
> Hello all,
>
> Is there any Cisco or third party Optical Transceiver SFP module which goes up to 80km, up to 15km and up to 20km.
>
> Please help me on this.
>
> thank you in advance.
>
>   

From rdobbins at arbor.net  Tue Jun  2 20:35:48 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 3 Jun 2009 07:35:48 +0700
Subject: [c-nsp] Netflow analyzer suggestions
In-Reply-To: <20090602150859.H38689@shell.xecu.net>
References: <20090602150859.H38689@shell.xecu.net>
Message-ID: <222ACA30-9C13-4636-98F9-6F3F87604466@arbor.net>


On Jun 3, 2009, at 2:21 AM, Andy Dills wrote:

> Does anybody have any suggestions they could pass along?

They should be able to use nfdump/nfsen, or most any of the others,  
and do graphing/reporting on individual IPs as /32s, one should think?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From jloiacon at csc.com  Tue Jun  2 20:52:38 2009
From: jloiacon at csc.com (Joe Loiacono)
Date: Tue, 2 Jun 2009 20:52:38 -0400
Subject: [c-nsp] Netflow analyzer suggestions
In-Reply-To: <20090602150859.H38689@shell.xecu.net>
References: <20090602150859.H38689@shell.xecu.net>
Message-ID: <OF9EFA05A9.E09314DD-ON852575CA.00046AC1-852575CA.0004D216@csc.com>

One open-source option is flow-tools and FlowViewer. It does exactly what 
you're asking for. But you would have to export v5 or v7. For information 
and screenshots:

http://ensight.eos.nasa.gov/FlowViewer/

Joe



Andy Dills <andy at xecu.net> 
Sent by: cisco-nsp-bounces at puck.nether.net
06/02/2009 03:21 PM

To
cisco-nsp at puck.nether.net
cc

Subject
[c-nsp] Netflow analyzer suggestions







Hi there,

Apologies for the non-cisco specific post, but I couldn't think of a 
better list to post to off of the top of my head.

A friend of mine is looking to get some better visibility into their 
network usage (low bandwidth, T1 type scenario). I got them setup with an 
IOS that supports netflow v9, and since they had a freebsd box being 
barely used, I built ntop to be their collector/analyzer.

It works reasonably well, but it's perhaps not quite...user friendly 
enough for them.

What they're looking for is a graphical representation at the host level. 
In essence, they're looking for something like cricket/mrtg but with each 
IP having its own graph (rather than each interface). Additional features, 

such as protocol breakdown and so forth are helpful, but the primary 
desire is to be able to see how much bandwidth a given IP address is using 

currently and was using in the past.

They're open to commercial solutions, but would prefer to keep costs down. 

Host operating system requirements for the collector/analyzer aren't 
important.

Does anybody have any suggestions they could pass along?

Thanks,
Andy

---
Andy Dills
Xecunet, Inc.
www.xecu.net
301-682-9972
---
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From r.burts at earthlink.net  Tue Jun  2 21:17:23 2009
From: r.burts at earthlink.net (Rick Burts)
Date: Tue, 02 Jun 2009 21:17:23 -0400
Subject: [c-nsp] ASA / EIGRP / Redundant Interfaces
In-Reply-To: <007a01c9c9b5$22c119a1$0600a8c0@whgroup.com>
References: <007a01c9c9b5$22c119a1$0600a8c0@whgroup.com>
Message-ID: <4A25CF23.4040806@earthlink.net>

It seems to me that an offset list applied outbound
on one of the routers could make its routes less
attractive than the routes from the other router.
This should give you 1 primary set of routes and 1
backup set of routes. And does not require any
special configuration on the ASA.

HTH

Rick

Jason Link wrote:
> Maybe that's the best option here.  I can't seem to find any other way to do it cleanly.
> 
> Thanks!
> 
> 
> -----Original Message-----
> From: Peter Rathlev <peter at rathlev.dk>
> Sent: Thursday, April 30, 2009 11:52 AM
> To: Jason Link <Jason.Link at whgroup.com>
> Cc: Cisco-nsp <cisco-nsp at puck.nether.net>
> Subject: RE: [c-nsp] ASA / EIGRP / Redundant Interfaces
> 
> On Thu, 2009-04-30 at 11:39 -0500, Jason Link wrote:
>> Additionally, I'm not sure HSRP would help me in a situation like this,
>> since the way I understand it the ASA will still learn both routers
>> "real" IP address and will form a neighbor to each one.  I would like to
>> avoid calling out the neighbor specifically, if I can help it.
> 
> Yes of course, if the ASA has to do EIGRP my suggestion is irrelevant. I
> overlooked that somewhat since I'm not used to thinking about having
> firewalls do dynamic routing. :-)
> 
> The HSRP thing would of course be with the ASA not participating in the
> EIGRP. On the ASA side you would use static routes pointing at the HSRP
> IP. On the router side you would use static routes pointing at the ASA
> primary IP.
> 
> Regards,
> Peter
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From pshem.k at gmail.com  Tue Jun  2 22:26:37 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Wed, 3 Jun 2009 14:26:37 +1200
Subject: [c-nsp] ICMP replay from egress PE
Message-ID: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>

Hi,

Recently we've upgraded some of our 7301 to ASR (1004). Config
remained pretty much the same (from L3VPNs perspective), but it looks
like the behaviour of both platforms is somewhat different. I'm not
sure if it's a feature or a bug yet.

We have a typical setup, like this:
CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
                        |              |
                        + --- PE3 --- CE3

So customers site is multihomed via PE2 and PE3 and has internal
connection between CE2 and CE3

With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
(egress interface from the vrf), after the upgrade to ASRs - all we
can see is PE1's IP and then straight CE2/CE3, but since customer
drops icmp packets - we can't really see which way it's really going.
Is there a way to get an ICMP reply from the egress ASR? I understand
it switches the packets out through the interface without actually
doing any lookups, but even after forcing 'label-per-vrf' we can't see
the last hop.
Any ideas if this behaviour can be corrected?

kind regards
Pshem

From zhqasmi at cyber.net.pk  Tue Jun  2 23:45:04 2009
From: zhqasmi at cyber.net.pk (Amjad Ul Hasnain Qasmi)
Date: Wed, 03 Jun 2009 09:45:04 +0600
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
Message-ID: <00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>

Try enabling " mpls ip propagate-ttl "
http://www.cisco.com/en/US/docs/ios/12_3/switch/command/reference/swi_m2.htm
l#wp1058956

Regards,
AHQ

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Pshem Kowalczyk
Sent: Wednesday, June 03, 2009 8:27 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ICMP replay from egress PE

Hi,

Recently we've upgraded some of our 7301 to ASR (1004). Config
remained pretty much the same (from L3VPNs perspective), but it looks
like the behaviour of both platforms is somewhat different. I'm not
sure if it's a feature or a bug yet.

We have a typical setup, like this:
CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
                        |              |
                        + --- PE3 --- CE3

So customers site is multihomed via PE2 and PE3 and has internal
connection between CE2 and CE3

With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
(egress interface from the vrf), after the upgrade to ASRs - all we
can see is PE1's IP and then straight CE2/CE3, but since customer
drops icmp packets - we can't really see which way it's really going.
Is there a way to get an ICMP reply from the egress ASR? I understand
it switches the packets out through the interface without actually
doing any lookups, but even after forcing 'label-per-vrf' we can't see
the last hop.
Any ideas if this behaviour can be corrected?

kind regards
Pshem
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From pshem.k at gmail.com  Wed Jun  3 01:00:13 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Wed, 3 Jun 2009 17:00:13 +1200
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com> 
	<00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>
Message-ID: <20fe625b0906022200h31a74b7ei399dbf870d499636@mail.gmail.com>

Hi,

If I do that I'll see the 'MPLS' hops, which I don't want. All I would
like to see is ICMP reply from the address inside the vrf.

kind regards
Pshem

2009/6/3 Amjad Ul Hasnain Qasmi <zhqasmi at cyber.net.pk>:
> Try enabling " mpls ip propagate-ttl "
> http://www.cisco.com/en/US/docs/ios/12_3/switch/command/reference/swi_m2.htm
> l#wp1058956
>
> Regards,
> AHQ
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Pshem Kowalczyk
> Sent: Wednesday, June 03, 2009 8:27 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ICMP replay from egress PE
>
> Hi,
>
> Recently we've upgraded some of our 7301 to ASR (1004). Config
> remained pretty much the same (from L3VPNs perspective), but it looks
> like the behaviour of both platforms is somewhat different. I'm not
> sure if it's a feature or a bug yet.
>
> We have a typical setup, like this:
> CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
> ? ? ? ? ? ? ? ? ? ? ? ?| ? ? ? ? ? ? ?|
> ? ? ? ? ? ? ? ? ? ? ? ?+ --- PE3 --- CE3
>
> So customers site is multihomed via PE2 and PE3 and has internal
> connection between CE2 and CE3
>
> With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
> (egress interface from the vrf), after the upgrade to ASRs - all we
> can see is PE1's IP and then straight CE2/CE3, but since customer
> drops icmp packets - we can't really see which way it's really going.
> Is there a way to get an ICMP reply from the egress ASR? I understand
> it switches the packets out through the interface without actually
> doing any lookups, but even after forcing 'label-per-vrf' we can't see
> the last hop.
> Any ideas if this behaviour can be corrected?
>
> kind regards
> Pshem
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>

From rick at woofpaws.com  Wed Jun  3 00:54:07 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Tue, 2 Jun 2009 21:54:07 -0700 (PDT)
Subject: [c-nsp] Revisiting ethernet bandwidth management
Message-ID: <58184.172.16.5.57.1244004847.squirrel@www.woofpaws.com>


I'm working on a network refresh that includes the customer aggregation. 
Services to customers are primarily across ethernet (LAN and MAN).

I've been researching/fighting/experimenting with methods to handle
per-port bidirectional bandwidth control.  The legacy configuration uses
Cisco's CAR, and I've been looking at traffic-shaping and policing. From
what I can see, the various bandwidth management techniques require
increasing CPU as the traffic rate increase (more packets/bytes == more
work for the CPU).

I need a device that does at least HSRP/VRRP/equivalent plus OSPF and
handles the bandwidth management.  The 3550G (playing with it for a
different project) reportedly has problems with multiple ports/streams
above 1Mbs.  The chassis-based devices (6500/7600) appear to punt at least
some of the traffic to CPU, plus I'd like to deploy small devices per
patch-panel and backhaul to the aggregation or core (depending on how much
functionality is in the device).

I'd like either a stackable or small chassis device that I can either
configure "M"Mbs per port/VLAN or "P"percent per port, not necessarily
with bursting capability. The extreme hypothetical environment would be
24ea 10/100/1000 ports each configured for 1Mbs bandwidth and hosts on all
ports attempting to send and/or receive at line rate without cratering the
device.

I've also considered essentially aggregating multiple ports/VLANs on a
switch and uplinking with a 100Mbs port.  This would require monitoring
and manual intervention to ensure the aggregate doesn't exceed 100mbs.  We
also have customers that need more than 100mbs which means I'd somehow
have to ensure that a single customer couldn't consume the capacity of an
entire GigE (unless provisioned for it).

Am I missing a feature/device/configuration that is obvious to somebody
else, or.... ?  My concern with any CPU-based solution is that it won't
scale as customer bandwidth needs continue to increase.  I'd also prefer
small, stand-alone devices and distribute them at the patch-panel level
for "light bulb" replacement and ease of cable management.

Thanks,


From rdobbins at arbor.net  Wed Jun  3 01:37:37 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 3 Jun 2009 12:37:37 +0700
Subject: [c-nsp] Revisiting ethernet bandwidth management
In-Reply-To: <58184.172.16.5.57.1244004847.squirrel@www.woofpaws.com>
References: <58184.172.16.5.57.1244004847.squirrel@www.woofpaws.com>
Message-ID: <14260C2D-D4D0-41C9-A506-120AFA1B52A4@arbor.net>


On Jun 3, 2009, at 11:54 AM, Rick Ernst wrote:

> Am I missing a feature/device/configuration that is obvious to  
> somebody
> else, or.... ?

Have you considered going with ASIC-based switches and make use of the  
QoS functionality, so you aren't CPU-bound?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From zhqasmi at cyber.net.pk  Wed Jun  3 02:10:36 2009
From: zhqasmi at cyber.net.pk (Amjad Ul Hasnain Qasmi)
Date: Wed, 03 Jun 2009 12:10:36 +0600
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <20fe625b0906022200h31a74b7ei399dbf870d499636@mail.gmail.com>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
	<00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>
	<20fe625b0906022200h31a74b7ei399dbf870d499636@mail.gmail.com>
Message-ID: <010001c9e412$0369a810$0a3cf830$@net.pk>

As per my understanding of your issue, you want to keep your mpls domain hidden from customer perspective but at the same time you want your egress LER to be appeared in traceroute. you may need to to disable TTL propagation for forwarded packets (VPN traffic), use "no mpls ip propagate forwarded" on LERs, this allows the structure of the MPLS network to be hidden from customers, but not the provider.

Regards,
AHQ



-----Original Message-----
From: Pshem Kowalczyk [mailto:pshem.k at gmail.com] 
Sent: Wednesday, June 03, 2009 11:00 AM
To: Amjad Ul Hasnain Qasmi
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] ICMP replay from egress PE

Hi,

If I do that I'll see the 'MPLS' hops, which I don't want. All I would
like to see is ICMP reply from the address inside the vrf.

kind regards
Pshem

2009/6/3 Amjad Ul Hasnain Qasmi <zhqasmi at cyber.net.pk>:
> Try enabling " mpls ip propagate-ttl "
> http://www.cisco.com/en/US/docs/ios/12_3/switch/command/reference/swi_m2.htm
> l#wp1058956
>
> Regards,
> AHQ
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Pshem Kowalczyk
> Sent: Wednesday, June 03, 2009 8:27 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ICMP replay from egress PE
>
> Hi,
>
> Recently we've upgraded some of our 7301 to ASR (1004). Config
> remained pretty much the same (from L3VPNs perspective), but it looks
> like the behaviour of both platforms is somewhat different. I'm not
> sure if it's a feature or a bug yet.
>
> We have a typical setup, like this:
> CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
>                        |              |
>                        + --- PE3 --- CE3
>
> So customers site is multihomed via PE2 and PE3 and has internal
> connection between CE2 and CE3
>
> With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
> (egress interface from the vrf), after the upgrade to ASRs - all we
> can see is PE1's IP and then straight CE2/CE3, but since customer
> drops icmp packets - we can't really see which way it's really going.
> Is there a way to get an ICMP reply from the egress ASR? I understand
> it switches the packets out through the interface without actually
> doing any lookups, but even after forcing 'label-per-vrf' we can't see
> the last hop.
> Any ideas if this behaviour can be corrected?
>
> kind regards
> Pshem
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>


From gert at greenie.muc.de  Wed Jun  3 03:16:09 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 3 Jun 2009 09:16:09 +0200
Subject: [c-nsp] hung vty on SXH3a?
Message-ID: <20090603071609.GY290@greenie.muc.de>

Hi,

so far, we have been quite happy with SXH3a, but today two of our boxes
have started playing games with me...  notably, the command we use to
auto-upload ACLs etc

   rcp new_config.txt router:running-config

started to fail with "rcp: running-config: No such file or directory".

On other boxes, it works "as usual".  All the "ip rcmd" config is present
and sane.

The only thing that looks different is this:

Cisco#who
    Line       User       Host(s)              Idle       Location
   1 vty 0                Virtual Exec         00:00:00   
*  2 vty 1     gert       idle                 00:00:00 mgmthost

  Interface      User        Mode                     Idle     Peer Address

Cisco#

- "vty 0" looks weird.  I can't find a way to recover that vty, that is
"clear line 1" or "clear line vty 0" don't change anything.  Nor is there
a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
"show tcb vty 0" doesn't display anything).


So... is this a known bug in SXH3a?  Is there a way to reclaim that VTY
without rebooting?

(I've also tried configuring "transport input none" under "line vty 0", 
and to completely disable "ip rcmd ..." to get rid of the session, but no 
change either).

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090603/50c6f5ed/attachment.bin>

From pshem.k at gmail.com  Wed Jun  3 04:30:02 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Wed, 3 Jun 2009 20:30:02 +1200
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <010001c9e412$0369a810$0a3cf830$@net.pk>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com> 
	<00f601c9e3fd$aeb52d30$0c1f8790$@net.pk>
	<20fe625b0906022200h31a74b7ei399dbf870d499636@mail.gmail.com> 
	<010001c9e412$0369a810$0a3cf830$@net.pk>
Message-ID: <20fe625b0906030130o16aedbf1we98d8db9dc920ca1@mail.gmail.com>

Hi,

That setup (without ttl propagation) works fine on 7301. I would like
to know if its possible to achieve the same result using and ASR1004.
Since we are not talking here about only one customer, or one person
that need to troubleshoot the problems having the previous behaviour
back is definitely the best option.

kind regards
Pshem


2009/6/3 Amjad Ul Hasnain Qasmi <zhqasmi at cyber.net.pk>:
> As per my understanding of your issue, you want to keep your mpls domain hidden from customer perspective but at the same time you want your egress LER to be appeared in traceroute. you may need to to disable TTL propagation for forwarded packets (VPN traffic), use "no mpls ip propagate forwarded" on LERs, this allows the structure of the MPLS network to be hidden from customers, but not the provider.
>
> Regards,
> AHQ
>
>
>
> -----Original Message-----
> From: Pshem Kowalczyk [mailto:pshem.k at gmail.com]
> Sent: Wednesday, June 03, 2009 11:00 AM
> To: Amjad Ul Hasnain Qasmi
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] ICMP replay from egress PE
>
> Hi,
>
> If I do that I'll see the 'MPLS' hops, which I don't want. All I would
> like to see is ICMP reply from the address inside the vrf.
>
> kind regards
> Pshem
>
> 2009/6/3 Amjad Ul Hasnain Qasmi <zhqasmi at cyber.net.pk>:
>> Try enabling " mpls ip propagate-ttl "
>> http://www.cisco.com/en/US/docs/ios/12_3/switch/command/reference/swi_m2.htm
>> l#wp1058956
>>
>> Regards,
>> AHQ
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Pshem Kowalczyk
>> Sent: Wednesday, June 03, 2009 8:27 AM
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] ICMP replay from egress PE
>>
>> Hi,
>>
>> Recently we've upgraded some of our 7301 to ASR (1004). Config
>> remained pretty much the same (from L3VPNs perspective), but it looks
>> like the behaviour of both platforms is somewhat different. I'm not
>> sure if it's a feature or a bug yet.
>>
>> We have a typical setup, like this:
>> CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
>> ? ? ? ? ? ? ? ? ? ? ? ?| ? ? ? ? ? ? ?|
>> ? ? ? ? ? ? ? ? ? ? ? ?+ --- PE3 --- CE3
>>
>> So customers site is multihomed via PE2 and PE3 and has internal
>> connection between CE2 and CE3
>>
>> With 7301 Traceroute from CE1 used to show the IP of PE2 or PE3
>> (egress interface from the vrf), after the upgrade to ASRs - all we
>> can see is PE1's IP and then straight CE2/CE3, but since customer
>> drops icmp packets - we can't really see which way it's really going.
>> Is there a way to get an ICMP reply from the egress ASR? I understand
>> it switches the packets out through the interface without actually
>> doing any lookups, but even after forcing 'label-per-vrf' we can't see
>> the last hop.
>> Any ideas if this behaviour can be corrected?
>>
>> kind regards
>> Pshem
>> _______________________________________________
>> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>
>
>

From peter at rathlev.dk  Wed Jun  3 04:29:59 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Wed, 03 Jun 2009 10:29:59 +0200
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <20090603071609.GY290@greenie.muc.de>
References: <20090603071609.GY290@greenie.muc.de>
Message-ID: <1244017799.3444.41.camel@localhost.localdomain>

On Wed, 2009-06-03 at 09:16 +0200, Gert Doering wrote:
...
> Cisco#who
>     Line       User       Host(s)              Idle       Location
>    1 vty 0                Virtual Exec         00:00:00   
> *  2 vty 1     gert       idle                 00:00:00 mgmthost
> 
>   Interface      User        Mode                     Idle     Peer Address
> 
> Cisco#
> 
> - "vty 0" looks weird.  I can't find a way to recover that vty, that is
> "clear line 1" or "clear line vty 0" don't change anything.  Nor is there
> a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
> "show tcb vty 0" doesn't display anything).

I've seen this on a 3560 when I tried running an exec command needing
user input via TFTP uploaded configuration. (Specifically I tried to do
a "do delete flash:/something" as a test.)

The session never recovered and only a hard reset (power off) could fix
it. The "reload" command didn't work. It was accepted, but nothing
happened. Needless to say, I just went on with my life and ignored
this. :-)

No strange commands were present in the "new_config.txt" copied over?

Regards,
Peter



From gert at greenie.muc.de  Wed Jun  3 04:47:53 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 3 Jun 2009 10:47:53 +0200
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <1244017799.3444.41.camel@localhost.localdomain>
References: <20090603071609.GY290@greenie.muc.de>
	<1244017799.3444.41.camel@localhost.localdomain>
Message-ID: <20090603084753.GZ290@greenie.muc.de>

Hi,

On Wed, Jun 03, 2009 at 10:29:59AM +0200, Peter Rathlev wrote:
> > - "vty 0" looks weird.  I can't find a way to recover that vty, that is
> > "clear line 1" or "clear line vty 0" don't change anything.  Nor is there
> > a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
> > "show tcb vty 0" doesn't display anything).
> 
> I've seen this on a 3560 when I tried running an exec command needing
> user input via TFTP uploaded configuration. (Specifically I tried to do
> a "do delete flash:/something" as a test.)

Mmmh.  I'm not sure what my colleagues tried - I just found the box in
this state...

> The session never recovered and only a hard reset (power off) could fix
> it. The "reload" command didn't work. It was accepted, but nothing
> happened. Needless to say, I just went on with my life and ignored
> this. :-)

Now *that* is scary.  Sounds something really got stuck on your box.

Well.  Time to reload, and upgrade to SXI...

> No strange commands were present in the "new_config.txt" copied over?

It wasn't *my* new_config.txt, otherwise all the other SXH3a boxes would
be in the same funny state now as well (and they aren't).  Just two of
them...

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090603/7ae93e4a/attachment.bin>

From Kris.Amy at EIP.net.au  Wed Jun  3 04:59:35 2009
From: Kris.Amy at EIP.net.au (Kris Amy)
Date: Wed, 3 Jun 2009 18:59:35 +1000
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <20090603084753.GZ290@greenie.muc.de>
Message-ID: <C64C7897.3EC5B%kris.amy@eip.net.au>

Hi,

I have something similar on a 7200 running 12.3(24a).

    Line       User       Host(s)              Idle       Location
   2 vty 0                idle                    14w6d A.B.C.D

I just haven't got around to reloading the router as this seems the only way to clear the vty.

Cheers,
Kris

On 3/06/09 6:47 PM, "Gert Doering" <gert at greenie.muc.de> wrote:

Hi,

On Wed, Jun 03, 2009 at 10:29:59AM +0200, Peter Rathlev wrote:
> > - "vty 0" looks weird.  I can't find a way to recover that vty, that is
> > "clear line 1" or "clear line vty 0" don't change anything.  Nor is there
> > a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
> > "show tcb vty 0" doesn't display anything).
>
> I've seen this on a 3560 when I tried running an exec command needing
> user input via TFTP uploaded configuration. (Specifically I tried to do
> a "do delete flash:/something" as a test.)

Mmmh.  I'm not sure what my colleagues tried - I just found the box in
this state...

> The session never recovered and only a hard reset (power off) could fix
> it. The "reload" command didn't work. It was accepted, but nothing
> happened. Needless to say, I just went on with my life and ignored
> this. :-)

Now *that* is scary.  Sounds something really got stuck on your box.

Well.  Time to reload, and upgrade to SXI...

> No strange commands were present in the "new_config.txt" copied over?

It wasn't *my* new_config.txt, otherwise all the other SXH3a boxes would
be in the same funny state now as well (and they aren't).  Just two of
them...

gert
--
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de


--
Kind Regards,
Kris Amy
Enterprise IP
Phone:    07 3123 5510
National: 1300 347 287
Fax:      1300 347 329
Direct:   07 3123 5511
Email:    kris.amy at eip.net.au

From achatz at forthnet.gr  Wed Jun  3 08:14:58 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 03 Jun 2009 15:14:58 +0300
Subject: [c-nsp] Ingress policing on a 3560
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A622FF0389D9@exch2k7.gilat.local>
References: <63266.172.25.144.4.1243823930.squirrel@imap.snnap.net>
	<EC993E87D960A541A66BF21D62AA42A622FF0389D9@exch2k7.gilat.local>
Message-ID: <4A266942.1030708@forthnet.gr>

Yep, that is a known way for matching ALL "by-default untrusted" traffic.

--
Tassos

Ziv Leyes wrote on 02/06/2009 15:43:
> I'm applying the same you need using dscp instead of mac for "all traffic" and it's working good, here's a sample:
> 
> class-map match-all ALL-TRAFFIC
>   match ip dscp 0
> !
> policy-map 7-MEGA
>   class ALL-TRAFFIC
>     police 7168000 1344000 exceed-action drop
> 
> !
> interface FastEthernet0/1
> description 7 Megabit rated interface sample
> service-policy input 7-MEGA
> !
> 
> 
> 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Tom Storey
> Sent: Monday, June 01, 2009 5:39 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Ingress policing on a 3560
> 
> Hi all.
> 
> What I'm trying to do is police ingress on a port, using a MAC ACL to
> match traffic to police (just a "permit any any" to match all traffic).
> 
> But what I'm getting is that the switch doesnt appear to be matching any
> traffic at all.
> 
> sw2#sh int gi0/14 | inc put rate
>   30 second input rate 20449000 bits/sec, 1688 packets/sec
>   30 second output rate 2620000 bits/sec, 1690 packets/sec
> sw2#sh policy-map int gi0/14
>  GigabitEthernet0/14
> 
>   Service-policy input: police-10mbit-in
> 
>     Class-map: mac-any-any (match-any)
>       0 packets, 0 bytes
>       30 second offered rate 0 bps, drop rate 0 bps
>       Match: access-group name mac-any-any
>         0 packets, 0 bytes
>         30 second rate 0 bps
> 
>     Class-map: class-default (match-any)
>       0 packets, 0 bytes
>       30 second offered rate 0 bps, drop rate 0 bps
>       Match: any
>         0 packets, 0 bytes
>         30 second rate 0 bps
> 
> Does anyone have any pointers as to what I'm doing wrong? Below is my config.
> 
> mac access-list extended mac-any-any
>  permit any any
> !
> class-map match-any mac-any-any
>  match access-group name mac-any-any
> !
> policy-map police-10mbit-in
>  class mac-any-any
>   police 10000000 1000000 exceed-action drop
> !
> interface GigabitEthernet0/14
>  service-policy input police-10mbit-in
> !
> 
> Ive also tried with just class-default, but got the same result.
> 
> I am currently using the "vlan" SDM profile, if that makes any difference.
> 
> Cheers,
> Tom
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
>  
>  
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
> 
> 
>  
>  
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From ip at ioshints.info  Wed Jun  3 08:23:17 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Wed, 3 Jun 2009 14:23:17 +0200
Subject: [c-nsp] ICMP replay from egress PE
In-Reply-To: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
References: <20fe625b0906021926x3e0065aficf005b0a86f3e0c4@mail.gmail.com>
Message-ID: <000d01c9e446$14212550$0a00000a@nil.si>

The only reason I could see for this behavior is the per-platform specific
IP packet processing on the egress PE router.

Obviously the difference between the 7300 and the ASR is the exact moment at
which the TTL is decrememented in the switching path. Based on your
description, ASR decrements TTL before LFIB lookup is performed and thus
decrements the label TTL, whereas the 7301 decrements TTL after the LFIB
lookup causes the VPN label to be popped exposing the IP packet and thus
decrements IP TTL.

I am not sure you can get what you used to have with the ASRs.

You could still, though, ping the PE2/PE3 in-VRF IP address from CE1 to
verify that the PE-CE links are up (and I'm positive you know all this), but
obviously cannot perform end-to-end path verification if CE2/CE3 block
traceroute probes. How about inspecting the VRF routing table on PE1? Do you
have access to it?

Interesting behavior, thanks for sharing it!
Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/
 

> -----Original Message-----
> From: Pshem Kowalczyk [mailto:pshem.k at gmail.com] 
> Sent: Wednesday, June 03, 2009 4:27 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ICMP replay from egress PE
> 
> Hi,
> 
> Recently we've upgraded some of our 7301 to ASR (1004). 
> Config remained pretty much the same (from L3VPNs 
> perspective), but it looks like the behaviour of both 
> platforms is somewhat different. I'm not sure if it's a 
> feature or a bug yet.
> 
> We have a typical setup, like this:
> CE1 --- PE1 --- P1 --- P2 --- PE2 --- CE2
>                         |              |
>                         + --- PE3 --- CE3
> 
> So customers site is multihomed via PE2 and PE3 and has 
> internal connection between CE2 and CE3
> 
> With 7301 Traceroute from CE1 used to show the IP of PE2 or 
> PE3 (egress interface from the vrf), after the upgrade to 
> ASRs - all we can see is PE1's IP and then straight CE2/CE3, 
> but since customer drops icmp packets - we can't really see 
> which way it's really going.
> Is there a way to get an ICMP reply from the egress ASR? I 
> understand it switches the packets out through the interface 
> without actually doing any lookups, but even after forcing 
> 'label-per-vrf' we can't see the last hop.
> Any ideas if this behaviour can be corrected?
> 
> kind regards
> Pshem
> 
> 


From panocisco77 at gmail.com  Wed Jun  3 09:45:14 2009
From: panocisco77 at gmail.com (Renelson Panosky)
Date: Wed, 3 Jun 2009 09:45:14 -0400
Subject: [c-nsp] IPV6 implementation
Message-ID: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>

I am getting ready to start running IPV6 on my core routers, i have a couple
questions for the people who already have IPV6 running

1. Should I let computers determine their own IPV6 addresses ?

2. Should I procure IPV6 DHCP Appliance ?

or

3. Should i configure my router to act as the IPV6 DHCP Servers?



Renelson

From jcposeidon at cantv.net  Wed Jun  3 09:52:01 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 03 Jun 2009 09:22:01 -0430
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU Load?
Message-ID: <4A268001.8030101@cantv.net>

Guys

    I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor 
stuff) and we are thinking about change the IO/7200-2FE by one 
IO/7200-GE could this help with this load?

Thanks

From rick at woofpaws.com  Wed Jun  3 10:15:41 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Wed, 3 Jun 2009 07:15:41 -0700 (PDT)
Subject: [c-nsp] Revisiting ethernet bandwidth management
In-Reply-To: <14260C2D-D4D0-41C9-A506-120AFA1B52A4@arbor.net>
References: <58184.172.16.5.57.1244004847.squirrel@www.woofpaws.com>
	<14260C2D-D4D0-41C9-A506-120AFA1B52A4@arbor.net>
Message-ID: <44037.69.30.17.85.1244038541.squirrel@www.woofpaws.com>


Any specific ASIC-based switch in mind?

What I've found (so far) with QoS is that it's generally ingress-only or
prioritization/congestion-management rather than bandwidth control.  I'm
quite willing to be corrected, though. :)

Rick


On Tue, June 2, 2009 22:37, Roland Dobbins wrote:
>
> On Jun 3, 2009, at 11:54 AM, Rick Ernst wrote:
>
>> Am I missing a feature/device/configuration that is obvious to
>> somebody
>> else, or.... ?
>
> Have you considered going with ASIC-based switches and make use of the
> QoS functionality, so you aren't CPU-bound?
>
> -----------------------------------------------------------------------
> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>
>          Unfortunately, inefficiency scales really well.
>
> 		   -- Kevin Lawton
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>


From pdavis at i2k.com  Wed Jun  3 10:21:20 2009
From: pdavis at i2k.com (Phil Davis)
Date: Wed, 03 Jun 2009 10:21:20 -0400
Subject: [c-nsp] PA-A3-T3 FEBE and LOS
In-Reply-To: <4A2572DD.3000506@i2k.com>
References: <4A2572DD.3000506@i2k.com>
Message-ID: <4A2686E0.9080207@i2k.com>

Phil Davis wrote:
> Hello,
>
>  I have an ATM DS3 coming through a PA-A3-T3. The last few days it 
> would abruptly go down for 5-10 minutes, perhaps every 12 hours on 
> average. During these times, the interface would show rapidly growing 
> carrier signal loss (about 10-20/sec.) I also saw incrementing FEBE 
> errors. However, neither the provider, nor a third-party transport 
> provider was detecting LOS on the line...<>

Just wanted to add to this. Overnight we saw the same issue with the 
replacement card, so I don't think it's our equipment. I now have some 
statistics that show the carrier transition/febe errors. I'm at a loss 
to fully interpret the sh controllers atm command. What is the first 
column on PLPC errors? Would appreciate any help I could get on this. 
Thanks!

Phil

sh int ATM1/0:
ATM1/0 is up, line protocol is up
  Hardware is ENHANCED ATM PA
  MTU 4470 bytes, sub MTU 4470, BW 40704 Kbit, DLY 190 usec,
     reliability 255/255, txload 204/255, rxload 29/255
  Encapsulation ATM, loopback not set
  Encapsulation(s): AAL5
  4095 maximum active VCs, 32 current VCCs
  VC Auto Creation Disabled.
  VC idle disconnect time: 300 seconds
  74 carrier transitions
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters 22:12:59
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 4673
  Queueing strategy: Per VC Queueing
  5 minute input rate 4695000 bits/sec, 2630 packets/sec
  5 minute output rate 32647000 bits/sec, 3750 packets/sec
     132076194 packets input, 900144269 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     38 input errors, 38 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     174968028 packets output, 1377286139 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out

I do see some CRC errors now, which did not see previously. That may be 
from insertion.

sh controller atm 1/0:
Interface ATM1/0 is up
Hardware is ENHANCED ATM PA - DS3 (45000Kbps)
Framer is PMC PM7345 S/UNI-PDH, SAR is LSI ATMIZER II
Firmware rev: G153, Framer rev: 1, ATMIZER II rev: 3
  idb=0x63A1F0D4, ds=0x63A491E0, vc=0x63A572E0
  slot 1, unit 1, subunit 0, fci_type 0x005B, ticks 79887
  1200 rx buffers: size=512, encap=64, trailer=28, magic=4
Curr Stats:
  VCC count: current=32, peak=32
  AAL2 VCC count: 0
  AAL2 TX no buffer count: 0
  AAL2 RX no buffer count: 0
  SAR crashes: Rx SAR=0, Tx SAR=0
  rx_cell_lost=0, rx_no_buffer=0, rx_crc_10=0, rx_no_mem=0
  rx_cell_len=0, rx_no_vcd=34410, rx_cell_throttle=0, tx_aci_err=0
Rx Free Ring status:
  base=0x3CA7C040, size=2048, write=400
Rx Compl Ring status:
  base=0x7E4DB7E0, size=2048, read=1662
Tx Ring status:
  base=0x3CF13A40, size=8192, write=312
Tx Compl Ring status:
  base=0x0E1B3840, size=4096, read=156
BFD Cache status:
  base=0x65F45940, size=6144, read=6143
Rx Cache status:
  base=0x64458360, size=16, write=14
Tx Shadow status:
  base=0x66691E60, size=8192, read=303, write=312
Control data:
  rx_max_spins=42, max_tx_count=144, tx_count=9
  rx_threshold=800, rx_count=14, tx_threshold=4608
  tx bfd write indx=0x10DF, rx_pool_info=0x63A208C0
Control data base address:
       rx_buf_base = 0x0E3A6C80        rx_p_base = 0x66802E80
            rx_pak = 0x639727DC              cmd = 0x64752080
            framer = 0x60479798        framer_cb = 0x6474FB80
       framer_base = 0x3C900000     pci_pa_stats = 0x7E391900
    device_base[0] = 0x3C800000   device_base[1] = 0x3CC00000
     ssram_base[0] = 0x3CA00000    ssram_base[1] = 0x3CE00000
     sdram_base[0] = 0x3CB00000    sdram_base[1] = 0x3CF00000
     pa_cmd_buf[0] = 0x3CA7FC00    pa_cmd_buf[1] = 0x3CE7FC00
       vcd_base[0] = 0x3CA00000      vcd_base[1] = 0x3CE18000
      chip_dump[0] = 0x0E39192C     chip_dump[1] = 0x0E391A2C
   sar_buf_base[0] = 0x3CB24000  sar_buf_base[1] = 0x3CF1C000
       bfd_base[0] = 0x3CA64000      bfd_base[1] = 0x3CE00000
       acd_base[0] = 0x3CA22080      acd_base[1] = 0x3CE38240
Framer Information:
 Framing mode: DS3 C-bit PLCP
 No alarm detected
Facility statistics: current interval elapsed 687 seconds
          lcv       fbe       ezd        pe       ppe      febe      hcse
   ----------------------------------------------------------------------
21          2         0         1         1         1         0         0
25          2         0         1         0         0         0         0
33          0         0         0         0         0    865055         0
34          0         0         0         0         0   5002913         0
38          0         0         0         0         0   7526033         0
39          0         0         0         0         0   3415647         0
40          0         0         0         0         0   1498637         0
42          0         0         0         0         0    217324         0
44          0         0         0         0         0   2972255         0
68          2         0         1         0         0         0         0
78          1         0         1         1         1         0         0

PLCP Errors:
         bipe       fbe      febe
    -----------------------------
21          1         0         0
25          2         0         0
33          0         0     65655
34          0         0    272680
38          0         0   1744705
39          0         0   2043937
40          0         0    957544
42          0         0     21423
44          0         0    866414
68          1         0         0
78          1         0         0

   lcv:  Line Code Violation
   fbe:  Framing Bit Error
   ezd:  Summed Excessive Zeros
   pe:   Parity Error
   ppe:  Path Parity Error
   febe: Far-end Block Error
   hcse: Rx Cell HCS Error
   bipe: Bit Interleave Parity (B1) Error




From gert at greenie.muc.de  Wed Jun  3 10:34:15 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 3 Jun 2009 16:34:15 +0200
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <4A268001.8030101@cantv.net>
References: <4A268001.8030101@cantv.net>
Message-ID: <20090603143415.GC290@greenie.muc.de>

Hi,

On Wed, Jun 03, 2009 at 09:22:01AM -0430, Juan C. Crespo R. wrote:
>    I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor 
> stuff) and we are thinking about change the IO/7200-2FE by one 
> IO/7200-GE could this help with this load?

No.  This is a CPU-based platform - the only way to reduce the CPU load
is to get a faster CPU or turn off features.

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090603/5e23730e/attachment.bin>

From trejrco at gmail.com  Wed Jun  3 10:27:58 2009
From: trejrco at gmail.com (TJ)
Date: Wed, 3 Jun 2009 10:27:58 -0400
Subject: [c-nsp] IPV6 implementation
In-Reply-To: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>
References: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>
Message-ID: <005a01c9e457$a7456380$f5d02a80$@com>

Short answer - it depends.

Quick thoughts:
	1) SLAAC can suffice, assuming IPv4 is present to "cheat" off of for
DNS/name resolution.  
	   Or if/when RFC5006 gets more widely supported.
	
	2) Maybe, see next comment :).
	
	3) DHCPv6 client and server support is not exactly 100% available on
all platforms, atleast 
	   not natively (3rd party apps exist, e.g. - Dibbler).  Many
routers currently support 
	   stateless DHCPv6 server functionality only ... not stateful.


HTH!
/TJ


>-----Original Message-----
>From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
>bounces at puck.nether.net] On Behalf Of Renelson Panosky
>Sent: Wednesday, June 03, 2009 9:45 AM
>To: cisco-nsp at puck.nether.net
>Subject: [c-nsp] IPV6 implementation
>
>I am getting ready to start running IPV6 on my core routers, i have a
couple
>questions for the people who already have IPV6 running
>
>1. Should I let computers determine their own IPV6 addresses ?
>
>2. Should I procure IPV6 DHCP Appliance ?
>
>or
>
>3. Should i configure my router to act as the IPV6 DHCP Servers?
>
>
>
>Renelson
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/


From dgranzer at gmail.com  Wed Jun  3 10:49:01 2009
From: dgranzer at gmail.com (David Granzer)
Date: Wed, 3 Jun 2009 16:49:01 +0200
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <4A268001.8030101@cantv.net>
References: <4A268001.8030101@cantv.net>
Message-ID: <844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>

Hi,

could you post how much bandwidth and packet per second your 7200 ?
Generally upgrade to I/O GE will not
help much because the performance is based on the NPE used.

regards,
David


On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R. <jcposeidon at cantv.net> wrote:
> Guys
>
> ? I have one POP with 90% of CPU Load (WCCP2, ?QoS and other minor stuff)
> and we are thinking about change the IO/7200-2FE by one IO/7200-GE could
> this help with this load?
>
> Thanks
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From jcposeidon at cantv.net  Wed Jun  3 11:01:10 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 03 Jun 2009 10:31:10 -0430
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
Message-ID: <4A269036.3080507@cantv.net>

It have

int fa0/0
  30 second input rate 30616000 bits/sec, 13300 packets/sec
  30 second output rate 47680000 bits/sec, 12178 packets/sec

int fa 0/1
  30 second input rate 27478000 bits/sec, 4672 packets/sec
  30 second output rate 19071000 bits/sec, 3774 packets/sec

int ser4/0 (ds3 link)
 30 second input rate 43264000 bits/sec, 11862 packets/sec
 30 second output rate 28832000 bits/sec, 13590 packets/sec

59376 Total

Thanks

David Granzer escribi?:
> Hi,
>
> could you post how much bandwidth and packet per second your 7200 ?
> Generally upgrade to I/O GE will not
> help much because the performance is based on the NPE used.
>
> regards,
> David
>
>
> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R. <jcposeidon at cantv.net> wrote:
>   
>> Guys
>>
>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor stuff)
>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE could
>> this help with this load?
>>
>> Thanks
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>     
>
>   

From lists at quux.de  Wed Jun  3 11:09:11 2009
From: lists at quux.de (Jens Link)
Date: Wed, 03 Jun 2009 17:09:11 +0200
Subject: [c-nsp] IPV6 implementation
In-Reply-To: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>
	(Renelson Panosky's message of "Wed\,
	3 Jun 2009 09\:45\:14 -0400")
References: <16e2ac180906030645h715b1de4y20faa49070410d49@mail.gmail.com>
Message-ID: <87oct5z754.fsf@laphroiag.quux.de>

Renelson Panosky <panocisco77 at gmail.com> writes:

> I am getting ready to start running IPV6 on my core routers, i have a couple
> questions for the people who already have IPV6 running
>
> 1. Should I let computers determine their own IPV6 addresses ?

Yes and no. For end user computers I would use SLAC (or maybe DCHPv6), for
servers, printers, ... static addresses

> 2. Should I procure IPV6 DHCP Appliance ?
>
> or
>
> 3. Should i configure my router to act as the IPV6 DHCP Servers?

Well that depends on how big your network is and if you have one group
managing DHCP and the other managing the routers. A *NIX (or Windows)
Sever will work just fine, it's more transparent, easier to troubleshoot
and yo probably get security updates faster.

cheers 

Jens
--
-------------------------------------------------------------------------
| Foelderichstr. 40  | 13595 Berlin, Germany | +49-151-18721264         |
| http://www.quux.de | http://blog.quux.de   | jabber: jenslink at guug.de |
-------------------------------------------------------------------------

From masood at nexlinx.net.pk  Wed Jun  3 12:24:15 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Wed, 3 Jun 2009 21:24:15 +0500 (PKT)
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A269036.3080507@cantv.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
Message-ID: <25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>

cisco 7200 is a software based router so that every packet is punted to
the NPE. You need to replace your NPE instead of PIC. which cisco 7200
series network processing engine you are running? what you get when do
"show version" on this router? By using 'show processes cpu sorted 1min'
you can check which process is eating NPE cpu cycles.

Regards,
Masood


> It have
>
> int fa0/0
>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>
> int fa 0/1
>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>
> int ser4/0 (ds3 link)
>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>
> 59376 Total
>
> Thanks
>
> David Granzer escribi?:
>> Hi,
>>
>> could you post how much bandwidth and packet per second your 7200 ?
>> Generally upgrade to I/O GE will not
>> help much because the performance is based on the NPE used.
>>
>> regards,
>> David
>>
>>
>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R. <jcposeidon at cantv.net>
>> wrote:
>>
>>> Guys
>>>
>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>> stuff)
>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>> could
>>> this help with this load?
>>>
>>> Thanks
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>>
>>
>>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From jcposeidon at cantv.net  Wed Jun  3 11:26:05 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 03 Jun 2009 10:56:05 -0430
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <4A26960D.8070206@cantv.net>

NPE 400

CPU utilization for five seconds: 76%/75%; one minute: 74%; five 
minutes: 75%
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  45   210365012  85449013       2461  0.23%  0.19%  0.19%   0 IP Input
 118    99161264 248440739        399  0.23%  0.08%  0.06%   0 traffic_shape
  18    19988356  29194664        684  0.00%  0.03%  0.02%   0 ARP Input
   4    49353040   2274191      21701  0.00%  0.03%  0.04%   0 Check heaps
  10    11268080  11331204        994  0.00%  0.02%  0.00%   0 EnvMon
  63     8535512  47262546        180  0.07%  0.01%  0.00%   0 Spanning Tree
  29    19555460    389652      50187  0.00%  0.01%  0.00%   0 
Per-minute Jobs
   5     6393048    430645      14845  0.07%  0.00%  0.00%   0 Pool Manager
 119    14495556   1901716       7622  0.00%  0.00%  0.00%   0 MFI LFD 
Timer Pr
  59     5397356   1127172       4788  0.00%  0.00%  0.00%   0 WCCP V2 
Protocol
  11           0         1          0  0.00%  0.00%  0.00%   0 OIR Handler
  12        7912    190100         41  0.00%  0.00%  0.00%   0 IPC 
Dynamic Cach
  13           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone 
Manager
  14     1344312  11329870        118  0.00%  0.00%  0.00%   0 IPC 
Periodic Tim
  15     1196200  11329850        105  0.00%  0.00%  0.00%   0 IPC 
Deferred Por
  16           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat 
Manager
  17       44772   1140352         39  0.00%  0.00%  0.00%   0 Compute 
SRP rate
   9           0         1          0  0.00%  0.00%  0.00%   0 Policy 
Manager
  19           0        28          0  0.00%  0.00%  0.00%   0 DDR Timers
  20           0         2          0  0.00%  0.00%  0.00%   0 Dialer event
  21           0         2          0  0.00%  0.00%  0.00%   0 Entity 
MIB API
  22           0         1          0  0.00%  0.00%  0.00%   0 SERIAL 
A'detect
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  23      770388   2845739        270  0.00%  0.00%  0.00%   0 HC 
Counter Timer
  24        5264        22     239272  0.00%  0.00%  0.00%   0 Critical 
Bkgnd
  25     3963452   4658455        850  0.00%  0.00%  0.00%   0 Net 
Background
  26        6188      3016       2051  0.00%  0.00%  0.00%   0 Logger
  27     2206724  11329804        194  0.00%  0.00%  0.00%   0 TTY 
Background
  28    65577956  11340517       5782  0.00%  0.00%  0.00%   0 
Per-Second Jobs
   8      144284   2275716         63  0.00%  0.00%  0.00%   0 
ALARM_TRIGGER_SC
   7           0         2          0  0.00%  0.00%  0.00%   0 Serial 
Backgroun
  31           0         1          0  0.00%  0.00%  0.00%   0 CSP Timer
   6           0         2          0  0.00%  0.00%  0.00%   0 Timers
  33           0         2          0  0.00%  0.00%  0.00%   0 Hawkeye 
Backgrou
  34           0         1          0  0.00%  0.00%  0.00%   0 SONET 
alarm time
   3     3297860   3024757       1090  0.00%  0.00%  0.00%   0 OSPF Hello
  36           0         2          0  0.00%  0.00%  0.00%   0 VNM DSPRM 
MAIN
  37           0         1          0  0.00%  0.00%  0.00%   0 CES Line 
Conditi
  38           0         2          0  0.00%  0.00%  0.00%   0 Flash MIB 
Update
  39           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM Input
  40           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM TIMER
  41           8        86         93  0.00%  0.00%  0.00%   0 TurboACL
  42           0         2          0  0.00%  0.00%  0.00%   0 CEF 
switching ba
  43           0         1          0  0.00%  0.00%  0.00%   0 AC Switch
  44           0         2          0  0.00%  0.00%  0.00%   0 AAA 
Dictionary R
   2      635356   2279979        278  0.00%  0.00%  0.00%   0 Load Meter
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  46           0         1          0  0.00%  0.00%  0.00%   0 ICMP 
event handl
  47     1608916   1520006       1058  0.00%  0.00%  0.00%   0 CDP Protocol
  48     1785752   1202253       1485  0.00%  0.00%  0.00%   0 LDP
  49          16       175         91  0.00%  0.00%  0.00%   0 OLM
  50           0         1          0  0.00%  0.00%  0.00%   0 PPPATM 
Session d
  51           0         2          0  0.00%  0.00%  0.00%   0 PASVC 
create VA
  52        9512      1676       5675  0.00%  0.00%  0.00%   0 EEM ED Syslog
  53           0         2          0  0.00%  0.00%  0.00%   0 EEM ED SNMP
  54           0         2          0  0.00%  0.00%  0.00%   0 EEM ED 
Memory Th
  55       23596    202778        116  0.00%  0.00%  0.00%   0 EEM ED Timer
  56           0         2          0  0.00%  0.00%  0.00%   0 EEM ED 
Counter
  57           0         2          0  0.00%  0.00%  0.00%   0 EEM ED 
Interface
  58           0         3          0  0.00%  0.00%  0.00%   0 EEM ED IOSWD
  30           0         1          0  0.00%  0.00%  0.00%   0 Inode 
Table Dest
  32           0         2          0  0.00%  0.00%  0.00%   0 CES Timer
  61           0         1          0  0.00%  0.00%  0.00%   0 MPLS 
Auto-Tunnel
  62           0         1          0  0.00%  0.00%  0.00%   0 O-UNI 
Client Msg
  35           0         1          0  0.00%  0.00%  0.00%   0 POS APS 
Event Pr
  64           0         1          0  0.00%  0.00%  0.00%   0 AC Mgr
  65           0         1          0  0.00%  0.00%  0.00%   0 SSS Manager
  66           0         2          0  0.00%  0.00%  0.00%   0 SSM 
connection m
  67           0         1          0  0.00%  0.00%  0.00%   0 PPP IP 
Add Route
  68       90640    189720        477  0.00%  0.00%  0.00%   0 CEF 
background
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  69           0         1          0  0.00%  0.00%  0.00%   0 IP IRDP
   1           0         2          0  0.00%  0.00%  0.00%   0 Chunk Manager
  71     2091684    355745       5879  0.00%  0.00%  0.00%   0 IP Background
  72     2340232    344710       6788  0.00%  0.00%  0.00%   0 IP RIB Update
  73    69186296  16952818       4081  0.00%  0.00%  0.00%   0 CEF: IPv4 
proces
  74          24       122        196  0.00%  0.00%  0.00%   0 ADJ 
background
  75           0         1          0  0.00%  0.00%  0.00%   0 L2X Data 
Daemon
  76           0         1          0  0.00%  0.00%  0.00%   0 HTTP Timer
  77      646408    693913        931  0.00%  0.00%  0.00%   0 TCP Timer
  78         800       219       3652  0.00%  0.00%  0.00%   0 TCP Protocols
  79           0         1          0  0.00%  0.00%  0.00%   0 Probe Input
  80           0         1          0  0.00%  0.00%  0.00%   0 RARP Input
  81           0         1          0  0.00%  0.00%  0.00%   0 Socket Timers
  82           0         2          0  0.00%  0.00%  0.00%   0 LSP Tunnels
  83           0         1          0  0.00%  0.00%  0.00%   0 COPS
  84           0         1          0  0.00%  0.00%  0.00%   0 X.25 
Encaps Mana
  85           0         1          0  0.00%  0.00%  0.00%   0 PAD InCall
  86           0         2          0  0.00%  0.00%  0.00%   0 X.25 
Background
  87          88       375        234  0.00%  0.00%  0.00%   0 AToM manager
  88           0         5          0  0.00%  0.00%  0.00%   0 AToM LDP 
manager
  89       79992    190099        420  0.00%  0.00%  0.00%   0 LDP 
Background
  90           0         1          0  0.00%  0.00%  0.00%   0 L2X 
Socket proce
  91           0         1          0  0.00%  0.00%  0.00%   0 L2X SSS 
manager
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
  92           0         1          0  0.00%  0.00%  0.00%   0 L2TP mgmt 
daemon
  93          28       204        137  0.00%  0.00%  0.00%   0 TCP Listener
  94           4         1       4000  0.00%  0.00%  0.00%   0 TSP
  95           0         1          0  0.00%  0.00%  0.00%   0 VOIP RTP 
Udp Inp
  96           0         1          0  0.00%  0.00%  0.00%   0 
QOS_MODULE_MAIN
  97           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_HTSP
  98           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_R2
  99           0         1          0  0.00%  0.00%  0.00%   0 CCSWVOICE
 100       43864   1140167         38  0.00%  0.00%  0.00%   0 RMON 
Recycle Pro
 101           0         2          0  0.00%  0.00%  0.00%   0 RMON 
Deferred Se
 102           0         1          0  0.00%  0.00%  0.00%   0 SYSMGT Events
 103     1016848  11311292         89  0.00%  0.00%  0.00%   0 
cerf_daemon_proc
 104           0         1          0  0.00%  0.00%  0.00%   0 SONET Traps
 105      640712   2278427        281  0.00%  0.00%  0.00%   0 EEM Server
 106           0         1          0  0.00%  0.00%  0.00%   0 Syslog Traps
 107           0         1          0  0.00%  0.00%  0.00%   0 DATA 
Transfer Pr
 108           0         1          0  0.00%  0.00%  0.00%   0 DATA 
Collector
 109           0         1          0  0.00%  0.00%  0.00%   0 RMON Packets
 110           0         2          0  0.00%  0.00%  0.00%   0 EEM 
Policy Direc
 111     1019748  11311275         90  0.00%  0.00%  0.00%   0 trunk 
conditioni
 112           0         1          0  0.00%  0.00%  0.00%   0 trunk 
conditioni
 113      503088   3349106        150  0.00%  0.00%  0.00%   0 Net Input
 114     2325524   2279676       1020  0.00%  0.00%  0.00%   0 Compute 
load avg
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
 115       83736    766853        109  0.00%  0.00%  0.00%   0 LSP 
Tunnel Head
 116           0         2          0  0.00%  0.00%  0.00%   0 LSDp 
Input Proc
 117     1288824   2405686        535  0.00%  0.00%  0.00%   0 LSD Main Proc
  60           0         1          0  0.00%  0.00%  0.00%   0 LSP 
Tunnel FRR
  70           0         3          0  0.00%  0.00%  0.00%   0 SNMP Timers
 120           0         2          0  0.00%  0.00%  0.00%   0 MFI LFD 
Main Pro
 121     2593264  11627651        223  0.00%  0.00%  0.00%   0 NTP
 122     6873376   1817623       3781  0.00%  0.00%  0.00%   0 Tag Control
 123       21808    190119        114  0.00%  0.00%  0.00%   0 IPRM
 124           0         2          0  0.00%  0.00%  0.00%   0 IP Flow 
Backgrou
 125     4970232   4644514       1070  0.00%  0.00%  0.00%   0 OSPF Hello
 126     4203656   2503602       1679  0.00%  0.00%  0.00%   0 IP SNMP
 127      457588   1255865        364  0.00%  0.00%  0.00%   0 PDU 
DISPATCHER
 128     5118352   1257172       4071  0.00%  0.00%  0.00%   0 SNMP ENGINE
 129           0         1          0  0.00%  0.00%  0.00%   0 SNMP 
ConfCopyPro
 130           0         1          0  0.00%  0.00%  0.00%   0 SNMP Traps
 131       28584    190100        150  0.00%  0.00%  0.00%   0 Time 
Range Proce
 132           0         1          0  0.00%  0.00%  0.00%   0 xcpa-driver
 133        1208       274       4408  0.00%  0.00%  0.00%   0 Tagcon Addr
 134     4599240  11781205        390  0.00%  0.00%  0.00%   0 OSPF Router 1
 135     1168632  11563127        101  0.00%  0.00%  0.00%   0 OSPF Router 2
 136     7196544   6637085       1084  0.00%  0.00%  0.00%   0 TDP Hello
 137        2712      1138       2383  0.00%  0.00%  0.00%   0 RADIUS
 PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
 139         516       180       2866  0.00%  0.00%  0.00%   0 AAA 
Accounting
 140          60      1542         38  0.00%  0.00%  0.00%   2 Virtual Exec



masood at nexlinx.net.pk escribi?:
> cisco 7200 is a software based router so that every packet is punted to
> the NPE. You need to replace your NPE instead of PIC. which cisco 7200
> series network processing engine you are running? what you get when do
> "show version" on this router? By using 'show processes cpu sorted 1min'
> you can check which process is eating NPE cpu cycles.
>
> Regards,
> Masood
>
>
>   
>> It have
>>
>> int fa0/0
>>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>>
>> int fa 0/1
>>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>>
>> int ser4/0 (ds3 link)
>>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>>
>> 59376 Total
>>
>> Thanks
>>
>> David Granzer escribi?:
>>     
>>> Hi,
>>>
>>> could you post how much bandwidth and packet per second your 7200 ?
>>> Generally upgrade to I/O GE will not
>>> help much because the performance is based on the NPE used.
>>>
>>> regards,
>>> David
>>>
>>>
>>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R. <jcposeidon at cantv.net>
>>> wrote:
>>>
>>>       
>>>> Guys
>>>>
>>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>>> stuff)
>>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>>> could
>>>> this help with this load?
>>>>
>>>> Thanks
>>>> _______________________________________________
>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>
>>>>
>>>>         
>>>       
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>     
>
>
>
>   

From david.freedman at uk.clara.net  Wed Jun  3 11:32:08 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 03 Jun 2009 16:32:08 +0100
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
Message-ID: <h0651o$car$1@ger.gmane.org>

Has anybody come across this and if so are there any known workarounds?

Am keen to know under what circumstances an EFP does not get programmed
to the card, if anybody has any more information on this would be
appreciative of it online or offline.

Regards,

David Freedman


From sethm at rollernet.us  Wed Jun  3 11:35:31 2009
From: sethm at rollernet.us (Seth Mattinen)
Date: Wed, 03 Jun 2009 08:35:31 -0700
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A26960D.8070206@cantv.net>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
Message-ID: <4A269843.9070300@rollernet.us>

Juan C. Crespo R. wrote:
> NPE 400
> 

Upgrade the NPE, turn off features, or reduce the load. You can change
to a GE if you don't believe us, but you'll probably find it didn't help
anything.

~Seth

From masood at nexlinx.net.pk  Wed Jun  3 12:41:52 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Wed, 3 Jun 2009 21:41:52 +0500 (PKT)
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A26960D.8070206@cantv.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
Message-ID: <46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>

cisco 7200 NPE-400 is normally for customer premise equipment and DS1/DS3
aggregation. As per cisco performance of up to 400 kpps in cef switching.

You can upgrade to NPE-G1 which provides performance of up to 1 million
packets per second in cef switching (an increase of up to 250 percent over
the cisco 7200 series npe 400)

Regards,
Masood

> NPE 400
>
> CPU utilization for five seconds: 76%/75%; one minute: 74%; five
> minutes: 75%
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   45   210365012  85449013       2461  0.23%  0.19%  0.19%   0 IP Input
>  118    99161264 248440739        399  0.23%  0.08%  0.06%   0
> traffic_shape
>   18    19988356  29194664        684  0.00%  0.03%  0.02%   0 ARP Input
>    4    49353040   2274191      21701  0.00%  0.03%  0.04%   0 Check heaps
>   10    11268080  11331204        994  0.00%  0.02%  0.00%   0 EnvMon
>   63     8535512  47262546        180  0.07%  0.01%  0.00%   0 Spanning
> Tree
>   29    19555460    389652      50187  0.00%  0.01%  0.00%   0
> Per-minute Jobs
>    5     6393048    430645      14845  0.07%  0.00%  0.00%   0 Pool
> Manager
>  119    14495556   1901716       7622  0.00%  0.00%  0.00%   0 MFI LFD
> Timer Pr
>   59     5397356   1127172       4788  0.00%  0.00%  0.00%   0 WCCP V2
> Protocol
>   11           0         1          0  0.00%  0.00%  0.00%   0 OIR Handler
>   12        7912    190100         41  0.00%  0.00%  0.00%   0 IPC
> Dynamic Cach
>   13           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone
> Manager
>   14     1344312  11329870        118  0.00%  0.00%  0.00%   0 IPC
> Periodic Tim
>   15     1196200  11329850        105  0.00%  0.00%  0.00%   0 IPC
> Deferred Por
>   16           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat
> Manager
>   17       44772   1140352         39  0.00%  0.00%  0.00%   0 Compute
> SRP rate
>    9           0         1          0  0.00%  0.00%  0.00%   0 Policy
> Manager
>   19           0        28          0  0.00%  0.00%  0.00%   0 DDR Timers
>   20           0         2          0  0.00%  0.00%  0.00%   0 Dialer
> event
>   21           0         2          0  0.00%  0.00%  0.00%   0 Entity
> MIB API
>   22           0         1          0  0.00%  0.00%  0.00%   0 SERIAL
> A'detect
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   23      770388   2845739        270  0.00%  0.00%  0.00%   0 HC
> Counter Timer
>   24        5264        22     239272  0.00%  0.00%  0.00%   0 Critical
> Bkgnd
>   25     3963452   4658455        850  0.00%  0.00%  0.00%   0 Net
> Background
>   26        6188      3016       2051  0.00%  0.00%  0.00%   0 Logger
>   27     2206724  11329804        194  0.00%  0.00%  0.00%   0 TTY
> Background
>   28    65577956  11340517       5782  0.00%  0.00%  0.00%   0
> Per-Second Jobs
>    8      144284   2275716         63  0.00%  0.00%  0.00%   0
> ALARM_TRIGGER_SC
>    7           0         2          0  0.00%  0.00%  0.00%   0 Serial
> Backgroun
>   31           0         1          0  0.00%  0.00%  0.00%   0 CSP Timer
>    6           0         2          0  0.00%  0.00%  0.00%   0 Timers
>   33           0         2          0  0.00%  0.00%  0.00%   0 Hawkeye
> Backgrou
>   34           0         1          0  0.00%  0.00%  0.00%   0 SONET
> alarm time
>    3     3297860   3024757       1090  0.00%  0.00%  0.00%   0 OSPF Hello
>   36           0         2          0  0.00%  0.00%  0.00%   0 VNM DSPRM
> MAIN
>   37           0         1          0  0.00%  0.00%  0.00%   0 CES Line
> Conditi
>   38           0         2          0  0.00%  0.00%  0.00%   0 Flash MIB
> Update
>   39           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
> Input
>   40           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
> TIMER
>   41           8        86         93  0.00%  0.00%  0.00%   0 TurboACL
>   42           0         2          0  0.00%  0.00%  0.00%   0 CEF
> switching ba
>   43           0         1          0  0.00%  0.00%  0.00%   0 AC Switch
>   44           0         2          0  0.00%  0.00%  0.00%   0 AAA
> Dictionary R
>    2      635356   2279979        278  0.00%  0.00%  0.00%   0 Load Meter
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   46           0         1          0  0.00%  0.00%  0.00%   0 ICMP
> event handl
>   47     1608916   1520006       1058  0.00%  0.00%  0.00%   0 CDP
> Protocol
>   48     1785752   1202253       1485  0.00%  0.00%  0.00%   0 LDP
>   49          16       175         91  0.00%  0.00%  0.00%   0 OLM
>   50           0         1          0  0.00%  0.00%  0.00%   0 PPPATM
> Session d
>   51           0         2          0  0.00%  0.00%  0.00%   0 PASVC
> create VA
>   52        9512      1676       5675  0.00%  0.00%  0.00%   0 EEM ED
> Syslog
>   53           0         2          0  0.00%  0.00%  0.00%   0 EEM ED SNMP
>   54           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
> Memory Th
>   55       23596    202778        116  0.00%  0.00%  0.00%   0 EEM ED
> Timer
>   56           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
> Counter
>   57           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
> Interface
>   58           0         3          0  0.00%  0.00%  0.00%   0 EEM ED
> IOSWD
>   30           0         1          0  0.00%  0.00%  0.00%   0 Inode
> Table Dest
>   32           0         2          0  0.00%  0.00%  0.00%   0 CES Timer
>   61           0         1          0  0.00%  0.00%  0.00%   0 MPLS
> Auto-Tunnel
>   62           0         1          0  0.00%  0.00%  0.00%   0 O-UNI
> Client Msg
>   35           0         1          0  0.00%  0.00%  0.00%   0 POS APS
> Event Pr
>   64           0         1          0  0.00%  0.00%  0.00%   0 AC Mgr
>   65           0         1          0  0.00%  0.00%  0.00%   0 SSS Manager
>   66           0         2          0  0.00%  0.00%  0.00%   0 SSM
> connection m
>   67           0         1          0  0.00%  0.00%  0.00%   0 PPP IP
> Add Route
>   68       90640    189720        477  0.00%  0.00%  0.00%   0 CEF
> background
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   69           0         1          0  0.00%  0.00%  0.00%   0 IP IRDP
>    1           0         2          0  0.00%  0.00%  0.00%   0 Chunk
> Manager
>   71     2091684    355745       5879  0.00%  0.00%  0.00%   0 IP
> Background
>   72     2340232    344710       6788  0.00%  0.00%  0.00%   0 IP RIB
> Update
>   73    69186296  16952818       4081  0.00%  0.00%  0.00%   0 CEF: IPv4
> proces
>   74          24       122        196  0.00%  0.00%  0.00%   0 ADJ
> background
>   75           0         1          0  0.00%  0.00%  0.00%   0 L2X Data
> Daemon
>   76           0         1          0  0.00%  0.00%  0.00%   0 HTTP Timer
>   77      646408    693913        931  0.00%  0.00%  0.00%   0 TCP Timer
>   78         800       219       3652  0.00%  0.00%  0.00%   0 TCP
> Protocols
>   79           0         1          0  0.00%  0.00%  0.00%   0 Probe Input
>   80           0         1          0  0.00%  0.00%  0.00%   0 RARP Input
>   81           0         1          0  0.00%  0.00%  0.00%   0 Socket
> Timers
>   82           0         2          0  0.00%  0.00%  0.00%   0 LSP Tunnels
>   83           0         1          0  0.00%  0.00%  0.00%   0 COPS
>   84           0         1          0  0.00%  0.00%  0.00%   0 X.25
> Encaps Mana
>   85           0         1          0  0.00%  0.00%  0.00%   0 PAD InCall
>   86           0         2          0  0.00%  0.00%  0.00%   0 X.25
> Background
>   87          88       375        234  0.00%  0.00%  0.00%   0 AToM
> manager
>   88           0         5          0  0.00%  0.00%  0.00%   0 AToM LDP
> manager
>   89       79992    190099        420  0.00%  0.00%  0.00%   0 LDP
> Background
>   90           0         1          0  0.00%  0.00%  0.00%   0 L2X
> Socket proce
>   91           0         1          0  0.00%  0.00%  0.00%   0 L2X SSS
> manager
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>   92           0         1          0  0.00%  0.00%  0.00%   0 L2TP mgmt
> daemon
>   93          28       204        137  0.00%  0.00%  0.00%   0 TCP
> Listener
>   94           4         1       4000  0.00%  0.00%  0.00%   0 TSP
>   95           0         1          0  0.00%  0.00%  0.00%   0 VOIP RTP
> Udp Inp
>   96           0         1          0  0.00%  0.00%  0.00%   0
> QOS_MODULE_MAIN
>   97           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_HTSP
>   98           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_R2
>   99           0         1          0  0.00%  0.00%  0.00%   0 CCSWVOICE
>  100       43864   1140167         38  0.00%  0.00%  0.00%   0 RMON
> Recycle Pro
>  101           0         2          0  0.00%  0.00%  0.00%   0 RMON
> Deferred Se
>  102           0         1          0  0.00%  0.00%  0.00%   0 SYSMGT
> Events
>  103     1016848  11311292         89  0.00%  0.00%  0.00%   0
> cerf_daemon_proc
>  104           0         1          0  0.00%  0.00%  0.00%   0 SONET Traps
>  105      640712   2278427        281  0.00%  0.00%  0.00%   0 EEM Server
>  106           0         1          0  0.00%  0.00%  0.00%   0 Syslog
> Traps
>  107           0         1          0  0.00%  0.00%  0.00%   0 DATA
> Transfer Pr
>  108           0         1          0  0.00%  0.00%  0.00%   0 DATA
> Collector
>  109           0         1          0  0.00%  0.00%  0.00%   0 RMON
> Packets
>  110           0         2          0  0.00%  0.00%  0.00%   0 EEM
> Policy Direc
>  111     1019748  11311275         90  0.00%  0.00%  0.00%   0 trunk
> conditioni
>  112           0         1          0  0.00%  0.00%  0.00%   0 trunk
> conditioni
>  113      503088   3349106        150  0.00%  0.00%  0.00%   0 Net Input
>  114     2325524   2279676       1020  0.00%  0.00%  0.00%   0 Compute
> load avg
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>  115       83736    766853        109  0.00%  0.00%  0.00%   0 LSP
> Tunnel Head
>  116           0         2          0  0.00%  0.00%  0.00%   0 LSDp
> Input Proc
>  117     1288824   2405686        535  0.00%  0.00%  0.00%   0 LSD Main
> Proc
>   60           0         1          0  0.00%  0.00%  0.00%   0 LSP
> Tunnel FRR
>   70           0         3          0  0.00%  0.00%  0.00%   0 SNMP Timers
>  120           0         2          0  0.00%  0.00%  0.00%   0 MFI LFD
> Main Pro
>  121     2593264  11627651        223  0.00%  0.00%  0.00%   0 NTP
>  122     6873376   1817623       3781  0.00%  0.00%  0.00%   0 Tag Control
>  123       21808    190119        114  0.00%  0.00%  0.00%   0 IPRM
>  124           0         2          0  0.00%  0.00%  0.00%   0 IP Flow
> Backgrou
>  125     4970232   4644514       1070  0.00%  0.00%  0.00%   0 OSPF Hello
>  126     4203656   2503602       1679  0.00%  0.00%  0.00%   0 IP SNMP
>  127      457588   1255865        364  0.00%  0.00%  0.00%   0 PDU
> DISPATCHER
>  128     5118352   1257172       4071  0.00%  0.00%  0.00%   0 SNMP ENGINE
>  129           0         1          0  0.00%  0.00%  0.00%   0 SNMP
> ConfCopyPro
>  130           0         1          0  0.00%  0.00%  0.00%   0 SNMP Traps
>  131       28584    190100        150  0.00%  0.00%  0.00%   0 Time
> Range Proce
>  132           0         1          0  0.00%  0.00%  0.00%   0 xcpa-driver
>  133        1208       274       4408  0.00%  0.00%  0.00%   0 Tagcon Addr
>  134     4599240  11781205        390  0.00%  0.00%  0.00%   0 OSPF Router
> 1
>  135     1168632  11563127        101  0.00%  0.00%  0.00%   0 OSPF Router
> 2
>  136     7196544   6637085       1084  0.00%  0.00%  0.00%   0 TDP Hello
>  137        2712      1138       2383  0.00%  0.00%  0.00%   0 RADIUS
>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>  139         516       180       2866  0.00%  0.00%  0.00%   0 AAA
> Accounting
>  140          60      1542         38  0.00%  0.00%  0.00%   2 Virtual
> Exec
>
>
>
> masood at nexlinx.net.pk escribi?:
>> cisco 7200 is a software based router so that every packet is punted to
>> the NPE. You need to replace your NPE instead of PIC. which cisco 7200
>> series network processing engine you are running? what you get when do
>> "show version" on this router? By using 'show processes cpu sorted 1min'
>> you can check which process is eating NPE cpu cycles.
>>
>> Regards,
>> Masood
>>
>>
>>
>>> It have
>>>
>>> int fa0/0
>>>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>>>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>>>
>>> int fa 0/1
>>>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>>>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>>>
>>> int ser4/0 (ds3 link)
>>>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>>>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>>>
>>> 59376 Total
>>>
>>> Thanks
>>>
>>> David Granzer escribi?:
>>>
>>>> Hi,
>>>>
>>>> could you post how much bandwidth and packet per second your 7200 ?
>>>> Generally upgrade to I/O GE will not
>>>> help much because the performance is based on the NPE used.
>>>>
>>>> regards,
>>>> David
>>>>
>>>>
>>>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R.
>>>> <jcposeidon at cantv.net>
>>>> wrote:
>>>>
>>>>
>>>>> Guys
>>>>>
>>>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>>>> stuff)
>>>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>>>> could
>>>>> this help with this load?
>>>>>
>>>>> Thanks
>>>>> _______________________________________________
>>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>>
>>>>>
>>>>>
>>>>
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>>
>>
>>
>>
>>
>



From jcposeidon at cantv.net  Wed Jun  3 11:40:47 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 03 Jun 2009 11:10:47 -0430
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <4A26997F.3030107@cantv.net>

That's great but the IO7200GE could help with the cpu load? if don't I 
must wait until get some budget

Thanks

masood at nexlinx.net.pk escribi?:
> cisco 7200 NPE-400 is normally for customer premise equipment and DS1/DS3
> aggregation. As per cisco performance of up to 400 kpps in cef switching.
>
> You can upgrade to NPE-G1 which provides performance of up to 1 million
> packets per second in cef switching (an increase of up to 250 percent over
> the cisco 7200 series npe 400)
>
> Regards,
> Masood
>
>   
>> NPE 400
>>
>> CPU utilization for five seconds: 76%/75%; one minute: 74%; five
>> minutes: 75%
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   45   210365012  85449013       2461  0.23%  0.19%  0.19%   0 IP Input
>>  118    99161264 248440739        399  0.23%  0.08%  0.06%   0
>> traffic_shape
>>   18    19988356  29194664        684  0.00%  0.03%  0.02%   0 ARP Input
>>    4    49353040   2274191      21701  0.00%  0.03%  0.04%   0 Check heaps
>>   10    11268080  11331204        994  0.00%  0.02%  0.00%   0 EnvMon
>>   63     8535512  47262546        180  0.07%  0.01%  0.00%   0 Spanning
>> Tree
>>   29    19555460    389652      50187  0.00%  0.01%  0.00%   0
>> Per-minute Jobs
>>    5     6393048    430645      14845  0.07%  0.00%  0.00%   0 Pool
>> Manager
>>  119    14495556   1901716       7622  0.00%  0.00%  0.00%   0 MFI LFD
>> Timer Pr
>>   59     5397356   1127172       4788  0.00%  0.00%  0.00%   0 WCCP V2
>> Protocol
>>   11           0         1          0  0.00%  0.00%  0.00%   0 OIR Handler
>>   12        7912    190100         41  0.00%  0.00%  0.00%   0 IPC
>> Dynamic Cach
>>   13           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone
>> Manager
>>   14     1344312  11329870        118  0.00%  0.00%  0.00%   0 IPC
>> Periodic Tim
>>   15     1196200  11329850        105  0.00%  0.00%  0.00%   0 IPC
>> Deferred Por
>>   16           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat
>> Manager
>>   17       44772   1140352         39  0.00%  0.00%  0.00%   0 Compute
>> SRP rate
>>    9           0         1          0  0.00%  0.00%  0.00%   0 Policy
>> Manager
>>   19           0        28          0  0.00%  0.00%  0.00%   0 DDR Timers
>>   20           0         2          0  0.00%  0.00%  0.00%   0 Dialer
>> event
>>   21           0         2          0  0.00%  0.00%  0.00%   0 Entity
>> MIB API
>>   22           0         1          0  0.00%  0.00%  0.00%   0 SERIAL
>> A'detect
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   23      770388   2845739        270  0.00%  0.00%  0.00%   0 HC
>> Counter Timer
>>   24        5264        22     239272  0.00%  0.00%  0.00%   0 Critical
>> Bkgnd
>>   25     3963452   4658455        850  0.00%  0.00%  0.00%   0 Net
>> Background
>>   26        6188      3016       2051  0.00%  0.00%  0.00%   0 Logger
>>   27     2206724  11329804        194  0.00%  0.00%  0.00%   0 TTY
>> Background
>>   28    65577956  11340517       5782  0.00%  0.00%  0.00%   0
>> Per-Second Jobs
>>    8      144284   2275716         63  0.00%  0.00%  0.00%   0
>> ALARM_TRIGGER_SC
>>    7           0         2          0  0.00%  0.00%  0.00%   0 Serial
>> Backgroun
>>   31           0         1          0  0.00%  0.00%  0.00%   0 CSP Timer
>>    6           0         2          0  0.00%  0.00%  0.00%   0 Timers
>>   33           0         2          0  0.00%  0.00%  0.00%   0 Hawkeye
>> Backgrou
>>   34           0         1          0  0.00%  0.00%  0.00%   0 SONET
>> alarm time
>>    3     3297860   3024757       1090  0.00%  0.00%  0.00%   0 OSPF Hello
>>   36           0         2          0  0.00%  0.00%  0.00%   0 VNM DSPRM
>> MAIN
>>   37           0         1          0  0.00%  0.00%  0.00%   0 CES Line
>> Conditi
>>   38           0         2          0  0.00%  0.00%  0.00%   0 Flash MIB
>> Update
>>   39           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
>> Input
>>   40           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
>> TIMER
>>   41           8        86         93  0.00%  0.00%  0.00%   0 TurboACL
>>   42           0         2          0  0.00%  0.00%  0.00%   0 CEF
>> switching ba
>>   43           0         1          0  0.00%  0.00%  0.00%   0 AC Switch
>>   44           0         2          0  0.00%  0.00%  0.00%   0 AAA
>> Dictionary R
>>    2      635356   2279979        278  0.00%  0.00%  0.00%   0 Load Meter
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   46           0         1          0  0.00%  0.00%  0.00%   0 ICMP
>> event handl
>>   47     1608916   1520006       1058  0.00%  0.00%  0.00%   0 CDP
>> Protocol
>>   48     1785752   1202253       1485  0.00%  0.00%  0.00%   0 LDP
>>   49          16       175         91  0.00%  0.00%  0.00%   0 OLM
>>   50           0         1          0  0.00%  0.00%  0.00%   0 PPPATM
>> Session d
>>   51           0         2          0  0.00%  0.00%  0.00%   0 PASVC
>> create VA
>>   52        9512      1676       5675  0.00%  0.00%  0.00%   0 EEM ED
>> Syslog
>>   53           0         2          0  0.00%  0.00%  0.00%   0 EEM ED SNMP
>>   54           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>> Memory Th
>>   55       23596    202778        116  0.00%  0.00%  0.00%   0 EEM ED
>> Timer
>>   56           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>> Counter
>>   57           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>> Interface
>>   58           0         3          0  0.00%  0.00%  0.00%   0 EEM ED
>> IOSWD
>>   30           0         1          0  0.00%  0.00%  0.00%   0 Inode
>> Table Dest
>>   32           0         2          0  0.00%  0.00%  0.00%   0 CES Timer
>>   61           0         1          0  0.00%  0.00%  0.00%   0 MPLS
>> Auto-Tunnel
>>   62           0         1          0  0.00%  0.00%  0.00%   0 O-UNI
>> Client Msg
>>   35           0         1          0  0.00%  0.00%  0.00%   0 POS APS
>> Event Pr
>>   64           0         1          0  0.00%  0.00%  0.00%   0 AC Mgr
>>   65           0         1          0  0.00%  0.00%  0.00%   0 SSS Manager
>>   66           0         2          0  0.00%  0.00%  0.00%   0 SSM
>> connection m
>>   67           0         1          0  0.00%  0.00%  0.00%   0 PPP IP
>> Add Route
>>   68       90640    189720        477  0.00%  0.00%  0.00%   0 CEF
>> background
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   69           0         1          0  0.00%  0.00%  0.00%   0 IP IRDP
>>    1           0         2          0  0.00%  0.00%  0.00%   0 Chunk
>> Manager
>>   71     2091684    355745       5879  0.00%  0.00%  0.00%   0 IP
>> Background
>>   72     2340232    344710       6788  0.00%  0.00%  0.00%   0 IP RIB
>> Update
>>   73    69186296  16952818       4081  0.00%  0.00%  0.00%   0 CEF: IPv4
>> proces
>>   74          24       122        196  0.00%  0.00%  0.00%   0 ADJ
>> background
>>   75           0         1          0  0.00%  0.00%  0.00%   0 L2X Data
>> Daemon
>>   76           0         1          0  0.00%  0.00%  0.00%   0 HTTP Timer
>>   77      646408    693913        931  0.00%  0.00%  0.00%   0 TCP Timer
>>   78         800       219       3652  0.00%  0.00%  0.00%   0 TCP
>> Protocols
>>   79           0         1          0  0.00%  0.00%  0.00%   0 Probe Input
>>   80           0         1          0  0.00%  0.00%  0.00%   0 RARP Input
>>   81           0         1          0  0.00%  0.00%  0.00%   0 Socket
>> Timers
>>   82           0         2          0  0.00%  0.00%  0.00%   0 LSP Tunnels
>>   83           0         1          0  0.00%  0.00%  0.00%   0 COPS
>>   84           0         1          0  0.00%  0.00%  0.00%   0 X.25
>> Encaps Mana
>>   85           0         1          0  0.00%  0.00%  0.00%   0 PAD InCall
>>   86           0         2          0  0.00%  0.00%  0.00%   0 X.25
>> Background
>>   87          88       375        234  0.00%  0.00%  0.00%   0 AToM
>> manager
>>   88           0         5          0  0.00%  0.00%  0.00%   0 AToM LDP
>> manager
>>   89       79992    190099        420  0.00%  0.00%  0.00%   0 LDP
>> Background
>>   90           0         1          0  0.00%  0.00%  0.00%   0 L2X
>> Socket proce
>>   91           0         1          0  0.00%  0.00%  0.00%   0 L2X SSS
>> manager
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>   92           0         1          0  0.00%  0.00%  0.00%   0 L2TP mgmt
>> daemon
>>   93          28       204        137  0.00%  0.00%  0.00%   0 TCP
>> Listener
>>   94           4         1       4000  0.00%  0.00%  0.00%   0 TSP
>>   95           0         1          0  0.00%  0.00%  0.00%   0 VOIP RTP
>> Udp Inp
>>   96           0         1          0  0.00%  0.00%  0.00%   0
>> QOS_MODULE_MAIN
>>   97           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_HTSP
>>   98           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_R2
>>   99           0         1          0  0.00%  0.00%  0.00%   0 CCSWVOICE
>>  100       43864   1140167         38  0.00%  0.00%  0.00%   0 RMON
>> Recycle Pro
>>  101           0         2          0  0.00%  0.00%  0.00%   0 RMON
>> Deferred Se
>>  102           0         1          0  0.00%  0.00%  0.00%   0 SYSMGT
>> Events
>>  103     1016848  11311292         89  0.00%  0.00%  0.00%   0
>> cerf_daemon_proc
>>  104           0         1          0  0.00%  0.00%  0.00%   0 SONET Traps
>>  105      640712   2278427        281  0.00%  0.00%  0.00%   0 EEM Server
>>  106           0         1          0  0.00%  0.00%  0.00%   0 Syslog
>> Traps
>>  107           0         1          0  0.00%  0.00%  0.00%   0 DATA
>> Transfer Pr
>>  108           0         1          0  0.00%  0.00%  0.00%   0 DATA
>> Collector
>>  109           0         1          0  0.00%  0.00%  0.00%   0 RMON
>> Packets
>>  110           0         2          0  0.00%  0.00%  0.00%   0 EEM
>> Policy Direc
>>  111     1019748  11311275         90  0.00%  0.00%  0.00%   0 trunk
>> conditioni
>>  112           0         1          0  0.00%  0.00%  0.00%   0 trunk
>> conditioni
>>  113      503088   3349106        150  0.00%  0.00%  0.00%   0 Net Input
>>  114     2325524   2279676       1020  0.00%  0.00%  0.00%   0 Compute
>> load avg
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>  115       83736    766853        109  0.00%  0.00%  0.00%   0 LSP
>> Tunnel Head
>>  116           0         2          0  0.00%  0.00%  0.00%   0 LSDp
>> Input Proc
>>  117     1288824   2405686        535  0.00%  0.00%  0.00%   0 LSD Main
>> Proc
>>   60           0         1          0  0.00%  0.00%  0.00%   0 LSP
>> Tunnel FRR
>>   70           0         3          0  0.00%  0.00%  0.00%   0 SNMP Timers
>>  120           0         2          0  0.00%  0.00%  0.00%   0 MFI LFD
>> Main Pro
>>  121     2593264  11627651        223  0.00%  0.00%  0.00%   0 NTP
>>  122     6873376   1817623       3781  0.00%  0.00%  0.00%   0 Tag Control
>>  123       21808    190119        114  0.00%  0.00%  0.00%   0 IPRM
>>  124           0         2          0  0.00%  0.00%  0.00%   0 IP Flow
>> Backgrou
>>  125     4970232   4644514       1070  0.00%  0.00%  0.00%   0 OSPF Hello
>>  126     4203656   2503602       1679  0.00%  0.00%  0.00%   0 IP SNMP
>>  127      457588   1255865        364  0.00%  0.00%  0.00%   0 PDU
>> DISPATCHER
>>  128     5118352   1257172       4071  0.00%  0.00%  0.00%   0 SNMP ENGINE
>>  129           0         1          0  0.00%  0.00%  0.00%   0 SNMP
>> ConfCopyPro
>>  130           0         1          0  0.00%  0.00%  0.00%   0 SNMP Traps
>>  131       28584    190100        150  0.00%  0.00%  0.00%   0 Time
>> Range Proce
>>  132           0         1          0  0.00%  0.00%  0.00%   0 xcpa-driver
>>  133        1208       274       4408  0.00%  0.00%  0.00%   0 Tagcon Addr
>>  134     4599240  11781205        390  0.00%  0.00%  0.00%   0 OSPF Router
>> 1
>>  135     1168632  11563127        101  0.00%  0.00%  0.00%   0 OSPF Router
>> 2
>>  136     7196544   6637085       1084  0.00%  0.00%  0.00%   0 TDP Hello
>>  137        2712      1138       2383  0.00%  0.00%  0.00%   0 RADIUS
>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>  139         516       180       2866  0.00%  0.00%  0.00%   0 AAA
>> Accounting
>>  140          60      1542         38  0.00%  0.00%  0.00%   2 Virtual
>> Exec
>>
>>
>>
>> masood at nexlinx.net.pk escribi?:
>>     
>>> cisco 7200 is a software based router so that every packet is punted to
>>> the NPE. You need to replace your NPE instead of PIC. which cisco 7200
>>> series network processing engine you are running? what you get when do
>>> "show version" on this router? By using 'show processes cpu sorted 1min'
>>> you can check which process is eating NPE cpu cycles.
>>>
>>> Regards,
>>> Masood
>>>
>>>
>>>
>>>       
>>>> It have
>>>>
>>>> int fa0/0
>>>>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>>>>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>>>>
>>>> int fa 0/1
>>>>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>>>>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>>>>
>>>> int ser4/0 (ds3 link)
>>>>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>>>>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>>>>
>>>> 59376 Total
>>>>
>>>> Thanks
>>>>
>>>> David Granzer escribi?:
>>>>
>>>>         
>>>>> Hi,
>>>>>
>>>>> could you post how much bandwidth and packet per second your 7200 ?
>>>>> Generally upgrade to I/O GE will not
>>>>> help much because the performance is based on the NPE used.
>>>>>
>>>>> regards,
>>>>> David
>>>>>
>>>>>
>>>>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R.
>>>>> <jcposeidon at cantv.net>
>>>>> wrote:
>>>>>
>>>>>
>>>>>           
>>>>>> Guys
>>>>>>
>>>>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>>>>> stuff)
>>>>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>>>>> could
>>>>>> this help with this load?
>>>>>>
>>>>>> Thanks
>>>>>> _______________________________________________
>>>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>>>
>>>>>>
>>>>>>
>>>>>>             
>>>> _______________________________________________
>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>
>>>>
>>>>         
>>>
>>>
>>>       
>
>
>
>   

From sethm at rollernet.us  Wed Jun  3 11:45:37 2009
From: sethm at rollernet.us (Seth Mattinen)
Date: Wed, 03 Jun 2009 08:45:37 -0700
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A26997F.3030107@cantv.net>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>	<4A26960D.8070206@cantv.net>	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net>
Message-ID: <4A269AA1.2030509@rollernet.us>

Juan C. Crespo R. wrote:
> That's great but the IO7200GE could help with the cpu load? if don't I
> must wait until get some budget
> 

To copy and paste Gert's initial response:

"No.  This is a CPU-based platform - the only way to reduce the CPU load
is to get a faster CPU or turn off features."

~Seth

From masood at nexlinx.net.pk  Wed Jun  3 12:53:55 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Wed, 3 Jun 2009 21:53:55 +0500 (PKT)
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
 Load?
In-Reply-To: <4A26997F.3030107@cantv.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net>
Message-ID: <61750.196.46.241.57.1244048035.squirrel@nexmail1.nexlinx.net.pk>

The answer to your question...

That's great but the IO7200GE could help with the cpu load?  Nah :)

What you need is NPE-G1 or NPE-G2 (double the speed of NPE-G1). Before
making a decision, calculate your network bandwidth requirements.

Regards,
Masood

> That's great but the IO7200GE could help with the cpu load? if don't I
> must wait until get some budget
>
> Thanks
>
> masood at nexlinx.net.pk escribi?:
>> cisco 7200 NPE-400 is normally for customer premise equipment and
>> DS1/DS3
>> aggregation. As per cisco performance of up to 400 kpps in cef
>> switching.
>>
>> You can upgrade to NPE-G1 which provides performance of up to 1 million
>> packets per second in cef switching (an increase of up to 250 percent
>> over
>> the cisco 7200 series npe 400)
>>
>> Regards,
>> Masood
>>
>>
>>> NPE 400
>>>
>>> CPU utilization for five seconds: 76%/75%; one minute: 74%; five
>>> minutes: 75%
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   45   210365012  85449013       2461  0.23%  0.19%  0.19%   0 IP Input
>>>  118    99161264 248440739        399  0.23%  0.08%  0.06%   0
>>> traffic_shape
>>>   18    19988356  29194664        684  0.00%  0.03%  0.02%   0 ARP
>>> Input
>>>    4    49353040   2274191      21701  0.00%  0.03%  0.04%   0 Check
>>> heaps
>>>   10    11268080  11331204        994  0.00%  0.02%  0.00%   0 EnvMon
>>>   63     8535512  47262546        180  0.07%  0.01%  0.00%   0 Spanning
>>> Tree
>>>   29    19555460    389652      50187  0.00%  0.01%  0.00%   0
>>> Per-minute Jobs
>>>    5     6393048    430645      14845  0.07%  0.00%  0.00%   0 Pool
>>> Manager
>>>  119    14495556   1901716       7622  0.00%  0.00%  0.00%   0 MFI LFD
>>> Timer Pr
>>>   59     5397356   1127172       4788  0.00%  0.00%  0.00%   0 WCCP V2
>>> Protocol
>>>   11           0         1          0  0.00%  0.00%  0.00%   0 OIR
>>> Handler
>>>   12        7912    190100         41  0.00%  0.00%  0.00%   0 IPC
>>> Dynamic Cach
>>>   13           0         1          0  0.00%  0.00%  0.00%   0 IPC Zone
>>> Manager
>>>   14     1344312  11329870        118  0.00%  0.00%  0.00%   0 IPC
>>> Periodic Tim
>>>   15     1196200  11329850        105  0.00%  0.00%  0.00%   0 IPC
>>> Deferred Por
>>>   16           0         1          0  0.00%  0.00%  0.00%   0 IPC Seat
>>> Manager
>>>   17       44772   1140352         39  0.00%  0.00%  0.00%   0 Compute
>>> SRP rate
>>>    9           0         1          0  0.00%  0.00%  0.00%   0 Policy
>>> Manager
>>>   19           0        28          0  0.00%  0.00%  0.00%   0 DDR
>>> Timers
>>>   20           0         2          0  0.00%  0.00%  0.00%   0 Dialer
>>> event
>>>   21           0         2          0  0.00%  0.00%  0.00%   0 Entity
>>> MIB API
>>>   22           0         1          0  0.00%  0.00%  0.00%   0 SERIAL
>>> A'detect
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   23      770388   2845739        270  0.00%  0.00%  0.00%   0 HC
>>> Counter Timer
>>>   24        5264        22     239272  0.00%  0.00%  0.00%   0 Critical
>>> Bkgnd
>>>   25     3963452   4658455        850  0.00%  0.00%  0.00%   0 Net
>>> Background
>>>   26        6188      3016       2051  0.00%  0.00%  0.00%   0 Logger
>>>   27     2206724  11329804        194  0.00%  0.00%  0.00%   0 TTY
>>> Background
>>>   28    65577956  11340517       5782  0.00%  0.00%  0.00%   0
>>> Per-Second Jobs
>>>    8      144284   2275716         63  0.00%  0.00%  0.00%   0
>>> ALARM_TRIGGER_SC
>>>    7           0         2          0  0.00%  0.00%  0.00%   0 Serial
>>> Backgroun
>>>   31           0         1          0  0.00%  0.00%  0.00%   0 CSP
>>> Timer
>>>    6           0         2          0  0.00%  0.00%  0.00%   0 Timers
>>>   33           0         2          0  0.00%  0.00%  0.00%   0 Hawkeye
>>> Backgrou
>>>   34           0         1          0  0.00%  0.00%  0.00%   0 SONET
>>> alarm time
>>>    3     3297860   3024757       1090  0.00%  0.00%  0.00%   0 OSPF
>>> Hello
>>>   36           0         2          0  0.00%  0.00%  0.00%   0 VNM
>>> DSPRM
>>> MAIN
>>>   37           0         1          0  0.00%  0.00%  0.00%   0 CES Line
>>> Conditi
>>>   38           0         2          0  0.00%  0.00%  0.00%   0 Flash
>>> MIB
>>> Update
>>>   39           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
>>> Input
>>>   40           0         2          0  0.00%  0.00%  0.00%   0 ATM OAM
>>> TIMER
>>>   41           8        86         93  0.00%  0.00%  0.00%   0 TurboACL
>>>   42           0         2          0  0.00%  0.00%  0.00%   0 CEF
>>> switching ba
>>>   43           0         1          0  0.00%  0.00%  0.00%   0 AC
>>> Switch
>>>   44           0         2          0  0.00%  0.00%  0.00%   0 AAA
>>> Dictionary R
>>>    2      635356   2279979        278  0.00%  0.00%  0.00%   0 Load
>>> Meter
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   46           0         1          0  0.00%  0.00%  0.00%   0 ICMP
>>> event handl
>>>   47     1608916   1520006       1058  0.00%  0.00%  0.00%   0 CDP
>>> Protocol
>>>   48     1785752   1202253       1485  0.00%  0.00%  0.00%   0 LDP
>>>   49          16       175         91  0.00%  0.00%  0.00%   0 OLM
>>>   50           0         1          0  0.00%  0.00%  0.00%   0 PPPATM
>>> Session d
>>>   51           0         2          0  0.00%  0.00%  0.00%   0 PASVC
>>> create VA
>>>   52        9512      1676       5675  0.00%  0.00%  0.00%   0 EEM ED
>>> Syslog
>>>   53           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>>> SNMP
>>>   54           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>>> Memory Th
>>>   55       23596    202778        116  0.00%  0.00%  0.00%   0 EEM ED
>>> Timer
>>>   56           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>>> Counter
>>>   57           0         2          0  0.00%  0.00%  0.00%   0 EEM ED
>>> Interface
>>>   58           0         3          0  0.00%  0.00%  0.00%   0 EEM ED
>>> IOSWD
>>>   30           0         1          0  0.00%  0.00%  0.00%   0 Inode
>>> Table Dest
>>>   32           0         2          0  0.00%  0.00%  0.00%   0 CES
>>> Timer
>>>   61           0         1          0  0.00%  0.00%  0.00%   0 MPLS
>>> Auto-Tunnel
>>>   62           0         1          0  0.00%  0.00%  0.00%   0 O-UNI
>>> Client Msg
>>>   35           0         1          0  0.00%  0.00%  0.00%   0 POS APS
>>> Event Pr
>>>   64           0         1          0  0.00%  0.00%  0.00%   0 AC Mgr
>>>   65           0         1          0  0.00%  0.00%  0.00%   0 SSS
>>> Manager
>>>   66           0         2          0  0.00%  0.00%  0.00%   0 SSM
>>> connection m
>>>   67           0         1          0  0.00%  0.00%  0.00%   0 PPP IP
>>> Add Route
>>>   68       90640    189720        477  0.00%  0.00%  0.00%   0 CEF
>>> background
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   69           0         1          0  0.00%  0.00%  0.00%   0 IP IRDP
>>>    1           0         2          0  0.00%  0.00%  0.00%   0 Chunk
>>> Manager
>>>   71     2091684    355745       5879  0.00%  0.00%  0.00%   0 IP
>>> Background
>>>   72     2340232    344710       6788  0.00%  0.00%  0.00%   0 IP RIB
>>> Update
>>>   73    69186296  16952818       4081  0.00%  0.00%  0.00%   0 CEF:
>>> IPv4
>>> proces
>>>   74          24       122        196  0.00%  0.00%  0.00%   0 ADJ
>>> background
>>>   75           0         1          0  0.00%  0.00%  0.00%   0 L2X Data
>>> Daemon
>>>   76           0         1          0  0.00%  0.00%  0.00%   0 HTTP
>>> Timer
>>>   77      646408    693913        931  0.00%  0.00%  0.00%   0 TCP
>>> Timer
>>>   78         800       219       3652  0.00%  0.00%  0.00%   0 TCP
>>> Protocols
>>>   79           0         1          0  0.00%  0.00%  0.00%   0 Probe
>>> Input
>>>   80           0         1          0  0.00%  0.00%  0.00%   0 RARP
>>> Input
>>>   81           0         1          0  0.00%  0.00%  0.00%   0 Socket
>>> Timers
>>>   82           0         2          0  0.00%  0.00%  0.00%   0 LSP
>>> Tunnels
>>>   83           0         1          0  0.00%  0.00%  0.00%   0 COPS
>>>   84           0         1          0  0.00%  0.00%  0.00%   0 X.25
>>> Encaps Mana
>>>   85           0         1          0  0.00%  0.00%  0.00%   0 PAD
>>> InCall
>>>   86           0         2          0  0.00%  0.00%  0.00%   0 X.25
>>> Background
>>>   87          88       375        234  0.00%  0.00%  0.00%   0 AToM
>>> manager
>>>   88           0         5          0  0.00%  0.00%  0.00%   0 AToM LDP
>>> manager
>>>   89       79992    190099        420  0.00%  0.00%  0.00%   0 LDP
>>> Background
>>>   90           0         1          0  0.00%  0.00%  0.00%   0 L2X
>>> Socket proce
>>>   91           0         1          0  0.00%  0.00%  0.00%   0 L2X SSS
>>> manager
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>   92           0         1          0  0.00%  0.00%  0.00%   0 L2TP
>>> mgmt
>>> daemon
>>>   93          28       204        137  0.00%  0.00%  0.00%   0 TCP
>>> Listener
>>>   94           4         1       4000  0.00%  0.00%  0.00%   0 TSP
>>>   95           0         1          0  0.00%  0.00%  0.00%   0 VOIP RTP
>>> Udp Inp
>>>   96           0         1          0  0.00%  0.00%  0.00%   0
>>> QOS_MODULE_MAIN
>>>   97           0         1          0  0.00%  0.00%  0.00%   0
>>> CCVPM_HTSP
>>>   98           0         1          0  0.00%  0.00%  0.00%   0 CCVPM_R2
>>>   99           0         1          0  0.00%  0.00%  0.00%   0
>>> CCSWVOICE
>>>  100       43864   1140167         38  0.00%  0.00%  0.00%   0 RMON
>>> Recycle Pro
>>>  101           0         2          0  0.00%  0.00%  0.00%   0 RMON
>>> Deferred Se
>>>  102           0         1          0  0.00%  0.00%  0.00%   0 SYSMGT
>>> Events
>>>  103     1016848  11311292         89  0.00%  0.00%  0.00%   0
>>> cerf_daemon_proc
>>>  104           0         1          0  0.00%  0.00%  0.00%   0 SONET
>>> Traps
>>>  105      640712   2278427        281  0.00%  0.00%  0.00%   0 EEM
>>> Server
>>>  106           0         1          0  0.00%  0.00%  0.00%   0 Syslog
>>> Traps
>>>  107           0         1          0  0.00%  0.00%  0.00%   0 DATA
>>> Transfer Pr
>>>  108           0         1          0  0.00%  0.00%  0.00%   0 DATA
>>> Collector
>>>  109           0         1          0  0.00%  0.00%  0.00%   0 RMON
>>> Packets
>>>  110           0         2          0  0.00%  0.00%  0.00%   0 EEM
>>> Policy Direc
>>>  111     1019748  11311275         90  0.00%  0.00%  0.00%   0 trunk
>>> conditioni
>>>  112           0         1          0  0.00%  0.00%  0.00%   0 trunk
>>> conditioni
>>>  113      503088   3349106        150  0.00%  0.00%  0.00%   0 Net
>>> Input
>>>  114     2325524   2279676       1020  0.00%  0.00%  0.00%   0 Compute
>>> load avg
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>  115       83736    766853        109  0.00%  0.00%  0.00%   0 LSP
>>> Tunnel Head
>>>  116           0         2          0  0.00%  0.00%  0.00%   0 LSDp
>>> Input Proc
>>>  117     1288824   2405686        535  0.00%  0.00%  0.00%   0 LSD Main
>>> Proc
>>>   60           0         1          0  0.00%  0.00%  0.00%   0 LSP
>>> Tunnel FRR
>>>   70           0         3          0  0.00%  0.00%  0.00%   0 SNMP
>>> Timers
>>>  120           0         2          0  0.00%  0.00%  0.00%   0 MFI LFD
>>> Main Pro
>>>  121     2593264  11627651        223  0.00%  0.00%  0.00%   0 NTP
>>>  122     6873376   1817623       3781  0.00%  0.00%  0.00%   0 Tag
>>> Control
>>>  123       21808    190119        114  0.00%  0.00%  0.00%   0 IPRM
>>>  124           0         2          0  0.00%  0.00%  0.00%   0 IP Flow
>>> Backgrou
>>>  125     4970232   4644514       1070  0.00%  0.00%  0.00%   0 OSPF
>>> Hello
>>>  126     4203656   2503602       1679  0.00%  0.00%  0.00%   0 IP SNMP
>>>  127      457588   1255865        364  0.00%  0.00%  0.00%   0 PDU
>>> DISPATCHER
>>>  128     5118352   1257172       4071  0.00%  0.00%  0.00%   0 SNMP
>>> ENGINE
>>>  129           0         1          0  0.00%  0.00%  0.00%   0 SNMP
>>> ConfCopyPro
>>>  130           0         1          0  0.00%  0.00%  0.00%   0 SNMP
>>> Traps
>>>  131       28584    190100        150  0.00%  0.00%  0.00%   0 Time
>>> Range Proce
>>>  132           0         1          0  0.00%  0.00%  0.00%   0
>>> xcpa-driver
>>>  133        1208       274       4408  0.00%  0.00%  0.00%   0 Tagcon
>>> Addr
>>>  134     4599240  11781205        390  0.00%  0.00%  0.00%   0 OSPF
>>> Router
>>> 1
>>>  135     1168632  11563127        101  0.00%  0.00%  0.00%   0 OSPF
>>> Router
>>> 2
>>>  136     7196544   6637085       1084  0.00%  0.00%  0.00%   0 TDP
>>> Hello
>>>  137        2712      1138       2383  0.00%  0.00%  0.00%   0 RADIUS
>>>  PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
>>>  139         516       180       2866  0.00%  0.00%  0.00%   0 AAA
>>> Accounting
>>>  140          60      1542         38  0.00%  0.00%  0.00%   2 Virtual
>>> Exec
>>>
>>>
>>>
>>> masood at nexlinx.net.pk escribi?:
>>>
>>>> cisco 7200 is a software based router so that every packet is punted
>>>> to
>>>> the NPE. You need to replace your NPE instead of PIC. which cisco 7200
>>>> series network processing engine you are running? what you get when do
>>>> "show version" on this router? By using 'show processes cpu sorted
>>>> 1min'
>>>> you can check which process is eating NPE cpu cycles.
>>>>
>>>> Regards,
>>>> Masood
>>>>
>>>>
>>>>
>>>>
>>>>> It have
>>>>>
>>>>> int fa0/0
>>>>>   30 second input rate 30616000 bits/sec, 13300 packets/sec
>>>>>   30 second output rate 47680000 bits/sec, 12178 packets/sec
>>>>>
>>>>> int fa 0/1
>>>>>   30 second input rate 27478000 bits/sec, 4672 packets/sec
>>>>>   30 second output rate 19071000 bits/sec, 3774 packets/sec
>>>>>
>>>>> int ser4/0 (ds3 link)
>>>>>  30 second input rate 43264000 bits/sec, 11862 packets/sec
>>>>>  30 second output rate 28832000 bits/sec, 13590 packets/sec
>>>>>
>>>>> 59376 Total
>>>>>
>>>>> Thanks
>>>>>
>>>>> David Granzer escribi?:
>>>>>
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> could you post how much bandwidth and packet per second your 7200 ?
>>>>>> Generally upgrade to I/O GE will not
>>>>>> help much because the performance is based on the NPE used.
>>>>>>
>>>>>> regards,
>>>>>> David
>>>>>>
>>>>>>
>>>>>> On Wed, Jun 3, 2009 at 3:52 PM, Juan C. Crespo R.
>>>>>> <jcposeidon at cantv.net>
>>>>>> wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>> Guys
>>>>>>>
>>>>>>>   I have one POP with 90% of CPU Load (WCCP2,  QoS and other minor
>>>>>>> stuff)
>>>>>>> and we are thinking about change the IO/7200-2FE by one IO/7200-GE
>>>>>>> could
>>>>>>> this help with this load?
>>>>>>>
>>>>>>> Thanks
>>>>>>> _______________________________________________
>>>>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>> _______________________________________________
>>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>>
>>
>>
>>
>>
>



From MatlockK at exempla.org  Wed Jun  3 11:52:28 2009
From: MatlockK at exempla.org (Matlock, Kenneth L)
Date: Wed, 3 Jun 2009 09:52:28 -0600
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <4A269AA1.2030509@rollernet.us>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>	<4A26960D.8070206@cantv.net>	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk><4A26997F.3030107@cantv.net>
	<4A269AA1.2030509@rollernet.us>
Message-ID: <4288131ED5E3024C9CD4782CECCAD2C7065D36B9@LMC-MAIL2.exempla.org>

To reiterate :)

The problem you're having is the CPU is having to process EVERY packet
coming in (the nature of the chassis unfortunately). Changing out the IO
module will only allow you to have faster interfaces, but the CPU is
still the exact same. 

The ONLY fixes are:

1) Reduce the packet rate on the chassis
2) Reduce the number of 'extraneous' services on the chassis
3) Get a faster CPU (NPE-G1 or NPE-G2)

The advertised PPS rates are assuming (I believe) 64-byte packets, and
nothing else (QoS/ACLs/dynamic routing protocols/etc) running on the
chassis.

Ken Matlock
Network Analyst
Exempla Healthcare
(303) 467-4671
matlockk at exempla.org


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Seth Mattinen
Sent: Wednesday, June 03, 2009 9:46 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] IO 7200 GE Improve Performance and help with the
CPU Load?

Juan C. Crespo R. wrote:
> That's great but the IO7200GE could help with the cpu load? if don't I
> must wait until get some budget
> 

To copy and paste Gert's initial response:

"No.  This is a CPU-based platform - the only way to reduce the CPU load
is to get a faster CPU or turn off features."

~Seth
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From paul at paulstewart.org  Wed Jun  3 11:55:26 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 3 Jun 2009 11:55:26 -0400
Subject: [c-nsp] BGP Advertising - Question re more specific block
Message-ID: <004201c9e463$b72ec280$258c4780$@org>

Hi folks.

 

I'd like to know if there's a better way to approach this.

 

We are advertising a specific /22 that belongs to a /18 block via one
specific upstream BGP connection.  The /18 is advertised to all upstreams,
the /22 is only advertised to one upstream as a method of influencing
traffic via that carrier (knowing that if that particular carrier went down,
the less specific subnet will still be reachable via the other providers).
Prepending is very ugly for this situation FYI.

 

We use BGP communities to identify upstream and downstream BGP connections
along with our own netblocks.

 

First I built a route-map that I could use inside the BGP network statement:

 

route-map blahblah-routes-providerx permit 1000

 set community 11666:6001 

 

Then created the network statement:

 

network xx.xx.xx.0 mask 255.255.252.0 route-map blahblah-routes-providerx

 

Created a new IP community-list that includes previous communities plus this
one new specific community (11666:6001):

 

ip community-list 101 permit 11666:4000

ip community-list 101 permit 11666:5000

ip community-list 101 permit 11666:6001

 

And, updated the route-map towards this upstream as applicable:

 

route-map outbound-tsystems permit 10

 match community 101

 

 

My question - is there a better way to configure this?  This is working just
fine for our needs but there's a lot of steps and we're going to have to add
more into this in future so rather do as simple a config as possible ;)

 

Thanks,

 

Paul

 

 


From achatz at forthnet.gr  Wed Jun  3 13:21:26 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 03 Jun 2009 20:21:26 +0300
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
In-Reply-To: <h0651o$car$1@ger.gmane.org>
References: <h0651o$car$1@ger.gmane.org>
Message-ID: <4A26B116.4040803@forthnet.gr>

Although i haven't met this, it might mean that the EVC frame matching config (the "encapsulation dot1q xxx" under the 
service instance) is not "converted" into the appropriate TCAM entry in the ES card. A possible result would be that 
frames that should be forwarded through this service instance, are either not forwarded at all or forwarded through a 
less specific match criterion of another service instance.

In any case, your account SE should be able to provide you with more -internal- details about this bug.

Regards,
Tassos

David Freedman wrote on 03/06/2009 18:32:
> Has anybody come across this and if so are there any known workarounds?
> 
> Am keen to know under what circumstances an EFP does not get programmed
> to the card, if anybody has any more information on this would be
> appreciative of it online or offline.
> 
> Regards,
> 
> David Freedman
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From gert at greenie.muc.de  Wed Jun  3 13:23:47 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 3 Jun 2009 19:23:47 +0200
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <4A26997F.3030107@cantv.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net>
Message-ID: <20090603172347.GD290@greenie.muc.de>

Hi,

On Wed, Jun 03, 2009 at 11:10:47AM -0430, Juan C. Crespo R. wrote:
> That's great but the IO7200GE could help with the cpu load? 

*NO*.

There is no intelligence on the IO board.  Packets go to the CPU.  If
the CPU is loaded, it doesn't matter where the packets are coming from.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090603/adb0848a/attachment.bin>

From david.freedman at uk.clara.net  Wed Jun  3 13:33:29 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 03 Jun 2009 18:33:29 +0100
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
In-Reply-To: <4A26B116.4040803@forthnet.gr>
References: <h0651o$car$1@ger.gmane.org> <4A26B116.4040803@forthnet.gr>
Message-ID: <4A26B3E9.3010303@uk.clara.net>

Tassos, the problem is that the EFP (Ethernet Flowpoint) is not
programmed to the card using the efp-client , without an EFP the service
instance has nothing to attach to.

Am currently waiting on somebody to share the DE notes with me so I can
see if I can find a workaround (even if it means a slew of test commands
to prod the subsystems directly)

I know this is resolved in SRC4 and we are on target to upgrade, would
just appreciate a faster solution , we are all out of alternatives :)

Dave.


Tassos Chatzithomaoglou wrote:
> Although i haven't met this, it might mean that the EVC frame matching
> config (the "encapsulation dot1q xxx" under the service instance) is not
> "converted" into the appropriate TCAM entry in the ES card. A possible
> result would be that frames that should be forwarded through this
> service instance, are either not forwarded at all or forwarded through a
> less specific match criterion of another service instance.
> 
> In any case, your account SE should be able to provide you with more
> -internal- details about this bug.
> 
> Regards,
> Tassos
> 
> David Freedman wrote on 03/06/2009 18:32:
>> Has anybody come across this and if so are there any known workarounds?
>>
>> Am keen to know under what circumstances an EFP does not get programmed
>> to the card, if anybody has any more information on this would be
>> appreciative of it online or offline.
>>
>> Regards,
>>
>> David Freedman
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From david.freedman at uk.clara.net  Wed Jun  3 13:33:29 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Wed, 03 Jun 2009 18:33:29 +0100
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
In-Reply-To: <4A26B116.4040803@forthnet.gr>
References: <h0651o$car$1@ger.gmane.org> <4A26B116.4040803@forthnet.gr>
Message-ID: <4A26B3E9.3010303@uk.clara.net>

Tassos, the problem is that the EFP (Ethernet Flowpoint) is not
programmed to the card using the efp-client , without an EFP the service
instance has nothing to attach to.

Am currently waiting on somebody to share the DE notes with me so I can
see if I can find a workaround (even if it means a slew of test commands
to prod the subsystems directly)

I know this is resolved in SRC4 and we are on target to upgrade, would
just appreciate a faster solution , we are all out of alternatives :)

Dave.


Tassos Chatzithomaoglou wrote:
> Although i haven't met this, it might mean that the EVC frame matching
> config (the "encapsulation dot1q xxx" under the service instance) is not
> "converted" into the appropriate TCAM entry in the ES card. A possible
> result would be that frames that should be forwarded through this
> service instance, are either not forwarded at all or forwarded through a
> less specific match criterion of another service instance.
> 
> In any case, your account SE should be able to provide you with more
> -internal- details about this bug.
> 
> Regards,
> Tassos
> 
> David Freedman wrote on 03/06/2009 18:32:
>> Has anybody come across this and if so are there any known workarounds?
>>
>> Am keen to know under what circumstances an EFP does not get programmed
>> to the card, if anybody has any more information on this would be
>> appreciative of it online or offline.
>>
>> Regards,
>>
>> David Freedman
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From achatz at forthnet.gr  Wed Jun  3 14:11:14 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 03 Jun 2009 21:11:14 +0300
Subject: [c-nsp] Mac-in-Mac supported in ES+ ?
Message-ID: <4A26BCC2.5090405@forthnet.gr>

Does anyone know more details about current mac-in-mac (802.1ah Provider Backbone Bridges) support?

7600#sh ethernet service ?
   evc         Ethernet EVC
   instance    Ethernet Service Instance
   interface   Ethernet Service Interface
   ipc         Ethernet Service IPC
   mac-tunnel  Ethernet Mac-in-Mac tunnel


CCO returned only pages regarding IOS-XR.

--
Tassos

From billf at mu.org  Wed Jun  3 16:13:18 2009
From: billf at mu.org (bill fumerola)
Date: Wed, 3 Jun 2009 13:13:18 -0700
Subject: [c-nsp] IO 7200 GE Improve Performance and help with the CPU
	Load?
In-Reply-To: <20090603172347.GD290@greenie.muc.de>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net> <20090603172347.GD290@greenie.muc.de>
Message-ID: <20090603201318.GM14367@elvis.mu.org>

On Wed, Jun 03, 2009 at 07:23:47PM +0200, Gert Doering wrote:
> On Wed, Jun 03, 2009 at 11:10:47AM -0430, Juan C. Crespo R. wrote:
> > That's great but the IO7200GE could help with the cpu load? 
> 
> *NO*.
> 
> There is no intelligence on the IO board.  Packets go to the CPU.  If
> the CPU is loaded, it doesn't matter where the packets are coming from.

unless pushing all the frames to one interface causes reduced CPU time
spent servicing interrupts from interrupt coalescing.

-- bill




From mduksa at gmail.com  Wed Jun  3 19:07:29 2009
From: mduksa at gmail.com (Marlon Duksa)
Date: Wed, 3 Jun 2009 16:07:29 -0700
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
Message-ID: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>

Hi -Does anyone know which cards on Cat6500 support MPLS
and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
distributed (DFC) forwarding solution?

I know that Cat6500 is very limited in VPLS support, but IP-VPN and EoMPLS
should be no problem, right?

Thanks,
Marlon

From avayner at cisco.com  Thu Jun  4 00:19:03 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Thu, 4 Jun 2009 06:19:03 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>

Marlon,

If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
done in hardware and in distributed forwarding mode.
For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
the core. Having this card means that again VPLS is done in hardware -
some functionality is done on the regular DFCs and some on the egress
core facing module.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
Sent: Thursday, June 04, 2009 02:07
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

Hi -Does anyone know which cards on Cat6500 support MPLS
and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
distributed (DFC) forwarding solution?

I know that Cat6500 is very limited in VPLS support, but IP-VPN and
EoMPLS
should be no problem, right?

Thanks,
Marlon
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From achatz at forthnet.gr  Thu Jun  4 02:20:12 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Thu, 04 Jun 2009 09:20:12 +0300
Subject: [c-nsp] standby RSP720 gets "Data TLB Error Exception" after rommon
	upgrade
Message-ID: <4A27679C.3070503@forthnet.gr>

Has anyone managed to do a rommon upgrade to a RSP720 and immediately afterwards had it 
boot as a standby ? I did it twice and i always got the "Data TLB Error Exception" message

rommon 7 > boot bootdisk:c7600rsp72043-advipservicesk9-mz.122-33.SRB5a.bin

Initializing ATA monitor library...

*** Data TLB Error Exception ***
PC = 0x40442e4, Vector = 0x1400, SP = 0x4012dc4


I have RMAed 2 RSP720s until now after doing exactly the same procedure and now i'm 
waiting for the 3rd one!

If the RSP720 is the only one in the chassis (so it's acting like an active), then booting 
after the rommon upgrade works fine! If the RSP720 gets booted as a standby after the 
rommon upgrade, then it gets destroyed and cannot be used neither as an active nor as a 
standby.

-- 
Tassos

From asturluismi at gmail.com  Thu Jun  4 04:26:21 2009
From: asturluismi at gmail.com (luismi)
Date: Thu, 04 Jun 2009 10:26:21 +0200
Subject: [c-nsp] Any problems w/ 3750 IOS 12.2(46)SE?
In-Reply-To: <A77B4558-D03A-439D-B6F9-60169E9CCF83@netspot.com.au>
References: <A77B4558-D03A-439D-B6F9-60169E9CCF83@netspot.com.au>
Message-ID: <1244103981.7817.0.camel@dsba-ipso>

What we saw with 12.2.(46) was a corruption of the "ifindex" file.
We will go for 12.2(50)

El mar, 02-06-2009 a las 16:45 +0930, Tom Lanyon escribi?:
> We are seeing consistent low TCP throughput over a dual gig  
> etherchannel between two stacks of 3x 3750G + 1x 3750E and  
> intermittent delays (ie. random slow ICMP ping times) on another 2x  
> 3750G stack, all on 12.2(46)SE. All switches are doing L2/L3  
> forwarding and a small amount of EIGRP.
> 
> The stack with delayed ICMP has seemingly random high CPU load and  
> this seems to correlate with the delayed ICMP packets; example:
> 	5Min Processes: 27% CPU
> 	Interrupts: 0% CPU
> 	Sum of all processes: 1.88% CPU
> 
> The other stacks haven't shown signs of ICMP delayed packets but still  
> list high (40-100%) peaks of CPU utilisation. Can't see any  
> indications of TCAM exhaustion on any switch (all desktop default SDM  
> template).
> 
> Just thought I'd throw this to the list to see if anyone else has had  
> something similar?
> 
> Tom
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From rgallagh at cisco.com  Thu Jun  4 06:05:22 2009
From: rgallagh at cisco.com (Richard Gallagher)
Date: Thu, 4 Jun 2009 11:05:22 +0100
Subject: [c-nsp] CSCsv21403  (EVC not programmed on ES20 linecard)
In-Reply-To: <4A26B3E9.3010303@uk.clara.net>
References: <h0651o$car$1@ger.gmane.org> <4A26B116.4040803@forthnet.gr>
	<4A26B3E9.3010303@uk.clara.net>
Message-ID: <381A4C3F-2CE8-4BB4-96DC-8651ED9A093B@cisco.com>

I've had a look for you and there is no workaround unfortunately.

You could try OIR'ing the LC if you are hitting the issue, this may  
resolve it, there are no magic "test commands" to overcome it.

Rich

On 3 Jun 2009, at 18:33, David Freedman wrote:

> Tassos, the problem is that the EFP (Ethernet Flowpoint) is not
> programmed to the card using the efp-client , without an EFP the  
> service
> instance has nothing to attach to.
>
> Am currently waiting on somebody to share the DE notes with me so I  
> can
> see if I can find a workaround (even if it means a slew of test  
> commands
> to prod the subsystems directly)
>
> I know this is resolved in SRC4 and we are on target to upgrade, would
> just appreciate a faster solution , we are all out of alternatives :)
>
> Dave.
>
>
> Tassos Chatzithomaoglou wrote:
>> Although i haven't met this, it might mean that the EVC frame  
>> matching
>> config (the "encapsulation dot1q xxx" under the service instance)  
>> is not
>> "converted" into the appropriate TCAM entry in the ES card. A  
>> possible
>> result would be that frames that should be forwarded through this
>> service instance, are either not forwarded at all or forwarded  
>> through a
>> less specific match criterion of another service instance.
>>
>> In any case, your account SE should be able to provide you with more
>> -internal- details about this bug.
>>
>> Regards,
>> Tassos
>>
>> David Freedman wrote on 03/06/2009 18:32:
>>> Has anybody come across this and if so are there any known  
>>> workarounds?
>>>
>>> Am keen to know under what circumstances an EFP does not get  
>>> programmed
>>> to the card, if anybody has any more information on this would be
>>> appreciative of it online or offline.
>>>
>>> Regards,
>>>
>>> David Freedman
>>>
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From RGoldberg at compudyne.net  Thu Jun  4 08:16:53 2009
From: RGoldberg at compudyne.net (Ryan Goldberg)
Date: Thu, 4 Jun 2009 07:16:53 -0500
Subject: [c-nsp] basic nat question
Message-ID: <D501339A41BE8E498AFEF0F6EB9343A00246E67FCD@crossfire08>

I really did *not* want my first post to cisco-nsp to be this lame, but...

if you have second-

got an 1841 out there, with x.x.x.161/29 bound on the internet facing port, and .163, .164, .165 also bound as secondaries.  

need to do some static nat, but only the entries for the primary IP work

eg

ip nat inside source static tcp 192.168.1.103 110 x.x.x.161 110 vrf ISP2 extendable

works just fine

ip nat inside source static tcp 192.168.1.156 443 x.x.x.163 110 vrf ISP2 extendable

does not work

a clue that I'm unable to make use of is the traffic that I send to the secondary, comes back from the primary according to the nat trans table, and as verified by packet capture

any help you could provide would be hugely appreciated

running 12.4.24T..

Thanks-
Ryan	


From paul at paulstewart.org  Thu Jun  4 09:39:47 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Thu, 4 Jun 2009 09:39:47 -0400
Subject: [c-nsp] BGP Advertising - Question re more specific block
In-Reply-To: <4A27C5C4.1070300@ibctech.ca>
References: <004201c9e463$b72ec280$258c4780$@org> <4A27C5C4.1070300@ibctech.ca>
Message-ID: <000001c9e519$ed961970$c8c24c50$@org>

Hi Steve..

That is correct - we will actually be taking any specifics and tagging them
with one community.  We will use that community only with certain upstream
and peering points.

Our overall problem is that we have one upstream that we are stuck with in
contract and are not remotely meeting our minimum traffic levels with them -
if we start prepending then we get too large of a traffic shift.  So I'm
hoping to take a few /22 and maybe a /20 and advertise it as a more specific
route to that upstream and also to our peering points (we don't want to push
any traffic away from peering points of course).

Thanks,

Paul


-----Original Message-----
From: Steve Bertrand [mailto:steve at ibctech.ca] 
Sent: Thursday, June 04, 2009 9:02 AM
To: Paul Stewart
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] BGP Advertising - Question re more specific block

* PGP - S/MIME Signed by an unverified key: 06/04/09 at 09:01:56

Paul Stewart wrote:

> We are advertising a specific /22 that belongs to a /18 block via one
> specific upstream BGP connection.  The /18 is advertised to all upstreams,
> the /22 is only advertised to one upstream as a method of influencing
> traffic via that carrier (knowing that if that particular carrier went
down,
> the less specific subnet will still be reachable via the other providers).
> Prepending is very ugly for this situation FYI.

Paul,

Just so I can get a better understanding, you are applying a community
to each /22 you are advertising to certain peers.

You are then applying a route-map to a particular peer, that only sends
the prefixes that have a particular community set. Is this correct?

Do you advertise this exact group of /22's to more than one upstream peer?

Steve

* Thawte Freemail Member <steve at ibctech.ca>
* Issuer: Thawte Consulting (Pty) Ltd. - Unverified


From cchurc05 at harris.com  Thu Jun  4 09:00:41 2009
From: cchurc05 at harris.com (Church, Charles)
Date: Thu, 4 Jun 2009 08:00:41 -0500
Subject: [c-nsp] basic nat question
In-Reply-To: <D501339A41BE8E498AFEF0F6EB9343A00246E67FCD@crossfire08>
References: <D501339A41BE8E498AFEF0F6EB9343A00246E67FCD@crossfire08>
Message-ID: <FA1BA229357DB640B944218F3585FECA0257C6D8@mspe2k1.cs.myharris.net>

What's the purpose of having those additional addresses bound as
secondaries?  It's not needed for NAT.

Chuck

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ryan Goldberg
Sent: Thursday, June 04, 2009 8:17 AM
To: 'cisco-nsp at puck.nether.net'
Subject: [c-nsp] basic nat question


I really did *not* want my first post to cisco-nsp to be this lame,
but...

if you have second-

got an 1841 out there, with x.x.x.161/29 bound on the internet facing
port, and .163, .164, .165 also bound as secondaries.  

need to do some static nat, but only the entries for the primary IP work

eg

ip nat inside source static tcp 192.168.1.103 110 x.x.x.161 110 vrf ISP2
extendable

works just fine

ip nat inside source static tcp 192.168.1.156 443 x.x.x.163 110 vrf ISP2
extendable

does not work

a clue that I'm unable to make use of is the traffic that I send to the
secondary, comes back from the primary according to the nat trans table,
and as verified by packet capture

any help you could provide would be hugely appreciated

running 12.4.24T..

Thanks-
Ryan	

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From steve at ibctech.ca  Thu Jun  4 09:01:56 2009
From: steve at ibctech.ca (Steve Bertrand)
Date: Thu, 04 Jun 2009 09:01:56 -0400
Subject: [c-nsp] BGP Advertising - Question re more specific block
In-Reply-To: <004201c9e463$b72ec280$258c4780$@org>
References: <004201c9e463$b72ec280$258c4780$@org>
Message-ID: <4A27C5C4.1070300@ibctech.ca>

Paul Stewart wrote:

> We are advertising a specific /22 that belongs to a /18 block via one
> specific upstream BGP connection.  The /18 is advertised to all upstreams,
> the /22 is only advertised to one upstream as a method of influencing
> traffic via that carrier (knowing that if that particular carrier went down,
> the less specific subnet will still be reachable via the other providers).
> Prepending is very ugly for this situation FYI.

Paul,

Just so I can get a better understanding, you are applying a community
to each /22 you are advertising to certain peers.

You are then applying a route-map to a particular peer, that only sends
the prefixes that have a particular community set. Is this correct?

Do you advertise this exact group of /22's to more than one upstream peer?

Steve
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3233 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090604/cbcdbf02/attachment-0001.bin>

From mduksa at gmail.com  Thu Jun  4 10:10:27 2009
From: mduksa at gmail.com (Marlon Duksa)
Date: Thu, 4 Jun 2009 07:10:27 -0700
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
Message-ID: <a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>

Thanks Arie. But ES cards are not supported on Cat6500, no? And also VPLS
over MPLS on a SIP in Cat6500 - is it supported? If so do you know which
SIP?Thanks,
Marlon

On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner) <avayner at cisco.com>wrote:

> Marlon,
>
> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
> done in hardware and in distributed forwarding mode.
> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
> the core. Having this card means that again VPLS is done in hardware -
> some functionality is done on the regular DFCs and some on the egress
> core facing module.
>
> Arie
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
> Sent: Thursday, June 04, 2009 02:07
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
> Hi -Does anyone know which cards on Cat6500 support MPLS
> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
> distributed (DFC) forwarding solution?
>
> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
> EoMPLS
> should be no problem, right?
>
> Thanks,
> Marlon
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From masood at nexlinx.net.pk  Thu Jun  4 11:26:16 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Thu, 4 Jun 2009 20:26:16 +0500 (PKT)
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
Message-ID: <28289.196.46.241.57.1244129176.squirrel@nexmail1.nexlinx.net.pk>

AFAIK VPLS is not supported on the Catalyst 6500 series. You should
upgrade to the 7600 series with enhanced core facing interfaces, such as
ES-cards or SIP-400/600 cards.

Regards,
Masood

> Thanks Arie. But ES cards are not supported on Cat6500, no? And also VPLS
> over MPLS on a SIP in Cat6500 - is it supported? If so do you know which
> SIP?Thanks,
> Marlon
>
> On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
> <avayner at cisco.com>wrote:
>
>> Marlon,
>>
>> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
>> done in hardware and in distributed forwarding mode.
>> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
>> the core. Having this card means that again VPLS is done in hardware -
>> some functionality is done on the regular DFCs and some on the egress
>> core facing module.
>>
>> Arie
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
>> Sent: Thursday, June 04, 2009 02:07
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>>
>> Hi -Does anyone know which cards on Cat6500 support MPLS
>> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
>> distributed (DFC) forwarding solution?
>>
>> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
>> EoMPLS
>> should be no problem, right?
>>
>> Thanks,
>> Marlon
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From chris.fournier at dal.ca  Thu Jun  4 09:55:08 2009
From: chris.fournier at dal.ca (Chris Fournier)
Date: Thu, 04 Jun 2009 10:55:08 -0300
Subject: [c-nsp] L2TPv3 performance over gig?
Message-ID: <1244123708.30703.5351.camel@linux-xvcs>

Does anyone use L2TPv3 over a gig link, and what is the performance
overhead introduced? I've seen some numbers at the Cisco website, but
these seem to reference encryption versus encapsulation.


Chris


From eng_mssk at hotmail.com  Thu Jun  4 10:36:41 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Thu, 4 Jun 2009 17:36:41 +0300
Subject: [c-nsp] Juniper Simulator
Message-ID: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>


Hey all
how are u ?
I am looking for a free simulator for Juniper routers

Thanks in advance

_________________________________________________________________
Windows Live?: Keep your life in sync. Check it out!
http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009

From achatz at forthnet.gr  Thu Jun  4 10:52:50 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Thu, 04 Jun 2009 17:52:50 +0300
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <28289.196.46.241.57.1244129176.squirrel@nexmail1.nexlinx.net.pk>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
	<28289.196.46.241.57.1244129176.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <4A27DFC2.7030805@forthnet.gr>

I had seen a presentation where with SIP-400 and SXI you could have VPLS on the 6500.

--
Tassos

masood at nexlinx.net.pk wrote on 04/06/2009 18:26:
> AFAIK VPLS is not supported on the Catalyst 6500 series. You should
> upgrade to the 7600 series with enhanced core facing interfaces, such as
> ES-cards or SIP-400/600 cards.
> 
> Regards,
> Masood
> 
>> Thanks Arie. But ES cards are not supported on Cat6500, no? And also VPLS
>> over MPLS on a SIP in Cat6500 - is it supported? If so do you know which
>> SIP?Thanks,
>> Marlon
>>
>> On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
>> <avayner at cisco.com>wrote:
>>
>>> Marlon,
>>>
>>> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
>>> done in hardware and in distributed forwarding mode.
>>> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
>>> the core. Having this card means that again VPLS is done in hardware -
>>> some functionality is done on the regular DFCs and some on the egress
>>> core facing module.
>>>
>>> Arie
>>>
>>> -----Original Message-----
>>> From: cisco-nsp-bounces at puck.nether.net
>>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
>>> Sent: Thursday, June 04, 2009 02:07
>>> To: cisco-nsp at puck.nether.net
>>> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>>>
>>> Hi -Does anyone know which cards on Cat6500 support MPLS
>>> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
>>> distributed (DFC) forwarding solution?
>>>
>>> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
>>> EoMPLS
>>> should be no problem, right?
>>>
>>> Thanks,
>>> Marlon
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>

From masood at nexlinx.net.pk  Thu Jun  4 11:57:38 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Thu, 4 Jun 2009 20:57:38 +0500 (PKT)
Subject: [c-nsp] Juniper Simulator
In-Reply-To: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
References: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
Message-ID: <65498.196.46.241.57.1244131058.squirrel@nexmail1.nexlinx.net.pk>

wrong list for this question, you use cisco-nsp for cisco stuff. you can
use juniper-nsp for juniper.
Anyway You can use QEMU with Olive to emulate Juniper JUNOS. The following
URL will take you to the page...

http://tinyurl.com/o4gbba

Regards,
Masood



>
> Hey all
> how are u ?
> I am looking for a free simulator for Juniper routers
>
> Thanks in advance
>
> _________________________________________________________________
> Windows Live?: Keep your life in sync. Check it out!
> http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/



From eng_mssk at hotmail.com  Thu Jun  4 10:54:20 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Thu, 4 Jun 2009 17:54:20 +0300
Subject: [c-nsp] Juniper Simulator
In-Reply-To: <65498.196.46.241.57.1244131058.squirrel@nexmail1.nexlinx.net.pk>
References: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
	<65498.196.46.241.57.1244131058.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <BLU102-W500F42E002081AB6169D7EFA4B0@phx.gbl>


i didnt know about juniper nsp 

thats y i asked here 

> Date: Thu, 4 Jun 2009 20:57:38 +0500
> Subject: Re: [c-nsp] Juniper Simulator
> From: masood at nexlinx.net.pk
> To: eng_mssk at hotmail.com
> CC: cisco-nsp at puck.nether.net
> 
> wrong list for this question, you use cisco-nsp for cisco stuff. you can
> use juniper-nsp for juniper.
> Anyway You can use QEMU with Olive to emulate Juniper JUNOS. The following
> URL will take you to the page...
> 
> http://tinyurl.com/o4gbba
> 
> Regards,
> Masood
> 
> 
> 
> >
> > Hey all
> > how are u ?
> > I am looking for a free simulator for Juniper routers
> >
> > Thanks in advance
> >
> > _________________________________________________________________
> > Windows Live?: Keep your life in sync. Check it out!
> > http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> 

_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

From dudepron at gmail.com  Thu Jun  4 10:54:43 2009
From: dudepron at gmail.com (Aaron)
Date: Thu, 4 Jun 2009 10:54:43 -0400
Subject: [c-nsp] L2TPv3 performance over gig?
In-Reply-To: <1244123708.30703.5351.camel@linux-xvcs>
References: <1244123708.30703.5351.camel@linux-xvcs>
Message-ID: <480dad640906040754u4786db38v34e1782bdac1ed8d@mail.gmail.com>

nothing more than doing mpls. Actually a little less since you don't have
ldp going

On Thu, Jun 4, 2009 at 09:55, Chris Fournier <chris.fournier at dal.ca> wrote:

> Does anyone use L2TPv3 over a gig link, and what is the performance
> overhead introduced? I've seen some numbers at the Cisco website, but
> these seem to reference encryption versus encapsulation.
>
>
> Chris
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From rus-p at inbox.ru  Thu Jun  4 09:34:05 2009
From: rus-p at inbox.ru (Ruslan Pustovoitov)
Date: Thu, 04 Jun 2009 17:34:05 +0400
Subject: [c-nsp] (no subject)
Message-ID: <E1MCD53-0006RC-00.rus-p-inbox-ru@f265.mail.ru>



Hi all,

I read config guide for IOS 12.2(x) about MSDP on 3750 and see this statements:

MSDP is not fully supported in this software release because of a lack of support for Multicast Border Gateway Protocol (MBGP), which works closely with MSDP. However, it is possible to create default peers that MSDP can operate with if MBGP is not running.
....
In this software release, because BGP and MBGP are not supported, you cannot configure an MSDP peer on the local switch by using the ip msdp peer global configuration command. Instead, you define a default MSDP peer (by using the ip msdp default-peer global configuration command) from which to accept all SA messages for the switch. 

Could anybody tell me why MSDP cannot use BGP to accomplish peer-rpf check flooding on this platform ?
Instead of this, config guide describe a simple case with default-peer configuration.




From moua0100 at umn.edu  Thu Jun  4 11:09:20 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 04 Jun 2009 10:09:20 -0500
Subject: [c-nsp] L2TPv3 performance over gig?
In-Reply-To: <1244123708.30703.5351.camel@linux-xvcs>
References: <1244123708.30703.5351.camel@linux-xvcs>
Message-ID: <4A27E3A0.5090102@umn.edu>

I've done testing for both:
* no encryption: ~ 980Mb
* encryption ~ 240 Mb

Performance dependent on router platform (in my case 7203 w/ NSE-100)

Encryption was on 7206 w/ NPE-G1 & VAM2+

Conclusion, performance limited to hardware used and not layer-1 link speed.



Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Chris Fournier wrote:
> Does anyone use L2TPv3 over a gig link, and what is the performance
> overhead introduced? I've seen some numbers at the Cisco website, but
> these seem to reference encryption versus encapsulation.
>
>
> Chris
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From sil at infiltrated.net  Thu Jun  4 10:41:28 2009
From: sil at infiltrated.net (J. Oquendo)
Date: Thu, 04 Jun 2009 10:41:28 -0400
Subject: [c-nsp] Juniper Simulator
In-Reply-To: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
References: <BLU102-W34BC63FC9768B624375EEDFA4B0@phx.gbl>
Message-ID: <4A27DD18.2020107@infiltrated.net>

Mohammad Khalil wrote:
> Hey all
> how are u ?
> I am looking for a free simulator for Juniper routers
>
> Thanks in advance
>
> _________________________________________________________________
> Windows Live?: Keep your life in sync. Check it out!
> http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
http://juniper.cluepon.net/index.php/Olive

-- 

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP

"It takes 20 years to build a reputation and five minutes to
ruin it. If you think about that, you'll do things
differently." - Warren Buffett

227C 5D35 7DCB 0893 95AA  4771 1DCE 1FD1 5CCD 6B5E
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E


From avayner at cisco.com  Thu Jun  4 11:29:49 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Thu, 4 Jun 2009 17:29:49 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>

Yes, this is true, ES20 is 7600 only (I missed the 6500 angle here ;-) )

We can do VPLS with SIP400 (lower BW) or SIP600 (higher BW).

 

BTW, There is also support for MPLSoGRE

 

Arie

 

From: Marlon Duksa [mailto:mduksa at gmail.com] 
Sent: Thursday, June 04, 2009 17:10
To: Arie Vayner (avayner)
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

 

Thanks Arie. But ES cards are not supported on Cat6500, no? And also
VPLS over MPLS on a SIP in Cat6500 - is it supported? If so do you know
which SIP?

Thanks,

Marlon

On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
<avayner at cisco.com> wrote:

Marlon,

If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
done in hardware and in distributed forwarding mode.
For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
the core. Having this card means that again VPLS is done in hardware -
some functionality is done on the regular DFCs and some on the egress
core facing module.

Arie


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
Sent: Thursday, June 04, 2009 02:07
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

Hi -Does anyone know which cards on Cat6500 support MPLS
and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
distributed (DFC) forwarding solution?

I know that Cat6500 is very limited in VPLS support, but IP-VPN and
EoMPLS
should be no problem, right?

Thanks,
Marlon

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 


From dudepron at gmail.com  Thu Jun  4 13:14:40 2009
From: dudepron at gmail.com (Aaron)
Date: Thu, 4 Jun 2009 13:14:40 -0400
Subject: [c-nsp] L2TPv3 performance over gig?
In-Reply-To: <4A27E3A0.5090102@umn.edu>
References: <1244123708.30703.5351.camel@linux-xvcs> <4A27E3A0.5090102@umn.edu>
Message-ID: <480dad640906041014g52456b6dkbcf72517d719ce1c@mail.gmail.com>

What does that have to do with L2TPv3?

On Thu, Jun 4, 2009 at 11:09, Ge Moua <moua0100 at umn.edu> wrote:

> I've done testing for both:
> * no encryption: ~ 980Mb
> * encryption ~ 240 Mb
>
> Performance dependent on router platform (in my case 7203 w/ NSE-100)
>
> Encryption was on 7206 w/ NPE-G1 & VAM2+
>
> Conclusion, performance limited to hardware used and not layer-1 link
> speed.
>
>
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
>
> Chris Fournier wrote:
>
>> Does anyone use L2TPv3 over a gig link, and what is the performance
>> overhead introduced? I've seen some numbers at the Cisco website, but
>> these seem to reference encryption versus encapsulation.
>>
>>
>> Chris
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From moua0100 at umn.edu  Thu Jun  4 14:01:38 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 04 Jun 2009 13:01:38 -0500
Subject: [c-nsp] L2TPv3 performance over gig?
In-Reply-To: <480dad640906041014g52456b6dkbcf72517d719ce1c@mail.gmail.com>
References: <1244123708.30703.5351.camel@linux-xvcs> <4A27E3A0.5090102@umn.edu>
	<480dad640906041014g52456b6dkbcf72517d719ce1c@mail.gmail.com>
Message-ID: <4A280C02.4070101@umn.edu>

The (2) scenarios is:
* L2TPv3 vc w/ no ecryption
vs.
* L2TPv3 vc w/ IPSec encryption (encapsulated inside of)

One can also do layer-2 VPN with MPLS, eg, AToM (EoMPLS), but I think 
the initial thread was about L2TPv3 (layer-2 VPN inside native IP).  
Persoanally I like the AToM/EoMPLS (or even VPLS) approach with the 
many-to-many connections flexibility (vs. one-to-one connection 
limitation with L2TPv3).

We have about a half-dozen sites on L2TPv3 but have considered 
AToM/EoMPLS.  Just in case your wondering Cisco TAC has far more 
in-depth expertise w/ MPLS flavors as I've been told; when you run into 
issues.

Good luck.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Aaron wrote:
> What does that have to do with L2TPv3?
>
> On Thu, Jun 4, 2009 at 11:09, Ge Moua <moua0100 at umn.edu 
> <mailto:moua0100 at umn.edu>> wrote:
>
>     I've done testing for both:
>     * no encryption: ~ 980Mb
>     * encryption ~ 240 Mb
>
>     Performance dependent on router platform (in my case 7203 w/ NSE-100)
>
>     Encryption was on 7206 w/ NPE-G1 & VAM2+
>
>     Conclusion, performance limited to hardware used and not layer-1
>     link speed.
>
>
>
>     Regards,
>     Ge Moua | Email: moua0100 at umn.edu <mailto:moua0100 at umn.edu>
>
>     Network Design Engineer
>     University of Minnesota | Networking & Telecommunications Services
>
>
>
>
>     Chris Fournier wrote:
>
>         Does anyone use L2TPv3 over a gig link, and what is the
>         performance
>         overhead introduced? I've seen some numbers at the Cisco
>         website, but
>         these seem to reference encryption versus encapsulation.
>
>
>         Chris
>
>         _______________________________________________
>         cisco-nsp mailing list  cisco-nsp at puck.nether.net
>         <mailto:cisco-nsp at puck.nether.net>
>         https://puck.nether.net/mailman/listinfo/cisco-nsp
>         archive at http://puck.nether.net/pipermail/cisco-nsp/
>          
>
>     _______________________________________________
>     cisco-nsp mailing list  cisco-nsp at puck.nether.net
>     <mailto:cisco-nsp at puck.nether.net>
>     https://puck.nether.net/mailman/listinfo/cisco-nsp
>     archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>

From lists.james.edwards at gmail.com  Thu Jun  4 14:46:41 2009
From: lists.james.edwards at gmail.com (james edwards)
Date: Thu, 4 Jun 2009 12:46:41 -0600
Subject: [c-nsp] help with BGP logs
Message-ID: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>

Can anyone give me some help with these logs ? The session is to a vyatta
router (Quagga) from a 7206,
what attribute is this ?

Jun  4 12:42:25.842 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Down BGP
protocol initialization
Jun  4 12:42:55.158 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Up
Jun  4 12:43:04.986 MST: %BGP-3-NOTIFICATION: received from neighbor
164.64.41.180 3/4 (invalid flags for attribute) 8 bytes E0150501 0000B7AA
Jun  4 12:43:04.990 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Down BGP
protocol initialization
Jun  4 12:43:17.170 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Up
Jun  4 12:43:46.710 MST: %BGP-3-NOTIFICATION: received from neighbor
164.64.41.180 3/4 (invalid flags for attribute) 8 bytes E0150501 0000B7AA

-- 
James H. Edwards
Senior Network Systems Administrator
Judicial Information Division
jedwards at nmcourts.gov

From achatz at forthnet.gr  Thu Jun  4 15:09:45 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Thu, 04 Jun 2009 22:09:45 +0300
Subject: [c-nsp] standby RSP720 gets "Data TLB Error Exception" after
 rommon	upgrade
In-Reply-To: <4A27679C.3070503@forthnet.gr>
References: <4A27679C.3070503@forthnet.gr>
Message-ID: <4A281BF9.1000205@forthnet.gr>

For everyone interested, bug was CSCsy92252.
Many thanks to Arie and Andrew (@Cisco) for pointing that out.

-- 
Tassos

Tassos Chatzithomaoglou wrote on 04/06/2009 09:20:
> Has anyone managed to do a rommon upgrade to a RSP720 and immediately 
> afterwards had it boot as a standby ? I did it twice and i always got 
> the "Data TLB Error Exception" message
> 
> rommon 7 > boot bootdisk:c7600rsp72043-advipservicesk9-mz.122-33.SRB5a.bin
> 
> Initializing ATA monitor library...
> 
> *** Data TLB Error Exception ***
> PC = 0x40442e4, Vector = 0x1400, SP = 0x4012dc4
> 
> 
> I have RMAed 2 RSP720s until now after doing exactly the same procedure 
> and now i'm waiting for the 3rd one!
> 
> If the RSP720 is the only one in the chassis (so it's acting like an 
> active), then booting after the rommon upgrade works fine! If the RSP720 
> gets booted as a standby after the rommon upgrade, then it gets 
> destroyed and cannot be used neither as an active nor as a standby.
> 


From biged7600 at gmail.com  Thu Jun  4 16:21:19 2009
From: biged7600 at gmail.com (James Edmondson)
Date: Thu, 4 Jun 2009 15:21:19 -0500
Subject: [c-nsp] standby RSP720 gets "Data TLB Error Exception" after
	rommon upgrade
In-Reply-To: <4A281BF9.1000205@forthnet.gr>
References: <4A27679C.3070503@forthnet.gr> <4A281BF9.1000205@forthnet.gr>
Message-ID: <d35a6baf0906041321y4fae4641u748f70a130da5d6f@mail.gmail.com>

I would suggest SRD1 IOS, however be prepared to upgrade the firmware if you
have any SPA boards.

On Thu, Jun 4, 2009 at 2:09 PM, Tassos Chatzithomaoglou
<achatz at forthnet.gr>wrote:

> For everyone interested, bug was CSCsy92252.
> Many thanks to Arie and Andrew (@Cisco) for pointing that out.
>
> --
> Tassos
>
> Tassos Chatzithomaoglou wrote on 04/06/2009 09:20:
>
>> Has anyone managed to do a rommon upgrade to a RSP720 and immediately
>> afterwards had it boot as a standby ? I did it twice and i always got the
>> "Data TLB Error Exception" message
>>
>> rommon 7 > boot bootdisk:c7600rsp72043-advipservicesk9-mz.122-33.SRB5a.bin
>>
>> Initializing ATA monitor library...
>>
>> *** Data TLB Error Exception ***
>> PC = 0x40442e4, Vector = 0x1400, SP = 0x4012dc4
>>
>>
>> I have RMAed 2 RSP720s until now after doing exactly the same procedure
>> and now i'm waiting for the 3rd one!
>>
>> If the RSP720 is the only one in the chassis (so it's acting like an
>> active), then booting after the rommon upgrade works fine! If the RSP720
>> gets booted as a standby after the rommon upgrade, then it gets destroyed
>> and cannot be used neither as an active nor as a standby.
>>
>>
>  _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
James

From RGoldberg at compudyne.net  Thu Jun  4 16:28:58 2009
From: RGoldberg at compudyne.net (Ryan Goldberg)
Date: Thu, 4 Jun 2009 15:28:58 -0500
Subject: [c-nsp] basic nat question
In-Reply-To: <FA1BA229357DB640B944218F3585FECA0257C6D8@mspe2k1.cs.myharris.net>
References: <D501339A41BE8E498AFEF0F6EB9343A00246E67FCD@crossfire08>
	<FA1BA229357DB640B944218F3585FECA0257C6D8@mspe2k1.cs.myharris.net>
Message-ID: <D501339A41BE8E498AFEF0F6EB9343A00246E68044@crossfire08>

> -----Original Message-----
> From: Church, Charles [mailto:cchurc05 at harris.com]

> What's the purpose of having those additional addresses bound as
> secondaries?  It's not needed for NAT.

desperate attempt to make things work I guess

> I really did *not* want my first post to cisco-nsp to be this lame,
> but...

aghhhh...

> ip nat inside source static tcp 192.168.1.103 110 x.x.x.161 110 vrf
> ISP2
> extendable
> 
> works just fine
> 
> ip nat inside source static tcp 192.168.1.156 443 x.x.x.163 110 vrf
> ISP2
> extendable
> 
> does not work

Had my head on wrong - wrong vrf.  Although I don't understand at this point why it worked with the primary.

Thanks for the responses...
Ryan

From cordmacleod at gmail.com  Thu Jun  4 18:39:58 2009
From: cordmacleod at gmail.com (Cord MacLeod)
Date: Thu, 4 Jun 2009 15:39:58 -0700
Subject: [c-nsp] static arping gateways
Message-ID: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>

Would it be a reasonable solution to static arp a gateway on a cisco  
L3 switch to prevent a user from taking over the gateway?  So assuming  
you have HSRP running on 2 layer 3 switches and they share a gateway  
of 10.0.0.1 with switch one's address being 10.0.0.2 and two's address  
being 10.0.0.3 would it be reasonable to static arp each of these  
addresses to each switch? 
  

From peter at rathlev.dk  Thu Jun  4 19:31:33 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Fri, 05 Jun 2009 01:31:33 +0200
Subject: [c-nsp] static arping gateways
In-Reply-To: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
References: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
Message-ID: <1244158293.4721.8.camel@localhost.localdomain>

On Thu, 2009-06-04 at 15:39 -0700, Cord MacLeod wrote:
> Would it be a reasonable solution to static arp a gateway on a cisco  
> L3 switch to prevent a user from taking over the gateway?  So assuming  
> you have HSRP running on 2 layer 3 switches and they share a gateway  
> of 10.0.0.1 with switch one's address being 10.0.0.2 and two's address  
> being 10.0.0.3 would it be reasonable to static arp each of these  
> addresses to each switch? 

I'd say there's always a better way than static configuration.

I'm not sure exactly what the scenario is, but if you're talking about
simple L2 switches with a L3 interface for management, just keep the L3
termination away from user VLANs.

If you're talking about two L3 switches with a configuration like:

! *** A ***
interface Vlan2
 ip address 10.0.0.2 255.255.255.0
 standby ip 10.0.0.1
!

! *** B ***
interface Vlan2
 ip address 10.0.0.3 255.255.255.0
 standby ip 10.0.0.1
!

And then if you should configure each with a static ARP entry mapping
10.0.0.1 to 0000.0c07.ac00, then this would only "protect" each of these
two switches, not any hosts on the network. And the switches would often
have their own uplink(s), rarely needing to send traffic to the
"gateway" address.

Have you looked at Dynamic Arp Inspection?

Regards,
Peter



From amsoares at netcabo.pt  Thu Jun  4 19:34:49 2009
From: amsoares at netcabo.pt (Antonio Soares)
Date: Fri, 5 Jun 2009 00:34:49 +0100
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
Message-ID: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>

Hello group,

I need help in order to calculate the memory needed to accomodate 2 or more Full BGP Feeds. This is for a 12400 running IOS. Today i
saw this problem with some linecards:

++++++++++++++++++++++++++++++
%FIB-2-FIBDISABLE: Fatal error, slot X: no memory
++++++++++++++++++++++++++++++
%HW_RES_FAIL-4-LOW_CEF_MEM: SLOT Y is running low on E4_Lookup External SRAM resources.  CEF will begin resource constrained
forwarding operation if problem persists.  For additional details please see show ip cef resource and show ip cef summary
%LC-3-HWRESFAIL: OUT OF HW RESOURCES - FORWARDING MAY NOT BE ACCURATE.PLEASE CORRECT THE SITUATION AND TRY CLEAR CEF LINECARD TO
RECOVER
++++++++++++++++++++++++++++++

Slot X is a GE-GBIC-SC-B with 256 Mb of RAM and Slot Y is a 1X10GE-LR-SC with 512 Mb of RAM. The errors above occurred after the 2nd
Full BGP Feed was received. Linecards 4GE-SFP-LC with 512 Mb of RAM did not complain. Neither the SIP-600 with 1 Gb or the SIP-601
with 2Gb.

I have a PRP-2 with 1 Gb of RAM.

I understand that 256 Mb is definitely not enough. But i don't understand why the problem only affected the 1X10GE-LR-SC and not the
4GE-SFP-LC. Both have 512 Mb of RAM.



Thanks.

Regards,

Antonio Soares, CCIE #18473 (R&S)
amsoares at netcabo.pt





From cordmacleod at gmail.com  Thu Jun  4 19:37:52 2009
From: cordmacleod at gmail.com (Cord MacLeod)
Date: Thu, 4 Jun 2009 16:37:52 -0700
Subject: [c-nsp] static arping gateways
In-Reply-To: <1244158293.4721.8.camel@localhost.localdomain>
References: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
	<1244158293.4721.8.camel@localhost.localdomain>
Message-ID: <771064F0-629E-4D3F-8914-234F1C4FFFEF@gmail.com>


On Jun 4, 2009, at 4:31 PM, Peter Rathlev wrote:

> On Thu, 2009-06-04 at 15:39 -0700, Cord MacLeod wrote:
>> Would it be a reasonable solution to static arp a gateway on a cisco
>> L3 switch to prevent a user from taking over the gateway?  So  
>> assuming
>> you have HSRP running on 2 layer 3 switches and they share a gateway
>> of 10.0.0.1 with switch one's address being 10.0.0.2 and two's  
>> address
>> being 10.0.0.3 would it be reasonable to static arp each of these
>> addresses to each switch?
>
> I'd say there's always a better way than static configuration.
>
> I'm not sure exactly what the scenario is, but if you're talking about
> simple L2 switches with a L3 interface for management, just keep the  
> L3
> termination away from user VLANs.

A bunch of L2 switches connected to two L3 switches.

>
>
> If you're talking about two L3 switches with a configuration like:
>
> ! *** A ***
> interface Vlan2
> ip address 10.0.0.2 255.255.255.0
> standby ip 10.0.0.1
> !
>
> ! *** B ***
> interface Vlan2
> ip address 10.0.0.3 255.255.255.0
> standby ip 10.0.0.1
> !

Essentially, yes.

>
>
> And then if you should configure each with a static ARP entry mapping
> 10.0.0.1 to 0000.0c07.ac00, then this would only "protect" each of  
> these
> two switches, not any hosts on the network. And the switches would  
> often
> have their own uplink(s), rarely needing to send traffic to the
> "gateway" address.

I only want to protect the switches.  I don't want anyone stealing  
their ip addresses or the hrsp gateway addresses.

>
>
> Have you looked at Dynamic Arp Inspection?

Wish I could use this.  Unfortunately, I can't.  We use LVS, which is  
a linux load balancer.  This does use a VIP, but not a virtual mac  
address.  Therefore when there's a failover, the switch ignores the  
new mac address with DAI, found this out the hard way on my Juniper  
switches, which have DAI enabled by default.

>
>
> Regards,
> Peter
>
>


From fwissue at gmail.com  Thu Jun  4 21:06:29 2009
From: fwissue at gmail.com (Michael Lee)
Date: Thu, 4 Jun 2009 18:06:29 -0700
Subject: [c-nsp] help with BGP logs
In-Reply-To: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>
References: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>
Message-ID: <7ACEDD3C-6142-4BF0-BF9C-D6905E844E6A@gmail.com>

No enforce first as in bgp configuration

Regards

-mike

On Jun 4, 2009, at 11:46 AM, james edwards <lists.james.edwards at gmail.com 
 > wrote:

> Can anyone give me some help with these logs ? The session is to a  
> vyatta
> router (Quagga) from a 7206,
> what attribute is this ?
>
> Jun  4 12:42:25.842 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180  
> Down BGP
> protocol initialization
> Jun  4 12:42:55.158 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Up
> Jun  4 12:43:04.986 MST: %BGP-3-NOTIFICATION: received from neighbor
> 164.64.41.180 3/4 (invalid flags for attribute) 8 bytes E0150501  
> 0000B7AA
> Jun  4 12:43:04.990 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180  
> Down BGP
> protocol initialization
> Jun  4 12:43:17.170 MST: %BGP-5-ADJCHANGE: neighbor 164.64.41.180 Up
> Jun  4 12:43:46.710 MST: %BGP-3-NOTIFICATION: received from neighbor
> 164.64.41.180 3/4 (invalid flags for attribute) 8 bytes E0150501  
> 0000B7AA
>
> -- 
> James H. Edwards
> Senior Network Systems Administrator
> Judicial Information Division
> jedwards at nmcourts.gov
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From RWerber at epiknetworks.com  Thu Jun  4 21:37:57 2009
From: RWerber at epiknetworks.com (Ryan Werber)
Date: Thu, 4 Jun 2009 21:37:57 -0400
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
Message-ID: <4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Antonio Soares

>I need help in order to calculate the memory needed to accomodate 2 or
more Full BGP >Feeds. This is for a 12400 running IOS. Today i
>saw this problem with some linecards:

OUR GE-GBIC-SC-B's w/ 256MB Generally have about 100 megs of ram free
with 2 directly connected full feeds, and at least 6 through ibgp.
There may be a configuration issue.  Only recently have our Engine-0
Cards been running out of memory, as they only have 128MB.

bbr1.tor#execute-on slot 3 show proc mem | i Free
========= Line Card (Slot 3) =========
Total: 223634112, Used: 88582896, Free: 135051216

We have 12008's with GRP-B's w/ 512 RP Ram.

Hope this helps!

Ryan Werber
Epik Networks


From ltd at cisco.com  Thu Jun  4 22:43:13 2009
From: ltd at cisco.com (Lincoln Dale)
Date: Fri, 05 Jun 2009 12:43:13 +1000
Subject: [c-nsp] static arping gateways
In-Reply-To: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
References: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
Message-ID: <4A288641.90105@cisco.com>



Cord MacLeod wrote:
> Would it be a reasonable solution to static arp a gateway on a cisco 
> L3 switch to prevent a user from taking over the gateway?  So assuming 
> you have HSRP running on 2 layer 3 switches and they share a gateway 
> of 10.0.0.1 with switch one's address being 10.0.0.2 and two's address 
> being 10.0.0.3 would it be reasonable to static arp each of these 
> addresses to each switch? 
a better solution would be to enable Dynamic ARP Inspection (DAI) on 
your Cisco L3 switch.
"best practice" would be to enable various other integrated security 
features to protect against other DoS, flooding, spoofing, starvation 
attack vectors.


cheers,

lincoln.

From swmike at swm.pp.se  Fri Jun  5 00:13:01 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Fri, 5 Jun 2009 06:13:01 +0200 (CEST)
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
In-Reply-To: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
Message-ID: <alpine.DEB.1.10.0906050609370.22851@uplift.swm.pp.se>

On Fri, 5 Jun 2009, Antonio Soares wrote:

> I understand that 256 Mb is definitely not enough. But i don't 
> understand why the problem only affected the 1X10GE-LR-SC and not the 
> 4GE-SFP-LC. Both have 512 Mb of RAM.

Different models of linecards need different amounts of RAM for the same 
amount of routes. For instance, the 4GE gives up earlier when having just 
256M of ram (we had to upgrade a year ago or so) compared to the 3GE 
(which still works).

You need to monitor your RP and LC memory as well as your "show ip cef 
resources". Make sure your RP and LCs have *at least* 50 megs of ram free 
at all times, it's sometimes needed during a re-route.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From peter at rathlev.dk  Fri Jun  5 05:02:18 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Fri, 05 Jun 2009 11:02:18 +0200
Subject: [c-nsp] static arping gateways
In-Reply-To: <771064F0-629E-4D3F-8914-234F1C4FFFEF@gmail.com>
References: <77AB9902-77FA-4E52-9660-0D138613B2E9@gmail.com>
	<1244158293.4721.8.camel@localhost.localdomain>
	<771064F0-629E-4D3F-8914-234F1C4FFFEF@gmail.com>
Message-ID: <1244192538.3480.2.camel@localhost.localdomain>

On Thu, 2009-06-04 at 16:37 -0700, Cord MacLeod wrote:
> On Jun 4, 2009, at 4:31 PM, Peter Rathlev wrote:
> > I'm not sure exactly what the scenario is, but if you're talking
> > about simple L2 switches with a L3 interface for management, just
> > keep the L3 termination away from user VLANs.
> 
> A bunch of L2 switches connected to two L3 switches.

So why not just keep their management-interfaces on a seperate VLAN?
That would protect the L2 switches. And the L3 switches have their own
uplinks I assume, so they would probably not need to send traffic to
each other via the user VLAN.

Regards,
Peter



From amsoares at netcabo.pt  Fri Jun  5 07:13:44 2009
From: amsoares at netcabo.pt (Antonio Soares)
Date: Fri, 5 Jun 2009 12:13:44 +0100
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
In-Reply-To: <4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
Message-ID: <153DAD8392C948D6B0E0864E232B909C@int.convex.pt>

Wow, this is unbelievable ! Can you show us your "show proc mem | inc BGP" ? Do you really have two full BGP feeds (about 284k
prefixes each) ?


Thanks.

Regards,

Antonio Soares, CCIE #18473 (R&S)
amsoares at netcabo.pt

-----Original Message-----
From: Ryan Werber [mailto:RWerber at epiknetworks.com] 
Sent: sexta-feira, 5 de Junho de 2009 2:38
To: Antonio Soares; cisco-nsp
Subject: RE: [c-nsp] 12k Full BGP Feed Memory Requirements



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Antonio Soares

>I need help in order to calculate the memory needed to accomodate 2 or
more Full BGP >Feeds. This is for a 12400 running IOS. Today i
>saw this problem with some linecards:

OUR GE-GBIC-SC-B's w/ 256MB Generally have about 100 megs of ram free
with 2 directly connected full feeds, and at least 6 through ibgp.
There may be a configuration issue.  Only recently have our Engine-0
Cards been running out of memory, as they only have 128MB.

bbr1.tor#execute-on slot 3 show proc mem | i Free
========= Line Card (Slot 3) =========
Total: 223634112, Used: 88582896, Free: 135051216

We have 12008's with GRP-B's w/ 512 RP Ram.

Hope this helps!

Ryan Werber
Epik Networks



From masood at nexlinx.net.pk  Fri Jun  5 08:30:52 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Fri, 5 Jun 2009 17:30:52 +0500 (PKT)
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
In-Reply-To: <153DAD8392C948D6B0E0864E232B909C@int.convex.pt>
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
	<153DAD8392C948D6B0E0864E232B909C@int.convex.pt>
Message-ID: <28604.196.46.241.57.1244205052.squirrel@nexmail1.nexlinx.net.pk>

it seems very special memory tweaking/management stuff.. LOLs :)
i can't believe it. two full BGP feeds = 284k :P

Regards,
Masood

> Wow, this is unbelievable ! Can you show us your "show proc mem | inc BGP"
> ? Do you really have two full BGP feeds (about 284k
> prefixes each) ?
>
>
> Thanks.
>
> Regards,
>
> Antonio Soares, CCIE #18473 (R&S)
> amsoares at netcabo.pt
>
> -----Original Message-----
> From: Ryan Werber [mailto:RWerber at epiknetworks.com]
> Sent: sexta-feira, 5 de Junho de 2009 2:38
> To: Antonio Soares; cisco-nsp
> Subject: RE: [c-nsp] 12k Full BGP Feed Memory Requirements
>
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Antonio Soares
>
>>I need help in order to calculate the memory needed to accomodate 2 or
> more Full BGP >Feeds. This is for a 12400 running IOS. Today i
>>saw this problem with some linecards:
>
> OUR GE-GBIC-SC-B's w/ 256MB Generally have about 100 megs of ram free
> with 2 directly connected full feeds, and at least 6 through ibgp.
> There may be a configuration issue.  Only recently have our Engine-0
> Cards been running out of memory, as they only have 128MB.
>
> bbr1.tor#execute-on slot 3 show proc mem | i Free
> ========= Line Card (Slot 3) =========
> Total: 223634112, Used: 88582896, Free: 135051216
>
> We have 12008's with GRP-B's w/ 512 RP Ram.
>
> Hope this helps!
>
> Ryan Werber
> Epik Networks
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From mvanton at gmail.com  Fri Jun  5 09:09:28 2009
From: mvanton at gmail.com (vince anton)
Date: Fri, 5 Jun 2009 15:09:28 +0200
Subject: [c-nsp] optical power on SPA 10GE
Message-ID: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>

Hi All,


got a quick question:

Is it possible from a 12k GSR to obtain the optical power levels reaching a
10GE SPA.

With a 'sh controller' I can see the optical power in db reaching my POS
SPA, but no such luck with 10GE SPA (SPA-1X10GE-L-V2).

Any ideas how to get this info ?


Thanks

anton

From david.freedman at uk.clara.net  Fri Jun  5 10:13:04 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Fri, 05 Jun 2009 15:13:04 +0100
Subject: [c-nsp] optical power on SPA 10GE
In-Reply-To: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>
References: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>
Message-ID: <h0b95g$vrl$1@ger.gmane.org>

You mean the XFP?

Assuming you have a DOM XFP, try:

sh hw-module subslot X/Y transceiver Z

Where interface is X/Y/Z

Dave.


vince anton wrote:
> Hi All,
> 
> 
> got a quick question:
> 
> Is it possible from a 12k GSR to obtain the optical power levels reaching a
> 10GE SPA.
> 
> With a 'sh controller' I can see the optical power in db reaching my POS
> SPA, but no such luck with 10GE SPA (SPA-1X10GE-L-V2).
> 
> Any ideas how to get this info ?
> 
> 
> Thanks
> 
> anton
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From david.freedman at uk.clara.net  Fri Jun  5 10:13:40 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Fri, 05 Jun 2009 15:13:40 +0100
Subject: [c-nsp] optical power on SPA 10GE
In-Reply-To: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>
References: <87e0d3ae0906050609g57450eftda4f30e916842e@mail.gmail.com>
Message-ID: <h0b96k$vrl$2@ger.gmane.org>

I omitted the trailing keyword "status"


vince anton wrote:
> Hi All,
> 
> 
> got a quick question:
> 
> Is it possible from a 12k GSR to obtain the optical power levels reaching a
> 10GE SPA.
> 
> With a 'sh controller' I can see the optical power in db reaching my POS
> SPA, but no such luck with 10GE SPA (SPA-1X10GE-L-V2).
> 
> Any ideas how to get this info ?
> 
> 
> Thanks
> 
> anton
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From lists.james.edwards at gmail.com  Fri Jun  5 10:54:14 2009
From: lists.james.edwards at gmail.com (james edwards)
Date: Fri, 5 Jun 2009 08:54:14 -0600
Subject: [c-nsp] help with BGP logs
In-Reply-To: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>
References: <b7f636a60906041146u76135c6bofdc2622f85af149c@mail.gmail.com>
Message-ID: <b7f636a60906050754k3e959e05xc57e6948bbb784bd@mail.gmail.com>

Thanks to those who replied, it turned out to be a bug in Quagga.

Someone advertised 208.185.195.0/24 for about an hour with AS-Pathlimit
attribute. We filtered it out and will upgrade
Quagga. One version of Quagga, 099.9, had a bug and brought down the session
when it received a prefix with
the AS-Pathlimit attribute set.



-- 
James H. Edwards
Senior Network Systems Administrator
Judicial Information Division
jedwards at nmcourts.gov

From RWerber at epiknetworks.com  Fri Jun  5 15:30:37 2009
From: RWerber at epiknetworks.com (Ryan Werber)
Date: Fri, 5 Jun 2009 15:30:37 -0400
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
	<153DAD8392C948D6B0E0864E232B909C@int.convex.pt>
Message-ID: <4D58C7B4943F874BA4CB5D68A7924060B0F5F6@Epikserver2.Epik.local>




>-----Original Message-----
>From: Antonio Soares [mailto:amsoares at netcabo.pt] 
>Sent: Friday, June 05, 2009 4:14 AM

>Wow, this is unbelievable ! Can you show us your "show proc mem | inc
BGP" ? Do you really have two full BGP feeds (about 284k
>prefixes each) ?




#show proc memory  | i BGP
 169   0 2895956668 1123582500  310165452          0          0 BGP
Router
 172   0    3975400 1008225208       6840      53464          0 BGP I/O
 173   0       4188   12111120      14028          0          0 BGP
Scanner

First one is Cogent (174), the Second one is Tiscali (3257).  There are
4 Ibgp Route-Servers as well. we have ~10 full transit feeds throughout
our asn, as well as a ton of peering.  The only thing changed below are
ip addresses to protect the innocent. We currently have ~130 meg free on
the GRP-B. We also have 1 directly connected eBGP IPv6 peer, and 5
throughout our ASN.

38.103.xx.xx   4   174 3895305   60405 22155189    0    0 5w6d
283503
77.67.xx.xx    4  3257 5813157  139266 22155189    0    0 6w6d
282571
PEER-RS-1      4 21513 2472535 3813308 22155189    0    0 15:25:46
100863
RS-1           4 21513 4092583 3613405 22155189    0    0 6w6d
265775
RS-2           4 21513 3244549 3613398 22155189    0    0 6w6d
267897
RS-3           4 21513 5660680 3711962 22155189    0    0 1w1d
284664

show ip cef summary
IP Distributed CEF with switching (Table Version 8565971), flags=0x0
  288375 routes, 0 reresolve, 0 unresolved (0 old, 0 new), peak 18273
  8561775 instant recursive resolutions, 0 used background process
  12 load sharing elements, 12 references
  1389 in-place/0 aborted modifications
  57883336 bytes allocated to the FIB table data structures
  universal per-destination load sharing algorithm, id 6CE54348
  2(0) CEF resets
  Resolution Timer: Exponential (currently 1s, peak 4s)
  Tree summary:
   8-8-8-8 stride pattern
   short mask protection disabled
   288375 leaves, 14605 nodes using 23265244 bytes
  Transient memory used: 149355436, max: 149395476

  Table epoch: 0 (288375 entries at this epoch)

Adjacency Table has 41 adjacencies
  34 IPv4 adjacencies
  7 IPv6 adjacencies



From chale99 at gmail.com  Fri Jun  5 17:31:33 2009
From: chale99 at gmail.com (Chris Hale)
Date: Fri, 5 Jun 2009 17:31:33 -0400
Subject: [c-nsp] SOLVED: Re: strange behavior over MPLS network - remote
	desktop won't work
Message-ID: <db092ca60906051431i3ae0cba8w3ee411bfc936498e@mail.gmail.com>

I set the interfaces between the two 7206's at POP H as well as the GigE
backbone link to mpls mtu 1530, and everything worked.

Thanks all.

Chris

On Mon, Jun 1, 2009 at 4:35 PM, Gert Doering <gert at greenie.muc.de> wrote:

> Hi,
>
> On Sun, May 31, 2009 at 11:22:08PM +0200, Sascha E. Pollok wrote:
> > Also, what kind of FE boards do you use on the 7206?
> > I am currently unsure whether e.g. PA-FE-TX support
> > larger MTUs needed for MPLS/VPN.
>
> "Sort of".  There was a lengthy discussion on this list, about two years
> ago - as far as I remember, the single-port FEs for the 7200s are bugged
> and can only do an MTU up to 1530 bytes.
>
> ... but this still works nicely for simple L3 VPN stuff (1500+4+4).
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                           //
> www.muc.de/~gert/ <http://www.muc.de/%7Egert/>
> Gert Doering - Munich, Germany
> gert at greenie.muc.de
> fax: +49-89-35655025
> gert at net.informatik.tu-muenchen.de
>



-- 
------------------
Chris Hale
chale99 at gmail.com

From walter.keen at RainierConnect.net  Fri Jun  5 17:35:01 2009
From: walter.keen at RainierConnect.net (Walter Keen)
Date: Fri, 05 Jun 2009 14:35:01 -0700
Subject: [c-nsp] 7500 performance (was: Re: IO 7200 GE Improve Performance
 and help with the CPU Load?)
In-Reply-To: <4A269AA1.2030509@rollernet.us>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>	<4A26960D.8070206@cantv.net>	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>	<4A26997F.3030107@cantv.net>
	<4A269AA1.2030509@rollernet.us>
Message-ID: <4A298F85.5060002@rainierconnect.net>

Speaking of CPU performance, does anyone have any feedback on the Cisco 
7500 series, I'm considering using it instead of multiple 7204's to 
aggregate/terminate atm (9 oc3, 1 ds3) and T1 (channelized ds3) traffic, 
I'm looking at the RSP8, with vip4-80's and the appropriate PA's, and 
planning on doing etherchannel on (2) pa-fe's back to our core (7613) 
router.


From gsgranados at comcast.net  Sat Jun  6 02:27:36 2009
From: gsgranados at comcast.net (Scott Granados)
Date: Fri, 5 Jun 2009 23:27:36 -0700
Subject: [c-nsp] ACL creation and editing tool suggestions?
Message-ID: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>

I'm working in an environment with several large (north of 300 lines) ACLs that need managing.  Several different people have had their hands in editing before I arrived and the lists have grown in to large jumbled messes and as such are introducing a lot of error because of their complexity. I'm wondering how people manage large ACLs effectively.  Are there any tools that help in the automation of ACL creation or any good methods, if even by hand, that folks could recommend to help ease the clean up and maintenance process.  Something that could optimize the ACL in automated fashion?

Any pointers would be appreciated.

Thanks
Scott

From rdobbins at arbor.net  Sat Jun  6 06:26:05 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Sat, 6 Jun 2009 17:26:05 +0700
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
Message-ID: <BA2CC3F2-CDF9-4C63-9FE9-980D3EAEEB5B@arbor.net>


On Jun 6, 2009, at 1:27 PM, Scott Granados wrote:

> Something that could optimize the ACL in automated fashion?

None of the commercial tools I've seen do this in a platform-aware way  
- they're oriented towards software routers running T-train, and don't  
take into account hardware platform caveats.

You can start by organizing your ACLs into named and commented text  
files, and using something as simple as RCS to implement version  
control and to check out/check in ACL files for editing.  Lots of  
folks end up using tools like RANCID, RAT, Pancho, et. al. to help  
with auditing, and then custom Perl scripts or somesuch for editing/ 
updating.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From yvanog at hotmail.com  Sat Jun  6 12:51:43 2009
From: yvanog at hotmail.com (Rob Montgomery)
Date: Sat, 6 Jun 2009 12:51:43 -0400
Subject: [c-nsp] FW: 2621XM as Term Server
Message-ID: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>

 

Has anyone configured a 2621XM (ASYNC32A) as a terminal server?


From lukasz at bromirski.net  Sat Jun  6 14:20:15 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sat, 06 Jun 2009 20:20:15 +0200
Subject: [c-nsp] FW: 2621XM as Term Server
In-Reply-To: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>
References: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>
Message-ID: <4A2AB35F.6010806@bromirski.net>

On 2009-06-06 18:51, Rob Montgomery wrote:

> Has anyone configured a 2621XM (ASYNC32A) as a terminal server?

What is the *exact* problem you're facing?

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From sethm at rollernet.us  Sat Jun  6 15:31:05 2009
From: sethm at rollernet.us (Seth Mattinen)
Date: Sat, 06 Jun 2009 12:31:05 -0700
Subject: [c-nsp] FW: 2621XM as Term Server
In-Reply-To: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>
References: <BAY124-DS10A01E0BB9FE2CA4787D7C7490@phx.gbl>
Message-ID: <4A2AC3F9.8080301@rollernet.us>

Rob Montgomery wrote:
>  
> 
> Has anyone configured a 2621XM (ASYNC32A) as a terminal server?
> 

Yes, not with a 2621XM specifically, but they're practically all the same.

~Seth

From zivl at gilat.net  Sun Jun  7 08:48:43 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Sun, 7 Jun 2009 15:48:43 +0300
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
Message-ID: <EC993E87D960A541A66BF21D62AA42A622FF2D2189@exch2k7.gilat.local>

I can't imagine any kind of environment that would need 300 or more lines of ACL, I'm sure most of it is historical trash that can be disposed.
I'd suggest you to try to determine what do you REALLY need and create new ACL based on actual and updated needs, and then just delete the unused old ones.

I have some long ACLs which I'm used to create divided by sections, according to protocols, then most to less specific, stating from permitted and ending with the denies, even when implied I like to put them so it's clear to others, e.g

ip access extended TEST
 permit icmp any any
 permit udp any eq 53 any
 permit tcp any any established
 permit tcp any host 2.2.2.2 eq 80
 permit tcp host 1.1.1.1 host 2.2.2.2 eq 3339
 deny tcp any host 2.2.2.2 eq 3339
 permit ip host 3.3.3.3 4.4.4.0 0.0.0.255
 deny ip any 4.4.4.0 0.0.0.255
 permit ip any any

In case I need to add/remove/edit a working ACL I always use the line numbers
If you do "show ip access-list TEST" for instance you'll get this output:

Extended IP access list TEST
    10 permit icmp any any
    20 permit udp any eq domain any
    30 permit tcp any any established
    40 permit tcp any host 2.2.2.2 eq www
    50 permit tcp host 1.1.1.1 host 2.2.2.2 eq 3339
    60 deny tcp any host 2.2.2.2 eq 3339
    70 permit ip host 3.3.3.3 4.4.4.0 0.0.0.255
    80 deny ip any 4.4.4.0 0.0.0.255
 90 permit ip any any

This allows you to remove a line by doing
conf t
ip access-list extended TEST
no 60
!
Or add a line in between
55 permit tcp host 5.5.5.5 host 2.2.2.2 eq 3339

Which will change your ACL to:

Extended IP access list TEST
    10 permit icmp any any
    20 permit udp any eq domain any
    30 permit tcp any any established
    40 permit tcp any host 2.2.2.2 eq www
    50 permit tcp host 1.1.1.1 host 2.2.2.2 eq 3339
    55 permit tcp host 5.5.5.5 host 2.2.2.2 eq 3339
    60 deny tcp any host 2.2.2.2 eq 3339
    70 permit ip host 3.3.3.3 4.4.4.0 0.0.0.255
    80 deny ip any 4.4.4.0 0.0.0.255
 90 permit ip any any

Anyway, I wouldn't suggest using any kind of automatic stuff, you'll have to actually go line by line, as tedious as it may sound, to determine what exactly you need or not, or just opt to create them from scratch setting only the stuff you're sure you need and save the old ones for reference or future review.
Hope this helps,
Ziv



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Scott Granados
Sent: Saturday, June 06, 2009 9:28 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ACL creation and editing tool suggestions?

I'm working in an environment with several large (north of 300 lines) ACLs that need managing.  Several different people have had their hands in editing before I arrived and the lists have grown in to large jumbled messes and as such are introducing a lot of error because of their complexity. I'm wondering how people manage large ACLs effectively.  Are there any tools that help in the automation of ACL creation or any good methods, if even by hand, that folks could recommend to help ease the clean up and maintenance process.  Something that could optimize the ACL in automated fashion?

Any pointers would be appreciated.

Thanks
Scott
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From ygauteron at gmail.com  Sun Jun  7 11:45:53 2009
From: ygauteron at gmail.com (Yann Gauteron)
Date: Sun, 7 Jun 2009 17:45:53 +0200
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A622FF2D2189@exch2k7.gilat.local>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
	<EC993E87D960A541A66BF21D62AA42A622FF2D2189@exch2k7.gilat.local>
Message-ID: <8097baf0906070845l3cd1e20bmb989a322e1bcfc60@mail.gmail.com>

2009/6/7 Ziv Leyes <zivl at gilat.net>:
> I can't imagine any kind of environment that would need 300 or more lines of ACL, I'm sure most of it is historical trash that can be disposed.
> I'd suggest you to try to determine what do you REALLY need and create new ACL based on actual and updated needs, and then just delete the unused old ones.

I can imagine a design where subnets are badly aggregated and where an
ACL entry has to be repeated many times because it has to be applied
to non-adjacent subnets that should have the same access control
applied. I have seen this once... This was the result of historical
evolution of the network without never thinking more steps forward
than just the present augmentation (for instance reserving some
ajdacent IP subnets for future extensions). ACL management is a
nightmare, but redesigning the network was just something that was not
considered by the company (because of the time and costs, and "why
would I redesign it, as it operates as expected ?")

From ibrahim.abozaid at gmail.com  Sun Jun  7 19:09:53 2009
From: ibrahim.abozaid at gmail.com (Ibrahim Abo Zaid)
Date: Mon, 8 Jun 2009 02:09:53 +0300
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
Message-ID: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>

Hi All


I am trying to establish L2 Etherchannel between 2 7609 routers ,
SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
12.2(33)SRD*

are there any concerns to establish this etherchannel between ports in
different line cards ?


best regards
--Ibrahim

From peter at rathlev.dk  Sun Jun  7 20:01:16 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 08 Jun 2009 02:01:16 +0200
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
In-Reply-To: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
References: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
Message-ID: <1244419276.3423.70.camel@localhost.localdomain>

On Mon, 2009-06-08 at 02:09 +0300, Ibrahim Abo Zaid wrote:
> I am trying to establish L2 Etherchannel between 2 7609 routers ,
> SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
> 12.2(33)SRD*
> 
> are there any concerns to establish this etherchannel between ports in
> different line cards ?

Etherchannels are a little pointless on the WS-X6148-GE card and
similiar. They have 1GB/s ASICs, so you'll never exceed 1GB/s anyhow.
And the ASIC to physical port ratio also limits you.

But generally speaking, cross module etherchannels are a good idea and
AFAIK is recommended from Cisco for high availability.

Regards,
Peter



From paul at paulstewart.org  Sun Jun  7 20:07:41 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Sun, 7 Jun 2009 20:07:41 -0400
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
In-Reply-To: <1244419276.3423.70.camel@localhost.localdomain>
References: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
	<1244419276.3423.70.camel@localhost.localdomain>
Message-ID: <000901c9e7cd$24df84b0$6e9e8e10$@org>

You may wish to clarify the 1Gb/s limit however on the 6148A unless I am
mistaken.  Yes, 1 Gig per ASIC but doesn't the 6148A have one ASIC per 8
ports or am I thinking of a different card?  

Thank you for the clarification...

Paul



-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Rathlev
Sent: June 7, 2009 8:01 PM
To: Ibrahim Abo Zaid
Cc: cisco_nsp
Subject: Re: [c-nsp] 7600 router and Etherchannel across multiple line card

On Mon, 2009-06-08 at 02:09 +0300, Ibrahim Abo Zaid wrote:
> I am trying to establish L2 Etherchannel between 2 7609 routers ,
> SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
> 12.2(33)SRD*
> 
> are there any concerns to establish this etherchannel between ports in
> different line cards ?

Etherchannels are a little pointless on the WS-X6148-GE card and
similiar. They have 1GB/s ASICs, so you'll never exceed 1GB/s anyhow.
And the ASIC to physical port ratio also limits you.

But generally speaking, cross module etherchannels are a good idea and
AFAIK is recommended from Cisco for high availability.

Regards,
Peter


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From paul at paulstewart.org  Sun Jun  7 20:10:30 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Sun, 7 Jun 2009 20:10:30 -0400
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
In-Reply-To: <1244419276.3423.70.camel@localhost.localdomain>
References: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
	<1244419276.3423.70.camel@localhost.localdomain>
Message-ID: <000a01c9e7cd$8958f430$9c0adc90$@org>

Apologies for bumping the post....

My notes show the following:

WS-X6148A-GE-TX 
*Number of ports: 48 
Number of port groups: 6 
Port ranges per port group: 1-8, 9-16, 17-24, 25-32, 33-40, 41-48 *The 
aggregate bandwidth of each port group is 1 Gbps. 

WS-X6148-GE-TX 
*Number of ports: 48 
Number of port groups: 2 
Port ranges per port group: 1-24, 25-48 
Note WS-X6148-GE-TX, WS-X6148V-GE-TX, and WS-X6148-GE-45AF do not 
support these features: 
*More than 1 Gbps of traffic per EtherChannel

Sorry, I was thinking 6148A and the OP has specified the non-A version hence
the confusion on my part...

Thanks,

Paul


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Rathlev
Sent: June 7, 2009 8:01 PM
To: Ibrahim Abo Zaid
Cc: cisco_nsp
Subject: Re: [c-nsp] 7600 router and Etherchannel across multiple line card

On Mon, 2009-06-08 at 02:09 +0300, Ibrahim Abo Zaid wrote:
> I am trying to establish L2 Etherchannel between 2 7609 routers ,
> SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
> 12.2(33)SRD*
> 
> are there any concerns to establish this etherchannel between ports in
> different line cards ?

Etherchannels are a little pointless on the WS-X6148-GE card and
similiar. They have 1GB/s ASICs, so you'll never exceed 1GB/s anyhow.
And the ASIC to physical port ratio also limits you.

But generally speaking, cross module etherchannels are a good idea and
AFAIK is recommended from Cisco for high availability.

Regards,
Peter


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From dstorandt at teljet.com  Sun Jun  7 20:51:22 2009
From: dstorandt at teljet.com (David Storandt)
Date: Sun, 7 Jun 2009 20:51:22 -0400
Subject: [c-nsp] 7500 performance
Message-ID: <f52f476c0906071751m4ff1cdddy993e4fcaeac0b8e2@mail.gmail.com>

Have you seen Cisco's performance spec sheet? Once of their better
references for rough platform performance estimation.

http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf

A RSP8 is a touch faster than a 720x/NPE400, but also the 7500-series
distributed switching capability will offload the CPU when it doesn't
have to deal with forwarding, leaving more cycles for pure software
processes.

-Dave

From sfischer1967 at gmail.com  Sun Jun  7 22:47:58 2009
From: sfischer1967 at gmail.com (Steven Fischer)
Date: Sun, 7 Jun 2009 22:47:58 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
Message-ID: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>

I have a 4510 in our environment that is reporting literally dozens of
changes to the running configuration throughout the day - days on which I am
certain no changes have been made to it - the syslog message is given with
the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
whole lot.  Any ideas on what could be causing this?

-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy

From rdobbins at arbor.net  Sun Jun  7 23:00:22 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Mon, 8 Jun 2009 10:00:22 +0700
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
Message-ID: <A9443A5C-3795-4CFF-B1F1-8E1FA5A5FABD@arbor.net>


On Jun 8, 2009, at 9:47 AM, Steven Fischer wrote:

> Any ideas on what could be causing this?

Are you doing config diffs in order to ensure that no changes are in  
fact being made?  Have you looked through the AAA logs to look at  
logins/logouts and commands executed by authorized personnel?

You should consider the possibility that someone other than authorized  
personnel within your organization is making changes, and investigate  
accordingly - especially if all the usual BCPs around iACLs, vty ACLs,  
AAA, strong local account/password, et. al. haven't yet been  
implemented.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From sfischer1967 at gmail.com  Sun Jun  7 23:02:45 2009
From: sfischer1967 at gmail.com (Steven Fischer)
Date: Sun, 7 Jun 2009 23:02:45 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>
Message-ID: <500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>

indeed, we are running RANCID...good call.  and they are periodic...but none
of my other devices do this, and we have another 4510 that doesn't appear to
be doing it either.

can anything be done?  I'm just waiting for management to see this and
wonder what in blue-blazes is going on, and then to panic.

On Sun, Jun 7, 2009 at 10:56 PM, Ryan West <rwest at zyedge.com> wrote:

> Are you running any type of backup utility (RANCID etc) that might be
> triggering your logs?  Are the timestamps periodic or random?
>
> -ryan
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:
> cisco-nsp-bounces at puck.nether.net] On Behalf Of Steven Fischer
> Sent: Sunday, June 07, 2009 10:48 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
> day...
>
> I have a 4510 in our environment that is reporting literally dozens of
> changes to the running configuration throughout the day - days on which I
> am
> certain no changes have been made to it - the syslog message is given with
> the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
> whole lot.  Any ideas on what could be causing this?
>
> --
> To him who is able to keep you from falling and to present you before his
> glorious presence without fault and with great joy
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy

From rdobbins at arbor.net  Sun Jun  7 23:13:00 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Mon, 8 Jun 2009 10:13:00 +0700
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>
	<500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>
Message-ID: <80C93820-59A7-49E7-9617-F40B68EBAB5D@arbor.net>


On Jun 8, 2009, at 10:02 AM, Steven Fischer wrote:

> can anything be done?


Assuming it's RANCID or something else legit, and assuming that you in  
fact don't want to see this in your logs (why non-technical management  
are looking at your logs in the first place is an interesting  
question, heh), is the log-level on this box different than the log- 
level on the other boxes?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From andhy.indarto at indosat.com  Sun Jun  7 22:38:59 2009
From: andhy.indarto at indosat.com (Andhy Indarto)
Date: Mon, 8 Jun 2009 09:38:59 +0700
Subject: [c-nsp] atm oam ping ok but ping ip not ok
Message-ID: <2233A6BE8D55AE4C9119D7870748FC310C6AEB90@isatjkt-msg01.office.corp.indosat.com>

Dear all,

I have experience with ATM interface that when I do atm oam ping the
result is normal but when I do ping ip then the result is bad and have a
lot of packet loss.

This is the reslt of atm oam ping :

Sending 500, 53-byte end-to-end OAM echoes, timeout is 2 seconds:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Success rate is 100 percent (500/500), round-trip min/avg/max = 4/6/16
ms

 

And this is the result of ping ip :

Sending 100, 100-byte ICMP Echos to 10.149.3.97, timeout is 2 seconds:

..!!..!!!.!!!..!...!!!.!!!!.!.!!!!.!!...!...!..!!!..!!!.!!!.!!..!!....

..!..!!..!!!.!.!!!...!!..!..!!

Success rate is 53 percent (53/100), round-trip min/avg/max = 4/4/8 ms

I am new with atm and I have to troubleshoot inter-city link using ATM,
what is the cause of L2 ping ok but L3 ping is bad ? What is the
troubleshooting scenario that I should do to verify and find the root
cause ?

Thanks

andhi




*****
"This message is intended only for recipients who are authorized to receive it. 
It contains confidential and/ or legally priveleged information belong to PT INDOSAT Tbk ("INDOSAT"), therefore the authorized recipients shall  protect this confidential information disclosed pursuant to provisions of Indosat's policy.
If you are not a valid recipient of this message, please delete it from your system and/ or destroy all of the tangible material produced from the information herein together with all copies or reproductions thereof and notify the sender immediately. 
Please also be notified that any disclosure, copying, distribution or taking any action based on the contents of this message is strictly prohibited and may be unlawful".
*****

From rwest at zyedge.com  Sun Jun  7 22:56:32 2009
From: rwest at zyedge.com (Ryan West)
Date: Sun, 7 Jun 2009 22:56:32 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout
	the	day...
In-Reply-To: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>

Are you running any type of backup utility (RANCID etc) that might be triggering your logs?  Are the timestamps periodic or random?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Steven Fischer
Sent: Sunday, June 07, 2009 10:48 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the day...

I have a 4510 in our environment that is reporting literally dozens of
changes to the running configuration throughout the day - days on which I am
certain no changes have been made to it - the syslog message is given with
the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
whole lot.  Any ideas on what could be causing this?

-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From rwest at zyedge.com  Sun Jun  7 23:20:38 2009
From: rwest at zyedge.com (Ryan West)
Date: Sun, 7 Jun 2009 23:20:38 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
 day...
In-Reply-To: <500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074D@zy-ex1.zyedge.local>
	<500ffb690906072002w9922a52q61ba5a32350baae1@mail.gmail.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E14012482A9074F@zy-ex1.zyedge.local>

Without seeing the differences between configs on your 4510's, I would look at the archive section of the config to see if the auditing is enabled.

-ryan

From: Steven Fischer [mailto:sfischer1967 at gmail.com]
Sent: Sunday, June 07, 2009 11:03 PM
To: Ryan West
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] 4510 reporting dozens of config changes throughout the day...

indeed, we are running RANCID...good call.  and they are periodic...but none of my other devices do this, and we have another 4510 that doesn't appear to be doing it either.

can anything be done?  I'm just waiting for management to see this and wonder what in blue-blazes is going on, and then to panic.
On Sun, Jun 7, 2009 at 10:56 PM, Ryan West <rwest at zyedge.com<mailto:rwest at zyedge.com>> wrote:
Are you running any type of backup utility (RANCID etc) that might be triggering your logs?  Are the timestamps periodic or random?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net<mailto:cisco-nsp-bounces at puck.nether.net> [mailto:cisco-nsp-bounces at puck.nether.net<mailto:cisco-nsp-bounces at puck.nether.net>] On Behalf Of Steven Fischer
Sent: Sunday, June 07, 2009 10:48 PM
To: cisco-nsp at puck.nether.net<mailto:cisco-nsp at puck.nether.net>
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the day...

I have a 4510 in our environment that is reporting literally dozens of
changes to the running configuration throughout the day - days on which I am
certain no changes have been made to it - the syslog message is given with
the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
whole lot.  Any ideas on what could be causing this?

--
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net<mailto:cisco-nsp at puck.nether.net>
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



--
To him who is able to keep you from falling and to present you before his glorious presence without fault and with great joy

From swmike at swm.pp.se  Mon Jun  8 01:27:14 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Mon, 8 Jun 2009 07:27:14 +0200 (CEST)
Subject: [c-nsp] atm oam ping ok but ping ip not ok
In-Reply-To: <2233A6BE8D55AE4C9119D7870748FC310C6AEB90@isatjkt-msg01.office.corp.indosat.com>
References: <2233A6BE8D55AE4C9119D7870748FC310C6AEB90@isatjkt-msg01.office.corp.indosat.com>
Message-ID: <alpine.DEB.1.10.0906080725370.22851@uplift.swm.pp.se>

On Mon, 8 Jun 2009, Andhy Indarto wrote:

> I am new with atm and I have to troubleshoot inter-city link using ATM, 
> what is the cause of L2 ping ok but L3 ping is bad ? What is the 
> troubleshooting scenario that I should do to verify and find the root 
> cause ?

When I've run into this it's always been that the routers are sending 
packets with higher bitrate than the ATM network is policing cellrate to. 
Make sure you have the correct UBR in your routers compared to what the 
ATM network is policing the PVC to.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From david.freedman at uk.clara.net  Mon Jun  8 05:23:46 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 08 Jun 2009 10:23:46 +0100
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
 day...
In-Reply-To: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
Message-ID: <4A2CD8A2.8050809@uk.clara.net>

Silly question, but are you running RANCID and do these changes appear
to be to port/vlan membership?

It is quite a common occurrence to have flapping ports be shown as
members and then suddenly not members of a vlan when rancid executes the
"show vlan" command.

Dave.


Steven Fischer wrote:
> I have a 4510 in our environment that is reporting literally dozens of
> changes to the running configuration throughout the day - days on which I am
> certain no changes have been made to it - the syslog message is given with
> the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
> whole lot.  Any ideas on what could be causing this?
> 


From david.freedman at uk.clara.net  Mon Jun  8 05:23:46 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 08 Jun 2009 10:23:46 +0100
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
 day...
In-Reply-To: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
Message-ID: <4A2CD8A2.8050809@uk.clara.net>

Silly question, but are you running RANCID and do these changes appear
to be to port/vlan membership?

It is quite a common occurrence to have flapping ports be shown as
members and then suddenly not members of a vlan when rancid executes the
"show vlan" command.

Dave.


Steven Fischer wrote:
> I have a 4510 in our environment that is reporting literally dozens of
> changes to the running configuration throughout the day - days on which I am
> certain no changes have been made to it - the syslog message is given with
> the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
> whole lot.  Any ideas on what could be causing this?
> 


From david.freedman at uk.clara.net  Mon Jun  8 05:26:40 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 08 Jun 2009 10:26:40 +0100
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
Message-ID: <4A2CD950.70704@uk.clara.net>

A newcomer to the 12.4(T) train is "ACL Object Groups"

http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_object_group_acl.html

I can see this making everybody's lives useful when it hits real
production trains.

For the time being, I'm emulating this functionality with my own
home-grown software.

Dave.


Scott Granados wrote:
> I'm working in an environment with several large (north of 300 lines) ACLs that need managing.  Several different people have had their hands in editing before I arrived and the lists have grown in to large jumbled messes and as such are introducing a lot of error because of their complexity. I'm wondering how people manage large ACLs effectively.  Are there any tools that help in the automation of ACL creation or any good methods, if even by hand, that folks could recommend to help ease the clean up and maintenance process.  Something that could optimize the ACL in automated fashion?
> 
> Any pointers would be appreciated.
> 
> Thanks
> Scott
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From david.freedman at uk.clara.net  Mon Jun  8 05:26:40 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 08 Jun 2009 10:26:40 +0100
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
Message-ID: <4A2CD950.70704@uk.clara.net>

A newcomer to the 12.4(T) train is "ACL Object Groups"

http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_object_group_acl.html

I can see this making everybody's lives useful when it hits real
production trains.

For the time being, I'm emulating this functionality with my own
home-grown software.

Dave.


Scott Granados wrote:
> I'm working in an environment with several large (north of 300 lines) ACLs that need managing.  Several different people have had their hands in editing before I arrived and the lists have grown in to large jumbled messes and as such are introducing a lot of error because of their complexity. I'm wondering how people manage large ACLs effectively.  Are there any tools that help in the automation of ACL creation or any good methods, if even by hand, that folks could recommend to help ease the clean up and maintenance process.  Something that could optimize the ACL in automated fashion?
> 
> Any pointers would be appreciated.
> 
> Thanks
> Scott
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From tom at netspot.com.au  Mon Jun  8 05:36:26 2009
From: tom at netspot.com.au (Tom Lanyon)
Date: Mon, 8 Jun 2009 19:06:26 +0930
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <4A2CD8A2.8050809@uk.clara.net>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<4A2CD8A2.8050809@uk.clara.net>
Message-ID: <BAC5728D-B7DE-4760-891D-56CB3F752F6D@netspot.com.au>

On 08/06/2009, at 6:53 PM, David Freedman wrote:

> Silly question, but are you running RANCID and do these changes appear
> to be to port/vlan membership?
>
> It is quite a common occurrence to have flapping ports be shown as
> members and then suddenly not members of a vlan when rancid executes  
> the
> "show vlan" command.


That shouldn't cause a AUDIT-5-RUN_CONFIG log message though, right?

Tom

From sfischer1967 at gmail.com  Mon Jun  8 06:01:15 2009
From: sfischer1967 at gmail.com (Steven Fischer)
Date: Mon, 8 Jun 2009 06:01:15 -0400
Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
	day...
In-Reply-To: <BAC5728D-B7DE-4760-891D-56CB3F752F6D@netspot.com.au>
References: <500ffb690906071947n60d38714v7f4c4ea7812a1edd@mail.gmail.com>
	<4A2CD8A2.8050809@uk.clara.net>
	<BAC5728D-B7DE-4760-891D-56CB3F752F6D@netspot.com.au>
Message-ID: <500ffb690906080301p40dfd68bu4a74c721ae3ea083@mail.gmail.com>

doing a compare, I found a single config element, "ip ssh logging events"
that was present on the device generating the messages, but not on the 4510
that isn't.  Removed it, and will see what that does.

On Mon, Jun 8, 2009 at 5:36 AM, Tom Lanyon <tom at netspot.com.au> wrote:

> On 08/06/2009, at 6:53 PM, David Freedman wrote:
>
> Silly question, but are you running RANCID and do these changes appear
>> to be to port/vlan membership?
>>
>> It is quite a common occurrence to have flapping ports be shown as
>> members and then suddenly not members of a vlan when rancid executes the
>> "show vlan" command.
>>
>
>
> That shouldn't cause a AUDIT-5-RUN_CONFIG log message though, right?
>
> Tom
>



-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy

From karim.adel at gmail.com  Mon Jun  8 06:13:01 2009
From: karim.adel at gmail.com (Kasper Adel)
Date: Mon, 8 Jun 2009 13:13:01 +0300
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
Message-ID: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>

Hello,

I'm looking for a way to measure Jitter for a VoIP network and i cant get my
hands on IXIA or any fancy tool like that so i'm asking if anyone used any
open source tool specifically for the matter.

IPerf is an option but i've never used it, so can you guys point me if i can
be used and what are the tests that i can try with it, my skills on *nix and
these tools is similar to my skills with Chinese poetry ;)

Thanks,
Kas

From Ian.Mackinnon at lumison.net  Mon Jun  8 06:19:12 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Mon, 8 Jun 2009 11:19:12 +0100
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D91C2BB9@nbg01-exch-01.entlstaff.domain.lumison.net>

Is using IP SLA functionality on your routers an option?
Then graph the data with Cacti or mrtg.
Or smoke ping, http://oss.oetiker.ch/smokeping/


> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Kasper Adel
> Sent: 08 June 2009 11:13
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
>
> Hello,
>
> I'm looking for a way to measure Jitter for a VoIP network and i cant
> get my
> hands on IXIA or any fancy tool like that so i'm asking if anyone used
> any
> open source tool specifically for the matter.
>
> IPerf is an option but i've never used it, so can you guys point me if
> i can
> be used and what are the tests that i can try with it, my skills on
> *nix and
> these tools is similar to my skills with Chinese poetry ;)
>
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From peter at rathlev.dk  Mon Jun  8 06:24:56 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 08 Jun 2009 12:24:56 +0200
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <1244456696.5100.37.camel@localhost.localdomain>

On Mon, 2009-06-08 at 13:13 +0300, Kasper Adel wrote:
> I'm looking for a way to measure Jitter for a VoIP network and i cant
> get my hands on IXIA or any fancy tool like that so i'm asking if
> anyone used any open source tool specifically for the matter.
> 
> IPerf is an option but i've never used it, so can you guys point me if
> i can be used and what are the tests that i can try with it, my skills
> on *nix and these tools is similar to my skills with Chinese poetry ;)

We use IP SLA / RTR measuring and graph it via Cacti. This URL describes
the procedure for installing the required templates in Cacti:

desc
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From peter at rathlev.dk  Mon Jun  8 06:25:57 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 08 Jun 2009 12:25:57 +0200
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <1244456757.5100.38.camel@localhost.localdomain>

(Hist Ctrl+Enter a little fast before, sorry. :-))

On Mon, 2009-06-08 at 13:13 +0300, Kasper Adel wrote:
> I'm looking for a way to measure Jitter for a VoIP network and i cant
> get my hands on IXIA or any fancy tool like that so i'm asking if
> anyone used any open source tool specifically for the matter.
> 
> IPerf is an option but i've never used it, so can you guys point me if
> i can be used and what are the tests that i can try with it, my skills
> on *nix and these tools is similar to my skills with Chinese poetry ;)

We use IP SLA / RTR measuring and graph it via Cacti. This URL describes
the procedure for installing the required templates in Cacti:

http://forums.cacti.net/about19542.html

Regards,
Peter



From masood at nexlinx.net.pk  Mon Jun  8 07:31:51 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Mon, 8 Jun 2009 16:31:51 +0500 (PKT)
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>

MTR is a nice tool to check delay, loss and jitter stuff. If you wana keep
track of historic logs, you can use nagios (or a tool like nagios).

You can write your own scripts (using tcl, bash, perl or whatever u like)
to monitor delay, jitter and loss and can feed the output to nagios for
historic logs.

Regards,
Masood


> Hello,
>
> I'm looking for a way to measure Jitter for a VoIP network and i cant get
> my
> hands on IXIA or any fancy tool like that so i'm asking if anyone used any
> open source tool specifically for the matter.
>
> IPerf is an option but i've never used it, so can you guys point me if i
> can
> be used and what are the tests that i can try with it, my skills on *nix
> and
> these tools is similar to my skills with Chinese poetry ;)
>
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From karim.adel at gmail.com  Mon Jun  8 06:53:33 2009
From: karim.adel at gmail.com (Kasper Adel)
Date: Mon, 8 Jun 2009 13:53:33 +0300
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <e05f39290906080353j21135d03i4372f2d811aaee6b@mail.gmail.com>

Thanks guys, the customer is looking for a third party vendor for this test
because we already used IP SLA and it looks good but the Media Gateways
vendor has its own measurement tool inside and they mentioned that their
values are bad (8 msec jittter).

Cheers,
Kas

On Mon, Jun 8, 2009 at 2:31 PM, <masood at nexlinx.net.pk> wrote:

> MTR is a nice tool to check delay, loss and jitter stuff. If you wana keep
> track of historic logs, you can use nagios (or a tool like nagios).
>
> You can write your own scripts (using tcl, bash, perl or whatever u like)
> to monitor delay, jitter and loss and can feed the output to nagios for
> historic logs.
>
> Regards,
> Masood
>
>
> > Hello,
> >
> > I'm looking for a way to measure Jitter for a VoIP network and i cant get
> > my
> > hands on IXIA or any fancy tool like that so i'm asking if anyone used
> any
> > open source tool specifically for the matter.
> >
> > IPerf is an option but i've never used it, so can you guys point me if i
> > can
> > be used and what are the tests that i can try with it, my skills on *nix
> > and
> > these tools is similar to my skills with Chinese poetry ;)
> >
> > Thanks,
> > Kas
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
>
>
>

From ray at oneunified.net  Mon Jun  8 07:02:52 2009
From: ray at oneunified.net (Ray Burkholder)
Date: Mon, 8 Jun 2009 08:02:52 -0300
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080353j21135d03i4372f2d811aaee6b@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>	<35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
	<e05f39290906080353j21135d03i4372f2d811aaee6b@mail.gmail.com>
Message-ID: <052801c9e828$ca440100$5ecc0300$@net>

> 
> Thanks guys, the customer is looking for a third party vendor for this
> test
> because we already used IP SLA and it looks good but the Media Gateways
> vendor has its own measurement tool inside and they mentioned that
> their
> values are bad (8 msec jittter).

Obtain nProbe from NTOP.  It can be used to collect jitter statistics,
amongst other things.  nProbe has a small, reasonable one time licensing
fee.  Use any version 9 netflow analyzer to look at the statistics.

http://www.oneunified.net/blog/OpenSource/Debian/Monitoring/ntop.article

> 
> 
> On Mon, Jun 8, 2009 at 2:31 PM, <masood at nexlinx.net.pk> wrote:
> 
> > MTR is a nice tool to check delay, loss and jitter stuff. If you wana
> keep
> > track of historic logs, you can use nagios (or a tool like nagios).
> >
> > You can write your own scripts (using tcl, bash, perl or whatever u
> like)
> > to monitor delay, jitter and loss and can feed the output to nagios
> for
> > historic logs.
> >
> >
> > > Hello,
> > >
> > > I'm looking for a way to measure Jitter for a VoIP network and i
> cant get
> > > my
> > > hands on IXIA or any fancy tool like that so i'm asking if anyone
> used
> > any
> > > open source tool specifically for the matter.
> > >
> > > IPerf is an option but i've never used it, so can you guys point me
> if i
> > > can
> > > be used and what are the tests that i can try with it, my skills on
> *nix
> > > and
> > > these tools is similar to my skills with Chinese poetry ;)
> > >


-- 
Scanned for viruses and dangerous content at 
http://www.oneunified.net and is believed to be clean.


From rodunn at cisco.com  Mon Jun  8 07:15:28 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Mon, 8 Jun 2009 07:15:28 -0400
Subject: [c-nsp] 7500 performance (was: Re: IO 7200 GE Improve
	Performance and help with the CPU Load?)
In-Reply-To: <4A298F85.5060002@rainierconnect.net>
References: <4A268001.8030101@cantv.net>
	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>
	<4A269036.3080507@cantv.net>
	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>
	<4A26960D.8070206@cantv.net>
	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>
	<4A26997F.3030107@cantv.net> <4A269AA1.2030509@rollernet.us>
	<4A298F85.5060002@rainierconnect.net>
Message-ID: <20090608111528.GE1288@rtp-cse-489.cisco.com>

As long as you want just basic IP with very little features and
you make sure it's all dCEF switched you will probably be ok.

Watch the VIP cpu loads though if you pack the oc3's and etherchannels.

It's all software, although distributed, switching.

Rodney

On Fri, Jun 05, 2009 at 02:35:01PM -0700, Walter Keen wrote:
> Speaking of CPU performance, does anyone have any feedback on the Cisco 
> 7500 series, I'm considering using it instead of multiple 7204's to 
> aggregate/terminate atm (9 oc3, 1 ds3) and T1 (channelized ds3) traffic, 
> I'm looking at the RSP8, with vip4-80's and the appropriate PA's, and 
> planning on doing etherchannel on (2) pa-fe's back to our core (7613) 
> router.
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From pekkas at netcore.fi  Mon Jun  8 07:17:46 2009
From: pekkas at netcore.fi (Pekka Savola)
Date: Mon, 8 Jun 2009 14:17:46 +0300 (EEST)
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<35132.196.46.241.57.1244460711.squirrel@nexmail1.nexlinx.net.pk>
Message-ID: <alpine.LRH.2.00.0906081415520.26369@netcore.fi>

On Mon, 8 Jun 2009, masood at nexlinx.net.pk wrote:
> MTR is a nice tool to check delay, loss and jitter stuff. If you wana keep
> track of historic logs, you can use nagios (or a tool like nagios).

Note that MTR is measuring almost everything it does from the ICMPs 
generated by the routers.  As such it doesn't necessarily give the 
right idea of end-to-end network properties.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

From bbc at misn.com  Mon Jun  8 08:46:06 2009
From: bbc at misn.com (Bryan Campbell)
Date: Mon, 08 Jun 2009 07:46:06 -0500
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <1244465167.7701.8.camel@home-desktop>


You cannot measure VOIP (sip) jitter using ICMP tools.  You will only
isolate false positives when the ICMP is not doing well.

Route or mirror the customers traffic trough a monitoring station.  Run
tcpdump or Wireshark to get a pcap file that contains traffic of
interest.  Wash the pcap file through the Wireshark VOIP analysis tool
to find your jitter.  It is a standard tool in Wireshark.

If you can't find jitter in this manner, it cannot be found.  If it
cannot be found, it doesn't exist.

bbc at misn.com



On Mon, 2009-06-08 at 13:13 +0300, Kasper Adel wrote:
> Hello,
> 
> I'm looking for a way to measure Jitter for a VoIP network and i cant get my
> hands on IXIA or any fancy tool like that so i'm asking if anyone used any
> open source tool specifically for the matter.
> 
> IPerf is an option but i've never used it, so can you guys point me if i can
> be used and what are the tests that i can try with it, my skills on *nix and
> these tools is similar to my skills with Chinese poetry ;)
> 
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From eric at atlantech.net  Mon Jun  8 10:06:21 2009
From: eric at atlantech.net (Eric Van Tol)
Date: Mon, 8 Jun 2009 10:06:21 -0400
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <1244465167.7701.8.camel@home-desktop>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<1244465167.7701.8.camel@home-desktop>
Message-ID: <2C05E949E19A9146AF7BDF9D44085B8635399EACA9@exchange.aoihq.local>

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Bryan Campbell
> Sent: Monday, June 08, 2009 8:46 AM
> To: Kasper Adel
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Opensource tool to measure Jitter for VoIP
> 
> 
> You cannot measure VOIP (sip) jitter using ICMP tools.  You will only
> isolate false positives when the ICMP is not doing well.
> 
> Route or mirror the customers traffic trough a monitoring station.  Run
> tcpdump or Wireshark to get a pcap file that contains traffic of
> interest.  Wash the pcap file through the Wireshark VOIP analysis tool
> to find your jitter.  It is a standard tool in Wireshark.
> 
> If you can't find jitter in this manner, it cannot be found.  If it
> cannot be found, it doesn't exist.
> 
> bbc at misn.com

What are the there legal ramifications to this?  While I like to think that "it's my network, I'll do what I want to measure its performance", I *think* that sniffing voice traffic without consent is considered wiretapping.  IANAL, but it would behoove you to get a consent form from your customer prior to taking this route, just in case.

-evt

From moua0100 at umn.edu  Mon Jun  8 10:11:29 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Mon, 08 Jun 2009 09:11:29 -0500
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
Message-ID: <4A2D1C11.3010105@umn.edu>

smokeping

supports latency metrics out of the box; add plugins for jitter

easy to install (debian based *nix)
apt-get install smokeping



Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Kasper Adel wrote:
> Hello,
>
> I'm looking for a way to measure Jitter for a VoIP network and i cant get my
> hands on IXIA or any fancy tool like that so i'm asking if anyone used any
> open source tool specifically for the matter.
>
> IPerf is an option but i've never used it, so can you guys point me if i can
> be used and what are the tests that i can try with it, my skills on *nix and
> these tools is similar to my skills with Chinese poetry ;)
>
> Thanks,
> Kas
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From mcgrath at fas.harvard.edu  Mon Jun  8 09:46:38 2009
From: mcgrath at fas.harvard.edu (Scott McGrath)
Date: Mon, 8 Jun 2009 08:46:38 -0500
Subject: [c-nsp] 4510 reporting dozens of config changes throughout
 the	day...
Message-ID: <0964463E42710F45AD34A9F2D9F249DC22A62F8735@34093-MBX-C05.mex07a.mlsrvr.com>

Port autonegotiation may be a cause you may prefer not logging port status changes which DO alter the running config

Sent with Good (www.good.com)


 -----Original Message-----
From: 	Steven Fischer [mailto:sfischer1967 at gmail.com]
Sent:	Sunday, June 07, 2009 10:06 PM Central Standard Time
To:	Ryan West
Cc:	cisco-nsp at puck.nether.net
Subject:	Re: [c-nsp] 4510 reporting dozens of config changes throughout the	day...

indeed, we are running RANCID...good call.  and they are periodic...but none
of my other devices do this, and we have another 4510 that doesn't appear to
be doing it either.

can anything be done?  I'm just waiting for management to see this and
wonder what in blue-blazes is going on, and then to panic.

On Sun, Jun 7, 2009 at 10:56 PM, Ryan West <rwest at zyedge.com> wrote:

> Are you running any type of backup utility (RANCID etc) that might be
> triggering your logs?  Are the timestamps periodic or random?
>
> -ryan
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:
> cisco-nsp-bounces at puck.nether.net] On Behalf Of Steven Fischer
> Sent: Sunday, June 07, 2009 10:48 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 4510 reporting dozens of config changes throughout the
> day...
>
> I have a 4510 in our environment that is reporting literally dozens of
> changes to the running configuration throughout the day - days on which I
> am
> certain no changes have been made to it - the syslog message is given with
> the header -  AUDIT-5-RUN_CONFIG.  Cisco's support site doesn't give me a
> whole lot.  Any ideas on what could be causing this?
>
> --
> To him who is able to keep you from falling and to present you before his
> glorious presence without fault and with great joy
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
To him who is able to keep you from falling and to present you before his
glorious presence without fault and with great joy
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From paul at paulstewart.org  Mon Jun  8 11:04:19 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Mon, 8 Jun 2009 11:04:19 -0400
Subject: [c-nsp] BGP Advertising - Question re more specific block
In-Reply-To: <200906081038.30501.kratzers@pa.net>
References: <004201c9e463$b72ec280$258c4780$@org>
	<200906081038.30501.kratzers@pa.net>
Message-ID: <001301c9e84a$66b67fb0$34237f10$@org>

Thank you....

We've messed already with a number of the options as you mentioned - this is
really a last resort from our viewpoint. ;)  The upstream (AS3320) does not
have good reach when going against our other upstreams/peering and we are
locked in a contract so trying to hit our minimum commit with them as best
as we can.

When we do some granular local-pref options it swings traffic around too
"dramatically" - using communities doesn't seem to resolve it neither (would
have thought it would actually)...

Appreciate it,

Paul


-----Original Message-----
From: Stephen Kratzer [mailto:kratzers at pa.net] 
Sent: Monday, June 08, 2009 10:39 AM
To: cisco-nsp at puck.nether.net
Cc: Paul Stewart
Subject: Re: [c-nsp] BGP Advertising - Question re more specific block

If the provider to which you are advertising a /22 is well-connected, I
would 
suggest determining what communities they support and try having them bump 
local pref up for the /18 and removing the more specific advertisements. If 
that brings too much traffic in via that provider, consider advertising 
the /18 with default local pref, but advertising a few more specifics with 
either no-advertise or no-export communities. Doing so should force that 
provider to use the more specifics while keeping global routing table 
pollution to a minimum. And if either of these two approaches don't bring 
enough traffic in via this provider, try tweaking local pref
(depreferencing) 
on other providers.

I realize that this doesn't address your specific config question, but I
think 
these approaches might be a bit better (more granular and nicer to the rest 
of us) than plain deaggregation. And yes, do as I say, not as I do.

Stephen

On Wednesday 03 June 2009 11:55:26 Paul Stewart wrote:
> Hi folks.
>
>
>
> I'd like to know if there's a better way to approach this.
>
>
>
> We are advertising a specific /22 that belongs to a /18 block via one
> specific upstream BGP connection.  The /18 is advertised to all upstreams,
> the /22 is only advertised to one upstream as a method of influencing
> traffic via that carrier (knowing that if that particular carrier went
> down, the less specific subnet will still be reachable via the other
> providers). Prepending is very ugly for this situation FYI.
>
>
>
> We use BGP communities to identify upstream and downstream BGP connections
> along with our own netblocks.
>
>
>
> First I built a route-map that I could use inside the BGP network
> statement:
>
>
>
> route-map blahblah-routes-providerx permit 1000
>
>  set community 11666:6001
>
>
>
> Then created the network statement:
>
>
>
> network xx.xx.xx.0 mask 255.255.252.0 route-map blahblah-routes-providerx
>
>
>
> Created a new IP community-list that includes previous communities plus
> this one new specific community (11666:6001):
>
>
>
> ip community-list 101 permit 11666:4000
>
> ip community-list 101 permit 11666:5000
>
> ip community-list 101 permit 11666:6001
>
>
>
> And, updated the route-map towards this upstream as applicable:
>
>
>
> route-map outbound-tsystems permit 10
>
>  match community 101
>
>
>
>
>
> My question - is there a better way to configure this?  This is working
> just fine for our needs but there's a lot of steps and we're going to have
> to add more into this in future so rather do as simple a config as
possible
> ;)
>
>
>
> Thanks,
>
>
>
> Paul
>
>
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/




From A.L.M.Buxey at lboro.ac.uk  Mon Jun  8 11:18:28 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Mon, 8 Jun 2009 16:18:28 +0100
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <2C05E949E19A9146AF7BDF9D44085B8635399EACA9@exchange.aoihq.local>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<1244465167.7701.8.camel@home-desktop>
	<2C05E949E19A9146AF7BDF9D44085B8635399EACA9@exchange.aoihq.local>
Message-ID: <20090608151828.GB1811@lboro.ac.uk>

Hi,

> What are the there legal ramifications to this?  While I like to think that "it's my network, I'll do what I want to measure its performance", I *think* that sniffing voice traffic without consent is considered wiretapping.  IANAL, but it would behoove you to get a consent form from your customer prior to taking this route, just in case.

dependsw what country you are in, why you are 'sniffing' and
how you are sniffing. if you are using an automated process to
keep measurements and are not looking at anything such as the payload
you have already removed a whole heap of issues. one would hope that
the voice traffic was encrypted by default so there was no 'wire-tapping'
argument (boy, I've had fun demonstrating why encryption should be
turned on ('but I'm on a private switched network!' they scream) )
finally, if you have no other indications of _who_ or _where_ the
IP addresses in src/dst are then thats another lot of privacy baggage
dumped.

the general concensus is that standard automated monitoring of network
performance with no tie to ownership or data within packets is fair game.

PS IANAL.

alan

From petelists at templin.org  Mon Jun  8 10:44:45 2009
From: petelists at templin.org (Pete Templin)
Date: Mon, 08 Jun 2009 09:44:45 -0500
Subject: [c-nsp] 7600 router and Etherchannel across multiple line card
In-Reply-To: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
References: <a48927f70906071609p5d27f698v8cb3a7c50f5d9f2d@mail.gmail.com>
Message-ID: <4A2D23DD.4080503@templin.org>

Ibrahim Abo Zaid wrote:

> I am trying to establish L2 Etherchannel between 2 7609 routers ,
> SUP720-MSFC3 , PFC is 3BXL and Line cards WS-X6148-GE and IOS is *
> 12.2(33)SRD*
> 
> are there any concerns to establish this etherchannel between ports in
> different line cards ?

I vaguely recall a major limitation in the 6148 cards: not only is the 
card limited by only 6 1Gbps controllers, I believe EtherChannel traffic 
is mirrored across all 6 1Gbps controllers and therefore 1Gbps of EC 
traffic will max the card.

pt


From madunix at gmail.com  Mon Jun  8 11:50:10 2009
From: madunix at gmail.com (madunix)
Date: Mon, 8 Jun 2009 17:50:10 +0200
Subject: [c-nsp] MPLS
Message-ID: <4d3f56c90906080850j5eef041cua8abd4938698d177@mail.gmail.com>

agree with you security concern and latency, the overhead to make the
routing work in an MPLS network will
slow the traffic down, this will  creates latency concerns for the customer.

>madunix wrote:
>> I have 3x sites with DS8100 SAN Storage at each side, I will be
>> replicating data from one side to another (A - B, synchronous,
>> distance 100Km) and (B-C, asynchronous, 300Km). Am thinking to use
>> MPLS based on IP-VPN  since its secure and not visible to other
>> customers or internet.
>> Out of your experience ...what do you think about ?
>>
>
>Well, it's not "secure", it's simply routing isolated.  If you want
>security, as in encryption, you will need to do that on your own.
>
>If you need low convergence times, MPLS/VPN is probably not your best
>choice.  I don't know of many (if any) providers who will guarantee the
>convergence times through their network.  You should expect convergence
>times in the 10's of seconds or more for certain types of failures.
>
>You may want to consider getting an L2VPN solution such as VPWS or VPLS and
>running your own routing protocol and failure detection methods.
>


madunix

From petelists at templin.org  Mon Jun  8 11:27:01 2009
From: petelists at templin.org (Pete Templin)
Date: Mon, 08 Jun 2009 10:27:01 -0500
Subject: [c-nsp] 7500 performance
In-Reply-To: <4A298F85.5060002@rainierconnect.net>
References: <4A268001.8030101@cantv.net>	<844ef89c0906030749v1dd9f77fy6c5d15059ab1b81e@mail.gmail.com>	<4A269036.3080507@cantv.net>	<25474.196.46.241.57.1244046255.squirrel@nexmail1.nexlinx.net.pk>	<4A26960D.8070206@cantv.net>	<46075.196.46.241.57.1244047312.squirrel@nexmail1.nexlinx.net.pk>	<4A26997F.3030107@cantv.net>	<4A269AA1.2030509@rollernet.us>
	<4A298F85.5060002@rainierconnect.net>
Message-ID: <4A2D2DC5.1020605@templin.org>

Walter Keen wrote:
> Speaking of CPU performance, does anyone have any feedback on the Cisco 
> 7500 series, I'm considering using it instead of multiple 7204's to 
> aggregate/terminate atm (9 oc3, 1 ds3) and T1 (channelized ds3) traffic, 
> I'm looking at the RSP8, with vip4-80's and the appropriate PA's, and 
> planning on doing etherchannel on (2) pa-fe's back to our core (7613) 
> router.

As someone (Jon Lewis?) said a while ago, VIPs in a 7500 are like 
individual 7202s with a magic backplane between them.  Sizing your VIPs 
is like sizing your NPEs.  If I were buying 7500s (which I wouldn't be 
doing), I'd be buying VIP4-80s at the bare minimum, VIP6-80s if I had 
the need, and RSP4s (if I didn't need full routes) or RSP16s (if I did 
need full routes).

I don't know how well those etherchannels will work for you.  I think 
they're software-dependent, but I suspect GEIP+ may be the better bet 
for you.  Complexity (of which etherchannel most likely qualifies) is 
not the 7500 strong suit.

pt


From zeusdadog at gmail.com  Mon Jun  8 14:33:09 2009
From: zeusdadog at gmail.com (Jay Nakamura)
Date: Mon, 8 Jun 2009 14:33:09 -0400
Subject: [c-nsp] Cisco IOS content filtering
Message-ID: <9418aca70906081133yd17948duaa1fd4153970828c@mail.gmail.com>

I am trying out for the first time the IOS content filtering feature.
Detail documentation seems little lacking.  One thing I can't find
references to is what exactly does each security categories and
productivity categories includes.  For example, UNBLEMISHED, what web
sites does that include?  Anyone have any info on this?

Thanks!

From mylists at battleop.com  Mon Jun  8 14:29:15 2009
From: mylists at battleop.com (Richey)
Date: Mon, 8 Jun 2009 14:29:15 -0400
Subject: [c-nsp] "sh run" crashes router
Message-ID: <00bb01c9e867$0727bc90$157735b0$@com>

I am setting up Tacacs+ on all of our far end routers so I can run rancid.
I have found several 1720s and a 2621 that crash when I log in to them and
issue the "sh run" command.   They reboot quickly and then I don't have a
problem with the "sh run" command after the reload.   If I look at the
output from a "sh ver" I get  System returned to ROM by error - a SegV
exception, PC 0x8066A150.    This seems to only be a small number of
routers.  They are in different environments (one is in a server room,
another on the wall in a warehouse, etc)   The 1700s are running various
versions of the same image type.    The only thing that they all have in
common is that it's been months since anyone has logged into the router.
Is this some bug that comes from long uptimes without any activity at the
CLI?

 

Richey

 

 


From eninja at gmail.com  Mon Jun  8 17:02:00 2009
From: eninja at gmail.com (e ninja)
Date: Mon, 8 Jun 2009 14:02:00 -0700
Subject: [c-nsp] "sh run" crashes router
In-Reply-To: <00bb01c9e867$0727bc90$157735b0$@com>
References: <00bb01c9e867$0727bc90$157735b0$@com>
Message-ID: <e8590f60906081402lcd51917o25f28fa998cafb53@mail.gmail.com>

Segmentation Violations (SegV) exceptions are _always_  caused by a bug in
Cisco IOS and could be triggered by either of the following:

   - Accessing an invalid memory address e.g. attempting to access the
   lowest 16KB of memory on powerPC platforms
   - Writing to a read-only memory region
   - A jump to an invalid PC (often 0x0)

Contact your network maintenance service provider/Cisco to get your bug fix.

More info at...

   -
   http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a0080189ddb.shtml
   - http://solutions.mysolvr.com/Spurious_Memory_Accesses

eninja



On Mon, Jun 8, 2009 at 11:29 AM, Richey <mylists at battleop.com> wrote:

> I am setting up Tacacs+ on all of our far end routers so I can run rancid.
> I have found several 1720s and a 2621 that crash when I log in to them and
> issue the "sh run" command.   They reboot quickly and then I don't have a
> problem with the "sh run" command after the reload.   If I look at the
> output from a "sh ver" I get  System returned to ROM by error - a SegV
> exception, PC 0x8066A150.    This seems to only be a small number of
> routers.  They are in different environments (one is in a server room,
> another on the wall in a warehouse, etc)   The 1700s are running various
> versions of the same image type.    The only thing that they all have in
> common is that it's been months since anyone has logged into the router.
> Is this some bug that comes from long uptimes without any activity at the
> CLI?
>
>
>
> Richey
>
>
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From elmi at 4ever.de  Mon Jun  8 17:03:27 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Mon, 8 Jun 2009 23:03:27 +0200
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)
Message-ID: <20090608210327.GV6911@ronin.4ever.de>

Re folks,

my private 7401 felt a bit empty, and I bought an ISL for it
(this should be the mgt interface, not much bandwidth).

I wonder if it is broken, or if I am doing something wrong, or
if this just cannot work because I'm too st00p1d and bought the
wrong thing...

The "show interface" output is quite interesting. No input packets,
but hundreds of thousands of input errors _per second_:

==========================================================================

rt#sh int f1/0
FastEthernet1/0 is up, line protocol is up
  Hardware is DEC21140A, address is 000a.4230.841c (bia 000a.4230.841c)
  Internet address is *.*.*.*
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 245/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, Unknown Speed, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  30 second input rate 0 bits/sec, 0 packets/sec
  30 second output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     2770584934 input errors, 0 CRC, 0 frame, 42604211 overrun, 2727980723 ignored
     0 watchdog
     0 input packets with dribble condition detected
     2432 packets output, 242733 bytes, 0 underruns
     0 output errors, 0 collisions, 2090 interface resets
     0 babbles, 0 late collision, 0 deferred
     2078 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

==========================================================================

Needless to say, I cannot see anything there and I cannot ping the
address with a direct connection either...

Config is straightforward:

interface FastEthernet1/0
 ip address *.*.*.* *.*.*.*
 load-interval 30
 duplex full
end

(I explicitly set the media-type, but that was obviously alright)

Of course the switch (3560) the box is connected to has full-duplex
configured on the if.


Any ideas?
		Elmar.

From paul at paulstewart.org  Mon Jun  8 17:40:37 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Mon, 8 Jun 2009 17:40:37 -0400
Subject: [c-nsp] "sh run" crashes router
In-Reply-To: <e8590f60906081402lcd51917o25f28fa998cafb53@mail.gmail.com>
References: <00bb01c9e867$0727bc90$157735b0$@com>
	<e8590f60906081402lcd51917o25f28fa998cafb53@mail.gmail.com>
Message-ID: <005901c9e881$c3c4ce50$4b4e6af0$@org>

What are some of the versions you are running?  We have some 1710/1711
routers and many 2621 in the field and have never experienced that
particular issue..

Agree with eninja though - always IOS bug 95% of the time anyways...;)

Paul


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of e ninja
Sent: June 8, 2009 5:02 PM
To: Richey
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] "sh run" crashes router

Segmentation Violations (SegV) exceptions are _always_  caused by a bug in
Cisco IOS and could be triggered by either of the following:

   - Accessing an invalid memory address e.g. attempting to access the
   lowest 16KB of memory on powerPC platforms
   - Writing to a read-only memory region
   - A jump to an invalid PC (often 0x0)

Contact your network maintenance service provider/Cisco to get your bug fix.

More info at...

   -
 
http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186
a0080189ddb.shtml
   - http://solutions.mysolvr.com/Spurious_Memory_Accesses

eninja



On Mon, Jun 8, 2009 at 11:29 AM, Richey <mylists at battleop.com> wrote:

> I am setting up Tacacs+ on all of our far end routers so I can run rancid.
> I have found several 1720s and a 2621 that crash when I log in to them and
> issue the "sh run" command.   They reboot quickly and then I don't have a
> problem with the "sh run" command after the reload.   If I look at the
> output from a "sh ver" I get  System returned to ROM by error - a SegV
> exception, PC 0x8066A150.    This seems to only be a small number of
> routers.  They are in different environments (one is in a server room,
> another on the wall in a warehouse, etc)   The 1700s are running various
> versions of the same image type.    The only thing that they all have in
> common is that it's been months since anyone has logged into the router.
> Is this some bug that comes from long uptimes without any activity at the
> CLI?
>
>
>
> Richey
>
>
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From mhuff at ox.com  Mon Jun  8 18:10:38 2009
From: mhuff at ox.com (Matthew Huff)
Date: Mon, 8 Jun 2009 18:10:38 -0400
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)
In-Reply-To: <20090608210327.GV6911@ronin.4ever.de>
References: <20090608210327.GV6911@ronin.4ever.de>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>

Duplex problems typically show runt, crc and collisions. 

The show interface line with:

  Full-duplex, Unknown Speed, 100BaseTX/FX

might be the problem.

How about :

interface FastEthernet1/0
 ip address *.*.*.* *.*.*.*
 load-interval 30
 speed 100
 duplex full
end

and check the config on the 3560

int fa1/2
  speed 100
  duplex full
  switchport
  switchport mode access
  spanning-tree portfast

If you are paranoid with portfast, add "spanning-tree bpduguard enable"



----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com? | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Elmar K. Bins
Sent: Monday, June 08, 2009 5:03 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)

Re folks,

my private 7401 felt a bit empty, and I bought an ISL for it
(this should be the mgt interface, not much bandwidth).

I wonder if it is broken, or if I am doing something wrong, or
if this just cannot work because I'm too st00p1d and bought the
wrong thing...

The "show interface" output is quite interesting. No input packets,
but hundreds of thousands of input errors _per second_:

==========================================================================

rt#sh int f1/0
FastEthernet1/0 is up, line protocol is up
  Hardware is DEC21140A, address is 000a.4230.841c (bia 000a.4230.841c)
  Internet address is *.*.*.*
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 245/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, Unknown Speed, 100BaseTX/FX
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  30 second input rate 0 bits/sec, 0 packets/sec
  30 second output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     2770584934 input errors, 0 CRC, 0 frame, 42604211 overrun, 2727980723 ignored
     0 watchdog
     0 input packets with dribble condition detected
     2432 packets output, 242733 bytes, 0 underruns
     0 output errors, 0 collisions, 2090 interface resets
     0 babbles, 0 late collision, 0 deferred
     2078 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

==========================================================================

Needless to say, I cannot see anything there and I cannot ping the
address with a direct connection either...

Config is straightforward:

interface FastEthernet1/0
 ip address *.*.*.* *.*.*.*
 load-interval 30
 duplex full
end

(I explicitly set the media-type, but that was obviously alright)

Of course the switch (3560) the box is connected to has full-duplex
configured on the if.


Any ideas?
		Elmar.
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From andy.saykao at staff.netspace.net.au  Mon Jun  8 21:48:30 2009
From: andy.saykao at staff.netspace.net.au (Andy Saykao)
Date: Tue, 9 Jun 2009 11:48:30 +1000
Subject: [c-nsp] data corruption erros on the 7606 sup-720
Message-ID: <56F211C5E3F24F47B103EA1B253822BE03654E51@vic-cr-ex1.staff.netspace.net.au>

Anybody come across data corruption erros on the 7606 sup-720 before?
What's causing them? Are they bad or can we live with them???? 
 
 
Eg:
 
router-1#sh data-corruption
Data inconsistency records for:
s72033_rp Software (s72033_rp-IPSERVICESK9_WAN-M), Version
12.2(18)SXF16, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Compiled Tue 03-Mar-09 23:54 by kellythw
 
Count           Traceback
  112920        40E36158, 4045D590 40E36158 40E36EFC 40E49340 40E3B3D8
40EB04B4 40E8F3B0
               1: May 13 19:10:42.989
               2: May 13 19:10:42.989
               3: May 13 19:10:42.993
          112920: Jun  9 01:40:38.250
 
We're using IOS s72033-ipservicesk9_wan-mz.122-18.SXF16.bin
 
We're only seeing these data corrpuption errors on this particular
hardware platform and IOS. We've got other 7606s deployed but these are
sup-32's instead and do not show any data corruption errors.

Thanks.
 
Andy

This email and any files transmitted with it are confidential and intended
 solely for the use of the individual or entity to whom they are addressed. 
Please notify the sender immediately by email if you have received this 
email by mistake and delete this email from your system. Please note that
 any views or opinions presented in this email are solely those of the
 author and do not necessarily represent those of the organisation. 
Finally, the recipient should check this email and any attachments for 
the presence of viruses. The organisation accepts no liability for any 
damage caused by any virus transmitted by this email.


From frnkblk at iname.com  Mon Jun  8 22:39:08 2009
From: frnkblk at iname.com (Frank Bulk - iName.com)
Date: Mon, 8 Jun 2009 21:39:08 -0500
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <20090603071609.GY290@greenie.muc.de>
References: <20090603071609.GY290@greenie.muc.de>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>

Have you tried the SNMP approach?

Frank

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Gert Doering
Sent: Wednesday, June 03, 2009 2:16 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] hung vty on SXH3a?

Hi,

so far, we have been quite happy with SXH3a, but today two of our boxes
have started playing games with me...  notably, the command we use to
auto-upload ACLs etc

   rcp new_config.txt router:running-config

started to fail with "rcp: running-config: No such file or directory".

On other boxes, it works "as usual".  All the "ip rcmd" config is present
and sane.

The only thing that looks different is this:

Cisco#who
    Line       User       Host(s)              Idle       Location
   1 vty 0                Virtual Exec         00:00:00   
*  2 vty 1     gert       idle                 00:00:00 mgmthost

  Interface      User        Mode                     Idle     Peer Address

Cisco#

- "vty 0" looks weird.  I can't find a way to recover that vty, that is
"clear line 1" or "clear line vty 0" don't change anything.  Nor is there
a TCB assigned to it ("show tcp vty 1" shows my telnet connection, but
"show tcb vty 0" doesn't display anything).


So... is this a known bug in SXH3a?  Is there a way to reclaim that VTY
without rebooting?

(I've also tried configuring "transport input none" under "line vty 0", 
and to completely disable "ip rcmd ..." to get rid of the session, but no 
change either).

gert

-- 
USENET is *not* the non-clickable part of WWW!
 
//www.muc.de/~gert/
Gert Doering - Munich, Germany
gert at greenie.muc.de
fax: +49-89-35655025
gert at net.informatik.tu-muenchen.de


From frnkblk at iname.com  Mon Jun  8 22:39:08 2009
From: frnkblk at iname.com (Frank Bulk - iName.com)
Date: Mon, 8 Jun 2009 21:39:08 -0500
Subject: [c-nsp] Netflow analyzer suggestions
In-Reply-To: <20090602150859.H38689@shell.xecu.net>
References: <20090602150859.H38689@shell.xecu.net>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABwr8R3BhjNQogpoNi10l+BAQAAAAA=@iname.com>

It's not cheap, but Xangati may be a good match.

Frank

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Andy Dills
Sent: Tuesday, June 02, 2009 2:21 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Netflow analyzer suggestions


Hi there,

Apologies for the non-cisco specific post, but I couldn't think of a 
better list to post to off of the top of my head.

A friend of mine is looking to get some better visibility into their 
network usage (low bandwidth, T1 type scenario). I got them setup with an 
IOS that supports netflow v9, and since they had a freebsd box being 
barely used, I built ntop to be their collector/analyzer.

It works reasonably well, but it's perhaps not quite...user friendly 
enough for them.

What they're looking for is a graphical representation at the host level. 
In essence, they're looking for something like cricket/mrtg but with each 
IP having its own graph (rather than each interface). Additional features, 
such as protocol breakdown and so forth are helpful, but the primary 
desire is to be able to see how much bandwidth a given IP address is using 
currently and was using in the past.

They're open to commercial solutions, but would prefer to keep costs down. 
Host operating system requirements for the collector/analyzer aren't 
important.

Does anybody have any suggestions they could pass along?

Thanks,
Andy

---
Andy Dills
Xecunet, Inc.
www.xecu.net
301-682-9972
---
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From ml at kenweb.org  Mon Jun  8 22:44:01 2009
From: ml at kenweb.org (ML)
Date: Mon, 08 Jun 2009 22:44:01 -0400
Subject: [c-nsp] ME3400 Transmit queues and architecture
Message-ID: <4A2DCC71.6080605@kenweb.org>

This is a multi part question please bear with me.

Background synopsis: A large (on the order of millions) of output queue 
drops were causing noticeable breakup of multicast video streams.
I learned that the default egress queue size is 160 starting in 
12.2.46SE.  I upgraded some lab switches, This helped my situation 
immensely.
However output queue drops continued albeit much less frequently.

Question 1:
 From an off-list reply to my original question I was told I could 
increase the number of queues per interface with this policy-map:

policy-map max-queue
  class class-default
  queue-limit 544

Naturally I would want to apply to this to every interface, however I am 
unsure if this will be detrimental.  What I don't know is where queue 
space exists: DRAM, a small supply of onboard SRAM?
If I allocate 544 queues to every interface on an ME3400-24TS-A will I 
starve other processes for memory (unlikely check my math below)?
If the current default queue size is 160 and I increase it to 544 for 
all FastEthernet interfaces I would increase the amount of memory usage 
by 2.25 megabytes:

Queue size is 256 bytes; 24 interfaces.
((256*(544-160)bytes))*24 = 2.25 megabytes

Since these ME3400s are just access switches I seem to always at least 
50MB of free memory. Therefore 2.25 MBs doesn't seem like a big impact.

Am I correct in my calculations about the impact of the preceding 
policy-map applied system wide? Do the output queues live in run of the 
mill DRAM?


Question 2:

When I do apply the 'max-queue' policy-map to an interface and inspect 
my work:

sh platform qos debug port-class
sh platform qos debug port-config X

Port Class 0: Queue #3 seems to have my new max-queue setting but every 
other Port Class  and corresponding  Queue are still set to 48 (The 
pre-12.2.46SE default queue size?)

Am I missing something when I use these commands? This is new territory 
for me.


Question 3:

Are the FastEthernet ports on the ME3400 over subscribed in any way? Can 
I expect line-rate performance on every port at once or is there an ASIC 
handling groups of 2^n ports?


Thanks in advance for any help.

****





From ip at ioshints.info  Tue Jun  9 00:58:25 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Tue, 9 Jun 2009 06:58:25 +0200
Subject: [c-nsp] Cisco IOS content filtering
In-Reply-To: <9418aca70906081133yd17948duaa1fd4153970828c@mail.gmail.com>
References: <9418aca70906081133yd17948duaa1fd4153970828c@mail.gmail.com>
Message-ID: <001101c9e8be$ecad7230$0a00000a@nil.si>

Haven't tried the server-based configuration yet (it only works on ISRs),
here's what you can do locally:

http://wiki.nil.com/Local_Content_Filtering_in_Cisco_IOS

Best regards
Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/ 

> -----Original Message-----
> From: Jay Nakamura [mailto:zeusdadog at gmail.com] 
> Sent: Monday, June 08, 2009 8:33 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco IOS content filtering
> 
> I am trying out for the first time the IOS content filtering feature.
> Detail documentation seems little lacking.  One thing I can't 
> find references to is what exactly does each security 
> categories and productivity categories includes.  For 
> example, UNBLEMISHED, what web sites does that include?  
> Anyone have any info on this?
> 
> Thanks!
> 
> 


From elmi at 4ever.de  Tue Jun  9 03:14:28 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Tue, 9 Jun 2009 09:14:28 +0200
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>
References: <20090608210327.GV6911@ronin.4ever.de>
	<483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>
Message-ID: <20090609071427.GW6911@ronin.4ever.de>

Re everyone and thank you for the input.

The "speed unknown" hadn't revealed itself to me _but_ I cannot
make it go away. The interface does not understand the "speed"
command:

rt(config-if)#speed ?
% Unrecognized command


The duplex does of course match on both sides - I did not see any
collision or late collision errors. The router i/f doesn't seem
capable of any kind of negotiation, at least there's no matching
command except for, maybe, "no duplex"...


I also get this from time to time:

*Jun  9 06:44:18: %SYS-3-CPUHOG: Task is running for (2004)msecs, more than (2000)msecs (0/0),process = Exec.
-Traceback= 0x608FAE9C 0x608FACB0 0x6015BA10 0x60162FC0 0x6016001C 0x6087A44C 0x60879ABC 0x6086F7A4 0x607FDF2C 0x6081BDD8 0x608BEFCC 0x608BEFB0


I wonder whether the interface is really broken (and I should
return it), or whether it's supposed to (not) work that way.

Yours,
	Elmar.

PS: Although my WS worked fine on that cable and switchport, I'll
    go swap the cable next.

PPS: IOSes tried are 12.3(14)T3 and 12.4(12)a.

From gert at greenie.muc.de  Tue Jun  9 03:20:46 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Tue, 9 Jun 2009 09:20:46 +0200
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>
References: <20090603071609.GY290@greenie.muc.de>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>
Message-ID: <20090609072046.GR290@greenie.muc.de>

Hi,

On Mon, Jun 08, 2009 at 09:39:08PM -0500, Frank Bulk - iName.com wrote:
> Have you tried the SNMP approach?

What is "the SNMP approach"?

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090609/a03def86/attachment.bin>

From mark.r.zipp at gmail.com  Tue Jun  9 03:26:31 2009
From: mark.r.zipp at gmail.com (Mark Zipp)
Date: Tue, 9 Jun 2009 16:56:31 +0930
Subject: [c-nsp] Non-Cisco SFPs (i.e. Finisar) in TwinGig modules on a 4900M?
Message-ID: <a9a0929d0906090026y67b4234bg1eaf61eb5d5e5ee@mail.gmail.com>

Hi,

Does anybody know if the 'service unsupported-transceiver' command is
supported on the 4900Ms? We're intending to use Finisar 1000BaseLX
SFPs.

Thanks,
Mark.

From elmi at 4ever.de  Tue Jun  9 03:28:11 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Tue, 9 Jun 2009 09:28:11 +0200
Subject: [c-nsp] ASR7401 and PA-FE-TX (ISL)
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>
References: <20090608210327.GV6911@ronin.4ever.de>
	<483E6B0272B0284BA86D7596C40D29F9C3811FD239@PUR-EXCH07.ox.com>
Message-ID: <20090609072811.GY6911@ronin.4ever.de>

I have an update on this one...

I powered off the router (in order to put a Wattmeter in between),
and while I was at it, I thought "hell, pull and push the card
back in again" which I did.

Well, I don't know why, but this worked, the card sees a speed
now and seems to work.

Thank you all for your kind responses and help!

Elmar.

From p.mayers at imperial.ac.uk  Tue Jun  9 04:33:38 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Tue, 09 Jun 2009 09:33:38 +0100
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <20090609072046.GR290@greenie.muc.de>
References: <20090603071609.GY290@greenie.muc.de>	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>
	<20090609072046.GR290@greenie.muc.de>
Message-ID: <4A2E1E62.8020301@imperial.ac.uk>

Gert Doering wrote:
> Hi,
> 
> On Mon, Jun 08, 2009 at 09:39:08PM -0500, Frank Bulk - iName.com wrote:
>> Have you tried the SNMP approach?
> 
> What is "the SNMP approach"?

You can use SNMP to close the TCP connection. Our local docs reckon:

snmpwalk -c READCOMM -v 2c ROUTER .1.3.6.1.2.1.6.13.1.1

...to get a list of connections, then:

snmpset -c WRITECOMM -v 2c ROUTER 
.1.3.6.1.2.1.6.13.1.1.locip.locport.remip.remport integer 12


From sam_mailinglists at spacething.org  Tue Jun  9 07:12:32 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Tue, 09 Jun 2009 12:12:32 +0100
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A23F37A.60008@spacething.org>
References: <4A23F37A.60008@spacething.org>
Message-ID: <4A2E43A0.2050306@spacething.org>

All,

I had some feedback from people that have tried it in the lab, but not 
in production yet.

I notice that in all the Cisco marketing material it talks repeatedly 
about how the guest's security profile will migrate with the VM. 
However, as far as I can tell NX-OS only offers non-stateful ACLs and no 
inspection so I'm not sure it's really that useful?

Sam

Sam Stickland wrote:
> Hi,
>
> Has anyone here deployed the Nexus V1000? I'm interested in feedback 
> (good, back or indifferent).
>
> Thanks,
>
> Sam
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From shinejoseph at dodo.com.au  Tue Jun  9 07:00:52 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Tue, 9 Jun 2009 19:00:52 +0800
Subject: [c-nsp] Policy Based Routing on Cisco 6500
Message-ID: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>

Hi,

I am wondering if there any performance issue with using PBR on a Cisco 6500 with Sup720?

Any pointers and suggestions are most appreciated.

Thanks in advance,

Shine

From cisco-nsp at ml.karotte.org  Tue Jun  9 07:11:09 2009
From: cisco-nsp at ml.karotte.org (Sebastian Wiesinger)
Date: Tue, 9 Jun 2009 13:11:09 +0200
Subject: [c-nsp] Non-Cisco SFPs (i.e. Finisar) in TwinGig modules on a
	4900M?
In-Reply-To: <a9a0929d0906090026y67b4234bg1eaf61eb5d5e5ee@mail.gmail.com>
References: <a9a0929d0906090026y67b4234bg1eaf61eb5d5e5ee@mail.gmail.com>
Message-ID: <20090609111109.GA22755@danton.fire-world.de>

* Mark Zipp <mark.r.zipp at gmail.com> [2009-06-09 09:33]:
> Hi,
> 
> Does anybody know if the 'service unsupported-transceiver' command is
> supported on the 4900Ms? We're intending to use Finisar 1000BaseLX
> SFPs.

I can confirm this:

NAME: "Converter 3/2", DESCR: "Converter Module"
PID: CVR-X2-SFP        , VID: V01  , SN: CAT111058P7

NAME: "GigabitEthernet3/11", DESCR: "1000BaseSX"
PID: Unspecified       , VID:      , SN: FNS11172H80

Don't forget to use

hw-module module X port-group Y select gigabitethernet

or you'll get some not-so-helpful errors (in older IOS versions).

-- 
GPG Key-ID: 0x76B79F20 (0x1B6034F476B79F20)
'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE.
            -- Terry Pratchett, The Fifth Elephant

From rdobbins at arbor.net  Tue Jun  9 07:54:32 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Tue, 9 Jun 2009 18:54:32 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2E43A0.2050306@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
Message-ID: <DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>


On Jun 9, 2009, at 6:12 PM, Sam Stickland wrote:

>  only offers non-stateful ACLs and no inspection so I'm not sure  
> it's really that useful?

Stateful inspection in front of front-end servers is generally not  
only useless, but counterproductive, as it greatly increases  
susceptibility to DDoS.  Especially with a software-based switch/ 
router/what-have-you.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From rdobbins at arbor.net  Tue Jun  9 08:01:15 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Tue, 9 Jun 2009 19:01:15 +0700
Subject: [c-nsp] Policy Based Routing on Cisco 6500
In-Reply-To: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
References: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
Message-ID: <4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>


On Jun 9, 2009, at 6:00 PM, Shine Joseph wrote:

> I am wondering if there any performance issue with using PBR on a  
> Cisco 6500 with Sup720?

I think (correction welcome) that it only works in hardware based upon  
matching an extended ACL - any attempt to do things like match on  
packet size, etc. results in software switching.

PBR by its nature is operationally brittle and ugly; if there's  
another way to accomplish one's goal, it's generally best to pursue an  
alternate method, if at all possible.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From avayner at cisco.com  Tue Jun  9 08:07:19 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Tue, 9 Jun 2009 14:07:19 +0200
Subject: [c-nsp] Policy Based Routing on Cisco 6500
In-Reply-To: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
References: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7BE31D4@xmb-ams-331.emea.cisco.com>

Shine,

PBR is done in hardware on the 6500. If you have DFC's, it would be done
on the DFC. If not, the central PFC will do it.
You should monitor your TCAM resources, as it may fill it up, and then
traffic would be punted to the CPU - which you want to avoid at all
costs.

Use the "show tcam counts" command.

Take a look here:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/con
figuration/guide/cef.html


Arie 

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Shine Joseph
Sent: Tuesday, June 09, 2009 14:01
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Policy Based Routing on Cisco 6500

Hi,

I am wondering if there any performance issue with using PBR on a Cisco
6500 with Sup720?

Any pointers and suggestions are most appreciated.

Thanks in advance,

Shine
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From rodunn at cisco.com  Tue Jun  9 09:13:11 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Tue, 9 Jun 2009 09:13:11 -0400
Subject: [c-nsp] "sh run" crashes router
In-Reply-To: <00bb01c9e867$0727bc90$157735b0$@com>
References: <00bb01c9e867$0727bc90$157735b0$@com>
Message-ID: <20090609131311.GB14941@rtp-cse-489.cisco.com>

Need:

sh ver
sh stack
and bonus points for a crashinfo file from flash:

Did you try posting the sh stack in the output interpreter on Cisco.com?

Rodney


sh On Mon, Jun 08, 2009 at 02:29:15PM -0400, Richey wrote:
> I am setting up Tacacs+ on all of our far end routers so I can run rancid.
> I have found several 1720s and a 2621 that crash when I log in to them and
> issue the "sh run" command.   They reboot quickly and then I don't have a
> problem with the "sh run" command after the reload.   If I look at the
> output from a "sh ver" I get  System returned to ROM by error - a SegV
> exception, PC 0x8066A150.    This seems to only be a small number of
> routers.  They are in different environments (one is in a server room,
> another on the wall in a warehouse, etc)   The 1700s are running various
> versions of the same image type.    The only thing that they all have in
> common is that it's been months since anyone has logged into the router.
> Is this some bug that comes from long uptimes without any activity at the
> CLI?
> 
>  
> 
> Richey
> 
>  
> 
>  
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From gert at greenie.muc.de  Tue Jun  9 10:39:21 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Tue, 9 Jun 2009 16:39:21 +0200
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2E43A0.2050306@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
Message-ID: <20090609143921.GY290@greenie.muc.de>

Hi,

On Tue, Jun 09, 2009 at 12:12:32PM +0100, Sam Stickland wrote:
> I notice that in all the Cisco marketing material it talks repeatedly 
> about how the guest's security profile will migrate with the VM. 
> However, as far as I can tell NX-OS only offers non-stateful ACLs and no 
> inspection so I'm not sure it's really that useful?

Well, you need to put this in relation to the "standard" VMware switch
- which can't do ACLs, and where nothing whatsoever will migrate but
everything (VLAN setup etc) needs to be properly prepated beforhand 
for VMotion to work...

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090609/2a3200dd/attachment.bin>

From linux.yahoo at gmail.com  Tue Jun  9 11:25:40 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 9 Jun 2009 17:25:40 +0200
Subject: [c-nsp] VPLS & FRR (RSVP Fast Reroute)
Message-ID: <7100ed370906090825u5e4d4d9fiaa8bc568141f19f0@mail.gmail.com>

Hello,

Is it possible to deploy MPLS VPLS by using RSVP instead of LDP?

I need FRR feature ;)

Thanks & Best Regards,
Manu

From tstevens at cisco.com  Tue Jun  9 11:42:36 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Tue, 09 Jun 2009 08:42:36 -0700
Subject: [c-nsp] Policy Based Routing on Cisco 6500
In-Reply-To: <4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>
References: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
	<4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>
Message-ID: <200906091542.n59FgakC013593@sj-core-3.cisco.com>

Correct. See:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/layer3.html#wpmkr1033564

?The Policy Feature Card (PFC) and any 
Distributed Feature Cards (DFCs) provide hardware 
support for policy-based routing (PBR) for 
route-map sequences that use the match ip 
address, set ip next-hop, and ip default next-hop PBR keywords.


HTH,
Tim


At 05:01 AM 6/9/2009, Roland Dobbins proclaimed:

>On Jun 9, 2009, at 6:00 PM, Shine Joseph wrote:
>
> > I am wondering if there any performance issue with using PBR on a
> > Cisco 6500 with Sup720?
>
>I think (correction welcome) that it only works in hardware based upon
>matching an extended ACL - any attempt to do things like match on
>packet size, etc. results in software switching.
>
>PBR by its nature is operationally brittle and ugly; if there's
>another way to accomplish one's goal, it's generally best to pursue an
>alternate method, if at all possible.
>
>-----------------------------------------------------------------------
>Roland Dobbins <rdobbins at arbor.net> // 
><<http://www.arbornetworks.com>http://www.arbornetworks.com>
>
>          Unfortunately, inefficiency scales really well.
>
>                    -- Kevin Lawton
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
><https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at 
><http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From sthaug at nethelp.no  Tue Jun  9 11:51:09 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Tue, 09 Jun 2009 17:51:09 +0200 (CEST)
Subject: [c-nsp] VPLS & FRR (RSVP Fast Reroute)
In-Reply-To: <7100ed370906090825u5e4d4d9fiaa8bc568141f19f0@mail.gmail.com>
References: <7100ed370906090825u5e4d4d9fiaa8bc568141f19f0@mail.gmail.com>
Message-ID: <20090609.175109.74673745.sthaug@nethelp.no>

> Is it possible to deploy MPLS VPLS by using RSVP instead of LDP?
> 
> I need FRR feature ;)

<tongue in cheek> Yes, it's called Juniper. </tongue in cheek>

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From linux.yahoo at gmail.com  Tue Jun  9 11:54:09 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 9 Jun 2009 17:54:09 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>
Message-ID: <7100ed370906090854y681a4828u8eb1a5b96fde6526@mail.gmail.com>

SIP400/SIP600 is 7600 only too

no?

On Thu, Jun 4, 2009 at 5:29 PM, Arie Vayner (avayner) <avayner at cisco.com>wrote:

> Yes, this is true, ES20 is 7600 only (I missed the 6500 angle here ;-) )
>
> We can do VPLS with SIP400 (lower BW) or SIP600 (higher BW).
>
>
>
> BTW, There is also support for MPLSoGRE
>
>
>
> Arie
>
>
>
> From: Marlon Duksa [mailto:mduksa at gmail.com]
> Sent: Thursday, June 04, 2009 17:10
> To: Arie Vayner (avayner)
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
>
>
> Thanks Arie. But ES cards are not supported on Cat6500, no? And also
> VPLS over MPLS on a SIP in Cat6500 - is it supported? If so do you know
> which SIP?
>
> Thanks,
>
> Marlon
>
> On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
> <avayner at cisco.com> wrote:
>
> Marlon,
>
> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
> done in hardware and in distributed forwarding mode.
> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
> the core. Having this card means that again VPLS is done in hardware -
> some functionality is done on the regular DFCs and some on the egress
> core facing module.
>
> Arie
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
> Sent: Thursday, June 04, 2009 02:07
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
> Hi -Does anyone know which cards on Cat6500 support MPLS
> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
> distributed (DFC) forwarding solution?
>
> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
> EoMPLS
> should be no problem, right?
>
> Thanks,
> Marlon
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From linux.yahoo at gmail.com  Tue Jun  9 11:55:16 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 9 Jun 2009 17:55:16 +0200
Subject: [c-nsp] VPLS & FRR (RSVP Fast Reroute)
In-Reply-To: <20090609.175109.74673745.sthaug@nethelp.no>
References: <7100ed370906090825u5e4d4d9fiaa8bc568141f19f0@mail.gmail.com>
	<20090609.175109.74673745.sthaug@nethelp.no>
Message-ID: <7100ed370906090855sef8c88ao51a6121b4d102e71@mail.gmail.com>

i know junos very well thanks ;)

On Tue, Jun 9, 2009 at 5:51 PM, <sthaug at nethelp.no> wrote:

> > Is it possible to deploy MPLS VPLS by using RSVP instead of LDP?
> >
> > I need FRR feature ;)
>
> <tongue in cheek> Yes, it's called Juniper. </tongue in cheek>
>
> Steinar Haug, Nethelp consulting, sthaug at nethelp.no
>

From gert at greenie.muc.de  Tue Jun  9 12:09:00 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Tue, 9 Jun 2009 18:09:00 +0200
Subject: [c-nsp] hung vty on SXH3a?
In-Reply-To: <4A2E1E62.8020301@imperial.ac.uk>
References: <20090603071609.GY290@greenie.muc.de>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com>
	<20090609072046.GR290@greenie.muc.de>
	<4A2E1E62.8020301@imperial.ac.uk>
Message-ID: <20090609160900.GZ290@greenie.muc.de>

Hi,

On Tue, Jun 09, 2009 at 09:33:38AM +0100, Phil Mayers wrote:
> Gert Doering wrote:
> >On Mon, Jun 08, 2009 at 09:39:08PM -0500, Frank Bulk - iName.com wrote:
> >>Have you tried the SNMP approach?
> >
> >What is "the SNMP approach"?
> 
> You can use SNMP to close the TCP connection. Our local docs reckon:
> 
> snmpwalk -c READCOMM -v 2c ROUTER .1.3.6.1.2.1.6.13.1.1
> 
> ...to get a list of connections, then:
> 
> snmpset -c WRITECOMM -v 2c ROUTER 
> .1.3.6.1.2.1.6.13.1.1.locip.locport.remip.remport integer 12

Thanks.  Indeed, there *is* a connection, stuck in CLOSEWAIT state.

Knowing what to look for, I can see it with "show tcp" as well, and
can clear it with "clear tcp tcb...".

I'm not sure whether it actually helped anything - now the session is
in "CLOSED" state, the VTY is still stuck, and the TCP session refuses
to "really" go away... :-(

But thanks for the explanation :-)

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090609/869e7fba/attachment.bin>

From avayner at cisco.com  Tue Jun  9 12:23:31 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Tue, 9 Jun 2009 18:23:31 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <7100ed370906090854y681a4828u8eb1a5b96fde6526@mail.gmail.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>
	<7100ed370906090854y681a4828u8eb1a5b96fde6526@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7BE3340@xmb-ams-331.emea.cisco.com>

Not that I am aware of...

 

http://www.cisco.com/en/US/products/hw/switches/ps708/products_relevant_
interfaces_and_modules.html

 

Arie

 

From: Manu Chao [mailto:linux.yahoo at gmail.com] 
Sent: Tuesday, June 09, 2009 18:54
To: Arie Vayner (avayner)
Cc: Marlon Duksa; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

 

SIP400/SIP600 is 7600 only too

 

no?

On Thu, Jun 4, 2009 at 5:29 PM, Arie Vayner (avayner)
<avayner at cisco.com> wrote:

Yes, this is true, ES20 is 7600 only (I missed the 6500 angle here ;-) )

We can do VPLS with SIP400 (lower BW) or SIP600 (higher BW).



BTW, There is also support for MPLSoGRE



Arie



From: Marlon Duksa [mailto:mduksa at gmail.com]
Sent: Thursday, June 04, 2009 17:10
To: Arie Vayner (avayner)
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500




Thanks Arie. But ES cards are not supported on Cat6500, no? And also
VPLS over MPLS on a SIP in Cat6500 - is it supported? If so do you know
which SIP?

Thanks,

Marlon

On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
<avayner at cisco.com> wrote:

Marlon,

If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
done in hardware and in distributed forwarding mode.
For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
the core. Having this card means that again VPLS is done in hardware -
some functionality is done on the regular DFCs and some on the egress
core facing module.

Arie


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
Sent: Thursday, June 04, 2009 02:07
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500

Hi -Does anyone know which cards on Cat6500 support MPLS
and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
distributed (DFC) forwarding solution?

I know that Cat6500 is very limited in VPLS support, but IP-VPN and
EoMPLS
should be no problem, right?

Thanks,
Marlon

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 


From ibrahim.abozaid at gmail.com  Tue Jun  9 12:26:18 2009
From: ibrahim.abozaid at gmail.com (Ibrahim Abo Zaid)
Date: Tue, 9 Jun 2009 19:26:18 +0300
Subject: [c-nsp] HSRP and Standby router
Message-ID: <a48927f70906090926l6cf8831bs1ceebe234fa66a19@mail.gmail.com>

Hi All

I was studying some HSRP senario which is little bit different than what
used to work on , we have 2 routers connected with access ports to internal
box which has 2 direct physical layer-2 links to both routers and HSRP is
running between VLAN SVIs on both routers across L2 ether-channel between
them

if physical link to active router fail , the client will ARP stanby router
for MAC of HSRP group IP , my question here is stanby router will answer ARP
requests while it still detect that active router is still alive from HSRP
over etherchannel between them ? and if yes , what MAC address it will
answer with ? the active router owns group vmac address so if standby reply
it will reply with bia address and L2-switch the traffic to active router ?

waiting for opinions and your experience share


best regards
--Ibrahim

From ip at ioshints.info  Tue Jun  9 12:54:09 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Tue, 9 Jun 2009 18:54:09 +0200
Subject: [c-nsp] Policy Based Routing on Cisco 6500
In-Reply-To: <4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>
References: <A96116DE10004649A384B3E64E0B0A0D@au.didata.local>
	<4B9493F0-E907-4D93-A4C4-F4E7DCF6194A@arbor.net>
Message-ID: <003801c9e922$e98c84b0$0a00000a@nil.si>

> PBR by its nature is operationally brittle and ugly; if 
> there's another way to accomplish one's goal, it's generally 
> best to pursue an alternate method, if at all possible.

Absolutely forcefully agree :) While this is a bit off-topic here's an
example of what you can do with a distance-vector routing protocol:

http://www.nil.com/ipcorner/ScalablePolicyRouting/

MPLS + BGP or MPLS TE can also solve numerous issues for which people tend
to use PBR.

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


From oliver.gorwits at oucs.ox.ac.uk  Tue Jun  9 14:03:32 2009
From: oliver.gorwits at oucs.ox.ac.uk (Oliver Gorwits)
Date: Tue, 09 Jun 2009 19:03:32 +0100
Subject: [c-nsp] ACL creation and editing tool suggestions?
In-Reply-To: <4A2CD950.70704@uk.clara.net>
References: <FA327920307749D5B7710ACCC47DB3BB@Toshiba>
	<4A2CD950.70704@uk.clara.net>
Message-ID: <4A2EA3F4.60306@oucs.ox.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


David Freedman wrote:
> A newcomer to the 12.4(T) train is "ACL Object Groups"

Some time ago I wrote a couple of Perl modules to help generate
these for FWSM type devices. They might still be useful:

http://search.cpan.org/perldoc?Net::Cisco::ObjectGroup
http://search.cpan.org/perldoc?Net::Cisco::AccessList::Extended


regards,
- --
Oliver Gorwits, Network and Telecommunications Group,
Oxford University Computing Services
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFKLqP02NPq7pwWBt4RAjN3AKDC1qvUvProXTG51b4n46kOz2wx/QCgoubB
q+JGCEb4jUkXrCDV8AeMTAs=
=uFSK
-----END PGP SIGNATURE-----

From tvarriale at comcast.net  Tue Jun  9 13:22:22 2009
From: tvarriale at comcast.net (Tony Varriale)
Date: Tue, 9 Jun 2009 12:22:22 -0500
Subject: [c-nsp] hung vty on SXH3a?
References: <20090603071609.GY290@greenie.muc.de><!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com><20090609072046.GR290@greenie.muc.de><4A2E1E62.8020301@imperial.ac.uk>
	<20090609160900.GZ290@greenie.muc.de>
Message-ID: <C4EA1540E9BA42B0A5CF85A57BBEEDD7@flamdt01>

Odd, I've been seeing similiar problems lately in ASA 8.x code with IPv6 SSH 
connections...when IPv6 isn't enabled.

Maybe the same team writes the management code? :)

tv
----- Original Message ----- 
From: "Gert Doering" <gert at greenie.muc.de>
To: "Phil Mayers" <p.mayers at imperial.ac.uk>
Cc: "Gert Doering" <gert at greenie.muc.de>; <cisco-nsp at puck.nether.net>
Sent: Tuesday, June 09, 2009 11:09 AM
Subject: Re: [c-nsp] hung vty on SXH3a?


> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/ 


From vandry at TZoNE.ORG  Tue Jun  9 13:31:52 2009
From: vandry at TZoNE.ORG (Phil Vandry)
Date: Tue, 9 Jun 2009 13:31:52 -0400
Subject: [c-nsp] Opensource tool to measure Jitter for VoIP
In-Reply-To: <1244465167.7701.8.camel@home-desktop>
References: <e05f39290906080313q3a04c780rfa8d56013d95cdd5@mail.gmail.com>
	<1244465167.7701.8.camel@home-desktop>
Message-ID: <20090609173152.GA14962@OZoNE.TZoNE.ORG>

On Mon, Jun 08, 2009 at 07:46:06AM -0500, Bryan Campbell wrote:
> You cannot measure VOIP (sip) jitter using ICMP tools.  You will only

s/sip/RTP/

[snip using Wireshark VoIP analysis]
> If you can't find jitter in this manner, it cannot be found.  If it
> cannot be found, it doesn't exist.

This will be true as long as you are monitoring close to the receiving
end. Otherwise you will miss jitter that is introduced by the network
beyond your monitoring point.

This means you may want to have two monitoring points for bidirectional
voice traffic: one close to each receiving end.

On Mon, Jun 08, 2009 at 10:06:21AM -0400, Eric Van Tol wrote:
> What are the there legal ramifications to this?  While I like to think
> that "it's my network, I'll do what I want to measure its performance",

You could avoid problems by capturing (Wireshark or tcpdump) using a
limited snapshot length. You do not need the payload to perform jitter
analysis so "tcpdump -s 50" might be safer (14 bytes Ethernet + 20 IP +
8 UDP + 8 RTP header).

-Phil

From linux.yahoo at gmail.com  Tue Jun  9 14:39:22 2009
From: linux.yahoo at gmail.com (Manu Chao)
Date: Tue, 9 Jun 2009 20:39:22 +0200
Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7BE3340@xmb-ams-331.emea.cisco.com>
References: <a89d89ac0906031607w1ad9fee6y626d23b5f5bc5e2a@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7B75617@xmb-ams-331.emea.cisco.com>
	<a89d89ac0906040710k79f28271t6e7cd57d2d7d4b2c@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7BE25CA@xmb-ams-331.emea.cisco.com>
	<7100ed370906090854y681a4828u8eb1a5b96fde6526@mail.gmail.com>
	<78C984F8939D424697B15E4B1C1BB3D7BE3340@xmb-ams-331.emea.cisco.com>
Message-ID: <7100ed370906091139n7afa958em4ff1927b9adc907d@mail.gmail.com>

Thanks Arie

On Tue, Jun 9, 2009 at 6:23 PM, Arie Vayner (avayner) <avayner at cisco.com>wrote:

>  Not that I am aware of?
>
>
>
>
> http://www.cisco.com/en/US/products/hw/switches/ps708/products_relevant_interfaces_and_modules.html
>
>
>
> Arie
>
>
>
> *From:* Manu Chao [mailto:linux.yahoo at gmail.com]
> *Sent:* Tuesday, June 09, 2009 18:54
> *To:* Arie Vayner (avayner)
> *Cc:* Marlon Duksa; cisco-nsp at puck.nether.net
>
> *Subject:* Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
>
>
> SIP400/SIP600 is 7600 only too
>
>
>
> no?
>
> On Thu, Jun 4, 2009 at 5:29 PM, Arie Vayner (avayner) <avayner at cisco.com>
> wrote:
>
> Yes, this is true, ES20 is 7600 only (I missed the 6500 angle here ;-) )
>
> We can do VPLS with SIP400 (lower BW) or SIP600 (higher BW).
>
>
>
> BTW, There is also support for MPLSoGRE
>
>
>
> Arie
>
>
>
> From: Marlon Duksa [mailto:mduksa at gmail.com]
> Sent: Thursday, June 04, 2009 17:10
> To: Arie Vayner (avayner)
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
>
>
>
> Thanks Arie. But ES cards are not supported on Cat6500, no? And also
> VPLS over MPLS on a SIP in Cat6500 - is it supported? If so do you know
> which SIP?
>
> Thanks,
>
> Marlon
>
> On Wed, Jun 3, 2009 at 9:19 PM, Arie Vayner (avayner)
> <avayner at cisco.com> wrote:
>
> Marlon,
>
> If you have DFCs on the regular LAN cards, then EoMPLS and L3VPN will be
> done in hardware and in distributed forwarding mode.
> For VPLS, you need to have either an ES20/ES40 card or a SIP card facing
> the core. Having this card means that again VPLS is done in hardware -
> some functionality is done on the regular DFCs and some on the egress
> core facing module.
>
> Arie
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Marlon Duksa
> Sent: Thursday, June 04, 2009 02:07
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] MPLS/IP-VPN capable cards on Cat 6500
>
> Hi -Does anyone know which cards on Cat6500 support MPLS
> and separately IP-VPN, posibly at 40Gbps throughput? I'm looking for a
> distributed (DFC) forwarding solution?
>
> I know that Cat6500 is very limited in VPLS support, but IP-VPN and
> EoMPLS
> should be no problem, right?
>
> Thanks,
> Marlon
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>

From ayourtch at cisco.com  Tue Jun  9 15:16:11 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Tue, 9 Jun 2009 21:16:11 +0200 (CEST)
Subject: [c-nsp] ASA IPv6 SSH Re:  hung vty on SXH3a?
In-Reply-To: <C4EA1540E9BA42B0A5CF85A57BBEEDD7@flamdt01>
References: <20090603071609.GY290@greenie.muc.de><!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAAiedOQa61KR4br7LTrx+1SAQAAAAA=@iname.com><20090609072046.GR290@greenie.muc.de><4A2E1E62.8020301@imperial.ac.uk>
	<20090609160900.GZ290@greenie.muc.de>
	<C4EA1540E9BA42B0A5CF85A57BBEEDD7@flamdt01>
Message-ID: <Pine.LNX.4.64.0906092111330.3439@zippy.stdio.be>



On Tue, 9 Jun 2009, Tony Varriale wrote:

> Odd, I've been seeing similiar problems lately in ASA 8.x code with IPv6 SSH 
> connections...when IPv6 isn't enabled.
>
> Maybe the same team writes the management code? :)

nope, they are different. :)

If you have more details / case# for the ASA IPv6 SSH issue - please 
unicast the details, let's take a look. (yes, I work in TAC and yes i 
am interested ensure we sort out this IPv6-related issue :)

cheers,
andrew

From mb at adv.gcomm.com.au  Tue Jun  9 19:05:31 2009
From: mb at adv.gcomm.com.au (mb at adv.gcomm.com.au)
Date: Wed, 10 Jun 2009 09:05:31 +1000
Subject: [c-nsp] BGP -> OSPF (Or another way?)
Message-ID: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>

Hi,

We are receiving a /24 from one of our upstreams, that we need to 
redistribute into our IGP (OSPF), so that all of our cores are aware 
that they can reach this /24 primarily through this upstream(Then, if 
this upstream is down, traffic destined to this /24 would go via our 
other upstreams)

I know redistributing bgp->ospf is considered a bad idea, but other 
than adding a static route, is there another option?

Under ospf would it be
redistribute bgp xxx route-map SUBNET_TO_INJECT_FROM_BGP

With the above route maps acl only allowing the /24 we are interested in?

Thanks in advance.

-------------------------------------------------------------------------
This e-mail was sent via GCOMM WebMail http://www.gcomm.com.au/



From mulitskiy at acedsl.com  Tue Jun  9 18:37:06 2009
From: mulitskiy at acedsl.com (Michael Ulitskiy)
Date: Tue, 9 Jun 2009 18:37:06 -0400
Subject: [c-nsp] RTL-8139 NIC in WS-X6348-RJ-45 - no link
Message-ID: <200906091837.06067.mulitskiy@acedsl.com>



From mulitskiy at acedsl.com  Tue Jun  9 18:37:06 2009
From: mulitskiy at acedsl.com (Michael Ulitskiy)
Date: Tue, 9 Jun 2009 18:37:06 -0400
Subject: [c-nsp] RTL-8139 NIC in WS-X6348-RJ-45 - no link
Message-ID: <200906091837.06067.mulitskiy@acedsl.com>

Hello,

I have some very strange problem. 
I have 2 old servers that I still need to support that have RTL-8139 NIC on-board.
For some reason if I connect them to WS-X6348-RJ-45 in 6500 the link doesn't come up whatever I do.
If I connect them to another switch - I tried 3500XL and 8500 - then everything OK and link 
comes up as it should.
Is anyone aware about some kind of incompatibility between Realtek and WS-X6348-RJ-45?
Is there any knob to turn?
Thanks,

Michael

From dale.shaw+cisco-nsp at gmail.com  Tue Jun  9 19:34:22 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Wed, 10 Jun 2009 09:34:22 +1000
Subject: [c-nsp] BGP -> OSPF (Or another way?)
In-Reply-To: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
References: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
Message-ID: <3329cbb40906091634p1a7a8017rdb7e206368ca0ebc@mail.gmail.com>

Hi,

On Wed, Jun 10, 2009 at 9:05 AM, <mb at adv.gcomm.com.au> wrote:
> I know redistributing bgp->ospf is considered a bad idea, but other than
> adding a static route, is there another option?

You could use a 'reliable static' (using IP SLA and the 'track'
keyword on the 'ip route' command) and redistribute that, but I'm not
sure it's any 'better' in this case, as long as you're only ever
redistributing a small number of routes. You could probably get
quicker convergence this way, depending on how connectivity to the
upstream fails.

http://www.cisco.com/en/US/docs/ios/12_3/12_3x/12_3xe/feature/guide/dbackupx.html

Assuming you pursue the BGP -> OSPF redistribution --

> Under ospf would it be
> redistribute bgp xxx route-map SUBNET_TO_INJECT_FROM_BGP

Don't forget the 'subnets' keyword.

> With the above route maps acl only allowing the /24 we are interested in?

Depending on your route-map config, yeah.

ip prefix-list BGP_TO_OSPF permit 192.168.55.0/24
!
route-map SUBNET_TO_INJECT_FROM_BGP
 match ip address prefix BGP_TO_OSPF
!
router ospf 1
 redistribute bgp 12345 subnets route-map SUBNET_TO_INJECT_FROM_BGP

This will inject anything matched in the 'BGP_TO_OSPF' prefix-list
into OSPF as a type-2 external ("O E2") route. This'll turn your BGP
router into an OSPF ASBR, if it's not already. Make sure it's not in a
stub area.

cheers,
Dale

From max.reid at saikonetworks.com  Tue Jun  9 19:41:25 2009
From: max.reid at saikonetworks.com (Maxwell Reid)
Date: Tue, 9 Jun 2009 16:41:25 -0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <20090609143921.GY290@greenie.muc.de>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<20090609143921.GY290@greenie.muc.de>
Message-ID: <8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>


The ACL"s on the vswitch/nexus are only part of the security  
equation.  It's using them in combination with vShield  Zones at the  
ESX level (new feature of v4) that yields the best results.


~Max



On Jun 9, 2009, at 7:39 AM, Gert Doering wrote:

> Hi,
>
> On Tue, Jun 09, 2009 at 12:12:32PM +0100, Sam Stickland wrote:
>> I notice that in all the Cisco marketing material it talks repeatedly
>> about how the guest's security profile will migrate with the VM.
>> However, as far as I can tell NX-OS only offers non-stateful ACLs  
>> and no
>> inspection so I'm not sure it's really that useful?
>
> Well, you need to put this in relation to the "standard" VMware switch
> - which can't do ACLs, and where nothing whatsoever will migrate but
> everything (VLAN setup etc) needs to be properly prepated beforhand
> for VMotion to work...
>
> gert
>
> -- 
> USENET is *not* the non-clickable part of WWW!
>                                                           //www.muc.de/~gert/
> Gert Doering - Munich, Germany                             gert at greenie.muc.de
> fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From Kris.Amy at EIP.net.au  Tue Jun  9 19:43:08 2009
From: Kris.Amy at EIP.net.au (Kris Amy)
Date: Wed, 10 Jun 2009 09:43:08 +1000
Subject: [c-nsp] BGP -> OSPF (Or another way?)
In-Reply-To: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
Message-ID: <C65530AD.3F126%kris.amy@eip.net.au>

You could run iBGP from your borders into your core.


On 10/06/09 9:05 AM, "mb at adv.gcomm.com.au" <mb at adv.gcomm.com.au> wrote:

Hi,

We are receiving a /24 from one of our upstreams, that we need to
redistribute into our IGP (OSPF), so that all of our cores are aware
that they can reach this /24 primarily through this upstream(Then, if
this upstream is down, traffic destined to this /24 would go via our
other upstreams)

I know redistributing bgp->ospf is considered a bad idea, but other
than adding a static route, is there another option?

Under ospf would it be
redistribute bgp xxx route-map SUBNET_TO_INJECT_FROM_BGP

With the above route maps acl only allowing the /24 we are interested in?

Thanks in advance.

-------------------------------------------------------------------------
This e-mail was sent via GCOMM WebMail http://www.gcomm.com.au/


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


--
Kind Regards,
Kris Amy
Enterprise IP
Phone:    07 3123 5510
National: 1300 347 287
Fax:      1300 347 329
Direct:   07 3123 5511
Email:    kris.amy at eip.net.au

From rdobbins at arbor.net  Tue Jun  9 20:00:36 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 10 Jun 2009 07:00:36 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<20090609143921.GY290@greenie.muc.de>
	<8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>
Message-ID: <7B1AB359-3C4C-49C4-B566-54056F489D46@arbor.net>


On Jun 10, 2009, at 6:41 AM, Maxwell Reid wrote:

>  It's using them in combination with vShield  Zones at the ESX level  
> (new feature of v4) that yields the best results.

It's also important to note that all of this runs in software, and is  
thus subject to the performance limitations thereof.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From mark.r.zipp at gmail.com  Tue Jun  9 21:16:32 2009
From: mark.r.zipp at gmail.com (Mark Zipp)
Date: Wed, 10 Jun 2009 10:46:32 +0930
Subject: [c-nsp] Non-Cisco SFPs (i.e. Finisar) in TwinGig modules on a
	4900M?
In-Reply-To: <20090609111109.GA22755@danton.fire-world.de>
References: <a9a0929d0906090026y67b4234bg1eaf61eb5d5e5ee@mail.gmail.com>
	<20090609111109.GA22755@danton.fire-world.de>
Message-ID: <a9a0929d0906091816o38b7f78bka0cc8f4b72cab3f3@mail.gmail.com>

Hi Sebastian,

2009/6/9 Sebastian Wiesinger <cisco-nsp at ml.karotte.org>:
> * Mark Zipp <mark.r.zipp at gmail.com> [2009-06-09 09:33]:
>> Hi,
>>
>> Does anybody know if the 'service unsupported-transceiver' command is
>> supported on the 4900Ms? We're intending to use Finisar 1000BaseLX
>> SFPs.
>
> I can confirm this:
>
> NAME: "Converter 3/2", DESCR: "Converter Module"
> PID: CVR-X2-SFP ? ? ? ?, VID: V01 ?, SN: CAT111058P7
>
> NAME: "GigabitEthernet3/11", DESCR: "1000BaseSX"
> PID: Unspecified ? ? ? , VID: ? ? ?, SN: FNS11172H80
>
> Don't forget to use
>
> hw-module module X port-group Y select gigabitethernet
>
> or you'll get some not-so-helpful errors (in older IOS versions).
>

Thanks very much for that info - it'll save us $000s!

Regards,
Mark.

> --
> GPG Key-ID: 0x76B79F20 (0x1B6034F476B79F20)
> 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE.
> ? ? ? ? ? ?-- Terry Pratchett, The Fifth Elephant
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From mksmith at adhost.com  Tue Jun  9 21:58:15 2009
From: mksmith at adhost.com (Michael K. Smith)
Date: Tue, 09 Jun 2009 18:58:15 -0700
Subject: [c-nsp] BGP -> OSPF (Or another way?)
In-Reply-To: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
Message-ID: <C6546147.7ADD6%mksmith@adhost.com>




On 6/9/09 4:05 PM, "mb at adv.gcomm.com.au" <mb at adv.gcomm.com.au> wrote:

> Hi,
> 
> We are receiving a /24 from one of our upstreams, that we need to
> redistribute into our IGP (OSPF), so that all of our cores are aware
> that they can reach this /24 primarily through this upstream(Then, if
> this upstream is down, traffic destined to this /24 would go via our
> other upstreams)
> 
> I know redistributing bgp->ospf is considered a bad idea, but other
> than adding a static route, is there another option?
> 
> Under ospf would it be
> redistribute bgp xxx route-map SUBNET_TO_INJECT_FROM_BGP
> 
> With the above route maps acl only allowing the /24 we are interested in?
> 

I think, as Kris said, you should be running iBGP to distribute external
routes through your network.  This keeps the two processes and associated
routes nicely separated.

Setting up an iBGP mesh should be as easy as a single network statement on
each of your connected devices towards every other (unless you want to use
route reflectors).

Regards,

Mike


From Skeeve at eintellego.net  Tue Jun  9 22:22:25 2009
From: Skeeve at eintellego.net (Skeeve Stevens)
Date: Wed, 10 Jun 2009 12:22:25 +1000
Subject: [c-nsp] PA-GE GBIC-T Support?
Message-ID: <292AF25E62B8894C921B893B53A19D97394469E479@BUSINESSEX.business.ad>

Does anyone know if the GBIC-T is officially supported in the PA-GE (for 7200's).

We're actually running these in a dozen routers but until the other day have never noticed it saying:

GigabitEthernet2/0 is up, line protocol is up
  Hardware is WISEMAN, address is 0005.5f23.b41c (bia 0005.5f23.b438)
...
  Full-duplex, 1000Mb/s, link type is autonegotiation, media type is unknown media type

But... it is fully working, and has been since it was installed with no errors.

This page: http://www.cisco.com/en/US/products/hw/modules/ps2033/products_data_sheet09186a0080091ce7.html

Only mentions:
1000Base-SX
1000Base-LX/LH
1000Base-ZX

This may or may not be an old page, but the GBIC-T is not mentioned anywhere, but maybe importantly, does not say that it "isn't" supported.

My googling for any commentary on the PA-GE with GBIC-T has resulted in nothing.

Thoughts anyone?

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
--
NOC, NOC, who's there?

Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.


From clinton at scripty.com  Tue Jun  9 23:38:01 2009
From: clinton at scripty.com (Clinton Work)
Date: Tue, 09 Jun 2009 21:38:01 -0600
Subject: [c-nsp] PA-GE GBIC-T Support?
In-Reply-To: <292AF25E62B8894C921B893B53A19D97394469E479@BUSINESSEX.business.ad>
References: <292AF25E62B8894C921B893B53A19D97394469E479@BUSINESSEX.business.ad>
Message-ID: <4A2F2A99.8010803@scripty.com>


The topic has been discussed before.  Sounds like it works, but isn't 
officially supported. 

http://markmail.org/message/ozlmnboj6ytph4tq

Skeeve Stevens wrote:
> Does anyone know if the GBIC-T is officially supported in the PA-GE (for 7200's).
>
> We're actually running these in a dozen routers but until the other day have never noticed it saying:
>
> GigabitEthernet2/0 is up, line protocol is up
>
>   


-- 
==================================================================
Clinton Work
Airdrie, AB



From achatz at forthnet.gr  Wed Jun 10 04:10:01 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Wed, 10 Jun 2009 11:10:01 +0300
Subject: [c-nsp] Inter-AS EoMPLS/VPLS
Message-ID: <4A2F6A59.2000100@forthnet.gr>

Does anyone have any experience?

I can see it's supported only on IOS-XR, so 7600 it's out of the question (any plans?).
http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.7/mpls/configuration/guide/gc37v2.html#wp1100339

-- 
Tassos

From ibrahim.abozaid at gmail.com  Wed Jun 10 04:30:05 2009
From: ibrahim.abozaid at gmail.com (Ibrahim Abo Zaid)
Date: Wed, 10 Jun 2009 11:30:05 +0300
Subject: [c-nsp] HSRP and Standby router
Message-ID: <a48927f70906100130r757e387fj5a8e4c95c35421ce@mail.gmail.com>

Hi All

I was studying some HSRP senario which is little bit different than what
used to work on , we have 2 routers connected with access ports to internal
box which has 2 direct physical layer-2 links to both routers and HSRP is
running between VLAN SVIs on both routers across L2 ether-channel between
them

if physical link to active router fail , the client will ARP stanby router
for MAC of HSRP group IP , my question here is stanby router will answer ARP
requests while it still detect that active router is still alive from HSRP
over etherchannel between them ? and if yes , what MAC address it will
answer with ? the active router owns group vmac address so if standby reply
it will reply with bia address and L2-switch the traffic to active router ?

waiting for opinions and your experience share


best regards
--Ibrahim

From llc at dansketelecom.com  Wed Jun 10 04:34:51 2009
From: llc at dansketelecom.com (Lars Lystrup Christensen)
Date: Wed, 10 Jun 2009 10:34:51 +0200
Subject: [c-nsp] Inter-AS EoMPLS/VPLS
In-Reply-To: <4A2F6A59.2000100@forthnet.gr>
References: <4A2F6A59.2000100@forthnet.gr>
Message-ID: <44417CD2F19FEA4F885088340A71D33201F0E6FD@mail.office.dansketelecom.com>

Hi Tassos,

You could do inter-AS EoMPLS by using Pseudo Wire stitching/switching, which is supporte don 12.2(33)SRC on the 7600.

It's done as a kind of VPLS domain, however it can only handle one neighbour.

______________________________________

Med venlig hilsen / Kind regards

Lars Lystrup Christensen 
Director of Engineering, CCIE(tm) #20292

Danske Telecom A/S
Sundkrogsgade 13, 4 
2100 K?benhavn ? 


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Tassos Chatzithomaoglou
Sent: 10. juni 2009 10:10
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Inter-AS EoMPLS/VPLS

Does anyone have any experience?

I can see it's supported only on IOS-XR, so 7600 it's out of the question (any plans?).
http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.7/mpls/configuration/guide/gc37v2.html#wp1100339

-- 
Tassos
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From sam_mailinglists at spacething.org  Wed Jun 10 05:56:46 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Wed, 10 Jun 2009 10:56:46 +0100
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
Message-ID: <4A2F835E.1090204@spacething.org>


From rdobbins at arbor.net  Wed Jun 10 06:12:48 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 10 Jun 2009 17:12:48 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2F835E.1090204@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
	<4A2F835E.1090204@spacething.org>
Message-ID: <0BABBA46-C1B8-40B2-B1A3-95F69BD458A8@arbor.net>



From rdobbins at arbor.net  Wed Jun 10 06:34:04 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Wed, 10 Jun 2009 17:34:04 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2F8AEE.4010904@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
	<4A2F835E.1090204@spacething.org> <4A2F8AEE.4010904@spacething.org>
Message-ID: <1F20BA2C-C258-4ABF-A626-415B17B7A4A9@arbor.net>



From sam_mailinglists at spacething.org  Wed Jun 10 06:29:02 2009
From: sam_mailinglists at spacething.org (Sam Stickland)
Date: Wed, 10 Jun 2009 11:29:02 +0100
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <4A2F835E.1090204@spacething.org>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<DA4079DA-94AA-4E79-9D9F-6384D9DE9273@arbor.net>
	<4A2F835E.1090204@spacething.org>
Message-ID: <4A2F8AEE.4010904@spacething.org>


From snar at snar.spb.ru  Wed Jun 10 05:11:59 2009
From: snar at snar.spb.ru (Alexandre Snarskii)
Date: Wed, 10 Jun 2009 13:11:59 +0400
Subject: [c-nsp] Inter-AS EoMPLS/VPLS
In-Reply-To: <4A2F6A59.2000100@forthnet.gr>
References: <4A2F6A59.2000100@forthnet.gr>
Message-ID: <20090610091159.GA73066@snar.spb.ru>



From j.varaillon at cosmoline.com  Wed Jun 10 05:30:05 2009
From: j.varaillon at cosmoline.com (Varaillon Jean Christophe)
Date: Wed, 10 Jun 2009 12:30:05 +0300
Subject: [c-nsp] BGP -> OSPF (Or another way?)
In-Reply-To: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
References: <20090610090531.uwoq6f82pgesoo8g@webmail.datafx.com.au>
Message-ID: <011701c9e9ae$0a20c1b0$1e624510$%varaillon@cosmoline.com>



From peter at rathlev.dk  Wed Jun 10 07:26:31 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Wed, 10 Jun 2009 13:26:31 +0200
Subject: [c-nsp] HSRP and Standby router
In-Reply-To: <a48927f70906100130r757e387fj5a8e4c95c35421ce@mail.gmail.com>
References: <a48927f70906100130r757e387fj5a8e4c95c35421ce@mail.gmail.com>
Message-ID: <1244633191.6034.13.camel@localhost.localdomain>

On Wed, 2009-06-10 at 11:30 +0300, Ibrahim Abo Zaid wrote:
> I was studying some HSRP senario which is little bit different than
> what used to work on , we have 2 routers connected with access ports
> to internal box which has 2 direct physical layer-2 links to both
> routers and HSRP is running between VLAN SVIs on both routers across
> L2 ether-channel between them
> 
> if physical link to active router fail , the client will ARP stanby
> router for MAC of HSRP group IP , my question here is stanby router
> will answer ARP requests while it still detect that active router is
> still alive from HSRP over etherchannel between them ? and if yes ,
> what MAC address it will answer with ? the active router owns group
> vmac address so if standby reply it will reply with bia address and
> L2-switch the traffic to active router ?

Assuming that the routers bridge the access connection and the
connection between them, thus forming a triangular bridge domain, then
if only one physical access link fails and the connection between the
routers is still active the HSRP role will not move between the two
routers. As long as they can see each other somehow the HSRP is stable.

This is effectively a ring topology where any one link may fail without
impacting the forwarding ability. The spanning tree might need to be
recalculated, so it might introduce a short-ish pause.

Traffic from access towards the HSRP standby IP might be switched
through the inactive HSRP member, and this might not be the most
effective way of switching, maybe introducing congestion, but traffic
would still end up in the right place.

OTOH if the two routers lose L2 contact they will both go active.
(Though if the router has no active ports in the VLAN the SVI should go
"line protocol down" and not try to participate in HSRP.) You can expect
loss of connectivity towards the gateway for a full HSRP hold-time
interval, default 10 seconds. AFAIK the standby HSRP unit will not
answer ARP queries in this period.

ARP entries need not be updated since the MAC address of the standby IP
address stays the same.

A topology change notification, sent out when there are changes in the
physical topology, will flush all MAC address tables, helping this part
of the convergence.

I may not have understood your question completely though. :-)

-- 
Peter Rathlev



From peter at rathlev.dk  Wed Jun 10 09:52:13 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Wed, 10 Jun 2009 15:52:13 +0200
Subject: [c-nsp] 3750E and X2-10GB-ZR compatibility?
Message-ID: <1244641933.7592.25.camel@localhost.localdomain>

Just a quick question: The 3750E doesn't support X2-10GB-ZR
tranceivers[1], only up to ER. Using "service unsupported-transceiver" I
can get the switch to recognize the transceiver, but will I be able to
get a link with it?

It's for testing part of a fiber stretch, so it's not for production.
Does anybody have any experience that can confirm or deny any of the
following:

- Could it damage the transceiver?
- Could it damage the switch?
- Would I be able to get link up with it? (The other end is a similar
transceiver in a WS-X6708-10GE-3C module.)
- If I got link up, could I trust this to generally work?

The problem is that the last part of the stretch isn't finished yet, and
it's a little much to carry around a 6506 chassis for testing purposes.

(We have OTDR btw, just want to do a "live" test.)

Thanks in advance.

-- 
Peter Rathlev

[1]: http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modu
les/compatibility/matrix/OL_6974.html#wp48759
(http://tinyurl.com/yooxks)



From max.reid at saikonetworks.com  Wed Jun 10 10:32:31 2009
From: max.reid at saikonetworks.com (Maxwell Reid)
Date: Wed, 10 Jun 2009 07:32:31 -0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <7B1AB359-3C4C-49C4-B566-54056F489D46@arbor.net>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<20090609143921.GY290@greenie.muc.de>
	<8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>
	<7B1AB359-3C4C-49C4-B566-54056F489D46@arbor.net>
Message-ID: <ABC850B9-F3AB-4249-ABA3-49F7C241F63E@saikonetworks.com>


On Jun 9, 2009, at 5:00 PM, Roland Dobbins wrote:

>
> On Jun 10, 2009, at 6:41 AM, Maxwell Reid wrote:
>
>> It's using them in combination with vShield  Zones at the ESX level  
>> (new feature of v4) that yields the best results.
>
> It's also important to note that all of this runs in software, and  
> is thus subject to the performance limitations thereof.



When you're talking about a box with 16-32 3 Ghz Cores and 128 GBs of  
ram with offloading NIC/CNA's that "software" is pretty speedy.   A  
single host running 3 vms can go  as high as 350,000 IOPs/sec from a  
storage perspective, and handle high PPS loads w/ 10GbE at line rate.   
Even "hardware" appliances like the ASA boot strap off what appears to  
be KVM and handle multiple contexts in software; and you really only  
need specialized ASIC's as part of the forwarding plane of high end  
routers.


~Max










>
>
> -----------------------------------------------------------------------
> Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>
>
>        Unfortunately, inefficiency scales really well.
>
> 		   -- Kevin Lawton
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From jcposeidon at cantv.net  Wed Jun 10 11:33:33 2009
From: jcposeidon at cantv.net (Juan C. Crespo R.)
Date: Wed, 10 Jun 2009 11:03:33 -0430
Subject: [c-nsp] Cisco DSLAM ?
Message-ID: <4A2FD24D.2060703@cantv.net>

Guys

Does anyone of you knows a good DSLAM for HDSL & ADSL ?

Thanks

From paul at paulstewart.org  Wed Jun 10 12:28:51 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 10 Jun 2009 12:28:51 -0400
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <4A2FD24D.2060703@cantv.net>
References: <4A2FD24D.2060703@cantv.net>
Message-ID: <000001c9e9e8$8abbfcb0$a033f610$@org>

Occam... ;)

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo R.
Sent: Wednesday, June 10, 2009 11:34 AM
To: Cisco Post NSP
Cc: cisco-nsp at puck.nether.net
Subject: [c-nsp] Cisco DSLAM ?

Guys

Does anyone of you knows a good DSLAM for HDSL & ADSL ?

Thanks
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From panocisco77 at gmail.com  Wed Jun 10 12:40:48 2009
From: panocisco77 at gmail.com (Renelson Panosky)
Date: Wed, 10 Jun 2009 12:40:48 -0400
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
Message-ID: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com>

I Have a brand new 6509-E with WS-SUP32-GE-3B booting up in rommon> mode i
was able to type the command boot so it can look for the right code to boot
up but after i configured the switch i turned off and turned it back on,  it
boot up in rommon mode again and everything was lost.  I know someone had
upgraded the IOS and i am sure that's what causing the problem and i know
there is command i can type to fix the problem but i can't remember it or
find it on the web can someone please help me out with this ?

Renelson

From avayner at cisco.com  Wed Jun 10 12:46:17 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Wed, 10 Jun 2009 18:46:17 +0200
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <4A2FD24D.2060703@cantv.net>
References: <4A2FD24D.2060703@cantv.net>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>

Juan,

Cisco does not make DSLAMs for a long time now...

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo
R.
Sent: Wednesday, June 10, 2009 18:34
To: Cisco Post NSP
Cc: cisco-nsp at puck.nether.net
Subject: [c-nsp] Cisco DSLAM ?

Guys

Does anyone of you knows a good DSLAM for HDSL & ADSL ?

Thanks
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From avayner at cisco.com  Wed Jun 10 12:50:31 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Wed, 10 Jun 2009 18:50:31 +0200
Subject: [c-nsp] HSRP and Standby router
In-Reply-To: <1244633191.6034.13.camel@localhost.localdomain>
References: <a48927f70906100130r757e387fj5a8e4c95c35421ce@mail.gmail.com>
	<1244633191.6034.13.camel@localhost.localdomain>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C48BFA@xmb-ams-331.emea.cisco.com>

I think this document can provide more insight:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DC_Infr
a2_5/DCInfra_6.html

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Peter Rathlev
Sent: Wednesday, June 10, 2009 14:27
To: Ibrahim Abo Zaid
Cc: cisco at groupstudy.com; cisco_nsp
Subject: Re: [c-nsp] HSRP and Standby router

On Wed, 2009-06-10 at 11:30 +0300, Ibrahim Abo Zaid wrote:
> I was studying some HSRP senario which is little bit different than
> what used to work on , we have 2 routers connected with access ports
> to internal box which has 2 direct physical layer-2 links to both
> routers and HSRP is running between VLAN SVIs on both routers across
> L2 ether-channel between them
> 
> if physical link to active router fail , the client will ARP stanby
> router for MAC of HSRP group IP , my question here is stanby router
> will answer ARP requests while it still detect that active router is
> still alive from HSRP over etherchannel between them ? and if yes ,
> what MAC address it will answer with ? the active router owns group
> vmac address so if standby reply it will reply with bia address and
> L2-switch the traffic to active router ?

Assuming that the routers bridge the access connection and the
connection between them, thus forming a triangular bridge domain, then
if only one physical access link fails and the connection between the
routers is still active the HSRP role will not move between the two
routers. As long as they can see each other somehow the HSRP is stable.

This is effectively a ring topology where any one link may fail without
impacting the forwarding ability. The spanning tree might need to be
recalculated, so it might introduce a short-ish pause.

Traffic from access towards the HSRP standby IP might be switched
through the inactive HSRP member, and this might not be the most
effective way of switching, maybe introducing congestion, but traffic
would still end up in the right place.

OTOH if the two routers lose L2 contact they will both go active.
(Though if the router has no active ports in the VLAN the SVI should go
"line protocol down" and not try to participate in HSRP.) You can expect
loss of connectivity towards the gateway for a full HSRP hold-time
interval, default 10 seconds. AFAIK the standby HSRP unit will not
answer ARP queries in this period.

ARP entries need not be updated since the MAC address of the standby IP
address stays the same.

A topology change notification, sent out when there are changes in the
physical topology, will flush all MAC address tables, helping this part
of the convergence.

I may not have understood your question completely though. :-)

-- 
Peter Rathlev


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From aaron at wsc.ma.edu  Wed Jun 10 13:24:34 2009
From: aaron at wsc.ma.edu (Childs, Aaron)
Date: Wed, 10 Jun 2009 13:24:34 -0400
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
In-Reply-To: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com>
References: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com>
Message-ID: <3760B7E1B344364AA0384B231FE7BA6901BBF92B31@ex-be1.ads.wsc.ma.edu>

Hi Renelson,
  What's the configuration register set to? (sh boot) once you're in IOS.  0x0 will bring you to rommon everytime, 0x2102 will boot the sup using the config file.

Aaron

-------------
Aaron Childs
Assistant Director, Networking
Westfield State College
http://www.wsc.ma.edu/it/


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Renelson Panosky
Sent: Wednesday, June 10, 2009 12:41 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B

I Have a brand new 6509-E with WS-SUP32-GE-3B booting up in rommon> mode i
was able to type the command boot so it can look for the right code to boot
up but after i configured the switch i turned off and turned it back on,  it
boot up in rommon mode again and everything was lost.  I know someone had
upgraded the IOS and i am sure that's what causing the problem and i know
there is command i can type to fix the problem but i can't remember it or
find it on the web can someone please help me out with this ?

Renelson
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From paul at paulstewart.org  Wed Jun 10 13:25:01 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 10 Jun 2009 13:25:01 -0400
Subject: [c-nsp] IPTV Switch Recommendation
Message-ID: <000801c9e9f0$638170a0$2a8451e0$@org>

Hi there.

 

We have a customer that does lots of IPTV - they have a new deployment
currently going into an MDU (condos).  They have asked for a recommended
switch that is "IPTV friendly" - I'm presuming they mean multicast aware
etc.  

 

Which Cisco switches would be recommended to handoff approximately 20 Cat5
drops fed by fiber coming in?

 

Cheers,

 

Paul

 

 

 


From masood at nexlinx.net.pk  Wed Jun 10 14:29:51 2009
From: masood at nexlinx.net.pk (masood at nexlinx.net.pk)
Date: Wed, 10 Jun 2009 23:29:51 +0500 (PKT)
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
References: <4A2FD24D.2060703@cantv.net>
	<78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
Message-ID: <27388.196.46.241.57.1244658591.squirrel@nexmail1.nexlinx.net.pk>

Yup Cisco does not make DSLAMs anymore. I think paradyne guys are doing
great job in fact.

http://www.paradyne.com/

Regards,
Masood

> Juan,
>
> Cisco does not make DSLAMs for a long time now...
>
> Arie
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo
> R.
> Sent: Wednesday, June 10, 2009 18:34
> To: Cisco Post NSP
> Cc: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco DSLAM ?
>
> Guys
>
> Does anyone of you knows a good DSLAM for HDSL & ADSL ?
>
> Thanks
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From swmike at swm.pp.se  Wed Jun 10 13:56:51 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Wed, 10 Jun 2009 19:56:51 +0200 (CEST)
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <000801c9e9f0$638170a0$2a8451e0$@org>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
Message-ID: <alpine.DEB.1.10.0906101956050.22851@uplift.swm.pp.se>

On Wed, 10 Jun 2009, Paul Stewart wrote:

> Which Cisco switches would be recommended to handoff approximately 20 
> Cat5 drops fed by fiber coming in?

3560/3750 seems to work well for this.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From ed at edgeoc.net  Wed Jun 10 14:00:41 2009
From: ed at edgeoc.net (Edward Salonia)
Date: Wed, 10 Jun 2009 18:00:41 +0000
Subject: [c-nsp] IPTV Switch Recommendation
Message-ID: <900802754-1244656846-cardhu_decombobulator_blackberry.rim.net-62317833-@bxe1048.bisx.prod.on.blackberry>

Take a look at the ME3400 series.

- Ed

------Original Message------
From: Paul Stewart
Sender: cisco-nsp-bounces at puck.nether.net
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] IPTV Switch Recommendation
Sent: Jun 10, 2009 1:25 PM

Hi there.

 

We have a customer that does lots of IPTV - they have a new deployment
currently going into an MDU (condos).  They have asked for a recommended
switch that is "IPTV friendly" - I'm presuming they mean multicast aware
etc.  

 

Which Cisco switches would be recommended to handoff approximately 20 Cat5
drops fed by fiber coming in?

 

Cheers,

 

Paul

 

 

 

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From savage at savage.za.org  Wed Jun 10 14:09:37 2009
From: savage at savage.za.org (Chris Knipe)
Date: Wed, 10 Jun 2009 20:09:37 +0200
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <000801c9e9f0$638170a0$2a8451e0$@org>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
Message-ID: <20090610180937.GA27437@fusion.opticnetworks.net>

On 10/06/09 13:25 -0400, Paul Stewart wrote:

>We have a customer that does lots of IPTV - they have a new deployment
>currently going into an MDU (condos).  They have asked for a recommended
>switch that is "IPTV friendly" - I'm presuming they mean multicast aware
>etc.  
>
>Which Cisco switches would be recommended to handoff approximately 20 Cat5
>drops fed by fiber coming in?


We're going through the same story at this stage.  Working with allot of 
vendors, testing, and trails.  So far for us, a combination of entry
level 2960s and 3560s are working fine.  You are correct, the most
important thing is Multicast and IGMP subscriptions, so pretty much
any half decent switch would be capable.

Ciscos naturally just work best for us though because we love them so 
much.

--
Chris.


From jeff-kell at utc.edu  Wed Jun 10 14:27:17 2009
From: jeff-kell at utc.edu (Jeff Kell)
Date: Wed, 10 Jun 2009 14:27:17 -0400
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <20090610180937.GA27437@fusion.opticnetworks.net>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
	<20090610180937.GA27437@fusion.opticnetworks.net>
Message-ID: <4A2FFB05.1050709@utc.edu>

Chris Knipe wrote:
> We're going through the same story at this stage.  Working with allot
> of vendors, testing, and trails.  So far for us, a combination of entry
> level 2960s and 3560s are working fine.  You are correct, the most
> important thing is Multicast and IGMP subscriptions, so pretty much
> any half decent switch would be capable. 

Reminds me... do you need the "LAN Base" version to make it fly, or will
"LAN Lite" work?

(or for the 3560s, IP Base or IP Services?)

Jeff

From savage at savage.za.org  Wed Jun 10 14:29:43 2009
From: savage at savage.za.org (Chris Knipe)
Date: Wed, 10 Jun 2009 20:29:43 +0200
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <4A2FFB05.1050709@utc.edu>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
	<20090610180937.GA27437@fusion.opticnetworks.net>
	<4A2FFB05.1050709@utc.edu>
Message-ID: <20090610182943.GA29875@fusion.opticnetworks.net>

On 10/06/09 14:27 -0400, Jeff Kell wrote:
>Chris Knipe wrote:
>> We're going through the same story at this stage.  Working with allot
>> of vendors, testing, and trails.  So far for us, a combination of entry
>> level 2960s and 3560s are working fine.  You are correct, the most
>> important thing is Multicast and IGMP subscriptions, so pretty much
>> any half decent switch would be capable. 
>
>Reminds me... do you need the "LAN Base" version to make it fly, or will
>"LAN Lite" work?

Didn't even know there is a LAN Lite :(  All our switches runs LAN Base

--
Chris



From rshughes at gmail.com  Wed Jun 10 14:54:55 2009
From: rshughes at gmail.com (Ryan Hughes)
Date: Wed, 10 Jun 2009 14:54:55 -0400
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <4A2FFB05.1050709@utc.edu>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
	<20090610180937.GA27437@fusion.opticnetworks.net>
	<4A2FFB05.1050709@utc.edu>
Message-ID: <e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>

It "depends" - largely on the type of Multicast you're rolling out.

I had mixed results with 3560's running IP Base versus IP Services for
SSM/AutoRP roll out. Depending on your requirements you could maybe get IP
Base to work but best results were with IP Services.

Ryan

On Wed, Jun 10, 2009 at 2:27 PM, Jeff Kell <jeff-kell at utc.edu> wrote:

> Chris Knipe wrote:
> > We're going through the same story at this stage.  Working with allot
> > of vendors, testing, and trails.  So far for us, a combination of entry
> > level 2960s and 3560s are working fine.  You are correct, the most
> > important thing is Multicast and IGMP subscriptions, so pretty much
> > any half decent switch would be capable.
>
> Reminds me... do you need the "LAN Base" version to make it fly, or will
> "LAN Lite" work?
>
> (or for the 3560s, IP Base or IP Services?)
>
> Jeff
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From amgnetforums at gmail.com  Wed Jun 10 15:45:45 2009
From: amgnetforums at gmail.com (amgnetforums)
Date: Wed, 10 Jun 2009 20:45:45 +0100
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>
References: <000801c9e9f0$638170a0$2a8451e0$@org>	<20090610180937.GA27437@fusion.opticnetworks.net>	<4A2FFB05.1050709@utc.edu>
	<e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>
Message-ID: <4A300D69.9060501@gmail.com>

Ryan Hughes wrote:
> It "depends" - largely on the type of Multicast you're rolling out.
>
> I had mixed results with 3560's running IP Base versus IP Services for
> SSM/AutoRP roll out. Depending on your requirements you could maybe get IP
> Base to work but best results were with IP Services.
>
> Ryan
>
> On Wed, Jun 10, 2009 at 2:27 PM, Jeff Kell <jeff-kell at utc.edu> wrote:
>
>   
>> Chris Knipe wrote:
>>     
>>> We're going through the same story at this stage.  Working with allot
>>> of vendors, testing, and trails.  So far for us, a combination of entry
>>> level 2960s and 3560s are working fine.  You are correct, the most
>>> important thing is Multicast and IGMP subscriptions, so pretty much
>>> any half decent switch would be capable.
>>>       
>> Reminds me... do you need the "LAN Base" version to make it fly, or will
>> "LAN Lite" work?
>>
>> (or for the 3560s, IP Base or IP Services?)
>>
>> Jeff
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>     
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   
Hi

We use ME3400 with metro ip access image. ssm works perfect. Have a look 
at the following links for some guidelines.

http://www.cisco.com/en/US/products/ps6902/products_implementation_design_guide_book09186a00806b5b4c.html

http://www.cisco.com/en/US/partner/products/ps6902/products_implementation_design_guide_book09186a0080665c4c.html

Anthony

From tarko at lanparty.ee  Wed Jun 10 15:12:57 2009
From: tarko at lanparty.ee (Tarko Tikan)
Date: Wed, 10 Jun 2009 22:12:57 +0300
Subject: [c-nsp] IPTV Switch Recommendation
In-Reply-To: <000801c9e9f0$638170a0$2a8451e0$@org>
References: <000801c9e9f0$638170a0$2a8451e0$@org>
Message-ID: <1244660866-sup-9497@valgus>

hey,

> We have a customer that does lots of IPTV - they have a new deployment
> currently going into an MDU (condos).  They have asked for a recommended
> switch that is "IPTV friendly" - I'm presuming they mean multicast aware
> etc.  

I have been down this road - don't waste your time with "cheaper" vendors, you will end up replacing the gear anyway.

> Which Cisco switches would be recommended to handoff approximately 20 Cat5
> drops fed by fiber coming in?

2960 does fine job. You now get all the security features that were available on 3750 only, on 2960 too.

ME2400 used to be an alternative but it always looked like a box made for one customer and it's EOS now anyway.

-- 
tarko

From tkacprzynski at SpencerStuart.com  Wed Jun 10 15:55:59 2009
From: tkacprzynski at SpencerStuart.com (tkacprzynski at SpencerStuart.com)
Date: Wed, 10 Jun 2009 14:55:59 -0500
Subject: [c-nsp] WS-X6148-RJ21 Ethernet Modules
In-Reply-To: <4A300D69.9060501@gmail.com>
References: <000801c9e9f0$638170a0$2a8451e0$@org>	<20090610180937.GA27437@fusion.opticnetworks.net>	<4A2FFB05.1050709@utc.edu><e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>
	<4A300D69.9060501@gmail.com>
Message-ID: <A8A11BA006DA57498FAC0A56686865042AA79799@usilwdex04.spencerstuart.com>

Hello
I was wondering if anyone has any experience using the RJ21 modules for
6500 Catalyst? Any good things to say? Any bad things to say?

Regrets deploying it? 

This would be for access switches.

Thank you,

Tom


From shinejoseph at dodo.com.au  Wed Jun 10 16:42:26 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 11 Jun 2009 04:42:26 +0800
Subject: [c-nsp] WLC discovery
Message-ID: <58C3E1A533144637A09B8082C7489B21@au.didata.local>

Hi,

A Cisco WLC4402 is configured and working alright. All of the APs currently are in the same subnet and hence the discovery do not require DHCP Option 43 or DNS. I want to add another AP that is in a different. When the AP tries to register with the WLC, it registers momentarily and un registers. This has happened for eithe DHCP option and DNS discovery.

I am sure, there is something I have not done to get this working. Can anyone suggest somthing that I should try?

Thanks in advance,

Shine

From eng_mssk at hotmail.com  Wed Jun 10 17:09:37 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Thu, 11 Jun 2009 00:09:37 +0300
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <4A2FD24D.2060703@cantv.net>
References: <4A2FD24D.2060703@cantv.net>
Message-ID: <BLU102-W261A5BC1409B9331812498FA450@phx.gbl>


you can use Paradyne DSLAMs or Alcatel ISAMs (IP DSLAMs)

> Date: Wed, 10 Jun 2009 11:03:33 -0430
> From: jcposeidon at cantv.net
> To: cisco-nsp-request at puck.nether.net
> CC: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco DSLAM ?
> 
> Guys
> 
> Does anyone of you knows a good DSLAM for HDSL & ADSL ?
> 
> Thanks
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

From A.L.M.Buxey at lboro.ac.uk  Wed Jun 10 17:11:31 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Wed, 10 Jun 2009 22:11:31 +0100
Subject: [c-nsp] WLC discovery
In-Reply-To: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
References: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
Message-ID: <20090610211131.GA9779@lboro.ac.uk>

Hi,
> Hi,
> 
> A Cisco WLC4402 is configured and working alright. All of the APs currently are in the same subnet and hence the discovery do not require DHCP Option 43 or DNS. I want to add another AP that is in a different. When the AP tries to register with the WLC, it registers momentarily and un registers. This has happened for eithe DHCP option and DNS discovery.
> 
> I am sure, there is something I have not done to get this working. Can anyone suggest somthing that I should try?

is master controller mode turned on?

alan

From shinejoseph at dodo.com.au  Wed Jun 10 17:14:08 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 11 Jun 2009 05:14:08 +0800
Subject: [c-nsp] WLC discovery
References: <C65594B8.DAF3%KaeglerM@tessco.com>
Message-ID: <29674A7372B443BDBC917147C67A32B7@au.didata.local>

Thanks Mike for the the quick response.

That means I have to have physical access to the APs which are already 
mounted on the ceiling.
I am in the process of moving this AP to another subnet and I have some 18 
of them to be moved from a single subnet to different subnets.

I can see this AP regsiters momentarily and de-registers. We are running 
code 5.1.

When the AP regsiters I can go to its configuration page and I see Hardware 
reset and Reset to Factory defaults.

Any help is appreciated.

Thanks,
Shine
----- Original Message ----- 
From: "Kaegler, Mike" <KaeglerM at tessco.com>
To: "Shine Joseph" <shinejoseph at dodo.com.au>; <cisco-nsp at puck.nether.net>
Sent: Thursday, June 11, 2009 4:50 AM
Subject: Re: [c-nsp] WLC discovery


> Boot the AP with the Mode button down to reset its parameter memory.
> If that doesn't help, hook into console and watch the messages.
> If that doesn't help, execute some 'debug [...]' statements on the same
> console.
> -porkchop
>
>
> On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:
>
>> Hi,
>>
>> A Cisco WLC4402 is configured and working alright. All of the APs 
>> currently
>> are in the same subnet and hence the discovery do not require DHCP Option 
>> 43
>> or DNS. I want to add another AP that is in a different. When the AP 
>> tries to
>> register with the WLC, it registers momentarily and un registers. This 
>> has
>> happened for eithe DHCP option and DNS discovery.
>>
>> I am sure, there is something I have not done to get this working. Can 
>> anyone
>> suggest somthing that I should try?
>>
>> Thanks in advance,
>>
>> Shine
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
> -- 
> Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
> Your wireless success, nothing less. http://www.tessco.com/
> 


From shinejoseph at dodo.com.au  Wed Jun 10 17:18:37 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 11 Jun 2009 05:18:37 +0800
Subject: [c-nsp] WLC discovery
References: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
	<20090610211131.GA9779@lboro.ac.uk>
Message-ID: <523AE2E8DAAC4990BDA1EB865ECB8630@au.didata.local>

Hi,

There is only one controller and I believe this is the master controller. DO 
you know, where I could check this?

Thanks,
Shine

----- Original Message ----- 
From: <A.L.M.Buxey at lboro.ac.uk>
To: "Shine Joseph" <shinejoseph at dodo.com.au>
Cc: <cisco-nsp at puck.nether.net>
Sent: Thursday, June 11, 2009 5:11 AM
Subject: Re: [c-nsp] WLC discovery


> Hi,
>> Hi,
>>
>> A Cisco WLC4402 is configured and working alright. All of the APs 
>> currently are in the same subnet and hence the discovery do not require 
>> DHCP Option 43 or DNS. I want to add another AP that is in a different. 
>> When the AP tries to register with the WLC, it registers momentarily and 
>> un registers. This has happened for eithe DHCP option and DNS discovery.
>>
>> I am sure, there is something I have not done to get this working. Can 
>> anyone suggest somthing that I should try?
>
> is master controller mode turned on?
>
> alan 


From KaeglerM at tessco.com  Wed Jun 10 16:50:00 2009
From: KaeglerM at tessco.com (Kaegler, Mike)
Date: Wed, 10 Jun 2009 16:50:00 -0400
Subject: [c-nsp] WLC discovery
In-Reply-To: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
Message-ID: <C65594B8.DAF3%KaeglerM@tessco.com>

Boot the AP with the Mode button down to reset its parameter memory.
If that doesn't help, hook into console and watch the messages.
If that doesn't help, execute some 'debug [...]' statements on the same
console.
-porkchop


On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:

> Hi,
> 
> A Cisco WLC4402 is configured and working alright. All of the APs currently
> are in the same subnet and hence the discovery do not require DHCP Option 43
> or DNS. I want to add another AP that is in a different. When the AP tries to
> register with the WLC, it registers momentarily and un registers. This has
> happened for eithe DHCP option and DNS discovery.
> 
> I am sure, there is something I have not done to get this working. Can anyone
> suggest somthing that I should try?
> 
> Thanks in advance,
> 
> Shine
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 

-- 
Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
Your wireless success, nothing less. http://www.tessco.com/


From rwest at zyedge.com  Wed Jun 10 17:30:32 2009
From: rwest at zyedge.com (Ryan West)
Date: Wed, 10 Jun 2009 17:30:32 -0400
Subject: [c-nsp] WLC discovery
In-Reply-To: <29674A7372B443BDBC917147C67A32B7@au.didata.local>
References: <C65594B8.DAF3%KaeglerM@tessco.com>
	<29674A7372B443BDBC917147C67A32B7@au.didata.local>
Message-ID: <8ED19A65-5326-45D3-9AB4-8ED342823302@zyedge.com>

Are you in Layer 2 or Layer 3 AP mode. I forget if this is the actual  
name, but you may need to switch to layer 3.

Sent from handheld.

On Jun 10, 2009, at 5:26 PM, "Shine Joseph" <shinejoseph at dodo.com.au>  
wrote:

> Thanks Mike for the the quick response.
>
> That means I have to have physical access to the APs which are already
> mounted on the ceiling.
> I am in the process of moving this AP to another subnet and I have  
> some 18
> of them to be moved from a single subnet to different subnets.
>
> I can see this AP regsiters momentarily and de-registers. We are  
> running
> code 5.1.
>
> When the AP regsiters I can go to its configuration page and I see  
> Hardware
> reset and Reset to Factory defaults.
>
> Any help is appreciated.
>
> Thanks,
> Shine
> ----- Original Message -----
> From: "Kaegler, Mike" <KaeglerM at tessco.com>
> To: "Shine Joseph" <shinejoseph at dodo.com.au>; <cisco-nsp at puck.nether.net 
> >
> Sent: Thursday, June 11, 2009 4:50 AM
> Subject: Re: [c-nsp] WLC discovery
>
>
>> Boot the AP with the Mode button down to reset its parameter memory.
>> If that doesn't help, hook into console and watch the messages.
>> If that doesn't help, execute some 'debug [...]' statements on the  
>> same
>> console.
>> -porkchop
>>
>>
>> On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:
>>
>>> Hi,
>>>
>>> A Cisco WLC4402 is configured and working alright. All of the APs
>>> currently
>>> are in the same subnet and hence the discovery do not require DHCP  
>>> Option
>>> 43
>>> or DNS. I want to add another AP that is in a different. When the AP
>>> tries to
>>> register with the WLC, it registers momentarily and un registers.  
>>> This
>>> has
>>> happened for eithe DHCP option and DNS discovery.
>>>
>>> I am sure, there is something I have not done to get this working.  
>>> Can
>>> anyone
>>> suggest somthing that I should try?
>>>
>>> Thanks in advance,
>>>
>>> Shine
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>
>> -- 
>> Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
>> Your wireless success, nothing less. http://www.tessco.com/
>>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From shinejoseph at dodo.com.au  Wed Jun 10 17:49:10 2009
From: shinejoseph at dodo.com.au (Shine Joseph)
Date: Thu, 11 Jun 2009 05:49:10 +0800
Subject: [c-nsp] WLC discovery
References: <C65594B8.DAF3%KaeglerM@tessco.com>
	<29674A7372B443BDBC917147C67A32B7@au.didata.local>
	<8ED19A65-5326-45D3-9AB4-8ED342823302@zyedge.com>
Message-ID: <49E6C818867140B7A647B639486C81C8@au.didata.local>

Yes it is in layer 3 mode

----- Original Message ----- 
From: "Ryan West" <rwest at zyedge.com>
To: "Shine Joseph" <shinejoseph at dodo.com.au>
Cc: "Kaegler, Mike" <KaeglerM at tessco.com>; <cisco-nsp at puck.nether.net>
Sent: Thursday, June 11, 2009 5:30 AM
Subject: Re: [c-nsp] WLC discovery


Are you in Layer 2 or Layer 3 AP mode. I forget if this is the actual  
name, but you may need to switch to layer 3.

Sent from handheld.

On Jun 10, 2009, at 5:26 PM, "Shine Joseph" <shinejoseph at dodo.com.au>  
wrote:

> Thanks Mike for the the quick response.
>
> That means I have to have physical access to the APs which are already
> mounted on the ceiling.
> I am in the process of moving this AP to another subnet and I have  
> some 18
> of them to be moved from a single subnet to different subnets.
>
> I can see this AP regsiters momentarily and de-registers. We are  
> running
> code 5.1.
>
> When the AP regsiters I can go to its configuration page and I see  
> Hardware
> reset and Reset to Factory defaults.
>
> Any help is appreciated.
>
> Thanks,
> Shine
> ----- Original Message -----
> From: "Kaegler, Mike" <KaeglerM at tessco.com>
> To: "Shine Joseph" <shinejoseph at dodo.com.au>; <cisco-nsp at puck.nether.net 
> >
> Sent: Thursday, June 11, 2009 4:50 AM
> Subject: Re: [c-nsp] WLC discovery
>
>
>> Boot the AP with the Mode button down to reset its parameter memory.
>> If that doesn't help, hook into console and watch the messages.
>> If that doesn't help, execute some 'debug [...]' statements on the  
>> same
>> console.
>> -porkchop
>>
>>
>> On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:
>>
>>> Hi,
>>>
>>> A Cisco WLC4402 is configured and working alright. All of the APs
>>> currently
>>> are in the same subnet and hence the discovery do not require DHCP  
>>> Option
>>> 43
>>> or DNS. I want to add another AP that is in a different. When the AP
>>> tries to
>>> register with the WLC, it registers momentarily and un registers.  
>>> This
>>> has
>>> happened for eithe DHCP option and DNS discovery.
>>>
>>> I am sure, there is something I have not done to get this working.  
>>> Can
>>> anyone
>>> suggest somthing that I should try?
>>>
>>> Thanks in advance,
>>>
>>> Shine
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>
>>
>> -- 
>> Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
>> Your wireless success, nothing less. http://www.tessco.com/
>>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From KaeglerM at tessco.com  Wed Jun 10 17:56:36 2009
From: KaeglerM at tessco.com (Kaegler, Mike)
Date: Wed, 10 Jun 2009 17:56:36 -0400
Subject: [c-nsp] WLC discovery
In-Reply-To: <49E6C818867140B7A647B639486C81C8@au.didata.local>
Message-ID: <C655A454.DB0E%KaeglerM@tessco.com>

Good call anyway, Ryan.

Master mode will have no affect in this scenario, AFAIK. Master will only
cause this controller to take priority over any other controllers if several
share the same group, forcing new APs to land on the Master (knowing where
they'd land makes for easier configuration during initial deployment). In
the era of WCS, this is less of an issue.

The only other things you can do are check firewalls between subnets (make
sure both IPs are allowed, etc). You can try a few 'debug [...]' commands on
the controller, but what you may really need is a ladder.
-porkchop

On 6/10/09 5:49 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:

> Yes it is in layer 3 mode
> 
> ----- Original Message -----
> From: "Ryan West" <rwest at zyedge.com>
> To: "Shine Joseph" <shinejoseph at dodo.com.au>
> Cc: "Kaegler, Mike" <KaeglerM at tessco.com>; <cisco-nsp at puck.nether.net>
> Sent: Thursday, June 11, 2009 5:30 AM
> Subject: Re: [c-nsp] WLC discovery
> 
> 
> Are you in Layer 2 or Layer 3 AP mode. I forget if this is the actual
> name, but you may need to switch to layer 3.
> 
> Sent from handheld.
> 
> On Jun 10, 2009, at 5:26 PM, "Shine Joseph" <shinejoseph at dodo.com.au>
> wrote:
> 
>> Thanks Mike for the the quick response.
>> 
>> That means I have to have physical access to the APs which are already
>> mounted on the ceiling.
>> I am in the process of moving this AP to another subnet and I have
>> some 18
>> of them to be moved from a single subnet to different subnets.
>> 
>> I can see this AP regsiters momentarily and de-registers. We are
>> running
>> code 5.1.
>> 
>> When the AP regsiters I can go to its configuration page and I see
>> Hardware
>> reset and Reset to Factory defaults.
>> 
>> Any help is appreciated.
>> 
>> Thanks,
>> Shine
>> ----- Original Message -----
>> From: "Kaegler, Mike" <KaeglerM at tessco.com>
>> To: "Shine Joseph" <shinejoseph at dodo.com.au>; <cisco-nsp at puck.nether.net
>>> 
>> Sent: Thursday, June 11, 2009 4:50 AM
>> Subject: Re: [c-nsp] WLC discovery
>> 
>> 
>>> Boot the AP with the Mode button down to reset its parameter memory.
>>> If that doesn't help, hook into console and watch the messages.
>>> If that doesn't help, execute some 'debug [...]' statements on the
>>> same
>>> console.
>>> -porkchop
>>> 
>>> 
>>> On 6/10/09 4:42 PM, "Shine Joseph" <shinejoseph at dodo.com.au> wrote:
>>> 
>>>> Hi,
>>>> 
>>>> A Cisco WLC4402 is configured and working alright. All of the APs
>>>> currently
>>>> are in the same subnet and hence the discovery do not require DHCP
>>>> Option
>>>> 43
>>>> or DNS. I want to add another AP that is in a different. When the AP
>>>> tries to
>>>> register with the WLC, it registers momentarily and un registers.
>>>> This
>>>> has
>>>> happened for eithe DHCP option and DNS discovery.
>>>> 
>>>> I am sure, there is something I have not done to get this working.
>>>> Can
>>>> anyone
>>>> suggest somthing that I should try?
>>>> 
>>>> Thanks in advance,
>>>> 
>>>> Shine
>>>> _______________________________________________
>>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>> 
>>> 
>>> -- 
>>> Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
>>> Your wireless success, nothing less. http://www.tessco.com/
>>> 
>> 
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 

-- 
Michael Kaegler, TESSCO Technologies: Engineering, 410 229 1295
Your wireless success, nothing less. http://www.tessco.com/


From dale.shaw+cisco-nsp at gmail.com  Wed Jun 10 18:25:41 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Thu, 11 Jun 2009 08:25:41 +1000
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
In-Reply-To: <3760B7E1B344364AA0384B231FE7BA6901BBF92B31@ex-be1.ads.wsc.ma.edu>
References: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com>
	<3760B7E1B344364AA0384B231FE7BA6901BBF92B31@ex-be1.ads.wsc.ma.edu>
Message-ID: <3329cbb40906101525g2bf543fdu9ee4a7e74a429a31@mail.gmail.com>

Check the config-register, as Aaron suggests, but also check the SP's
config-register.

#remote command switch show boot

If the RP shows 0x2102 but the SP is something else, that could be the
problem. To fix, go into config mode on the RP and re-enter the 0x2102
config-register, ^Z, then write mem.

Cheers,
Dale

On Thu, Jun 11, 2009 at 3:24 AM, Childs, Aaron<aaron at wsc.ma.edu> wrote:
> ?What's the configuration register set to? (sh boot) once you're in IOS. ?0x0 will bring you to rommon everytime, 0x2102 will boot the sup using the config file.
>
> Aaron
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Renelson Panosky
> Sent: Wednesday, June 10, 2009 12:41 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
>
> I Have a brand new 6509-E with WS-SUP32-GE-3B booting up in rommon> mode i
> was able to type the command boot so it can look for the right code to boot
> up but after i configured the switch i turned off and turned it back on, ?it
> boot up in rommon mode again and everything was lost. ?I know someone had
> upgraded the IOS and i am sure that's what causing the problem and i know
> there is command i can type to fix the problem but i can't remember it or
> find it on the web can someone please help me out with this ?
>
> Renelson

From cayers at ena.com  Wed Jun 10 19:08:06 2009
From: cayers at ena.com (Cory Ayers)
Date: Wed, 10 Jun 2009 18:08:06 -0500
Subject: [c-nsp] need help with 6509-E with WS-SUP32-GE-3B
In-Reply-To: <3329cbb40906101525g2bf543fdu9ee4a7e74a429a31@mail.gmail.com>
References: <16e2ac180906100940p850db43na2c1e7ea8e463184@mail.gmail.com><3760B7E1B344364AA0384B231FE7BA6901BBF92B31@ex-be1.ads.wsc.ma.edu>
	<3329cbb40906101525g2bf543fdu9ee4a7e74a429a31@mail.gmail.com>
Message-ID: <A7B0A9F02975A74A845FE85D0B95B8FA0D4DE305@misex01.ena.com>

> 
> Check the config-register, as Aaron suggests, but also check the SP's
> config-register.
> 
> #remote command switch show boot
> 
> If the RP shows 0x2102 but the SP is something else, that could be the
> problem. To fix, go into config mode on the RP and re-enter the 0x2102
> config-register, ^Z, then write mem.
> 
> Cheers,
> Dale
> 

While looking at show boot, you should also verify the boot variable.
It may be necessary to explicitly specify the image filename.
show boot
BOOT variable =
disk0:c7600s72033-advipservicesk9-mz.122-33.SRC2.bin,1;,1;

show star | i ^boot
boot-start-marker
boot system flash disk0:c7600s72033-advipservicesk9-mz.122-33.SRC2.bin
boot system flash 
boot-end-marker

From rdobbins at arbor.net  Wed Jun 10 21:16:00 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 11 Jun 2009 08:16:00 +0700
Subject: [c-nsp] Nexus V1000 - Feedback?
In-Reply-To: <ABC850B9-F3AB-4249-ABA3-49F7C241F63E@saikonetworks.com>
References: <4A23F37A.60008@spacething.org> <4A2E43A0.2050306@spacething.org>
	<20090609143921.GY290@greenie.muc.de>
	<8E7FB9F5-4AF2-49D1-8DDF-9A95F9F913B5@saikonetworks.com>
	<7B1AB359-3C4C-49C4-B566-54056F489D46@arbor.net>
	<ABC850B9-F3AB-4249-ABA3-49F7C241F63E@saikonetworks.com>
Message-ID: <E2657D70-B26F-48D4-9425-7014EC0D5D13@arbor.net>


On Jun 10, 2009, at 9:32 PM, Maxwell Reid wrote:

> you really only need specialized ASIC's as part of the forwarding  
> plane of high end routers.

When you're talking about DDoS, that's what's needed; general-purpose  
CPUs on boxes running many different VM/OS/app stacks, or things like  
ASAs don't cut it.

That's why you don't see stateful firewalling in front of major public- 
facing properties; not only is it useless by definition in such  
scenarios, in which every single incoming connection is unsolicited,  
but it's a DDoS chokepoint due to the state instantiated and the  
limited resources available.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From jrhett at netconsonance.com  Wed Jun 10 20:58:04 2009
From: jrhett at netconsonance.com (Jo Rhett)
Date: Wed, 10 Jun 2009 17:58:04 -0700
Subject: [c-nsp] full routing table / provider-class chassis
Message-ID: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>

I've been trying to spec Cisco for an upgrade of our Force10 backbone  
for nearly 2 months now.  I'm just trying to clarify which platform  
Cisco recommends for full routing table/hardware forwarding/provider- 
class environments.

Unfortunately every time I get through to the supposed right group, I  
mention our requirements and Cisco never follows up.  It's almost like  
they realize they have nothing on Juniper and they don't even bother.   
They are about to be eliminated from the choices for lack of having an  
answer.

Until they decide to care, is there anyone on here willing to propose  
a basic platform for provider-class environment?  By which I mean

* Full IPv4 & v6 routing table  (Cisco has 760k v4/260k v6 I know with  
SUP720/3CXL)
* ASIC-based line-rate forwarding (SUP720-3CXL and DFC-3CXL on each  
line card, right?)
* 196 ports copper 10/100/1000
* 40 ports SFP 1g  (on two line cards, not one)
* 96+ BGP peers, 8-10 full routing table peers

Unfortunately, Cisco's partners are useless.  They propose 6509s  
without the DFCs, which we know will fall over.   And as I understand  
it, the 6509 even with the 3CXL cards can't handle 5 full peers,  
nevermind 96 total peers.   Most people suggest the 7600 platform, but  
at least two comments on the mailing list indicate it isn't much better.

What are people using today for this kind of environment?  Does it work?

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness




From rdobbins at arbor.net  Wed Jun 10 21:42:49 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 11 Jun 2009 08:42:49 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
Message-ID: <CAAA2EF6-92A2-41E3-8172-9CA9F78EFD96@arbor.net>


On Jun 11, 2009, at 7:58 AM, Jo Rhett wrote:

> What are people using today for this kind of environment?

GSR, ASR 1K, CRS-1 all work quite well.

Avoid 6500/7600 for edge applications due to NetFlow, uRPF, & ACL  
caveats (they're fine in the core).

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From kgraham at industrial-marshmallow.com  Wed Jun 10 21:17:49 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Wed, 10 Jun 2009 18:17:49 -0700 (PDT)
Subject: [c-nsp] Location of 67xx rommon (c2lc-rm) images?
Message-ID: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>


With the new and not so improved software download and documentation
sites, does anyone know where to find rommon images and release notes
for 6500 line cards? RP/SP images are linked under the 6500 download 
pages, but the only DFC-related link is for c6dfc3 (65xx/68xx DFC3,
I believe).

Thanks.


From arup.ab at gmail.com  Wed Jun 10 22:28:16 2009
From: arup.ab at gmail.com (Arup Bhattacharya)
Date: Thu, 11 Jun 2009 07:58:16 +0530
Subject: [c-nsp] need help.....
Message-ID: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>

Why VLAN 0 is not configur in Switch where as starting range of VLAN is 0
and default VLAN is 1.......

-- 
Regards.....
Arup Bhattacharya
GSM-9748238797
-------------------------------------
Success is not final, failure is not fatal: it is the courage to continue
that counts

From achatz at forthnet.gr  Thu Jun 11 00:01:58 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Thu, 11 Jun 2009 07:01:58 +0300
Subject: [c-nsp] Location of 67xx rommon (c2lc-rm) images?
In-Reply-To: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
References: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
Message-ID: <4A3081B6.3040102@forthnet.gr>

Do a search for "c2lc-rm2.srec.122-18r.S1" and you'll find many download locations.

i.e.
http://tools.cisco.com/support/downloads/go/IPCheck.x?defAdv=N&sftAdv=N&filename=c2lc-rm2.srec.122-18r.S1&advUrl=null&defInd=N&mdfid=281569550&sftType=IOS%20ROMMON%20Software&optPlat=&relVer=12.2(18r)S1&md5=cabfe0b596363489047c769baf9dc161&modifmdfid=281569550&imname=null&imst=N&hybrid=Y&modelName=Cisco%20Catalyst%206500%20Series%20Virtual%20Switching%20Supervisor%20Engine%20720%20with%2010GE%20uplinks&treeMdfId=268437717&treeName=Cisco%20Interfaces%20and%20Modules&edesignator=&fsd=&hasfsd=N&nodecount=0


or use the old -classic- one:

http://www.cisco.com/cgi-bin/Software/Tablebuild/doftp.pl?ftpfile=/cisco/lan/catalyst/6000/rommon/c2lc-rm2.srec.122-18r.S1


--
Tassos

Kevin Graham wrote on 11/06/2009 04:17:
> With the new and not so improved software download and documentation
> sites, does anyone know where to find rommon images and release notes
> for 6500 line cards? RP/SP images are linked under the 6500 download 
> pages, but the only DFC-related link is for c6dfc3 (65xx/68xx DFC3,
> I believe).
> 
> Thanks.
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From spinthiras.mario at gmail.com  Thu Jun 11 02:31:15 2009
From: spinthiras.mario at gmail.com (Mario Spinthiras)
Date: Thu, 11 Jun 2009 09:31:15 +0300
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <BLU102-W261A5BC1409B9331812498FA450@phx.gbl>
References: <4A2FD24D.2060703@cantv.net>
	<BLU102-W261A5BC1409B9331812498FA450@phx.gbl>
Message-ID: <4f890e580906102331r10937ac9yfb8859586248f60b@mail.gmail.com>

Haven't had much DSLAM hands on but the Allied Telesis iMAP range is nice.

Regards,
Mario

From baimoung at inet.co.th  Thu Jun 11 02:51:35 2009
From: baimoung at inet.co.th (Charuntorn Baimoung)
Date: Thu, 11 Jun 2009 13:51:35 +0700 (ICT)
Subject: [c-nsp] Finisar SFPs on 6500 and 2960
In-Reply-To: <4A3081B6.3040102@forthnet.gr>
References: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
	<4A3081B6.3040102@forthnet.gr>
Message-ID: <Pine.LNX.4.62.0906111347110.27082@johann.inet.co.th>

     Can anyone ever use Finisar SFPs on connection between 6500 and 2960? 
Both switch compatible with Finisar SFPs.


Thanks


From eng_mssk at hotmail.com  Thu Jun 11 03:21:01 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Thu, 11 Jun 2009 10:21:01 +0300
Subject: [c-nsp] MetroEthernet Switches
Message-ID: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>


Hey all , 
we have ME-C3750-24TE switches
and we are using a product named redline for broadband lesaed lines 
we are using power adapters between the redline and the switch port
if i connect the redline directly to the switch port , am i going to face any failure ???
Input Power
The AN-80i is powered by the PoE power injector available in 90-264 VAC (50/60 Hz) or +/- 18-60 VDC versions.

Thanks in advance,

_________________________________________________________________
Show them the way! Add maps and directions to your party invites. 
http://www.microsoft.com/windows/windowslive/products/events.aspx

From A.L.M.Buxey at lboro.ac.uk  Thu Jun 11 03:54:16 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Thu, 11 Jun 2009 08:54:16 +0100
Subject: [c-nsp] WLC discovery
In-Reply-To: <523AE2E8DAAC4990BDA1EB865ECB8630@au.didata.local>
References: <58C3E1A533144637A09B8082C7489B21@au.didata.local>
	<20090610211131.GA9779@lboro.ac.uk>
	<523AE2E8DAAC4990BDA1EB865ECB8630@au.didata.local>
Message-ID: <20090611075416.GA12785@lboro.ac.uk>

Hi,
> Hi,
>
> There is only one controller and I believe this is the master controller. 
> DO you know, where I could check this?

CLI or web interface. on web interface it should be under controller
menu. CLI is buried somewhere non intuitive ;-)

alan

From elmi at 4ever.de  Thu Jun 11 06:28:31 2009
From: elmi at 4ever.de (Elmar K. Bins)
Date: Thu, 11 Jun 2009 12:28:31 +0200
Subject: [c-nsp] need help.....
In-Reply-To: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>
References: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>
Message-ID: <20090611102831.GS1071@ronin.4ever.de>

arup.ab at gmail.com (Arup Bhattacharya) wrote:

> Why VLAN 0 is not configur in Switch where as starting range of VLAN is 0
> and default VLAN is 1.......

There is no VLAN 0. "0" means "untagged".



From jcovini at free.fr  Thu Jun 11 04:42:26 2009
From: jcovini at free.fr (jcovini at free.fr)
Date: Thu, 11 Jun 2009 10:42:26 +0200
Subject: [c-nsp] need help.....
In-Reply-To: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>
References: <643fa0f40906101928q7bb79ec4r3c568dfc69197c71@mail.gmail.com>
Message-ID: <1244709746.4a30c3725a782@imp.free.fr>

C2950(config)#vlan 0
Command rejected: Bad VLAN list - character #2 (EOL) delimits a VLAN
number (0) out of the range 1..4094.

But go and check the following doc, you will see that VLAN 0 can be used by a
Cisco switch to forward DOT1P-tagged voices frames :

http://www.cisco.com/en/US/docs/switches/lan/catalyst2970/software/release/12.1_19_ea1/configuration/guide/swvoip.html#wp1034347


Selon Arup Bhattacharya <arup.ab at gmail.com>:

> Why VLAN 0 is not configur in Switch where as starting range of VLAN is 0
> and default VLAN is 1.......
>
> --
> Regards.....
> Arup Bhattacharya
> GSM-9748238797
> -------------------------------------
> Success is not final, failure is not fatal: it is the courage to continue
> that counts
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From A.L.M.Buxey at lboro.ac.uk  Thu Jun 11 04:44:29 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Thu, 11 Jun 2009 09:44:29 +0100
Subject: [c-nsp] WLC discovery
In-Reply-To: <C655A454.DB0E%KaeglerM@tessco.com>
References: <49E6C818867140B7A647B639486C81C8@au.didata.local>
	<C655A454.DB0E%KaeglerM@tessco.com>
Message-ID: <20090611084429.GB13857@lboro.ac.uk>

Hi,

> The only other things you can do are check firewalls between subnets (make
> sure both IPs are allowed, etc). You can try a few 'debug [...]' commands on
> the controller, but what you may really need is a ladder.

:-)

the AP joins..and then goes. when you move to l3 mode you rely on
information such as DHCP responses of DNS entries for the AP to
know what controller to talk to...hmm, but the AP does talk to
the controller at some point. AP debugging seems to be the best choice
here - normally the output will be screaming out the issue.

I wonder if its joining, being told about a firmware update...unable
to get that firmware update (via TFTP..cant recall) across the 
L3 link due to ACLs and then either just sitting there pretty or going
through the cycle again?

alan

From avayner at cisco.com  Thu Jun 11 03:56:00 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Thu, 11 Jun 2009 09:56:00 +0200
Subject: [c-nsp] MetroEthernet Switches
In-Reply-To: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>
References: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C48CFB@xmb-ams-331.emea.cisco.com>

Mohammad,

I would assume that the power adaptor is there in order to feed the
AN-80i with power, as the ME-C3750-24TE switches are not PoE enabled. If
you remove it, I guess the AN-80i will not get power, and would not
work...

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Mohammad Khalil
Sent: Thursday, June 11, 2009 10:21
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] MetroEthernet Switches


Hey all , 
we have ME-C3750-24TE switches
and we are using a product named redline for broadband lesaed lines 
we are using power adapters between the redline and the switch port
if i connect the redline directly to the switch port , am i going to
face any failure ???
Input Power
The AN-80i is powered by the PoE power injector available in 90-264 VAC
(50/60 Hz) or +/- 18-60 VDC versions.

Thanks in advance,

_________________________________________________________________
Show them the way! Add maps and directions to your party invites. 
http://www.microsoft.com/windows/windowslive/products/events.aspx
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From vedlabs at gmail.com  Thu Jun 11 06:34:30 2009
From: vedlabs at gmail.com (Ved Labs)
Date: Thu, 11 Jun 2009 16:04:30 +0530
Subject: [c-nsp] MetroEthernet Switches
In-Reply-To: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>
References: <BLU102-W90322A075B68BA8ED7F4CFA420@phx.gbl>
Message-ID: <7db92dcc0906110334r28781be5k4805d3cd41560002@mail.gmail.com>

Will you be using the DC to DC convertor and use the RPS port for the same ,

On Thu, Jun 11, 2009 at 12:51 PM, Mohammad Khalil <eng_mssk at hotmail.com>wrote:

>
> Hey all ,
> we have ME-C3750-24TE switches
> and we are using a product named redline for broadband lesaed lines
> we are using power adapters between the redline and the switch port
> if i connect the redline directly to the switch port , am i going to face
> any failure ???
> Input Power
> The AN-80i is powered by the PoE power injector available in 90-264 VAC
> (50/60 Hz) or +/- 18-60 VDC versions.
>
> Thanks in advance,
>
> _________________________________________________________________
> Show them the way! Add maps and directions to your party invites.
> http://www.microsoft.com/windows/windowslive/products/events.aspx
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From md at bts.sk  Thu Jun 11 06:54:20 2009
From: md at bts.sk (Marian =?utf-8?B?xI51cmtvdmnEjQ==?=)
Date: Thu, 11 Jun 2009 12:54:20 +0200
Subject: [c-nsp] 3750E and X2-10GB-ZR compatibility?
In-Reply-To: <1244641933.7592.25.camel@localhost.localdomain>
References: <1244641933.7592.25.camel@localhost.localdomain>
Message-ID: <20090611105420.GA34090@bts.sk>

On Wed, Jun 10, 2009 at 03:52:13PM +0200, Peter Rathlev wrote:
> Just a quick question: The 3750E doesn't support X2-10GB-ZR
> tranceivers[1], only up to ER. Using "service unsupported-transceiver" I
> can get the switch to recognize the transceiver, but will I be able to
> get a link with it?

There is nothing special about the X2-ZR units, they are fully compliant
with X2 spec, just have longer reach. Lack of "support" means there's no
entry in your IOS for ZR - but it was already added into 12.2(50)SE.

So either upgrade to 12.2(50)SE2 or use service unsupported-transceiver
in your present IOS and everything will work as expected. We're using
them in production with 12.2(44)SE1 for several months already.

   With kind regards,

       M.

From Skeeve at eintellego.net  Thu Jun 11 08:00:16 2009
From: Skeeve at eintellego.net (Skeeve Stevens)
Date: Thu, 11 Jun 2009 22:00:16 +1000
Subject: [c-nsp] Cisco IP Phones and IPv6
Message-ID: <292AF25E62B8894C921B893B53A19D97394469E4CE@BUSINESSEX.business.ad>

Does anyone know if any of the SCCP or SIP images for any of the models of Cisco IP Phones support IPv6?

...Skeeve

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
--
NOC, NOC, who's there?

Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.


From david.freedman at uk.clara.net  Thu Jun 11 09:41:48 2009
From: david.freedman at uk.clara.net (David Freedman)
Date: Thu, 11 Jun 2009 14:41:48 +0100
Subject: [c-nsp] Inter-AS EoMPLS/VPLS
In-Reply-To: <4A2F6A59.2000100@forthnet.gr>
References: <4A2F6A59.2000100@forthnet.gr>
Message-ID: <h0r1is$kdp$1@ger.gmane.org>

If you send labels via BGP for your xconnect endpoints then you can do
it without this feature. (Just like RFC4364 Section 10(C))

It does mean however sending eachother your /32s like you would if you
had mutual IGP , just without the IGP.

Dave.



Tassos Chatzithomaoglou wrote:
> Does anyone have any experience?
> 
> I can see it's supported only on IOS-XR, so 7600 it's out of the
> question (any plans?).
> http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.7/mpls/configuration/guide/gc37v2.html#wp1100339
> 
> 


From jfitz at Princeton.EDU  Thu Jun 11 09:44:14 2009
From: jfitz at Princeton.EDU (Jeff Fitzwater)
Date: Thu, 11 Jun 2009 09:44:14 -0400
Subject: [c-nsp] 3750 running jumbo frames ?
Message-ID: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>

We have the need to run two 3750 switches with jumbo frames (9000),  
for a high performance data transfer application.  Both switches will  
be manages by connections to a NON-JUMBO frame environment.   (That  
is, if this will work)

If I enable jumbo frames (which is a global change) and leave the  
management interface MTU at 1500 so the switch will use 1500 as packet  
size for all management, is there any NEGATIVE ISSUES I should be  
aware because of them being connected to the non-jumbo environment?



Thanks for any help,




Jeff Fitzwater
OIT Network Systems
Princeton University

From alexmoya at bellsouth.net  Thu Jun 11 09:00:04 2009
From: alexmoya at bellsouth.net (Alex Moya)
Date: Thu, 11 Jun 2009 06:00:04 -0700 (PDT)
Subject: [c-nsp] Cisco IP Phones and IPv6
Message-ID: <933154.15438.qm@web180712.mail.sp1.yahoo.com>


I beleave that 8.4 on the 7961 does

Sent from my iPhone

On Jun 11, 2009, at 8:00 AM, Skeeve Stevens <Skeeve at eintellego.net> wrote:

Does anyone know if any of the SCCP or SIP images for any of the models of Cisco IP Phones support IPv6?

...Skeeve

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
--
NOC, NOC, who's there?

Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee
 that attachments are!
 virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From jarruda-cnsp at jarruda.com  Thu Jun 11 09:29:53 2009
From: jarruda-cnsp at jarruda.com (Julio Arruda)
Date: Thu, 11 Jun 2009 09:29:53 -0400
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
References: <4A2FD24D.2060703@cantv.net>
	<78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
Message-ID: <4A3106D1.5010506@jarruda.com>

Arie Vayner (avayner) wrote:
> Juan,
> 
> Cisco does not make DSLAMs for a long time now...
> 

I wonder if there is any Next-Gen DLC that Cisco has been seeing/using 
in customers ?
In a previous life in NT, I remember Calix was quite popular in ANSI/T1 
customers in Caribean market, so, if someone is looking atend-to-end 
solutions, would cisco kit 'fit' better with any specific vendor (IOT 
and etc ?).


> Arie
> 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo
> R.
> Sent: Wednesday, June 10, 2009 18:34
> To: Cisco Post NSP
> Cc: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Cisco DSLAM ?
> 
> Guys
> 
> Does anyone of you knows a good DSLAM for HDSL & ADSL ?
> 
> Thanks
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From jfitz at Princeton.EDU  Thu Jun 11 10:14:11 2009
From: jfitz at Princeton.EDU (Jeff Fitzwater)
Date: Thu, 11 Jun 2009 10:14:11 -0400
Subject: [c-nsp] 3750 running jumbo frames ?
In-Reply-To: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
References: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
Message-ID: <31CE01FD-0D58-4C4D-9152-0C41D2B53673@princeton.edu>

	I forgot to mention that the hosts that will be using jumbo frames,  
will be on a separate VLAN between the two switches.  The concern was  
since the jumbo frame was a global change (all gig ports on 3750), how  
would it impact the other vlan that only has 1500 MTU hosts on.   I  
would assume there isn't any impact for hosts with a 1500 MTU, its  
just that the switch can now pass 9k frames if present.   The switch  
management was the other key issue.


Thanks


Jeff


On Jun 11, 2009, at 9:44 AM, Jeff Fitzwater wrote:

> We have the need to run two 3750 switches with jumbo frames (9000),  
> for a high performance data transfer application.  Both switches  
> will be manages by connections to a NON-JUMBO frame environment.    
> (That is, if this will work)
>
> If I enable jumbo frames (which is a global change) and leave the  
> management interface MTU at 1500 so the switch will use 1500 as  
> packet size for all management, is there any NEGATIVE ISSUES I  
> should be aware because of them being connected to the non-jumbo  
> environment?
>
>
>
> Thanks for any help,
>
>
>
>
> Jeff Fitzwater
> OIT Network Systems
> Princeton University
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From jared at puck.nether.net  Thu Jun 11 10:22:13 2009
From: jared at puck.nether.net (Jared Mauch)
Date: Thu, 11 Jun 2009 10:22:13 -0400
Subject: [c-nsp] Cisco IP Phones and IPv6
In-Reply-To: <933154.15438.qm@web180712.mail.sp1.yahoo.com>
References: <933154.15438.qm@web180712.mail.sp1.yahoo.com>
Message-ID: <3203A896-2BB5-4B6A-8DDE-C00FCE8C87A6@puck.nether.net>

They do, but require DHCPv6 to be configured.

- Jared

On Jun 11, 2009, at 9:00 AM, Alex Moya wrote:

>
> I beleave that 8.4 on the 7961 does
>
> Sent from my iPhone
>
> On Jun 11, 2009, at 8:00 AM, Skeeve Stevens <Skeeve at eintellego.net>  
> wrote:
>
> Does anyone know if any of the SCCP or SIP images for any of the  
> models of Cisco IP Phones support IPv6?
>
> ...Skeeve
>
> --
> Skeeve Stevens, CEO/Technical Director
> eintellego Pty Ltd - The Networking Specialists
> skeeve at eintellego.net / www.eintellego.net
> Phone: 1300 753 383, Fax: (+612) 8572 9954
> Cell +61 (0)414 753 383 / skype://skeeve
> --
> NOC, NOC, who's there?
>
> Disclaimer: Limits of Liability and Disclaimer: This message is for  
> the named person's use only. It may contain sensitive and private  
> proprietary or legally privileged information. You must not,  
> directly or indirectly, use, disclose, distribute, print, or copy  
> any part of this message if you are not the intended recipient.  
> eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd  
> group of companies reserve the right to monitor all e-mail  
> communications through its networks.  Any views expressed in this  
> message are those of the individual sender, except where the message  
> states otherwise and the sender is authorised to state them to be  
> the views of any such entity. Any reference to costs, fee  
> quotations, contractual transactions and variations to contract  
> terms is subject to separate confirmation in writing signed by an  
> authorised representative of eintellego. Whilst all efforts are made  
> to safeguard inbound and outbound e-mails, we cannot guarantee
> that attachments are!
> virus-free or compatible with your systems and do not accept any  
> liability in respect of viruses or computer problems experienced.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From bacon at walleyesoftware.com  Thu Jun 11 10:22:22 2009
From: bacon at walleyesoftware.com (Jeff Bacon)
Date: Thu, 11 Jun 2009 09:22:22 -0500
Subject: [c-nsp] full routing table / provider-class chassis (Roland
	Dobbins)
In-Reply-To: <mailman.7.1244716142.2683.cisco-nsp@puck.nether.net>
References: <mailman.7.1244716142.2683.cisco-nsp@puck.nether.net>
Message-ID: <5A69C25361FED34F83ABF05F5047524505CD8001@wally.walleyetrading.net>

> On Jun 11, 2009, at 7:58 AM, Jo Rhett wrote:
> 
> > What are people using today for this kind of environment?
> 
> GSR, ASR 1K, CRS-1 all work quite well.
> 
> Avoid 6500/7600 for edge applications due to NetFlow, uRPF, & ACL
> caveats (they're fine in the core).

Is there a good list of these caveats somewhere I can look at? 

Thanks
-bacon


From gert at greenie.muc.de  Thu Jun 11 09:41:24 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Thu, 11 Jun 2009 15:41:24 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
Message-ID: <20090611134124.GO290@greenie.muc.de>

Hi,

On Wed, Jun 10, 2009 at 05:58:04PM -0700, Jo Rhett wrote:
> Unfortunately, Cisco's partners are useless.  They propose 6509s  
> without the DFCs, which we know will fall over.   

Whether or not you need DFCs really depends on the throughput on the
box, and the features used.  DFCs are good due to local switching (less
load on the Sup and the fabrich) and because they do local netflow - but
if the aggregate throughput is lower than what the Supervisor('s hardware
forwarding engine) can handle, a DFC will not be mandatory.

Some of our peering/uplink routers have DFCs, others have not, and with
the load we have (peak traffic ~ 4-5 Gbit/s on those boxes) the DFCs are
not yet really needed.

> And as I understand  
> it, the 6509 even with the 3CXL cards can't handle 5 full peers,  

"XL" or "non-XL" has nothing to do with the number of *peers*.

"XL" decides on the number of prefixes that you can have in your 
forwarding table (hardware FIB) - and this will be about the same 
for "1 peer with a full BGP Table" or "20 peers with the same set of
prefixes but just different BGP paths".

A higher number of different "full table "peers is going to eat up CPU 
memory and CPU power - memory is easy (Sup720-3CXL comes with 1Gbyte
RAM, which is sufficient for at least 10 "full table" BGP peers), but
CPU might reach its limit with 5 full table peers and 91 others.

Our most loaded box has 2 full table eBGP peerings + iBGP full mesh + 
~30 smaller eBGP peerings, and the CPU load is usually well below 10% -
so it might work or it might not.


> nevermind 96 total peers.   Most people suggest the 7600 platform, but  
> at least two comments on the mailing list indicate it isn't much better.

For the 7600, there is the RSP720 supervisor board, which has a faster
CPU, so it should scale better with the number


> What are people using today for this kind of environment?  Does it work?

We use 6500s with Sup720-10G (-3CXL) and Sup720-3B, and we're quite happy
with them.  The platform has its limits (shared VLAN space being the 
most significant for many folks), but compared to a "real router" (CRS-1)
the main advantage is that it's dirt cheap.

For us, questions like "does our 'router box' need to have large line
card memory to do nice QoS things in case our backbone lines fill up?"
(which is one of the big differences between LAN hardware and ES/CRS
cards) translates to "for the price difference, we can just double or
triple the raw capacity of our backbone, thus having no congestion, 
thus needing no QoS"...

(Yes, caveats apply.  With LAN hardware, you always have issues with
microbursts and buffering.  But ES/CRS - or Juniper - hardware is LOTS 
of extra money.)

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/8d77bc9f/attachment.bin>

From pr at isprime.com  Thu Jun 11 09:41:28 2009
From: pr at isprime.com (Phil Rosenthal)
Date: Thu, 11 Jun 2009 09:41:28 -0400
Subject: [c-nsp] BGP Default announcement disappearing
Message-ID: <E41D4325-8F74-4E7C-8C8A-7464B1530847@isprime.com>

Hi all,

I know we've seen this bug now for several years, and I've given up  
hope for cisco ever fixing it.

We're now running SRD on a Sup720.

For those of you who haven't seen the bug before, it goes something  
like this:

1) Everything is working fine, you have your router in a full mesh in  
your network, seeing several full tables from various sources,  
including (at least) one directly connected full transit provider  
announcing a full table (or at least some peer with a very large  
number of routes).  You are announcing default (0.0.0.0/0) to several  
customer peers via BGP.
2) Transit provider (or peer with large number of routes) flaps a  
couple of times in rapid succession
3) A small number of default-only customer peers will see the default  
route get withdrawn, but most will continue as normal
4) Any default-only customer peer that flaps after this point will  
either not learn the default route, or will see it announced and then  
withdrawn immediately afterwards.

Sessions that are like this (supposed to be receiving default, but  
not), still show up just fine in a show ip bgp nei x.x.x routes  
command, eg:
BGP table version is 20510920, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i -  
internal,
               r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Originating default network 0.0.0.0

    Network          Next Hop            Metric LocPrf Weight Path

Total number of prefixes 0


Does anyone know of a way to get the router to once again announce  
0.0.0.0/0 without a reload?
I've tried removing the null0 route for 0/0 and re-adding it, as well  
as completely unconfiguring the sessions that should learn default and  
re-adding them, neither has worked.

Thanks,
-Phil

From dcp at dcptech.com  Thu Jun 11 10:53:50 2009
From: dcp at dcptech.com (David Prall)
Date: Thu, 11 Jun 2009 10:53:50 -0400
Subject: [c-nsp] 3750 running jumbo frames ?
In-Reply-To: <31CE01FD-0D58-4C4D-9152-0C41D2B53673@princeton.edu>
References: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
	<31CE01FD-0D58-4C4D-9152-0C41D2B53673@princeton.edu>
Message-ID: <005f01c9eaa4$8145c820$83d15860$@com>

The 3750 and 3560 can only pass L2 jumbos. They are limited to a frame size
of 1998 for routed packets.

http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration
_example09186a008010edab.shtml#c3

David

--
http://dcp.dcptech.com
 

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Jeff Fitzwater
> Sent: Thursday, June 11, 2009 10:14 AM
> To: Jeff Fitzwater
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] 3750 running jumbo frames ?
> 
> 	I forgot to mention that the hosts that will be using jumbo
> frames,
> will be on a separate VLAN between the two switches.  The concern was
> since the jumbo frame was a global change (all gig ports on 3750), how
> would it impact the other vlan that only has 1500 MTU hosts on.   I
> would assume there isn't any impact for hosts with a 1500 MTU, its
> just that the switch can now pass 9k frames if present.   The switch
> management was the other key issue.
> 
> 
> Thanks
> 
> 
> Jeff
> 
> 
> On Jun 11, 2009, at 9:44 AM, Jeff Fitzwater wrote:
> 
> > We have the need to run two 3750 switches with jumbo frames (9000),
> > for a high performance data transfer application.  Both switches
> > will be manages by connections to a NON-JUMBO frame environment.
> > (That is, if this will work)
> >
> > If I enable jumbo frames (which is a global change) and leave the
> > management interface MTU at 1500 so the switch will use 1500 as
> > packet size for all management, is there any NEGATIVE ISSUES I
> > should be aware because of them being connected to the non-jumbo
> > environment?
> >
> >
> >
> > Thanks for any help,
> >
> >
> >
> >
> > Jeff Fitzwater
> > OIT Network Systems
> > Princeton University
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From Ian.Mackinnon at lumison.net  Thu Jun 11 10:57:11 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Thu, 11 Jun 2009 15:57:11 +0100
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090611134124.GO290@greenie.muc.de>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>

Hi Gert,

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Gert Doering
> Sent: 11 June 2009 14:41
> To: Jo Rhett
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp

<SNIP>

> "XL" or "non-XL" has nothing to do with the number of *peers*.
>
> "XL" decides on the number of prefixes that you can have in your
> forwarding table (hardware FIB) - and this will be about the same for
> "1 peer with a full BGP Table" or "20 peers with the same set of
> prefixes but just different BGP paths".
>
> A higher number of different "full table "peers is going to eat up CPU
> memory and CPU power - memory is easy (Sup720-3CXL comes with 1Gbyte
> RAM, which is sufficient for at least 10 "full table" BGP peers), but
> CPU might reach its limit with 5 full table peers and 91 others.



I was the under the impression that the limit on these boxes (and ASR1002 R1) was approx 1 Million routes.
I had assumed that was the total number of routes from all your peers, eg we see about 280k routes in a full table, so that would be approx 4 full tables.
Are you saying that the limit on the number of routes, is actually in the FIB, ie active routes, so currently would always be about 280k, and multiple full tables is OK.


--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From mhuff at ox.com  Thu Jun 11 10:38:44 2009
From: mhuff at ox.com (Matthew Huff)
Date: Thu, 11 Jun 2009 10:38:44 -0400
Subject: [c-nsp] [c-nap] Location of 67xx rommon (c2lc-rm) images?
In-Reply-To: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
References: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C3811FD2A8@PUR-EXCH07.ox.com>

It's hidden.

We ran into the same thing. 

Look under the LAN Switches section, for switches, 6509, then the 6500
Virtual Switching Supervisor 720, IOS Rommmon. 

It's only there, and it's the same for DFC with regular sup 720. We found
this out from a TAC case.



----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Kevin Graham
> Sent: Wednesday, June 10, 2009 9:18 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Location of 67xx rommon (c2lc-rm) images?
> 
> 
> With the new and not so improved software download and documentation
> sites, does anyone know where to find rommon images and release notes
> for 6500 line cards? RP/SP images are linked under the 6500 download
> pages, but the only DFC-related link is for c6dfc3 (65xx/68xx DFC3,
> I believe).
> 
> Thanks.
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/3ad8a922/attachment-0001.bin>

From gert at greenie.muc.de  Thu Jun 11 11:17:01 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Thu, 11 Jun 2009 17:17:01 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
	<B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
Message-ID: <20090611151701.GQ290@greenie.muc.de>

Hi,

On Thu, Jun 11, 2009 at 03:57:11PM +0100, Ian MacKinnon wrote:
> > "XL" or "non-XL" has nothing to do with the number of *peers*.
> >
> > "XL" decides on the number of prefixes that you can have in your
> > forwarding table (hardware FIB) - and this will be about the same for
> > "1 peer with a full BGP Table" or "20 peers with the same set of
> > prefixes but just different BGP paths".
> >
> > A higher number of different "full table "peers is going to eat up CPU
> > memory and CPU power - memory is easy (Sup720-3CXL comes with 1Gbyte
> > RAM, which is sufficient for at least 10 "full table" BGP peers), but
> > CPU might reach its limit with 5 full table peers and 91 others.
> 
> I was the under the impression that the limit on these boxes 
> (and ASR1002 R1) was approx 1 Million routes.

True.  *FIB space* routes.

> I had assumed that was the total number of routes from all your peers, 
> eg we see about 280k routes in a full table, 

Correct.

> so that would be approx 4 full tables.

No.

1 full table has 280k routes.

100 full tables have 280k routes as well. (But LOTS of additional BGP path
information - but those are not stored in the FIB, and don't count for 
the "1 million" limit).

> Are you saying that the limit on the number of routes, is actually in 
> the FIB, ie active routes, so currently would always be about 280k, and 
> multiple full tables is OK.

BGP paths that don't go to the FIB are not "routes".  They are just prefixes
with path info.

(In other words: yes).

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/81db1f0b/attachment.bin>

From Ian.Mackinnon at lumison.net  Thu Jun 11 11:18:44 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Thu, 11 Jun 2009 16:18:44 +0100
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090611151701.GQ290@greenie.muc.de>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
	<B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
	<20090611151701.GQ290@greenie.muc.de>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D9444EEC@nbg01-exch-01.entlstaff.domain.lumison.net>

Thanks Gert, excellent answer.

> -----Original Message-----
> From: Gert Doering [mailto:gert at greenie.muc.de]
> Sent: 11 June 2009 16:17
> To: Ian MacKinnon
> Cc: Gert Doering; Jo Rhett; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] full routing table / provider-class chassis
>
> Hi,
>
> On Thu, Jun 11, 2009 at 03:57:11PM +0100, Ian MacKinnon wrote:
> > > "XL" or "non-XL" has nothing to do with the number of *peers*.
> > >
> > > "XL" decides on the number of prefixes that you can have in your
> > > forwarding table (hardware FIB) - and this will be about the same
> > > for
> > > "1 peer with a full BGP Table" or "20 peers with the same set of
> > > prefixes but just different BGP paths".
> > >
> > > A higher number of different "full table "peers is going to eat up
> > > CPU memory and CPU power - memory is easy (Sup720-3CXL comes with
> > > 1Gbyte RAM, which is sufficient for at least 10 "full table" BGP
> > > peers), but CPU might reach its limit with 5 full table peers and
> 91 others.
> >
> > I was the under the impression that the limit on these boxes (and
> > ASR1002 R1) was approx 1 Million routes.
>
> True.  *FIB space* routes.
>
> > I had assumed that was the total number of routes from all your
> peers,
> > eg we see about 280k routes in a full table,
>
> Correct.
>
> > so that would be approx 4 full tables.
>
> No.
>
> 1 full table has 280k routes.
>
> 100 full tables have 280k routes as well. (But LOTS of additional BGP
> path information - but those are not stored in the FIB, and don't count
> for the "1 million" limit).
>
> > Are you saying that the limit on the number of routes, is actually in
> > the FIB, ie active routes, so currently would always be about 280k,
> > and multiple full tables is OK.
>
> BGP paths that don't go to the FIB are not "routes".  They are just
> prefixes with path info.
>
> (In other words: yes).
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>
> //www.muc.de/~gert/
> Gert Doering - Munich, Germany
> gert at greenie.muc.de
> fax: +49-89-35655025                        gert at net.informatik.tu-
> muenchen.de

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From gert at greenie.muc.de  Thu Jun 11 11:23:10 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Thu, 11 Jun 2009 17:23:10 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090611151701.GQ290@greenie.muc.de>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
	<B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
	<20090611151701.GQ290@greenie.muc.de>
Message-ID: <20090611152310.GR290@greenie.muc.de>

Hi,

On Thu, Jun 11, 2009 at 05:17:01PM +0200, Gert Doering wrote:
> > Are you saying that the limit on the number of routes, is actually in 
> > the FIB, ie active routes, so currently would always be about 280k, and 
> > multiple full tables is OK.
> 
> BGP paths that don't go to the FIB are not "routes".  They are just prefixes
> with path info.
> 
> (In other words: yes).

To clarify: this is the way *Cisco* does it.  Information gets collected
inside routing processes, routing processes (here: BGP) select a "winner"
amoing all candidates (= 1 route out of many BGP paths), and the result
goes to the FIB (if it's the protocol with the best preference).

As far as I understand, Juniper handles this a bit different, with no
separate tables for "inside BGP" stuff, so things might look different
there.

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/98b465e6/attachment.bin>

From A.L.M.Buxey at lboro.ac.uk  Thu Jun 11 12:03:18 2009
From: A.L.M.Buxey at lboro.ac.uk (A.L.M.Buxey at lboro.ac.uk)
Date: Thu, 11 Jun 2009 17:03:18 +0100
Subject: [c-nsp] Cisco IP Phones and IPv6
In-Reply-To: <933154.15438.qm@web180712.mail.sp1.yahoo.com>
References: <933154.15438.qm@web180712.mail.sp1.yahoo.com>
Message-ID: <20090611160318.GA14721@lboro.ac.uk>

Hi,
> 
> I beleave that 8.4 on the 7961 does
> 
> Sent from my iPhone
> 
> On Jun 11, 2009, at 8:00 AM, Skeeve Stevens <Skeeve at eintellego.net> wrote:
> 
> Does anyone know if any of the SCCP or SIP images for any of the models of Cisco IP Phones support IPv6?

8.4.2S show it ghosted out on the network info page...i think 
we're just one version short - cant recall if its the firmware
or the CUCM we need to deal with....its certainly coming!

alan

From rdobbins at arbor.net  Thu Jun 11 12:07:47 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 11 Jun 2009 23:07:47 +0700
Subject: [c-nsp] full routing table / provider-class chassis (Roland
	Dobbins)
In-Reply-To: <5A69C25361FED34F83ABF05F5047524505CD8001@wally.walleyetrading.net>
References: <mailman.7.1244716142.2683.cisco-nsp@puck.nether.net>
	<5A69C25361FED34F83ABF05F5047524505CD8001@wally.walleyetrading.net>
Message-ID: <7813E55B-4111-4B52-A1A5-34337B7CE8DD@arbor.net>


On Jun 11, 2009, at 9:22 PM, Jeff Bacon wrote:

> Is there a good list of these caveats somewhere I can look at?

NetFlow:

256K mls tables at 93% efficiency (~233K entries).

No packet-sampled control of flow creation can lead to mls table  
overflow & non-deterministic skewing of stats/heuristics; small mls  
table size contributes to this in environments with diverse traffic  
patterns and/or high pps, such as SP edge.  NetFlow 'sampling' on  
6500/7600 is actually NDE output telemetry sampling only, not the same  
as packet-sampled control of flow creation on software platforms, GSR,  
ASR 1K, CRS-1, N7K.

No logical OR of TCP flags observed throughout a TCP flow, only the  
last flag.

No dropped traffic stats/heuristics.

ACLs:

ACLs must be carefully crafted to avoid LOU exhaustion & subsequent  
software switching self-DoS:

<https://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00800c9470.shtml#wp43500 
 >

uRPF:

uRPF mode must be the same for all interfaces in a chassis.

Note that these are all edge features.  These boxes are fine running  
in the core and/or other areas in which these particular edge features  
aren't required; it's the edge which can be problematic.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From cmadams at hiwaay.net  Thu Jun 11 12:13:05 2009
From: cmadams at hiwaay.net (Chris Adams)
Date: Thu, 11 Jun 2009 11:13:05 -0500
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090611152310.GR290@greenie.muc.de>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<20090611134124.GO290@greenie.muc.de>
	<B5F945E48C137C49A98BC86DD35939C012D9444EDE@nbg01-exch-01.entlstaff.domain.lumison.net>
	<20090611151701.GQ290@greenie.muc.de>
	<20090611152310.GR290@greenie.muc.de>
Message-ID: <20090611161305.GC1185296@hiwaay.net>

Once upon a time, Gert Doering <gert at greenie.muc.de> said:
> As far as I understand, Juniper handles this a bit different, with no
> separate tables for "inside BGP" stuff, so things might look different
> there.

Juniper JUNOS keeps all routes (static, OSPF, BGP, etc.) in the "route
table" in the routing engine (where the protocols run), and exports the
best routes to the "forwarding table" in the forwarding engine (where
the packets are forwarded).  The forwarding table in a router with full
Internet BGP routes currently has ~282K routes, while the route table
has ~282K times however many full-route peers you have (plus internal
routes in both cases).

The route table has all the routes (from all sources and peers) known to
the router, but routing engine RAM is (relatively) cheap since the RE is
basically just a PC running FreeBSD.  I'm not sure off the top of my
head how much additional RAM is used per full-route peer.

-- 
Chris Adams <cmadams at hiwaay.net>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.

From Jeff.Wojciechowski at midlandpaper.com  Thu Jun 11 12:37:42 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Thu, 11 Jun 2009 11:37:42 -0500
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>

Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
  Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
        Full-Duplex, 100 Mbps
        Description: LAN/STATE Failover Interface
        MAC address 0024.14d3.7b37, MTU 1500
        IP address x.x.x.x, subnet mask 255.255.255.0
        558 packets input, 49468 bytes, 0 no buffer
        Received 3 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        499 packets output, 71296 bytes, 0 underruns
        0 output errors, 0 collisions, 9 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        input queue (curr/max packets): hardware (0/25) software (0/0)
        output queue (curr/max packets): hardware (0/0) software (0/0)
  Traffic Statistics for "failover":
        558 packets input, 39264 bytes
        502 packets output, 59800 bytes
        0 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff

From mhuff at ox.com  Thu Jun 11 13:04:26 2009
From: mhuff at ox.com (Matthew Huff)
Date: Thu, 11 Jun 2009 13:04:26 -0400
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C3811FD2C3@PUR-EXCH07.ox.com>

Try connecting to the serial port on both boxes and setting the name on
both, and then retrying the sync.

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
> Sent: Thursday, June 11, 2009 12:38 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ASA 5510 Configuration Replication Failure
> 
> Dearest List:
> 
> We are building a new active/standby ASA cluster with 5510's and the
> initial config synch went just fine.
> 
> However, when we changed the hostname on the primary unit and did a
> 'write standby' I got the following:
> 
> VaultASA(config)# wr stan
> Building configuration...
> [OK]
> VaultASA(config)# Beginning configuration replication: Sending to mate.
> Failover LAN Failed
> Configuration Replication Failure
> sh ver
> 
> Cisco Adaptive Security Appliance Software Version 8.0(3)
> Device Manager Version 6.1(5)
> 
> Another interesting point about this is that both units show the synch
> interface (E0/3 on both units in our case) show line protocol down.
> 
> VaultASA(config)# sh int e0/3
> Interface Ethernet0/3 "failover", is down, line protocol is down
>   Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
>         Full-Duplex, 100 Mbps
>         Description: LAN/STATE Failover Interface
>         MAC address 0024.14d3.7b37, MTU 1500
>         IP address x.x.x.x, subnet mask 255.255.255.0
>         558 packets input, 49468 bytes, 0 no buffer
>         Received 3 broadcasts, 0 runts, 0 giants
>         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
>         0 L2 decode drops
>         499 packets output, 71296 bytes, 0 underruns
>         0 output errors, 0 collisions, 9 interface resets
>         0 babbles, 0 late collisions, 0 deferred
>         0 lost carrier, 0 no carrier
>         input queue (curr/max packets): hardware (0/25) software (0/0)
>         output queue (curr/max packets): hardware (0/0) software (0/0)
>   Traffic Statistics for "failover":
>         558 packets input, 39264 bytes
>         502 packets output, 59800 bytes
>         0 packets dropped
>       1 minute input rate 0 pkts/sec,  0 bytes/sec
>       1 minute output rate 0 pkts/sec,  0 bytes/sec
>       1 minute drop rate, 0 pkts/sec
>       5 minute input rate 0 pkts/sec,  0 bytes/sec
>       5 minute output rate 0 pkts/sec,  0 bytes/sec
>       5 minute drop rate, 0 pkts/sec
> VaultASA(config)#
> 
> Ideas?
> 
> Thanks in advance.
> 
> Jeff
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/3fd2bdad/attachment.bin>

From peter at rathlev.dk  Thu Jun 11 13:04:03 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 11 Jun 2009 19:04:03 +0200
Subject: [c-nsp] 3750E and X2-10GB-ZR compatibility?
In-Reply-To: <20090611105420.GA34090@bts.sk>
References: <1244641933.7592.25.camel@localhost.localdomain>
	<20090611105420.GA34090@bts.sk>
Message-ID: <1244739843.3383.1.camel@localhost.localdomain>

Hi Marian,

On Thu, 2009-06-11 at 12:54 +0200, Marian ?urkovi? wrote:
> There is nothing special about the X2-ZR units, they are fully compliant
> with X2 spec, just have longer reach. Lack of "support" means there's no
> entry in your IOS for ZR - but it was already added into 12.2(50)SE.

Thank you very much for poiting this out, after loading 12.2(50)SE2 it
was recognized fine. :-)

Regards,
Peter



From peter at rathlev.dk  Thu Jun 11 13:13:09 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 11 Jun 2009 19:13:09 +0200
Subject: [c-nsp] 3750 running jumbo frames ?
In-Reply-To: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
References: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
Message-ID: <1244740389.3383.6.camel@localhost.localdomain>

On Thu, 2009-06-11 at 09:44 -0400, Jeff Fitzwater wrote:
> We have the need to run two 3750 switches with jumbo frames (9000),  
> for a high performance data transfer application.  Both switches will  
> be manages by connections to a NON-JUMBO frame environment.   (That  
> is, if this will work)
> 
> If I enable jumbo frames (which is a global change) and leave the  
> management interface MTU at 1500 so the switch will use 1500 as packet  
> size for all management, is there any NEGATIVE ISSUES I should be  
> aware because of them being connected to the non-jumbo environment?

This will not present problems. As David mentions only L2 switched
frames can be jumbo. Management-traffic wouldn't exceed the routing MTU,
which is 1500 bytes by default. Changing the "system jumbo mtu" doesn't
change the L3 MTU.

Any TCP based L3 connection would use the lowest of the two endpoint
MSSs anyway, so hosts connecting from 1500 byte MTU segments would
always end up using 1500 byte MTU connections. Even if you could adjust
routing MTU to 9000 bytes you probably wouldn't face any problems.

IMHO there would never be any negative effects from enabling 9000 bytes
MTU, unless of course you explicitely WANT to limit the MTU.

Regards,
Peter



From kloch at kl.net  Thu Jun 11 12:40:50 2009
From: kloch at kl.net (Kevin Loch)
Date: Thu, 11 Jun 2009 12:40:50 -0400
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
Message-ID: <4A313392.60604@kl.net>

Jo Rhett wrote:
> I've been trying to spec Cisco for an upgrade of our Force10 backbone 
> for nearly 2 months now.  I'm just trying to clarify which platform 
> Cisco recommends for full routing table/hardware 
> forwarding/provider-class environments.
> 
> Unfortunately every time I get through to the supposed right group, I 
> mention our requirements and Cisco never follows up.  It's almost like 
> they realize they have nothing on Juniper and they don't even bother.  
> They are about to be eliminated from the choices for lack of having an 
> answer.
> 
> Until they decide to care, is there anyone on here willing to propose a 
> basic platform for provider-class environment?  By which I mean
> 
> * Full IPv4 & v6 routing table  (Cisco has 760k v4/260k v6 I know with 
> SUP720/3CXL)
> * ASIC-based line-rate forwarding (SUP720-3CXL and DFC-3CXL on each line 
> card, right?)
> * 196 ports copper 10/100/1000
> * 40 ports SFP 1g  (on two line cards, not one)
> * 96+ BGP peers, 8-10 full routing table peers
> 
> Unfortunately, Cisco's partners are useless.  They propose 6509s without 
> the DFCs, which we know will fall over.  

Well that depends...

The DFC's only do next-hop (tcam) lookups and netflow.  All packets are
switched on the centralized PFC.  Each line card has two 20Gbit/s
fabric channels (2x 40Gbit/s full duplex) to the PFC.  The PFC also has
tcam for lookups and netflow to service any cards that do not have
a DFC.

The PFC is rated at something like 30Mpps so if you are doing less
than that and you don't need the extra netflow tcam you don't
need any DFC's and can still theoretically do 640Gbit/s (320Gbit/s
for those of us to have highly unbalanced traffic flows).

Netflow is subsampled on this platform.  I have been able to get
pretty good estimates of traffic flow (checked against SNMP counters)
but I would not use that for any kind of accounting.  The
SNMP counters are fairly noisy due to the several second update
intervals.  SNMP counters on vlans are even worse and loop
over after a few gbit/s even though the coutners themselves
are 64bit.  You may find using smaller switches (like 3560)
for most customer ports and using 10Gig uplinks is better
than using copper ports on the 6500/7600.

I would avoid the sup720, the rsp720 has 2x the ram and more
than 2x the cpu power.  cpu on the sup720 is by far it's biggest
limitation.



> And as I understand it, the 
> 6509 even with the 3CXL cards can't handle 5 full peers, nevermind 96 
> total peers.   Most people suggest the 7600 platform, but at least two 
> comments on the mailing list indicate it isn't much better.
> 
> What are people using today for this kind of environment?  Does it work?
> 


From lukasz at bromirski.net  Thu Jun 11 13:40:32 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Thu, 11 Jun 2009 19:40:32 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A313392.60604@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net>
Message-ID: <4A314190.8050907@bromirski.net>

On 2009-06-11 18:40, Kevin Loch wrote:

You've got something messed up Kevin:

> The DFC's only do next-hop (tcam) lookups and netflow.

DFCs are doing all and exactly the same work as PFC on
Supervisors locally on the LC that they are installed to.
They're the same in terms of hardware, just in a
different form - to fit the LC, not the Sup.

 > All packets are switched on the centralized PFC.

If the LC has a DFC, packet is switched by DFC toward
destination - if it's on the same card, it's switched locally
(until, of course, you seem to have 6748/6704/6708/6716 where
the card is divided into two).

If the LC doesn't have a DFC but CFC only, the traffic is
switched by PFC.

 > Each line card has two 20Gbit/s fabric channels
 > (2x 40Gbit/s full duplex) to the PFC.

Each 67xx series LC can have one or two 20Gbit/s channel
connections to switch fabric located at Supervisor. Switch
Fabric ASICs and PFCs are not the same thing.

65xx LCs have one or two 8Gbit/s connections to the switch fabric
and different DFCs models, but the switch fabric of Sup720/RSP720
can autonegotiate 8/20 Gbit/s upon insertion into chassis/boot.

> The PFC is rated at something like 30Mpps so if you are doing less
> than that and you don't need the extra netflow tcam you don't
> need any DFC's and can still theoretically do 640Gbit/s (320Gbit/s
> for those of us to have highly unbalanced traffic flows).

PFC is 30Mpps, DFCs for 67xx LCs can do 48Mpps.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From bacon at walleyesoftware.com  Thu Jun 11 14:00:52 2009
From: bacon at walleyesoftware.com (Jeff Bacon)
Date: Thu, 11 Jun 2009 13:00:52 -0500
Subject: [c-nsp] cisco-nsp Digest, Vol 79, Issue 37
In-Reply-To: <mailman.33.1244733169.2683.cisco-nsp@puck.nether.net>
References: <mailman.33.1244733169.2683.cisco-nsp@puck.nether.net>
Message-ID: <5A69C25361FED34F83ABF05F5047524505CD8011@wally.walleyetrading.net>

> 
> Message: 4
> Date: Thu, 11 Jun 2009 15:41:24 +0200
> From: Gert Doering <gert at greenie.muc.de>
> To: Jo Rhett <jrhett at netconsonance.com>
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] full routing table / provider-class chassis
> Message-ID: <20090611134124.GO290 at greenie.muc.de>
> Content-Type: text/plain; charset="us-ascii"
> 
> 
> (Yes, caveats apply.  With LAN hardware, you always have issues with
> microbursts and buffering.  But ES/CRS - or Juniper - hardware is LOTS
> of extra money.)
> 
> gert
> 

So is there a good way to watch/track microbursts? I don't care if it
buffers, but in our environment (lot of market data) we suffer from 
a) regular microbursts (micro meaning in the 1s or less timeframe)
b) no really good way to measure or capture them short of putting packet
sniffers on lines and sorting through packet dumps ex-post-facto. 

We're using 6500/720-3BXL hardware but could buy other hardware (though
I imagine that's not the problem). Traffic comes in over gig fiber or
various metro-e, NYC metro area. 

Our general answer is "throw more bandwidth at the problem" - which is
fine; the problem is knowing _when_ we need to, short of finding out
from end-users. 

-bacon


From rwest at zyedge.com  Thu Jun 11 14:16:16 2009
From: rwest at zyedge.com (Ryan West)
Date: Thu, 11 Jun 2009 14:16:16 -0400
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>

Jeff,

It's hard to tell exactly what happened based on your post, can you do a 'show failover'?  When the ASA's are paired, you should only need to do a wr to save config on both.  Try erasing the config on the backup ASA, regenerate your RSA key with your new hostname (on the primary), re-enter the failover commands (on the standby) and see if it sync's up again.  You should consider moving away from 8.0(3), there a number of publicized security risks with it.  The interim releases should have much fewer bugs as well.

As for the failover interface, are you using a crossover or does it connect to a switch?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
Sent: Thursday, June 11, 2009 12:38 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ASA 5510 Configuration Replication Failure

Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
  Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
        Full-Duplex, 100 Mbps
        Description: LAN/STATE Failover Interface
        MAC address 0024.14d3.7b37, MTU 1500
        IP address x.x.x.x, subnet mask 255.255.255.0
        558 packets input, 49468 bytes, 0 no buffer
        Received 3 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        499 packets output, 71296 bytes, 0 underruns
        0 output errors, 0 collisions, 9 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        input queue (curr/max packets): hardware (0/25) software (0/0)
        output queue (curr/max packets): hardware (0/0) software (0/0)
  Traffic Statistics for "failover":
        558 packets input, 39264 bytes
        502 packets output, 59800 bytes
        0 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From randy_94108 at yahoo.com  Thu Jun 11 13:39:43 2009
From: randy_94108 at yahoo.com (Randy)
Date: Thu, 11 Jun 2009 10:39:43 -0700 (PDT)
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
Message-ID: <755887.26624.qm@web80506.mail.mud.yahoo.com>

was the appliance actually *the active unit* when you made the change?
despite the replication failure, you should still be able to connect to both appliances and see what they think their host names are. Make sure it is the same.
?
make sure you have the following entries in the config:
in active:
?
conf t
standby lan unit primary
hostname state(this will display the state of the unit at the prompt - hostname/act and hostname/stdby)
?
in standby:
conf t
standby lan unit secondary
hostname state
?
Regards
?


--- On Thu, 6/11/09, Jeff Wojciechowski <Jeff.Wojciechowski at midlandpaper.com> wrote:


From: Jeff Wojciechowski <Jeff.Wojciechowski at midlandpaper.com>
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
To: "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>
Date: Thursday, June 11, 2009, 9:37 AM


Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
? Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
? ? ? ? Full-Duplex, 100 Mbps
? ? ? ? Description: LAN/STATE Failover Interface
? ? ? ? MAC address 0024.14d3.7b37, MTU 1500
? ? ? ? IP address x.x.x.x, subnet mask 255.255.255.0
? ? ? ? 558 packets input, 49468 bytes, 0 no buffer
? ? ? ? Received 3 broadcasts, 0 runts, 0 giants
? ? ? ? 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
? ? ? ? 0 L2 decode drops
? ? ? ? 499 packets output, 71296 bytes, 0 underruns
? ? ? ? 0 output errors, 0 collisions, 9 interface resets
? ? ? ? 0 babbles, 0 late collisions, 0 deferred
? ? ? ? 0 lost carrier, 0 no carrier
? ? ? ? input queue (curr/max packets): hardware (0/25) software (0/0)
? ? ? ? output queue (curr/max packets): hardware (0/0) software (0/0)
? Traffic Statistics for "failover":
? ? ? ? 558 packets input, 39264 bytes
? ? ? ? 502 packets output, 59800 bytes
? ? ? ? 0 packets dropped
? ? ? 1 minute input rate 0 pkts/sec,? 0 bytes/sec
? ? ? 1 minute output rate 0 pkts/sec,? 0 bytes/sec
? ? ? 1 minute drop rate, 0 pkts/sec
? ? ? 5 minute input rate 0 pkts/sec,? 0 bytes/sec
? ? ? 5 minute output rate 0 pkts/sec,? 0 bytes/sec
? ? ? 5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff
_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From mhuff at ox.com  Thu Jun 11 14:56:52 2009
From: mhuff at ox.com (Matthew Huff)
Date: Thu, 11 Jun 2009 14:56:52 -0400
Subject: [c-nsp] cisco-nsp Digest, Vol 79, Issue 37
In-Reply-To: <5A69C25361FED34F83ABF05F5047524505CD8011@wally.walleyetrading.net>
References: <mailman.33.1244733169.2683.cisco-nsp@puck.nether.net>
	<5A69C25361FED34F83ABF05F5047524505CD8011@wally.walleyetrading.net>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C3811FD2CE@PUR-EXCH07.ox.com>

input and output drops on the interface are the key (depending on
direction). Microbursting is a problem with the short term sustained rate
overflows the input or output hardware buffer. If the system can't dequeue
the packets faster enough the you will get tail drops. With a 6500/720-3BXL
the problem with microbursting is going to be in the linecard.

With a 67xx series linecard you shouldn't receive microbursting unless you
have a very congested fabric or are saturating the interface
With a 65xx series linecard it will depend on the rate. On an otherwise
normal utilization microbursting shouldn't be a big problem
With a 61xx,62xx, 63xx the buffers are pretty shallow, hence their
positioning as access linecards for end users

All this depends on hardware switching. If something is causing the packets
to be punted to the CPU, then microbursting drops can occur on any linecard.


----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Jeff Bacon
> Sent: Thursday, June 11, 2009 2:01 PM
> To: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] cisco-nsp Digest, Vol 79, Issue 37
> 
> >
> > Message: 4
> > Date: Thu, 11 Jun 2009 15:41:24 +0200
> > From: Gert Doering <gert at greenie.muc.de>
> > To: Jo Rhett <jrhett at netconsonance.com>
> > Cc: cisco-nsp at puck.nether.net
> > Subject: Re: [c-nsp] full routing table / provider-class chassis
> > Message-ID: <20090611134124.GO290 at greenie.muc.de>
> > Content-Type: text/plain; charset="us-ascii"
> >
> >
> > (Yes, caveats apply.  With LAN hardware, you always have issues with
> > microbursts and buffering.  But ES/CRS - or Juniper - hardware is
> LOTS
> > of extra money.)
> >
> > gert
> >
> 
> So is there a good way to watch/track microbursts? I don't care if it
> buffers, but in our environment (lot of market data) we suffer from
> a) regular microbursts (micro meaning in the 1s or less timeframe)
> b) no really good way to measure or capture them short of putting
> packet
> sniffers on lines and sorting through packet dumps ex-post-facto.
> 
> We're using 6500/720-3BXL hardware but could buy other hardware (though
> I imagine that's not the problem). Traffic comes in over gig fiber or
> various metro-e, NYC metro area.
> 
> Our general answer is "throw more bandwidth at the problem" - which is
> fine; the problem is knowing _when_ we need to, short of finding out
> from end-users.
> 
> -bacon
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090611/0f636d9e/attachment-0001.bin>

From p.mayers at imperial.ac.uk  Thu Jun 11 15:01:34 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Thu, 11 Jun 2009 20:01:34 +0100
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A313392.60604@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net>
Message-ID: <4A31548E.3080501@imperial.ac.uk>

Kevin Loch wrote:

>>
>> Unfortunately, Cisco's partners are useless.  They propose 6509s without 
>> the DFCs, which we know will fall over.  
> 
> Well that depends...
> 
> The DFC's only do next-hop (tcam) lookups and netflow.  All packets are
> switched on the centralized PFC.  Each line card has two 20Gbit/s

?ukasz has already addressed this; suffice to say he's right, and the 
above is not correct. A TCAM lookup *is* the forwarding operation, and 
the DFC has all information required locally to switch the packet (via 
the fabric) to the output linecard, and does so.

> 
> Netflow is subsampled on this platform.  I have been able to get

I don't know what you mean by "subsampled", but my experience of netflow 
on this platform does not match this description.

Because we are within the netflow TCAM limits, I get 100% accurate 
netflow. There's no sampling in hardware - the hardware is in fact not 
*capable* of such - and we see all packets in our flow table.

> pretty good estimates of traffic flow (checked against SNMP counters)
> but I would not use that for any kind of accounting.  The

Again, this depends on your traffic pattern. We use it for accounting 
and it is essentially totally reliable, given our traffic patterns.

It's popular to bash netflow on the 6500s, but I personally think that's 
unfair. It's very effective for the (large numbers of) sites who are 
within the design limits of the platform. I can understand it's 
frustrating to be outside those limits though.

> SNMP counters are fairly noisy due to the several second update
> intervals.  SNMP counters on vlans are even worse and loop
> over after a few gbit/s even though the coutners themselves
> are 64bit.  You may find using smaller switches (like 3560)
> for most customer ports and using 10Gig uplinks is better
> than using copper ports on the 6500/7600.

I think that would depend on the architecture one was trying to build. 
By terminating the link on a 6748-TX, you get:

  * sensible power redundancy
  * sensible control-plane redundancy
  * better performance / lower contention
  * fewer devices to manage

> 
> I would avoid the sup720, the rsp720 has 2x the ram and more

Obviously it's worth emphasising that the RSP720 is 7600-only, and from 
posts on this list it's still not in general availability I think?

> than 2x the cpu power.  cpu on the sup720 is by far it's biggest
> limitation.

That's certainly true; 600Mhz is pretty derisory these days.

From Jeff.Wojciechowski at midlandpaper.com  Thu Jun 11 15:15:30 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Thu, 11 Jun 2009 14:15:30 -0500
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>

Ryan,

Thx for the heads up on the 8.0(3) bugs.

I blew away the configs on the secondary unit - upgraded to 8.0(4) on both units, re synched and the synch interface goes line protocol down and got this:

OUTPUT FROM SECONDARY:
______________________

        Detected an Active mate
 Beginning configuration replication from mate.
Failover LAN Failed

        Switching to Active

VaultASA(config-if)# sh fail
Failover On
Failover unit Secondary
Failover LAN Interface: failover Ethernet0/3 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 250 maximum
Version: Ours 8.0(4), Mate 8.0(4)
Last Failover at: 14:05:04 CDT Jun 11 2009
        This host: Secondary - Active
                Active time: 53 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Up Sys)
                  Interface outside (172.20.50.16): Normal (Waiting)
                  Interface inside (172.20.40.16): Normal (Waiting)
                slot 1: empty
        Other host: Primary - Failed
                Active time: 204 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Unknown/Unknown)
                  Interface outside (172.20.50.17): Unknown (Waiting)
                  Interface inside (172.20.40.17): Unknown (Waiting)
                slot 1: empty

Stateful Failover Logical Update Statistics
        Link : failover Ethernet0/3 (Failed)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         0          0          0          0
        sys cmd         0          0          0          0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         0          0          0          0
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       0       0
        Xmit Q:         0       0       0

Sh Fail on Primary (after failure):
___________________________________

VaultASA# sh fail
Failover On
Failover unit Primary
Failover LAN Interface: failover Ethernet0/3 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 250 maximum
Version: Ours 8.0(4), Mate 8.0(4)
Last Failover at: 14:01:27 CDT Jun 11 2009
        This host: Primary - Active
                Active time: 387 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Up Sys)
                  Interface outside (172.20.50.16): Normal (Waiting)
                  Interface inside (172.20.40.16): Normal (Waiting)
                slot 1: empty
        Other host: Secondary - Failed
                Active time: 0 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Unknown/Unknown)
                  Interface outside (172.20.50.17): Unknown (Waiting)
                  Interface inside (172.20.40.17): Unknown (Waiting)
                slot 1: empty

Stateful Failover Logical Update Statistics
        Link : failover Ethernet0/3 (Failed)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         0          0          0          0
        sys cmd         0          0          0          0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         0          0          0          0
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       0       0
        Xmit Q:         0       0       0


To answer your question - the failover interfaces are connected directly using a straight thru cable - the interfaces come 'up' long enough to synch and then immediately go down after a synch. And yes we tried different cable(s) on the synch interface :o)

Thanks,

-Jeff


-----Original Message-----
From: Ryan West [mailto:rwest at zyedge.com] 
Sent: Thursday, June 11, 2009 1:16 PM
To: Jeff Wojciechowski; cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Jeff,

It's hard to tell exactly what happened based on your post, can you do a 'show failover'?  When the ASA's are paired, you should only need to do a wr to save config on both.  Try erasing the config on the backup ASA, regenerate your RSA key with your new hostname (on the primary), re-enter the failover commands (on the standby) and see if it sync's up again.  You should consider moving away from 8.0(3), there a number of publicized security risks with it.  The interim releases should have much fewer bugs as well.

As for the failover interface, are you using a crossover or does it connect to a switch?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
Sent: Thursday, June 11, 2009 12:38 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ASA 5510 Configuration Replication Failure

Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
  Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
        Full-Duplex, 100 Mbps
        Description: LAN/STATE Failover Interface
        MAC address 0024.14d3.7b37, MTU 1500
        IP address x.x.x.x, subnet mask 255.255.255.0
        558 packets input, 49468 bytes, 0 no buffer
        Received 3 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        499 packets output, 71296 bytes, 0 underruns
        0 output errors, 0 collisions, 9 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        input queue (curr/max packets): hardware (0/25) software (0/0)
        output queue (curr/max packets): hardware (0/0) software (0/0)
  Traffic Statistics for "failover":
        558 packets input, 39264 bytes
        502 packets output, 59800 bytes
        0 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From chadwick.whitten at gmail.com  Thu Jun 11 15:23:32 2009
From: chadwick.whitten at gmail.com (Chad Whitten)
Date: Thu, 11 Jun 2009 14:23:32 -0500
Subject: [c-nsp] Cisco DSLAM ?
In-Reply-To: <4A3106D1.5010506@jarruda.com>
References: <4A2FD24D.2060703@cantv.net>
	<78C984F8939D424697B15E4B1C1BB3D7C48BF7@xmb-ams-331.emea.cisco.com>
	<4A3106D1.5010506@jarruda.com>
Message-ID: <973236a60906111223v7d847c46x82e1674834c4ac52@mail.gmail.com>

On Thu, Jun 11, 2009 at 8:29 AM, Julio Arruda <jarruda-cnsp at jarruda.com>wrote:

> Arie Vayner (avayner) wrote:
>
>> Juan,
>>
>> Cisco does not make DSLAMs for a long time now...
>>
>>
> I wonder if there is any Next-Gen DLC that Cisco has been seeing/using in
> customers ?
> In a previous life in NT, I remember Calix was quite popular in ANSI/T1
> customers in Caribean market, so, if someone is looking atend-to-end
> solutions, would cisco kit 'fit' better with any specific vendor (IOT and
> etc ?).
>
>
>
>  Arie
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Juan C. Crespo
>> R.
>> Sent: Wednesday, June 10, 2009 18:34
>> To: Cisco Post NSP
>> Cc: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] Cisco DSLAM ?
>>
>> Guys
>>
>> Does anyone of you knows a good DSLAM for HDSL & ADSL ?
>>
>> Thanks
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
Chad Whitten
chadwick.whitten at gmail.com
601-519-4172

From jfitz at Princeton.EDU  Thu Jun 11 16:23:03 2009
From: jfitz at Princeton.EDU (Jeff Fitzwater)
Date: Thu, 11 Jun 2009 16:23:03 -0400
Subject: [c-nsp] 3750 running jumbo frames ?
In-Reply-To: <1244740389.3383.6.camel@localhost.localdomain>
References: <987B409C-FF47-45CD-BF4D-C350D24B7EB3@princeton.edu>
	<1244740389.3383.6.camel@localhost.localdomain>
Message-ID: <5E377FEF-23E7-4782-BCB1-4A6127BCC81F@Princeton.EDU>

Thanks for all the info.   Thats what I thought, but I have people  
checking on me.

Case closed.


Jeff
On Jun 11, 2009, at 1:13 PM, Peter Rathlev wrote:

> On Thu, 2009-06-11 at 09:44 -0400, Jeff Fitzwater wrote:
>> We have the need to run two 3750 switches with jumbo frames (9000),
>> for a high performance data transfer application.  Both switches will
>> be manages by connections to a NON-JUMBO frame environment.   (That
>> is, if this will work)
>>
>> If I enable jumbo frames (which is a global change) and leave the
>> management interface MTU at 1500 so the switch will use 1500 as  
>> packet
>> size for all management, is there any NEGATIVE ISSUES I should be
>> aware because of them being connected to the non-jumbo environment?
>
> This will not present problems. As David mentions only L2 switched
> frames can be jumbo. Management-traffic wouldn't exceed the routing  
> MTU,
> which is 1500 bytes by default. Changing the "system jumbo mtu"  
> doesn't
> change the L3 MTU.
>
> Any TCP based L3 connection would use the lowest of the two endpoint
> MSSs anyway, so hosts connecting from 1500 byte MTU segments would
> always end up using 1500 byte MTU connections. Even if you could  
> adjust
> routing MTU to 9000 bytes you probably wouldn't face any problems.
>
> IMHO there would never be any negative effects from enabling 9000  
> bytes
> MTU, unless of course you explicitely WANT to limit the MTU.
>
> Regards,
> Peter
>
>


From jared at puck.nether.net  Thu Jun 11 16:48:50 2009
From: jared at puck.nether.net (Jared Mauch)
Date: Thu, 11 Jun 2009 16:48:50 -0400
Subject: [c-nsp] WS-X6148-RJ21 Ethernet Modules
In-Reply-To: <A8A11BA006DA57498FAC0A56686865042AA79799@usilwdex04.spencerstuart.com>
References: <000801c9e9f0$638170a0$2a8451e0$@org>	<20090610180937.GA27437@fusion.opticnetworks.net>	<4A2FFB05.1050709@utc.edu><e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com>
	<4A300D69.9060501@gmail.com>
	<A8A11BA006DA57498FAC0A56686865042AA79799@usilwdex04.spencerstuart.com>
Message-ID: <E632AB70-30FB-46F9-9B29-7AEA6B0E3FB0@puck.nether.net>

My biggest comments surround insuring that they're supported in recent  
software.  Cisco pulled some hardware support in the SXI -> SXI1  
rebuild.

You also need to verify that the patch panels being used are the  
"right ones".  It's easy for someone to hand you a T1 patch panel and  
think it's viable for ethernet until you actually trace the wiring.

	- Jared

On Jun 10, 2009, at 3:55 PM, <tkacprzynski at SpencerStuart.com> <tkacprzynski at SpencerStuart.com 
 > wrote:

> Hello
> I was wondering if anyone has any experience using the RJ21 modules  
> for
> 6500 Catalyst? Any good things to say? Any bad things to say?
>
> Regrets deploying it?
>
> This would be for access switches.
>
> Thank you,
>
> Tom
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From cchurc05 at harris.com  Thu Jun 11 17:15:52 2009
From: cchurc05 at harris.com (Church, Charles)
Date: Thu, 11 Jun 2009 16:15:52 -0500
Subject: [c-nsp] WS-X6148-RJ21 Ethernet Modules
In-Reply-To: <E632AB70-30FB-46F9-9B29-7AEA6B0E3FB0@puck.nether.net>
References: <000801c9e9f0$638170a0$2a8451e0$@org>	<20090610180937.GA27437@fusion.opticnetworks.net>	<4A2FFB05.1050709@utc.edu><e44f1b0e0906101154y10cd7366n2016bd0ffee0ec3@mail.gmail.com><4A300D69.9060501@gmail.com><A8A11BA006DA57498FAC0A56686865042AA79799@usilwdex04.spencerstuart.com>
	<E632AB70-30FB-46F9-9B29-7AEA6B0E3FB0@puck.nether.net>
Message-ID: <FA1BA229357DB640B944218F3585FECA025E1577@mspe2k1.cs.myharris.net>

>My biggest comments surround insuring that they're supported in recent

>software.  Cisco pulled some hardware support in the SXI -> SXI1  
>rebuild.

Didn't know about that.  Thought SXH and SXI had the same HW support.
Are there release notes for SXI1 up yet?

Chuck

From rwest at zyedge.com  Thu Jun 11 17:16:48 2009
From: rwest at zyedge.com (Ryan West)
Date: Thu, 11 Jun 2009 17:16:48 -0400
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
	<6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5305@zy-ex1.zyedge.local>

Have you tried a crossover?  Can you post 'show run failover' ?  A console on the standby firewall might reveal something during the replication process too.

-ryan

-----Original Message-----
From: Jeff Wojciechowski [mailto:Jeff.Wojciechowski at midlandpaper.com] 
Sent: Thursday, June 11, 2009 3:16 PM
To: Ryan West
Cc: cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Ryan,

Thx for the heads up on the 8.0(3) bugs.

I blew away the configs on the secondary unit - upgraded to 8.0(4) on both units, re synched and the synch interface goes line protocol down and got this:

OUTPUT FROM SECONDARY:
______________________

        Detected an Active mate
 Beginning configuration replication from mate.
Failover LAN Failed

        Switching to Active

VaultASA(config-if)# sh fail
Failover On
Failover unit Secondary
Failover LAN Interface: failover Ethernet0/3 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 250 maximum
Version: Ours 8.0(4), Mate 8.0(4)
Last Failover at: 14:05:04 CDT Jun 11 2009
        This host: Secondary - Active
                Active time: 53 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Up Sys)
                  Interface outside (172.20.50.16): Normal (Waiting)
                  Interface inside (172.20.40.16): Normal (Waiting)
                slot 1: empty
        Other host: Primary - Failed
                Active time: 204 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Unknown/Unknown)
                  Interface outside (172.20.50.17): Unknown (Waiting)
                  Interface inside (172.20.40.17): Unknown (Waiting)
                slot 1: empty

Stateful Failover Logical Update Statistics
        Link : failover Ethernet0/3 (Failed)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         0          0          0          0
        sys cmd         0          0          0          0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         0          0          0          0
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       0       0
        Xmit Q:         0       0       0

Sh Fail on Primary (after failure):
___________________________________

VaultASA# sh fail
Failover On
Failover unit Primary
Failover LAN Interface: failover Ethernet0/3 (Failed - No Switchover)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 250 maximum
Version: Ours 8.0(4), Mate 8.0(4)
Last Failover at: 14:01:27 CDT Jun 11 2009
        This host: Primary - Active
                Active time: 387 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Up Sys)
                  Interface outside (172.20.50.16): Normal (Waiting)
                  Interface inside (172.20.40.16): Normal (Waiting)
                slot 1: empty
        Other host: Secondary - Failed
                Active time: 0 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.0(4)) status (Unknown/Unknown)
                  Interface outside (172.20.50.17): Unknown (Waiting)
                  Interface inside (172.20.40.17): Unknown (Waiting)
                slot 1: empty

Stateful Failover Logical Update Statistics
        Link : failover Ethernet0/3 (Failed)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         0          0          0          0
        sys cmd         0          0          0          0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          0          0
        UDP conn        0          0          0          0
        ARP tbl         0          0          0          0
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       0       0
        Xmit Q:         0       0       0


To answer your question - the failover interfaces are connected directly using a straight thru cable - the interfaces come 'up' long enough to synch and then immediately go down after a synch. And yes we tried different cable(s) on the synch interface :o)


Thanks,

-Jeff


-----Original Message-----
From: Ryan West [mailto:rwest at zyedge.com] 
Sent: Thursday, June 11, 2009 1:16 PM
To: Jeff Wojciechowski; cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Jeff,

It's hard to tell exactly what happened based on your post, can you do a 'show failover'?  When the ASA's are paired, you should only need to do a wr to save config on both.  Try erasing the config on the backup ASA, regenerate your RSA key with your new hostname (on the primary), re-enter the failover commands (on the standby) and see if it sync's up again.  You should consider moving away from 8.0(3), there a number of publicized security risks with it.  The interim releases should have much fewer bugs as well.

As for the failover interface, are you using a crossover or does it connect to a switch?

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
Sent: Thursday, June 11, 2009 12:38 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ASA 5510 Configuration Replication Failure

Dearest List:

We are building a new active/standby ASA cluster with 5510's and the initial config synch went just fine.

However, when we changed the hostname on the primary unit and did a 'write standby' I got the following:

VaultASA(config)# wr stan
Building configuration...
[OK]
VaultASA(config)# Beginning configuration replication: Sending to mate.
Failover LAN Failed
Configuration Replication Failure
sh ver

Cisco Adaptive Security Appliance Software Version 8.0(3)
Device Manager Version 6.1(5)

Another interesting point about this is that both units show the synch interface (E0/3 on both units in our case) show line protocol down.

VaultASA(config)# sh int e0/3
Interface Ethernet0/3 "failover", is down, line protocol is down
  Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
        Full-Duplex, 100 Mbps
        Description: LAN/STATE Failover Interface
        MAC address 0024.14d3.7b37, MTU 1500
        IP address x.x.x.x, subnet mask 255.255.255.0
        558 packets input, 49468 bytes, 0 no buffer
        Received 3 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        499 packets output, 71296 bytes, 0 underruns
        0 output errors, 0 collisions, 9 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        input queue (curr/max packets): hardware (0/25) software (0/0)
        output queue (curr/max packets): hardware (0/0) software (0/0)
  Traffic Statistics for "failover":
        558 packets input, 39264 bytes
        502 packets output, 59800 bytes
        0 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
VaultASA(config)#

Ideas?

Thanks in advance.

Jeff
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From Jeff.Wojciechowski at midlandpaper.com  Thu Jun 11 17:24:03 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Thu, 11 Jun 2009 16:24:03 -0500
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5305@zy-ex1.zyedge.local>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
	<6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5305@zy-ex1.zyedge.local>
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AED808@XBOX.midlandpaper.com>

Ryan -

Solved... for now at least...

Still using straight thru cable for synch interface I upgraded to 8.21 - based on the following bug IDs:

CSCsu88174
CSCsw98373
CSCsy21727
CSCsz63217

For the record the sh run | inc fail:

failover lan unit primary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.20.20.6 255.255.255.0 standby 172.20.20.7

and 

failover lan unit secondary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.20.20.6 255.255.255.0 standby 172.20.20.7

Thanks again,

-Jeff


-----Original Message-----
From: Ryan West [mailto:rwest at zyedge.com] 
Sent: Thursday, June 11, 2009 4:17 PM
To: Jeff Wojciechowski
Cc: cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Have you tried a crossover?  Can you post 'show run failover' ?  A console on the standby firewall might reveal something during the replication process too.

-ryan


<snipped>


From kgraham at industrial-marshmallow.com  Thu Jun 11 17:58:19 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Thu, 11 Jun 2009 14:58:19 -0700 (PDT)
Subject: [c-nsp] Location of 67xx rommon (c2lc-rm) images?
In-Reply-To: <4A3081B6.3040102@forthnet.gr>
References: <499643.28801.qm@web1215.biz.mail.gq1.yahoo.com>
	<4A3081B6.3040102@forthnet.gr>
Message-ID: <601566.41451.qm@web1206.biz.mail.gq1.yahoo.com>




> Do a search for "c2lc-rm2.srec.122-18r.S1"

Yep, thanks for the pointer. Wonderful that they made the site
spider-friendly enough that:

   http://www.google.com/search?q=site%3Acisco.com+c2lc-rm2

...returns 1 result. I was mostly trying to confirm that (18r)S1 was
still the most current option so was hoping for a canonical location
over a search result.

> and you'll find many download locations.

Indeed. 3 pages of download links for irrelevant permutations of
supervisors and chassis combinations with release notes as the 
last result of the last page.

Apparently the brilliant decisions for how to deliver support
tools made c2lc is the exclusive "IOS rommon" for "6509E ->
Sup720 w/ 10GbE uplinks"... I admire the effort it must take to
maintain such a friendly facade over such clear contempt for 
anyone actually using it.

From samantha at cairns.net.au  Thu Jun 11 20:13:24 2009
From: samantha at cairns.net.au (Samantha (Regional Connect))
Date: Fri, 12 Jun 2009 10:13:24 +1000
Subject: [c-nsp] Problem with config for 7206 acting as a lns
Message-ID: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>

Hi

I have the radius issuing the following attribute (example)

lcp:interface-config#1=service-policy output 160
lcp:interface-config#1=service-policy input 2560

Now when the user authenticates it closes the connection on the user
If I remove the attributes from radius (shaping after a user has reached a
download limit)
they stay connected




boot system flash disk0:c7200-xxxxxxxxxxxx
aaa new-model
!
!
aaa authentication login default local
aaa authentication enable default enable
aaa authentication ppp default group radius
aaa authorization network l2tp group radius
aaa accounting delay-start
aaa accounting update periodic 5
aaa accounting network default start-stop group radius
aaa accounting network l2tp start-stop group radius
aaa nas port extended
aaa pod server auth-type any server-key xxxxxxxxxxxxxxxxx
aaa session-id common
enable secret 5 $1$BSPX$QS0/XG/J8WmSW7attjsTC/
enable password xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
clock timezone GMT 10
ip subnet-zero
no ip source-route
!
!
ip name-server xxx.xxx.xxx.xxx
ip name-server xxx.xxx.xxx.xxx
ip name-server xxx.xxx.xxx.xxx
!
ip cef
vpdn enable
vpdn multihop
vpdn aaa attribute nas-port vpdn-nas
vpdn logging
vpdn logging local
vpdn logging tunnel-drop
vpdn history failure table-size 50
vpdn session-limit 1000
! Default L2TP VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 1
 lcp renegotiation always
 l2tp tunnel password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
!
!
voice call carrier capacity active
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet1/0
 description LNS Link to Network
 ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
 duplex full
 ipv6 address xxx.xxx.xxx.xxx /48
 ipv6 enable
 no cdp enable
!
interface FastEthernet2/0
 no ip address
 duplex full
 no cdp enable
 no mop enabled
!
interface FastEthernet2/0.1027
 encapsulation dot1Q 1027
 ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
 no cdp enable
!
interface FastEthernet2/0.1028
 encapsulation dot1Q 1028
 ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
 no cdp enable
!
interface Virtual-Template1
 description Customer DSL-Sessions via L2TP
 ip unnumbered FastEthernet1/0
 ip access-group 110 out
 peer default ip address pool default
 ppp authentication pap chap radius
ppp authorization l2tp
 ppp accounting l2tp
 ppp multilink
!
router ospf 1
 router-id 202.xxx.xxx.xxx
 log-adjacency-changes
 redistribute connected subnets
 redistribute static subnets
 passive-interface FastEthernet2/0
 passive-interface FastEthernet2/0.1027
 passive-interface FastEthernet2/0.1028
 network 202.xxx.xxx.xxx 0.0.0.255 area 0.0.0.0
!
ip local pool default xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
ip route xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx FastEthernet1/0
no ip http server
!
!
access-list 110 permit ip any any
no cdp run
ipv6 route xxx.xxx.xxx.xxx 48 FastEthernet1/0
ipv6 route ::/0 xxx.xxx.xxx.xxx
!
snmp-server community public RO 99
snmp-server location Equinix Sydney
snmp-server contact xxx.xxx.xxx.xxx
snmp-server chassis-id lns1.c7206
snmp-server enable traps tty
!
!
radius-server configure-nas
radius-server host xxx.xxx.xxx.xxx auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server key xxxxxxxxxxx
radius-server authorization permit missing Service-Type
radius-server vsa send accounting
radius-server vsa send authentication
no call rsvp-sync
!
!
mgcp profile default
!
dial-peer cor custom
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
!
ntp clock-period 17179650
ntp master 4
ntp server 192.189.54.17
ntp server 202.47.112.1
ntp server 192.189.54.65
!


Thanks


Sam


From BBlackford at nwresd.k12.or.us  Thu Jun 11 22:20:14 2009
From: BBlackford at nwresd.k12.or.us (Bill Blackford)
Date: Thu, 11 Jun 2009 19:20:14 -0700
Subject: [c-nsp] x6148 vs. x6548
Message-ID: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>

I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.

I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.

Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.

-b

--
Bill Blackford                     
Senior Network Engineer            
Technology Systems Group           
Northwest Regional ESD             

my /home away from home


From cphillips at wbsconnect.com  Thu Jun 11 22:31:55 2009
From: cphillips at wbsconnect.com (Chris Phillips)
Date: Thu, 11 Jun 2009 19:31:55 -0700
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
Message-ID: <4A31BE1B.4020702@wbsconnect.com>

Bill,

One caveat that jumps to mind is the max MTU of 1518 instead of the far 
more desirable 9216.  We ran into some MPLS VC issues with MTU mismatch 
that forced us to re-engineer and/or upgrade those blades.

Give this a read before you buy anything:

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/product_data_sheet0900aecd8017376e_ps4835_Products_Data_Sheet.html

Good luck with your decision.

Bill Blackford wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
> 
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
> 
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
> 
> -b
> 
> --
> Bill Blackford                     
> Senior Network Engineer            
> Technology Systems Group           
> Northwest Regional ESD             
> 
> my /home away from home
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

-- 
Chris Phillips


From ayourtch at gmail.com  Thu Jun 11 23:32:26 2009
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Fri, 12 Jun 2009 05:32:26 +0200
Subject: [c-nsp] Cisco IP Phones and IPv6
In-Reply-To: <292AF25E62B8894C921B893B53A19D97394469E4CE@BUSINESSEX.business.ad>
References: <292AF25E62B8894C921B893B53A19D97394469E4CE@BUSINESSEX.business.ad>
Message-ID: <530c5af60906112032u29362a5ej97af9433e6f8c6a4@mail.gmail.com>

On Thu, Jun 11, 2009 at 2:00 PM, Skeeve Stevens<Skeeve at eintellego.net> wrote:
> Does anyone know if any of the SCCP or SIP images for any of the models of Cisco IP Phones support IPv6?

I found these two pointers, HTH:

http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/firmware/8_5_2/english/release/notes/7900_852.html#wp159417
http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/admin/7_1_2/ccmfeat/fsipv6.html

thanks,
andrew

>
> ...Skeeve
>
> --
> Skeeve Stevens, CEO/Technical Director
> eintellego Pty Ltd - The Networking Specialists
> skeeve at eintellego.net / www.eintellego.net
> Phone: 1300 753 383, Fax: (+612) 8572 9954
> Cell +61 (0)414 753 383 / skype://skeeve
> --
> NOC, NOC, who's there?
>
> Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are!
>  virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From mulitskiy at acedsl.com  Fri Jun 12 01:10:09 2009
From: mulitskiy at acedsl.com (Michael Ulitskiy)
Date: Fri, 12 Jun 2009 01:10:09 -0400
Subject: [c-nsp] Problem with config for 7206 acting as a lns
In-Reply-To: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>
References: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>
Message-ID: <200906120110.09722.mulitskiy@acedsl.com>

There's no such policy-maps defined in your config.
If you supply an undefined policy-map in radius VSA then cisco just drops the connection.

Michael

On Thursday 11 June 2009 08:13:24 pm Samantha (Regional Connect) wrote:
> Hi
> 
> I have the radius issuing the following attribute (example)
> 
> lcp:interface-config#1=service-policy output 160
> lcp:interface-config#1=service-policy input 2560
> 
> Now when the user authenticates it closes the connection on the user
> If I remove the attributes from radius (shaping after a user has reached a
> download limit)
> they stay connected
> 
> 
> 
> 
> boot system flash disk0:c7200-xxxxxxxxxxxx
> aaa new-model
> !
> !
> aaa authentication login default local
> aaa authentication enable default enable
> aaa authentication ppp default group radius
> aaa authorization network l2tp group radius
> aaa accounting delay-start
> aaa accounting update periodic 5
> aaa accounting network default start-stop group radius
> aaa accounting network l2tp start-stop group radius
> aaa nas port extended
> aaa pod server auth-type any server-key xxxxxxxxxxxxxxxxx
> aaa session-id common
> enable secret 5 $1$BSPX$QS0/XG/J8WmSW7attjsTC/
> enable password xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> !
> clock timezone GMT 10
> ip subnet-zero
> no ip source-route
> !
> !
> ip name-server xxx.xxx.xxx.xxx
> ip name-server xxx.xxx.xxx.xxx
> ip name-server xxx.xxx.xxx.xxx
> !
> ip cef
> vpdn enable
> vpdn multihop
> vpdn aaa attribute nas-port vpdn-nas
> vpdn logging
> vpdn logging local
> vpdn logging tunnel-drop
> vpdn history failure table-size 50
> vpdn session-limit 1000
> ! Default L2TP VPDN group
>  accept-dialin
>   protocol l2tp
>   virtual-template 1
>  lcp renegotiation always
>  l2tp tunnel password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
> !
> !
> !
> voice call carrier capacity active
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> interface FastEthernet1/0
>  description LNS Link to Network
>  ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
>  duplex full
>  ipv6 address xxx.xxx.xxx.xxx /48
>  ipv6 enable
>  no cdp enable
> !
> interface FastEthernet2/0
>  no ip address
>  duplex full
>  no cdp enable
>  no mop enabled
> !
> interface FastEthernet2/0.1027
>  encapsulation dot1Q 1027
>  ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
>  no cdp enable
> !
> interface FastEthernet2/0.1028
>  encapsulation dot1Q 1028
>  ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
>  no cdp enable
> !
> interface Virtual-Template1
>  description Customer DSL-Sessions via L2TP
>  ip unnumbered FastEthernet1/0
>  ip access-group 110 out
>  peer default ip address pool default
>  ppp authentication pap chap radius
> ppp authorization l2tp
>  ppp accounting l2tp
>  ppp multilink
> !
> router ospf 1
>  router-id 202.xxx.xxx.xxx
>  log-adjacency-changes
>  redistribute connected subnets
>  redistribute static subnets
>  passive-interface FastEthernet2/0
>  passive-interface FastEthernet2/0.1027
>  passive-interface FastEthernet2/0.1028
>  network 202.xxx.xxx.xxx 0.0.0.255 area 0.0.0.0
> !
> ip local pool default xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
> ip classless
> ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
> ip route xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx FastEthernet1/0
> no ip http server
> !
> !
> access-list 110 permit ip any any
> no cdp run
> ipv6 route xxx.xxx.xxx.xxx 48 FastEthernet1/0
> ipv6 route ::/0 xxx.xxx.xxx.xxx
> !
> snmp-server community public RO 99
> snmp-server location Equinix Sydney
> snmp-server contact xxx.xxx.xxx.xxx
> snmp-server chassis-id lns1.c7206
> snmp-server enable traps tty
> !
> !
> radius-server configure-nas
> radius-server host xxx.xxx.xxx.xxx auth-port 1645 acct-port 1646
> radius-server retransmit 3
> radius-server key xxxxxxxxxxx
> radius-server authorization permit missing Service-Type
> radius-server vsa send accounting
> radius-server vsa send authentication
> no call rsvp-sync
> !
> !
> mgcp profile default
> !
> dial-peer cor custom
> !
> !
> !
> !
> gatekeeper
> shutdown
> !
> !
> line con 0
>  stopbits 1
> line aux 0
>  stopbits 1
> line vty 0 4
> !
> ntp clock-period 17179650
> ntp master 4
> ntp server 192.189.54.17
> ntp server 202.47.112.1
> ntp server 192.189.54.65
> !
> 
> 
> Thanks
> 
> 
> Sam
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From tincan at gmail.com  Fri Jun 12 02:41:27 2009
From: tincan at gmail.com (Nate)
Date: Thu, 11 Jun 2009 23:41:27 -0700
Subject: [c-nsp] Nexus 5000 + Qlogic QLE8042 + VMware ESX 3.5?
Message-ID: <f8da69c80906112341s48bae95aq4f02cadcb40301c6@mail.gmail.com>

Has anyone gotten VMware ESX 3.5 Update 4 to recognize the Qlogic
QLE8042 CNA with both the 10G Ethernet interface and FC HBA? We're
trying to get the server with the CNA installed connected to the Nexus
5000 and while the Ethernet interfaces are shown as up on the N5K, the
VFC interfaces are stuck in init state. ESX does not appear to
recognize the Qlogic as an HBA, even though we're using the latest
driver from Qlogic. We contacted VMware tech support and the answer we
got back was that ESX will only recognize the Qlogic as an Ethernet
interface, not HBA. That does not sound right, since I've recalled
hearing others having success. If anyone has successfully gotten the
Qlogic CNA to work under VMware ESX as both an Ethernet and HBA, I
would love to hear your experience.

TIA!
Nate

From erik at infopact.nl  Fri Jun 12 02:54:16 2009
From: erik at infopact.nl (E. Versaevel)
Date: Fri, 12 Jun 2009 08:54:16 +0200
Subject: [c-nsp] Problem with config for 7206 acting as a lns
In-Reply-To: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>
References: <02ee01c9eaf2$9a4a0fe0$cede2fa0$@net.au>
Message-ID: <4A31FB98.30008@infopact.nl>

You need to increment the sequence number:

> lcp:interface-config#1=service-policy output 160
> lcp:interface-config#2=service-policy input 2560

also make sure the service policy referred to are in you configuration :)



Samantha (Regional Connect) schreef:
> Hi
> 
> I have the radius issuing the following attribute (example)
> 
> lcp:interface-config#1=service-policy output 160
> lcp:interface-config#1=service-policy input 2560
> 
> Now when the user authenticates it closes the connection on the user
> If I remove the attributes from radius (shaping after a user has reached a
> download limit)
> they stay connected
> 
> 
> 
> 
> boot system flash disk0:c7200-xxxxxxxxxxxx
> aaa new-model
> !
> !
> aaa authentication login default local
> aaa authentication enable default enable
> aaa authentication ppp default group radius
> aaa authorization network l2tp group radius
> aaa accounting delay-start
> aaa accounting update periodic 5
> aaa accounting network default start-stop group radius
> aaa accounting network l2tp start-stop group radius
> aaa nas port extended
> aaa pod server auth-type any server-key xxxxxxxxxxxxxxxxx
> aaa session-id common
> enable secret 5 $1$BSPX$QS0/XG/J8WmSW7attjsTC/
> enable password xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> !
> clock timezone GMT 10
> ip subnet-zero
> no ip source-route
> !
> !
> ip name-server xxx.xxx.xxx.xxx
> ip name-server xxx.xxx.xxx.xxx
> ip name-server xxx.xxx.xxx.xxx
> !
> ip cef
> vpdn enable
> vpdn multihop
> vpdn aaa attribute nas-port vpdn-nas
> vpdn logging
> vpdn logging local
> vpdn logging tunnel-drop
> vpdn history failure table-size 50
> vpdn session-limit 1000
> ! Default L2TP VPDN group
>  accept-dialin
>   protocol l2tp
>   virtual-template 1
>  lcp renegotiation always
>  l2tp tunnel password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
> !
> !
> !
> voice call carrier capacity active
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> !
> interface FastEthernet1/0
>  description LNS Link to Network
>  ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
>  duplex full
>  ipv6 address xxx.xxx.xxx.xxx /48
>  ipv6 enable
>  no cdp enable
> !
> interface FastEthernet2/0
>  no ip address
>  duplex full
>  no cdp enable
>  no mop enabled
> !
> interface FastEthernet2/0.1027
>  encapsulation dot1Q 1027
>  ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
>  no cdp enable
> !
> interface FastEthernet2/0.1028
>  encapsulation dot1Q 1028
>  ip address 125.xxx.xxx.xxx 255.255.xxx.xxx
>  no cdp enable
> !
> interface Virtual-Template1
>  description Customer DSL-Sessions via L2TP
>  ip unnumbered FastEthernet1/0
>  ip access-group 110 out
>  peer default ip address pool default
>  ppp authentication pap chap radius
> ppp authorization l2tp
>  ppp accounting l2tp
>  ppp multilink
> !
> router ospf 1
>  router-id 202.xxx.xxx.xxx
>  log-adjacency-changes
>  redistribute connected subnets
>  redistribute static subnets
>  passive-interface FastEthernet2/0
>  passive-interface FastEthernet2/0.1027
>  passive-interface FastEthernet2/0.1028
>  network 202.xxx.xxx.xxx 0.0.0.255 area 0.0.0.0
> !
> ip local pool default xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
> ip classless
> ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
> ip route xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx FastEthernet1/0
> no ip http server
> !
> !
> access-list 110 permit ip any any
> no cdp run
> ipv6 route xxx.xxx.xxx.xxx 48 FastEthernet1/0
> ipv6 route ::/0 xxx.xxx.xxx.xxx
> !
> snmp-server community public RO 99
> snmp-server location Equinix Sydney
> snmp-server contact xxx.xxx.xxx.xxx
> snmp-server chassis-id lns1.c7206
> snmp-server enable traps tty
> !
> !
> radius-server configure-nas
> radius-server host xxx.xxx.xxx.xxx auth-port 1645 acct-port 1646
> radius-server retransmit 3
> radius-server key xxxxxxxxxxx
> radius-server authorization permit missing Service-Type
> radius-server vsa send accounting
> radius-server vsa send authentication
> no call rsvp-sync
> !
> !
> mgcp profile default
> !
> dial-peer cor custom
> !
> !
> !
> !
> gatekeeper
> shutdown
> !
> !
> line con 0
>  stopbits 1
> line aux 0
>  stopbits 1
> line vty 0 4
> !
> ntp clock-period 17179650
> ntp master 4
> ntp server 192.189.54.17
> ntp server 202.47.112.1
> ntp server 192.189.54.65
> !
> 
> 
> Thanks
> 
> 
> Sam
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/



Erik Versaevel

From narmaw at pertamina-ep.com  Fri Jun 12 03:35:54 2009
From: narmaw at pertamina-ep.com (Narma Wahyuadi)
Date: Fri, 12 Jun 2009 14:35:54 +0700
Subject: [c-nsp] cisco router for internet
Message-ID: <002801c9eb30$6c62c660$45285320$@com>

Could cisco router 2800 series work under BGP protocol for internet ?

 

thx


_____________________________________________________________________

Note: The information contained in this e-mail is intended only for the use of the individual or entity named above and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended party to receive the message and its attachment(s), you are hereby notified that any dissemination, distribution or copy of the message is strictly prohibited. Please immediately notify the sender and delete the message as soon as possible. Thank you for kind attention.
 
Catatan: Informasi yang terdapat dalam e-mail ini ditujukan hanya untuk penggunaan individu atau kelompok yang disebutkan di atas dan mungkin berisi informasi yang istimewa, rahasia dan dikecualikan dari pengungkapan menurut hukum yang berlaku. Jika Anda bukan pihak yang ditujukan untuk menerima pesan ini beserta lampirannya, dengan ini Anda diberitahukan bahwa penyebaran, pendistribusian atau penyalinan pesan ini adalah sangat dilarang. Harap segera memberitahu pengirim dan menghapus pesan ini secepatnya. Terima kasih atas perhatian Anda.

From Skeeve at eintellego.net  Fri Jun 12 04:54:06 2009
From: Skeeve at eintellego.net (Skeeve Stevens)
Date: Fri, 12 Jun 2009 18:54:06 +1000
Subject: [c-nsp] cisco router for internet
In-Reply-To: <002801c9eb30$6c62c660$45285320$@com>
References: <002801c9eb30$6c62c660$45285320$@com>
Message-ID: <292AF25E62B8894C921B893B53A19D97394469E4E3@BUSINESSEX.business.ad>

Yes... just not fast, but if you run a 2821/2852 with a gig of Ram, it can do multiple tables quite fine, it just takes a little while to fully load all the routes.

A 2811 with 768 will also be fine.  I wouldn't try a 2801... even with 512 it will be slow.

...Skeeve

--
Skeeve Stevens, CEO/Technical Director
eintellego Pty Ltd - The Networking Specialists
skeeve at eintellego.net / www.eintellego.net
Phone: 1300 753 383, Fax: (+612) 8572 9954
Cell +61 (0)414 753 383 / skype://skeeve
--
NOC, NOC, who's there?


> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Narma Wahyuadi
> Sent: Friday, 12 June 2009 5:36 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] cisco router for internet
>
> Could cisco router 2800 series work under BGP protocol for internet ?
>
>
>
> thx
>
>
> _____________________________________________________________________
>
> Note: The information contained in this e-mail is intended only for the
> use of the individual or entity named above and may contain information
> that is privileged, confidential and exempt from disclosure under
> applicable law. If you are not the intended party to receive the
> message and its attachment(s), you are hereby notified that any
> dissemination, distribution or copy of the message is strictly
> prohibited. Please immediately notify the sender and delete the message
> as soon as possible. Thank you for kind attention.
>
> Catatan: Informasi yang terdapat dalam e-mail ini ditujukan hanya untuk
> penggunaan individu atau kelompok yang disebutkan di atas dan mungkin
> berisi informasi yang istimewa, rahasia dan dikecualikan dari
> pengungkapan menurut hukum yang berlaku. Jika Anda bukan pihak yang
> ditujukan untuk menerima pesan ini beserta lampirannya, dengan ini Anda
> diberitahukan bahwa penyebaran, pendistribusian atau penyalinan pesan
> ini adalah sangat dilarang. Harap segera memberitahu pengirim dan
> menghapus pesan ini secepatnya. Terima kasih atas perhatian Anda.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From lukasz at bromirski.net  Fri Jun 12 05:18:35 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Fri, 12 Jun 2009 11:18:35 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A31548E.3080501@imperial.ac.uk>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>	<4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk>
Message-ID: <4A321D6B.4000300@bromirski.net>

On 2009-06-11 21:01, Phil Mayers wrote:

>> I would avoid the sup720, the rsp720 has 2x the ram and more
> Obviously it's worth emphasising that the RSP720 is 7600-only, and from
> posts on this list it's still not in general availability I think?

True, the RSP is 7600-only, but only the RSP720-10GE waits for general
availability until 12.2(33)SRE (due to HA issues, NSF/SSO is not yet
supported). RSP720 is available.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From s.ganschow at buelow-masiak.de  Fri Jun 12 05:54:46 2009
From: s.ganschow at buelow-masiak.de (Sebastian Ganschow)
Date: Fri, 12 Jun 2009 11:54:46 +0200
Subject: [c-nsp] clear ip pool
Message-ID: <H0000084006e1e5f.1244800486.bohr.dbmg.de@MHS>

Hi,

we've got our ciscos configured that ip pool configuration is derived 
from our radius servers.

In order to change the ip pool, I change the pool in the radius config. 
But our ciscos are still using the old ip pool. It seems like some 
caching issue.

Is there any way to let the cisco forget the pool information and get it 
again from the radius server?

Thanks in advance

Sebastian



From rwest at zyedge.com  Fri Jun 12 08:25:24 2009
From: rwest at zyedge.com (Ryan West)
Date: Fri, 12 Jun 2009 08:25:24 -0400
Subject: [c-nsp] cisco router for internet
In-Reply-To: <002801c9eb30$6c62c660$45285320$@com>
References: <002801c9eb30$6c62c660$45285320$@com>
Message-ID: <6E21B2BDEF6E714EA0B5BA8D5D0E140124835C531A@zy-ex1.zyedge.local>

Hi.

Depends on what you mean by work.  A 2811 with 512 megs of RAM will handle multiple full feeds ok.  It chugs when they are first sent, but will handle them fine.  The question is really how many routes do you need from your provider.  You may only need a default from one provider and customer routes from the other, in which case the default amount of RAM (256 on the 2811) would be just fine.

Here is a 2811 with two full feeds:

mcrt01#show memory free
                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)
Processor   44D28460   711818144   304454336   407363808   406062736   406201608

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
x.x.x.x         4   174 2221937   39239  8509486    3    0 2w2d       282799
x.x.x.x         4   174   38978   39247  8509486    0    0 3w6d            1
x.x.x.x         4   701 1511250   78488  8509486    0    0 3w6d       281498

-ryan

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Narma Wahyuadi
Sent: Friday, June 12, 2009 3:36 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] cisco router for internet

Could cisco router 2800 series work under BGP protocol for internet ?

 

thx


_____________________________________________________________________

Note: The information contained in this e-mail is intended only for the use of the individual or entity named above and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If you are not the intended party to receive the message and its attachment(s), you are hereby notified that any dissemination, distribution or copy of the message is strictly prohibited. Please immediately notify the sender and delete the message as soon as possible. Thank you for kind attention.
 
Catatan: Informasi yang terdapat dalam e-mail ini ditujukan hanya untuk penggunaan individu atau kelompok yang disebutkan di atas dan mungkin berisi informasi yang istimewa, rahasia dan dikecualikan dari pengungkapan menurut hukum yang berlaku. Jika Anda bukan pihak yang ditujukan untuk menerima pesan ini beserta lampirannya, dengan ini Anda diberitahukan bahwa penyebaran, pendistribusian atau penyalinan pesan ini adalah sangat dilarang. Harap segera memberitahu pengirim dan menghapus pesan ini secepatnya. Terima kasih atas perhatian Anda.
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From geoff at pendery.net  Fri Jun 12 09:36:25 2009
From: geoff at pendery.net (Geoffrey Pendery)
Date: Fri, 12 Jun 2009 08:36:25 -0500
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
Message-ID: <d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From will at thoughtcrime.net  Fri Jun 12 09:42:11 2009
From: will at thoughtcrime.net (Byrd, William)
Date: Fri, 12 Jun 2009 08:42:11 -0500 (CDT)
Subject: [c-nsp] A question about TACACS+ and controlling command use
Message-ID: <1244814131.v2.mailanyonewebmail-222491@fuse114>

I've done a lot of thinking and searching on this problem and I haven't
been able to figure out any way to solve it. The rest of the Engineers
here have come to the conclusion it just can't be done.

We have a pretty large deployment of Cisco 7200's with the vast majority
being carded out with PA-MC-2T3 cards. Typically a customer will order a
DS1 or several DS1's which will be delivered MLPPP to the customer.

As we do not currently have any automation tools in place to provision or
remove old provisioning for customers we frequently end up in situations
where a technician building or removing a customer has shutdown a DS3 and
taken down a lot of customers.

The obvious answer is to restrict the use of the shutdown command.
Unfortunately the technicians that often make the mistakes have to be able
to use the command to shut down Serial or Ethernet interfaces in the
course of their work.

As TACACS is setup to basically permit or deny the use of the command I
can't find a way to restrict it on say a T3 controller but permit it for
everything else; example:

        cmd = no
                {
                        permit ^shutdown.<cr>$
                        deny .*

        cmd = shutdown
                {
                        permit .*
                }

Anyone ever deal with a similar problem and find a good solution to it?

-Will

From BBlackford at nwresd.k12.or.us  Fri Jun 12 09:51:17 2009
From: BBlackford at nwresd.k12.or.us (Bill Blackford)
Date: Fri, 12 Jun 2009 06:51:17 -0700
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
Message-ID: <6069A203FD01884885C037F81DD7508016CE1890F4@wsc-mail-01.intra.nwresd.k12.or.us>

Your question is one of mine as well. I plan to from EC's across the 6548 and a 6516-GBIC (yes copper and fiber).

So does this essentially mean that every 6 ports has its own gig ASIC? So, I'd have to stagger like: 1/1, 1/7, 1/13, etc.?

Now, if what you're reporting is correct (I'm sure it is), then I'm not getting much more benefit going with the 6548. I know I can only get a standard MTU with this line card as well. I could consider the 6148A if I really wanted jumbo's, but that's not very high on my list of wants. The 6748 is out of budget range at this time unfortunately.

Thanks for your input.

-b

-----Original Message-----
From: gpendery at gmail.com [mailto:gpendery at gmail.com] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 6:36 AM
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From Ian.Mackinnon at lumison.net  Fri Jun 12 09:54:01 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Fri, 12 Jun 2009 14:54:01 +0100
Subject: [c-nsp] A question about TACACS+ and controlling command use
In-Reply-To: <1244814131.v2.mailanyonewebmail-222491@fuse114>
References: <1244814131.v2.mailanyonewebmail-222491@fuse114>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D9444FD4@nbg01-exch-01.entlstaff.domain.lumison.net>

Don't know if this would work, but why not bar them from the controller command instead
Ie
Conf t
Controller T3 1/0 -----Block this command
shut

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Byrd, William
> Sent: 12 June 2009 14:42
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] A question about TACACS+ and controlling command use
>
> I've done a lot of thinking and searching on this problem and I haven't
> been able to figure out any way to solve it. The rest of the Engineers
> here have come to the conclusion it just can't be done.
>
> We have a pretty large deployment of Cisco 7200's with the vast
> majority
> being carded out with PA-MC-2T3 cards. Typically a customer will order
> a
> DS1 or several DS1's which will be delivered MLPPP to the customer.
>
> As we do not currently have any automation tools in place to provision
> or
> remove old provisioning for customers we frequently end up in
> situations
> where a technician building or removing a customer has shutdown a DS3
> and
> taken down a lot of customers.
>
> The obvious answer is to restrict the use of the shutdown command.
> Unfortunately the technicians that often make the mistakes have to be
> able
> to use the command to shut down Serial or Ethernet interfaces in the
> course of their work.
>
> As TACACS is setup to basically permit or deny the use of the command I
> can't find a way to restrict it on say a T3 controller but permit it
> for
> everything else; example:
>
>         cmd = no
>                 {
>                         permit ^shutdown.<cr>$
>                         deny .*
>
>         cmd = shutdown
>                 {
>                         permit .*
>                 }
>
> Anyone ever deal with a similar problem and find a good solution to it?
>
> -Will
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From will at thoughtcrime.net  Fri Jun 12 09:56:56 2009
From: will at thoughtcrime.net (Byrd, William)
Date: Fri, 12 Jun 2009 08:56:56 -0500 (CDT)
Subject: [c-nsp] A question about TACACS+ and controlling command use
Message-ID: <1244815016.v2.mailanyonewebmail-222491@fuse113>

Unfortunately since they need access to build channel-groups for customer
DS1 transport this isn't an option. :-(

-Will

----- Original Message -----
From: "Ian MacKinnon" <ian.mackinnon at lumison.net>
Sent: Fri, June 12, 2009 9:54
Subject:RE: [c-nsp] A question about TACACS+ and controlling command use


Don't know if this would work, but why not bar them from the controller
command instead
Ie
Conf t
Controller T3 1/0 -----Block this command
shut

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Byrd, William
> Sent: 12 June 2009 14:42
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] A question about TACACS+ and controlling command use
>
> I've done a lot of thinking and searching on this problem and I haven't
> been able to figure out any way to solve it. The rest of the Engineers
> here have come to the conclusion it just can't be done.
>
> We have a pretty large deployment of Cisco 7200's with the vast
> majority
> being carded out with PA-MC-2T3 cards. Typically a customer will order
> a
> DS1 or several DS1's which will be delivered MLPPP to the customer.
>
> As we do not currently have any automation tools in place to provision
> or
> remove old provisioning for customers we frequently end up in
> situations
> where a technician building or removing a customer has shutdown a DS3
> and
> taken down a lot of customers.
>
> The obvious answer is to restrict the use of the shutdown command.
> Unfortunately the technicians that often make the mistakes have to be
> able
> to use the command to shut down Serial or Ethernet interfaces in the
> course of their work.
>
> As TACACS is setup to basically permit or deny the use of the command I
> can't find a way to restrict it on say a T3 controller but permit it
> for
> everything else; example:
>
>         cmd = no
>                 {
>                         permit ^shutdown.<cr>$
>                         deny .*
>
>         cmd = shutdown
>                 {
>                         permit .*
>                 }
>
> Anyone ever deal with a similar problem and find a good solution to it?
>
> -Will
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.



----- End of original message -----


From jared at puck.nether.net  Fri Jun 12 11:33:23 2009
From: jared at puck.nether.net (Jared Mauch)
Date: Fri, 12 Jun 2009 11:33:23 -0400
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <6069A203FD01884885C037F81DD7508016CE1890F4@wsc-mail-01.intra.nwresd.k12.or.us>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<6069A203FD01884885C037F81DD7508016CE1890F4@wsc-mail-01.intra.nwresd.k12.or.us>
Message-ID: <E0495A97-0849-4941-84F2-DD728D39D28D@puck.nether.net>


On Jun 12, 2009, at 9:51 AM, Bill Blackford wrote:

> Your question is one of mine as well. I plan to from EC's across the  
> 6548 and a 6516-GBIC (yes copper and fiber).
>
> So does this essentially mean that every 6 ports has its own gig  
> ASIC? So, I'd have to stagger like: 1/1, 1/7, 1/13, etc.?

You can see the port ASIC mapping with the following command: (note  
the 1-12 or 1-8 grouping)

Router#show interfaces f3/1 capabilities
FastEthernet3/1
   Dot1x:                 yes
   Model:                 WS-X6348-RJ-45
   Type:                  10/100BaseTX
   Speed:                 10,100,auto
   Duplex:                half,full
   Trunk encap. type:     802.1Q,ISL
   Trunk mode:            on,off,desirable,nonegotiate
   Channel:               yes
   Broadcast suppression: percentage(0-100)
   Flowcontrol:           rx-(off,on),tx-(none)
   Membership:            static
   Fast Start:            yes
   QOS scheduling:        rx-(1q4t), tx-(2q2t)
   CoS rewrite:           yes
   ToS rewrite:           yes
   Inline power:          no
   SPAN:                  source/destination
   UDLD                   yes
   Link Debounce:         yes
   Link Debounce Time:    no
   Ports on ASIC:         1-12
   Port-Security:         yes

Router#sh int g1/1 cap
GigabitEthernet1/1
   Model:                 WS-X6416-GBIC
   Type:                  1000BaseSX
   Speed:                 1000
   Duplex:                full
   Trunk encap. type:     802.1Q,ISL
   Trunk mode:            on,off,desirable,nonegotiate
   Channel:               yes
   Broadcast suppression: percentage(0-100)
   Flowcontrol:           rx-(off,on,desired),tx-(off,on,desired)
   Membership:            static
   Fast Start:            yes
   QOS scheduling:        rx-(1p1q4t), tx-(1p2q2t)
   QOS queueing mode:     rx-(cos), tx-(cos)
   CoS rewrite:           yes
   ToS rewrite:           yes
   Inline power:          no
   SPAN:                  source/destination
   UDLD                   yes
   Link Debounce:         yes
   Link Debounce Time:    yes
   Ports on ASIC:         1-8
   Remote switch uplink:  yes
   Dot1x:                 yes
   Port-Security:         yes


From kloch at kl.net  Fri Jun 12 11:42:45 2009
From: kloch at kl.net (Kevin Loch)
Date: Fri, 12 Jun 2009 11:42:45 -0400
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A31548E.3080501@imperial.ac.uk>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
Message-ID: <4A327775.8050800@kl.net>

Phil Mayers wrote:
> Kevin Loch wrote:
> 
>>>
>>> Unfortunately, Cisco's partners are useless.  They propose 6509s 
>>> without the DFCs, which we know will fall over.  
>>
>> Well that depends...
>>
>> The DFC's only do next-hop (tcam) lookups and netflow.  All packets are
>> switched on the centralized PFC.  Each line card has two 20Gbit/s
> 
> ?ukasz has already addressed this; suffice to say he's right, and the 
> above is not correct. A TCAM lookup *is* the forwarding operation, and 
> the DFC has all information required locally to switch the packet (via 
> the fabric) to the output linecard, and does so.

After re-reading this:

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd80673385.html

I shouldn't have said PFC. The fabric is on the supervisor card itself
not the PFC.  What I meant was the packet is always sent to the
centralized switch fabric on the active supervisor card regardless of
where the lookups/acl are done.

The important point is that the lookup limitations (mpps) are
different than the fabric bandwidth limitations (gbps) because of how
these functions are separated on the cef720/dcef720 platform.

A 6509 should not "fall over without DFC's" unless you are doing more
than 30mpps.  That is 15gbit/s of 64 byte packets or 360gbit/s of
1500 byte packets.

- Kevin

From petelists at templin.org  Fri Jun 12 11:34:14 2009
From: petelists at templin.org (Pete Templin)
Date: Fri, 12 Jun 2009 10:34:14 -0500
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
Message-ID: <4A327576.4040004@templin.org>

Geoffrey Pendery wrote:

> I have a question of my own, since this subject has come up a time or
>  two - regarding the 6148's, the statement is made a couple times
> that Etherchannel will get you port redundancy but no extra
> bandwidth, since the ASIC is only a gig.  But if I distribute my
> channel across two slots, say Gig 1/1 and Gig 2/1, does that get me
> around the gig limit?  Or even Gig 1/1 and Gig 1/48, since it's
> separate ASICs? Logic tells me yes, but I've heard the "1 gig limit"
> mentioned as if it's a hard platform limitation, not just a result of
> a particular bottleneck.  My instinctive behavior with channels is to
> span them across blades anyway, to guard against blade failure....

My understanding (since my google-fu won't find a quickie answer at the 
moment) is that 6148s copy any EtherChannel frames to every ASIC on the 
card, so you can get to 2G by spreading over two cards, but you're still 
limited to 1G no matter no many controllers you cover within a 6148.  :(

We've updated the banners on all relevant 6148-loaded chassis to remind 
folks to never build EtherChannels on those cards.  Oh well...

pt

From Jeff.Wojciechowski at midlandpaper.com  Fri Jun 12 12:07:23 2009
From: Jeff.Wojciechowski at midlandpaper.com (Jeff Wojciechowski)
Date: Fri, 12 Jun 2009 11:07:23 -0500
Subject: [c-nsp] ASA 5510 Configuration Replication Failure
In-Reply-To: <6B8401A83219DF499C34DEAEE9A599921015AED808@XBOX.midlandpaper.com>
References: <6B8401A83219DF499C34DEAEE9A599921015AED7E9@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C52C6@zy-ex1.zyedge.local>
	<6B8401A83219DF499C34DEAEE9A599921015AED7FC@XBOX.midlandpaper.com>
	<6E21B2BDEF6E714EA0B5BA8D5D0E140124835C5305@zy-ex1.zyedge.local>
	<6B8401A83219DF499C34DEAEE9A599921015AED808@XBOX.midlandpaper.com>
Message-ID: <6B8401A83219DF499C34DEAEE9A599921015AED811@XBOX.midlandpaper.com>

OK - found the REAL issue now.

My standby unit turned into a brick on me :o) I actually SAW it happen. All the link lights went out at once.

Thanks again for the help.

-Jeff

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Jeff Wojciechowski
Sent: Thursday, June 11, 2009 4:24 PM
To: Ryan West
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] ASA 5510 Configuration Replication Failure

Ryan -

Solved... for now at least...

Still using straight thru cable for synch interface I upgraded to 8.21 - based on the following bug IDs:

CSCsu88174
CSCsw98373
CSCsy21727
CSCsz63217

For the record the sh run | inc fail:

failover lan unit primary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.20.20.6 255.255.255.0 standby 172.20.20.7

and 

failover lan unit secondary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.20.20.6 255.255.255.0 standby 172.20.20.7

Thanks again,

-Jeff


-----Original Message-----
From: Ryan West [mailto:rwest at zyedge.com] 
Sent: Thursday, June 11, 2009 4:17 PM
To: Jeff Wojciechowski
Cc: cisco-nsp at puck.nether.net
Subject: RE: ASA 5510 Configuration Replication Failure

Have you tried a crossover?  Can you post 'show run failover' ?  A console on the standby firewall might reveal something during the replication process too.

-ryan


<snipped>

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From ip at ioshints.info  Fri Jun 12 12:36:42 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Fri, 12 Jun 2009 18:36:42 +0200
Subject: [c-nsp] A question about TACACS+ and controlling command use
In-Reply-To: <1244814131.v2.mailanyonewebmail-222491@fuse114>
References: <1244814131.v2.mailanyonewebmail-222491@fuse114>
Message-ID: <001201c9eb7b$f89db680$0a00000a@nil.si>

> The obvious answer is to restrict the use of the shutdown command.
> Unfortunately the technicians that often make the mistakes 
> have to be able to use the command to shut down Serial or 
> Ethernet interfaces in the course of their work.

Something along the lines of this EEM Tcl policies:

http://wiki.nil.com/Display_configuration_sections_while_configuring_the_rou
ter

Write one Tcl policy that recognizes the interface name and saves it with
appl_setinfo. The other Tcl policy should recognize the "shutdown" command,
retrieve the saved interface name and check it.

Not too elegant, but working.

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


From mulitskiy at acedsl.com  Fri Jun 12 12:46:01 2009
From: mulitskiy at acedsl.com (Michael Ulitskiy)
Date: Fri, 12 Jun 2009 12:46:01 -0400
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <4A327576.4040004@templin.org>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<4A327576.4040004@templin.org>
Message-ID: <200906121246.01415.mulitskiy@acedsl.com>

On Friday 12 June 2009 11:34:14 am Pete Templin wrote:
> Geoffrey Pendery wrote:
> 
> > I have a question of my own, since this subject has come up a time or
> >  two - regarding the 6148's, the statement is made a couple times
> > that Etherchannel will get you port redundancy but no extra
> > bandwidth, since the ASIC is only a gig.  But if I distribute my
> > channel across two slots, say Gig 1/1 and Gig 2/1, does that get me
> > around the gig limit?  Or even Gig 1/1 and Gig 1/48, since it's
> > separate ASICs? Logic tells me yes, but I've heard the "1 gig limit"
> > mentioned as if it's a hard platform limitation, not just a result of
> > a particular bottleneck.  My instinctive behavior with channels is to
> > span them across blades anyway, to guard against blade failure....
> 
> My understanding (since my google-fu won't find a quickie answer at the 
> moment) is that 6148s copy any EtherChannel frames to every ASIC on the 
> card, so you can get to 2G by spreading over two cards, but you're still 
> limited to 1G no matter no many controllers you cover within a 6148.  :(
> 
> We've updated the banners on all relevant 6148-loaded chassis to remind 
> folks to never build EtherChannels on those cards.  Oh well...

My understanding was that every EtherChannel frame is delivered (by Sup) to every
ASIC involved (has a port) in EtherChannel regardless of which card it is on.
So you can't get more than 1G even if you distribute your EtherChannel over several cards.
Am I wrong?

Michael

From tstevens at cisco.com  Fri Jun 12 14:22:00 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Fri, 12 Jun 2009 11:22:00 -0700
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <200906121246.01415.mulitskiy@acedsl.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
	<4A327576.4040004@templin.org>
	<200906121246.01415.mulitskiy@acedsl.com>
Message-ID: <200906121822.n5CIM8vC018410@sj-core-2.cisco.com>

You are correct. That only applies to the 6148. Originally it also 
applied to the 6548 as well, but that limitation was removed later by 
s/w optimizations in the LTL programming scheme. So you *can* get 
more than 1G thru an etherchannel with 6548s, but of course, you 
still can only get 1G max thru a given port group on the card.

All the other restrictions of the 6148 (eg, no jumbos) still apply to 6548.

HTH,
Tim


At 09:46 AM 6/12/2009, Michael Ulitskiy muttered:

>On Friday 12 June 2009 11:34:14 am Pete Templin wrote:
> > Geoffrey Pendery wrote:
> >
> > > I have a question of my own, since this subject has come up a time or
> > >  two - regarding the 6148's, the statement is made a couple times
> > > that Etherchannel will get you port redundancy but no extra
> > > bandwidth, since the ASIC is only a gig.  But if I distribute my
> > > channel across two slots, say Gig 1/1 and Gig 2/1, does that get me
> > > around the gig limit?  Or even Gig 1/1 and Gig 1/48, since it's
> > > separate ASICs? Logic tells me yes, but I've heard the "1 gig limit"
> > > mentioned as if it's a hard platform limitation, not just a result of
> > > a particular bottleneck.  My instinctive behavior with channels is to
> > > span them across blades anyway, to guard against blade failure....
> >
> > My understanding (since my google-fu won't find a quickie answer at the
> > moment) is that 6148s copy any EtherChannel frames to every ASIC on the
> > card, so you can get to 2G by spreading over two cards, but you're still
> > limited to 1G no matter no many controllers you cover within a 6148.  :(
> >
> > We've updated the banners on all relevant 6148-loaded chassis to remind
> > folks to never build EtherChannels on those cards.  Oh well...
>
>My understanding was that every EtherChannel frame is delivered (by 
>Sup) to every
>ASIC involved (has a port) in EtherChannel regardless of which card it is on.
>So you can't get more than 1G even if you distribute your 
>EtherChannel over several cards.
>Am I wrong?
>
>Michael
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
><https://puck.nether.net/mailman/listinfo/cisco-nsp>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at 
><http://puck.nether.net/pipermail/cisco-nsp/>http://puck.nether.net/pipermail/cisco-nsp/




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From jrhett at netconsonance.com  Fri Jun 12 15:58:36 2009
From: jrhett at netconsonance.com (Jo Rhett)
Date: Fri, 12 Jun 2009 12:58:36 -0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A327775.8050800@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
Message-ID: <AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>

On Jun 12, 2009, at 8:42 AM, Kevin Loch wrote:
>> ?ukasz has already addressed this; suffice to say he's right, and  
>> the above is not correct. A TCAM lookup *is* the forwarding  
>> operation, and the DFC has all information required locally to  
>> switch the packet (via the fabric) to the output linecard, and does  
>> so.
>
> I shouldn't have said PFC. The fabric is on the supervisor card itself
> not the PFC.  What I meant was the packet is always sent to the
> centralized switch fabric on the active supervisor card regardless of
> where the lookups/acl are done.

Just for information, I know very intimately how this stuff works and  
don't need you to explain it to me.  I haven't objected yet because  
others might find this interesting.  (and FYI, your last sentence is  
wrong too if DFCs exist on each card)

> The important point is that the lookup limitations (mpps) are
> different than the fabric bandwidth limitations (gbps) because of how
> these functions are separated on the cef720/dcef720 platform.
>
> A 6509 should not "fall over without DFC's" unless you are doing more
> than 30mpps.  That is 15gbit/s of 64 byte packets or 360gbit/s of
> 1500 byte packets.


Sorry, let me back up and explain again.  I've been dealing with Cisco  
for 20 years now.   And I very well know Cisco's ability to super- 
inflate their packet handling ability.  And specifically, I have run  
6509 systems into the ground with a mere 500mb/sec of traffic.

Their whole MPPS statistics are based on perfect-world scenarios that  
don't exist.  And honestly, I have on 5 different occasions had the  
opportunity to push Cisco to prove those numbers, and they have failed  
to do so IN A LAB THEY DESIGNED JUST TO DO SO.

So ... yeah.   Don't go believing those statistics.

Now let's talk about reality: 1/10 inbound/outbound ratios, 5% of  
received traffic is Internet cruft requiring (wasted) TCAM lookups,  
etc and such forth than any provider peering router observes, and  
you're down to a much lower ratio.  Fail to install DFCs and you'll  
find your 6509s falling over with just a few gigabits of traffic.    
30mpps versus 48mpps gives an illusion that DFCs only give you another  
50%, but that's not reality on the ground.  Don't try and persuade me  
otherwise, I've seen this repeatedly in real life environments.

Now, let's stop talking about non-DFC cards and start talking about  
equipment which can handle uRPF on every port, full Netflow analysis  
of up to 8 ports at a time, every port layer 3, every port filtered,  
colo facility core/peering.

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness




From ross at kallisti.us  Fri Jun 12 16:52:02 2009
From: ross at kallisti.us (Ross Vandegrift)
Date: Fri, 12 Jun 2009 16:52:02 -0400
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A327775.8050800@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
Message-ID: <20090612205202.GC10390@kallisti.us>

On Fri, Jun 12, 2009 at 11:42:45AM -0400, Kevin Loch wrote:
> A 6509 should not "fall over without DFC's" unless you are doing more
> than 30mpps.  That is 15gbit/s of 64 byte packets or 360gbit/s of
> 1500 byte packets.

Hah, keep drinking the cool aid!  I have a pair of 6500s ready to fall
over at about 150kpps.  All WS-67xx LAN cards with DFCs.  CPU averages
60% and often maxes.  TAC says that this is within the parameters of
normal performance given the role as datacenter aggregation routers.

No netflow, no uRPF, no multicast, no IPv6, no BFD, no MPLS, no ACLs
in the forwarding plane.  Very basic OSPF, BGP, and MSTP.  About 2000
VLANs, 80% of which have associated layer 3 SVIs.

On the other hand, I have other 6500s with identical hardware
inventory and almost identical config where performance is a complete
non-issue.  I've seen a 6500 in a near-optimal situation switch
2-3Mpps.  I'll believe 30Mpps when I see a 7200 NPE-G1 hit 1Mpps :)

-- 
Ross Vandegrift
ross at kallisti.us

"If the fight gets hot, the songs get hotter.  If the going gets tough,
the songs get tougher."
	--Woody Guthrie

From scubacuda at gmail.com  Fri Jun 12 17:09:54 2009
From: scubacuda at gmail.com (Rogelio)
Date: Fri, 12 Jun 2009 14:09:54 -0700
Subject: [c-nsp] LACP + Wi-Fi = ghettofabulous big wireless pipes?
Message-ID: <4A32C422.6030509@gmail.com>

I've got several outdoor Wi-Fi radios that I would like to configure in 
a PtP configuration on multiple 802.11a channels.

My question to the list is, "Can I use LACP on each end (via a network 
switch) to aggregate those PtP connections into one virtual connection?"

e.g.

http://www.cisco.com/en/US/tech/tk389/tk213/technologies_configuration_example09186a0080094470.shtml

So, instead of using ethernet to each switch, I'm connecting an ethernet 
cable from my switch into the 100 Mbps LIM of the radio node, creating a 
PtP link across an area, then coming out that other radio's 100 Mbps LIM 
via ethernet into another LACP-friendly switch.

So, on each port, there is something like...

switch->ethernet->radio-> 5 GHz PtP link->radio->ethernet->switch

Any feedback on this?

From peter at rathlev.dk  Fri Jun 12 18:03:13 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Sat, 13 Jun 2009 00:03:13 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
Message-ID: <1244844193.9252.17.camel@localhost.localdomain>

On Fri, 2009-06-12 at 12:58 -0700, Jo Rhett wrote:
> Now let's talk about reality: 1/10 inbound/outbound ratios, 5% of  
> received traffic is Internet cruft requiring (wasted) TCAM lookups,  
> etc and such forth than any provider peering router observes, and  
> you're down to a much lower ratio.  Fail to install DFCs and you'll  
> find your 6509s falling over with just a few gigabits of traffic.    
> 30mpps versus 48mpps gives an illusion that DFCs only give you another  
> 50%, but that's not reality on the ground.  Don't try and persuade me  
> otherwise, I've seen this repeatedly in real life environments.

I tend to agree with this (and your points generally btw), especially
when looking carefully at the subject of this thread. I'd still say "it
depends" though. Sometimes a non DFC enabled box would do the job fine.
It's (mostly) not like the box dies doing nothing. :-)

I would even suspect that many C6k/Sup720s are probably using very
little of their capacity. It's targeted at the enterprise, and I've seen
3BXL boxes in 6 node networks with ~ 50 prefixes in OSPF and nothing
else. I would therefore say that _sometimes_ someone from Cisco or a
partner might upsell a little.

The people that are genuinely worried about the performance would also
know what to do about it and where to look for alternatives.

> Now, let's stop talking about non-DFC cards and start talking about  
> equipment which can handle uRPF on every port, full Netflow analysis  
> of up to 8 ports at a time, every port layer 3, every port filtered,  
> colo facility core/peering.

If this is the target then 6500/7600 isn't really the best tool IMHO.

Regards,
Peter



From irsk.inc at gmail.com  Fri Jun 12 18:20:10 2009
From: irsk.inc at gmail.com (Rishi Kochar)
Date: Fri, 12 Jun 2009 17:20:10 -0500
Subject: [c-nsp] EEM - action syslog working but action cli command working
In-Reply-To: <744b72620906121505o673e2e3cu57dbd973941c2f58@mail.gmail.com>
References: <744b72620906121505o673e2e3cu57dbd973941c2f58@mail.gmail.com>
Message-ID: <744b72620906121520i7c74feb6g5cea15d4a7dfd409@mail.gmail.com>

Hi

I am trying to develop a small EEM applet to test shut a port when an event
on the port occurs.

The script i have written is
event manager applet EMSHUT
event syslog occurs 1 pattern <my pattern>
action 1.0 syslog priority emergencies msg "HELLO"
action 1.1 cli command "enable"
action 1.2 cli command "conf t"
action 1.3 cli command "voice-port 0/1/1"
action 1.4 cli command "shut"


This script is printing HELLO in syslogs but wont shut down the voice-port.

Any help on this will be highly appreciated

Thanks
Inder

From tom at netspot.com.au  Fri Jun 12 22:27:53 2009
From: tom at netspot.com.au (Tom Lanyon)
Date: Sat, 13 Jun 2009 11:57:53 +0930
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <1244844193.9252.17.camel@localhost.localdomain>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
Message-ID: <A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>


On 13/06/2009, at 7:33 AM, Peter Rathlev wrote:
>> Now, let's stop talking about non-DFC cards and start talking about
>> equipment which can handle uRPF on every port, full Netflow analysis
>> of up to 8 ports at a time, every port layer 3, every port filtered,
>> colo facility core/peering.
>
> If this is the target then 6500/7600 isn't really the best tool IMHO.


Was the original intention of this thread not to find out exactly what  
*is* the best tool for the above scenario? :)

Regards,
Tom

From rdobbins at arbor.net  Fri Jun 12 23:40:11 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Sat, 13 Jun 2009 10:40:11 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090612205202.GC10390@kallisti.us>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net> <20090612205202.GC10390@kallisti.us>
Message-ID: <6C53A0D1-AD1F-4365-9125-3EDBA1EB64AC@arbor.net>


On Jun 13, 2009, at 3:52 AM, Ross Vandegrift wrote:

>  I have a pair of 6500s ready to fall over at about 150kpps.


It sounds as if you've a lot of stuff being punted, which should bear  
further investigation.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From rdobbins at arbor.net  Fri Jun 12 23:43:51 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Sat, 13 Jun 2009 10:43:51 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
	<A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
Message-ID: <FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>


On Jun 13, 2009, at 9:27 AM, Tom Lanyon wrote:

> Was the original intention of this thread not to find out exactly  
> what *is* the best tool for the above scenario? :)

GSR w/E3 or E5 LCs, ASR 1K, CRS-1, or N7K, depending upon the  
circumstances (note initial FIB-size limitation on N7K; I don't know  
if newer hardware has yet been introduced which raises this ceiling,  
Tim or someone else with clue will surely clarify).

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From ip at ioshints.info  Sat Jun 13 01:21:07 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Sat, 13 Jun 2009 07:21:07 +0200
Subject: [c-nsp] EEM - action syslog working but action cli command
	working
In-Reply-To: <744b72620906121520i7c74feb6g5cea15d4a7dfd409@mail.gmail.com>
References: <744b72620906121505o673e2e3cu57dbd973941c2f58@mail.gmail.com>
	<744b72620906121520i7c74feb6g5cea15d4a7dfd409@mail.gmail.com>
Message-ID: <005901c9ebe6$c21e4960$0a00000a@nil.si>

Could be yet another prompt-related EEM bug. See

http://blog.ioshints.info/2008/02/fix-bugs-in-eem-action-cli.html
http://blog.ioshints.info/2007/12/execute-cli-commands-with-prompts-in.html
 
Use the EEM debugging (debug event man action cli) to verify what's going
on.

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/

> -----Original Message-----
> From: Rishi Kochar [mailto:irsk.inc at gmail.com] 
> Sent: Saturday, June 13, 2009 12:20 AM
> To: cisco-nsp
> Subject: [c-nsp] EEM - action syslog working but action cli 
> command working
> 
> Hi
> 
> I am trying to develop a small EEM applet to test shut a port 
> when an event on the port occurs.
> 
> The script i have written is
> event manager applet EMSHUT
> event syslog occurs 1 pattern <my pattern> action 1.0 syslog 
> priority emergencies msg "HELLO"
> action 1.1 cli command "enable"
> action 1.2 cli command "conf t"
> action 1.3 cli command "voice-port 0/1/1"
> action 1.4 cli command "shut"
> 
> 
> This script is printing HELLO in syslogs but wont shut down 
> the voice-port.
> 
> Any help on this will be highly appreciated
> 
> Thanks
> Inder
> 
> 


From jrhett at netconsonance.com  Sat Jun 13 01:34:11 2009
From: jrhett at netconsonance.com (Jo Rhett)
Date: Fri, 12 Jun 2009 22:34:11 -0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <1244844193.9252.17.camel@localhost.localdomain>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
Message-ID: <F6821C62-A9D5-4B89-81BB-A20ABB516CA5@netconsonance.com>

>> Now, let's stop talking about non-DFC cards and start talking about
>> equipment which can handle uRPF on every port, full Netflow analysis
>> of up to 8 ports at a time, every port layer 3, every port filtered,
>> colo facility core/peering.

On Jun 12, 2009, at 3:03 PM, Peter Rathlev wrote:
> If this is the target then 6500/7600 isn't really the best tool IMHO.


I suspected as much.  Honestly, I'm aiming for an MX480 ;-)  But I  
need to determine the comparable Cisco product(s) and get them listed  
on the comparison sheet.

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness




From lukasz at bromirski.net  Sat Jun 13 07:20:35 2009
From: lukasz at bromirski.net (=?ISO-8859-2?Q?=A3ukasz_Bromirski?=)
Date: Sat, 13 Jun 2009 13:20:35 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090612205202.GC10390@kallisti.us>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>	<4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk>	<4A327775.8050800@kl.net>
	<20090612205202.GC10390@kallisti.us>
Message-ID: <4A338B83.2010405@bromirski.net>

On 2009-06-12 22:52, Ross Vandegrift wrote:

> No netflow, no uRPF, no multicast, no IPv6, no BFD, no MPLS, no ACLs
> in the forwarding plane.  Very basic OSPF, BGP, and MSTP.  About 2000
> VLANs, 80% of which have associated layer 3 SVIs.

Something is killing the CPU with that config though, just as Roland
remarked. You should escalate that with TAC, or use CoPP to lower the
load RP is taking and look for root cause.

> On the other hand, I have other 6500s with identical hardware
> inventory and almost identical config where performance is a complete
> non-issue.  I've seen a 6500 in a near-optimal situation switch
> 2-3Mpps.  I'll believe 30Mpps when I see a 7200 NPE-G1 hit 1Mpps :)

A couple of people on this list claimed they have 6500s doing a
200-300Mpps without a problem, search the archives. I'm logged via SSH
to a 6500 that is doing over 80Mpps right now and load stays at 2-5%,
with ACLs, uRPF, three full BGP feeds and some QoS.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From lukasz at bromirski.net  Sat Jun 13 07:23:13 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sat, 13 Jun 2009 13:23:13 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A327775.8050800@kl.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>	<4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk> <4A327775.8050800@kl.net>
Message-ID: <4A338C21.1010604@bromirski.net>

On 2009-06-12 17:42, Kevin Loch wrote:

> A 6509 should not "fall over without DFC's" unless you are doing more
> than 30mpps. That is 15gbit/s of 64 byte packets or 360gbit/s of
> 1500 byte packets.

It should 'fall over' even if the traffic will rise, and there won't
be enough PFC Mpps to do the work - simply switch fabric channels
will fill up with traffic going to the PFC. Adding DFCs will increase
the performance in terms of pps in that situation - people do this all
the time when their configs top the performance envelope of the current
setup.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From lukasz at bromirski.net  Sat Jun 13 07:49:46 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sat, 13 Jun 2009 13:49:46 +0200
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <4A338C21.1010604@bromirski.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>	<4A313392.60604@kl.net>	<4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net> <4A338C21.1010604@bromirski.net>
Message-ID: <4A33925A.4030700@bromirski.net>

On 2009-06-13 13:23, ?ukasz Bromirski wrote:

> It should 'fall over'

It *shouldn't* of course. My bad :)

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From arla at rn.dk  Sat Jun 13 08:26:11 2009
From: arla at rn.dk (Arne Larsen / Region Nordjylland)
Date: Sat, 13 Jun 2009 14:26:11 +0200
Subject: [c-nsp] vs tacacs+ on Nexus 5010
Message-ID: <8D68760F464FFD40A01BF2FB374E4A28016554CE82BB@SRVEXC02.aas.its.nja.dk>

Hi Folks.

Does anyone off you have a Nexus 5010 running under tacacs+ freeware.
I can't find any doc. regarding the respond the Nexus need to authorize users.
How does one setup restricted users, like a user that only has the permissions to use show commands.
The box users ether plain pap or chap login, does anyone know why this is different from a "normal" Cisco box.

/Arne

From ltd at cisco.com  Sat Jun 13 10:09:04 2009
From: ltd at cisco.com (Lincoln Dale)
Date: Sun, 14 Jun 2009 00:09:04 +1000
Subject: [c-nsp] vs tacacs+ on Nexus 5010
In-Reply-To: <8D68760F464FFD40A01BF2FB374E4A28016554CE82BB@SRVEXC02.aas.its.nja.dk>
References: <8D68760F464FFD40A01BF2FB374E4A28016554CE82BB@SRVEXC02.aas.its.nja.dk>
Message-ID: <4A33B300.9090601@cisco.com>

Arne Larsen / Region Nordjylland wrote:
> Hi Folks.
>
> Does anyone off you have a Nexus 5010 running under tacacs+ freeware.
> I can't find any doc. regarding the respond the Nexus need to authorize users.
> How does one setup restricted users, like a user that only has the permissions to use show commands.
> The box users ether plain pap or chap login, does anyone know why this is different from a "normal" Cisco box.
>   
NX-OS / Nexus platforms use RBAC.
Nexus 7000 documentation shows this, i'm sure N5K docs do too, but i 
have N7K handy.  see 
http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_tacacsplus.html#wp1511744

see 
http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_tacacsplus.html#wp1511711 
for details on how to specify the role using a VSA.


cheers,

lincoln.

From bacon at walleyesoftware.com  Sat Jun 13 17:41:28 2009
From: bacon at walleyesoftware.com (Jeff Bacon)
Date: Sat, 13 Jun 2009 16:41:28 -0500
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <mailman.61.1244822841.2287.cisco-nsp@puck.nether.net>
References: <mailman.61.1244822841.2287.cisco-nsp@puck.nether.net>
Message-ID: <5A69C25361FED34F83ABF05F5047524505CD804E@wally.walleyetrading.net>



> Date: Fri, 12 Jun 2009 06:51:17 -0700
> From: Bill Blackford <BBlackford at nwresd.k12.or.us>
> To: Geoffrey Pendery <geoff at pendery.net>
> Cc: "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>
> Subject: 
> Message-ID:
> 	<6069A203FD01884885C037F81DD7508016CE1890F4 at wsc-mail-
> 01.intra.nwresd.k12.or.us>
> 
> Content-Type: text/plain; charset="iso-8859-1"
> 
> Your question is one of mine as well. I plan to from EC's across the
6548
> and a 6516-GBIC (yes copper and fiber).
> 
> So does this essentially mean that every 6 ports has its own gig ASIC?
So,
> I'd have to stagger like: 1/1, 1/7, 1/13, etc.?
> 
> Now, if what you're reporting is correct (I'm sure it is), then I'm
not
> getting much more benefit going with the 6548. I know I can only get a
> standard MTU with this line card as well. I could consider the 6148A
if I
> really wanted jumbo's, but that's not very high on my list of wants.
The
> 6748 is out of budget range at this time unfortunately.

I had 6548s. I found out about the ASIC limitation by IOS helpfully
telling me when I created the EC "do this and your bandwidth is going to
be limited". 

I read the docs more closely, after a brief bout of kicking self for
attempting to save a buck without reading all of the docs. My helpful
rep at World Data gave me a decent trade on the 6548s, had 6748s there
shortly thereafter, and that was the end of that.  

Yes you could on a 6548 and just stagger your ports and I believe that
will perform fine, assuming you otherwise stay within the card's
limitations (e.g. CEF256/8G fabric ports). 

I would give some thought to the 6816As over the 65116s. They seem to be
quite cheap refurb, and otherwise appear to be excellent cards, for
which DFC-3Bs don't cost a ton more should you care. Only downside I've
seen so far is that switchport vlan mapping applies to all 8 ports on
the fabric port/controller, but there appears to be a theme there
anyway. 

-bacon
Cisco-using dilettante


From jhigham at epri.com  Sat Jun 13 20:16:20 2009
From: jhigham at epri.com (Higham, Josh)
Date: Sat, 13 Jun 2009 17:16:20 -0700
Subject: [c-nsp] 4506 - disconnected ports generating traffic?
Message-ID: <4C3B8C75B5899943AEC675BA6DD4627301DEE5C1@uspalex02.epri.com>

I have a very strange bug and am not getting much from my ticket with
Cisco.  I have a switch that has physically disconnected interfaces that
show as up, are generating traffic (input, plus output drops), and logs
show MAC addresses flapping between these interfaces.  Plugging a cable
in (whether or not there is a device at the other end), in some cases
stopped this from happening.

 

Has anyone run across this or similar behavior?

 

1     6  Sup II+10GE 10GE (X2), 1000BaseX (SFP) WS-X4013+10GE      

 2    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 3    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 4    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 5    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 6    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  

 

This interface has nothing connected to it, but not the output drops and
input traffic

 

CLT-ACCESS-B2F1-1#sho int g5/27

GigabitEthernet5/27 is up, line protocol is up (connected)

  Hardware is Gigabit Ethernet Port, address is 0023.5e78.744a (bia
0023.5e78.744a)

  MTU 1500 bytes, BW 100000 Kbit, DLY 10 usec, 

     reliability 255/255, txload 229/255, rxload 229/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 100Mb/s, link type is auto, media type is 10/100/1000-TX

  input flow-control is off, output flow-control is off

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input 05:03:57, output never, output hang never

  Last clearing of "show interface" counters 00:02:41

  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops:
59099365

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  30 second input rate 89862000 bits/sec, 45921 packets/sec

  30 second output rate 89862000 bits/sec, 45921 packets/sec

     6696953 packets input, 1638126423 bytes, 0 no buffer

     Received 6696922 broadcasts (88192 multicasts)

     0 runts, 0 giants, 0 throttles

     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 input packets with dribble condition detected

     6696953 packets output, 1638126423 bytes, 0 underruns

 

These two interfaces have nothing connected:

 

.Jun 14 00:11:35.578 UTC: %C4K_EBM-4-HOSTFLAPPING: Host CI:SC:OX:XX:XX
in vlan 4 is flapping between port Gi5/28 and port Gi5/25

 

(the MAC address that is flapping is from the core switch that this
access switch is linked to)

 

Here is the interface configuration:

 

interface GigabitEthernet5/27

 power inline auto max 7900

 switchport access vlan 4

 switchport trunk encapsulation dot1q

 switchport trunk native vlan 4

 switchport trunk allowed vlan 4,25

 switchport mode access

 load-interval 30

 qos trust dscp

 tx-queue 1

   bandwidth percent 25

 tx-queue 2

   bandwidth percent 25

 tx-queue 3

   bandwidth percent 30

   priority high

   shape percent 30

 tx-queue 4

   bandwidth percent 20

 no cdp enable

 

Thanks for any help or thoughts about what to look at or check.

 

Josh Higham


From avayner at cisco.com  Sat Jun 13 23:48:17 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Sun, 14 Jun 2009 05:48:17 +0200
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C492B2@xmb-ams-331.emea.cisco.com>

Geoffrey,

A small correction. The x6548 is an 8G card, but it has 2 fabric connections, so the limit would be 16G.

As long as you do not use the other 7 ports out of each 8 port group, each port group can give you 1G, but take into consideration that the x6148 is a classic card, so it has no fabric connections, and uses the shared bus.

In general the x6148 is not supposed to be a "core" card. It's for connecting low end desktops etc.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 16:36
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From avayner at cisco.com  Sat Jun 13 23:52:14 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Sun, 14 Jun 2009 05:52:14 +0200
Subject: [c-nsp] x6148 vs. x6548
References: <6069A203FD01884885C037F81DD7508016CE1890E4@wsc-mail-01.intra.nwresd.k12.or.us>
	<d6966e4b0906120636w6d772f9cv49b4dd03e9199419@mail.gmail.com> 
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C492B3@xmb-ams-331.emea.cisco.com>

Guys,

Sorry, I pressed the send button to quickly. The 1Gig limit per etherchannel is still there even between slots for the x6148.

Arie

-----Original Message-----
From: Arie Vayner (avayner) 
Sent: Sunday, June 14, 2009 06:48
To: 'Geoffrey Pendery'; Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] x6148 vs. x6548

Geoffrey,

A small correction. The x6548 is an 8G card, but it has 2 fabric connections, so the limit would be 16G.

As long as you do not use the other 7 ports out of each 8 port group, each port group can give you 1G, but take into consideration that the x6148 is a classic card, so it has no fabric connections, and uses the shared bus.

In general the x6148 is not supposed to be a "core" card. It's for connecting low end desktops etc.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 16:36
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From sagupta at cisco.com  Sun Jun 14 00:00:24 2009
From: sagupta at cisco.com (Sachin Gupta (sagupta))
Date: Sat, 13 Jun 2009 21:00:24 -0700
Subject: [c-nsp] x6148 vs. x6548
Message-ID: <55C7D0A26108FD47BFEDF55BCBFAD93C0806E751@xmb-sjc-229.amer.cisco.com>

The 6548 has a single 8G fabric connection.

Sachin

----- Original Message -----
From: cisco-nsp-bounces at puck.nether.net <cisco-nsp-bounces at puck.nether.net>
To: Geoffrey Pendery <geoff at pendery.net>; Bill Blackford <BBlackford at nwresd.k12.or.us>
Cc: cisco-nsp at puck.nether.net <cisco-nsp at puck.nether.net>
Sent: Sat Jun 13 20:48:17 2009
Subject: Re: [c-nsp] x6148 vs. x6548

Geoffrey,

A small correction. The x6548 is an 8G card, but it has 2 fabric connections, so the limit would be 16G.

As long as you do not use the other 7 ports out of each 8 port group, each port group can give you 1G, but take into consideration that the x6148 is a classic card, so it has no fabric connections, and uses the shared bus.

In general the x6148 is not supposed to be a "core" card. It's for connecting low end desktops etc.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 16:36
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From avayner at cisco.com  Sun Jun 14 02:38:14 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Sun, 14 Jun 2009 08:38:14 +0200
Subject: [c-nsp] x6148 vs. x6548
In-Reply-To: <55C7D0A26108FD47BFEDF55BCBFAD93C0806E751@xmb-sjc-229.amer.cisco.com>
References: <55C7D0A26108FD47BFEDF55BCBFAD93C0806E751@xmb-sjc-229.amer.cisco.com>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7C492D3@xmb-ams-331.emea.cisco.com>

I stand corrected... I have double checked, and I remembered it all wrong (assumed it's like with the 6748...). Only 1x8G.

BTW, if you want to use an etherchannel with one port on a 65XX and another on a 61XX (or another combination of qos-wise incompatible cards) you need to use the following command "no mls qos channel-consistency"

Arie

-----Original Message-----
From: Sachin Gupta (sagupta) 
Sent: Sunday, June 14, 2009 07:00
To: Arie Vayner (avayner); 'geoff at pendery.net'; 'BBlackford at nwresd.k12.or.us'
Cc: 'cisco-nsp at puck.nether.net'
Subject: Re: [c-nsp] x6148 vs. x6548

The 6548 has a single 8G fabric connection.

Sachin

----- Original Message -----
From: cisco-nsp-bounces at puck.nether.net <cisco-nsp-bounces at puck.nether.net>
To: Geoffrey Pendery <geoff at pendery.net>; Bill Blackford <BBlackford at nwresd.k12.or.us>
Cc: cisco-nsp at puck.nether.net <cisco-nsp at puck.nether.net>
Sent: Sat Jun 13 20:48:17 2009
Subject: Re: [c-nsp] x6148 vs. x6548

Geoffrey,

A small correction. The x6548 is an 8G card, but it has 2 fabric connections, so the limit would be 16G.

As long as you do not use the other 7 ports out of each 8 port group, each port group can give you 1G, but take into consideration that the x6148 is a classic card, so it has no fabric connections, and uses the shared bus.

In general the x6148 is not supposed to be a "core" card. It's for connecting low end desktops etc.

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Geoffrey Pendery
Sent: Friday, June 12, 2009 16:36
To: Bill Blackford
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] x6148 vs. x6548

Well, with the 6548, you're still going to be limited to 8 Gbps,
rather than 6 Gbps.  It's a CEF256 card, which means it has an 8 Gbps
fabric connection to the supervisor, instead of just sharing the 32
Gbps like the 6148 does.  So if you're looking to drive more than a
gig through an Etherchannel, it will do it, but only for a limited
number of them.  The 6748 would bump your bottleneck up to 40 Gbps.

I have a question of my own, since this subject has come up a time or
two - regarding the 6148's, the statement is made a couple times that
Etherchannel will get you port redundancy but no extra bandwidth,
since the ASIC is only a gig.  But if I distribute my channel across
two slots, say Gig 1/1 and Gig 2/1, does that get me around the gig
limit?  Or even Gig 1/1 and Gig 1/48, since it's separate ASICs?
Logic tells me yes, but I've heard the "1 gig limit" mentioned as if
it's a hard platform limitation, not just a result of a particular
bottleneck.  My instinctive behavior with channels is to span them
across blades anyway, to guard against blade failure....


-Geoff


On Thu, Jun 11, 2009 at 9:20 PM, Bill
Blackford<BBlackford at nwresd.k12.or.us> wrote:
> I've recently learned that the ws-x6148-ge-tx has 6 gig ASICs, one for every 8 ports thusly rendering this line card to a 8:1 oversubscription ratio. I've also learned that an etherchannel is limited to 1 gig, great for redundancy, but slow as all get up.
>
> I'm buying a ws-x6548-ge-tx in hope that it can do much better (I didn't have enough in my budget for a x6748). How does the 6548 compare to the 6148? I have a pair of shiny new sup720-3bxl's.
>
> Thank you for any insight from the field as Cisco's site seems best suited for the marketing of products.
>
> -b
>
> --
> Bill Blackford
> Senior Network Engineer
> Technology Systems Group
> Northwest Regional ESD
>
> my /home away from home
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From eng_mssk at hotmail.com  Sun Jun 14 10:37:02 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Sun, 14 Jun 2009 17:37:02 +0300
Subject: [c-nsp] port channel overruns
Message-ID: <BLU102-W5779C0FD81928FFE91E8BFA410@phx.gbl>


hey all 
i have Cisco 7606 and i configured port channel consisting of 5 links 
now the individual ports (Gig) , do not have overruns but the port channel has 
even though the ports in the mentioned port channel have 8 ports spacing to overcome the issue of ASIC
can anyone help ?

Router#sh int po20 | inc overr
     0 input errors, 0 CRC, 0 frame, 468063 overrun, 0 ignored

Thanks in advance

_________________________________________________________________
Drag n? drop?Get easy photo sharing with Windows Live? Photos.

http://www.microsoft.com/windows/windowslive/products/photos.aspx

From sthaug at nethelp.no  Sun Jun 14 11:42:10 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Sun, 14 Jun 2009 17:42:10 +0200 (CEST)
Subject: [c-nsp] port channel overruns
In-Reply-To: <BLU102-W5779C0FD81928FFE91E8BFA410@phx.gbl>
References: <BLU102-W5779C0FD81928FFE91E8BFA410@phx.gbl>
Message-ID: <20090614.174210.74726651.sthaug@nethelp.no>

> i have Cisco 7606 and i configured port channel consisting of 5 links 
> now the individual ports (Gig) , do not have overruns but the port channel has 
> even though the ports in the mentioned port channel have 8 ports spacing to overcome the issue of ASIC
> can anyone help ?

What type of card are your ports on? What type of Supervisor?

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From graham at g-rock.net  Sun Jun 14 18:52:56 2009
From: graham at g-rock.net (Graham Wooden)
Date: Sun, 14 Jun 2009 17:52:56 -0500
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
Message-ID: <C65AE978.5439%graham@g-rock.net>

Hi all,

I just updated the SP?s ROMMON on a Sup32 to the latest,
c6ksup32-rm2.srec.122-18r.SX9.  However, can this same file be applied to
update the RP's ROMMON as well?  While logged into CCO I have only came
across docs that referred to the SP upgrade. I guess no biggie if the SP and
RP have difference ROMMON versions, I was just curious.

Thanks,

-graham



From dale.shaw+cisco-nsp at gmail.com  Sun Jun 14 19:53:57 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Mon, 15 Jun 2009 09:53:57 +1000
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <C65AE978.5439%graham@g-rock.net>
References: <C65AE978.5439%graham@g-rock.net>
Message-ID: <3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>

Hi,

<semi-hijack>

On Mon, Jun 15, 2009 at 8:52 AM, Graham Wooden<graham at g-rock.net> wrote:
>
> I just updated the SP?s ROMMON on a Sup32 to the latest,
> c6ksup32-rm2.srec.122-18r.SX9. ?However, can this same file be applied to
> update the RP's ROMMON as well? ?While logged into CCO I have only came
> across docs that referred to the SP upgrade. I guess no biggie if the SP and
> RP have difference ROMMON versions, I was just curious.

I'm curious about how many people out there manage ROMMON/bootflash
images in the same way the 'main' image is managed.

In one customer network, there are tens of 7200s running 12.4T code
with 12.3-based boot code. The same network has 20+ 6500s
(sup32/sup720) running various 12.2(18)SXF images and I doubt anyone's
ever given a second thought to 'auxiliary' code like ROMMON or any
other flashable components.

So, is stuff like ROMMON a set-and-forget or
never-even-thought-about-it thing for you, or do you actively track
image availability and factor upgrades in to your broader platform
management activities? Is it considered good practice, for example, to
match 7200 series boot flash revs with the main image, or does this
fall into the "if it ain't broke, .." category?

cheers,
Dale

From dcp at dcptech.com  Sun Jun 14 20:07:14 2009
From: dcp at dcptech.com (David Prall)
Date: Sun, 14 Jun 2009 20:07:14 -0400
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
References: <C65AE978.5439%graham@g-rock.net>
	<3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
Message-ID: <006c01c9ed4d$4f0174d0$ed045e70$@com>

The key issue with the boot image is being able to access the flash device
where the real image exists. A number of devices, ie Majority, no longer
need this but in the past upgrading to an ATA Flash card / disk0:, from
linear flash / slot0: meant that you needed a boot image that could support
the flash. The 7500 is an absolute for having the two in sync. 

6500 MSFC3 ROMMON
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/rommon/OL_4497.htm
l

David

--
http://dcp.dcptech.com
 

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Dale Shaw
> Sent: Sunday, June 14, 2009 7:54 PM
> To: Graham Wooden
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
> 
> Hi,
> 
> <semi-hijack>
> 
> On Mon, Jun 15, 2009 at 8:52 AM, Graham Wooden<graham at g-rock.net>
> wrote:
> >
> > I just updated the SP?s ROMMON on a Sup32 to the latest,
> > c6ksup32-rm2.srec.122-18r.SX9. ?However, can this same file be
> applied to
> > update the RP's ROMMON as well? ?While logged into CCO I have only
> came
> > across docs that referred to the SP upgrade. I guess no biggie if the
> SP and
> > RP have difference ROMMON versions, I was just curious.
> 
> I'm curious about how many people out there manage ROMMON/bootflash
> images in the same way the 'main' image is managed.
> 
> In one customer network, there are tens of 7200s running 12.4T code
> with 12.3-based boot code. The same network has 20+ 6500s
> (sup32/sup720) running various 12.2(18)SXF images and I doubt anyone's
> ever given a second thought to 'auxiliary' code like ROMMON or any
> other flashable components.
> 
> So, is stuff like ROMMON a set-and-forget or
> never-even-thought-about-it thing for you, or do you actively track
> image availability and factor upgrades in to your broader platform
> management activities? Is it considered good practice, for example, to
> match 7200 series boot flash revs with the main image, or does this
> fall into the "if it ain't broke, .." category?
> 
> cheers,
> Dale
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From jay at west.net  Sun Jun 14 20:15:07 2009
From: jay at west.net (Jay Hennigan)
Date: Sun, 14 Jun 2009 17:15:07 -0700
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
References: <C65AE978.5439%graham@g-rock.net>
	<3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
Message-ID: <4A35928B.4090907@west.net>

Dale Shaw wrote:

> I'm curious about how many people out there manage ROMMON/bootflash
> images in the same way the 'main' image is managed.
> 
> In one customer network, there are tens of 7200s running 12.4T code
> with 12.3-based boot code. The same network has 20+ 6500s
> (sup32/sup720) running various 12.2(18)SXF images and I doubt anyone's
> ever given a second thought to 'auxiliary' code like ROMMON or any
> other flashable components.
> 
> So, is stuff like ROMMON a set-and-forget or
> never-even-thought-about-it thing for you, or do you actively track
> image availability and factor upgrades in to your broader platform
> management activities? Is it considered good practice, for example, to
> match 7200 series boot flash revs with the main image, or does this
> fall into the "if it ain't broke, .." category?

7200s have three places where code is stored, ROMMON, Bootflash, and the 
main image.

ROMMON is a physical "Yank this chip out of its socket and replace it 
with another chip" so not flashable.   Not DIY unless you have an EPROM 
burner and a factory chip with newer code to dump.

I typically don't worry about bootflash unless there's a compatibility 
issue with that and a newer IOS, but this is indeed flashable and images 
are available on CCO.

On smaller platforms the ROMMON and bootflash are combined onto a single 
BootROM.  This is also a "Yank the physical chip and replace it" type of 
thing.  Occasionally this needs to be upgraded when newer code becomes 
too large for the original design to address, but it's been a long time 
since I've needed to deal with it, IIRC the 2500 and maybe early 2600 
series routers.

In my experience on most platforms these are "set and forget", but I 
don't have a lot of hands-on with the 6500.

--
Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net
Impulse Internet Service  -  http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV

From kgraham at industrial-marshmallow.com  Sun Jun 14 20:27:11 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Sun, 14 Jun 2009 17:27:11 -0700 (PDT)
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <4A35928B.4090907@west.net>
References: <C65AE978.5439%graham@g-rock.net>
	<3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
	<4A35928B.4090907@west.net>
Message-ID: <663794.93579.qm@web1215.biz.mail.gq1.yahoo.com>


> 7200s have three places where code is stored, ROMMON, Bootflash, and the main 

> image.
> 
> ROMMON is a physical "Yank this chip out of its socket and replace it with 
> another chip" so not flashable.   Not DIY unless you have an EPROM burner and a 
> factory chip with newer code to dump.

Depends on the NPE. NPE-G1 rommon can be upgraded, most notably for the short-
lived MPF functionality. 

From graham at g-rock.net  Sun Jun 14 20:30:21 2009
From: graham at g-rock.net (Graham Wooden)
Date: Sun, 14 Jun 2009 19:30:21 -0500
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <006c01c9ed4d$4f0174d0$ed045e70$@com>
Message-ID: <C65B004D.544B%graham@g-rock.net>

Thanks David and Dale for the insights.

SP Rommon was pretty far back, and upgrading it solved an issue I was
having. However, after reading the caveats listed for the MSFC2A, I don't
think I am going to mess with the RP - until I really need to.

Thanks again,

-graham

On 6/14/09 7:07 PM, "David Prall" <dcp at dcptech.com> wrote:

> The key issue with the boot image is being able to access the flash device
> where the real image exists. A number of devices, ie Majority, no longer
> need this but in the past upgrading to an ATA Flash card / disk0:, from
> linear flash / slot0: meant that you needed a boot image that could support
> the flash. The 7500 is an absolute for having the two in sync.
> 
> 6500 MSFC3 ROMMON
> http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/rommon/OL_4497.htm
> l
> 
> David
> 
> --
> http://dcp.dcptech.com
>  
> 
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
>> bounces at puck.nether.net] On Behalf Of Dale Shaw
>> Sent: Sunday, June 14, 2009 7:54 PM
>> To: Graham Wooden
>> Cc: cisco-nsp at puck.nether.net
>> Subject: Re: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
>> 
>> Hi,
>> 
>> <semi-hijack>
>> 
>> On Mon, Jun 15, 2009 at 8:52 AM, Graham Wooden<graham at g-rock.net>
>> wrote:
>>> 
>>> I just updated the SP?s ROMMON on a Sup32 to the latest,
>>> c6ksup32-rm2.srec.122-18r.SX9. ?However, can this same file be
>> applied to
>>> update the RP's ROMMON as well? ?While logged into CCO I have only
>> came
>>> across docs that referred to the SP upgrade. I guess no biggie if the
>> SP and
>>> RP have difference ROMMON versions, I was just curious.
>> 
>> I'm curious about how many people out there manage ROMMON/bootflash
>> images in the same way the 'main' image is managed.
>> 
>> In one customer network, there are tens of 7200s running 12.4T code
>> with 12.3-based boot code. The same network has 20+ 6500s
>> (sup32/sup720) running various 12.2(18)SXF images and I doubt anyone's
>> ever given a second thought to 'auxiliary' code like ROMMON or any
>> other flashable components.
>> 
>> So, is stuff like ROMMON a set-and-forget or
>> never-even-thought-about-it thing for you, or do you actively track
>> image availability and factor upgrades in to your broader platform
>> management activities? Is it considered good practice, for example, to
>> match 7200 series boot flash revs with the main image, or does this
>> fall into the "if it ain't broke, .." category?
>> 
>> cheers,
>> Dale
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 



From irsk.inc at gmail.com  Mon Jun 15 00:57:23 2009
From: irsk.inc at gmail.com (Rishi Kochar)
Date: Sun, 14 Jun 2009 23:57:23 -0500
Subject: [c-nsp] Two events in EEM
Message-ID: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>

hi
i work for cisco in UC technology.
i am very new to EEM. I dont deal with scripting at all but i have to create
one for one of my customers

I have created an event manager applet with an '
#event syslog pattern <pattern>.
Now after matching the pattern i want it wait for a countdown timer and the
execute certain cli commands.
what's the easiest way to do it ?
i think with EEM i cant make my first applet to call another applet which
has a countdown timer because with
#action 1.0 cli command "event manager run <2nd applet>"
in this 2nd applet should have "event none" if i need to call it manually
from 1st applet but thats not the case because 2nd applet will have a
countdown timer as its event.

any help on this would be highly appreciated

thanks and regards
inder

From gert at greenie.muc.de  Mon Jun 15 02:19:48 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Mon, 15 Jun 2009 08:19:48 +0200
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
References: <C65AE978.5439%graham@g-rock.net>
	<3329cbb40906141653i4843b565xf8b2584dae824f9b@mail.gmail.com>
Message-ID: <20090615061947.GI290@greenie.muc.de>

Hi,

On Mon, Jun 15, 2009 at 09:53:57AM +1000, Dale Shaw wrote:
> So, is stuff like ROMMON a set-and-forget or
> never-even-thought-about-it thing for you, or do you actively track
> image availability and factor upgrades in to your broader platform
> management activities? 

For us it's "set-and-forget".  There are certain cases where ROMMON
and/or boot IOS updates are needed (like SXH IOS on 6500), but besides 
this, we usually never touch it, on any platform.

> Is it considered good practice, for example, to
> match 7200 series boot flash revs with the main image, or does this
> fall into the "if it ain't broke, .." category?

We always consider it "if it ain't broke..." - and so far, haven't seen
any adverse effects.

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090615/f38692d4/attachment.bin>

From eninja at gmail.com  Mon Jun 15 03:23:33 2009
From: eninja at gmail.com (Eninja)
Date: Mon, 15 Jun 2009 08:23:33 +0100
Subject: [c-nsp] Two events in EEM
In-Reply-To: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
References: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
Message-ID: <84F4B3F8-54F4-4C0F-A8FB-8A99822075A3@gmail.com>

Inder,

Sounds like you're a Cisco software development engineer. Shouldn't  
this be sent to a Cisco internal list rather than a public list?

Eninja ;)



On Jun 15, 2009, at 5:57 AM, Rishi Kochar <irsk.inc at gmail.com> wrote:

> hi
> i work for cisco in UC technology.
> i am very new to EEM. I dont deal with scripting at all but i have  
> to create
> one for one of my customers
>
> I have created an event manager applet with an '
> #event syslog pattern <pattern>.
> Now after matching the pattern i want it wait for a countdown timer  
> and the
> execute certain cli commands.
> what's the easiest way to do it ?
> i think with EEM i cant make my first applet to call another applet  
> which
> has a countdown timer because with
> #action 1.0 cli command "event manager run <2nd applet>"
> in this 2nd applet should have "event none" if i need to call it  
> manually
> from 1st applet but thats not the case because 2nd applet will have a
> countdown timer as its event.
>
> any help on this would be highly appreciated
>
> thanks and regards
> inder
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From dale.shaw+cisco-nsp at gmail.com  Mon Jun 15 03:54:03 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Mon, 15 Jun 2009 17:54:03 +1000
Subject: [c-nsp] Using 'shutdown' versus pulling the cable
Message-ID: <3329cbb40906150054u557e40b2kc102e1d89ebe919@mail.gmail.com>

Hi all,

I'm working on some failover test scenarios and I'm trying to
determine if issuing a 'shutdown' command on a router's Ethernet
interface is effectively identical, from the perspective of the
attached switch, as removing the cable.

Here's a simplified topology:

R1-Fa0/0 -- Fa1/0/1-SW1

Assume R1's Fa0/0 interface is directly connected to SW1's Fa1/0/1
interface, and Fa1/0/1 is configured as a routed port ("no
switchport"). R1 and SW1 are EIGRP neighbours.

Is the 'shutdown' command somehow 'cleaner' or more graceful than
yanking the cable? For example, does IOS do any 'nice' things like
send EIGRP goodbye messages before *really* shutting down the
interface? Anything similar happening at lower layers? This requires
insight into IOS behaviour that I don't have and I'm not sure how to
get within any reasonable time frame (read: without cracking out the
packet capture tool).

We don't have remote power-off/power-on capabilities so this is all
about assessing whether we need an on-site presence to simulate loss
of power. If 'shutdown' on R1 is the same as pulling the cable, and
SW1's response will be the same, that's great. If it's not the same,
it's not a valid simulation.

Hopefully this hasn't been covered before. The key words involved make
it difficult to search on.

Cheers,
Dale

From alan.pashi at gmail.com  Mon Jun 15 04:38:17 2009
From: alan.pashi at gmail.com (Tengiz Alaniya)
Date: Mon, 15 Jun 2009 12:38:17 +0400
Subject: [c-nsp] FWSM failover time
Message-ID: <29c062fe0906150138t4559beddob0205f4f0db2330b@mail.gmail.com>

Hi all, sorry for my eng ;)



Ok, here is  my story about 2 catalyst 6500 boxes, with installed fws
blades. Between fws are configured as transparent with A/A failover. Nodes
are connected with 2x10Tg EC.

When one of boxes filed, initial failover begins, but the time between first
node stops forwarding and the second node begins forwarding is too big,
about ~7 sec.

Any suggestions to how decrease failover time?



*First box failover config:*

*msk-dc-fwm-c2-1/9#    sh run failover *

failover

failover lan unit primary

failover preempt 1

failover lan interface failover-lan Vlan104

failover polltime unit msec 500 holdtime 3

failover link failover-state Vlan105

failover interface ip failover-lan 192.168.255.253 255.255.255.252 standby
192.168.255.254

failover interface ip failover-state 192.168.255.249 255.255.255.252 standby
192.168.255.250

failover group 1

  replication http

  polltime interface 3

failover group 2

  secondary

*msk-dc-fwm-c2-1/9# sh failover *

Failover On

Failover unit Primary

Failover LAN Interface: failover-lan Vlan 104 (up)

Unit Poll frequency 500 milliseconds, holdtime 3 seconds

Interface Poll frequency 15 seconds

Interface Policy 50%

Monitored Interfaces 4 of 250 maximum

Config sync: active

Version: Ours 4.0(3), Mate 4.0(3)

Group 1 last failover at: 14:41:29 UTC Jun 11 2009

Group 2 last failover at: 14:41:29 UTC Jun 11 2009



  This host:    Primary

  Group 1       State:          Standby Ready

                Active time:    0 (sec)

  Group 2       State:          Standby Ready

                Active time:    0 (sec)



                1c Interface outside (0.0.0.0): Normal (Not-Monitored)

                1c Interface inside (0.0.0.0): Normal (Not-Monitored)

                backup Interface outside (0.0.0.0): Normal (Waiting)

                backup Interface inside (0.0.0.0): Normal (Waiting)

                documentum Interface outside (0.0.0.0): Normal
(Not-Monitored)

                documentum Interface inside (0.0.0.0): Normal
(Not-Monitored)

                engineering Interface outside (0.0.0.0): Normal
(Not-Monitored)

                engineering Interface inside (0.0.0.0): Normal
(Not-Monitored)

                ksupr Interface outside (0.0.0.0): Normal (Not-Monitored)

                ksupr Interface inside (0.0.0.0): Normal (Not-Monitored)

                monitoring Interface outside (0.0.0.0): Normal
(Not-Monitored)

                monitoring Interface inside (0.0.0.0): Normal
(Not-Monitored)

                sap Interface outside (0.0.0.0): Normal (Not-Monitored)

                sap Interface inside (0.0.0.0): Normal (Not-Monitored)

                sql Interface outside (0.0.0.0): Normal (Not-Monitored)

                sql Interface inside (0.0.0.0): Normal (Not-Monitored)

                vmware-mng Interface outside (0.0.0.0): Normal (Waiting)

                vmware-mng Interface inside (0.0.0.0): Normal (Waiting)

                vmware-vmotion Interface outside (0.0.0.0): Normal
(Not-Monitored)

                vmware-vmotion Interface inside (0.0.0.0): Normal
(Not-Monitored)



  Other host:   Secondary

  Group 1       State:          Active

                Active time:    326568 (sec)

  Group 2       State:          Active

                Active time:    344824 (sec)



                1c Interface outside (10.42.225.252): Normal (Not-Monitored)

                1c Interface inside (10.42.225.252): Normal (Not-Monitored)

                backup Interface outside (10.42.229.252): Normal (Waiting)

                backup Interface inside (10.42.229.252): Normal (Waiting)

                documentum Interface outside (10.42.226.252): Normal
(Not-Monitored)

                documentum Interface inside (10.42.226.252): Normal
(Not-Monitored)

                engineering Interface outside (10.42.231.252): Normal
(Not-Monitored)

                engineering Interface inside (10.42.231.252): Normal
(Not-Monitored)

                ksupr Interface outside (10.42.228.252): Normal
(Not-Monitored)

                ksupr Interface inside (10.42.228.252): Normal
(Not-Monitored)

                monitoring Interface outside (10.42.230.252): Normal
(Not-Monitored)

                monitoring Interface inside (10.42.230.252): Normal
(Not-Monitored)

                sap Interface outside (10.42.224.252): Normal
(Not-Monitored)

                sap Interface inside (10.42.224.252): Normal (Not-Monitored)

                sql Interface outside (10.42.227.252): Normal
(Not-Monitored)

                sql Interface inside (10.42.227.252): Normal (Not-Monitored)

                vmware-mng Interface outside (10.42.223.124): Normal
(Waiting)

                vmware-mng Interface inside (10.42.223.124): Normal
(Waiting)

                vmware-vmotion Interface outside (10.42.223.252): Normal
(Not-Monitored)

                vmware-vmotion Interface inside (10.42.223.252): Normal
(Not-Monitored)



Stateful Failover Logical Update Statistics

        Link : failover-state Vlan 105 (up)

        Stateful Obj    xmit       xerr       rcv        rerr

        General         41619      0          41940      0

        sys cmd         41619      0          41619      0

        up time         0          0          0          0

        RPC services    0          0          0          0

        TCP conn        0          0          114        0

        UDP conn        0          0          0          0

        ARP tbl         0          0          207        0

        Xlate_Timeout   0          0          0          0

        AAA tbl         0          0          0          0

        DACL            0          0          0          0

        Acl optimization        0          0          0          0

        OSPF Area SeqNo         0          0          0          0



        Logical Update Queue Information

                        Cur     Max     Total

        Recv Q:         0       2       681787

        Xmit Q:         0       0       41619



*Second box config:*

*msk-dc-fwm-c2-1/9# sh run fail*

failover

failover lan unit secondary

failover preempt 1

failover lan interface failover-lan Vlan104

failover polltime unit msec 500 holdtime 3

failover link failover-state Vlan105

failover interface ip failover-lan 192.168.255.253 255.255.255.252 standby
192.168.255.254

failover interface ip failover-state 192.168.255.249 255.255.255.252 standby
192.168.255.250

failover group 1

  replication http

  polltime interface 3

failover group 2

  secondary

*msk-dc-fwm-c2-1/9# sh failover *

Failover On

Failover unit Secondary

Failover LAN Interface: failover-lan Vlan 104 (up)

Unit Poll frequency 500 milliseconds, holdtime 3 seconds

Interface Poll frequency 15 seconds

Interface Policy 50%

Monitored Interfaces 4 of 250 maximum

Config sync: active

Version: Ours 4.0(3), Mate 4.0(3)

Group 1 last failover at: 12:34:47 UTC Jun 11 2009

Group 2 last failover at: 07:30:05 UTC Jun 11 2009



  This host:    Secondary

  Group 1       State:          Active

                Active time:    326640 (sec)

  Group 2       State:          Active

                Active time:    344896 (sec)



                1c Interface outside (10.42.225.252): Normal (Not-Monitored)

                1c Interface inside (10.42.225.252): Normal (Not-Monitored)

                backup Interface outside (10.42.229.252): Normal (Waiting)

                backup Interface inside (10.42.229.252): Normal (Waiting)

                documentum Interface outside (10.42.226.252): Normal
(Not-Monitored)

                documentum Interface inside (10.42.226.252): Normal
(Not-Monitored)

                engineering Interface outside (10.42.231.252): Normal
(Not-Monitored)

                engineering Interface inside (10.42.231.252): Normal
(Not-Monitored)

                ksupr Interface outside (10.42.228.252): Normal
(Not-Monitored)

                ksupr Interface inside (10.42.228.252): Normal
(Not-Monitored)

                monitoring Interface outside (10.42.230.252): Normal
(Not-Monitored)

                monitoring Interface inside (10.42.230.252): Normal
(Not-Monitored)

                sap Interface outside (10.42.224.252): Normal
(Not-Monitored)

                sap Interface inside (10.42.224.252): Normal (Not-Monitored)

                sql Interface outside (10.42.227.252): Normal
(Not-Monitored)

                sql Interface inside (10.42.227.252): Normal (Not-Monitored)

                vmware-mng Interface outside (10.42.223.124): Normal
(Waiting)

                vmware-mng Interface inside (10.42.223.124): Normal
(Waiting)

                vmware-vmotion Interface outside (10.42.223.252): Normal
(Not-Monitored)

                vmware-vmotion Interface inside (10.42.223.252): Normal
(Not-Monitored)



  Other host:   Primary

  Group 1       State:          Standby Ready

                Active time:    0 (sec)

  Group 2       State:          Standby Ready

                Active time:    0 (sec)



                1c Interface outside (0.0.0.0): Normal (Not-Monitored)

                1c Interface inside (0.0.0.0): Normal (Not-Monitored)

                backup Interface outside (0.0.0.0): Normal (Waiting)

                backup Interface inside (0.0.0.0): Normal (Waiting)

                documentum Interface outside (0.0.0.0): Normal
(Not-Monitored)

                documentum Interface inside (0.0.0.0): Normal
(Not-Monitored)

                engineering Interface outside (0.0.0.0): Normal
(Not-Monitored)

                engineering Interface inside (0.0.0.0): Normal
(Not-Monitored)

                ksupr Interface outside (0.0.0.0): Normal (Not-Monitored)

                ksupr Interface inside (0.0.0.0): Normal (Not-Monitored)

                monitoring Interface outside (0.0.0.0): Normal
(Not-Monitored)

                monitoring Interface inside (0.0.0.0): Normal
(Not-Monitored)

                sap Interface outside (0.0.0.0): Normal (Not-Monitored)

                sap Interface inside (0.0.0.0): Normal (Not-Monitored)

                sql Interface outside (0.0.0.0): Normal (Not-Monitored)

                sql Interface inside (0.0.0.0): Normal (Not-Monitored)

                vmware-mng Interface outside (0.0.0.0): Normal (Waiting)

                vmware-mng Interface inside (0.0.0.0): Normal (Waiting)

                vmware-vmotion Interface outside (0.0.0.0): Normal
(Not-Monitored)

                vmware-vmotion Interface inside (0.0.0.0): Normal
(Not-Monitored)



Stateful Failover Logical Update Statistics

        Link : failover-state Vlan 105 (up)

        Stateful Obj    xmit       xerr       rcv        rerr

        General         45207      0          44925      0

        sys cmd         44833      0          44830      0

        up time         0          0          0          0

        RPC services    0          0          0          0

        TCP conn        129        0          74         0

        UDP conn        0          0          0          0

        ARP tbl         245        0          21         0

        Xlate_Timeout   0          0          0          0

        AAA tbl         0          0          0          0

        DACL            0          0          0          0

        Acl optimization        0          0          0          0

        OSPF Area SeqNo         0          0          0          0



        Logical Update Queue Information

                        Cur     Max     Total

        Recv Q:         0       3       715068

        Xmit Q:         0       0       66148


-- 
Kind regards,
Tengiz Alaniya

From Thomas.Sillaber at nextiraone.de  Mon Jun 15 05:03:19 2009
From: Thomas.Sillaber at nextiraone.de (Thomas.Sillaber at nextiraone.de)
Date: Mon, 15 Jun 2009 11:03:19 +0200
Subject: [c-nsp] Using 'shutdown' versus pulling the cable
References: <3329cbb40906150054u557e40b2kc102e1d89ebe919@mail.gmail.com>
Message-ID: <D2A12B44A1003D45A7117D0BBB957A061441E7C6@BER05101.ebdmail.alcatel.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Dale,

using the "shutdown" command is IMHO always cleaner because of "graceful
shutdown" feature. If you plan a failover test physically disconnecting
the link or powering off the device shows the "real" failover time.  

Brgds and have a great day

Thomas Sillaber


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iQEVAwUBSjYOVWZ0NRmWJ+KQAQKS0wf/YD/rJtDi7LsezfRWLdJ6o1dQZM/ngM0l
9yYI/cOX7C4JKHJ4cMgL4R1zT94W07jSJJNbqR9mjrdodJdLSyaFlG7GIVbPgNlu
V3npL7N48pSoZfBKd1OxfpfjHoLLEMntUKsYY7IoSd733XXKJ6+UcwyCfd7R0qdq
CGgJRyMzsJ+mXcs+u0k23i1iDA4p54PiK6y6YkwBWI8zSGvhD4nxOMy2wryaJADn
VOWNgwsct5r/rgUYFPppHNw1joy9W60kvh4BLh508JTr24xGhQYkJgleKdif4wE7
n0OuNhmyqlAPFYqt4KRwomWIQMkQZGXhqX4EH4Ebe2BBLd6ihai4ow==
=rgiN
-----END PGP SIGNATURE-----

From bep at whack.org  Mon Jun 15 05:46:06 2009
From: bep at whack.org (Bruce Pinsky)
Date: Mon, 15 Jun 2009 02:46:06 -0700
Subject: [c-nsp] Using 'shutdown' versus pulling the cable
In-Reply-To: <D2A12B44A1003D45A7117D0BBB957A061441E7C6@BER05101.ebdmail.alcatel.de>
References: <3329cbb40906150054u557e40b2kc102e1d89ebe919@mail.gmail.com>
	<D2A12B44A1003D45A7117D0BBB957A061441E7C6@BER05101.ebdmail.alcatel.de>
Message-ID: <4A36185E.9030103@whack.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thomas.Sillaber at nextiraone.de wrote:
> Hi Dale,
> 
> using the "shutdown" command is IMHO always cleaner because of "graceful
> shutdown" feature. If you plan a failover test physically disconnecting
> the link or powering off the device shows the "real" failover time.  
> 

If you want a less "well behaved failure", pull just the tx or rx side of
the fiber...or introduce 10e-4 errors and see what happens.

- --
=========
bep

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAko2GF4ACgkQE1XcgMgrtyaBmQCgrOYQzV9JEBwWDT5l/853Kk7E
dAoAoPP7d46mAvb0DNaXdcpPv26/lTrg
=KlEo
-----END PGP SIGNATURE-----

From p.mayers at imperial.ac.uk  Mon Jun 15 05:47:40 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Mon, 15 Jun 2009 10:47:40 +0100
Subject: [c-nsp] Two events in EEM
In-Reply-To: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
References: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
Message-ID: <4A3618BC.6060307@imperial.ac.uk>

Use a stub track object with a "delay" parameter?

track 499 stub-object
  ! this delay will occur
  delay down 10

event manager applet test1
  event syslog pattern ".*foo.*"
  action 1.0 track set 499 state down

event manager applet test2
  event track 499 state down
  action 1.0 cli command "your CLI here"

This requires a suitable version of EEM (2.2 I think?)

From rodunn at cisco.com  Mon Jun 15 07:28:46 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Mon, 15 Jun 2009 07:28:46 -0400
Subject: [c-nsp] Two events in EEM
In-Reply-To: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
References: <744b72620906142157v35fb7d8fnc2e72bc5aa634c67@mail.gmail.com>
Message-ID: <20090615112846.GB8987@rtp-cse-489.cisco.com>

In your first applet that triggers on the syslog pattern have it
actually configure the second EEM applet that then runs on a
countdown timer:

action 4.0 cli command "event timer countodwn 30

Basically, have one applet configure the second and have the
second configure a third that would remove the second after it
runs the commands.

Depending on if you only want it to run once, which a countdown timer
does.

Rodney





On Sun, Jun 14, 2009 at 11:57:23PM -0500, Rishi Kochar wrote:
> hi
> i work for cisco in UC technology.
> i am very new to EEM. I dont deal with scripting at all but i have to create
> one for one of my customers
> 
> I have created an event manager applet with an '
> #event syslog pattern <pattern>.
> Now after matching the pattern i want it wait for a countdown timer and the
> execute certain cli commands.
> what's the easiest way to do it ?
> i think with EEM i cant make my first applet to call another applet which
> has a countdown timer because with
> #action 1.0 cli command "event manager run <2nd applet>"
> in this 2nd applet should have "event none" if i need to call it manually
> from 1st applet but thats not the case because 2nd applet will have a
> countdown timer as its event.
> 
> any help on this would be highly appreciated
> 
> thanks and regards
> inder
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From peter at rathlev.dk  Mon Jun 15 11:05:53 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Mon, 15 Jun 2009 17:05:53 +0200
Subject: [c-nsp] BGP Dynamic Neighbors and VPNv4
In-Reply-To: <1240845228.7881.64.camel@localhost.localdomain>
References: <1240845228.7881.64.camel@localhost.localdomain>
Message-ID: <1245078353.6634.8.camel@localhost.localdomain>

As follow-up for the archives. Short version: It doesn't seem to work.

On Mon, 2009-04-27 at 17:13 +0200, Peter Rathlev wrote:
> Reading about BGP Dynamic Neighbors I can see that the 12.2SX
> Configuration Guide[1] states that only IPv4 peering is supported. Would
> anybody know if this actually means "no IPv6" or if it also means "no
> VPNv4"? I don't currently have a SXH/SXI box to test this from I'm
> afraid.

As Phil said it will eat the configuration, but it doesn't seem to work
for VPNv4 when I test it. The RR clients seem stuck in a "(NoNeg)"
state:

 000088: Jun 15 16:10:37.587 CEST: %BGP-5-ADJCHANGE: neighbor 10.85.248.7 Up
 R2(config-router-af)#do sh ip bgp vpnv4 all sum
 BGP router identifier 10.85.248.11, local AS number 65432
 BGP table version is 1, main routing table version 1
 
 Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
 10.85.248.7     4       65432       3       3        0    0    0 00:00:12 (NoNeg)

>From the RR itself:

 000426: Jun 15 16:10:37.591 CEST: %BGP-5-ADJCHANGE: neighbor *10.85.248.11 Up 
 R1(config-router)#do sh ip bgp vpnv4 all sum
 ...
 Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
 10.85.248.1     4       65432  252567  250975     1048    0    0 2w6d           17
 BGP peergroup RM-core-RR listen range group members: 
   10.85.248.0/24 
 R1(config-router)#

It logs an adjacency change saying a dynamic ("*") neighbor is up, but
the sessions is not listen under the summary. (Can anybody tell me what
the "(NoNeg)" is btw?)

I guess this means that VPNv4 isn't a supported AF for dynamic
neighbors. :'(

A regular RR setup of course works fine. That's what we'll do then.

This was tested on 12.2(33)SXI1 AIS.

Regards,
Peter



From felixnkansah at gmail.com  Mon Jun 15 12:39:07 2009
From: felixnkansah at gmail.com (Felix Nkansah)
Date: Mon, 15 Jun 2009 16:39:07 +0000
Subject: [c-nsp] Cisco ITP and SMSC
Message-ID: <18dba4e50906150939kf3d1df4h29f87664cb5ac0ad@mail.gmail.com>

Hi Team,

I would appreciate if any on this list could direct me to useful resources
that go in-depth into SS7 and SS7-over-IP protocols, focusing on using Cisco
ITPs in combination with a SMSC and SS7 network.

Thanks in advance.

Felix

From rick at woofpaws.com  Mon Jun 15 13:24:28 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Mon, 15 Jun 2009 10:24:28 -0700 (PDT)
Subject: [c-nsp] Policing on Catalyst 4948 - Hardware or Software?
Message-ID: <40751.69.30.17.85.1245086669.squirrel@www.woofpaws.com>


The Catalyst 4948 was brought to my attention as a potential collocation
aggregation device; with a specific requirement of bidirectional policing
per port.

I have spent quite a bit of time on Cisco and Google trying to find out
whether policing (independent of marking/classifying) is performed in
hardware or software.  I get some hints that it is hardware, but nothing
the says so outright.  With a 266MHz processor, it doesn't seem like there
is a lot of capacity for bandwidth management.

In an ideal/extreme case, I'd like to be able to have hosts/networks
attempt to push 1Gbs per port and have it throttled to 1Mbs each without
cratering the device.  More realistically, 24 ports populated, each set to
10-500Mbs per customer (port).

I'm looking at a distributed device rather than modular for several
reasons including cable management (a nightmare at high port density) and
incremental expansion (makes the finance people less upset than dropping a
full chassis in with minimal utilization).

As part of the bigger picture; I'm looking at 7206VXR/G2 at the border for
GigE upstreams and BGP endpoints funneled to a pair of 7600/Sup720 for
redundant "glue", feeding multiple legacy aggregation devices and new,
bandwidth managed, ethernet customers.  Current utilization is ~300Mbs
both in and out, but we now have customers looking for 100-300Mbs CIR.

As an aggregation device, I'm also looking for OSPF, BGP, HSRP, and
potentially Layer-3 ACLs.

There are several other vendors touting ASIC-based policing but Cisco
isn't as informative.

Thanks,
Rick

From ygauteron at gmail.com  Mon Jun 15 14:57:43 2009
From: ygauteron at gmail.com (Yann Gauteron)
Date: Mon, 15 Jun 2009 20:57:43 +0200
Subject: [c-nsp] Cisco ITP and SMSC
In-Reply-To: <18dba4e50906150939kf3d1df4h29f87664cb5ac0ad@mail.gmail.com>
References: <18dba4e50906150939kf3d1df4h29f87664cb5ac0ad@mail.gmail.com>
Message-ID: <8097baf0906151157x4a502524v207619c8313216da@mail.gmail.com>

What kind of resources are you specifically interested in?

2009/6/15 Felix Nkansah <felixnkansah at gmail.com>:
> Hi Team,
>
> I would appreciate if any on this list could direct me to useful resources
> that go in-depth into SS7 and SS7-over-IP protocols, focusing on using Cisco
> ITPs in combination with a SMSC and SS7 network.
>
> Thanks in advance.
>
> Felix
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From kgraham at industrial-marshmallow.com  Mon Jun 15 13:59:03 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 15 Jun 2009 10:59:03 -0700 (PDT)
Subject: [c-nsp] heat fins popping loose on WS-X67xx cards
In-Reply-To: <alpine.DEB.2.00.0905290851570.23331@seatpost.its.uiowa.edu>
References: <alpine.DEB.2.00.0905281110020.7239@seatpost.its.uiowa.edu>
	<44417CD2F19FEA4F885088340A71D33201F0DFCB@mail.office.dansketelecom.com>
	<4A1F00C8.9060109@west.net> <4A1F0B39.6040907@forthnet.gr>
	<alpine.DEB.2.00.0905290851570.23331@seatpost.its.uiowa.edu>
Message-ID: <141296.79805.qm@web1212.biz.mail.gq1.yahoo.com>




> The first shows the "Z1" socket in the background with the fuzzy loop in the 

> foreground. The second shows the heat fin & loop in the foregraound with the 
> socket in the background.  The loop is supposed to be in the Z1 socket.

Just unpacked a WS-X6748-GE-TX and found a loose jumped in the bag. Thanks to
this thread, gave a slight push to the heat fin and off it came, with jumper
Z1 suspiciously absent.

> Based on the responses I've received it seems that this is a fairly common 
> failure due to a design flaw.  I got the usual "that's strange; nobody else is 
> having this problem" from Cisco.  I now have ample justification for telling 
> them "bull".

Indeed. Given the number of instances cited here alone, I'm really surprised
there hasn't been a field notice.

From vanormer at gmail.com  Mon Jun 15 14:59:03 2009
From: vanormer at gmail.com (Robert VanOrmer)
Date: Mon, 15 Jun 2009 13:59:03 -0500
Subject: [c-nsp] Qos on IPSec + GRE tunnel with sup720-3bxl
Message-ID: <009101c9edeb$5ac18820$10449860$@com>

I am having an interesting challenge in getting a QoS policy that is
supported / works across a IPSec + GRE tunnel running 12.2(18)SXF
(Sup720-3bxl, ws-svc-ipsec-1, flexwan with DS3).  I am not trying to do
anything overly complex.. really just want to make sure RTP or EF tagged
frames make it, and let the rest of the traffic fend for itself with any
queuing strategy.  Originally, I was just planning to use class/policy maps
with the bandwidth and priority controls to guarantee a certain amount of
bandwidth to dscp ef.  This doesn't seem to be supported..  and my google-fu
is failing me..  Most documentation references the qos pre-qualify features
and auto-qos, which are also unsupported in this configuration.  TAC
recommends policing, but I would rather avoid that unless that is the best
mechanism.  Anybody have any experience with a similar design and willing to
share some pointers?  Any recommendations on the best QoS strategy using GRE
tunnels on the 6500 platform?

 


From felixnkansah at gmail.com  Mon Jun 15 15:11:03 2009
From: felixnkansah at gmail.com (Felix Nkansah)
Date: Mon, 15 Jun 2009 19:11:03 +0000
Subject: [c-nsp] Cisco ITP and SMSC
In-Reply-To: <8097baf0906151157x4a502524v207619c8313216da@mail.gmail.com>
References: <18dba4e50906150939kf3d1df4h29f87664cb5ac0ad@mail.gmail.com>
	<8097baf0906151157x4a502524v207619c8313216da@mail.gmail.com>
Message-ID: <18dba4e50906151211l55f983fdld28d333a441a75f9@mail.gmail.com>

Any that you know on the subject could prove useful to me.
But to be specific, anything that teaches concepts and configurations of
application servers, routing on point codes, global title configuration,
multilayer routing, etc.

Thanks in advance.

On Mon, Jun 15, 2009 at 6:57 PM, Yann Gauteron <ygauteron at gmail.com> wrote:

> What kind of resources are you specifically interested in?
>
> 2009/6/15 Felix Nkansah <felixnkansah at gmail.com>:
> > Hi Team,
> >
> > I would appreciate if any on this list could direct me to useful
> resources
> > that go in-depth into SS7 and SS7-over-IP protocols, focusing on using
> Cisco
> > ITPs in combination with a SMSC and SS7 network.
> >
> > Thanks in advance.
> >
> > Felix
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
>

From kgraham at industrial-marshmallow.com  Mon Jun 15 14:29:10 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 15 Jun 2009 11:29:10 -0700 (PDT)
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
	<A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
	<FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>
Message-ID: <919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>



> > Was the original intention of this thread not to find out exactly what *is* 
> the best tool for the above scenario? :)
> 
> GSR w/E3 or E5 LCs, ASR 1K, CRS-1, or N7K, depending upon the circumstances 

Probably none of them -- N7K seems squarely targeted at enterprise DC, so given
BU turf wars, wouldn't go near it for a SP workload (ie. consider that post-
split, the 6500 and 7600 are clearly diverging). Otherwise, ASR9K or 7600
are going to be the only ones that get close to the port counts that were cited
initially.

Given the 192 ports of 10/100/1000, presumably this is aggregating customers,
in which case it'd be best to roll these up on 7600/RSP720 (along with their
associated BGP, since most of them would probably be suitable for peer-groups).
uRPF wouldn't be a problem, and hopefully ACL's would be uniform enough across
customers to share most of the ACE entries. 

With that compromise (namely loosing customer-customer netflow detail), the 
remaining requirements for full netflow exports and the balance of the BGP
workload are feasible for any of ASR1k, GSR, or CRS-1.

From c.spurgeon at mail.utexas.edu  Mon Jun 15 14:54:18 2009
From: c.spurgeon at mail.utexas.edu (Charles Spurgeon)
Date: Mon, 15 Jun 2009 13:54:18 -0500
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <C65B004D.544B%graham@g-rock.net>
References: <006c01c9ed4d$4f0174d0$ed045e70$@com>
	<C65B004D.544B%graham@g-rock.net>
Message-ID: <20090615185418.GA48691@argus.gw.utexas.edu>

On Sun, Jun 14, 2009 at 07:29:58PM -0500, Graham Wooden wrote:
> Thanks David and Dale for the insights.
> 
> SP Rommon was pretty far back, and upgrading it solved an issue I was
> having. However, after reading the caveats listed for the MSFC2A, I don't
> think I am going to mess with the RP - until I really need to.

Another data point along the lines of "if it ain't broke..."

When we did a SP rommon upgrade to 45 sup720s a while back (to fix
some serious booting bugs) we lost one sup720 when it became bricked
due to a failed rommon upgrade.

Since then the risk of bricking the sup720 has been added to the list
of reasons that we don't mess with the rommon unless we have to.

-Charles

Charles E. Spurgeon / UTnet
UT Austin ITS / Networking
c.spurgeon at its.utexas.edu / 512.475.9265



From dsavage at castleaccess.com  Mon Jun 15 14:49:00 2009
From: dsavage at castleaccess.com (Denis Savage)
Date: Mon, 15 Jun 2009 11:49:00 -0700
Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
In-Reply-To: <mailman.401.1245078433.2287.cisco-nsp@puck.nether.net>
Message-ID: <C65BE5AC.321BE%dsavage@castleaccess.com>

Is there any benefit of going with the 7201 NPE-G2 over the 7204 VXR with
the NPE-G2 engine? They appear to be the exact same, except the 7204 has
four slots as opposed to the 7201 being a 1U appliance. Yet, the 7204 is
cheaper from what I can gather. Am I missing something?

Thanks,

Denis Savage



From kgraham at industrial-marshmallow.com  Mon Jun 15 14:48:26 2009
From: kgraham at industrial-marshmallow.com (Kevin Graham)
Date: Mon, 15 Jun 2009 11:48:26 -0700 (PDT)
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <20090612205202.GC10390@kallisti.us>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net> <20090612205202.GC10390@kallisti.us>
Message-ID: <34850.38269.qm@web1209.biz.mail.gq1.yahoo.com>



> Hah, keep drinking the cool aid!  I have a pair of 6500s ready to fall
> over at about 150kpps.  All WS-67xx LAN cards with DFCs.  CPU averages
> 60% and often maxes.
>
> No netflow, no uRPF, no multicast, no IPv6, no BFD, no MPLS, no ACLs
> in the forwarding plane.  Very basic OSPF, BGP, and MSTP.  About 2000
> VLANs, 80% of which have associated layer 3 SVIs.

...which of course is mostly irrelevant to the forwarding performance.
If its just a handy opportunity to bitch, go for it, but as others 
mentioned, something's not right. "ready to fall over at 150kpps" is
only right if traffic is being entirely software switched on the MSFC3.

Barring that, the main thing that SP/RP would be seeing is mac-learning
and ARP (for which an above-average load would be reasonable assuming
with ~default values and a correspondingly high number of hosts to go
along with those ~2000 vlans).

From mhuff at ox.com  Mon Jun 15 16:05:11 2009
From: mhuff at ox.com (Matthew Huff)
Date: Mon, 15 Jun 2009 16:05:11 -0400
Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
In-Reply-To: <C65BE5AC.321BE%dsavage@castleaccess.com>
References: <mailman.401.1245078433.2287.cisco-nsp@puck.nether.net>
	<C65BE5AC.321BE%dsavage@castleaccess.com>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C1427C@PUR-EXCH07.ox.com>

I believe the deal with the 7201 is that you are paying for the compactness.
Also the 7204 is probably the most mass produced 72xx, so it's probably an
economy of scale, especially if you are looking at refurb.

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Denis Savage
> Sent: Monday, June 15, 2009 2:49 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
> 
> Is there any benefit of going with the 7201 NPE-G2 over the 7204 VXR
> with
> the NPE-G2 engine? They appear to be the exact same, except the 7204
> has
> four slots as opposed to the 7201 being a 1U appliance. Yet, the 7204
> is
> cheaper from what I can gather. Am I missing something?
> 
> Thanks,
> 
> Denis Savage
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090615/84aa7c7e/attachment.bin>

From gert at greenie.muc.de  Mon Jun 15 16:16:56 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Mon, 15 Jun 2009 22:16:56 +0200
Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
In-Reply-To: <C65BE5AC.321BE%dsavage@castleaccess.com>
References: <mailman.401.1245078433.2287.cisco-nsp@puck.nether.net>
	<C65BE5AC.321BE%dsavage@castleaccess.com>
Message-ID: <20090615201656.GV290@greenie.muc.de>

Hi,

On Mon, Jun 15, 2009 at 11:49:00AM -0700, Denis Savage wrote:
> Is there any benefit of going with the 7201 NPE-G2 over the 7204 VXR with
> the NPE-G2 engine? They appear to be the exact same, except the 7204 has
> four slots as opposed to the 7201 being a 1U appliance. Yet, the 7204 is
> cheaper from what I can gather. Am I missing something?

The 7201 is only using 1U of rack space.

Which might seem obvious - but if all you need is "GigE ports" (and maybe
a single PA), but at the same time the amount of rack space you can use 
is limited, 1U beats 4U :-)

gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090615/000fb16c/attachment.bin>

From achatz at forthnet.gr  Mon Jun 15 16:21:41 2009
From: achatz at forthnet.gr (Tassos Chatzithomaoglou)
Date: Mon, 15 Jun 2009 23:21:41 +0300
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <20090615185418.GA48691@argus.gw.utexas.edu>
References: <006c01c9ed4d$4f0174d0$ed045e70$@com>	<C65B004D.544B%graham@g-rock.net>
	<20090615185418.GA48691@argus.gw.utexas.edu>
Message-ID: <4A36AD55.6090101@forthnet.gr>



Charles Spurgeon wrote on 15/06/2009 21:54:
> On Sun, Jun 14, 2009 at 07:29:58PM -0500, Graham Wooden wrote:
>> Thanks David and Dale for the insights.
>>
>> SP Rommon was pretty far back, and upgrading it solved an issue I was
>> having. However, after reading the caveats listed for the MSFC2A, I don't
>> think I am going to mess with the RP - until I really need to.
> 
> Another data point along the lines of "if it ain't broke..."
> 
> When we did a SP rommon upgrade to 45 sup720s a while back (to fix
> some serious booting bugs) we lost one sup720 when it became bricked
> due to a failed rommon upgrade.
> 

Since there is a resident (GOLD) rommon also, couldn't that one be used for "recovery"?

-- 
Tassos

> Since then the risk of bricking the sup720 has been added to the list
> of reasons that we don't mess with the rommon unless we have to.
> 
> -Charles
> 
> Charles E. Spurgeon / UTnet
> UT Austin ITS / Networking
> c.spurgeon at its.utexas.edu / 512.475.9265
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 


From rdobbins at arbor.net  Mon Jun 15 16:31:58 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Tue, 16 Jun 2009 03:31:58 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <34850.38269.qm@web1209.biz.mail.gq1.yahoo.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net> <20090612205202.GC10390@kallisti.us>
	<34850.38269.qm@web1209.biz.mail.gq1.yahoo.com>
Message-ID: <0F6687DF-1945-4E0D-8815-89402C3AEE19@arbor.net>


On Jun 16, 2009, at 1:48 AM, Kevin Graham wrote:

> "ready to fall over at 150kpps" is only right if traffic is being  
> entirely software switched on the MSFC3.

Concur.  I'd start here:

sh proc c sort | e 0.00

sh fm sum

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From amsoares at netcabo.pt  Mon Jun 15 19:35:37 2009
From: amsoares at netcabo.pt (Antonio Soares)
Date: Tue, 16 Jun 2009 00:35:37 +0100
Subject: [c-nsp] 12k Full BGP Feed Memory Requirements
In-Reply-To: <4D58C7B4943F874BA4CB5D68A7924060B0F5F6@Epikserver2.Epik.local>
References: <6E449148FF134A9BA2815F839724F23E@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F530@Epikserver2.Epik.local>
	<153DAD8392C948D6B0E0864E232B909C@int.convex.pt>
	<4D58C7B4943F874BA4CB5D68A7924060B0F5F6@Epikserver2.Epik.local>
Message-ID: <9F415B851F1640F5884181C42F35A315@int.convex.pt>

What type of LC's do you have in that router ?

I'm trying to find what is the difference in the architecture between Eng3 vs Eng4 LC's that could justify this problem:

router#show ip cef resource   
Hardware resource allocation status summary
Green (Normal), Yellow (Caution) Red (Alarm)
Slot HW Resource Name        Util     Alert
X    E4_Lookup External SRAM  93        Y         
Y    E3 Rx PLU                26        G         
Y    E3_Rx_TLU                11        G        

Both have the same Route Memory and Packet Memory (512 Mb). 

But all i was able to find is related with Eng0/Eng1/Eng2:

Cisco 12000 Series Internet Router Architecture: Line Card Design

http://www.cisco.com/en/US/products/hw/routers/ps167/products_tech_note09186a00801e1dbd.shtml


Thanks.

Regards,

Antonio Soares, CCIE #18473 (R&S)
amsoares at netcabo.pt

-----Original Message-----
From: Ryan Werber [mailto:RWerber at epiknetworks.com] 
Sent: sexta-feira, 5 de Junho de 2009 20:31
To: Antonio Soares; cisco-nsp
Subject: RE: [c-nsp] 12k Full BGP Feed Memory Requirements




>-----Original Message-----
>From: Antonio Soares [mailto:amsoares at netcabo.pt] 
>Sent: Friday, June 05, 2009 4:14 AM

>Wow, this is unbelievable ! Can you show us your "show proc mem | inc
BGP" ? Do you really have two full BGP feeds (about 284k
>prefixes each) ?




#show proc memory  | i BGP
 169   0 2895956668 1123582500  310165452          0          0 BGP
Router
 172   0    3975400 1008225208       6840      53464          0 BGP I/O
 173   0       4188   12111120      14028          0          0 BGP
Scanner

First one is Cogent (174), the Second one is Tiscali (3257).  There are
4 Ibgp Route-Servers as well. we have ~10 full transit feeds throughout
our asn, as well as a ton of peering.  The only thing changed below are
ip addresses to protect the innocent. We currently have ~130 meg free on
the GRP-B. We also have 1 directly connected eBGP IPv6 peer, and 5
throughout our ASN.

38.103.xx.xx   4   174 3895305   60405 22155189    0    0 5w6d
283503
77.67.xx.xx    4  3257 5813157  139266 22155189    0    0 6w6d
282571
PEER-RS-1      4 21513 2472535 3813308 22155189    0    0 15:25:46
100863
RS-1           4 21513 4092583 3613405 22155189    0    0 6w6d
265775
RS-2           4 21513 3244549 3613398 22155189    0    0 6w6d
267897
RS-3           4 21513 5660680 3711962 22155189    0    0 1w1d
284664

show ip cef summary
IP Distributed CEF with switching (Table Version 8565971), flags=0x0
  288375 routes, 0 reresolve, 0 unresolved (0 old, 0 new), peak 18273
  8561775 instant recursive resolutions, 0 used background process
  12 load sharing elements, 12 references
  1389 in-place/0 aborted modifications
  57883336 bytes allocated to the FIB table data structures
  universal per-destination load sharing algorithm, id 6CE54348
  2(0) CEF resets
  Resolution Timer: Exponential (currently 1s, peak 4s)
  Tree summary:
   8-8-8-8 stride pattern
   short mask protection disabled
   288375 leaves, 14605 nodes using 23265244 bytes
  Transient memory used: 149355436, max: 149395476

  Table epoch: 0 (288375 entries at this epoch)

Adjacency Table has 41 adjacencies
  34 IPv4 adjacencies
  7 IPv6 adjacencies




From jkrejci at usinternet.com  Mon Jun 15 19:08:03 2009
From: jkrejci at usinternet.com (Justin Krejci)
Date: Mon, 15 Jun 2009 18:08:03 -0500
Subject: [c-nsp] LX vs LH Transceivers
Message-ID: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>

There appears to be a fair amount of threads online about using LX and LH
together on a SMF link. I have a situation where there is a 7206VXR with an
NPE-G1 that has a LX GBIC installed that is talking via SMF to a 12000
series router to one of our providers that is using an LX transceiver. This
gigE link has been up and running happily for a while.

 

We are running into some performance issues on the 7200 when under load so
we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
combo port. We have one GLC-LH-SM SFP transceiver installed into the
sfp-only port but when cutting over the above mentioned link from the 7200
to the 6509 we get no eth link at all. We verified fibers are clean, light
levels are within spec and strands connected in the correct tx/rx slots on
the transceiver. A simple hard loop at the FDP causes the gig interface to
come right up on the 6509 so I know the transceiver and gig port are
producing and receiving light at a hardware level but it seemed odd this was
not working when talking to the provider's LX GBIC. 

 

Everywhere online that I could find seems to indicate LX and LH are 100%
compatible with each other and that Cisco even uses these two
interchangeably (to the dismay of some).

http://marc.info/?l=cisco-nsp
<http://marc.info/?l=cisco-nsp&m=120612428712150&w=2> &m=120612428712150&w=2

http://en.wikipedia.org/wiki/Gigabit_Ethernet#1000BASE-LX

 

 

When talking with this provider they are adamant that their Cisco LX
equipment is not at all compatible with regular Cisco LH equipment and
mentioned that they are not using standard IOS but are using some customized
OS on their Cisco which is why there is this incompatibility. This to me
seems very suspicious like they don't want to troubleshoot this problem but
I can't dismiss their claims as invalid since I am not real knowledgeable in
this regard. They also claim they are not able to support LH connectivity
for this circuit due to this compatibility. From what I've read it seems the
LH/LX compatibility is really more of a hardware difference and software
driving the hardware would have no real bearing on this but again I don't
have anything to back up my line of thought. Do I need to press my provider
a little harder on this issue or are their claims true/possible and I am
just going to have to get an actual "LX" SFP for this circuit or figure
something else out.

 

Thanks!

Justin Krejci


From dale.shaw+cisco-nsp at gmail.com  Mon Jun 15 19:57:25 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Tue, 16 Jun 2009 09:57:25 +1000
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
Message-ID: <3329cbb40906151657h4c0ddd38t1eb52223a0ff3656@mail.gmail.com>

Hi Justin,

On Tue, Jun 16, 2009 at 9:08 AM, Justin Krejci<jkrejci at usinternet.com> wrote:
> We are running into some performance issues on the 7200 when under load so
> we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
> combo port. We have one GLC-LH-SM SFP transceiver installed into the
> sfp-only port but when cutting over the above mentioned link from the 7200
> to the 6509 we get no eth link at all.

Sorry if this is offensively obvious, but did your interface config
include "media-type sfp"?

The only other trick I've found with 1000BASE-LX recently was between
a WS-X6724-SFP line card and an Alcatel 1662 -- the link wouldn't come
up without "speed nonegotiate".

Good luck.

Cheers,
Dale

From jkrejci at usinternet.com  Mon Jun 15 20:10:08 2009
From: jkrejci at usinternet.com (Justin Krejci)
Date: Mon, 15 Jun 2009 19:10:08 -0500
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3329cbb40906151657h4c0ddd38t1eb52223a0ff3656@mail.gmail.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
	<3329cbb40906151657h4c0ddd38t1eb52223a0ff3656@mail.gmail.com>
Message-ID: <3D3B02466EFE42EA96616FA1CBD7D798@usicorp.usinternet.com>

Dale,

Thanks for the tip but this particular case I was using the sfp-only
interface so there is not even an option for configuring media-type.

router(config)#int g5/1
router(config-if)#me?   
% Unrecognized command
router(config-if)#int g5/2
router(config-if)#me?
media-type  

router(config-if)#me


Also I did not try the "speed nonegotiate" option, I will definitely have to
try that.

Thanks!

-----Original Message-----
From: dale.shaw at gmail.com [mailto:dale.shaw at gmail.com] On Behalf Of Dale
Shaw
Sent: Monday, June 15, 2009 6:57 PM
To: Justin Krejci
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] LX vs LH Transceivers

Hi Justin,

On Tue, Jun 16, 2009 at 9:08 AM, Justin Krejci<jkrejci at usinternet.com>
wrote:
> We are running into some performance issues on the 7200 when under load so
> we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
> combo port. We have one GLC-LH-SM SFP transceiver installed into the
> sfp-only port but when cutting over the above mentioned link from the 7200
> to the 6509 we get no eth link at all.

Sorry if this is offensively obvious, but did your interface config
include "media-type sfp"?

The only other trick I've found with 1000BASE-LX recently was between
a WS-X6724-SFP line card and an Alcatel 1662 -- the link wouldn't come
up without "speed nonegotiate".

Good luck.

Cheers,
Dale


From fusionfoto at gmail.com  Mon Jun 15 21:33:05 2009
From: fusionfoto at gmail.com (FF)
Date: Mon, 15 Jun 2009 21:33:05 -0400
Subject: [c-nsp] XENPAK packet loss
Message-ID: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>

I've been trying to solve an odd problem and can't seem to make any headway.
I'm in the process of upgrading two DF links that were formerly served
by 1GB/ZX optics to XENPAK-DWDM optics. 1 lamba only on each.

The ZX link for the first span ran fine. When the DWDM XENPAK is
installed, both ends see about -15db receive power and ping fine until
traffic is put on them. At about 200-300 mb/s they start losing 1500
byte packets. The more traffic, the more the problem. At night, when
traffic is lower, the link looks clean. No attenuators are on this
link.

On a longer span (140km) link, I have the same setup, with two EDFAs.
The input power comes in right around -24dbm. It tests clean mostly,
but drops 2 packets out of 10,000 when empty. More traffic, more
drops.  I figured it was a strength problem (-24dbm is right at the
edge). So went in with a some fiber cleaners and rejumpered
everything. Got it down to -22dbm which should be well within the
tolerances. If anything the problem got worse, not better.

There are some input/CRC errors incrementing on one side or the other.
Not as many as there are dropped packets, but clearly some do
correlate to dropped packets (for example 6 input errors out of 25,000
packets).

I looked up the data sheet on the Cisco DWDM transceivers (all the
optics and the EDFAs are Cisco) and they say you may get burst errors
above -15dbm, but nothing about bursts at below. I have no idea how to
diagnose for burst errors anyway. I don't know if this is a signal
strength problem, or something else. On the long span, I could
theoretically be hitting issues like dispersion, but on the short span
I should be running perfectly since everything is within tolerances.
Since they are both seeing the same sort of behavior, I am wondering
if its something I've overlooked.

So now I have two spans, of drastically different lengths, both
dropping packets directly related to the amount of traffic moving over
them. Only BGP and static routes are on these. All are 6500/SUP32 or
SUP720s running 12.22-33SXH5 or SXHI1.

Any help/advice/assistance would be appreciated it. I'm trying to
avoid spending 8+ hrs on the phone with TAC.

Thank you very much.

-- 
My opinions aren't even my own. FF

From swmike at swm.pp.se  Tue Jun 16 02:22:32 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Tue, 16 Jun 2009 08:22:32 +0200 (CEST)
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
Message-ID: <alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>

On Mon, 15 Jun 2009, FF wrote:

> On a longer span (140km) link, I have the same setup, with two EDFAs. 
> The input power comes in right around -24dbm. It tests clean mostly, but 
> drops 2 packets out of 10,000 when empty. More traffic, more drops.  I 
> figured it was a strength problem (-24dbm is right at the edge). So went 
> in with a some fiber cleaners and rejumpered everything. Got it down to 
> -22dbm which should be well within the tolerances. If anything the 
> problem got worse, not better.

Is this link dispersion compensated? Otherwise that is most likely your 
problem, 1GE rarely get chromatic dispersion (CD) problems, 10GE much more 
so.

> So now I have two spans, of drastically different lengths, both dropping 
> packets directly related to the amount of traffic moving over them. Only 
> BGP and static routes are on these. All are 6500/SUP32 or SUP720s 
> running 12.22-33SXH5 or SXHI1.

Which indicates a constant BER (bit error rate) which is consistant with 
CD induced BER.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From andy.saykao at staff.netspace.net.au  Tue Jun 16 02:23:56 2009
From: andy.saykao at staff.netspace.net.au (Andy Saykao)
Date: Tue, 16 Jun 2009 16:23:56 +1000
Subject: [c-nsp] Can you apply crypto map to SVI
Message-ID: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>

Hi All,
 
Got a problem with a site-to-site IPSEC vpn implementation where one end
is using SVI.
 
Does any body know if a crypto map can be applied to a SVI to bring up
the IPSEC tunnel? It accepts the command but I can't pass any traffic
to/from it.
 
interface vlan 10
 crypto map MY-MAP
 
Or do you need to apply the crypto map to a physical interface? 
 
I've gotten it working on a sub-interface (eg: interface
GigabitEthernet0/0.11) but can't find any documentation that talks about
applying it to a SVI and whether this will work.
 
Thanks.
 
Andy

This email and any files transmitted with it are confidential and intended
 solely for the use of the individual or entity to whom they are addressed. 
Please notify the sender immediately by email if you have received this 
email by mistake and delete this email from your system. Please note that
 any views or opinions presented in this email are solely those of the
 author and do not necessarily represent those of the organisation. 
Finally, the recipient should check this email and any attachments for 
the presence of viruses. The organisation accepts no liability for any 
damage caused by any virus transmitted by this email.


From dmitry at dmitry.net  Tue Jun 16 03:03:39 2009
From: dmitry at dmitry.net (Dmitry Kiselev)
Date: Tue, 16 Jun 2009 10:03:39 +0300
Subject: [c-nsp] SVI bandwidth
Message-ID: <20090616070339.GF81381@f17.dmitry.net>

Hello!

Is there any way to configure some sort of "bandwidth inherit"
command, but regarding SVI not sub-interfaces? Or some way
to configure the default bandwidth for all SVIs without own
explicit definition?

Thanks!

P.S. C7600-RSP720 under latest 12.2SRC

-- 
Dmitry Kiselev

From hegedus.gabor at euroway.hu  Tue Jun 16 04:07:37 2009
From: hegedus.gabor at euroway.hu (Hegedus Gabor)
Date: Tue, 16 Jun 2009 10:07:37 +0200
Subject: [c-nsp] mars reinstall
Message-ID: <4A3752C9.2040105@euroway.hu>

Hi all!

I have a problem.
Our Mars doesn't want to  work good.
It not responding remotely.
I need a  good  user guide what tells me how to reinstall the MARS.

we have 4.x version on it and I think i'm going to install 6.x.

how can I do it, pls help

Thank you.

br Gabor

From moua0100 at umn.edu  Tue Jun 16 05:02:49 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Tue, 16 Jun 2009 04:02:49 -0500
Subject: [c-nsp] Can you apply crypto map to SVI
In-Reply-To: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
Message-ID: <4A375FB9.3010305@umn.edu>

Yes, this should work contigent on hw plaform.  If you do a "sh cry 
engine" do you see an active crypto engine in sw or hw?  If not then the 
crypto commands will never be invoked even though legal.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi All,
>  
> Got a problem with a site-to-site IPSEC vpn implementation where one end
> is using SVI.
>  
> Does any body know if a crypto map can be applied to a SVI to bring up
> the IPSEC tunnel? It accepts the command but I can't pass any traffic
> to/from it.
>  
> interface vlan 10
>  crypto map MY-MAP
>  
> Or do you need to apply the crypto map to a physical interface? 
>  
> I've gotten it working on a sub-interface (eg: interface
> GigabitEthernet0/0.11) but can't find any documentation that talks about
> applying it to a SVI and whether this will work.
>  
> Thanks.
>  
> Andy
>
> This email and any files transmitted with it are confidential and intended
>  solely for the use of the individual or entity to whom they are addressed. 
> Please notify the sender immediately by email if you have received this 
> email by mistake and delete this email from your system. Please note that
>  any views or opinions presented in this email are solely those of the
>  author and do not necessarily represent those of the organisation. 
> Finally, the recipient should check this email and any attachments for 
> the presence of viruses. The organisation accepts no liability for any 
> damage caused by any virus transmitted by this email.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From zivl at gilat.net  Tue Jun 16 05:14:39 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Tue, 16 Jun 2009 12:14:39 +0300
Subject: [c-nsp] mars reinstall
In-Reply-To: <4A3752C9.2040105@euroway.hu>
References: <4A3752C9.2040105@euroway.hu>
Message-ID: <EC993E87D960A541A66BF21D62AA42A622FF3A2B69@exch2k7.gilat.local>

Yeah, we had some problems with MARS too so we've upgraded it to SATURN, much greater and robust, and hey, you've gotta love the rings and the 61 moons!
Just kiddin'

Have you look at this link?
http://www.cisco.com/en/US/products/ps6241/prod_installation_guides_list.html
There are a lot of guides there about installation/upgrade/migration
Hope this helps
Ziv





-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Hegedus Gabor
Sent: Tuesday, June 16, 2009 11:08 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] mars reinstall

Hi all!

I have a problem.
Our Mars doesn't want to  work good.
It not responding remotely.
I need a  good  user guide what tells me how to reinstall the MARS.

we have 4.x version on it and I think i'm going to install 6.x.

how can I do it, pls help

Thank you.

br Gabor
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From lists at memetic.org  Tue Jun 16 06:52:50 2009
From: lists at memetic.org (Adam Armstrong)
Date: Tue, 16 Jun 2009 11:52:50 +0100
Subject: [c-nsp] RSP720-10GE & C7606
Message-ID: <4A377982.5070303@memetic.org>

Hi All,

I have a pair of RSP720-10GEs and a 7606 chassis. The RSP datasheet 
suggests they aren't compatible. Does anyone have any evidence either way?

Thanks,
adam.

From eng_mssk at hotmail.com  Tue Jun 16 08:38:58 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Tue, 16 Jun 2009 15:38:58 +0300
Subject: [c-nsp] Double Natting
Message-ID: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>


hey all
i have a wimax CPE which have public IP address
and from the LAN side it has the ip add 192.168.1.1 and its DHCP enabled
now i have tp-link router that is connected to the CPE and got the ip address 192.168.1.100
i connected a laptop to the router and got the ip address 192.168.2.100
can i access the laptop via remote desktop by accessing the public ip address of the CPE ?

thanks

_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us

From lowen at pari.edu  Tue Jun 16 09:13:38 2009
From: lowen at pari.edu (Lamar Owen)
Date: Tue, 16 Jun 2009 09:13:38 -0400
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
Message-ID: <200906160913.38353.lowen@pari.edu>

On Monday 15 June 2009 07:08:03 pm Justin Krejci wrote:
> There appears to be a fair amount of threads online about using LX and LH
> together on a SMF link. I have a situation where there is a 7206VXR with an
> NPE-G1 that has a LX GBIC installed that is talking via SMF to a 12000
> series router to one of our providers that is using an LX transceiver. This
> gigE link has been up and running happily for a while.
[snip]
> We are running into some performance issues on the 7200 when under load so
> we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
> combo port. We have one GLC-LH-SM SFP transceiver installed into the
> sfp-only port but when cutting over the above mentioned link from the 7200
> to the 6509 we get no eth link at all. 

I've seen random issues with our 12012 with 1 port GE linecards linking up 
with a Catalyst 5509's GE port before; have no idea if they are related or 
not, but disabling autonegotiation on the Catalyst seemed to fix it.  The link 
would intermittently come up on the Cat 5509, and the link showed up on the 
12012, but would not be stable until disabling negotiation on the 5509.  I 
realize that's old hardware, but even the latest 6500 stuff inherits more from 
the old Catalyst line than it does from the 7200 router line.

In our case, the 12012's LC links up fine with an Extreme Summit1i, with a 
7401ASR's GE port, with a 7507's GEIP and GEIP+, and with a 7200 NPE-G1's 
port. Had issues with the Cat 5509 gig ports (both on the SupIIIG and the 
three port gig card) only.  Haven't tried with our 7609 yet, or with a Cat 
8500, or with a Cat 5500's 9 port gig etherchannel card.


From avayner at cisco.com  Tue Jun 16 09:43:39 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Tue, 16 Jun 2009 15:43:39 +0200
Subject: [c-nsp] Double Natting
In-Reply-To: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
References: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7CCDBD8@xmb-ams-331.emea.cisco.com>

Mohammad,

Yes, you can, but you will have to configure port mapping on both NAT
devices.
RDP should be using port 3389

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Mohammad Khalil
Sent: Tuesday, June 16, 2009 15:39
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Double Natting


hey all
i have a wimax CPE which have public IP address
and from the LAN side it has the ip add 192.168.1.1 and its DHCP enabled
now i have tp-link router that is connected to the CPE and got the ip
address 192.168.1.100
i connected a laptop to the router and got the ip address 192.168.2.100
can i access the laptop via remote desktop by accessing the public ip
address of the CPE ?

thanks

_________________________________________________________________
Invite your mail contacts to join your friends list with Windows Live
Spaces. It's easy!
http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.a
spx&mkt=en-us
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From eng_mssk at hotmail.com  Tue Jun 16 09:56:50 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Tue, 16 Jun 2009 16:56:50 +0300
Subject: [c-nsp] Double Natting
In-Reply-To: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
References: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
Message-ID: <BLU102-W296651969AFD68143F0B1EFA3F0@phx.gbl>


Thanks all for ur assist , i configured port forwarding before submitting my request but the CPE is dump i figured it later that u have to assign port range not a specific port on the CPE :)

> From: eng_mssk at hotmail.com
> To: cisco-nsp at puck.nether.net
> Date: Tue, 16 Jun 2009 15:38:58 +0300
> Subject: [c-nsp] Double Natting
> 
> 
> hey all
> i have a wimax CPE which have public IP address
> and from the LAN side it has the ip add 192.168.1.1 and its DHCP enabled
> now i have tp-link router that is connected to the CPE and got the ip address 192.168.1.100
> i connected a laptop to the router and got the ip address 192.168.2.100
> can i access the laptop via remote desktop by accessing the public ip address of the CPE ?
> 
> thanks
> 
> _________________________________________________________________
> Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy!
> http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx&mkt=en-us
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_________________________________________________________________
Show them the way! Add maps and directions to your party invites. 
http://www.microsoft.com/windows/windowslive/products/events.aspx

From lgeyer at gmail.com  Tue Jun 16 10:04:33 2009
From: lgeyer at gmail.com (Laurent Geyer)
Date: Tue, 16 Jun 2009 10:04:33 -0400
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com>
Message-ID: <39647f4d0906160704t4344824ak13f79e6721f474a7@mail.gmail.com>

On Mon, Jun 15, 2009 at 7:08 PM, Justin Krejci<jkrejci at usinternet.com> wrote:
> Everywhere online that I could find seems to indicate LX and LH are 100%
> compatible with each other and that Cisco even uses these two
> interchangeably (to the dismay of some).

LX and LH interoperability shouldn't be an issue, we mix and match
like that all the time.

Have you attempted to disabled link negotiation on your 6500 yet?

- Laurent

From fusionfoto at gmail.com  Tue Jun 16 10:06:16 2009
From: fusionfoto at gmail.com (FF)
Date: Tue, 16 Jun 2009 10:06:16 -0400
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
Message-ID: <4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>

I thought Chromatic Dispersion is distance related. This is supposed
to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
ps dispersion tolerance). Do you need a DCU even when operating within
that range? One of the links is only about 40-50km.

Is there a Cisco command to pull up the BER the optic is seeing?

Thanks.


On Tue, Jun 16, 2009 at 2:22 AM, Mikael Abrahamsson<swmike at swm.pp.se> wrote:
> On Mon, 15 Jun 2009, FF wrote:
>
>> On a longer span (140km) link, I have the same setup, with two EDFAs. The
>> input power comes in right around -24dbm. It tests clean mostly, but drops 2
>> packets out of 10,000 when empty. More traffic, more drops. ?I figured it
>> was a strength problem (-24dbm is right at the edge). So went in with a some
>> fiber cleaners and rejumpered everything. Got it down to -22dbm which should
>> be well within the tolerances. If anything the problem got worse, not
>> better.
>
> Is this link dispersion compensated? Otherwise that is most likely your
> problem, 1GE rarely get chromatic dispersion (CD) problems, 10GE much more
> so.
>
>> So now I have two spans, of drastically different lengths, both dropping
>> packets directly related to the amount of traffic moving over them. Only BGP
>> and static routes are on these. All are 6500/SUP32 or SUP720s running
>> 12.22-33SXH5 or SXHI1.
>
> Which indicates a constant BER (bit error rate) which is consistant with CD
> induced BER.
>
> --
> Mikael Abrahamsson ? ?email: swmike at swm.pp.se
>



-- 
FF

From drrtuy at ya.ru  Tue Jun 16 09:27:17 2009
From: drrtuy at ya.ru (Roman A. Nozdrin)
Date: Tue, 16 Jun 2009 16:27:17 +0300
Subject: [c-nsp] Double Natting
In-Reply-To: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
References: <BLU102-W2551BBA93D00D72EF172BFFA3F0@phx.gbl>
Message-ID: <4A379DB5.8060607@ya.ru>

Mohammad Khalil wrote:
> hey all
> i have a wimax CPE which have public IP address
> and from the LAN side it has the ip add 192.168.1.1 and its DHCP enabled
> now i have tp-link router that is connected to the CPE and got the ip address 192.168.1.100
> i connected a laptop to the router and got the ip address 192.168.2.100
> can i access the laptop via remote desktop by accessing the public ip address of the CPE ?

It seems You can get to the laptop using the topology you described.

For example.
CPE(RDP port) -> TP-LINK(RDP port) -> laptop

Does tp-link router smart enough to manipulate with destination nat? 
What is the actual model of the router?

WBR
Roman A. Nozdrin

From cluestore at gmail.com  Tue Jun 16 10:17:30 2009
From: cluestore at gmail.com (Clue Store)
Date: Tue, 16 Jun 2009 09:17:30 -0500
Subject: [c-nsp] Global Route Leaking on same PE
Message-ID: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>

Hi All,

Looked through the archives but couldn't find anything about this specific
issue. I'm trying to leak a route from the global table on a PE to an
iterface that is on the same PE but I get the folowwing when I try to just
point it to a loopback.....

ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 global
%Invalid next hop address (it's this router)

Also tried to point it to just the interface and it says vpn routes have to
be pointed to next-hop addresses. Anyone have some clue how to get this to
work where the traffic never leaves the same PE and makes a look around the
network??

TIA

From swmike at swm.pp.se  Tue Jun 16 10:19:08 2009
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Tue, 16 Jun 2009 16:19:08 +0200 (CEST)
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
	<4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
Message-ID: <alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>

On Tue, 16 Jun 2009, FF wrote:

> I thought Chromatic Dispersion is distance related. This is supposed

Yes it is.

> to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
> ps dispersion tolerance). Do you need a DCU even when operating within
> that range? One of the links is only about 40-50km.

Well, you didn't say the links were DC or not, and you didn't say how long 
the link was. At 40-50km, CD is most likely not the cause of your 
problems.

According to some info I found, SMF-28 DSF still has 17.1ps/nm/km, meaning 
your 1600ps dispersion tolerance only gets you 94km? I might be wrong 
though, I can't get the whole article, google only displays from its 
cache.

> Is there a Cisco command to pull up the BER the optic is seeing?

No, on GE you can only see it by sending traffic and observing the error 
counters.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From fusionfoto at gmail.com  Tue Jun 16 10:41:09 2009
From: fusionfoto at gmail.com (FF)
Date: Tue, 16 Jun 2009 10:41:09 -0400
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
	<4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
	<alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>
Message-ID: <4522daf90906160741v3090895ekffc76615f5697e11@mail.gmail.com>

On Tue, Jun 16, 2009 at 10:19 AM, Mikael Abrahamsson<swmike at swm.pp.se> wrote:
> On Tue, 16 Jun 2009, FF wrote:
>
>> I thought Chromatic Dispersion is distance related. This is supposed
>
> Yes it is.
>
>> to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
>> ps dispersion tolerance). Do you need a DCU even when operating within
>> that range? One of the links is only about 40-50km.
>
> Well, you didn't say the links were DC or not, and you didn't say how long
> the link was. At 40-50km, CD is most likely not the cause of your problems.

On the shorter link, we are seeing the same kind of problem, but not
the same problem. Any traffic-related issues at that distance that
could explain it?

>
> According to some info I found, SMF-28 DSF still has 17.1ps/nm/km, meaning
> your 1600ps dispersion tolerance only gets you 94km? I might be wrong
> though, I can't get the whole article, google only displays from its cache.


Well, that could explain the longer link, definitely. Is dispersion
something, say I'm +300 ps over my dispersion budget,
I get a -625 ps DCU on each side and I'm good? I'm trying to avoid
upsizing the amplifiers to compensate for the DCU's insertion loss.

>
>> Is there a Cisco command to pull up the BER the optic is seeing?
>
> No, on GE you can only see it by sending traffic and observing the error
> counters.
>

Thank you very much.


-- 
FF

From md at bts.sk  Tue Jun 16 11:50:56 2009
From: md at bts.sk (=?UTF-8?Q?Marian_=C4=8Eurkovi=C4=8D?=)
Date: Tue, 16 Jun 2009 17:50:56 +0200
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <20090616154120.M78569@bts.sk>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
	<4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
	<alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>
	<20090616154120.M78569@bts.sk>
Message-ID: <20090616155020.M58546@bts.sk>

On Tue, 16 Jun 2009 16:19:08 +0200 (CEST), Mikael Abrahamsson wrote
> On Tue, 16 Jun 2009, FF wrote:
> 
> > I thought Chromatic Dispersion is distance related. This is supposed
> 
> Yes it is.
> 
> > to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
> > ps dispersion tolerance). Do you need a DCU even when operating within
> > that range? One of the links is only about 40-50km.
> 
> Well, you didn't say the links were DC or not, and you didn't say how 
> long the link was. At 40-50km, CD is most likely not the cause of your 
> problems.
> 
> According to some info I found, SMF-28 DSF still has 17.1ps/nm/km, 
> meaning your 1600ps dispersion tolerance only gets you 94km? I might 
> be wrong though, I can't get the whole article, google only displays 
> from its cache.

Wait, if it's really DSF, it has zero dispersion at 1550 nm.
But such fiber is unsuitable for DWDM operation.

If it's NZDSF, it should have ~ 4 - 6 ps/nm/km.

    M.


From jeff-kell at utc.edu  Tue Jun 16 13:04:28 2009
From: jeff-kell at utc.edu (Jeff Kell)
Date: Tue, 16 Jun 2009 13:04:28 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
Message-ID: <4A37D09C.7050401@utc.edu>

Clue Store wrote:
> Hi All,
>
> Looked through the archives but couldn't find anything about this specific
> issue. I'm trying to leak a route from the global table on a PE to an
> iterface that is on the same PE but I get the folowwing when I try to just
> point it to a loopback.....
>
> ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 global
> %Invalid next hop address (it's this router)

Sure.  You need a pair of VS 6509s with SUP720-3BXLs, a few FWSMs, and a
CRS-1 backup...

Just kidding.  This seems to come up every few months, and yes, I've
asked myself some time ago.  There is no easy and elegant way to do
this, AFAIK.  And believe me, I've tried. 

VRF-to-VRF, piece of cake.  Global-to-anything else, or anything
else-to-global, it just isn't happening.  The global table is sacred.

If you have redundant PEs, you can point the "next-hops" to each other
and satisfy the criteria to bleed the route.  You can also set an
interface in each endpoint and physically cable them together, as
depressing as that may sound.  I resorted to a FWSM, which also works in
the same manner as the naked cable loop.

What you and most everyone else that asks really wants is import/export
functionality involving the global table to be as straightforward as it
is for VRF route-targets, but so far, it just isn't available.

Jeff



From ip at ioshints.info  Tue Jun 16 13:23:45 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Tue, 16 Jun 2009 19:23:45 +0200
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
Message-ID: <002501c9eea7$34983830$0a00000a@nil.si>

The last time I've seen discussion on this topic, you had to have an
external back-to-back connection between a VRF interface and a global
interface. 

> -----Original Message-----
> From: Clue Store [mailto:cluestore at gmail.com] 
> Sent: Tuesday, June 16, 2009 4:18 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Global Route Leaking on same PE
> 
> Hi All,
> 
> Looked through the archives but couldn't find anything about 
> this specific issue. I'm trying to leak a route from the 
> global table on a PE to an iterface that is on the same PE 
> but I get the folowwing when I try to just point it to a loopback.....
> 
> ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 
> global %Invalid next hop address (it's this router)
> 
> Also tried to point it to just the interface and it says vpn 
> routes have to be pointed to next-hop addresses. Anyone have 
> some clue how to get this to work where the traffic never 
> leaves the same PE and makes a look around the network??
> 
> TIA
> 
> 


From jarruda-cnsp at jarruda.com  Tue Jun 16 13:48:37 2009
From: jarruda-cnsp at jarruda.com (Julio Arruda)
Date: Tue, 16 Jun 2009 13:48:37 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <002501c9eea7$34983830$0a00000a@nil.si>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
Message-ID: <4A37DAF5.1040002@jarruda.com>

Ivan Pepelnjak wrote:
> The last time I've seen discussion on this topic, you had to have an
> external back-to-back connection between a VRF interface and a global
> interface. 

I maybe wrong, but seems this was related to resolving the CEF adjacency 
   to a physical interface ?
I understand that you could then use the ip route vrf command, adding 
the interface in the ip route statement.

> 
>> -----Original Message-----
>> From: Clue Store [mailto:cluestore at gmail.com] 
>> Sent: Tuesday, June 16, 2009 4:18 PM
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] Global Route Leaking on same PE
>>
>> Hi All,
>>
>> Looked through the archives but couldn't find anything about 
>> this specific issue. I'm trying to leak a route from the 
>> global table on a PE to an iterface that is on the same PE 
>> but I get the folowwing when I try to just point it to a loopback.....
>>
>> ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 
>> global %Invalid next hop address (it's this router)
>>
>> Also tried to point it to just the interface and it says vpn 
>> routes have to be pointed to next-hop addresses. Anyone have 
>> some clue how to get this to work where the traffic never 
>> leaves the same PE and makes a look around the network??
>>
>> TIA
>>
>>
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From howard at leadmon.net  Tue Jun 16 13:38:07 2009
From: howard at leadmon.net (Howard Leadmon)
Date: Tue, 16 Jun 2009 13:38:07 -0400
Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
In-Reply-To: <C65BE5AC.321BE%dsavage@castleaccess.com>
References: <mailman.401.1245078433.2287.cisco-nsp@puck.nether.net>
	<C65BE5AC.321BE%dsavage@castleaccess.com>
Message-ID: <007101c9eea9$391ee6e0$ab5cb4a0$@net>

 Well the 7201 comes with 4x GE ports, and with the NPE-G2 your only getting
3x GE ports to start.  To get the same you would have to add a PA-GE to your
router, and probably the Jacket Card and PA-GE if you didn't want to suck up
all the bandwidth points of the slots.

 Personally I went with a 7206VXR (why get 4 slots in the same size chassis
when you can have 6), and the NPE-G2.  I do have to admit to needing a
couple PA slots, as I needed to support a DS3 and a couple DS1 lines as well
in the router.

 I think as others mentioned, the 7201 is smaller if your space tight..


---
Howard Leadmon 


> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Denis Savage
> Sent: Monday, June 15, 2009 2:49 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 7201 NPE-G2 vs. 7204 with NPE-G2 engine
> 
> Is there any benefit of going with the 7201 NPE-G2 over the 7204 VXR with
> the NPE-G2 engine? They appear to be the exact same, except the 7204 has
> four slots as opposed to the 7201 being a 1U appliance. Yet, the 7204 is
> cheaper from what I can gather. Am I missing something?
> 
> Thanks,
> 
> Denis Savage
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From rbf+cisco-nsp at panix.com  Tue Jun 16 14:21:35 2009
From: rbf+cisco-nsp at panix.com (Brett Frankenberger)
Date: Tue, 16 Jun 2009 13:21:35 -0500
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <002501c9eea7$34983830$0a00000a@nil.si>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
Message-ID: <20090616182135.GA28410@panix.com>

On Tue, Jun 16, 2009 at 07:23:45PM +0200, Ivan Pepelnjak wrote:
> The last time I've seen discussion on this topic, you had to have an
> external back-to-back connection between a VRF interface and a global
> interface. 

Depending on the platform, you can do it with a GRE tunnel with both
ends on the same router.  (Should be fine on a software-switched
platform; YMMV on a hardware switched platform.)

> > ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 global

int lo888
 ip address 10.0.0.1 255.255.255.255
int lo999
 ip address 10.0.0.2 255.255.255.255
int tun1
 ip address 10.0.0.5 255.255.255.252
 tunnel source lo888
 tunnel destination 10.0.0.2
int tun2
 ip vrf forwarding test
 tunnel source lo999
 tunnel destination 10.0.0.1
ip route vrf test 64.193.x.x 255.255.255.248 tunnel2 10.0.0.5

(Might want to force a larger MTU on the tunnel -- no fragmentation
issues since the tunnel-encapsulated packets never leave the router.)

     -- Brett

From cluestore at gmail.com  Tue Jun 16 14:28:17 2009
From: cluestore at gmail.com (Clue Store)
Date: Tue, 16 Jun 2009 13:28:17 -0500
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <4A37DAF5.1040002@jarruda.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si> <4A37DAF5.1040002@jarruda.com>
Message-ID: <580af3b90906161128v601c5d19oc22f6b462ecd904f@mail.gmail.com>

  Thanks for the replies all.
>
>
> >I maybe wrong, but seems this was related to resolving the CEF adjacency
>  to a physical interface ?
> >I understand that you could then use the ip route vrf command, adding the
> interface in the ip route statement.
>
>>
>>
>
Tried this and it said vpn routes must specify a next hop :(

I have this working pointing it to an adjecent router loop interface making
a nice traffic loop through a dot1q interface. Looks like I might just have
to either move my global boxen to another non-PE terminating router or
extend my vrf downstream to seperate the voice and data out.

Thanks
Max

From luan at netcraftsmen.net  Tue Jun 16 13:39:44 2009
From: luan at netcraftsmen.net (Luan Nguyen)
Date: Tue, 16 Jun 2009 13:39:44 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <002501c9eea7$34983830$0a00000a@nil.si>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
Message-ID: <02d001c9eea9$6f918020$4eb48060$@net>

You could also use a GRE tunnel for the connection as well.
Jeff is right that this topic keeps coming up every so often.  I wonder why
Cisco won't just make this easier for people.

----------------------------------------------
Luan Nguyen
Chesapeake NetCraftsmen, LLC.
http://www.netcraftsmen.net
----------------------------------------------

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ivan Pepelnjak
Sent: Tuesday, June 16, 2009 1:24 PM
To: 'Clue Store'; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Global Route Leaking on same PE

The last time I've seen discussion on this topic, you had to have an
external back-to-back connection between a VRF interface and a global
interface. 

> -----Original Message-----
> From: Clue Store [mailto:cluestore at gmail.com] 
> Sent: Tuesday, June 16, 2009 4:18 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Global Route Leaking on same PE
> 
> Hi All,
> 
> Looked through the archives but couldn't find anything about 
> this specific issue. I'm trying to leak a route from the 
> global table on a PE to an iterface that is on the same PE 
> but I get the folowwing when I try to just point it to a loopback.....
> 
> ip route vrf test 64.193.x.x 255.255.255.248 192.168.222.1 
> global %Invalid next hop address (it's this router)
> 
> Also tried to point it to just the interface and it says vpn 
> routes have to be pointed to next-hop addresses. Anyone have 
> some clue how to get this to work where the traffic never 
> leaves the same PE and makes a look around the network??
> 
> TIA
> 
> 

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From c.spurgeon at mail.utexas.edu  Tue Jun 16 15:08:45 2009
From: c.spurgeon at mail.utexas.edu (Charles Spurgeon)
Date: Tue, 16 Jun 2009 14:08:45 -0500
Subject: [c-nsp] 6500/SUP32 - RP ROMMON upgrade?
In-Reply-To: <4A36AD55.6090101@forthnet.gr>
References: <006c01c9ed4d$4f0174d0$ed045e70$@com>
	<C65B004D.544B%graham@g-rock.net>
	<20090615185418.GA48691@argus.gw.utexas.edu>
	<4A36AD55.6090101@forthnet.gr>
Message-ID: <20090616190845.GA16273@argus.gw.utexas.edu>

On Mon, Jun 15, 2009 at 11:21:18PM +0300, Tassos Chatzithomaoglou wrote:
> 
> >When we did a SP rommon upgrade to 45 sup720s a while back (to fix
> >some serious booting bugs) we lost one sup720 when it became bricked
> >due to a failed rommon upgrade.
> >
> 
> Since there is a resident (GOLD) rommon also, couldn't that one be used for 
> "recovery"?

As I recall the sup became unbootable and unrecoverable when the
rommon upgrade wedged during the upgrade process, and the TAC sent a
replacement. I couldn't find any further details in our email archives
on the issue.

-Charles

Charles E. Spurgeon / UTnet
UT Austin ITS / Networking
c.spurgeon at its.utexas.edu / 512.475.9265

From harbor235 at gmail.com  Tue Jun 16 15:45:32 2009
From: harbor235 at gmail.com (harbor235)
Date: Tue, 16 Jun 2009 15:45:32 -0400
Subject: [c-nsp] Network Perefromance
Message-ID: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>

I wanted to ping everyone on tools they were using to understand the
performace of their
network, specifically, measuring packet loss, latency, and jitter.

mike

From jkrejci at usinternet.com  Tue Jun 16 15:46:22 2009
From: jkrejci at usinternet.com (Justin Krejci)
Date: Tue, 16 Jun 2009 14:46:22 -0500
Subject: [c-nsp] LX vs LH Transceivers
In-Reply-To: <3D3B02466EFE42EA96616FA1CBD7D798@usicorp.usinternet.com>
References: <3E79CE9C0B7C401490E6CD827B2A7E44@usicorp.usinternet.com><3329cbb40906151657h4c0ddd38t1eb52223a0ff3656@mail.gmail.com>
	<3D3B02466EFE42EA96616FA1CBD7D798@usicorp.usinternet.com>
Message-ID: <F361217983AC454587B4C224FBC5E9E9@usicorp.usinternet.com>

For the sake of completeness on this thread I was able to use the LH
transceiver just fine after entering the command "speed nonegotiate" on the
interface. 

I will be interested to hear what the provider has to say about this now,
even though prior to making my config change I double checked with them
again on their point about "LX to LH are not compatible" to make sure they
didn't hear "LH to SX" or something like that.

Thanks for the tips everyone.

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Justin Krejci
Sent: Monday, June 15, 2009 7:10 PM
To: 'Dale Shaw'
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] LX vs LH Transceivers

Dale,

Thanks for the tip but this particular case I was using the sfp-only
interface so there is not even an option for configuring media-type.

router(config)#int g5/1
router(config-if)#me?   
% Unrecognized command
router(config-if)#int g5/2
router(config-if)#me?
media-type  

router(config-if)#me


Also I did not try the "speed nonegotiate" option, I will definitely have to
try that.

Thanks!

-----Original Message-----
From: dale.shaw at gmail.com [mailto:dale.shaw at gmail.com] On Behalf Of Dale
Shaw
Sent: Monday, June 15, 2009 6:57 PM
To: Justin Krejci
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] LX vs LH Transceivers

Hi Justin,

On Tue, Jun 16, 2009 at 9:08 AM, Justin Krejci<jkrejci at usinternet.com>
wrote:
> We are running into some performance issues on the 7200 when under load so
> we have a 6509 sup720 3bxl. The sup720 has one sfp port and one sfp/rj45
> combo port. We have one GLC-LH-SM SFP transceiver installed into the
> sfp-only port but when cutting over the above mentioned link from the 7200
> to the 6509 we get no eth link at all.

Sorry if this is offensively obvious, but did your interface config
include "media-type sfp"?

The only other trick I've found with 1000BASE-LX recently was between
a WS-X6724-SFP line card and an Alcatel 1662 -- the link wouldn't come
up without "speed nonegotiate".

Good luck.

Cheers,
Dale

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From tdurack at gmail.com  Tue Jun 16 16:12:13 2009
From: tdurack at gmail.com (Tim Durack)
Date: Tue, 16 Jun 2009 16:12:13 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <02d001c9eea9$6f918020$4eb48060$@net>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
	<02d001c9eea9$6f918020$4eb48060$@net>
Message-ID: <9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>

On Tue, Jun 16, 2009 at 1:39 PM, Luan Nguyen<luan at netcraftsmen.net> wrote:
> You could also use a GRE tunnel for the connection as well.
> Jeff is right that this topic keeps coming up every so often. ?I wonder why
> Cisco won't just make this easier for people.
>
> ----------------------------------------------
> Luan Nguyen
> Chesapeake NetCraftsmen, LLC.
> http://www.netcraftsmen.net
> ----------------------------------------------

Amen to that.

I've played around with the various loopback strategies, including
using a gre tunnel that originates/terminates on the same PE. It
worked, but didn't seem like a scalable solution.

The conclusion I came to is that most MPLS scenarios assume you are
using a separate PE/firewall to move traffic between global and vrfs
(and probably even inter-vrf.)

It would be great to have a simple global-vrf route exchange feature though.

Tim:>

From mhuff at ox.com  Tue Jun 16 16:35:19 2009
From: mhuff at ox.com (Matthew Huff)
Date: Tue, 16 Jun 2009 16:35:19 -0400
Subject: [c-nsp] Network Perefromance
In-Reply-To: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>
References: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C142C3@PUR-EXCH07.ox.com>

We are a Cisco shop, so we use "ip sla" feature of newer IOS releases with
CiscoWorks LMS. Netflow is useful for trafic monitoring, but for latency and
jitter, the cisco featureset is really nice.

For example, between two of our voice gateway boxes (running sip trunking
between them) in NY & SF:

rtr-nyvoip#show ip sla statistics aggregated 1
IPSLAs aggregated statistics

IPSLA operation id: 1
Start Time Index: .16:15:07.749 EDT Tue Jun 16 2009
Type of operation: udp-jitter
Voice Scores:
MinOfICPIF: 11  MaxOfICPIF: 11  MinOfMOS: 4.6   MaxOfMOS: 4.6
RTT Values:
        Number Of RTT: 18000            RTT Min/Avg/Max: 91/91/96
milliseconds
Latency one-way time:
        Number of Latency one-way Samples: 0
        Source to Destination Latency one way Min/Avg/Max: 0/0/0
milliseconds
        Destination to Source Latency one way Min/Avg/Max: 0/0/0
milliseconds
Jitter Time:
        Number of SD Jitter Samples: 17982
        Number of DS Jitter Samples: 17982
        Source to Destination Jitter Min/Avg/Max: 0/1/4 milliseconds
        Destination to Source Jitter Min/Avg/Max: 0/1/4 milliseconds
Packet Loss Values:
        Loss Source to Destination: 0           Loss Destination to Source:
0
        Out Of Sequence: 0      Tail Drop: 0
        Packet Late Arrival: 0  Packet Skipped: 0
Number of successes: 18
Number of failures: 0

Start Time Index: .15:15:07.749 EDT Tue Jun 16 2009
Type of operation: udp-jitter
Voice Scores:
MinOfICPIF: 11  MaxOfICPIF: 11  MinOfMOS: 4.6   MaxOfMOS: 4.6
RTT Values:
        Number Of RTT: 60000            RTT Min/Avg/Max: 91/91/103
milliseconds
Latency one-way time:
        Number of Latency one-way Samples: 0
        Source to Destination Latency one way Min/Avg/Max: 0/0/0
milliseconds
        Destination to Source Latency one way Min/Avg/Max: 0/0/0
milliseconds
Jitter Time:
        Number of SD Jitter Samples: 59940
        Number of DS Jitter Samples: 59940
        Source to Destination Jitter Min/Avg/Max: 0/1/11 milliseconds
        Destination to Source Jitter Min/Avg/Max: 0/1/7 milliseconds
Packet Loss Values:
        Loss Source to Destination: 0           Loss Destination to Source:
0
        Out Of Sequence: 0      Tail Drop: 0
        Packet Late Arrival: 0  Packet Skipped: 0
Number of successes: 60
Number of failures: 0

The config is:

ip sla responder
ip sla logging traps
ip sla 1
 udp-jitter x.x.x.x 12420 source-ip x.x.x.x codec g729a
ip sla schedule 1 life forever start-time now


----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of harbor235
> Sent: Tuesday, June 16, 2009 3:46 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Network Perefromance
> 
> I wanted to ping everyone on tools they were using to understand the
> performace of their
> network, specifically, measuring packet loss, latency, and jitter.
> 
> mike
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090616/5173b555/attachment.bin>

From fusionfoto at gmail.com  Tue Jun 16 16:51:00 2009
From: fusionfoto at gmail.com (FF)
Date: Tue, 16 Jun 2009 16:51:00 -0400
Subject: [c-nsp] XENPAK packet loss
In-Reply-To: <20090616155020.M58546@bts.sk>
References: <4522daf90906151833o464b47b4x8266170f8cc929b4@mail.gmail.com>
	<alpine.DEB.1.10.0906160820440.22851@uplift.swm.pp.se>
	<4522daf90906160706v479940b7v38c21374615ca741@mail.gmail.com>
	<alpine.DEB.1.10.0906161611350.22851@uplift.swm.pp.se>
	<20090616154120.M78569@bts.sk> <20090616155020.M58546@bts.sk>
Message-ID: <4522daf90906161351y5e9053d2ic32c2ef3abde6fe7@mail.gmail.com>

Ok. On the 4-6 ps/nm/km basis we are close but not outside out budget.
The lower number is what  we budgeted for.

We solved the primary traffic problem (which packet loss on two
completely different links). It wasn't related to the hardware
but rather the MPLS FIB being in exception. Supposedly you can't clear
this without a reboot, but clear mpls ldp neigh * seems
to do the trick.

Exactly *why* so many routes were being tagged as MPLS isn't clear yet.

Cisco TAC wasn't more lucid than saying bad things can happen in MPLS
exception state, and you have to reboot to fix it.

Thanks for your assistance everyone! I will be doing some dispersion
measurements on the other leg.


On Tue, Jun 16, 2009 at 11:50 AM, Marian ?urkovi?<md at bts.sk> wrote:
> On Tue, 16 Jun 2009 16:19:08 +0200 (CEST), Mikael Abrahamsson wrote
>> On Tue, 16 Jun 2009, FF wrote:
>>
>> > I thought Chromatic Dispersion is distance related. This is supposed
>>
>> Yes it is.
>>
>> > to be SMF-28 DSF, the optics are supposed to be 80km (XENPAK DWDM 1600
>> > ps dispersion tolerance). Do you need a DCU even when operating within
>> > that range? One of the links is only about 40-50km.
>>
>> Well, you didn't say the links were DC or not, and you didn't say how
>> long the link was. At 40-50km, CD is most likely not the cause of your
>> problems.
>>
>> According to some info I found, SMF-28 DSF still has 17.1ps/nm/km,
>> meaning your 1600ps dispersion tolerance only gets you 94km? I might
>> be wrong though, I can't get the whole article, google only displays
>> from its cache.
>
> Wait, if it's really DSF, it has zero dispersion at 1550 nm.
> But such fiber is unsuitable for DWDM operation.
>
> If it's NZDSF, it should have ~ 4 - 6 ps/nm/km.
>
> ? ?M.
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
FF

From chris.brown at acsalaska.net  Tue Jun 16 18:49:00 2009
From: chris.brown at acsalaska.net (Christopher E. Brown)
Date: Tue, 16 Jun 2009 14:49:00 -0800
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
Message-ID: <4A38215C.1020707@acsalaska.net>



Can anyone comment on the 2821 as an ethernet fed MPLS PE?


This would require a settable MTU on the GigE ports "ie: mtu 1576", and standard support
for LDP, MP-BGP, standard L3 VPN support.


Spent too much time trolling Cisco site and not finding answers.


-- 
------------------------------------------------------------------------
Christopher E. Brown   <chris.brown at acsalaska.net>   desk (907) 550-8393
                                                     cell (907) 632-8492
IP Engineer - ACS
------------------------------------------------------------------------


From td_miles at yahoo.com  Tue Jun 16 19:29:04 2009
From: td_miles at yahoo.com (Tony)
Date: Tue, 16 Jun 2009 16:29:04 -0700 (PDT)
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
Message-ID: <915014.72951.qm@web110103.mail.gq1.yahoo.com>

Hi Chris,



This link will tell you about the MPLS support (answer = yes, depending):



http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6557/prod_white_paper0900aecd8051fbdc.html





And look here for jumbo frame support on 2800 (answer = yes, up to 9000 bytes):



http://www.cisco.com/en/US/prod/collateral/routers/ps5854/prod_qas0900aecd80169bd6.html





regards,

Tony.

--- On Wed, 17/6/09, Christopher E. Brown <chris.brown at acsalaska.net> wrote:

From: Christopher E. Brown <chris.brown at acsalaska.net>
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
To: "'Cisco-nsp'" <cisco-nsp at puck.nether.net>
Date: Wednesday, 17 June, 2009, 8:49 AM



Can anyone comment on the 2821 as an ethernet fed MPLS PE?


This would require a settable MTU on the GigE ports "ie: mtu 1576", and standard support
for LDP, MP-BGP, standard L3 VPN support.


Spent too much time trolling Cisco site and not finding answers.




      

From CFlint at mt.gov  Tue Jun 16 19:56:23 2009
From: CFlint at mt.gov (Flint, Chris)
Date: Tue, 16 Jun 2009 17:56:23 -0600
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
Message-ID: <169F1B4CBA47CC4F93BF2BD0A504C0552EB157532C@doaisd05222.state.mt.ads>

2821 works as an MPLS PE, the 10/100/1000 interfaces on 2821 support higher MTU.  

If you downsize to a 2811/01, you have to run 12.4(x)T to get a user-settable MTU on the 10/100 interface.  Even then you get an error message, but the MTU command is accepted.  I'm not sure exactly where support started, but (20)T and (22)T both support it.



Flint


--------------------------------------------
Message: 6
Date: Tue, 16 Jun 2009 16:29:04 -0700 (PDT)
From: Tony <td_miles at yahoo.com>
To: "'Cisco-nsp'" <cisco-nsp at puck.nether.net>,	"Christopher E. Brown"
	<chris.brown at acsalaska.net>
Subject: Re: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
Message-ID: <915014.72951.qm at web110103.mail.gq1.yahoo.com>
Content-Type: text/plain; charset=utf-8

Hi Chris,

This link will tell you about the MPLS support (answer = yes, depending):
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6557/prod_white_paper0900aecd8051fbdc.html

And look here for jumbo frame support on 2800 (answer = yes, up to 9000 bytes):
http://www.cisco.com/en/US/prod/collateral/routers/ps5854/prod_qas0900aecd80169bd6.html


regards,

Tony.

--- On Wed, 17/6/09, Christopher E. Brown <chris.brown at acsalaska.net> wrote:

From: Christopher E. Brown <chris.brown at acsalaska.net>
Subject: [c-nsp] Cisco 2821 as an ethernet fed MPLS PE
To: "'Cisco-nsp'" <cisco-nsp at puck.nether.net>
Date: Wednesday, 17 June, 2009, 8:49 AM



Can anyone comment on the 2821 as an ethernet fed MPLS PE?


This would require a settable MTU on the GigE ports "ie: mtu 1576", and standard support
for LDP, MP-BGP, standard L3 VPN support.


Spent too much time trolling Cisco site and not finding answers.

------------------------------

From danletkeman at gmail.com  Tue Jun 16 20:13:18 2009
From: danletkeman at gmail.com (Dan Letkeman)
Date: Tue, 16 Jun 2009 19:13:18 -0500
Subject: [c-nsp] Dynamic DNS updates to Local DNS Server
Message-ID: <dcbb85870906161713m6180a202r5be4f1ca56ef5b30@mail.gmail.com>

Hello,

I cannot seem to find any information or configuration examples of
using a Cisco IOS DHCP server to update A records on a local dns
server.

I would like to have the router that is running dhcp update the
records for a few windows workstation to a bind dns server.

Any help would be appreciated.

From tseveendorj at gmail.com  Tue Jun 16 20:42:32 2009
From: tseveendorj at gmail.com (Tseveendorj)
Date: Wed, 17 Jun 2009 09:42:32 +0900
Subject: [c-nsp] 3825 memory issue
Message-ID: <4A383BF8.4020705@gmail.com>

Hello,

I'm using 3825 router to provide internet for ADSL customers. Last week 
I configured policy-map to provide different bandwidth usage. Since this 
time my routers memory usage goes up.

border-r#sh processes memory sorted allocated
Processor Pool Total:  143619888 Used:  118621160 Free:   24998728
      I/O Pool Total:   36699648 Used:   10651088 Free:   26048560

 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
   0   0 4186877216 4187728860    1501456     256604          0 *Dead*
 104   0  110901912    6213036   95681064          0          0 PPP IP Route
 224   0   79114360   79153804       8752          0          0 crypto 
sw pk pro
   0   0   45088716   14947936   24508036          0          0 *Init*
 219   0   26739468   26964080      13060          0          0 SNMP ENGINE
 217   0   17194704   16959140      24012          0          0 IP SNMP
   1   0   16815572   15676464    1146168          0          0 Chunk 
Manager
 225   0   12566668   12602840     170956          0          0 
VTEMPLATE Backgr
 213   0    5154176   13760992      38104          0          0 PPP Events
  18   0    4428420    4428088       7392          0          0 ARP 
Background
 210   0    3901896    1455596     422460          0          0 PPPoE 
Discovery
  88   0    3291920    3138964      82928          0          0 IP Input
 109   0    2823624          0      13060          0          0 TCP 
Protocols
 209   0    1489464     320004     606848          0          0 PPPoE 
Background
  83   0    1131888          0       7060          0          0 AAA ACCT 
Proc
 222   0     969124    4249452      67108          0          0 RADIUS
  82   0     953112        252      13664          0          0 AAA Server
 207   0     750732       4252     775844          0          0 L2TP 
mgmt daemon
  59   0     648724       1328     629396          0          0 USB Startup
 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
  95   0     439864     305652     243420          0          0 SSS Manager
  77 578     413692     401112      24988          0          0 Virtual Exec
 178   0     350580    1918340       7060          0          0 AAA SEND 
STOP EV
  25   0     263208          0     272656     113400          0 EEM ED 
Syslog
 198   0     250300     250300      13060          0          0 Syslog
 167   0     247992          0     255052          0          0 
QOS_MODULE_MAIN
 188   0     119396       7344     125844          0          0 EEM Server
 122   0     108244        252     115052          0          0 SCTP 
Main Proces
 120   0     104664        252     103352          0          0 DHCPD 
Receive
  93   0      98112        504      13060          0          0 PPP Hooks
 106   0      73808          0      73808          0          0 CEF process
 142   0      73236        252      72648          0          0 FLEX 
DSPRM MAIN
  17   0      72948      32844      47164          0          0 ARP Input
  24   0      72748          0      79808          0          0 Entity 
MIB API
  40   0      67568       4424       7060          0          0 TTY 
Background
 103   0      66736          0      76796          0          0 IP RIB 
Update
   4   0      65588          0      90648          0          0 EDDRI_MAIN
 152   0      59568      73276       7060          0          0 LOCAL AAA
  54   0      57904        252      64712          0          0 VNM 
DSPRM MAIN
 206   0      56660          0      15868          0          0 SSH 
Event handle
  84   0      49384          0      56444          0          0 ACCT 
Periodic Pr
 226   0      47236      16108      16152          0          0 BGP Router

I have several questions.

1. What is *Dead* process ? it takes many memory why ?
2. Is there any unknown process working ?
3. How do I decrease memory usage ?
4. What is column of memory real usage ?

Sincerely,
Tseveen.

From andy.saykao at staff.netspace.net.au  Tue Jun 16 21:43:27 2009
From: andy.saykao at staff.netspace.net.au (Andy Saykao)
Date: Wed, 17 Jun 2009 11:43:27 +1000
Subject: [c-nsp] Can you apply crypto map to SVI
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
	<4A375FB9.3010305@umn.edu>
Message-ID: <56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>

Hi Ge,

Yes I see an active crypto engine in "software". 

core1#sh cry engine configuration

        crypto engine name:  unknown
        crypto engine type:  software
             serial number:  00016956
       crypto engine state:  installed
     crypto engine in slot:  N/A
                  platform:  Cisco Software Crypto Engine

   Encryption Process Info:
          input queue size:  500
           input queue top:  0
           input queue bot:  0
         input queue count:  0

   Crypto Adjacency Counts:
                Lock Count:  0
              Unlock Count:  0
        crypto lib version:  17.0.0
         ipsec lib version:  2.0.0

Does this mean that if the crypto map is applied to the SVI that the
IPSEC tunnel should be working (considering my IPSEC config is all
good).

Thanks.

Andy

-----Original Message-----
From: Ge Moua [mailto:moua0100 at umn.edu] 
Sent: Tuesday, 16 June 2009 7:03 PM
To: Andy Saykao
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Can you apply crypto map to SVI

Yes, this should work contigent on hw plaform.  If you do a "sh cry
engine" do you see an active crypto engine in sw or hw?  If not then the
crypto commands will never be invoked even though legal.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi All,
>  
> Got a problem with a site-to-site IPSEC vpn implementation where one 
> end is using SVI.
>  
> Does any body know if a crypto map can be applied to a SVI to bring up

> the IPSEC tunnel? It accepts the command but I can't pass any traffic 
> to/from it.
>  
> interface vlan 10
>  crypto map MY-MAP
>  
> Or do you need to apply the crypto map to a physical interface? 
>  
> I've gotten it working on a sub-interface (eg: interface
> GigabitEthernet0/0.11) but can't find any documentation that talks 
> about applying it to a SVI and whether this will work.
>  
> Thanks.
>  
> Andy
>
> This email and any files transmitted with it are confidential and 
> intended  solely for the use of the individual or entity to whom they
are addressed.
> Please notify the sender immediately by email if you have received 
> this email by mistake and delete this email from your system. Please 
> note that  any views or opinions presented in this email are solely 
> those of the  author and do not necessarily represent those of the
organisation.
> Finally, the recipient should check this email and any attachments for

> the presence of viruses. The organisation accepts no liability for any

> damage caused by any virus transmitted by this email.
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________

From uugnaa_mns at yahoo.com  Tue Jun 16 22:16:37 2009
From: uugnaa_mns at yahoo.com (uugnaa)
Date: Tue, 16 Jun 2009 19:16:37 -0700 (PDT)
Subject: [c-nsp] 3825 memory issue
Message-ID: <952530.34890.qm@web55102.mail.re4.yahoo.com>

Hello,

*Dead* is nothing but processes as a group that are now dead.


"Holding" is Amount of memory currently allocated to the process.

"Allocated" is Bytes of memory allocated by the process.

"Freed" is Bytes of memory freed by the process, regardless of who originally allocated it.

Please try on following command, you may get glue
#show memory dead 
#show memory debug unused
#show memory
#show processes


--- On Wed, 6/17/09, Tseveendorj <tseveendorj at gmail.com> wrote:

From: Tseveendorj <tseveendorj at gmail.com>
Subject: [c-nsp] 3825 memory issue
To: cisco-nsp at puck.nether.net
Date: Wednesday, June 17, 2009, 6:12 AM

Hello,

I'm using 3825 router to provide internet for ADSL customers. Last week I configured policy-map to provide different bandwidth usage. Since this time my routers memory usage goes up.

border-r#sh processes memory sorted allocated
Processor Pool Total:? 143619888 Used:? 118621160 Free:???24998728
? ???I/O Pool Total:???36699648 Used:???10651088 Free:???26048560

PID TTY? Allocated? ? ? Freed? ? Holding? ? Getbufs? ? Retbufs Process
? 0???0 4186877216 4187728860? ? 1501456? ???256604? ? ? ? ? 0 *Dead*
104???0? 110901912? ? 6213036???95681064? ? ? ? ? 0? ? ? ? ? 0 PPP IP Route
224???0???79114360???79153804? ? ???8752? ? ? ? ? 0? ? ? ? ? 0 crypto sw pk pro
? 0???0???45088716???14947936???24508036? ? ? ? ? 0? ? ? ? ? 0 *Init*
219???0???26739468???26964080? ? ? 13060? ? ? ? ? 0? ? ? ? ? 0 SNMP ENGINE
217???0???17194704???16959140? ? ? 24012? ? ? ? ? 0? ? ? ? ? 0 IP SNMP
? 1???0???16815572???15676464? ? 1146168? ? ? ? ? 0? ? ? ? ? 0 Chunk Manager
225???0???12566668???12602840? ???170956? ? ? ? ? 0? ? ? ? ? 0 VTEMPLATE Backgr
213???0? ? 5154176???13760992? ? ? 38104? ? ? ? ? 0? ? ? ? ? 0 PPP Events
 18???0? ? 4428420? ? 4428088? ? ???7392? ? ? ? ? 0? ? ? ? ? 0 ARP Background
210???0? ? 3901896? ? 1455596? ???422460? ? ? ? ? 0? ? ? ? ? 0 PPPoE Discovery
 88???0? ? 3291920? ? 3138964? ? ? 82928? ? ? ? ? 0? ? ? ? ? 0 IP Input
109???0? ? 2823624? ? ? ? ? 0? ? ? 13060? ? ? ? ? 0? ? ? ? ? 0 TCP Protocols
209???0? ? 1489464? ???320004? ???606848? ? ? ? ? 0? ? ? ? ? 0 PPPoE Background
 83???0? ? 1131888? ? ? ? ? 0? ? ???7060? ? ? ? ? 0? ? ? ? ? 0 AAA ACCT Proc
222???0? ???969124? ? 4249452? ? ? 67108? ? ? ? ? 0? ? ? ? ? 0 RADIUS
 82???0? ???953112? ? ? ? 252? ? ? 13664? ? ? ? ? 0? ? ? ? ? 0 AAA Server
207???0? ???750732? ? ???4252? ???775844? ? ? ? ? 0? ? ? ? ? 0 L2TP mgmt daemon
 59???0? ???648724? ? ???1328? ???629396? ? ? ? ? 0? ? ? ? ? 0 USB Startup
PID TTY? Allocated? ? ? Freed? ? Holding? ? Getbufs? ? Retbufs Process
 95???0? ???439864? ???305652? ???243420? ? ? ? ? 0? ? ? ? ? 0 SSS Manager
 77 578? ???413692? ???401112? ? ? 24988? ? ? ? ? 0? ? ? ? ? 0 Virtual Exec
178???0? ???350580? ? 1918340? ? ???7060? ? ? ? ? 0? ? ? ? ? 0 AAA SEND STOP EV
 25???0? ???263208? ? ? ? ? 0? ???272656? ???113400? ? ? ? ? 0 EEM ED Syslog
198???0? ???250300? ???250300? ? ? 13060? ? ? ? ? 0? ? ? ? ? 0 Syslog
167???0? ???247992? ? ? ? ? 0? ???255052? ? ? ? ? 0? ? ? ? ? 0 QOS_MODULE_MAIN
188???0? ???119396? ? ???7344? ???125844? ? ? ? ? 0? ? ? ? ? 0 EEM Server
122???0? ???108244? ? ? ? 252? ???115052? ? ? ? ? 0? ? ? ? ? 0 SCTP Main Proces
120???0? ???104664? ? ? ? 252? ???103352? ? ? ? ? 0? ? ? ? ? 0 DHCPD Receive
 93???0? ? ? 98112? ? ? ? 504? ? ? 13060? ? ? ? ? 0? ? ? ? ? 0 PPP Hooks
106???0? ? ? 73808? ? ? ? ? 0? ? ? 73808? ? ? ? ? 0? ? ? ? ? 0 CEF process
142???0? ? ? 73236? ? ? ? 252? ? ? 72648? ? ? ? ? 0? ? ? ? ? 0 FLEX DSPRM MAIN
 17???0? ? ? 72948? ? ? 32844? ? ? 47164? ? ? ? ? 0? ? ? ? ? 0 ARP Input
 24???0? ? ? 72748? ? ? ? ? 0? ? ? 79808? ? ? ? ? 0? ? ? ? ? 0 Entity MIB API
 40???0? ? ? 67568? ? ???4424? ? ???7060? ? ? ? ? 0? ? ? ? ? 0 TTY Background
103???0? ? ? 66736? ? ? ? ? 0? ? ? 76796? ? ? ? ? 0? ? ? ? ? 0 IP RIB Update
? 4???0? ? ? 65588? ? ? ? ? 0? ? ? 90648? ? ? ? ? 0? ? ? ? ? 0 EDDRI_MAIN
152???0? ? ? 59568? ? ? 73276? ? ???7060? ? ? ? ? 0? ? ? ? ? 0 LOCAL AAA
 54???0? ? ? 57904? ? ? ? 252? ? ? 64712? ? ? ? ? 0? ? ? ? ? 0 VNM DSPRM MAIN
206???0? ? ? 56660? ? ? ? ? 0? ? ? 15868? ? ? ? ? 0? ? ? ? ? 0 SSH Event handle
 84???0? ? ? 49384? ? ? ? ? 0? ? ? 56444? ? ? ? ? 0? ? ? ? ? 0 ACCT Periodic Pr
226???0? ? ? 47236? ? ? 16108? ? ? 16152? ? ? ? ? 0? ? ? ? ? 0 BGP Router

I have several questions.

1. What is *Dead* process ? it takes many memory why ?
2. Is there any unknown process working ?
3. How do I decrease memory usage ?
4. What is column of memory real usage ?

Sincerely,
Tseveen.
_______________________________________________
cisco-nsp mailing list? cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



      

From moua0100 at umn.edu  Wed Jun 17 00:15:24 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Tue, 16 Jun 2009 23:15:24 -0500
Subject: [c-nsp] Can you apply crypto map to SVI
In-Reply-To: <56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
	<4A375FB9.3010305@umn.edu>
	<56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>
Message-ID: <4A386DDC.6030302@umn.edu>

Maybe; I've seen a situation with the me-6524 with the crypto commands 
available but functionality disabled.  What hardware platform are you 
running?

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi Ge,
>
> Yes I see an active crypto engine in "software". 
>
> core1#sh cry engine configuration
>
>         crypto engine name:  unknown
>         crypto engine type:  software
>              serial number:  00016956
>        crypto engine state:  installed
>      crypto engine in slot:  N/A
>                   platform:  Cisco Software Crypto Engine
>
>    Encryption Process Info:
>           input queue size:  500
>            input queue top:  0
>            input queue bot:  0
>          input queue count:  0
>
>    Crypto Adjacency Counts:
>                 Lock Count:  0
>               Unlock Count:  0
>         crypto lib version:  17.0.0
>          ipsec lib version:  2.0.0
>
> Does this mean that if the crypto map is applied to the SVI that the
> IPSEC tunnel should be working (considering my IPSEC config is all
> good).
>
> Thanks.
>
> Andy
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu] 
> Sent: Tuesday, 16 June 2009 7:03 PM
> To: Andy Saykao
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Can you apply crypto map to SVI
>
> Yes, this should work contigent on hw plaform.  If you do a "sh cry
> engine" do you see an active crypto engine in sw or hw?  If not then the
> crypto commands will never be invoked even though legal.
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Andy Saykao wrote:
>   
>> Hi All,
>>  
>> Got a problem with a site-to-site IPSEC vpn implementation where one 
>> end is using SVI.
>>  
>> Does any body know if a crypto map can be applied to a SVI to bring up
>>     
>
>   
>> the IPSEC tunnel? It accepts the command but I can't pass any traffic 
>> to/from it.
>>  
>> interface vlan 10
>>  crypto map MY-MAP
>>  
>> Or do you need to apply the crypto map to a physical interface? 
>>  
>> I've gotten it working on a sub-interface (eg: interface
>> GigabitEthernet0/0.11) but can't find any documentation that talks 
>> about applying it to a SVI and whether this will work.
>>  
>> Thanks.
>>  
>> Andy
>>
>> This email and any files transmitted with it are confidential and 
>> intended  solely for the use of the individual or entity to whom they
>>     
> are addressed.
>   
>> Please notify the sender immediately by email if you have received 
>> this email by mistake and delete this email from your system. Please 
>> note that  any views or opinions presented in this email are solely 
>> those of the  author and do not necessarily represent those of the
>>     
> organisation.
>   
>> Finally, the recipient should check this email and any attachments for
>>     
>
>   
>> the presence of viruses. The organisation accepts no liability for any
>>     
>
>   
>> damage caused by any virus transmitted by this email.
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email
> ______________________________________________________________________
>   

From andy.saykao at staff.netspace.net.au  Wed Jun 17 00:17:45 2009
From: andy.saykao at staff.netspace.net.au (Andy Saykao)
Date: Wed, 17 Jun 2009 14:17:45 +1000
Subject: [c-nsp] Can you apply crypto map to SVI
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
	<4A375FB9.3010305@umn.edu>
	<56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>
	<4A386DDC.6030302@umn.edu>
Message-ID: <56F211C5E3F24F47B103EA1B253822BE03654E87@vic-cr-ex1.staff.netspace.net.au>

Hi Ge,

This is being implemented on a Cisco 7606 (SUP720) running
12.2(18)SXF16.

Thanks.

Andy 

-----Original Message-----
From: Ge Moua [mailto:moua0100 at umn.edu] 
Sent: Wednesday, 17 June 2009 2:15 PM
To: Andy Saykao
Cc: cisco-nsp at puck.nether.net
Subject: Re: Can you apply crypto map to SVI

Maybe; I've seen a situation with the me-6524 with the crypto commands
available but functionality disabled.  What hardware platform are you
running?

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi Ge,
>
> Yes I see an active crypto engine in "software". 
>
> core1#sh cry engine configuration
>
>         crypto engine name:  unknown
>         crypto engine type:  software
>              serial number:  00016956
>        crypto engine state:  installed
>      crypto engine in slot:  N/A
>                   platform:  Cisco Software Crypto Engine
>
>    Encryption Process Info:
>           input queue size:  500
>            input queue top:  0
>            input queue bot:  0
>          input queue count:  0
>
>    Crypto Adjacency Counts:
>                 Lock Count:  0
>               Unlock Count:  0
>         crypto lib version:  17.0.0
>          ipsec lib version:  2.0.0
>
> Does this mean that if the crypto map is applied to the SVI that the 
> IPSEC tunnel should be working (considering my IPSEC config is all 
> good).
>
> Thanks.
>
> Andy
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu]
> Sent: Tuesday, 16 June 2009 7:03 PM
> To: Andy Saykao
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Can you apply crypto map to SVI
>
> Yes, this should work contigent on hw plaform.  If you do a "sh cry 
> engine" do you see an active crypto engine in sw or hw?  If not then 
> the crypto commands will never be invoked even though legal.
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Andy Saykao wrote:
>   
>> Hi All,
>>  
>> Got a problem with a site-to-site IPSEC vpn implementation where one 
>> end is using SVI.
>>  
>> Does any body know if a crypto map can be applied to a SVI to bring 
>> up
>>     
>
>   
>> the IPSEC tunnel? It accepts the command but I can't pass any traffic

>> to/from it.
>>  
>> interface vlan 10
>>  crypto map MY-MAP
>>  
>> Or do you need to apply the crypto map to a physical interface? 
>>  
>> I've gotten it working on a sub-interface (eg: interface
>> GigabitEthernet0/0.11) but can't find any documentation that talks 
>> about applying it to a SVI and whether this will work.
>>  
>> Thanks.
>>  
>> Andy
>>
>> This email and any files transmitted with it are confidential and 
>> intended  solely for the use of the individual or entity to whom they
>>     
> are addressed.
>   
>> Please notify the sender immediately by email if you have received 
>> this email by mistake and delete this email from your system. Please 
>> note that  any views or opinions presented in this email are solely 
>> those of the  author and do not necessarily represent those of the
>>     
> organisation.
>   
>> Finally, the recipient should check this email and any attachments 
>> for
>>     
>
>   
>> the presence of viruses. The organisation accepts no liability for 
>> any
>>     
>
>   
>> damage caused by any virus transmitted by this email.
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email 
> ______________________________________________________________________
>   

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________

From moua0100 at umn.edu  Wed Jun 17 00:43:45 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Tue, 16 Jun 2009 23:43:45 -0500
Subject: [c-nsp] Can you apply crypto map to SVI
In-Reply-To: <56F211C5E3F24F47B103EA1B253822BE03654E87@vic-cr-ex1.staff.netspace.net.au>
References: <56F211C5E3F24F47B103EA1B253822BE03654E84@vic-cr-ex1.staff.netspace.net.au>
	<4A375FB9.3010305@umn.edu>
	<56F211C5E3F24F47B103EA1B253822BE03654E86@vic-cr-ex1.staff.netspace.net.au>
	<4A386DDC.6030302@umn.edu>
	<56F211C5E3F24F47B103EA1B253822BE03654E87@vic-cr-ex1.staff.netspace.net.au>
Message-ID: <4A387481.4080403@umn.edu>

I think on the 6500 with Sup720 you may need a IPSec VAM or SPA card for 
IPSec functionality to be active; I wonder if this is the same on the 
7606; you should open a case with Cisco and ask the quesiton.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi Ge,
>
> This is being implemented on a Cisco 7606 (SUP720) running
> 12.2(18)SXF16.
>
> Thanks.
>
> Andy 
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu] 
> Sent: Wednesday, 17 June 2009 2:15 PM
> To: Andy Saykao
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: Can you apply crypto map to SVI
>
> Maybe; I've seen a situation with the me-6524 with the crypto commands
> available but functionality disabled.  What hardware platform are you
> running?
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Andy Saykao wrote:
>   
>> Hi Ge,
>>
>> Yes I see an active crypto engine in "software". 
>>
>> core1#sh cry engine configuration
>>
>>         crypto engine name:  unknown
>>         crypto engine type:  software
>>              serial number:  00016956
>>        crypto engine state:  installed
>>      crypto engine in slot:  N/A
>>                   platform:  Cisco Software Crypto Engine
>>
>>    Encryption Process Info:
>>           input queue size:  500
>>            input queue top:  0
>>            input queue bot:  0
>>          input queue count:  0
>>
>>    Crypto Adjacency Counts:
>>                 Lock Count:  0
>>               Unlock Count:  0
>>         crypto lib version:  17.0.0
>>          ipsec lib version:  2.0.0
>>
>> Does this mean that if the crypto map is applied to the SVI that the 
>> IPSEC tunnel should be working (considering my IPSEC config is all 
>> good).
>>
>> Thanks.
>>
>> Andy
>>
>> -----Original Message-----
>> From: Ge Moua [mailto:moua0100 at umn.edu]
>> Sent: Tuesday, 16 June 2009 7:03 PM
>> To: Andy Saykao
>> Cc: cisco-nsp at puck.nether.net
>> Subject: Re: [c-nsp] Can you apply crypto map to SVI
>>
>> Yes, this should work contigent on hw plaform.  If you do a "sh cry 
>> engine" do you see an active crypto engine in sw or hw?  If not then 
>> the crypto commands will never be invoked even though legal.
>>
>> Regards,
>> Ge Moua | Email: moua0100 at umn.edu
>>
>> Network Design Engineer
>> University of Minnesota | Networking & Telecommunications Services
>>
>>
>>
>> Andy Saykao wrote:
>>   
>>     
>>> Hi All,
>>>  
>>> Got a problem with a site-to-site IPSEC vpn implementation where one 
>>> end is using SVI.
>>>  
>>> Does any body know if a crypto map can be applied to a SVI to bring 
>>> up
>>>     
>>>       
>>   
>>     
>>> the IPSEC tunnel? It accepts the command but I can't pass any traffic
>>>       
>
>   
>>> to/from it.
>>>  
>>> interface vlan 10
>>>  crypto map MY-MAP
>>>  
>>> Or do you need to apply the crypto map to a physical interface? 
>>>  
>>> I've gotten it working on a sub-interface (eg: interface
>>> GigabitEthernet0/0.11) but can't find any documentation that talks 
>>> about applying it to a SVI and whether this will work.
>>>  
>>> Thanks.
>>>  
>>> Andy
>>>
>>> This email and any files transmitted with it are confidential and 
>>> intended  solely for the use of the individual or entity to whom they
>>>     
>>>       
>> are addressed.
>>   
>>     
>>> Please notify the sender immediately by email if you have received 
>>> this email by mistake and delete this email from your system. Please 
>>> note that  any views or opinions presented in this email are solely 
>>> those of the  author and do not necessarily represent those of the
>>>     
>>>       
>> organisation.
>>   
>>     
>>> Finally, the recipient should check this email and any attachments 
>>> for
>>>     
>>>       
>>   
>>     
>>> the presence of viruses. The organisation accepts no liability for 
>>> any
>>>     
>>>       
>>   
>>     
>>> damage caused by any virus transmitted by this email.
>>>
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>   
>>>     
>>>       
>> ______________________________________________________________________
>> This email has been scanned by the MessageLabs Email Security System.
>> For more information please visit http://www.messagelabs.com/email 
>> ______________________________________________________________________
>>   
>>     
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email
> ______________________________________________________________________
>   

From tseveendorj at gmail.com  Wed Jun 17 00:36:10 2009
From: tseveendorj at gmail.com (Tseveendorj)
Date: Wed, 17 Jun 2009 13:36:10 +0900
Subject: [c-nsp] 3825 memory issue
In-Reply-To: <952530.34890.qm@web55102.mail.re4.yahoo.com>
References: <952530.34890.qm@web55102.mail.re4.yahoo.com>
Message-ID: <4A3872BA.9010500@gmail.com>

PPP IP Route process eating a lot of memory and It is keep eating up 
hour by hour.

border-r#sh processes memory sorted holding
Processor Pool Total:  143619888 Used:  120966360 Free:   22653528
      I/O Pool Total:   36699648 Used:   10651088 Free:   26048560

 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
 104   0  113301400    6272240   97988856          0          0 PPP IP Route
   0   0   45088716   14947936   24508036          0          0 *Init*
   0   0   11410388   12182232    1503712     256604          0 *Dead*
   1   0   16854608   15701280    1160388          0          0 Chunk 
Manager


Any clue get out of memory related thing with configuration ?
Other way I have to upgrade RAM.

Sincerely,
Tseveen.



uugnaa wrote:
> Hello,
>
> *Dead* is nothing but processes as a group that are now dead.
>
>
> "Holding" is Amount of memory currently allocated to the process.
>
> "Allocated" is Bytes of memory allocated by the process.
>
> "Freed" is Bytes of memory freed by the process, regardless of who originally allocated it.
>
> Please try on following command, you may get glue
> #show memory dead 
> #show memory debug unused
> #show memory
> #show processes
>
>
> --- On Wed, 6/17/09, Tseveendorj <tseveendorj at gmail.com> wrote:
>
> From: Tseveendorj <tseveendorj at gmail.com>
> Subject: [c-nsp] 3825 memory issue
> To: cisco-nsp at puck.nether.net
> Date: Wednesday, June 17, 2009, 6:12 AM
>
> Hello,
>
> I'm using 3825 router to provide internet for ADSL customers. Last week I configured policy-map to provide different bandwidth usage. Since this time my routers memory usage goes up.
>
> border-r#sh processes memory sorted allocated
> Processor Pool Total:  143619888 Used:  118621160 Free:   24998728
>      I/O Pool Total:   36699648 Used:   10651088 Free:   26048560
>
> PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
>   0   0 4186877216 4187728860    1501456     256604          0 *Dead*
> 104   0  110901912    6213036   95681064          0          0 PPP IP Route
> 224   0   79114360   79153804       8752          0          0 crypto sw pk pro
>   0   0   45088716   14947936   24508036          0          0 *Init*
> 219   0   26739468   26964080      13060          0          0 SNMP ENGINE
> 217   0   17194704   16959140      24012          0          0 IP SNMP
>   1   0   16815572   15676464    1146168          0          0 Chunk Manager
> 225   0   12566668   12602840     170956          0          0 VTEMPLATE Backgr
> 213   0    5154176   13760992      38104          0          0 PPP Events
>  18   0    4428420    4428088       7392          0          0 ARP Background
> 210   0    3901896    1455596     422460          0          0 PPPoE Discovery
>  88   0    3291920    3138964      82928          0          0 IP Input
> 109   0    2823624          0      13060          0          0 TCP Protocols
> 209   0    1489464     320004     606848          0          0 PPPoE Background
>  83   0    1131888          0       7060          0          0 AAA ACCT Proc
> 222   0     969124    4249452      67108          0          0 RADIUS
>  82   0     953112        252      13664          0          0 AAA Server
> 207   0     750732       4252     775844          0          0 L2TP mgmt daemon
>  59   0     648724       1328     629396          0          0 USB Startup
> PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
>  95   0     439864     305652     243420          0          0 SSS Manager
>  77 578     413692     401112      24988          0          0 Virtual Exec
> 178   0     350580    1918340       7060          0          0 AAA SEND STOP EV
>  25   0     263208          0     272656     113400          0 EEM ED Syslog
> 198   0     250300     250300      13060          0          0 Syslog
> 167   0     247992          0     255052          0          0 QOS_MODULE_MAIN
> 188   0     119396       7344     125844          0          0 EEM Server
> 122   0     108244        252     115052          0          0 SCTP Main Proces
> 120   0     104664        252     103352          0          0 DHCPD Receive
>  93   0      98112        504      13060          0          0 PPP Hooks
> 106   0      73808          0      73808          0          0 CEF process
> 142   0      73236        252      72648          0          0 FLEX DSPRM MAIN
>  17   0      72948      32844      47164          0          0 ARP Input
>  24   0      72748          0      79808          0          0 Entity MIB API
>  40   0      67568       4424       7060          0          0 TTY Background
> 103   0      66736          0      76796          0          0 IP RIB Update
>   4   0      65588          0      90648          0          0 EDDRI_MAIN
> 152   0      59568      73276       7060          0          0 LOCAL AAA
>  54   0      57904        252      64712          0          0 VNM DSPRM MAIN
> 206   0      56660          0      15868          0          0 SSH Event handle
>  84   0      49384          0      56444          0          0 ACCT Periodic Pr
> 226   0      47236      16108      16152          0          0 BGP Router
>
> I have several questions.
>
> 1. What is *Dead* process ? it takes many memory why ?
> 2. Is there any unknown process working ?
> 3. How do I decrease memory usage ?
> 4. What is column of memory real usage ?
>
> Sincerely,
> Tseveen.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
>       
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>   


From vitya at list.ru  Wed Jun 17 01:49:44 2009
From: vitya at list.ru (victor)
Date: Wed, 17 Jun 2009 09:49:44 +0400
Subject: [c-nsp] ME-4924-10GE & mgt port
Message-ID: <op.uvnmg6bg2vrlim@localhost.localdomain>

Hi
Please, help. What is the purpose of mgt port on ME-4924-10GE. I somehow  
feel that it's for out-of-band management but there is no corresponding  
entry in the config. Though during the boot it prints "1 Virtual Ethernet  
Interface". Current IOS - ipbase-m 12.2(31) sga5.
How can I use this port?
-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From oboehmer at cisco.com  Wed Jun 17 02:24:01 2009
From: oboehmer at cisco.com (Oliver Boehmer (oboehmer))
Date: Wed, 17 Jun 2009 08:24:01 +0200
Subject: [c-nsp] clear ip pool
In-Reply-To: <H0000084006e1e5f.1244800486.bohr.dbmg.de@MHS>
References: <H0000084006e1e5f.1244800486.bohr.dbmg.de@MHS>
Message-ID: <70B7A1CCBFA5C649BD562B6D9F7ED7840784BF34@xmb-ams-333.emea.cisco.com>

Sebastian Ganschow <> wrote on Friday, June 12, 2009 11:55:

> Hi,
> 
> we've got our ciscos configured that ip pool configuration is derived
> from our radius servers.
> 
> In order to change the ip pool, I change the pool in the radius
> config. But our ciscos are still using the old ip pool. It seems like
> some caching issue.
> 
> Is there any way to let the cisco forget the pool information and get
> it again from the radius server?

Hmm, it's been a while since I dealt with that sort of stuff, and there
is an AVP (cisco-avpair = "ip:pool-timeout=<minutes>") you can (and
should) send along with the pool definition. I fear the default is "no
timeout", and I'm not aware how to manually clear this. Maybe you can
try "no ip local pool <name>" to purge it..

	oli

From avayner at cisco.com  Wed Jun 17 02:31:31 2009
From: avayner at cisco.com (Arie Vayner (avayner))
Date: Wed, 17 Jun 2009 08:31:31 +0200
Subject: [c-nsp] ME-4924-10GE & mgt port
In-Reply-To: <op.uvnmg6bg2vrlim@localhost.localdomain>
References: <op.uvnmg6bg2vrlim@localhost.localdomain>
Message-ID: <78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>

Victor,

Try taking a look here:
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/conf
iguration/guide/sw_int.html#wp1110617

Arie

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of victor
Sent: Wednesday, June 17, 2009 08:50
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ME-4924-10GE & mgt port

Hi
Please, help. What is the purpose of mgt port on ME-4924-10GE. I somehow

feel that it's for out-of-band management but there is no corresponding

entry in the config. Though during the boot it prints "1 Virtual
Ethernet  
Interface". Current IOS - ipbase-m 12.2(31) sga5.
How can I use this port?
-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From Ronny.Faessler at srgssrideesuisse.ch  Wed Jun 17 01:59:24 2009
From: Ronny.Faessler at srgssrideesuisse.ch (=?iso-8859-1?Q?F=E4ssler=2C_Ronny?=)
Date: Wed, 17 Jun 2009 07:59:24 +0200
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <mailman.575.1245181541.2287.cisco-nsp@puck.nether.net>
References: <mailman.575.1245181541.2287.cisco-nsp@puck.nether.net>
Message-ID: <4D958EB6FC3CC442B053B06F57497F7E012BF7D2@seginus.GD.AD.PROD>

Just additional Info 
Here's what "my" Cisco Technical sayed last time i looked at it...

You can not point the next-hop to the local routers interface. 
Development does not plan on supporting this configuration.   <---- !!!! 

Looks bad - I did it with a "golden Cable" -  Physcal crossover loop...

Have a great day
Ronny

From vitya at list.ru  Wed Jun 17 03:54:03 2009
From: vitya at list.ru (victor)
Date: Wed, 17 Jun 2009 11:54:03 +0400
Subject: [c-nsp] ME-4924-10GE & mgt port
In-Reply-To: <78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>
References: <op.uvnmg6bg2vrlim@localhost.localdomain>
	<78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>
Message-ID: <op.uvnr4mc42vrlim@localhost.localdomain>

Like I said there is nothing like "interface FastEthernet1" in the  
running-config
Maybe I need to enable it somewhere?
When I plug in a patch-cord the link ON THE OTHER SIDE goes up but the  
light beneath mgt port doesn't light up.
BTW, sho int doesn't list Fe1 as a possible option.

On Wed, 17 Jun 2009 10:31:31 +0400, Arie Vayner (avayner)  
<avayner at cisco.com> wrote:

> Victor,
>
> Try taking a look here:
> http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/conf
> iguration/guide/sw_int.html#wp1110617
>
> Arie
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of victor
> Sent: Wednesday, June 17, 2009 08:50
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ME-4924-10GE & mgt port
>
> Hi
> Please, help. What is the purpose of mgt port on ME-4924-10GE. I somehow
>
> feel that it's for out-of-band management but there is no corresponding
>
> entry in the config. Though during the boot it prints "1 Virtual
> Ethernet
> Interface". Current IOS - ipbase-m 12.2(31) sga5.
> How can I use this port?


-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

From euang+cisco-nsp at lists.eusahues.co.uk  Wed Jun 17 04:33:08 2009
From: euang+cisco-nsp at lists.eusahues.co.uk (Euan Galloway)
Date: Wed, 17 Jun 2009 09:33:08 +0100
Subject: [c-nsp] ME-4924-10GE & mgt port
In-Reply-To: <op.uvnr4mc42vrlim@localhost.localdomain>
References: <op.uvnmg6bg2vrlim@localhost.localdomain>
	<78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>
	<op.uvnr4mc42vrlim@localhost.localdomain>
Message-ID: <20090617083308.GA20135@hyperion.eusahues.co.uk>

On Wed, Jun 17, 2009 at 11:54:03AM +0400, victor wrote:
> Like I said there is nothing like "interface FastEthernet1" in the 
> running-config
> Maybe I need to enable it somewhere?
> When I plug in a patch-cord the link ON THE OTHER SIDE goes up but the 
> light beneath mgt port doesn't light up.
> BTW, sho int doesn't list Fe1 as a possible option.

Maybe this line (mentioned under "ISSU Model")

"So, you cannot enable the management port on a redundant chassis if one 
of the two supervisor engines is running an IOS image older than 12.2(50)SG 
(where the Management port is not supported)."

-- 
Euan Galloway

From steve.mcnamara at gmail.com  Wed Jun 17 05:53:40 2009
From: steve.mcnamara at gmail.com (Steve McNamara)
Date: Wed, 17 Jun 2009 10:53:40 +0100
Subject: [c-nsp] ME-4924-10GE & mgt port
In-Reply-To: <op.uvnr4mc42vrlim@localhost.localdomain>
References: <op.uvnmg6bg2vrlim@localhost.localdomain>
	<78C984F8939D424697B15E4B1C1BB3D7CCDF09@xmb-ams-331.emea.cisco.com>
	<op.uvnr4mc42vrlim@localhost.localdomain>
Message-ID: <494a4f80906170253y51d77059x4bc565f16d80f1eb@mail.gmail.com>

From
http://www.cisco.com/en/US/docs/switches/metro/me4924-10ge/hardware/installation/guide/HIGOVEW.html#wp1161221
 Management Port

The management port is used (in ROMMON mode only) to recover a switch
software image that has been corrupted or destroyed due to a network
catastrophe. This port is not active while the switch is operating normally.


You should designate one of the normalports on your switch as a management
port, used for configuration and monitoring traffic. D o not connect the
management port to this network, it is only intended to be used from a
direct console connection.

Regards

Steve

On Wed, Jun 17, 2009 at 08:54, victor <vitya at list.ru> wrote:

> Like I said there is nothing like "interface FastEthernet1" in the
> running-config
> Maybe I need to enable it somewhere?
> When I plug in a patch-cord the link ON THE OTHER SIDE goes up but the
> light beneath mgt port doesn't light up.
> BTW, sho int doesn't list Fe1 as a possible option.
>
>
> On Wed, 17 Jun 2009 10:31:31 +0400, Arie Vayner (avayner) <
> avayner at cisco.com> wrote:
>
>  Victor,
>>
>> Try taking a look here:
>> http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/conf
>> iguration/guide/sw_int.html#wp1110617
>>
>> Arie
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of victor
>> Sent: Wednesday, June 17, 2009 08:50
>> To: cisco-nsp at puck.nether.net
>> Subject: [c-nsp] ME-4924-10GE & mgt port
>>
>> Hi
>> Please, help. What is the purpose of mgt port on ME-4924-10GE. I somehow
>>
>> feel that it's for out-of-band management but there is no corresponding
>>
>> entry in the config. Though during the boot it prints "1 Virtual
>> Ethernet
>> Interface". Current IOS - ipbase-m 12.2(31) sga5.
>> How can I use this port?
>>
>
>
> --
> Using Opera's revolutionary e-mail client: http://www.opera.com/mail/
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From jmaimon at ttec.com  Wed Jun 17 06:17:04 2009
From: jmaimon at ttec.com (Joe Maimon)
Date: Wed, 17 Jun 2009 06:17:04 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>	<002501c9eea7$34983830$0a00000a@nil.si>	<02d001c9eea9$6f918020$4eb48060$@net>
	<9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
Message-ID: <4A38C2A0.1010500@ttec.com>



Tim Durack wrote:

> 
> Amen to that.
> 
> I've played around with the various loopback strategies, including
> using a gre tunnel that originates/terminates on the same PE. It
> worked, but didn't seem like a scalable solution.

A dot1q trunk between two ports (if your not using a switch platform as 
your router) or even ATM scales. You just pay 2x pps. And you can scale 
it for however many connections you want. Which is probably faster than 
tunnels, but I havent actually benchmarked it.

> 
> The conclusion I came to is that most MPLS scenarios assume you are
> using a separate PE/firewall to move traffic between global and vrfs
> (and probably even inter-vrf.)
> 
> It would be great to have a simple global-vrf route exchange feature though.

And a way to treat it as an interface on both sides.

> 
> Tim:>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> 

From s.ganschow at buelow-masiak.de  Wed Jun 17 06:49:23 2009
From: s.ganschow at buelow-masiak.de (Sebastian Ganschow)
Date: Wed, 17 Jun 2009 12:49:23 +0200
Subject: [c-nsp] clear ip pool
In-Reply-To: <70B7A1CCBFA5C649BD562B6D9F7ED7840784BF34@xmb-ams-333.emea.cisco.com>
Message-ID: <H0000084006ecdb2.1245235762.bohr.dbmg.de@MHS>

> Hmm, it's been a while since I dealt with that sort of stuff, and 
there
> is an AVP (cisco-avpair = "ip:pool-timeout=<minutes>") you can (and
> should) send along with the pool definition. I fear the default is "no
> timeout", and I'm not aware how to manually clear this. Maybe you can
> try "no ip local pool <name>" to purge it..
> 
> 	oli

You can purge the pool with no ip local pool <name>, but the infos I 
found on CCO are saying, that the information from the radius server is 
only retrieved during a reload.

Sebastian



From oboehmer at cisco.com  Wed Jun 17 06:54:00 2009
From: oboehmer at cisco.com (Oliver Boehmer (oboehmer))
Date: Wed, 17 Jun 2009 12:54:00 +0200
Subject: [c-nsp] clear ip pool
In-Reply-To: <H0000084006ecdb2.1245235762.bohr.dbmg.de@MHS>
References: <70B7A1CCBFA5C649BD562B6D9F7ED7840784BF34@xmb-ams-333.emea.cisco.com>
	<H0000084006ecdb2.1245235762.bohr.dbmg.de@MHS>
Message-ID: <70B7A1CCBFA5C649BD562B6D9F7ED7840784C16D@xmb-ams-333.emea.cisco.com>

Sebastian Ganschow <mailto:s.ganschow at buelow-masiak.de> wrote on
Wednesday, June 17, 2009 12:49:

>> Hmm, it's been a while since I dealt with that sort of stuff, and
>> there is an AVP (cisco-avpair = "ip:pool-timeout=<minutes>") you can
>> (and should) send along with the pool definition. I fear the default
>> is "no timeout", and I'm not aware how to manually clear this. Maybe
>> you can try "no ip local pool <name>" to purge it..
>> 
>> 	oli
> 
> You can purge the pool with no ip local pool <name>, but the infos I
> found on CCO are saying, that the information from the radius server
> is only retrieved during a reload.

hmm, where is this documented? If I recall correctly, the router tries
to fetch the pool from Radius when a user logs in whose authorization
information reference this pool and the pool is not yet defined (or has
expired when you sent "ip:pool-timeout" along with the pool)

	oli

From s.ganschow at buelow-masiak.de  Wed Jun 17 10:17:21 2009
From: s.ganschow at buelow-masiak.de (Sebastian Ganschow)
Date: Wed, 17 Jun 2009 16:17:21 +0200
Subject: [c-nsp] clear ip pool
In-Reply-To: <70B7A1CCBFA5C649BD562B6D9F7ED7840784C16D@xmb-ams-333.emea.cisco.com>
Message-ID: <H0000084006ecdba.1245248240.bohr.dbmg.de@MHS>

> hmm, where is this documented? If I recall correctly, the router tries
> to fetch the pool from Radius when a user logs in whose authorization
> information reference this pool and the pool is not yet defined (or 
has
> expired when you sent "ip:pool-timeout" along with the pool)

We had no timeout configured. I assume, the pool won't time out then.

There was no pool configured on the router, but sh ip local pool, showed 
the pool, which was retrieved via RADIUS. 
When I deleted the local pool with no ip local pool dslin, the pool was 
removed, but hasn't been loaded via RADIUS. So for the moment, I've 
configured the pool locally, till I can reload the router in the next 
maintenance window.

As I don't find the page, where this is documented, I can't send the 
link.

Sebastian 


From cluestore at gmail.com  Wed Jun 17 11:52:33 2009
From: cluestore at gmail.com (Clue Store)
Date: Wed, 17 Jun 2009 10:52:33 -0500
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>
	<002501c9eea7$34983830$0a00000a@nil.si>
	<02d001c9eea9$6f918020$4eb48060$@net>
	<9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
Message-ID: <580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>

> >It would be great to have a simple global-vrf route exchange feature
> though.


Anyone using a vrf for their global tables??  This solution could possibly
work for me but not sure what insane issues would come up by doing this.

From harbor235 at gmail.com  Wed Jun 17 09:57:35 2009
From: harbor235 at gmail.com (harbor235)
Date: Wed, 17 Jun 2009 09:57:35 -0400
Subject: [c-nsp] Network Perefromance
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C381C142C3@PUR-EXCH07.ox.com>
References: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>
	<483E6B0272B0284BA86D7596C40D29F9C381C142C3@PUR-EXCH07.ox.com>
Message-ID: <836bf1f90906170657i74ad129fh212d22c10b3c8687@mail.gmail.com>

I am definitely aware of IP SLA and also agree that it is very useful,
however, this customer's network is Juniper so I will be
unable to uitlize that feature.

MTR looks like it is doable, however, it uses icmp. I doubt that you can get
an accurate picture of the network using
icmp, can it be programed to use TCP or  udp and vary the packet size?

mike

On Tue, Jun 16, 2009 at 4:35 PM, Matthew Huff <mhuff at ox.com> wrote:

> We are a Cisco shop, so we use "ip sla" feature of newer IOS releases with
> CiscoWorks LMS. Netflow is useful for trafic monitoring, but for latency
> and
> jitter, the cisco featureset is really nice.
>
> For example, between two of our voice gateway boxes (running sip trunking
> between them) in NY & SF:
>
> rtr-nyvoip#show ip sla statistics aggregated 1
> IPSLAs aggregated statistics
>
> IPSLA operation id: 1
> Start Time Index: .16:15:07.749 EDT Tue Jun 16 2009
> Type of operation: udp-jitter
> Voice Scores:
> MinOfICPIF: 11  MaxOfICPIF: 11  MinOfMOS: 4.6   MaxOfMOS: 4.6
> RTT Values:
>        Number Of RTT: 18000            RTT Min/Avg/Max: 91/91/96
> milliseconds
> Latency one-way time:
>        Number of Latency one-way Samples: 0
>        Source to Destination Latency one way Min/Avg/Max: 0/0/0
> milliseconds
>        Destination to Source Latency one way Min/Avg/Max: 0/0/0
> milliseconds
> Jitter Time:
>        Number of SD Jitter Samples: 17982
>        Number of DS Jitter Samples: 17982
>        Source to Destination Jitter Min/Avg/Max: 0/1/4 milliseconds
>        Destination to Source Jitter Min/Avg/Max: 0/1/4 milliseconds
> Packet Loss Values:
>        Loss Source to Destination: 0           Loss Destination to Source:
> 0
>        Out Of Sequence: 0      Tail Drop: 0
>        Packet Late Arrival: 0  Packet Skipped: 0
> Number of successes: 18
> Number of failures: 0
>
> Start Time Index: .15:15:07.749 EDT Tue Jun 16 2009
> Type of operation: udp-jitter
> Voice Scores:
> MinOfICPIF: 11  MaxOfICPIF: 11  MinOfMOS: 4.6   MaxOfMOS: 4.6
> RTT Values:
>        Number Of RTT: 60000            RTT Min/Avg/Max: 91/91/103
> milliseconds
> Latency one-way time:
>        Number of Latency one-way Samples: 0
>        Source to Destination Latency one way Min/Avg/Max: 0/0/0
> milliseconds
>        Destination to Source Latency one way Min/Avg/Max: 0/0/0
> milliseconds
> Jitter Time:
>        Number of SD Jitter Samples: 59940
>        Number of DS Jitter Samples: 59940
>        Source to Destination Jitter Min/Avg/Max: 0/1/11 milliseconds
>        Destination to Source Jitter Min/Avg/Max: 0/1/7 milliseconds
> Packet Loss Values:
>        Loss Source to Destination: 0           Loss Destination to Source:
> 0
>        Out Of Sequence: 0      Tail Drop: 0
>        Packet Late Arrival: 0  Packet Skipped: 0
> Number of successes: 60
> Number of failures: 0
>
> The config is:
>
> ip sla responder
> ip sla logging traps
> ip sla 1
>  udp-jitter x.x.x.x 12420 source-ip x.x.x.x codec g729a
> ip sla schedule 1 life forever start-time now
>
>
> ----
> Matthew Huff       | One Manhattanville Rd
> OTA Management LLC | Purchase, NY 10577
> http://www.ox.com  | Phone: 914-460-4039
> aim: matthewbhuff  | Fax:   914-460-4139
>
>
>
> > -----Original Message-----
> > From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> > bounces at puck.nether.net] On Behalf Of harbor235
> > Sent: Tuesday, June 16, 2009 3:46 PM
> > To: cisco-nsp at puck.nether.net
> > Subject: [c-nsp] Network Perefromance
> >
> > I wanted to ping everyone on tools they were using to understand the
> > performace of their
> > network, specifically, measuring packet loss, latency, and jitter.
> >
> > mike
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From jeff-kell at utc.edu  Wed Jun 17 12:19:11 2009
From: jeff-kell at utc.edu (Jeff Kell)
Date: Wed, 17 Jun 2009 12:19:11 -0400
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com>	<002501c9eea7$34983830$0a00000a@nil.si>	<02d001c9eea9$6f918020$4eb48060$@net>	<9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com>
	<580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>
Message-ID: <4A39177F.3070403@utc.edu>

Clue Store wrote:
> Anyone using a vrf for their global tables??  This solution could possibly
> work for me but not sure what insane issues would come up by doing this.

After trying several other approaches and failing, "if you can't beat
them, join them..."

We use the "global table" only for infrastructure and network management
(ironically, our "out-of-band" needs).

User traffic is ALL in VRFs.

Jeff

From eric at atlantech.net  Wed Jun 17 12:33:13 2009
From: eric at atlantech.net (Eric Van Tol)
Date: Wed, 17 Jun 2009 12:33:13 -0400
Subject: [c-nsp] Network Perefromance
In-Reply-To: <836bf1f90906170657i74ad129fh212d22c10b3c8687@mail.gmail.com>
References: <836bf1f90906161245k5d217af5h32950925f115cd89@mail.gmail.com>
	<483E6B0272B0284BA86D7596C40D29F9C381C142C3@PUR-EXCH07.ox.com>
	<836bf1f90906170657i74ad129fh212d22c10b3c8687@mail.gmail.com>
Message-ID: <2C05E949E19A9146AF7BDF9D44085B86353E994F23@exchange.aoihq.local>

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of harbor235
> Sent: Wednesday, June 17, 2009 9:58 AM
> To: Matthew Huff
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Network Perefromance
> 
> I am definitely aware of IP SLA and also agree that it is very useful,
> however, this customer's network is Juniper so I will be
> unable to uitlize that feature.
> 

Look into RPM, available in JUNOS:

http://www.juniper.net/techpubs/en_US/junos9.5/information-products/topic-collections/config-guide-services/id-13352983.html#id-13352983

-evt

From paul at paulstewart.org  Wed Jun 17 13:05:33 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 17 Jun 2009 13:05:33 -0400
Subject: [c-nsp] 10GE blade questions
Message-ID: <000001c9ef6d$e0666350$a13329f0$@org>

We have a 6509 sup2/msfc2 switch which only does layer2 services - is there
10GE options available for this platform?

 

The WS-X6708-10G-3CXL  blades are also of interest for Sup720 platform - if
they are only doing VLAN trunks out to remote switches and any routing would
be done on SVI interfaces on the Sup720 then does it matter if you get only
the 3C version?

 

Thanks,

 

Paul

 

 

 


From rblayzor.bulk at inoc.net  Wed Jun 17 13:12:49 2009
From: rblayzor.bulk at inoc.net (Robert Blayzor)
Date: Wed, 17 Jun 2009 13:12:49 -0400
Subject: [c-nsp] NPE-G2 Management interface limitation
Message-ID: <0BAA3160-87C9-4353-95F6-D607FE811A43@inoc.net>

The NPE-G2 fact states:

Q. Are routing protocols supported on the 10/100BASE-T management  
interface?
A. Yes, routing protocols are supported on the management interface.  
However, the management interface is strictly for management purposes  
only, with limited packet forwarding.


We use management interfaces now on some of the G2's, but need another  
interface to trap some IP exported streams (10 - 20Mbps max).  I  
cannot find anything that states what the "limited packet forwarding"  
is.  Anyone have any more info or real world experience?

TIA

-- 
Robert Blayzor, BOFH
INOC, LLC
rblayzor at inoc.net
http://www.inoc.net/~rblayzor/




From gert at greenie.muc.de  Wed Jun 17 13:29:09 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Wed, 17 Jun 2009 19:29:09 +0200
Subject: [c-nsp] 10GE blade questions
In-Reply-To: <000001c9ef6d$e0666350$a13329f0$@org>
References: <000001c9ef6d$e0666350$a13329f0$@org>
Message-ID: <20090617172909.GL290@greenie.muc.de>

Hi,

On Wed, Jun 17, 2009 at 01:05:33PM -0400, Paul Stewart wrote:
> We have a 6509 sup2/msfc2 switch which only does layer2 services - is there
> 10GE options available for this platform?

None of the WS-X67xx boards will work with a Sup2 (they need Sup720
fabric connections).

I seem to remember that there was an earlier 10G blade (something like
"1 ports, no XENPAKs"), but can't find any details about it - the
board name was WS-X6502-10GE, and even that one would require a fabric
board for your Sup2 (CEF256 fabric) - which hardly anybody has.

I'm not sure whether I'd go there...

> The WS-X6708-10G-3CXL  blades are also of interest for Sup720 platform - if
> they are only doing VLAN trunks out to remote switches and any routing would
> be done on SVI interfaces on the Sup720 then does it matter if you get only
> the 3C version?

Yes.  *If* there is a DFC on the board, and it's a non-XL DFC, all the
switching in the system downgrades itself to "non-XL".

I think you could run it as a CFC card (with no DFC), but as far as 
I remember, it's not sold that way and most likely "not supported".

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090617/fe616268/attachment.bin>

From tstevens at cisco.com  Wed Jun 17 13:51:20 2009
From: tstevens at cisco.com (Tim Stevenson)
Date: Wed, 17 Jun 2009 10:51:20 -0700
Subject: [c-nsp] 10GE blade questions
In-Reply-To: <20090617172909.GL290@greenie.muc.de>
References: <000001c9ef6d$e0666350$a13329f0$@org>
	<20090617172909.GL290@greenie.muc.de>
Message-ID: <200906171751.n5HHpYTD015448@sj-core-2.cisco.com>

At 10:29 AM 6/17/2009, Gert Doering blurted out:

>Hi,
>
>On Wed, Jun 17, 2009 at 01:05:33PM -0400, Paul Stewart wrote:
> > We have a 6509 sup2/msfc2 switch which only does layer2 services - is there
> > 10GE options available for this platform?
>
>None of the WS-X67xx boards will work with a Sup2 (they need Sup720
>fabric connections).
>
>I seem to remember that there was an earlier 10G blade (something like
>"1 ports, no XENPAKs"), but can't find any details about it - the
>board name was WS-X6502-10GE, and even that one would require a fabric
>board for your Sup2 (CEF256 fabric) - which hardly anybody has.
>
>I'm not sure whether I'd go there...

That card is EOL & will be EOS next month. You are better off 
upgrading the sup to sup720 and buying a 670x 10G card, it'll be 
cheaper & higher performance.

> > The WS-X6708-10G-3CXL  blades are also of interest for Sup720 platform - if
> > they are only doing VLAN trunks out to remote switches and any 
> routing would
> > be done on SVI interfaces on the Sup720 then does it matter if you get only
> > the 3C version?
>
>Yes.  *If* there is a DFC on the board, and it's a non-XL DFC, all the
>switching in the system downgrades itself to "non-XL".
>
>I think you could run it as a CFC card (with no DFC), but as far as
>I remember, it's not sold that way and most likely "not supported".

6708/16 do not have a CFC option, they only run with DFC.


HTH,
Tim


>gert
>--
>USENET is *not* the non-clickable part of WWW!
> 
>//www.muc.de/~gert/
>Gert Doering - Munich, Germany                             gert at greenie.muc.de
>fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
>
>_______________________________________________
>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>https://puck.nether.net/mailman/listinfo/cisco-nsp
>archive at http://puck.nether.net/pipermail/cisco-nsp/




Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.

From paul at paulstewart.org  Wed Jun 17 13:57:27 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Wed, 17 Jun 2009 13:57:27 -0400
Subject: [c-nsp] 10GE blade questions
In-Reply-To: <200906171751.n5HHpYTD015448@sj-core-2.cisco.com>
References: <000001c9ef6d$e0666350$a13329f0$@org>
	<20090617172909.GL290@greenie.muc.de>
	<200906171751.n5HHpYTD015448@sj-core-2.cisco.com>
Message-ID: <000d01c9ef75$212d7890$638869b0$@org>

Thanks folks.. I figured the 720 upgrade would come along as part of
this..;)

 

Cheers,

 

Paul

 

 

From: Tim Stevenson [mailto:tstevens at cisco.com] 
Sent: Wednesday, June 17, 2009 1:51 PM
To: Gert Doering; Paul Stewart
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] 10GE blade questions

 

At 10:29 AM 6/17/2009, Gert Doering blurted out:




Hi,

On Wed, Jun 17, 2009 at 01:05:33PM -0400, Paul Stewart wrote:
> We have a 6509 sup2/msfc2 switch which only does layer2 services - is
there
> 10GE options available for this platform?

None of the WS-X67xx boards will work with a Sup2 (they need Sup720
fabric connections).

I seem to remember that there was an earlier 10G blade (something like
"1 ports, no XENPAKs"), but can't find any details about it - the
board name was WS-X6502-10GE, and even that one would require a fabric
board for your Sup2 (CEF256 fabric) - which hardly anybody has.

I'm not sure whether I'd go there...


That card is EOL & will be EOS next month. You are better off upgrading the
sup to sup720 and buying a 670x 10G card, it'll be cheaper & higher
performance.




> The WS-X6708-10G-3CXL  blades are also of interest for Sup720 platform -
if
> they are only doing VLAN trunks out to remote switches and any routing
would
> be done on SVI interfaces on the Sup720 then does it matter if you get
only
> the 3C version?

Yes.  *If* there is a DFC on the board, and it's a non-XL DFC, all the
switching in the system downgrades itself to "non-XL".

I think you could run it as a CFC card (with no DFC), but as far as
I remember, it's not sold that way and most likely "not supported".


6708/16 do not have a CFC option, they only run with DFC.


HTH,
Tim





gert
--
USENET is *not* the non-clickable part of WWW!
                                                           //
www.muc.de/~gert/ <http://www.muc.de/~gert/> 
Gert Doering - Munich, Germany
gert at greenie.muc.de
fax: +49-89-35655025
gert at net.informatik.tu-muenchen.de

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/







Tim Stevenson, tstevens at cisco.com
Routing & Switching CCIE #5561
Technical Marketing Engineer, Cisco Nexus 7000
Cisco - http://www.cisco.com <http://www.cisco.com/> 
IP Phone: 408-526-6759
********************************************************
The contents of this message may be *Cisco Confidential*
and are intended for the specified recipients only.


From ras at e-gerbil.net  Wed Jun 17 15:21:46 2009
From: ras at e-gerbil.net (Richard A Steenbergen)
Date: Wed, 17 Jun 2009 14:21:46 -0500
Subject: [c-nsp] 10GE blade questions
In-Reply-To: <20090617172909.GL290@greenie.muc.de>
References: <000001c9ef6d$e0666350$a13329f0$@org>
	<20090617172909.GL290@greenie.muc.de>
Message-ID: <20090617192146.GG51443@gerbil.cluepon.net>

On Wed, Jun 17, 2009 at 07:29:09PM +0200, Gert Doering wrote:
> I seem to remember that there was an earlier 10G blade (something like
> "1 ports, no XENPAKs"), but can't find any details about it - the
> board name was WS-X6502-10GE, and even that one would require a fabric
> board for your Sup2 (CEF256 fabric) - which hardly anybody has.
> 
> I'm not sure whether I'd go there...

WS-X6502-10GE, a 1-port CEF256 with proprietary LR optics which has been
End of Sale for about 5 years now. At one point they were the poor man's
alternative to a 6704, but these days they're so rare that they're far
more expensive than a sup720+6704. Of course, if you know the right
people, I bet you could probably still find one via dumpster diving, 
but unless you're trying to complete your museum collection I wouldn't 
recommend wasting the time.

-- 
Richard A Steenbergen <ras at e-gerbil.net>       http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

From ez.c0re at gmail.com  Wed Jun 17 15:55:04 2009
From: ez.c0re at gmail.com (c0re dumped)
Date: Wed, 17 Jun 2009 16:55:04 -0300
Subject: [c-nsp] NAT issue
Message-ID: <6dd8736a0906171255g688a8502keb926cd520d8b51f@mail.gmail.com>

Hello guys,

I have following scenario:

I receive a packet in ATM0/0 interface. The packet has the following
addresses: SRC A.A.A.A and DST B.B.B.B.
I must translate the packet and send it out the *same* interface
(ATM0/0), *but* with the following addresses: SRC X.X.X.X DST Y.Y.Y.Y

What NAT configuration do I have to apply so that will work perfectly ?


thanx,

Fabio

-- 

"To err is human, to blame it on somebody else shows management potential."

From pshem.k at gmail.com  Wed Jun 17 16:39:05 2009
From: pshem.k at gmail.com (Pshem Kowalczyk)
Date: Thu, 18 Jun 2009 08:39:05 +1200
Subject: [c-nsp] Global Route Leaking on same PE
In-Reply-To: <580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>
References: <580af3b90906160717u716a2601m63769052f09b0de@mail.gmail.com> 
	<002501c9eea7$34983830$0a00000a@nil.si>
	<02d001c9eea9$6f918020$4eb48060$@net> 
	<9e246b4d0906161312o285451a3pe5186cfe1ff582c1@mail.gmail.com> 
	<580af3b90906170852vbb0f91am40e209a4cf5963c6@mail.gmail.com>
Message-ID: <20fe625b0906171339u7ecdd242k559728190d6ae9b3@mail.gmail.com>

Hi,

Yes, everything - including internet table, only infrastructure runs
in the global one.  As many have noticed the pain of getting anything
going between the global table and the vrfs is just too much. All I
miss now is ability to do a static route from vrf to another vrf ;-)
but for now vrf import/export seems to do the trick short term ;-)

regards
pshem


2009/6/18 Clue Store <cluestore at gmail.com>:
>> >It would be great to have a simple global-vrf route exchange feature
>> though.
>
>
> Anyone using a vrf for their global tables?? ?This solution could possibly
> work for me but not sure what insane issues would come up by doing this.
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From rodunn at cisco.com  Wed Jun 17 16:58:14 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Wed, 17 Jun 2009 16:58:14 -0400
Subject: [c-nsp] NAT issue
In-Reply-To: <6dd8736a0906171255g688a8502keb926cd520d8b51f@mail.gmail.com>
References: <6dd8736a0906171255g688a8502keb926cd520d8b51f@mail.gmail.com>
Message-ID: <20090617205814.GB3393@rtp-cse-489.cisco.com>

What does your routing look like to get it in/out the same ATM interface?

On Wed, Jun 17, 2009 at 04:55:04PM -0300, c0re dumped wrote:
> Hello guys,
> 
> I have following scenario:
> 
> I receive a packet in ATM0/0 interface. The packet has the following
> addresses: SRC A.A.A.A and DST B.B.B.B.
> I must translate the packet and send it out the *same* interface
> (ATM0/0), *but* with the following addresses: SRC X.X.X.X DST Y.Y.Y.Y
> 
> What NAT configuration do I have to apply so that will work perfectly ?
> 
> 
> thanx,
> 
> Fabio
> 
> -- 
> 
> "To err is human, to blame it on somebody else shows management potential."
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From jrhett at netconsonance.com  Wed Jun 17 19:59:05 2009
From: jrhett at netconsonance.com (Jo Rhett)
Date: Wed, 17 Jun 2009 16:59:05 -0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
	<A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
	<FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>
	<919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>
Message-ID: <28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>

  On Jun 15, 2009, at 11:29 AM, Kevin Graham wrote:
> Given the 192 ports of 10/100/1000, presumably this is aggregating  
> customers,
> in which case it'd be best to roll these up on 7600/RSP720 (along  
> with their
> associated BGP, since most of them would probably be suitable for  
> peer-groups).
> uRPF wouldn't be a problem, and hopefully ACL's would be uniform  
> enough across
> customers to share most of the ACE entries.
>
> With that compromise (namely loosing customer-customer netflow  
> detail), the
> remaining requirements for full netflow exports and the balance of  
> the BGP
> workload are feasible for any of ASR1k, GSR, or CRS-1.

We don't have core and edge -- our switches do both.   Every port on  
the switch is either a BGP peer/uplink/downlink or a customer.  Every  
port layer3-routed with only a few handfuls of customers with dual  
links.

Purchasing a switch to be the edge and then another to handle BGP  
seems a bit of overkill for our fairly small datacenters  (largest  
will have around 300 customers ~ 360 ports).   I'd prefer something  
that can handle both edge and core duties.

-- 
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness


From peter at rathlev.dk  Wed Jun 17 20:01:01 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 18 Jun 2009 00:01:01 +0000
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
Message-ID: <1245283261.15106.46.camel@localhost.localdomain>

Hi,

I have the need to introduce some PBR to solve a hopefully temporary
problem. Some of the traffic being routed will leave the same interface
as it arrives on.

My worry is if this would have any performance impact the traffic
arrives on and leaves from the same interface. I could imagine that some
forwarding implementations might penalize this scenario.

The PBR will be performed by two 3560s running IP Services and with HSRP
configuration on all interfaces. It should do PBR in hardware (we're not
using VRF Lite here) but is this also the case for traffic hair-pinning
like this?

To elaborate on the plan:

+---+                     +---+
| X |----             ----| Y |
+---+    \           /    +---+
          \         /
           \       /
          +---------+
          |   PBR   |
          +---------+
               |
               |
             +---+
             | Z |
             +----

The Z<->PBR and PBR<->Y interfaces are members of the same VLAN. The
PBR<->X interface will be in another VLAN.

Traffic from Z currently uses Y as gateway. I need to route some traffic
(based on a policy map) to X instead. Since I have little control over Y
(upstream Internet), and since Z relies on keeping it's current
interface address (it's an ASA using this interface address for VPN
identity) I can't split them.

The plan was to introduce the 3560 in the same subnet and then let Z's
default route be PBR instead of Y. Based on the policy map PBR will
either forward to Y (on the same interface) or X. To assure correct
policy routing I'd of course have to disable sending redirects.

(The "right" solution IMHO would be allocating a new subnet for PBR<->Y
and coordinate this with our upstream, but lack of both time and
cluefulness means that this will have to be some other time.)

Regards,
Peter



From ray at oneunified.net  Wed Jun 17 20:17:08 2009
From: ray at oneunified.net (Ray Burkholder)
Date: Wed, 17 Jun 2009 21:17:08 -0300
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com><4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk><4A327775.8050800@kl.net><AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com><1244844193.9252.17.camel@localhost.localdomain><A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au><FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net><919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>
	<28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
Message-ID: <A06A5ABC0C5945B5A2583B5D5DC95F53@oneunified.local>

> 
> We don't have core and edge -- our switches do both.   Every port on  
> the switch is either a BGP peer/uplink/downlink or a 
> customer.  Every port layer3-routed with only a few handfuls 
> of customers with dual links.
> 
> Purchasing a switch to be the edge and then another to handle 
> BGP seems a bit of overkill for our fairly small datacenters  
> (largest  
> will have around 300 customers ~ 360 ports).   I'd prefer something  
> that can handle both edge and core duties.
> 

Do you put dual Sup's in the switches?  Ie, how do you handle the scenario
of software upgrades (doesn't the whole switch have to go down to do this
type of maintenance, or do you not do that sort of thing) or switch
malfunctions?  Is it a safe bet to put so many customers and links into one
box? Or are you actually using multiple switches?


-- 
Scanned for viruses and dangerous content at 
http://www.oneunified.net and is believed to be clean.


From rdobbins at arbor.net  Wed Jun 17 20:55:13 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 18 Jun 2009 07:55:13 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com>
	<4A313392.60604@kl.net> <4A31548E.3080501@imperial.ac.uk>
	<4A327775.8050800@kl.net>
	<AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com>
	<1244844193.9252.17.camel@localhost.localdomain>
	<A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au>
	<FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net>
	<919169.94149.qm@web1204.biz.mail.gq1.yahoo.com>
	<28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
Message-ID: <65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>


On Jun 18, 2009, at 6:59 AM, Jo Rhett wrote:

> I'd prefer something that can handle both edge and core duties.

GSR w/E3 or E5 LCs, CRS-1, or ASR 1K.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From justin at justinshore.com  Wed Jun 17 23:08:48 2009
From: justin at justinshore.com (Justin Shore)
Date: Wed, 17 Jun 2009 22:08:48 -0500
Subject: [c-nsp] BGP quandry
Message-ID: <4A39AFC0.8050101@justinshore.com>

I'm scratching my head on a BGP problem.  I have a pair of core routers 
and a pair of distribution routers in our data center.  The DC routers 
each have a single connection to the core routers (1 connection per 
pair).  Previously the DC routers were configured as route-reflector 
clients with a route-map stripping out all ipv4 routes but the default. 
  The links are MPLS-enabled and I have production MPLS/VPNs on the 
links currently that are working fine.  It's fairly straightforward. 
Upstream of the core routers are a pair of border routers.  The border 
and core routers are in a full mesh.

Now I'm trying to hang a new router off of one of the data center 
routers and extend our BGP environment to it.  I've configured it to be 
part of a confederation (that router will ultimately have a direct 
Internet peer and will need full routes).  I'm currently hopping over 
the DC router and going straight to a core router for that eBGP 
confederation connection.  However I now need to access a MPLS/VPN from 
the new router in our data center.  So it basically looks like this:

A     B
|\   /|
| \ / |
|  /\ |
| /  \|
C-----D
|     |
E     F
       |
       G

A	Border 1
B	Border 2
C	Core 1
D	Core 2
E	DC 1
F	DC 2
G	New Router

A-D are currently a full mesh and I'd like to extend that to A-F.  G is 
the beginning of a confederation and new AS.

I'm taking the opportunity to go back and eliminate the RR design from 
the DC and make those 2 routers part of the full mesh with the core and 
border routers.  I've removed the RR config from one of the DC routers 
and its directly connected core router and replaced it with my standard 
ibgp peer-group.  The session comes up but I'm not getting any vpnv4 
routes over the session.  I can't figure out what I'm overlooking.

Core:
  neighbor ibgp-peer peer-group
  neighbor ibgp-peer remote-as 65001
  neighbor ibgp-peer transport path-mtu-discovery
  neighbor ibgp-peer password 7 monkey
  neighbor ibgp-peer update-source Loopback0
  neighbor ibgp-peer version 4
  neighbor ibgp-peer send-community
  neighbor ibgp-peer soft-reconfiguration inbound
  neighbor ibgp-peer maximum-prefix 350000 80 warning-only
  neighbor 10.64.0.34 peer-group ibgp-peer
  neighbor 10.64.0.34 description iBGP to 7201-1.dc (65001)
  neighbor 10.64.0.34 default-originate
!
  address-family vpnv4
  neighbor ibgp-peer send-community extended
  neighbor 10.64.0.34 activate
  exit-address-family

I added the last activate for grins but it didn't help.  peer-groups are 
auto-activated which is why it's not explicitly spelled out in the vpn4 
statement.

DC:
  neighbor ibgp-peer peer-group
  neighbor ibgp-peer remote-as 65001
  neighbor ibgp-peer transport path-mtu-discovery
  neighbor ibgp-peer password 7 monkey
  neighbor ibgp-peer update-source Loopback0
  neighbor ibgp-peer version 4
  neighbor 10.64.0.20 peer-group ibgp-peer
  neighbor 10.64.0.20 description iBGP to 7613-2.clr (65001)
!
  address-family ipv4
   neighbor ibgp-peer send-community
   neighbor ibgp-peer soft-reconfiguration inbound
   neighbor ibgp-peer maximum-prefix 350000 80 warning-only
   neighbor 10.64.0.20 activate
  exit-address-family
  !
  address-family vpnv4
   neighbor ibgp-peer send-community extended
  exit-address-family


I've removed several things of course.  Does anything jump out at 
anyone?  I'm having difficulty finding a command to see what prefixes 
I'm advertising inside of a vrf to the remote peer.  All I get on the DC 
router is the connected and static prefixes.  Do peer-groups and vpnv4 
routes not mix?

Thanks
  Justin


From justin at justinshore.com  Wed Jun 17 23:54:56 2009
From: justin at justinshore.com (Justin Shore)
Date: Wed, 17 Jun 2009 22:54:56 -0500
Subject: [c-nsp] BGP quandry
In-Reply-To: <4A39AFC0.8050101@justinshore.com>
References: <4A39AFC0.8050101@justinshore.com>
Message-ID: <4A39BA90.4030107@justinshore.com>

Justin Shore wrote:
> Core:
....
> !
>  address-family vpnv4
>  neighbor ibgp-peer send-community extended
>  neighbor 10.64.0.34 activate
>  exit-address-family
> 
> I added the last activate for grins but it didn't help.  peer-groups are 
> auto-activated which is why it's not explicitly spelled out in the vpn4 
> statement.
> 
> DC:
....
>  neighbor 10.64.0.20 peer-group ibgp-peer
>  neighbor 10.64.0.20 description iBGP to 7613-2.clr (65001)
> !
>  address-family vpnv4
>   neighbor ibgp-peer send-community extended
>  exit-address-family

So I did a little more playing around and found that if I added an vpnv4 
activate on the DC #2 router for core #2's IP I got my vpnv4 routes.  I 
only got those connected to core #2 though.  I had to add another 
activate for core #1.  I'm assuming that core #2 sent those BGP routes 
that it learned via iBGP from core #1 to DC #2 because of the RR config. 
  Since I'm eliminating the iBGP RR config I have to complete the full 
mesh to get the full set of routes.  That makes sense.

One thing that doesn't make sense at this point is why the ibgp-peer 
peer-group config in the vpnv4 address-family wasn't sufficient enough 
to enable the learning of vpnv4 routes.  Do peer-groups and vpnv4 config 
not mix?  Trying to add the command "neighbor aaa.bbb.ccc.ddd 
send-community extendeded" to any of the routers involved (where 
aaa.bbb.ccc.ddd is a configured member of a peer-group) results in the 
error:

% Invalid command for a peer-group member

To me that implies that some sort of interaction exists between vpnv4 
config and peer-group config.  Can anyone add any input to this?

Thanks
  Justin



From anderson.levi at gmail.com  Thu Jun 18 03:32:36 2009
From: anderson.levi at gmail.com (Anderson Levi)
Date: Thu, 18 Jun 2009 10:32:36 +0300
Subject: [c-nsp] Cisco SFP
Message-ID: <e22d607d0906180032w42e356ceyd2a9a49a70ebe0cc@mail.gmail.com>

Hi,

I want to buy Cisco's gigabit SFPs for a network rollout and I've realised,
from the info I've gathered on the website, that there's a leap from the <
10km range (GLC-LH-SM) to the < 70km range (GLC-ZX-SM). The distance I have
in mind falls in between 10km and 70km.

What are the implications of using a GLC-ZX-SM module to light a stretch of
20 - 30km? Would I need to add an attenuator, given that 20km is well below
the 70km limit?

Any info would be helpful. Thanks.

From gtb at slac.stanford.edu  Thu Jun 18 03:49:42 2009
From: gtb at slac.stanford.edu (Buhrmaster, Gary)
Date: Thu, 18 Jun 2009 00:49:42 -0700
Subject: [c-nsp] Cisco SFP
In-Reply-To: <e22d607d0906180032w42e356ceyd2a9a49a70ebe0cc@mail.gmail.com>
References: <e22d607d0906180032w42e356ceyd2a9a49a70ebe0cc@mail.gmail.com>
Message-ID: <D0D0330CBD07114D85B70B784E80C2F202CE3465@exch-mail2.win.slac.stanford.edu>

> What are the implications of using a GLC-ZX-SM module to light a
> stretch of 20 - 30km? Would I need to add an attenuator, given that 20km is well
> below the 70km limit?


As always, the answer is "it depends", because
it is the optical power, not distance, but usually
if the link is <~25km you can expect to need an
attenuator.  The typical transmit is ~ 0-5dBm,
and the max receive power is ~ -3dBm.  If you
overload the receiver, you could damage the
device, or shorten is life, or cause various
physical link errors to be reported as the
optics is overloaded.  So, in all cases,
measure the received power, and add in the
needed attenuation.

Reference:  
http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6577/product_data_sheet0900aecd8033f885.html

Gary

From amsoares at netcabo.pt  Thu Jun 18 06:48:57 2009
From: amsoares at netcabo.pt (Antonio Soares)
Date: Thu, 18 Jun 2009 11:48:57 +0100
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com><4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk><4A327775.8050800@kl.net><AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com><1244844193.9252.17.camel@localhost.localdomain><A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au><FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net><919169.94149.qm@web1204.biz.mail.gq1.yahoo.com><28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
	<65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>
Message-ID: <36EC7DC293AA437EB939B1B1D74283DA@int.convex.pt>

Why are you not including E4 or E4+ ? I'm asking this because i saw a E4 hitting the maximum when the number of CEF routes handled
doubled (from 280k to 560k). To the E3, this transition was smooth... And i'm not able to find docs that could explain this...


Thanks.

Regards,

Antonio Soares, CCIE #18473 (R&S)
amsoares at netcabo.pt

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Roland Dobbins
Sent: quinta-feira, 18 de Junho de 2009 1:55
To: Cisco-nsp
Subject: Re: [c-nsp] full routing table / provider-class chassis


On Jun 18, 2009, at 6:59 AM, Jo Rhett wrote:

> I'd prefer something that can handle both edge and core duties.

GSR w/E3 or E5 LCs, CRS-1, or ASR 1K.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



From peter at rathlev.dk  Thu Jun 18 06:50:57 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 18 Jun 2009 12:50:57 +0200
Subject: [c-nsp] BGP quandry
In-Reply-To: <4A39BA90.4030107@justinshore.com>
References: <4A39AFC0.8050101@justinshore.com>
	<4A39BA90.4030107@justinshore.com>
Message-ID: <1245322257.20522.9.camel@localhost.localdomain>

On Wed, 2009-06-17 at 22:54 -0500, Justin Shore wrote:
> So I did a little more playing around and found that if I added an vpnv4 
> activate on the DC #2 router for core #2's IP I got my vpnv4 routes.  I 
> only got those connected to core #2 though.  I had to add another 
> activate for core #1.  I'm assuming that core #2 sent those BGP routes 
> that it learned via iBGP from core #1 to DC #2 because of the RR config. 
>   Since I'm eliminating the iBGP RR config I have to complete the full 
> mesh to get the full set of routes.  That makes sense.

Core #2 doesn't have "route-reflector-client" configured towards the new
router, so it only sends it's own prefixes and prefixes from any RR
clients of it's own. That seems to make sense to me too.

> One thing that doesn't make sense at this point is why the ibgp-peer 
> peer-group config in the vpnv4 address-family wasn't sufficient enough 
> to enable the learning of vpnv4 routes.  Do peer-groups and vpnv4 config 
> not mix?  Trying to add the command "neighbor aaa.bbb.ccc.ddd 
> send-community extendeded" to any of the routers involved (where 
> aaa.bbb.ccc.ddd is a configured member of a peer-group) results in the 
> error:
> 
> % Invalid command for a peer-group member
> 
> To me that implies that some sort of interaction exists between vpnv4 
> config and peer-group config.  Can anyone add any input to this?

AFAIK you always have to activate the specific peers in the VPNv4
configuration for VPNv4 functionality. I.e. :

 router bgp 64512
  neighbor PG peer-group
  neighbor PG remote-as 65412
  neghibor 10.0.0.1 activate
  !
  address-family vpnv4
   neighbor 10.0.0.1 activate
   exit-address-family
  ! 
  exit
 !

VPNv4 and IPv4 mixes fine, but the activation is seperated so you can
run some IPv4 only peers, some VPNv4 only peers and some mixed peers.

Regards,
Peter



From rdobbins at arbor.net  Thu Jun 18 07:04:22 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 18 Jun 2009 18:04:22 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <36EC7DC293AA437EB939B1B1D74283DA@int.convex.pt>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com><4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk><4A327775.8050800@kl.net><AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com><1244844193.9252.17.camel@localhost.localdomain><A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au><FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net><919169.94149.qm@web1204.biz.mail.gq1.yahoo.com><28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
	<65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>
	<36EC7DC293AA437EB939B1B1D74283DA@int.convex.pt>
Message-ID: <B0074169-12BA-4A9A-81C2-BB975E4030C4@arbor.net>


On Jun 18, 2009, at 5:48 PM, Antonio Soares wrote:

> Why are you not including E4 or E4+ ?

Because those are intended to be deployed as coreward-facing cards,  
they aren't optimized for edge features like NetFlow, uRPF, and ACLs.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From rdobbins at arbor.net  Thu Jun 18 07:20:40 2009
From: rdobbins at arbor.net (Roland Dobbins)
Date: Thu, 18 Jun 2009 18:20:40 +0700
Subject: [c-nsp] full routing table / provider-class chassis
In-Reply-To: <B0074169-12BA-4A9A-81C2-BB975E4030C4@arbor.net>
References: <04BFB690-C747-46D2-A1D6-E4B7243E804B@netconsonance.com><4A313392.60604@kl.net>
	<4A31548E.3080501@imperial.ac.uk><4A327775.8050800@kl.net><AC33EE12-F68C-41AB-8C74-3A6C327EAFA2@netconsonance.com><1244844193.9252.17.camel@localhost.localdomain><A76AFCA9-F958-4C08-8574-D2A2A3AAA12F@netspot.com.au><FC3F8A48-4CB5-481B-8371-B2450806CF2E@arbor.net><919169.94149.qm@web1204.biz.mail.gq1.yahoo.com><28FF196F-67B9-4D57-BCF9-D3B4EB38FC7C@netconsonance.com>
	<65E6E3AF-FBDA-45F0-A08E-8FE386DBEF86@arbor.net>
	<36EC7DC293AA437EB939B1B1D74283DA@int.convex.pt>
	<B0074169-12BA-4A9A-81C2-BB975E4030C4@arbor.net>
Message-ID: <5074CACB-9C4A-4F04-B401-75CD02B797C7@arbor.net>


On Jun 18, 2009, at 6:04 PM, Roland Dobbins wrote:

> Because those are intended to be deployed as coreward-facing cards,  
> they aren't optimized for edge features like NetFlow, uRPF, and ACLs.

To clarify, I mean these cards are for use in core routers only - edge  
routers need the features on the coreward as well as the peering/ 
transit/customer edges, so the northbound and southbound LCs on edge  
routers should be E3 or E5.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton


From fraglet at gmail.com  Thu Jun 18 07:41:53 2009
From: fraglet at gmail.com (John)
Date: Thu, 18 Jun 2009 12:41:53 +0100
Subject: [c-nsp] Link state propagation / remote port shutdown with EoMPLS
	on 6500
Message-ID: <5c374d9a0906180441h2470630br18efea343f461a0@mail.gmail.com>

Hi All
Im playing around with EoMPLS on 6500`s w/SUP720-3b and 6700 line cards...
No ES hardware.

Everything seems fine, performance is good, scales ok for what we need, what
I`m failing to do is get link state propagation or remote port shutdown to
work.

Anybody have any pointers on this..

Our config is very basic port mode xconnects..


interface GigabitEthernet1/12
 mtu 1560
 no ip address
 xconnect 192.168.1.1 2007 pw-class TEST#1


I notice that in conf mode under the xconnect config you can enter "remote
link failure notification" this seems to be enabled by default, but doesnt
seem to do anything..

I imagine that I need to configure some OAM or CFM or similar, but am at a
loss as to how, anyone thats already done it?

Any help gratefully accepted

From zivl at gilat.net  Thu Jun 18 09:08:22 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Thu, 18 Jun 2009 16:08:22 +0300
Subject: [c-nsp] L2TPv3 and VLANs
Message-ID: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>

Hi,
I'm trying to make sure this following scenario can work.
3 remote sites, one is the HQ which has a switch that handles 2 vlans, let's say vlan 10 and vlan 20.
The other two branches needs to be connected to the HQ and have a flat LAN between them and the HQ, but each branch to it's own vlan, branch 1 to vlan 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
Every site has a switch and a router (C2801 I think) Is it possible to do?
If yes, then I was thinking about L2TPv3, but in this case I'd need to make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
How do I make this happen on the HQ router? I was thinking to bring the vlans via a trunk from the switch and then finishing them on sub-interfaces with dot1q and then xconnecting the sob-interface to each l2tp tunnel to each respective branch. Is it correct or there is a better way?

Will this work?

Thanks in advance for your help
Ziv


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From justin at justinshore.com  Thu Jun 18 10:06:49 2009
From: justin at justinshore.com (Justin Shore)
Date: Thu, 18 Jun 2009 09:06:49 -0500
Subject: [c-nsp] BGP quandry
In-Reply-To: <1245322257.20522.9.camel@localhost.localdomain>
References: <4A39AFC0.8050101@justinshore.com>	
	<4A39BA90.4030107@justinshore.com>
	<1245322257.20522.9.camel@localhost.localdomain>
Message-ID: <4A3A49F9.5090004@justinshore.com>

Peter Rathlev wrote:
> Core #2 doesn't have "route-reflector-client" configured towards the new
> router, so it only sends it's own prefixes and prefixes from any RR
> clients of it's own. That seems to make sense to me too.

It does now that I've thought about it.  With iBGP not forwarding on 
updates it learns from other iBGP speakers, the only way I was receiving 
the routes in the existing environment was with the RR config.  That 
makes sense.  So now I'm building a full mesh between all the speakers. 
  I haven't done a great deal of RR work so I always have to stop and 
research RRs when I work with them.  I was pretty sure that I couldn't 
pull an eBGP confederation speaker off of the RR client which is why I 
was pushing everything back towards the full mesh.

> AFAIK you always have to activate the specific peers in the VPNv4
> configuration for VPNv4 functionality. I.e. :
> 
> VPNv4 and IPv4 mixes fine, but the activation is seperated so you can
> run some IPv4 only peers, some VPNv4 only peers and some mixed peers.

That's good to know.  I assumed that the I could make the change en mass 
by using the peer-group but adding individual activations will work too. 
  That's probably a good thing so I can be more flexible with my 
peer-group use.

Thanks for the input
  Justin



From moua0100 at umn.edu  Thu Jun 18 10:44:05 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 18 Jun 2009 09:44:05 -0500
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
Message-ID: <4A3A52B5.4090509@umn.edu>


 > How do I make this happen on the HQ router?

Each l2tp tunnel will have its own vc:  "sh l2tun all"

You obviously have thoughts this all out as your logic for how it will 
and should work is sound.

We are doing a very similar setup over here at the UofMn and this is 
working well for us.


Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Ziv Leyes wrote:
> Hi,
> I'm trying to make sure this following scenario can work.
> 3 remote sites, one is the HQ which has a switch that handles 2 vlans, let's say vlan 10 and vlan 20.
> The other two branches needs to be connected to the HQ and have a flat LAN between them and the HQ, but each branch to it's own vlan, branch 1 to vlan 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
> Every site has a switch and a router (C2801 I think) Is it possible to do?
> If yes, then I was thinking about L2TPv3, but in this case I'd need to make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
> How do I make this happen on the HQ router? I was thinking to bring the vlans via a trunk from the switch and then finishing them on sub-interfaces with dot1q and then xconnecting the sob-interface to each l2tp tunnel to each respective branch. Is it correct or there is a better way?
>
> Will this work?
>
> Thanks in advance for your help
> Ziv
>
>
>  
>  
> ************************************************************************************
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
> ************************************************************************************
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   

From paul at paulstewart.org  Thu Jun 18 11:08:29 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Thu, 18 Jun 2009 11:08:29 -0400
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <4A3A52B5.4090509@umn.edu>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu>
Message-ID: <000001c9f026$b0bb05c0$12311140$@org>

How did you deal with MTU issues from l2tpv3?  In our testing we would see
packets drop instead of fragmenting where they should... I've been meaning
to followup on this as we have some great l2tpv3 deployments waiting in the
wings...

Paul


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
Sent: Thursday, June 18, 2009 10:44 AM
To: Ziv Leyes
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] L2TPv3 and VLANs


 > How do I make this happen on the HQ router?

Each l2tp tunnel will have its own vc:  "sh l2tun all"

You obviously have thoughts this all out as your logic for how it will 
and should work is sound.

We are doing a very similar setup over here at the UofMn and this is 
working well for us.


Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Ziv Leyes wrote:
> Hi,
> I'm trying to make sure this following scenario can work.
> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
let's say vlan 10 and vlan 20.
> The other two branches needs to be connected to the HQ and have a flat LAN
between them and the HQ, but each branch to it's own vlan, branch 1 to vlan
10 and branch 2 to vlan 20. They must NOT see each other's traffic.
> Every site has a switch and a router (C2801 I think) Is it possible to do?
> If yes, then I was thinking about L2TPv3, but in this case I'd need to
make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
> How do I make this happen on the HQ router? I was thinking to bring the
vlans via a trunk from the switch and then finishing them on sub-interfaces
with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
each respective branch. Is it correct or there is a better way?
>
> Will this work?
>
> Thanks in advance for your help
> Ziv
>
>
>  
>  
>
****************************************************************************
********
> This footnote confirms that this email message has been scanned by
> PineApp Mail-SeCure for the presence of malicious code, vandals & computer
viruses.
>
****************************************************************************
********
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>   
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From moua0100 at umn.edu  Thu Jun 18 11:33:27 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 18 Jun 2009 10:33:27 -0500
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <000001c9f026$b0bb05c0$12311140$@org>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
Message-ID: <4A3A5E47.1080506@umn.edu>

Yep, ran into  that to; on the upstream layer-3 hop from hosts do 
something like "tcp-mss adjust 1300" which will ensure tcp packets haver 
enough head-room for l2tpv3 headers.  With UDP traffic, this get more 
tricky; I haven't done this yet but one can adjust max segment size on 
end-station hosts to something like 1300 (which of course would affect 
all protocol types); there are open source tools to do this, but 
downside is that all the end-station hosts need to touched for 
consistency; i suppose I'm too lazy : - (

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Paul Stewart wrote:
> How did you deal with MTU issues from l2tpv3?  In our testing we would see
> packets drop instead of fragmenting where they should... I've been meaning
> to followup on this as we have some great l2tpv3 deployments waiting in the
> wings...
>
> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
> Sent: Thursday, June 18, 2009 10:44 AM
> To: Ziv Leyes
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] L2TPv3 and VLANs
>
>
>  > How do I make this happen on the HQ router?
>
> Each l2tp tunnel will have its own vc:  "sh l2tun all"
>
> You obviously have thoughts this all out as your logic for how it will 
> and should work is sound.
>
> We are doing a very similar setup over here at the UofMn and this is 
> working well for us.
>
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Ziv Leyes wrote:
>   
>> Hi,
>> I'm trying to make sure this following scenario can work.
>> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
>>     
> let's say vlan 10 and vlan 20.
>   
>> The other two branches needs to be connected to the HQ and have a flat LAN
>>     
> between them and the HQ, but each branch to it's own vlan, branch 1 to vlan
> 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
>   
>> Every site has a switch and a router (C2801 I think) Is it possible to do?
>> If yes, then I was thinking about L2TPv3, but in this case I'd need to
>>     
> make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
>   
>> How do I make this happen on the HQ router? I was thinking to bring the
>>     
> vlans via a trunk from the switch and then finishing them on sub-interfaces
> with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
> each respective branch. Is it correct or there is a better way?
>   
>> Will this work?
>>
>> Thanks in advance for your help
>> Ziv
>>
>>
>>  
>>  
>>
>>     
> ****************************************************************************
> ********
>   
>> This footnote confirms that this email message has been scanned by
>> PineApp Mail-SeCure for the presence of malicious code, vandals & computer
>>     
> viruses.
>   
> ****************************************************************************
> ********
>   
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>   

From moua0100 at umn.edu  Thu Jun 18 11:39:52 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 18 Jun 2009 10:39:52 -0500
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <4A3A5E47.1080506@umn.edu>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
Message-ID: <4A3A5FC8.6070100@umn.edu>

I"ve also seen "out-of-order" packets get discarded (essentially 
dropped); if fragmentation is clean and in correct order, L2TPv3 as 
implemeted by Cisco seems  to work better; we've open a case with Cisco 
about this re: VTP traffic and their response essentially was to do 
nothing about it and not use VTP (so we are now using VTP transparent 
mode with no VTP updates) and thus no VTP being transmitted over the 
l2tpv3 pseudowire.

I've been meaning to do pseudowire testing using AToM/EoMPLS tunnled 
inside of GRE to see if this works better; Cisco TAC seems to be more 
recpetive in supporting MPLS issues rather than L2TPv3 over native IP.

Let me know if you run into different conclusions as I've been 
struggling with this issue for a few years now.

Good luck.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Ge Moua wrote:
> Yep, ran into  that to; on the upstream layer-3 hop from hosts do 
> something like "tcp-mss adjust 1300" which will ensure tcp packets 
> haver enough head-room for l2tpv3 headers.  With UDP traffic, this get 
> more tricky; I haven't done this yet but one can adjust max segment 
> size on end-station hosts to something like 1300 (which of course 
> would affect all protocol types); there are open source tools to do 
> this, but downside is that all the end-station hosts need to touched 
> for consistency; i suppose I'm too lazy : - (
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Paul Stewart wrote:
>> How did you deal with MTU issues from l2tpv3?  In our testing we 
>> would see
>> packets drop instead of fragmenting where they should... I've been 
>> meaning
>> to followup on this as we have some great l2tpv3 deployments waiting 
>> in the
>> wings...
>>
>> Paul
>>
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
>> Sent: Thursday, June 18, 2009 10:44 AM
>> To: Ziv Leyes
>> Cc: cisco-nsp at puck.nether.net
>> Subject: Re: [c-nsp] L2TPv3 and VLANs
>>
>>
>>  > How do I make this happen on the HQ router?
>>
>> Each l2tp tunnel will have its own vc:  "sh l2tun all"
>>
>> You obviously have thoughts this all out as your logic for how it 
>> will and should work is sound.
>>
>> We are doing a very similar setup over here at the UofMn and this is 
>> working well for us.
>>
>>
>> Regards,
>> Ge Moua | Email: moua0100 at umn.edu
>>
>> Network Design Engineer
>> University of Minnesota | Networking & Telecommunications Services
>>
>>
>>
>> Ziv Leyes wrote:
>>  
>>> Hi,
>>> I'm trying to make sure this following scenario can work.
>>> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
>>>     
>> let's say vlan 10 and vlan 20.
>>  
>>> The other two branches needs to be connected to the HQ and have a 
>>> flat LAN
>>>     
>> between them and the HQ, but each branch to it's own vlan, branch 1 
>> to vlan
>> 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
>>  
>>> Every site has a switch and a router (C2801 I think) Is it possible 
>>> to do?
>>> If yes, then I was thinking about L2TPv3, but in this case I'd need to
>>>     
>> make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
>>  
>>> How do I make this happen on the HQ router? I was thinking to bring the
>>>     
>> vlans via a trunk from the switch and then finishing them on 
>> sub-interfaces
>> with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
>> each respective branch. Is it correct or there is a better way?
>>  
>>> Will this work?
>>>
>>> Thanks in advance for your help
>>> Ziv
>>>
>>>
>>>  
>>>  
>>>
>>>     
>> **************************************************************************** 
>>
>> ********
>>  
>>> This footnote confirms that this email message has been scanned by
>>> PineApp Mail-SeCure for the presence of malicious code, vandals & 
>>> computer
>>>     
>> viruses.
>>   
>> **************************************************************************** 
>>
>> ********
>>  
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>       
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>   
>

From linuxloader at gmail.com  Thu Jun 18 12:32:39 2009
From: linuxloader at gmail.com (Georgi Genov)
Date: Thu, 18 Jun 2009 19:32:39 +0300
Subject: [c-nsp] BGP Load balance for the uplink
Message-ID: <4A3A6C27.1030502@gmail.com>



Here is my scenario , i have 2 uplink providers , one with 2 backup 
sessions on two different vlans with 2x /30 ip addr and other with 
multihop bgp .First provider with the 2 sessions i have 2:1 speed 
compare against the second . I advertise at the both providers same 
prefix lists . ( 2x /18 and one /24 ) . dmzlink-bw is one solution , but 
it didn`t work at multihop bgp . Some other suggestions .

PS: Ruter is RSP720-3CXL-GE with Cisco IOS Software, c7600rsp72043_rp 
Software (c7600rsp72043_rp-ADVIPSERVICES-M), Version 12.2(33)SRB5a, 
RELEASE SOFTWARE (fc1)


From peter at rathlev.dk  Thu Jun 18 13:13:02 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Thu, 18 Jun 2009 19:13:02 +0200
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <1245283261.15106.46.camel@localhost.localdomain>
References: <1245283261.15106.46.camel@localhost.localdomain>
Message-ID: <1245345182.26970.13.camel@localhost.localdomain>

On Thu, 2009-06-18 at 00:01 +0000, Peter Rathlev wrote: 
> I have the need to introduce some PBR to solve a hopefully temporary
> problem. Some of the traffic being routed will leave the same interface
> as it arrives on.
> 
> My worry is if this would have any performance impact the traffic
> arrives on and leaves from the same interface. I could imagine that some
> forwarding implementations might penalize this scenario.

Follow up: We've tested this and it works fine. It seems to have some
CPU impact when the unit policy routes, but not much. When pushing 100
mbps traffic through the CPU rises to ~25-30% for a few seconds (spent
on interrupt switching) and then falls down ~5% again.

This might be PBR-specific and have nothing to do with the traffic
arriving on and exiting the same interface though. We will be doing some
more (production) testing soon, with more flows and more bandwidth. I
can't see why the number of flows should matter since the 3560 AFAIK
just pushes packets, but I also can't see why the start of a TCP session
should matter. The "ip route-cache" hasn't been disabled of course; I
assume this would have a detrimental effect on performance.

Regards,
Peter



From rodunn at cisco.com  Thu Jun 18 14:34:33 2009
From: rodunn at cisco.com (Rodney Dunn)
Date: Thu, 18 Jun 2009 14:34:33 -0400
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <1245345182.26970.13.camel@localhost.localdomain>
References: <1245283261.15106.46.camel@localhost.localdomain>
	<1245345182.26970.13.camel@localhost.localdomain>
Message-ID: <20090618183433.GB13882@rtp-cse-489.cisco.com>

Curious..I don't know that platform forwarding architecture.

But what does 'sh int stat' give you?

Also, sh ip traffic a couple times once you start the traffic.


On Thu, Jun 18, 2009 at 07:13:02PM +0200, Peter Rathlev wrote:lso

> On Thu, 2009-06-18 at 00:01 +0000, Peter Rathlev wrote: 
> > I have the need to introduce some PBR to solve a hopefully temporary
> > problem. Some of the traffic being routed will leave the same interface
> > as it arrives on.
> > 
> > My worry is if this would have any performance impact the traffic
> > arrives on and leaves from the same interface. I could imagine that some
> > forwarding implementations might penalize this scenario.
> 
> Follow up: We've tested this and it works fine. It seems to have some
> CPU impact when the unit policy routes, but not much. When pushing 100
> mbps traffic through the CPU rises to ~25-30% for a few seconds (spent
> on interrupt switching) and then falls down ~5% again.
> 
> This might be PBR-specific and have nothing to do with the traffic
> arriving on and exiting the same interface though. We will be doing some
> more (production) testing soon, with more flows and more bandwidth. I
> can't see why the number of flows should matter since the 3560 AFAIK
> just pushes packets, but I also can't see why the start of a TCP session
> should matter. The "ip route-cache" hasn't been disabled of course; I
> assume this would have a detrimental effect on performance.
> 
> Regards,
> Peter
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

From paul at paulstewart.org  Thu Jun 18 20:31:42 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Thu, 18 Jun 2009 20:31:42 -0400
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <4A3A5E47.1080506@umn.edu>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
Message-ID: <007a01c9f075$5258a1f0$f709e5d0$@org>

Thanks... we don't want to touch each workstation - would involve way too
much time for our installations...;)

With UDP traffic, does anything "normally" break that comes to mind on
larger MTU? I can't think of anything hence why I'm asking...

Cheers,

Paul


-----Original Message-----
From: Ge Moua [mailto:moua0100 at umn.edu] 
Sent: June 18, 2009 11:33 AM
To: Paul Stewart
Cc: 'Ziv Leyes'; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] L2TPv3 and VLANs

Yep, ran into  that to; on the upstream layer-3 hop from hosts do 
something like "tcp-mss adjust 1300" which will ensure tcp packets haver 
enough head-room for l2tpv3 headers.  With UDP traffic, this get more 
tricky; I haven't done this yet but one can adjust max segment size on 
end-station hosts to something like 1300 (which of course would affect 
all protocol types); there are open source tools to do this, but 
downside is that all the end-station hosts need to touched for 
consistency; i suppose I'm too lazy : - (

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Paul Stewart wrote:
> How did you deal with MTU issues from l2tpv3?  In our testing we would see
> packets drop instead of fragmenting where they should... I've been meaning
> to followup on this as we have some great l2tpv3 deployments waiting in
the
> wings...
>
> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
> Sent: Thursday, June 18, 2009 10:44 AM
> To: Ziv Leyes
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] L2TPv3 and VLANs
>
>
>  > How do I make this happen on the HQ router?
>
> Each l2tp tunnel will have its own vc:  "sh l2tun all"
>
> You obviously have thoughts this all out as your logic for how it will 
> and should work is sound.
>
> We are doing a very similar setup over here at the UofMn and this is 
> working well for us.
>
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Ziv Leyes wrote:
>   
>> Hi,
>> I'm trying to make sure this following scenario can work.
>> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
>>     
> let's say vlan 10 and vlan 20.
>   
>> The other two branches needs to be connected to the HQ and have a flat
LAN
>>     
> between them and the HQ, but each branch to it's own vlan, branch 1 to
vlan
> 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
>   
>> Every site has a switch and a router (C2801 I think) Is it possible to
do?
>> If yes, then I was thinking about L2TPv3, but in this case I'd need to
>>     
> make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
>   
>> How do I make this happen on the HQ router? I was thinking to bring the
>>     
> vlans via a trunk from the switch and then finishing them on
sub-interfaces
> with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
> each respective branch. Is it correct or there is a better way?
>   
>> Will this work?
>>
>> Thanks in advance for your help
>> Ziv
>>
>>
>>  
>>  
>>
>>     
>
****************************************************************************
> ********
>   
>> This footnote confirms that this email message has been scanned by
>> PineApp Mail-SeCure for the presence of malicious code, vandals &
computer
>>     
> viruses.
>   
>
****************************************************************************
> ********
>   
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>   



From ml at kenweb.org  Thu Jun 18 20:36:36 2009
From: ml at kenweb.org (ML)
Date: Thu, 18 Jun 2009 20:36:36 -0400
Subject: [c-nsp] Incorrect netflow data from 7600/6500?
Message-ID: <4A3ADD94.7060508@kenweb.org>

I'm trying to export flows from a 6509 to nfcapd/nfdump.

When I sort by protocol and bytes I see a "protocol 0" as the majority 
of the traffic.

Top 20    Protocol ordered by bytes:

Proto 	Protocol   Flows  Packets    Bytes
0       0          7.8 M  296.8 M  229.1 G
TCP     6          2.8 M   82.0 M   35.3 G
UDP     17         3.7 M   21.7 M    4.3 G

<truncated for brevity>

I've seen this result from multiple other Netflow tools: ntop, Orion 
NetFlow and now nfdump.  The only common element is my hardware.
I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both running
12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.

I think I can make the assumption there isn't a protocol in use that 
trumps both UDP and TCP traffic combined.  Have I run into an IOS bug or 
did I misconfigure?

Configuarion:
-----------------------------------
mls aging fast time 1 threshold 1
mls aging long 64
mls aging normal 32
mls flow ip interface-destination-source
no mls flow ipv6
mls nde sender version 5
no mls acl tcam share-global
mls nde sender version 5

ip flow-cache timeout inactive 10
ip flow-cache timeout active 1

"Config for interfaces of interest"
  ip flow ingress
  ip route-cache flow

ip flow-export source Loopback0
ip flow-export version 5
ip flow-export destination x.x.x.x
------------------------------------

Any help is appreciated.







From ayourtch at cisco.com  Thu Jun 18 22:32:12 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Fri, 19 Jun 2009 04:32:12 +0200 (CEST)
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <4A3A5E47.1080506@umn.edu>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
Message-ID: <Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>

Hi Ge,

On Thu, 18 Jun 2009, Ge Moua wrote:

[snip]

> I haven't done this yet but one can adjust max segment size on end-station 
> hosts to something like 1300 (which of course would affect all protocol 
> types); there are open source tools to do this, but downside is that all the 
> end-station hosts need to touched for consistency; i suppose I'm too lazy : - (

Would not the clients honour the DHCP option 26 ?

cheers,
andrew

p.s. of course, if the fragmenting does not take place of the 
pass-through packets with no DF, that deserves a closer look. 
Fragmentation considered harmful and all, still it should work.

From paul at paulstewart.org  Thu Jun 18 22:40:12 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Thu, 18 Jun 2009 22:40:12 -0400
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
Message-ID: <007e01c9f087$45aebae0$d10c30a0$@org>

I must admit  - I didn't know such an option existed... and that's great to
know...

On a related note to the PS below... we have tested lt2tpv3 on a few
different boxes running various IOS images and on each of the devices we did
test we seen the same behavior.  This means something is either broke in the
code in my opinion or that we are doing something wrong.  Typically that
means the second option in our case (lol) but I did get a fair amount of
feedback offline from folks with similar problems....;)

Paul


-----Original Message-----
From: Andrew Yourtchenko [mailto:ayourtch at cisco.com] 
Sent: June 18, 2009 10:32 PM
To: Ge Moua
Cc: Paul Stewart; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] L2TPv3 and VLANs

Hi Ge,

On Thu, 18 Jun 2009, Ge Moua wrote:

[snip]

> I haven't done this yet but one can adjust max segment size on end-station

> hosts to something like 1300 (which of course would affect all protocol 
> types); there are open source tools to do this, but downside is that all
the 
> end-station hosts need to touched for consistency; i suppose I'm too lazy
: - (

Would not the clients honour the DHCP option 26 ?

cheers,
andrew

p.s. of course, if the fragmenting does not take place of the 
pass-through packets with no DF, that deserves a closer look. 
Fragmentation considered harmful and all, still it should work.



From SHughes at GREnergy.com  Thu Jun 18 22:14:43 2009
From: SHughes at GREnergy.com (Hughes, Scott GRE/MG)
Date: Thu, 18 Jun 2009 21:14:43 -0500
Subject: [c-nsp] Incorrect netflow data from 7600/6500?
In-Reply-To: <4A3ADD94.7060508@kenweb.org>
References: <4A3ADD94.7060508@kenweb.org>
Message-ID: <D72AC2E49DA8AB4195DF356ED05663DD29520D3C5F@MNCMS01.intra.grenergy.com>

I had this problem as well, and was able to solve it with the following config:

mls flow ip interface-full


________________________________________
From: cisco-nsp-bounces at puck.nether.net [cisco-nsp-bounces at puck.nether.net] On Behalf Of ML [ml at kenweb.org]
Sent: Thursday, June 18, 2009 7:36 PM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Incorrect netflow data from 7600/6500?

I'm trying to export flows from a 6509 to nfcapd/nfdump.

When I sort by protocol and bytes I see a "protocol 0" as the majority
of the traffic.

Top 20    Protocol ordered by bytes:

Proto   Protocol   Flows  Packets    Bytes
0       0          7.8 M  296.8 M  229.1 G
TCP     6          2.8 M   82.0 M   35.3 G
UDP     17         3.7 M   21.7 M    4.3 G

<truncated for brevity>

I've seen this result from multiple other Netflow tools: ntop, Orion
NetFlow and now nfdump.  The only common element is my hardware.
I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both running
12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.

I think I can make the assumption there isn't a protocol in use that
trumps both UDP and TCP traffic combined.  Have I run into an IOS bug or
did I misconfigure?

Configuarion:
-----------------------------------
mls aging fast time 1 threshold 1
mls aging long 64
mls aging normal 32
mls flow ip interface-destination-source
no mls flow ipv6
mls nde sender version 5
no mls acl tcam share-global
mls nde sender version 5

ip flow-cache timeout inactive 10
ip flow-cache timeout active 1

"Config for interfaces of interest"
  ip flow ingress
  ip route-cache flow

ip flow-export source Loopback0
ip flow-export version 5
ip flow-export destination x.x.x.x
------------------------------------

Any help is appreciated.






_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

From ayourtch at cisco.com  Thu Jun 18 23:15:17 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Fri, 19 Jun 2009 05:15:17 +0200 (CEST)
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <007e01c9f087$45aebae0$d10c30a0$@org>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
	<007e01c9f087$45aebae0$d10c30a0$@org>
Message-ID: <Pine.LNX.4.64.0906190452330.8007@zippy.stdio.be>



On Thu, 18 Jun 2009, Paul Stewart wrote:

> I must admit  - I didn't know such an option existed... and that's great to
> know...

I myself discovered it by accident when I saw the MTU on my linux box to 
be not the 1500 :-)

>
> On a related note to the PS below... we have tested lt2tpv3 on a few
> different boxes running various IOS images and on each of the devices we did
> test we seen the same behavior.  This means something is either broke in the
> code in my opinion or that we are doing something wrong.  Typically that
> means the second option in our case (lol) but I did get a fair amount of
> feedback offline from folks with similar problems....;)

It could be as well that it is the first option but that the tcp 
mss-adjust hack is working "good enough" for anyone to bother - there are 
always "more important battles" to fight. But if someone on the list is 
willing to spend some cycles on this in the lab and subsequently open a 
case to get this to a more definitive status quo - unicast me.

thanks,
andrew

p.s. about the protocols that can break with this scenario, a few things 
come to mind: kerberos, possibly IKE w/certs, SNMP, netflow.


From moua0100 at umn.edu  Fri Jun 19 00:13:01 2009
From: moua0100 at umn.edu (Ge Moua)
Date: Thu, 18 Jun 2009 23:13:01 -0500
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <007a01c9f075$5258a1f0$f709e5d0$@org>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu> <007a01c9f075$5258a1f0$f709e5d0$@org>
Message-ID: <4A3B104D.3060003@umn.edu>

RTP, video streaming, h.323, & the like; nothing really breaks, just 
"spongy" response if the pipe is saturated.

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Paul Stewart wrote:
> Thanks... we don't want to touch each workstation - would involve way too
> much time for our installations...;)
>
> With UDP traffic, does anything "normally" break that comes to mind on
> larger MTU? I can't think of anything hence why I'm asking...
>
> Cheers,
>
> Paul
>
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu] 
> Sent: June 18, 2009 11:33 AM
> To: Paul Stewart
> Cc: 'Ziv Leyes'; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] L2TPv3 and VLANs
>
> Yep, ran into  that to; on the upstream layer-3 hop from hosts do 
> something like "tcp-mss adjust 1300" which will ensure tcp packets haver 
> enough head-room for l2tpv3 headers.  With UDP traffic, this get more 
> tricky; I haven't done this yet but one can adjust max segment size on 
> end-station hosts to something like 1300 (which of course would affect 
> all protocol types); there are open source tools to do this, but 
> downside is that all the end-station hosts need to touched for 
> consistency; i suppose I'm too lazy : - (
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Paul Stewart wrote:
>   
>> How did you deal with MTU issues from l2tpv3?  In our testing we would see
>> packets drop instead of fragmenting where they should... I've been meaning
>> to followup on this as we have some great l2tpv3 deployments waiting in
>>     
> the
>   
>> wings...
>>
>> Paul
>>
>>
>> -----Original Message-----
>> From: cisco-nsp-bounces at puck.nether.net
>> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Ge Moua
>> Sent: Thursday, June 18, 2009 10:44 AM
>> To: Ziv Leyes
>> Cc: cisco-nsp at puck.nether.net
>> Subject: Re: [c-nsp] L2TPv3 and VLANs
>>
>>
>>  > How do I make this happen on the HQ router?
>>
>> Each l2tp tunnel will have its own vc:  "sh l2tun all"
>>
>> You obviously have thoughts this all out as your logic for how it will 
>> and should work is sound.
>>
>> We are doing a very similar setup over here at the UofMn and this is 
>> working well for us.
>>
>>
>> Regards,
>> Ge Moua | Email: moua0100 at umn.edu
>>
>> Network Design Engineer
>> University of Minnesota | Networking & Telecommunications Services
>>
>>
>>
>> Ziv Leyes wrote:
>>   
>>     
>>> Hi,
>>> I'm trying to make sure this following scenario can work.
>>> 3 remote sites, one is the HQ which has a switch that handles 2 vlans,
>>>     
>>>       
>> let's say vlan 10 and vlan 20.
>>   
>>     
>>> The other two branches needs to be connected to the HQ and have a flat
>>>       
> LAN
>   
>>>     
>>>       
>> between them and the HQ, but each branch to it's own vlan, branch 1 to
>>     
> vlan
>   
>> 10 and branch 2 to vlan 20. They must NOT see each other's traffic.
>>   
>>     
>>> Every site has a switch and a router (C2801 I think) Is it possible to
>>>       
> do?
>   
>>> If yes, then I was thinking about L2TPv3, but in this case I'd need to
>>>     
>>>       
>> make two different xconnections between HQ-->Branch 1 and HQ-->Branch 2.
>>   
>>     
>>> How do I make this happen on the HQ router? I was thinking to bring the
>>>     
>>>       
>> vlans via a trunk from the switch and then finishing them on
>>     
> sub-interfaces
>   
>> with dot1q and then xconnecting the sob-interface to each l2tp tunnel to
>> each respective branch. Is it correct or there is a better way?
>>   
>>     
>>> Will this work?
>>>
>>> Thanks in advance for your help
>>> Ziv
>>>
>>>
>>>  
>>>  
>>>
>>>     
>>>       
> ****************************************************************************
>   
>> ********
>>   
>>     
>>> This footnote confirms that this email message has been scanned by
>>> PineApp Mail-SeCure for the presence of malicious code, vandals &
>>>       
> computer
>   
>>>     
>>>       
>> viruses.
>>   
>>
>>     
> ****************************************************************************
>   
>> ********
>>   
>>     
>>> _______________________________________________
>>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>>   
>>>     
>>>       
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>   
>>     
>
>
>   

From ying-xiang at 163.com  Fri Jun 19 00:58:00 2009
From: ying-xiang at 163.com (ying-xiang)
Date: Fri, 19 Jun 2009 12:58:00 +0800 (CST)
Subject: [c-nsp] the ospf 0*E2 route type can not be redistributed between
 two ospf process
Message-ID: <15453343.191691245387480644.JavaMail.coremail@bj163app61.163.com>


hi,folk
 
anyone knows the reason why i can not redistribute the O*E2 route which generated by one ospf router using default-information originate command to another ospf process?

From anderson.levi at gmail.com  Fri Jun 19 03:12:52 2009
From: anderson.levi at gmail.com (Anderson Levi)
Date: Fri, 19 Jun 2009 10:12:52 +0300
Subject: [c-nsp] Cisco SFP
In-Reply-To: <D0D0330CBD07114D85B70B784E80C2F202CE3465@exch-mail2.win.slac.stanford.edu>
References: <e22d607d0906180032w42e356ceyd2a9a49a70ebe0cc@mail.gmail.com>
	<D0D0330CBD07114D85B70B784E80C2F202CE3465@exch-mail2.win.slac.stanford.edu>
Message-ID: <e22d607d0906190012q4e66a47bm9ada4adff6ddc59c@mail.gmail.com>

Thanks.

On Thu, Jun 18, 2009 at 10:49 AM, Buhrmaster, Gary <gtb at slac.stanford.edu>wrote:

> > What are the implications of using a GLC-ZX-SM module to light a
> > stretch of 20 - 30km? Would I need to add an attenuator, given that 20km
> is well
> > below the 70km limit?
>
>
> As always, the answer is "it depends", because
> it is the optical power, not distance, but usually
> if the link is <~25km you can expect to need an
> attenuator.  The typical transmit is ~ 0-5dBm,
> and the max receive power is ~ -3dBm.  If you
> overload the receiver, you could damage the
> device, or shorten is life, or cause various
> physical link errors to be reported as the
> optics is overloaded.  So, in all cases,
> measure the received power, and add in the
> needed attenuation.
>
> Reference:
>
> http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6577/product_data_sheet0900aecd8033f885.html
>
> Gary
>

From zhuifeng0426 at gmail.com  Fri Jun 19 03:57:34 2009
From: zhuifeng0426 at gmail.com (zhuifeng0426)
Date: Fri, 19 Jun 2009 15:57:34 +0800
Subject: [c-nsp] Hello packets sending on NBMA netwroks
Message-ID: <200906191557329199317@gmail.com>

Hi list:
I have a question about Hello packet sending on NBMA networks:
in page 79 of RFC 2328 it said:
"If the router is eligible to become Designated Router, it
must periodically send Hello Packets to all neighbors that
are also eligible.  In addition, if the router is itself the
Designated Router or Backup Designated Router, it must also
send periodic Hello Packets to all other neighbors."
and:
"If the router is not eligible to become Designated Router, 
it must periodically send Hello Packets to both the
Designated Router and the Backup Designated Router (if they
exist).  It must also send an Hello Packet in reply to an
Hello Packet received from any eligible neighbor (other than
the current Designated Router and Backup Designated Router).
This is needed to establish an initial bidirectional
relationship with any potential Designated Router."
so, here is a question:
since all eligible(other than DR and BDR) router won't send Hello packets to the router that is not eligible to become DR, how can these route reply the eligible(other than DR and BDR) router? 

2009-06-19 



zhuifeng0426 

From benny+usenet at amorsen.dk  Fri Jun 19 04:41:12 2009
From: benny+usenet at amorsen.dk (Benny Amorsen)
Date: Fri, 19 Jun 2009 10:41:12 +0200
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <007e01c9f087$45aebae0$d10c30a0$@org> (Paul Stewart's message of
	"Thu\, 18 Jun 2009 22\:40\:12 -0400")
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
	<007e01c9f087$45aebae0$d10c30a0$@org>
Message-ID: <m3y6ro7h07.fsf@ursa.amorsen.dk>

"Paul Stewart" <paul at paulstewart.org> writes:

> On a related note to the PS below... we have tested lt2tpv3 on a few
> different boxes running various IOS images and on each of the devices we did
> test we seen the same behavior.  This means something is either broke in the
> code in my opinion or that we are doing something wrong.  Typically that
> means the second option in our case (lol) but I did get a fair amount of
> feedback offline from folks with similar problems....;)

Generally problems with PMTU are caused by people blocking ICMP in their
(usually PIX/ASA) firewalls. If you control the whole path, you can make
sure that you're not one of the culprits.

On the other hand, if you're trying to reach the Internet through
tunnels with non-1500-byte MTU, you'll just have to accept that it won't
work. You can MSS adjust for TCP traffic though or you can lower your
interface or route MTU as workarounds. The only real fix is either
PIX/ASA administrators getting a clue, or Cisco getting a clue. Not
particularly likely.


/Benny

(Yes, I'm bitter.)

From drrtuy at ya.ru  Fri Jun 19 05:47:48 2009
From: drrtuy at ya.ru (Roman A. Nozdrin)
Date: Fri, 19 Jun 2009 12:47:48 +0300
Subject: [c-nsp] Hello packets sending on NBMA netwroks
In-Reply-To: <200906191557329199317@gmail.com>
References: <200906191557329199317@gmail.com>
Message-ID: <4A3B5EC4.6010507@ya.ru>

Hello.

> I have a question about Hello packet sending on NBMA networks:
> in page 79 of RFC 2328 it said:
> "If the router is eligible to become Designated Router, it
> must periodically send Hello Packets to all neighbors that
> are also eligible.  In addition, if the router is itself the
> Designated Router or Backup Designated Router, it must also
> send periodic Hello Packets to all other neighbors."
> and:
> "If the router is not eligible to become Designated Router, 
> it must periodically send Hello Packets to both the
> Designated Router and the Backup Designated Router (if they
> exist).  It must also send an Hello Packet in reply to an
> Hello Packet received from any eligible neighbor (other than
> the current Designated Router and Backup Designated Router).
> This is needed to establish an initial bidirectional
> relationship with any potential Designated Router."
> so, here is a question:
> since all eligible(other than DR and BDR) router won't send Hello packets to the router that is not eligible to become DR, how can these route reply the eligible(other than DR and BDR) router? 

OSPF uses neighbor statement to send Hello to unicast IP address in NMBA 
clouds. If eligible router knows target non-eligible router via neighbor 
command, it will send Hello to it. So don't forget to put neccesecery 
neighbor ips configuring eligible router.

WBR
Roman A. Nozdrin

From peter.haag at switch.ch  Fri Jun 19 08:53:59 2009
From: peter.haag at switch.ch (Peter Haag)
Date: Fri, 19 Jun 2009 14:53:59 +0200
Subject: [c-nsp] nfdump 1.6b snapshot available
Message-ID: <4A3B8A67.10801@switch.ch>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,
I'm looking for testers for a new snapshot nfdump-1.6b-snapshot=20090619
which I just put onto Sourceforge. There shouldn't be many changes from
the beta code until final 1.6 stable.
However, I would like users to test the new snapshot and please send
me feedback about potential bugs you found.
Feel also free to send me feature request and other ideas, which can go
into next releases.

The two existing 1.5.x branches on Sourceforge for packeteer and
CISCO NSEL will get merged into 1.6.1.

If you need to read flow files from nfdump-1.5.x do not forget to
run configure with --enable-compat15

What changed and what's new: ( to be read from bottom to top )

o Flow-tools converter updated - supports more common elements.
o Sflow collector updated. Supports more common elements.
o Add sampling to nfdump. Sampling is automatically recognised
  in undocumented v5 header fields and in v9 option templates.
  see nfcapd.1(1)
o Add @include option for filter to include more filter files.
o Add flexible aggregation comparable to Flexible Netflow (FNF)
  over all available v9 tags
o All new tags can be selected in -o fmt:... see nfdump(1)
o topN stat for all new tags is implemented
o Integrate developer code to read from pcap files into stable branch
o Update filter syntax for new tags
o Add flexible storage option for nfcapd. To save disk space, the
  data extensions to be stored in the data file are user selectable.
o Added more v9 tags for netflow v9.
  The detailed tags are listed in nfcapd(1) Beside of MAC addresses
  and VLAN labels, also MPLS labels and many more v9 tags are now
  supported. AS numbers and interface numbers are now 32bit clean.
  Adding new tags also extended the binary file format with
  data block type 2, which is extension based. File format
  for version <= 1.5.* ( Data block format type 1 ) is read
  transparently. ( --enable-compat15 ) Data block type 2 are skipped
  by nfdump 1.5.7.
o Added option for multiple netflow stream to same port.
  -n <Ident,IP,base_directory>
  Example: -n router1,192.168.100.1,/var/nfdump/router1
  So multiple -n options may be given at the command line
  Old style syntax still works for compatibility, ( -I .. -l ... )
  but then only one source is supported.
o Move to automake for building nfdump
o Make nfdump fully 64bit compliant. ( 32/64bit data alignments and access )
  Compiles and runs cleanly on 32/64bit systems
o Switch scaling factor ( k, M, G ) from 1024 to 1000.

Ths snapshot can be used as a drop in replacement for nfdump-1.5.x
and can be used together with NfSen. However, not all new feature can
be used as NfSen does not yet support them.

Feedback is appreciated

Happy playing!

	- Peter

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box,  CH-8021   Zurich, Switzerland
E-mail: peter.haag at switch.ch Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iQCVAwUBSjuKZf5AbZRALNr/AQIrggQAkhFuU273sC0dOtcOYd8IxNLgG1ZsUtHA
r9pHbz+QHjzALH6XDRk1B+GuL8jVgcnAz83DYruJVHiBI34xxpNJJi5p5dX2wUED
pqURfLtHykl0ITA15K2X0f5yQUQkFR8sQsrf8rdGyokeGWglV0u8sEdP1QPq2lLW
ATjp54V/PC8=
=VW7f
-----END PGP SIGNATURE-----

From geoff at pendery.net  Fri Jun 19 08:35:38 2009
From: geoff at pendery.net (Geoffrey Pendery)
Date: Fri, 19 Jun 2009 07:35:38 -0500
Subject: [c-nsp] the ospf 0*E2 route type can not be redistributed
	between two ospf process
In-Reply-To: <15453343.191691245387480644.JavaMail.coremail@bj163app61.163.com>
References: <15453343.191691245387480644.JavaMail.coremail@bj163app61.163.com>
Message-ID: <d6966e4b0906190535o595d07f9jfc7598a569165df5@mail.gmail.com>

Well if you're talking "default-information originate", then the route
in question is 0.0.0.0/0, default.  It's special - you can't just tell
an OSPF process to redistribute 0.0.0.0/0.  If you want both processes
to distribute default, then they both need the "default-information
originate" command.


-Geoff


On Thu, Jun 18, 2009 at 11:58 PM, ying-xiang<ying-xiang at 163.com> wrote:
>
> hi,folk
>
> anyone knows the reason why i can not redistribute the O*E2 route which generated by one ospf router using default-information originate command to another ospf process?
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From peter.haag at switch.ch  Fri Jun 19 09:08:01 2009
From: peter.haag at switch.ch (Peter Haag)
Date: Fri, 19 Jun 2009 15:08:01 +0200
Subject: [c-nsp]  Incorrect netflow data from 7600/6500?
In-Reply-To: <mailman.874.1245381356.2287.cisco-nsp@puck.nether.net>
References: <mailman.874.1245381356.2287.cisco-nsp@puck.nether.net>
Message-ID: <4A3B8DB1.6000009@switch.ch>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> 
> I'm trying to export flows from a 6509 to nfcapd/nfdump.
> 
> When I sort by protocol and bytes I see a "protocol 0" as the majority
> of the traffic.
> 
> Top 20    Protocol ordered by bytes:
> 
> Proto   Protocol   Flows  Packets    Bytes
> 0       0          7.8 M  296.8 M  229.1 G
> TCP     6          2.8 M   82.0 M   35.3 G
> UDP     17         3.7 M   21.7 M    4.3 G
> 
> <truncated for brevity>
> 
> I've seen this result from multiple other Netflow tools: ntop, Orion
> NetFlow and now nfdump.  The only common element is my hardware.
> I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both running
> 12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.
> 
> I think I can make the assumption there isn't a protocol in use that
> trumps both UDP and TCP traffic combined.  Have I run into an IOS bug or
> did I misconfigure?

No - port 0 result from fragmented packets Most likely UDP packets > MTU size.
Since the IP ID field is not tracked in a v5 Netflow record, the router
can not map a fragmented packet to the appropriate flow, and simply
creates a flow with port '0'

	- Peter
> 
> Configuarion:
> -----------------------------------
> mls aging fast time 1 threshold 1
> mls aging long 64
> mls aging normal 32
> mls flow ip interface-destination-source
> no mls flow ipv6
> mls nde sender version 5
> no mls acl tcam share-global
> mls nde sender version 5
> 
> ip flow-cache timeout inactive 10
> ip flow-cache timeout active 1
> 
> "Config for interfaces of interest"
>   ip flow ingress
>   ip route-cache flow
> 
> ip flow-export source Loopback0
> ip flow-export version 5
> ip flow-export destination x.x.x.x
> ------------------------------------
> 
> Any help is appreciated.
> 
> 
> 
> 
> 
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> ------------------------------
> 
> Message: 9
> Date: Fri, 19 Jun 2009 05:15:17 +0200 (CEST)
> From: Andrew Yourtchenko <ayourtch at cisco.com>
> To: Paul Stewart <paul at paulstewart.org>
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] L2TPv3 and VLANs
> Message-ID: <Pine.LNX.4.64.0906190452330.8007 at zippy.stdio.be>
> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
> 
> 
> 
> On Thu, 18 Jun 2009, Paul Stewart wrote:
> 
>> I must admit  - I didn't know such an option existed... and that's great to
>> know...
> 
> I myself discovered it by accident when I saw the MTU on my linux box to 
> be not the 1500 :-)
> 
>> On a related note to the PS below... we have tested lt2tpv3 on a few
>> different boxes running various IOS images and on each of the devices we did
>> test we seen the same behavior.  This means something is either broke in the
>> code in my opinion or that we are doing something wrong.  Typically that
>> means the second option in our case (lol) but I did get a fair amount of
>> feedback offline from folks with similar problems....;)
> 
> It could be as well that it is the first option but that the tcp 
> mss-adjust hack is working "good enough" for anyone to bother - there are 
> always "more important battles" to fight. But if someone on the list is 
> willing to spend some cycles on this in the lab and subsequently open a 
> case to get this to a more definitive status quo - unicast me.
> 
> thanks,
> andrew
> 
> p.s. about the protocols that can break with this scenario, a few things 
> come to mind: kerberos, possibly IKE w/certs, SNMP, netflow.
> 
> 
> 
> ------------------------------
> 
> _______________________________________________
> cisco-nsp mailing list
> cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> 
> End of cisco-nsp Digest, Vol 79, Issue 65
> *****************************************

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box,  CH-8021   Zurich, Switzerland
E-mail: peter.haag at switch.ch Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iQCVAwUBSjuNr/5AbZRALNr/AQJ//wQAmWIig5w5P2kB7uF/4gPMzwAbwJtPyG70
SqBEPKRG/KWat4iudfEwA/789EUNjSVK53mYSm2eWwU4UcLfExAcNHTWl2YAax7o
Sh9TZ4zimwScHrTTXoTAdUVs+qa7eKbhxWmOyrZGhvar/NxUK5B3dqUqiGsA7DBl
Err93Fg3fV0=
=HP1D
-----END PGP SIGNATURE-----

From nic at gblx.net  Fri Jun 19 09:22:14 2009
From: nic at gblx.net (Nic McCartney)
Date: Fri, 19 Jun 2009 14:22:14 +0100
Subject: [c-nsp] Long Uptime
Message-ID: <018201c9f0e0$f65e3740$e31aa5c0$@net>

Not techy, just interesting anyone beat this uptime?

Liverpool_St_A#sho ver
Cisco Internetwork Operating System Software IOS (tm) 3000 Software
(IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c) 1986-1996
by cisco Systems, Inc.
Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
data-base: 0x00001000

ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
SOFTWARE (fc1)

Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
restarted by power-on System image file is "flash:igs-j-l.110-13", booted
via flash

cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of memory.
Processor board ID 04812778, with hardware revision 00000000 Bridging
software.
SuperLAT software copyright 1990 by Meridian Technology Corp).
X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
TN3270 Emulation software (copyright 1994 by TGV Inc).
1 Ethernet/IEEE 802.3 interface.
2 Serial network interfaces.
32K bytes of non-volatile configuration memory.
8192K bytes of processor board System flash (Read ONLY)

Configuration register is 0x2102

Liverpool_St_A#


Thanks

Nic



From ploopster at gmail.com  Fri Jun 19 10:03:17 2009
From: ploopster at gmail.com (Sridhar Ayengar)
Date: Fri, 19 Jun 2009 10:03:17 -0400
Subject: [c-nsp] Long Uptime
In-Reply-To: <018201c9f0e0$f65e3740$e31aa5c0$@net>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
Message-ID: <4A3B9AA5.3080704@gmail.com>

Nic McCartney wrote:
> Not techy, just interesting anyone beat this uptime?

I can, but not on a Cisco.

Peace...  Sridhar

From peter at rathlev.dk  Fri Jun 19 10:08:01 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Fri, 19 Jun 2009 16:08:01 +0200
Subject: [c-nsp] Incorrect netflow data from 7600/6500?
In-Reply-To: <4A3B8DB1.6000009@switch.ch>
References: <mailman.874.1245381356.2287.cisco-nsp@puck.nether.net>
	<4A3B8DB1.6000009@switch.ch>
Message-ID: <1245420481.6873.2.camel@localhost.localdomain>

On Fri, 2009-06-19 at 15:08 +0200, Peter Haag wrote:
> > I've seen this result from multiple other Netflow tools: ntop, Orion
> > NetFlow and now nfdump.  The only common element is my hardware.
> > I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both
> > running 12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.
> > 
> > I think I can make the assumption there isn't a protocol in use that
> > trumps both UDP and TCP traffic combined.  Have I run into an IOS
> > bug or did I misconfigure?
> 
> No - port 0 result from fragmented packets Most likely UDP packets >
> MTU size. Since the IP ID field is not tracked in a v5 Netflow record,
> the router can not map a fragmented packet to the appropriate flow,
> and simply creates a flow with port '0'

Well, that would be for _port_ 0 traffic, with either TCP or UDP in the
protocol field, wouldn't it? OPs traffic is "protocol 0", so IMHO Scotts
point about flow mask is the best bet.

Regards,
Peter



From mustafa.golam at gmail.com  Fri Jun 19 10:19:51 2009
From: mustafa.golam at gmail.com (Mustafa Golam -)
Date: Fri, 19 Jun 2009 15:19:51 +0100
Subject: [c-nsp] Long Uptime
In-Reply-To: <018201c9f0e0$f65e3740$e31aa5c0$@net>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
Message-ID: <c72973e60906190719r66a462b4hedc10883d8771780@mail.gmail.com>

Check this:
http://www.networkworld.com/community/node/18932

Some of them are more stable than yours :P

//Mustafa

On Fri, Jun 19, 2009 at 2:22 PM, Nic McCartney <nic at gblx.net> wrote:

> Not techy, just interesting anyone beat this uptime?
>
> Liverpool_St_A#sho ver
> Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c) 1986-1996
> by cisco Systems, Inc.
> Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> data-base: 0x00001000
>
> ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> SOFTWARE (fc1)
>
> Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> via flash
>
> cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of memory.
> Processor board ID 04812778, with hardware revision 00000000 Bridging
> software.
> SuperLAT software copyright 1990 by Meridian Technology Corp).
> X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> TN3270 Emulation software (copyright 1994 by TGV Inc).
> 1 Ethernet/IEEE 802.3 interface.
> 2 Serial network interfaces.
> 32K bytes of non-volatile configuration memory.
> 8192K bytes of processor board System flash (Read ONLY)
>
> Configuration register is 0x2102
>
> Liverpool_St_A#
>
>
> Thanks
>
> Nic
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



-- 
--
*??)
?.???.?*??) ?.?*?)
(?.?? (?.?` *Mustafa Golam,CCIE(..)'.'`,.
-.*.-JNCIS,RHCE,CC{D,I,N,S,V}P`et. al.'.'`,..
    Email  : mustafa.golam at gmail.com
    GSM: ++234-(7034174940)/(7060460120)
      http://journey2ccie.wordpress.com/

From gustavo at nexthop.com.br  Fri Jun 19 10:25:14 2009
From: gustavo at nexthop.com.br (Gustavo Rodrigues Ramos)
Date: Fri, 19 Jun 2009 11:25:14 -0300
Subject: [c-nsp] Long Uptime
In-Reply-To: <018201c9f0e0$f65e3740$e31aa5c0$@net>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
Message-ID: <73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>

Is this suppose to be a good thing? (not patching your systems for
almost 10 years?)...

Gustavo.


On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> Not techy, just interesting anyone beat this uptime?
>
> Liverpool_St_A#sho ver
> Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c) 1986-1996
> by cisco Systems, Inc.
> Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> data-base: 0x00001000
>
> ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> SOFTWARE (fc1)
>
> Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> via flash
>
> cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of memory.
> Processor board ID 04812778, with hardware revision 00000000 Bridging
> software.
> SuperLAT software copyright 1990 by Meridian Technology Corp).
> X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> TN3270 Emulation software (copyright 1994 by TGV Inc).
> 1 Ethernet/IEEE 802.3 interface.
> 2 Serial network interfaces.
> 32K bytes of non-volatile configuration memory.
> 8192K bytes of processor board System flash (Read ONLY)
>
> Configuration register is 0x2102
>
> Liverpool_St_A#
>
>
> Thanks
>
> Nic
>
>
> _______________________________________________
> cisco-nsp mailing list ?cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From rinse.kloek at isp.solcon.nl  Fri Jun 19 10:49:00 2009
From: rinse.kloek at isp.solcon.nl (Rinse Kloek)
Date: Fri, 19 Jun 2009 16:49:00 +0200
Subject: [c-nsp] ETSI Rack mounts for 4500
In-Reply-To: <73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
Message-ID: <4A3BA55C.6070101@isp.solcon.nl>

All,

I am looking for some ERSI Rack mount ears to place some Cisco 4506's in 
special Telco cabinets. The cabinets are 1,5 inch wider than the normal 
19 inch cabinets.
Does Cisco have these rack ears ?

regards,
Rinse

From rick at woofpaws.com  Fri Jun 19 10:54:55 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Fri, 19 Jun 2009 07:54:55 -0700 (PDT)
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>


I'm not seeing anything jump out at me as different between the
Sup720(3BXL) and RSP.  What am I missing?

The potential deployment is core "glue" (router-reflector, redundancy)
between border and aggregation layers.  Other than BGP and OSPF, it's job
would be essentially to just move packets. uRPF and BGP blackholing would
be at the border, but I'd like to pull NetFlow data from the core.

Thanks,
Rick


From Ian.Mackinnon at lumison.net  Fri Jun 19 10:58:40 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Fri, 19 Jun 2009 15:58:40 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D94456E8@nbg01-exch-01.entlstaff.domain.lumison.net>

The biggie is 7600 only not 6500 :-(
As I am sure Gert will be along shortly to say.

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Rick Ernst
> Sent: 19 June 2009 15:55
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Sup720 vs RSP720 - Difference?
>
>
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?
>
> The potential deployment is core "glue" (router-reflector, redundancy)
> between border and aggregation layers.  Other than BGP and OSPF, it's
> job
> would be essentially to just move packets. uRPF and BGP blackholing
> would
> be at the border, but I'd like to pull NetFlow data from the core.
>
> Thanks,
> Rick
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From ivan.pepelnjak at zaplana.net  Fri Jun 19 11:00:26 2009
From: ivan.pepelnjak at zaplana.net (Ivan Pepelnjak)
Date: Fri, 19 Jun 2009 17:00:26 +0200
Subject: [c-nsp] the ospf 0*E2 route type can not be
	redistributedbetween two ospf process
In-Reply-To: <d6966e4b0906190535o595d07f9jfc7598a569165df5@mail.gmail.com>
References: <15453343.191691245387480644.JavaMail.coremail@bj163app61.163.com>
	<d6966e4b0906190535o595d07f9jfc7598a569165df5@mail.gmail.com>
Message-ID: <010501c9f0ee$ae6d2140$0a00000a@nil.si>

See also http://wiki.nil.com/OSPF_default_routes for more details.

Best regards
Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/ 

> -----Original Message-----
> From: Geoffrey Pendery [mailto:geoff at pendery.net] 
> Sent: Friday, June 19, 2009 2:36 PM
> To: ying-xiang
> Cc: cisco-nsp
> Subject: Re: [c-nsp] the ospf 0*E2 route type can not be 
> redistributedbetween two ospf process
> 
> Well if you're talking "default-information originate", then 
> the route in question is 0.0.0.0/0, default.  It's special - 
> you can't just tell an OSPF process to redistribute 
> 0.0.0.0/0.  If you want both processes to distribute default, 
> then they both need the "default-information originate" command.
> 
> 
> -Geoff
> 
> 
> On Thu, Jun 18, 2009 at 11:58 PM, 
> ying-xiang<ying-xiang at 163.com> wrote:
> >
> > hi,folk
> >
> > anyone knows the reason why i can not redistribute the O*E2 
> route which generated by one ospf router using 
> default-information originate command to another ospf process?
> > _______________________________________________
> > cisco-nsp mailing list ?cisco-nsp at puck.nether.net 
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> 
> 


From p.mayers at imperial.ac.uk  Fri Jun 19 11:06:10 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 19 Jun 2009 16:06:10 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <4A3BA962.2030105@imperial.ac.uk>

Rick Ernst wrote:
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?

The CPU is faster. It's 7600-only. I think it's got resilient EOBC (does 
the EOBC fail in the real world!?!) and there are probably some other 
things.

From Ian.Mackinnon at lumison.net  Fri Jun 19 10:58:40 2009
From: Ian.Mackinnon at lumison.net (Ian MacKinnon)
Date: Fri, 19 Jun 2009 15:58:40 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <B5F945E48C137C49A98BC86DD35939C012D94456E8@nbg01-exch-01.entlstaff.domain.lumison.net>

The biggie is 7600 only not 6500 :-(
As I am sure Gert will be along shortly to say.

> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Rick Ernst
> Sent: 19 June 2009 15:55
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Sup720 vs RSP720 - Difference?
>
>
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?
>
> The potential deployment is core "glue" (router-reflector, redundancy)
> between border and aggregation layers.  Other than BGP and OSPF, it's
> job
> would be essentially to just move packets. uRPF and BGP blackholing
> would
> be at the border, but I'd like to pull NetFlow data from the core.
>
> Thanks,
> Rick
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

--

This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender. Any
offers or quotation of service are subject to formal specification.
Errors and omissions excepted.  Please note that any views or opinions
presented in this email are solely those of the author and do not
necessarily represent those of Lumison.
Finally, the recipient should check this email and any attachments for the
presence of viruses.  Lumison accept no liability for any
damage caused by any virus transmitted by this email.

From p.mayers at imperial.ac.uk  Fri Jun 19 11:22:19 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 19 Jun 2009 16:22:19 +0100
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection
Message-ID: <4A3BAD2B.1060602@imperial.ac.uk>

All,

We've recently deployed config on our ACE (blades in 6500s) to provide 
resilient DNS.

However, the ACE seems to be doing some kind of DNS inspection, and is 
(incorrectly I think) closing the SLB session the instant a DNS answer 
comes back. This causes problems with clients that make 2 lookups very 
quickly, from the same source port.

i.e. I am seeing:

client sport=5000 dport=53 query id=2346 hostname A
client sport=5000 dport=53 query id=4646 hostname AAAA
server dport=5000 sport=53 reply id=2346 A=192.168.x.y

...and that's it. The 2nd reply is dropped. If the client makes the 
queries "slowly" they work fine:

client sport=5000 dport=53 query id=2346 hostname A
server dport=5000 sport=53 reply id=2346 A=192.168.x.y
client sport=5000 dport=53 query id=4646 hostname AAAA
server dport=5000 sport=53 reply id=4646 AAAA=...

Our old DNS servers (via static anycast routes) and a different service 
(via eBGP multipath anycast) don't exhibit the problem, so I'm certain 
it's the ACE.

FYI, this causes problems with the glibc changes present in 2.10 & 
Fedora 11 - the glibc always tries two queries in quick succession for A 
and AAAA records, and the timeouts can destroy kerberos/ldap logins...

I'm aware of the "inspect" commands, but they're off by default and I 
can't "no inspect"; it tells me it's already turned off.

Does anyone know if and how I can persuade the ACE to stop being so 
"clever" and just treat the DNS as "plain old UDP"?

version info is:

Software
   loader:    Version 12.2[120]
   system:    Version A2(1.1) [build 3.0(0)A2(1.1) 
adbuild_00:25:02-2008/06/05_/auto/adbu-rel3/rel_a2_1_1_throttle/REL_3_0_0_A2_1_1]
   system image file: [LCP] disk0:c6ace-t1k9-mz.A2_1_1.bin
   installed license: ACE-08G-LIC ACE-SEC-LIC-K9

...and the config we're using is:


serverfarm host RECURSIVE-DNS
   transparent
   predictor leastconns
   probe TCP_53
   rserver xxx 53
     inservice
   rserver yyy 53
     inservice
   rserver www 53
     inservice
   rserver zzz 53
     inservice

class-map match-any VIP_SPONCON-DNS
   2 match virtual-address 192.168.a.b udp eq domain
   3 match virtual-address 192.168.a.b tcp eq domain

policy-map type loadbalance first-match SLB_RECURSIVE-DNS
   class class-default
     serverfarm RECURSIVE-DNS

policy-map multi-match VIPS_VLANxx
   !.. various config, then
   class VIP_SPONCON-DNS
     loadbalance vip inservice
     loadbalance policy SLB_RECURSIVE-DNS
     loadbalance vip icmp-reply
     loadbalance vip advertise


From Thomas.Sillaber at nextiraone.de  Fri Jun 19 11:32:12 2009
From: Thomas.Sillaber at nextiraone.de (Thomas.Sillaber at nextiraone.de)
Date: Fri, 19 Jun 2009 17:32:12 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<B5F945E48C137C49A98BC86DD35939C012D94456E8@nbg01-exch-01.entlstaff.domain.lumison.net>
Message-ID: <D2A12B44A1003D45A7117D0BBB957A061449DCE1@BER05101.ebdmail.alcatel.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Rick,

here's a short overview about the diff:

-
------------------------------------------------------------------------
--
					Sup720		RSP720
MSFC					MSFC3			MSFC4!
DRAM					1G			up to 4G
(DDR2)!
NVRAM					2M			4M!
Bootflash				64M			512M!
PFC					PFCB /BXL		PFC3C
/CXL!
FIB/LFIB Entries			1M			1M
Cam Table Size			32k/64k		80k/96k!
IP Subscriber termination	not available	+32k
IP Forwarding			30Mpps		30Mpps
MPLS Forwarding			20Mpps		20Mpps
-
------------------------------------------------------------------------
--
PFC3CXL!

ACl Masks (Ipv4/Ipv6)			4k/2k 	(PFC3BXL = 4k/1k)
ACL Entries (IPv4/IPv6)			32k/16k	(PFC3BXL = 32k/8k)
Hash of VLAN ID in EtherChannel	yes 		(PFC3BXL = no)
-
------------------------------------------------------------------------
--

==> it's 76 Hw
==> Redundant EOBC is available with S Chassis

Brgds 

Thomas




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iQEVAwUBSjuveWZ0NRmWJ+KQAQJzdAgAnXO1uCowH8BxPCC8MPVDjfqOnIWjl2cS
d1rU2ORhBsct6ZSSIqWC9y4xnjELhhHfXaaMEyJPrTRUX383akhlzuJbyLnolzrw
U+iym8yDyLjlPwnlyGNzM2sGm5TDohlRRh/vtyljyootqLeIHNnb87cYbNUyyX0v
wg552oTLv/BBOv7LHyMYA8SMqs/IkwvveaEzxXSXuQ1JU3B3PG5VgJ8S8+kfatoM
Gd24Mz+8TdNiyieJ6Uy22CT/o2E+yDSj+qBDEnuIkbWG0C5RvHe1iDtFuKyb2mDZ
NU3ImFbyxJzS/0o+94KueTfPkLfDKvE7Z9Ao/i2oy5bcakC2O4QoeQ==
=kmct
-----END PGP SIGNATURE-----

From paul at paulstewart.org  Fri Jun 19 11:31:50 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Fri, 19 Jun 2009 11:31:50 -0400
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <000001c9f0f3$1defbe20$59cf3a60$@org>

I'm not sure about performance numbers but biggest thing I can see is
support for 4GB RAM - for us, this is becoming an issue with BGP tables
chewing up 60% of our memory today in 3BXL's.  I miss the PRP2 platform for
BGP now... thinking of moving back to GSR's in the near future on PRP3's

Paul


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Rick Ernst
Sent: Friday, June 19, 2009 10:55 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Sup720 vs RSP720 - Difference?


I'm not seeing anything jump out at me as different between the
Sup720(3BXL) and RSP.  What am I missing?

The potential deployment is core "glue" (router-reflector, redundancy)
between border and aggregation layers.  Other than BGP and OSPF, it's job
would be essentially to just move packets. uRPF and BGP blackholing would
be at the border, but I'd like to pull NetFlow data from the core.

Thanks,
Rick

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


From Thomas.Sillaber at nextiraone.de  Fri Jun 19 11:35:57 2009
From: Thomas.Sillaber at nextiraone.de (Thomas.Sillaber at nextiraone.de)
Date: Fri, 19 Jun 2009 17:35:57 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <D2A12B44A1003D45A7117D0BBB957A061449DCE4@BER05101.ebdmail.alcatel.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Rick,

i forgot the cpu--

			SUP-720		RSP-720
CPU			600Mhz		1.3GHz

Brgds and have a great day


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iQEVAwUBSjuwXWZ0NRmWJ+KQAQI/2Qf/Vv9BANQJM7FF2O3If8m3T/trWrx7nSmR
A4uwexKG9QDHCO9uHkoSdz0w8ko261sdJKLDM5O7GbW7bqqdwuGmhN/nI/CiT8pE
DYt2L53L+DDBIXPdEmiKvL5HvrftAHKYxhqEraTy1hU896WOzvXdj41ZqtMbJH+l
5s9+iRJJdg3CCknkWHRFCIwARjLa2+bwwF+dz7SANsEH17+x1zcp9xAHM+HOYSXo
OayU07LPySo4+lVVgkicx/vIKGc/ucNy76RZhWlme8oTXqC/cY0SOP06QgqBnJk3
NLmtTALim2/QO9897PLyeJvM94TMMj6s1Mq8bXoYgrZ98Abv6MdLuA==
=AYCZ
-----END PGP SIGNATURE-----

From apiasecki at gmail.com  Fri Jun 19 11:42:31 2009
From: apiasecki at gmail.com (Adam Piasecki)
Date: Fri, 19 Jun 2009 11:42:31 -0400
Subject: [c-nsp] Long Uptime
In-Reply-To: <73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
Message-ID: <345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>

Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE
SOFTWARE
(fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Wed 28-Aug-02 10:25 by antonino
Image text-base: 0x80010000, data-base: 0x80528000

ROM: Bootstrap program is CALHOUN boot loader

switch02.kst.dc uptime is 6 years, 4 weeks, 4 days, 48 minutes
System returned to ROM by power-on
System restarted at 11:00:50 EST Tue May 20 2003
System image file is "flash:/c2950-i6q4l2-mz.121-11.EA1.bin"

My longest running switch.


On Fri, Jun 19, 2009 at 10:25 AM, Gustavo Rodrigues Ramos <
gustavo at nexthop.com.br> wrote:

> Is this suppose to be a good thing? (not patching your systems for
> almost 10 years?)...
>
> Gustavo.
>
>
> On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> > Not techy, just interesting anyone beat this uptime?
> >
> > Liverpool_St_A#sho ver
> > Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> > (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c)
> 1986-1996
> > by cisco Systems, Inc.
> > Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> > data-base: 0x00001000
> >
> > ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> > ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> > SOFTWARE (fc1)
> >
> > Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> > restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> > via flash
> >
> > cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of
> memory.
> > Processor board ID 04812778, with hardware revision 00000000 Bridging
> > software.
> > SuperLAT software copyright 1990 by Meridian Technology Corp).
> > X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> > TN3270 Emulation software (copyright 1994 by TGV Inc).
> > 1 Ethernet/IEEE 802.3 interface.
> > 2 Serial network interfaces.
> > 32K bytes of non-volatile configuration memory.
> > 8192K bytes of processor board System flash (Read ONLY)
> >
> > Configuration register is 0x2102
> >
> > Liverpool_St_A#
> >
> >
> > Thanks
> >
> > Nic
> >
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From nic at gblx.net  Fri Jun 19 11:52:54 2009
From: nic at gblx.net (Nic McCartney)
Date: Fri, 19 Jun 2009 16:52:54 +0100
Subject: [c-nsp] Long Uptime
In-Reply-To: <345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>	
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
	<345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>
Message-ID: <024301c9f0f6$02db7e50$08927af0$@net>

Come on guys, 529weeks = 10yrs nobody beat that ? J

 

Nic

 

From: Adam Piasecki [mailto:apiasecki at gmail.com] 
Sent: 19 June 2009 16:43
To: Gustavo Rodrigues Ramos
Cc: Nic McCartney; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Long Uptime

 

Cisco Internetwork Operating System Software

IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE
SOFTWARE
(fc1)
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Wed 28-Aug-02 10:25 by antonino
Image text-base: 0x80010000, data-base: 0x80528000

ROM: Bootstrap program is CALHOUN boot loader

switch02.kst.dc uptime is 6 years, 4 weeks, 4 days, 48 minutes
System returned to ROM by power-on
System restarted at 11:00:50 EST Tue May 20 2003
System image file is "flash:/c2950-i6q4l2-mz.121-

11.EA1.bin"

My longest running switch.

 

On Fri, Jun 19, 2009 at 10:25 AM, Gustavo Rodrigues Ramos
<gustavo at nexthop.com.br> wrote:

Is this suppose to be a good thing? (not patching your systems for
almost 10 years?)...

Gustavo.



On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> Not techy, just interesting anyone beat this uptime?
>
> Liverpool_St_A#sho ver
> Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c)
1986-1996
> by cisco Systems, Inc.
> Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> data-base: 0x00001000
>
> ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> SOFTWARE (fc1)
>
> Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> via flash
>
> cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of
memory.
> Processor board ID 04812778, with hardware revision 00000000 Bridging
> software.
> SuperLAT software copyright 1990 by Meridian Technology Corp).
> X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> TN3270 Emulation software (copyright 1994 by TGV Inc).
> 1 Ethernet/IEEE 802.3 interface.
> 2 Serial network interfaces.
> 32K bytes of non-volatile configuration memory.
> 8192K bytes of processor board System flash (Read ONLY)
>
> Configuration register is 0x2102
>
> Liverpool_St_A#
>
>
> Thanks
>
> Nic
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 


From ip at ioshints.info  Fri Jun 19 12:14:31 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Fri, 19 Jun 2009 18:14:31 +0200
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <20090618183433.GB13882@rtp-cse-489.cisco.com>
References: <1245283261.15106.46.camel@localhost.localdomain><1245345182.26970.13.camel@localhost.localdomain>
	<20090618183433.GB13882@rtp-cse-489.cisco.com>
Message-ID: <012401c9f0f9$081226a0$0a00000a@nil.si>

Just guessing: for PBR you need netflow-like TCAM entries, so the first
packet in the flow is always processor-switched and then the subsequent
packets can be hardware-switched. Does this make sense to the switching
gurus?

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/

> -----Original Message-----
> From: Rodney Dunn [mailto:rodunn at cisco.com] 
> Sent: Thursday, June 18, 2009 8:35 PM
> To: Peter Rathlev
> Cc: cisco-nsp
> Subject: Re: [c-nsp] Redirects / hair-pinning traffic vs. performance
> 
> Curious..I don't know that platform forwarding architecture.
> 
> But what does 'sh int stat' give you?
> 
> Also, sh ip traffic a couple times once you start the traffic.
> 
> 
> On Thu, Jun 18, 2009 at 07:13:02PM +0200, Peter Rathlev wrote:lso
> 
> > On Thu, 2009-06-18 at 00:01 +0000, Peter Rathlev wrote: 
> > > I have the need to introduce some PBR to solve a 
> hopefully temporary 
> > > problem. Some of the traffic being routed will leave the same 
> > > interface as it arrives on.
> > > 
> > > My worry is if this would have any performance impact the traffic 
> > > arrives on and leaves from the same interface. I could 
> imagine that 
> > > some forwarding implementations might penalize this scenario.
> > 
> > Follow up: We've tested this and it works fine. It seems to 
> have some 
> > CPU impact when the unit policy routes, but not much. When 
> pushing 100 
> > mbps traffic through the CPU rises to ~25-30% for a few 
> seconds (spent 
> > on interrupt switching) and then falls down ~5% again.
> > 
> > This might be PBR-specific and have nothing to do with the traffic 
> > arriving on and exiting the same interface though. We will be doing 
> > some more (production) testing soon, with more flows and more 
> > bandwidth. I can't see why the number of flows should 
> matter since the 
> > 3560 AFAIK just pushes packets, but I also can't see why 
> the start of 
> > a TCP session should matter. The "ip route-cache" hasn't 
> been disabled 
> > of course; I assume this would have a detrimental effect on 
> performance.
> > 
> > Regards,
> > Peter
> > 
> > 
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> 
> 


From rick at woofpaws.com  Fri Jun 19 12:32:25 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Fri, 19 Jun 2009 09:32:25 -0700 (PDT)
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <000001c9f0f3$1defbe20$59cf3a60$@org>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
Message-ID: <44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>


Thanks to everyone for the feedback so far.

For my situation, the two biggest items that stand out are:
 - 4GB vs 1GB RAM
 - 7600 chassis only, not 6500 (planning on a 7600 chassis, though)

I'm a bit surprised that you are seeing ~60%  memory used by BGP. My
border routers (4 routers, 1 full feed each) and core (route-reflectors)
are both only showing about 25% memory used, total.

Since the Sup720 (spec-wise, at least) capacity is roughly 2 orders of
magnitude higher than I'm currently pushing through the core, it looks
like it should serve for several years.  The RSP720 becomes an upgrade
option if 1GB is no longer big enough for full tables (plus IPv6
roll-out?).

On the subject of memory and DFCs... do the DFCs also support 4GB for the
FIB, or is this an apples vs oranges comparison?

Thanks,


On Fri, June 19, 2009 08:31, Paul Stewart wrote:
> I'm not sure about performance numbers but biggest thing I can see is
> support for 4GB RAM - for us, this is becoming an issue with BGP tables
> chewing up 60% of our memory today in 3BXL's.  I miss the PRP2 platform
> for
> BGP now... thinking of moving back to GSR's in the near future on PRP3's
>
> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Rick Ernst
> Sent: Friday, June 19, 2009 10:55 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Sup720 vs RSP720 - Difference?
>
>
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?
>
> The potential deployment is core "glue" (router-reflector, redundancy)
> between border and aggregation layers.  Other than BGP and OSPF, it's job
> would be essentially to just move packets. uRPF and BGP blackholing would
> be at the border, but I'd like to pull NetFlow data from the core.
>
> Thanks,
> Rick
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>


From p.mayers at imperial.ac.uk  Fri Jun 19 12:43:57 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Fri, 19 Jun 2009 17:43:57 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
Message-ID: <4A3BC04D.3090008@imperial.ac.uk>

Rick Ernst wrote:
> Thanks to everyone for the feedback so far.
> 
> For my situation, the two biggest items that stand out are:
>  - 4GB vs 1GB RAM
>  - 7600 chassis only, not 6500 (planning on a 7600 chassis, though)
> 
> I'm a bit surprised that you are seeing ~60%  memory used by BGP. My
> border routers (4 routers, 1 full feed each) and core (route-reflectors)
> are both only showing about 25% memory used, total.

I guess the poster is taking more than one full feed (see below) which 
consumes more ram.

> 
> Since the Sup720 (spec-wise, at least) capacity is roughly 2 orders of
> magnitude higher than I'm currently pushing through the core, it looks

By "spec-wise" I assume you mean forwarding rates? The 6500/7600 
platforms are indeed very fast.

> like it should serve for several years.  The RSP720 becomes an upgrade
> option if 1GB is no longer big enough for full tables (plus IPv6
> roll-out?).
> 
> On the subject of memory and DFCs... do the DFCs also support 4GB for the
> FIB, or is this an apples vs oranges comparison?

It doesn't work that way. FIB is held in TCAM, not RAM.

PFC/DFCs some in two forms - XL and non-XL.

XL can hold ~1M FIB entries, with some commands to divide this up 
between v4, v6 and so on. Notably, this is more than sufficient to hold 
a full table.

non-XL can hold 256k entries, which is not sufficient for a full table.

So, for full-table applications, ensure you get a sup with XL PFC and 
that *all* your linecards have XL DFCs.

Also be aware, as discussed recently - holding >1 full feed on a 
6500/7600 does not consume more FIB entries - it just uses sup RAM, 
since only one FIB entry is installed per prefix.

I see in your original post you mentioned netflow - you will probably 
want to have a look through the archives for the (many, long) threads 
where people document their problems with netflow on this platform. 
Specifically, like the FIB, the DFCs have limited TCAM slots for netflow 
entries (256k/1M on non-XL/XL) and you can over-run this TCAM if you 
have a lot of traffic.

If the netflow is important to you, and you're likely to have >1M flows 
at any given time, you might want to consider alternatives.

From ayourtch at cisco.com  Fri Jun 19 12:52:09 2009
From: ayourtch at cisco.com (Andrew Yourtchenko)
Date: Fri, 19 Jun 2009 18:52:09 +0200 (CEST)
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <m3y6ro7h07.fsf@ursa.amorsen.dk>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
	<007e01c9f087$45aebae0$d10c30a0$@org> <m3y6ro7h07.fsf@ursa.amorsen.dk>
Message-ID: <Pine.LNX.4.64.0906191509390.8007@zippy.stdio.be>



On Fri, 19 Jun 2009, Benny Amorsen wrote:

> "Paul Stewart" <paul at paulstewart.org> writes:
>
>> On a related note to the PS below... we have tested lt2tpv3 on a few
>> different boxes running various IOS images and on each of the devices we did
>> test we seen the same behavior.  This means something is either broke in the
>> code in my opinion or that we are doing something wrong.  Typically that
>> means the second option in our case (lol) but I did get a fair amount of
>> feedback offline from folks with similar problems....;)
>
> Generally problems with PMTU are caused by people blocking ICMP in their

Somehow yesterday I correlated the original "UDP not working" comment to 
the "replies off list" and was thinking that we don't fragment the 
UDP correctly - since I assumed the PMTUD blackholing problem to be 
reasonably well known. Sorry, my bad.

> (usually PIX/ASA) firewalls. If you control the whole path, you can make
> sure that you're not one of the culprits.
>
> On the other hand, if you're trying to reach the Internet through
> tunnels with non-1500-byte MTU, you'll just have to accept that it won't
> work. You can MSS adjust for TCP traffic though or you can lower your
> interface or route MTU as workarounds. The only real fix is either
> PIX/ASA administrators getting a clue, or Cisco getting a clue. Not
> particularly likely.

Given the existence of http://www.kb.cert.org/vuls/id/222750, it's 
impossible to claim a simple and single answer for all, IMHO. I wish I 
could just say "fix your systems and don't bother to block the type 3 
code 4", and the things would magically work. But there're always 
"more urgent things that need to be done yesterday" - so we are where we 
are.

OTOH, to create a blackhole, you don't need a firewall or a firewall 
administrator, for that reason - "no ip unreachables" does this job pretty 
well too.

>
>
> /Benny
>
> (Yes, I'm bitter.)
>

Have a good weekend.

cheers,
andrew

From paul at paulstewart.org  Fri Jun 19 12:55:17 2009
From: paul at paulstewart.org (Paul Stewart)
Date: Fri, 19 Jun 2009 12:55:17 -0400
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
Message-ID: <000a01c9f0fe$c5fad7c0$51f08740$@org>

Hey there...

Between the two 7206's in question, we have about 280 BGP peers configured
split about 60/40 between them.... ;)

Paul


-----Original Message-----
From: Rick Ernst [mailto:rick at woofpaws.com] 
Sent: Friday, June 19, 2009 12:32 PM
To: Paul Stewart
Cc: cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] Sup720 vs RSP720 - Difference?


Thanks to everyone for the feedback so far.

For my situation, the two biggest items that stand out are:
 - 4GB vs 1GB RAM
 - 7600 chassis only, not 6500 (planning on a 7600 chassis, though)

I'm a bit surprised that you are seeing ~60%  memory used by BGP. My
border routers (4 routers, 1 full feed each) and core (route-reflectors)
are both only showing about 25% memory used, total.

Since the Sup720 (spec-wise, at least) capacity is roughly 2 orders of
magnitude higher than I'm currently pushing through the core, it looks
like it should serve for several years.  The RSP720 becomes an upgrade
option if 1GB is no longer big enough for full tables (plus IPv6
roll-out?).

On the subject of memory and DFCs... do the DFCs also support 4GB for the
FIB, or is this an apples vs oranges comparison?

Thanks,


On Fri, June 19, 2009 08:31, Paul Stewart wrote:
> I'm not sure about performance numbers but biggest thing I can see is
> support for 4GB RAM - for us, this is becoming an issue with BGP tables
> chewing up 60% of our memory today in 3BXL's.  I miss the PRP2 platform
> for
> BGP now... thinking of moving back to GSR's in the near future on PRP3's
>
> Paul
>
>
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net
> [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Rick Ernst
> Sent: Friday, June 19, 2009 10:55 AM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] Sup720 vs RSP720 - Difference?
>
>
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?
>
> The potential deployment is core "glue" (router-reflector, redundancy)
> between border and aggregation layers.  Other than BGP and OSPF, it's job
> would be essentially to just move packets. uRPF and BGP blackholing would
> be at the border, but I'd like to pull NetFlow data from the core.
>
> Thanks,
> Rick
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



From gert at greenie.muc.de  Fri Jun 19 13:27:47 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 19:27:47 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
Message-ID: <20090619172747.GX290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 07:54:55AM -0700, Rick Ernst wrote:
> I'm not seeing anything jump out at me as different between the
> Sup720(3BXL) and RSP.  What am I missing?

RSP has faster CPU and you are stuck to the bad guys BU.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/306fd935/attachment.bin>

From gert at greenie.muc.de  Fri Jun 19 13:29:30 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 19:29:30 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <D2A12B44A1003D45A7117D0BBB957A061449DCE1@BER05101.ebdmail.alcatel.de>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<B5F945E48C137C49A98BC86DD35939C012D94456E8@nbg01-exch-01.entlstaff.domain.lumison.net>
	<D2A12B44A1003D45A7117D0BBB957A061449DCE1@BER05101.ebdmail.alcatel.de>
Message-ID: <20090619172930.GY290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 05:32:12PM +0200, Thomas.Sillaber at nextiraone.de wrote:
> here's a short overview about the diff:
> -
> ------------------------------------------------------------------------
> --
> 					Sup720		RSP720
> MSFC					MSFC3			MSFC4!
> DRAM					1G			up to 4G
> (DDR2)!
> NVRAM					2M			4M!
> Bootflash				64M			512M!
> PFC					PFCB /BXL		PFC3C
> /CXL!

One should point out that there is also the Sup720-10G/3CXL (or however
it's called correctly in Cisco lingua).  PFC3C/3C-XL with the bigger
MAC table, and 2x 10G + 3x 1G onboard.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/2d22c72a/attachment.bin>

From gert at greenie.muc.de  Fri Jun 19 13:30:40 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 19:30:40 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
Message-ID: <20090619173040.GZ290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 09:32:25AM -0700, Rick Ernst wrote:
> On the subject of memory and DFCs... do the DFCs also support 4GB for the
> FIB, or is this an apples vs oranges comparison?

The DFC is the same, and its FIB memory is limited by TCAM (1 million
entries on the -XL) not by DRAM.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/29fdc10d/attachment-0001.bin>

From gert at greenie.muc.de  Fri Jun 19 13:35:03 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 19:35:03 +0200
Subject: [c-nsp] Long Uptime
In-Reply-To: <024301c9f0f6$02db7e50$08927af0$@net>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
	<345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>
	<024301c9f0f6$02db7e50$08927af0$@net>
Message-ID: <20090619173503.GA290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 04:52:54PM +0100, Nic McCartney wrote:
> Come on guys, 529weeks = 10yrs nobody beat that ? J

Best I have is 

win-gw uptime is 9 years, 37 weeks, 4 days, 5 hours, 26 minutes
System restarted by power-on at 11:32:23 UTC Sat Oct 2 1999
System image file is "flash:c2500-is-l.112-15a.bin.Z", booted via flash

... but that's, well, "not 10 years yet".

OTOH this box was doing production traffic until about two weeks ago
(and is now retired due to "only 10 Mbit/s ethernet and no IPv6").

11.0, wow :-)

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/4679839c/attachment.bin>

From rick at woofpaws.com  Fri Jun 19 13:55:11 2009
From: rick at woofpaws.com (Rick Ernst)
Date: Fri, 19 Jun 2009 10:55:11 -0700 (PDT)
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <20090619173040.GZ290@greenie.muc.de>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
	<20090619173040.GZ290@greenie.muc.de>
Message-ID: <51675.69.30.17.85.1245434111.squirrel@www.woofpaws.com>

Thanks for all the great feedback and information, folks!

So, the Sup720/RSP720 uses DRAM to store RIB + other stuff, and the FIB is
in TCAM either on the Sup (if no DFC), or on the DFC?

It looks like the extra memory on the RSP720 vs Sup720 would be good for
multiple feeds, but the TCAM (potentially divided between IPv4 and IPv6)
is limited to 1 million entries (2 entries per IPv6) regardless of
platform?

IIRC TCAM is also used for ACLs and, as somebody else mentioned, also for
Netflow?  Is there a different set of TCAM between FIB, ACLs, and NetFlow,
or does everything combined have to fit into the same 1M entries?


On Fri, June 19, 2009 10:30, Gert Doering wrote:
> Hi,
>
> On Fri, Jun 19, 2009 at 09:32:25AM -0700, Rick Ernst wrote:
>> On the subject of memory and DFCs... do the DFCs also support 4GB for
>> the
>> FIB, or is this an apples vs oranges comparison?
>
> The DFC is the same, and its FIB memory is limited by TCAM (1 million
> entries on the -XL) not by DRAM.
>
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                            //www.muc.de/~gert/
> Gert Doering - Munich, Germany
> gert at greenie.muc.de
> fax: +49-89-35655025
> gert at net.informatik.tu-muenchen.de
>


From gert at greenie.muc.de  Fri Jun 19 14:00:19 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 20:00:19 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <51675.69.30.17.85.1245434111.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
	<20090619173040.GZ290@greenie.muc.de>
	<51675.69.30.17.85.1245434111.squirrel@www.woofpaws.com>
Message-ID: <20090619180019.GB290@greenie.muc.de>

Hi,

On Fri, Jun 19, 2009 at 10:55:11AM -0700, Rick Ernst wrote:
> So, the Sup720/RSP720 uses DRAM to store RIB + other stuff, and the FIB is
> in TCAM either on the Sup (if no DFC), or on the DFC?

Correct.

> It looks like the extra memory on the RSP720 vs Sup720 would be good for
> multiple feeds, but the TCAM (potentially divided between IPv4 and IPv6)
> is limited to 1 million entries (2 entries per IPv6) regardless of
> platform?

Correct.  (256k entries if non-XL TCAM is used).

> IIRC TCAM is also used for ACLs and, as somebody else mentioned, also for
> Netflow?  Is there a different set of TCAM between FIB, ACLs, and NetFlow,
> or does everything combined have to fit into the same 1M entries?

ACL and Netflow stuff goes "somewhere else" in the TCAM.  The 1M entries
are "just FIB" (IPv4, IPv6, MPLS, multicast).

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/f365fe41/attachment.bin>

From gert at greenie.muc.de  Fri Jun 19 14:23:14 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Fri, 19 Jun 2009 20:23:14 +0200
Subject: [c-nsp] Thanks (Re:  Sup720 vs RSP720 - Difference?)
In-Reply-To: <51268.69.30.17.85.1245435043.squirrel@www.woofpaws.com>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>
	<000001c9f0f3$1defbe20$59cf3a60$@org>
	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
	<20090619173040.GZ290@greenie.muc.de>
	<51675.69.30.17.85.1245434111.squirrel@www.woofpaws.com>
	<20090619180019.GB290@greenie.muc.de>
	<51268.69.30.17.85.1245435043.squirrel@www.woofpaws.com>
Message-ID: <20090619182314.GC290@greenie.muc.de>

Hi,

(I'm copying back my response to c-nsp, because it ended up longer than
intended, and it might be useful to have in the archives)

On Fri, Jun 19, 2009 at 11:10:43AM -0700, Rick Ernst wrote:
> Thanks for the tremendous help you've given on the Sup/RSP question.
> I've been wading through white-papers, spec-sheets, Google, CCO, etc.
> trying to get my brain wrapped around what's going on, and none of it has
> been as useful as the information you've provided.
> 
> As a note, I'm going from all software routing (7206VXR/G1, 7507/RSP16) to
> 7600 series, so my brain is not yet calibrated for proper understanding
> and knowing which questions to ask. :)

There's a tremendous wealth of information in the archives of cisco-nsp,
as "us others" have had the same startup confusion as well.

There are a few important things to keep in mind:

 - if a "software router" is unhappy with something, it will get "somewhat
   slower" because it's going to be executed in a slower software forwarding
   path - but in the end, it's all "software".

 - if a (Cisco) "hardware router" is unhappy with a combination of features 
   you enable, the performance will go down *drastically*, because the
   hardware is extremely fast and the CPU on these boxes is fairly weak
   (the Sup720 is slower than a NPE-G1).  So check the set of desired
   features first - some are just not very suitable for fast-but-dumb
   devices.  NAT is one of the border cases, reflexive ACLs are tricky,
   and one of the worst thing is "tunnels with fragmentation".

   Most of this is documented, though.

 - the 6500/7600 series is "a big switch with extra brains".  This means
   that it will be less flexible in some cases than a "real router" - the
   most notable thing is the global VLAN space.  This means that if you
   have "dot1q vlan 2" on one interface, and "dot1q vlan 2" on another
   interface, it will be the *same* vlan 2.  On a "router", it's two 
   different dot1q subinterfaces, while on the switch, it's "two trunk 
   ports that carry the same VLAN (2)".

   The positive side of this is that you can play much nicer tricks with
   ether-channel aggregation than with "routers" - like the GSR that still
   can't do all possible features on an ether-channel (for the longest time,
   no IPv6 support at all on ether-channels...).

   This is really the most important thing to keep in mind: the 
   architecture is much closer to a switch than to a "classic" router, 
   and this has upsides and downsides.


 - there are the SIP and ES cards that plug into the 6500/7600, and 
   effectively bring their own brains - read: different bugs, different
   features, and different behaviour regarding VLAN space and such.

 - if something you want is not shipping today, don't believe any of the
   promises they are going to make.  Especially regarding combinations of
   line cards, chassis types, and supervisor boards - customers have been
   badly burnt by Cisco internal fights here.  Make them sign that this
   is going to work or else they will be taking back the boxes.


gert

-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/51570910/attachment.bin>

From vijay.ramcharan at verizonbusiness.com  Fri Jun 19 13:52:57 2009
From: vijay.ramcharan at verizonbusiness.com (Ramcharan, Vijay A)
Date: Fri, 19 Jun 2009 17:52:57 +0000
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection
In-Reply-To: <4A3BAD2B.1060602@imperial.ac.uk>
References: <4A3BAD2B.1060602@imperial.ac.uk>
Message-ID: <8171C8272CE8FE4A8F5BFF8A97CE6AB3DD35A6@ASHEVS006.mcilink.com>

Not sure if these are applicable but may be worth looking into. Just a
shot in the dark as I don't have ACEs to test with and I have not run
into this particular problem myself. 

I think each feature is mutually exclusive. 
UDP booster (high connection rates for UDP) and UDP fast-age (UDP
per-packet load balancing) 

http://cco.cisco.com/en/US/docs/app_ntwk_services/data_center_app_servic
es/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1157547
http://cco.cisco.com/en/US/docs/app_ntwk_services/data_center_app_servic
es/ace_appliances/vA3_1_0/configuration/slb/guide/classlb.html#wp1281598

 
Vijay Ramcharan  
  
-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Phil Mayers
Sent: June 19, 2009 11:22
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] ACE & load-balancing of DNS / ALG / inspection

All,

We've recently deployed config on our ACE (blades in 6500s) to provide 
resilient DNS.

However, the ACE seems to be doing some kind of DNS inspection, and is 
(incorrectly I think) closing the SLB session the instant a DNS answer 
comes back. This causes problems with clients that make 2 lookups very 
quickly, from the same source port.

i.e. I am seeing:

client sport=5000 dport=53 query id=2346 hostname A
client sport=5000 dport=53 query id=4646 hostname AAAA
server dport=5000 sport=53 reply id=2346 A=192.168.x.y

...and that's it. The 2nd reply is dropped. If the client makes the 
queries "slowly" they work fine:

client sport=5000 dport=53 query id=2346 hostname A
server dport=5000 sport=53 reply id=2346 A=192.168.x.y
client sport=5000 dport=53 query id=4646 hostname AAAA
server dport=5000 sport=53 reply id=4646 AAAA=...

Our old DNS servers (via static anycast routes) and a different service 
(via eBGP multipath anycast) don't exhibit the problem, so I'm certain 
it's the ACE.

FYI, this causes problems with the glibc changes present in 2.10 & 
Fedora 11 - the glibc always tries two queries in quick succession for A

and AAAA records, and the timeouts can destroy kerberos/ldap logins...

I'm aware of the "inspect" commands, but they're off by default and I 
can't "no inspect"; it tells me it's already turned off.

Does anyone know if and how I can persuade the ACE to stop being so 
"clever" and just treat the DNS as "plain old UDP"?

version info is:

Software
   loader:    Version 12.2[120]
   system:    Version A2(1.1) [build 3.0(0)A2(1.1) 
adbuild_00:25:02-2008/06/05_/auto/adbu-rel3/rel_a2_1_1_throttle/REL_3_0_
0_A2_1_1]
   system image file: [LCP] disk0:c6ace-t1k9-mz.A2_1_1.bin
   installed license: ACE-08G-LIC ACE-SEC-LIC-K9

...and the config we're using is:


serverfarm host RECURSIVE-DNS
   transparent
   predictor leastconns
   probe TCP_53
   rserver xxx 53
     inservice
   rserver yyy 53
     inservice
   rserver www 53
     inservice
   rserver zzz 53
     inservice

class-map match-any VIP_SPONCON-DNS
   2 match virtual-address 192.168.a.b udp eq domain
   3 match virtual-address 192.168.a.b tcp eq domain

policy-map type loadbalance first-match SLB_RECURSIVE-DNS
   class class-default
     serverfarm RECURSIVE-DNS

policy-map multi-match VIPS_VLANxx
   !.. various config, then
   class VIP_SPONCON-DNS
     loadbalance vip inservice
     loadbalance policy SLB_RECURSIVE-DNS
     loadbalance vip icmp-reply
     loadbalance vip advertise

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

______________________________________________________________________
This e-mail has been scanned by Verizon Managed Email Content Service,
using Skeptic(tm) technology powered by MessageLabs. For more
information on Verizon Managed Email Content Service, visit
http://www.verizonbusiness.com.
______________________________________________________________________

From sthaug at nethelp.no  Fri Jun 19 14:28:36 2009
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Fri, 19 Jun 2009 20:28:36 +0200 (CEST)
Subject: [c-nsp] Long Uptime
In-Reply-To: <20090619173503.GA290@greenie.muc.de>
References: <345400390906190842w29c12f42md8fab5ac80dff66d@mail.gmail.com>
	<024301c9f0f6$02db7e50$08927af0$@net>
	<20090619173503.GA290@greenie.muc.de>
Message-ID: <20090619.202836.41666142.sthaug@nethelp.no>

> OTOH this box was doing production traffic until about two weeks ago
> (and is now retired due to "only 10 Mbit/s ethernet and no IPv6").
> 
> 11.0, wow :-)

Some of us have not-so-fond memories of 8.2 - before it was called 
IOS :-)

(Also, before CIDR, before command completion and lots of other good
stuff...)

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From gtb at slac.stanford.edu  Fri Jun 19 15:26:38 2009
From: gtb at slac.stanford.edu (Buhrmaster, Gary)
Date: Fri, 19 Jun 2009 12:26:38 -0700
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <D2A12B44A1003D45A7117D0BBB957A061449DCE4@BER05101.ebdmail.alcatel.de>
References: <D2A12B44A1003D45A7117D0BBB957A061449DCE4@BER05101.ebdmail.alcatel.de>
Message-ID: <D0D0330CBD07114D85B70B784E80C2F202CE34AF@exch-mail2.win.slac.stanford.edu>

> 			SUP-720		RSP-720
> CPU			600Mhz		1.3GHz

  CPU Arch        MIPS based        PPC based
                  SR71000           8548

(comparing cpu "effectiveness" between the two
architecture implementations is a more complex
evaluation than the frequency differences alone.)

From george at mang.gr  Fri Jun 19 15:27:36 2009
From: george at mang.gr (Giorgos Manousakis)
Date: Fri, 19 Jun 2009 22:27:36 +0300
Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
Message-ID: <20090619192738.50C492FF06@geomanous.awmn>

Dear All,

i am trying to apply QoS on my aDsl interface (2048/256) and i need to give
strict priority to voice traffic, including skype and g711.

I suppose that i can match the g711 by using nbar rtp audio protocol or by
using source ports that are know on my asterisk server.

Because of randomness of skype protocol that kind of handling does not
apply. 
I found that skype is included in nbar but only after 12.4 version. 
Unfortunately i cannot upgrade the ios of my 837 cause of lack of DRAM,
which is not upgradable. 
So i tried to find a pdlm addon for skype, but it is not available for stand
alone download (http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm).

Can i found anywhere a skype.pdlm file? Is there any other way that i can
match this traffic? Could i try rtp audio for that one too?

Thanks 


From mhuff at ox.com  Fri Jun 19 15:57:36 2009
From: mhuff at ox.com (Matthew Huff)
Date: Fri, 19 Jun 2009 15:57:36 -0400
Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
In-Reply-To: <20090619192738.50C492FF06@geomanous.awmn>
References: <20090619192738.50C492FF06@geomanous.awmn>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C1434E@PUR-EXCH07.ox.com>

Even with the newest Skype nbar pdlm or built-in nbar in 12.4T(x), it is
pretty useless. The majority of Skype traffic is sent now encrypted over
port 443. The only way I know to monitor/block it is with something like
bluecoat/websense, and then only at the point of origin (since you have to
proxy the ssl traffic at the source). I'd be happy to be proved wrong, but I
believe, at least for now, that Skype has won the war. 

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Giorgos Manousakis
> Sent: Friday, June 19, 2009 3:28 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
> 
> Dear All,
> 
> i am trying to apply QoS on my aDsl interface (2048/256) and i need to
> give
> strict priority to voice traffic, including skype and g711.
> 
> I suppose that i can match the g711 by using nbar rtp audio protocol or
> by
> using source ports that are know on my asterisk server.
> 
> Because of randomness of skype protocol that kind of handling does not
> apply.
> I found that skype is included in nbar but only after 12.4 version.
> Unfortunately i cannot upgrade the ios of my 837 cause of lack of DRAM,
> which is not upgradable.
> So i tried to find a pdlm addon for skype, but it is not available for
> stand
> alone download (http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm).
> 
> Can i found anywhere a skype.pdlm file? Is there any other way that i
> can
> match this traffic? Could i try rtp audio for that one too?
> 
> Thanks
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4229 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090619/711ce0a2/attachment.bin>

From dudepron at gmail.com  Fri Jun 19 19:46:41 2009
From: dudepron at gmail.com (Aaron)
Date: Fri, 19 Jun 2009 19:46:41 -0400
Subject: [c-nsp] Long Uptime
In-Reply-To: <73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
Message-ID: <480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>

If it is an OOB system and it works why not?

Aaron

On Fri, Jun 19, 2009 at 10:25, Gustavo Rodrigues Ramos <
gustavo at nexthop.com.br> wrote:

> Is this suppose to be a good thing? (not patching your systems for
> almost 10 years?)...
>
> Gustavo.
>
>
> On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> > Not techy, just interesting anyone beat this uptime?
> >
> > Liverpool_St_A#sho ver
> > Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> > (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c)
> 1986-1996
> > by cisco Systems, Inc.
> > Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> > data-base: 0x00001000
> >
> > ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> > ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> > SOFTWARE (fc1)
> >
> > Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> > restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> > via flash
> >
> > cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of
> memory.
> > Processor board ID 04812778, with hardware revision 00000000 Bridging
> > software.
> > SuperLAT software copyright 1990 by Meridian Technology Corp).
> > X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> > TN3270 Emulation software (copyright 1994 by TGV Inc).
> > 1 Ethernet/IEEE 802.3 interface.
> > 2 Serial network interfaces.
> > 32K bytes of non-volatile configuration memory.
> > 8192K bytes of processor board System flash (Read ONLY)
> >
> > Configuration register is 0x2102
> >
> > Liverpool_St_A#
> >
> >
> > Thanks
> >
> > Nic
> >
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From ml at kenweb.org  Fri Jun 19 20:18:39 2009
From: ml at kenweb.org (ML)
Date: Fri, 19 Jun 2009 20:18:39 -0400
Subject: [c-nsp] Incorrect netflow data from 7600/6500?
In-Reply-To: <1245420481.6873.2.camel@localhost.localdomain>
References: <mailman.874.1245381356.2287.cisco-nsp@puck.nether.net>	<4A3B8DB1.6000009@switch.ch>
	<1245420481.6873.2.camel@localhost.localdomain>
Message-ID: <4A3C2ADF.10304@kenweb.org>

Peter Rathlev wrote:
> On Fri, 2009-06-19 at 15:08 +0200, Peter Haag wrote:
>>> I've seen this result from multiple other Netflow tools: ntop, Orion
>>> NetFlow and now nfdump.  The only common element is my hardware.
>>> I've exported flows from a 7606-SUP32 and a 6509SUP720-3B both
>>> running 12.2(18)SXF4.  Both emit the mysterious protocol 0 flows.
>>>
>>> I think I can make the assumption there isn't a protocol in use that
>>> trumps both UDP and TCP traffic combined.  Have I run into an IOS
>>> bug or did I misconfigure?
>> No - port 0 result from fragmented packets Most likely UDP packets >
>> MTU size. Since the IP ID field is not tracked in a v5 Netflow record,
>> the router can not map a fragmented packet to the appropriate flow,
>> and simply creates a flow with port '0'
> 
> Well, that would be for _port_ 0 traffic, with either TCP or UDP in the
> protocol field, wouldn't it? OPs traffic is "protocol 0", so IMHO Scotts
> point about flow mask is the best bet.
> 
> Regards,
> Peter


To provide closure to the question Scott's suggestion does work but not 
when the router is doing NAT.





From ayourtch at gmail.com  Fri Jun 19 21:09:11 2009
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Sat, 20 Jun 2009 03:09:11 +0200
Subject: [c-nsp] L2TPv3 and VLANs
In-Reply-To: <m3y6ro7h07.fsf@ursa.amorsen.dk>
References: <EC993E87D960A541A66BF21D62AA42A622FF3A30A0@exch2k7.gilat.local>
	<4A3A52B5.4090509@umn.edu> <000001c9f026$b0bb05c0$12311140$@org>
	<4A3A5E47.1080506@umn.edu>
	<Pine.LNX.4.64.0906190409500.8007@zippy.stdio.be>
	<007e01c9f087$45aebae0$d10c30a0$@org> <m3y6ro7h07.fsf@ursa.amorsen.dk>
Message-ID: <530c5af60906191809l3306da98ja6bb3f37b308fc3c@mail.gmail.com>

On Fri, Jun 19, 2009 at 10:41 AM, Benny Amorsen<benny+usenet at amorsen.dk> wrote:
> "Paul Stewart" <paul at paulstewart.org> writes:

> Generally problems with PMTU are caused by people blocking ICMP in their
> (usually PIX/ASA) firewalls. If you control the whole path, you can make
> sure that you're not one of the culprits.

For the topic of PMTUD blackhole, today evening I wrote up a little bit here:
http://supportwiki.cisco.com/wiki/index.php/PMTUD_blackhole

The aim was to get something that would not only be a collection of
links to the multipage documents, but would also give a quick summary
for the PMTUD. - and also try to view it from both the "network guy"
and "security guy" point of view - and to hopefully get the two to
talk as opposed to fight on who is "right".

Whether I achieved that - you judge. so, any comments, constructive
flames, etc. are very welcome. As it's wiki, it's obviously editable
as well.

cheers,
andrew

From cchurc05 at harris.com  Fri Jun 19 21:22:15 2009
From: cchurc05 at harris.com (Church, Charles)
Date: Fri, 19 Jun 2009 20:22:15 -0500
Subject: [c-nsp] Shaping and dialer ints 12.4(24)T vs. 15T8
Message-ID: <FA1BA229357DB640B944218F3585FECA02647AE6@mspe2k1.cs.myharris.net>

Can anyone confirm for me if some shaping and/or NBAR bugs were fixed
between 24T and older 15T7 or T8?  Platform is 870, interface is
Ethernet doing PPPoE to upstream DSL modem.  Under 15T, a policy applied
to the physical Ethernet int that looked like this:

class-map match-any Hi-Priority
 match protocol rtp
 match protocol sip
 match protocol ssh
!
policy-map Shape-Out
 class Hi-Priority
    priority 200
 class class-default
    shape average 2048000

Didn't seem to have any effect on locally-originated traffic (no matches
on SSH), nor did the shaping on class default seem to work.  End result
was traffic was sent without shaping, SSH wasn't prioritized, and remote
access to router sucked!  I figured it was just the way it worked,
figured you had to apply something to the dialer int.  But can't do GTS
on that int.  Figured I'd trying a later IOS, tried 24T, and it seems to
work fine.  Matching SSH, and the class default counters seem fine now.
Nothing appears to be needed on the dialer int after all.  Just
wondering if that's indeed the cause.

Thanks,

Chuck

From dale.shaw+cisco-nsp at gmail.com  Fri Jun 19 21:52:37 2009
From: dale.shaw+cisco-nsp at gmail.com (Dale Shaw)
Date: Sat, 20 Jun 2009 11:52:37 +1000
Subject: [c-nsp] Shaping and dialer ints 12.4(24)T vs. 15T8
In-Reply-To: <FA1BA229357DB640B944218F3585FECA02647AE6@mspe2k1.cs.myharris.net>
References: <FA1BA229357DB640B944218F3585FECA02647AE6@mspe2k1.cs.myharris.net>
Message-ID: <3329cbb40906191852n6056bdd3wa012c2a6a9bf4b9e@mail.gmail.com>

Hi Charles,

On Sat, Jun 20, 2009 at 11:22 AM, Church, Charles<cchurc05 at harris.com> wrote:
> Can anyone confirm for me if some shaping and/or NBAR bugs were fixed
> between 24T and older 15T7 or T8?

Hmm, it doesn't directly match your scenario, but there were some new
QoS features introduced in 12.4(20)T -- most notably "Hierarchical
Queuing Framework (HQF)" -- that may have had an effect on your
configuration.

http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/qos_frhqf_support.html
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6558/white_paper_c11-481499.html

I have a similar configuration to yours on my home router, but I use a
top-level shaper to introduce backpressure. Partial config follows:

policy-map aardvark-queue
 class voice-sip
  bandwidth 20
 class voice-packet
  priority 96
 class class-default
  fair-queue
  random-detect
!
policy-map aardvark-shape
 class class-default
  shape average 1177000 11770 0
  service-policy aardvark-queue
!
interface FastEthernet0/1
 pppoe enable group global
 pppoe-client dial-pool-number 1
 service-policy output aardvark-shape
!
interface Dialer1
 bandwidth 1000
 bandwidth receive 12000
 ip address negotiated
 ip mtu 1492
 dialer pool 1
 dialer idle-timeout 0
 dialer persistent
 dialer-group 1

NB: I am running 12.4(15)T9.

cheers,
Dale

From alex at digriz.org.uk  Sat Jun 20 08:50:43 2009
From: alex at digriz.org.uk (Alexander Clouter)
Date: Sat, 20 Jun 2009 13:50:43 +0100
Subject: [c-nsp] ipv4 link-local for eigrp
Message-ID: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>

Hi,

After an organisational switch refresh last year we have been 
fortunately enough to end up with surrounded by nothing but 3750 stacks 
(c3750-ipbasek9-mz.122-50.SE1.bin) at the edge of the network; the core 
is made up by a pair of 6509's (s72033-ipservicesk9-mz.122-33.SXI.bin).  
As we were overhauling the network we decided to have some fun and 
rollout L3 to the edge to obliterate spanning-tree where-ever we can.  
As Cisco boxen are a pain and don't let you have true 'hybrid' L2+L3 
links (we still have some L2 action at the edge) and assign IP addresses 
to trunk links we use 'native' VLAN's to route the L3 stuff through the 
link.

This all works great and we are happy with it, however now things are 
working, I hoping to now have a 'lessons learned' fixup of the bits that 
niggle at me.  This ties in with the IPv6 rollout we are doing over the 
next few months and I thought it's worth fixing up the IPv4 stuff at the 
same time.

The biggest issue is all the rfc1918 usage used in the /30 used to force 
the L3 routes out to the edge of the network which make traceroutes 
ugly.  I really do not want to put aside publicly routable addresses 
that are just used to pass EIGRP data around, as that would involve 
soaking up over 50 /30's, a bit of a waste.

So what to use, I am pretty keen to use link-local IPv4 addresses 
(169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
point-to-point links and they are perfect for this situation.  The 
downside is that I run into the following issues:
 1. 169.254.0.0/16 can start to appear in the distributed EIGRP listings
 2. traceroutes have 169.254.0.0/16 addresses in them
 3. 169.254.0.0/16 is pingable by edge hosts as the switch they are
        plugged into knows of at least one 169.254.0.0/16 address.
	These addresses should never escape the local subnet

Now apparently I can solve the first issue by properly fixing up the way 
we use EIGRP, possibly involving liberal use of 'ip prefix-list' 
filtering or something similar?

There is *very* little online about if the second issue can even be 
solved on Cisco kit, but I did stumble on a suggestion to use 
NAT/route-map's (that would work perfectly for us as the Loopback0 
interface on are kit is a non-rfc1918 address):

https://cisco.hosted.jivesoftware.com/message/4910

I could not get this to work, but I was only tinkering with it for a 
couple of hours.  If only IOS had a 'ip icmp source interface...' 
command :)

I do have no idea on how I could fix the third issue or if it is even 
possible.  I would have hoped the kit would have a way to say "don't 
route where the source, or dest, IP address is in this ACL list".  I 
guess I could build ACL lists and place them on all the edge switches 
and just throw these packets into oblivion, however that would not be a 
global setting, instead a messy per-vlan settings surely?

So, I'm hoping someone can make any suggestions on how I could go about 
doing this.  Suggestions on how to tackle all three issues would be 
great as I'm not 100% on that I do know how to solve the first two 
issues.  Has anyone else done or heard of anyone using local-link 
addresses for routing between...erm...routers and then fixed the ICMP 
issue.

Even if the advice is "well if you had xy software you could do z".

Thanks in advance for any clue you can impart onto me.

Cheers

-- 
Alexander Clouter
.sigmonster says: The life of a repo man is always intense.


From gert at greenie.muc.de  Sat Jun 20 11:49:53 2009
From: gert at greenie.muc.de (Gert Doering)
Date: Sat, 20 Jun 2009 17:49:53 +0200
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
Message-ID: <20090620154953.GM290@greenie.muc.de>

Hi,

On Sat, Jun 20, 2009 at 01:50:43PM +0100, Alexander Clouter wrote:
> The biggest issue is all the rfc1918 usage used in the /30 used to force 
> the L3 routes out to the edge of the network which make traceroutes 
> ugly.  I really do not want to put aside publicly routable addresses 
> that are just used to pass EIGRP data around, as that would involve 
> soaking up over 50 /30's, a bit of a waste.
> 
> So what to use, I am pretty keen to use link-local IPv4 addresses 
> (169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
> point-to-point links and they are perfect for this situation.  

Using 169.254.x addresses is no better or worse than RFC1918 addresses.

Just don't go there.  If your routers are going to source packets from
those addresses (traceroute responses or - much worse! - ICMP packet too
big messages), use public addresses.  That's what they are there for.

On non-ethernet point-to-point links, you could use "ip unnumbered"...

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 304 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/cisco-nsp/attachments/20090620/dfbe0045/attachment.bin>

From alex at digriz.org.uk  Sat Jun 20 11:19:24 2009
From: alex at digriz.org.uk (Alexander Clouter)
Date: Sat, 20 Jun 2009 16:19:24 +0100
Subject: [c-nsp] ipv4 link-local for eigrp
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
Message-ID: <s8bvg6-951.ln1@woodchuck.wormnet.eu>

Alexander Clouter <alex at digriz.org.uk> wrote:
> 
> [snipped]
> 
> So what to use, I am pretty keen to use link-local IPv4 addresses 
> (169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
> point-to-point links and they are perfect for this situation.  The 
> downside is that I run into the following issues:
> 1. 169.254.0.0/16 can start to appear in the distributed EIGRP listings
> 2. traceroutes have 169.254.0.0/16 addresses in them
> 3. 169.254.0.0/16 is pingable by edge hosts as the switch they are
>        plugged into knows of at least one 169.254.0.0/16 address.
>        These addresses should never escape the local subnet
> 
I see in the archives the first two points have been lightly touched 
upon before, with prefix-list filterings and some NAT.  Of course I'm 
interested in other possible solutions or sound advice.

Cheers

-- 
Alexander Clouter
.sigmonster says: <Manoj> I *like* the chicken


From dcp at dcptech.com  Sat Jun 20 12:32:59 2009
From: dcp at dcptech.com (David Prall)
Date: Sat, 20 Jun 2009 12:32:59 -0400
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <s8bvg6-951.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
	<s8bvg6-951.ln1@woodchuck.wormnet.eu>
Message-ID: <000901c9f1c4$de71be10$9b553a30$@com>

Use public addresses on the links and use outbound distribute-lists to stop
the propagation of point-to-point links. Traceroute will continue to work,
unless you use uRPF. 

David

--
http://dcp.dcptech.com
 
> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Alexander Clouter
> Sent: Saturday, June 20, 2009 11:19 AM
> To: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] ipv4 link-local for eigrp
> 
> Alexander Clouter <alex at digriz.org.uk> wrote:
> >
> > [snipped]
> >
> > So what to use, I am pretty keen to use link-local IPv4 addresses
> > (169.254.0.0/16) much like I plan to for IPv6 to build up the L3
> > point-to-point links and they are perfect for this situation.  The
> > downside is that I run into the following issues:
> > 1. 169.254.0.0/16 can start to appear in the distributed EIGRP
> listings
> > 2. traceroutes have 169.254.0.0/16 addresses in them
> > 3. 169.254.0.0/16 is pingable by edge hosts as the switch they are
> >        plugged into knows of at least one 169.254.0.0/16 address.
> >        These addresses should never escape the local subnet
> >
> I see in the archives the first two points have been lightly touched
> upon before, with prefix-list filterings and some NAT.  Of course I'm
> interested in other possible solutions or sound advice.
> 
> Cheers
> 
> --
> Alexander Clouter
> .sigmonster says: <Manoj> I *like* the chicken
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From ip at ioshints.info  Sat Jun 20 13:00:57 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Sat, 20 Jun 2009 19:00:57 +0200
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
Message-ID: <004a01c9f1c8$aef42980$0a00000a@nil.si>

You could use unnumbered Ethernet VLAN subinterfaces assuming your IOS
release supports them (or you could get your gear upgraded to a release that
does ... I am utterly confused when faced with Catalyst IOS releases):

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtunvlan.html

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/

> -----Original Message-----
> From: Alexander Clouter [mailto:alex at digriz.org.uk] 
> Sent: Saturday, June 20, 2009 2:51 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] ipv4 link-local for eigrp
> 
> Hi,
> 
> After an organisational switch refresh last year we have been 
> fortunately enough to end up with surrounded by nothing but 
> 3750 stacks
> (c3750-ipbasek9-mz.122-50.SE1.bin) at the edge of the 
> network; the core is made up by a pair of 6509's 
> (s72033-ipservicesk9-mz.122-33.SXI.bin).  

[...]

> The biggest issue is all the rfc1918 usage used in the /30 
> used to force the L3 routes out to the edge of the network 
> which make traceroutes ugly.  I really do not want to put 
> aside publicly routable addresses that are just used to pass 
> EIGRP data around, as that would involve soaking up over 50 
> /30's, a bit of a waste.
> 
> So what to use, I am pretty keen to use link-local IPv4 addresses
> (169.254.0.0/16) much like I plan to for IPv6 to build up the 
> L3 point-to-point links and they are perfect for this 
> situation.  The downside is that I run into the following issues:
>  1. 169.254.0.0/16 can start to appear in the distributed 
> EIGRP listings  2. traceroutes have 169.254.0.0/16 addresses 
> in them  3. 169.254.0.0/16 is pingable by edge hosts as the 
> switch they are
>         plugged into knows of at least one 169.254.0.0/16 address.
> 	These addresses should never escape the local subnet
> 
> Now apparently I can solve the first issue by properly fixing 
> up the way we use EIGRP, possibly involving liberal use of 
> 'ip prefix-list' 
> filtering or something similar?
> 
> There is *very* little online about if the second issue can 
> even be solved on Cisco kit, but I did stumble on a 
> suggestion to use NAT/route-map's (that would work perfectly 
> for us as the Loopback0 interface on are kit is a non-rfc1918 
> address):
> 
> https://cisco.hosted.jivesoftware.com/message/4910
> 
> I could not get this to work, but I was only tinkering with 
> it for a couple of hours.  If only IOS had a 'ip icmp source 
> interface...' 
> command :)


From alex at digriz.org.uk  Sat Jun 20 12:32:13 2009
From: alex at digriz.org.uk (Alexander Clouter)
Date: Sat, 20 Jun 2009 17:32:13 +0100
Subject: [c-nsp] ipv4 link-local for eigrp
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
	<20090620154953.GM290@greenie.muc.de>
Message-ID: <dhfvg6-nf1.ln1@woodchuck.wormnet.eu>

Gert Doering <gert at greenie.muc.de> wrote:
> 
> Hi,
> 
> On Sat, Jun 20, 2009 at 01:50:43PM +0100, Alexander Clouter wrote:
>> The biggest issue is all the rfc1918 usage used in the /30 used to force 
>> the L3 routes out to the edge of the network which make traceroutes 
>> ugly.  I really do not want to put aside publicly routable addresses 
>> that are just used to pass EIGRP data around, as that would involve 
>> soaking up over 50 /30's, a bit of a waste.
>> 
>> So what to use, I am pretty keen to use link-local IPv4 addresses 
>> (169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
>> point-to-point links and they are perfect for this situation.  
> 
> Using 169.254.x addresses is no better or worse than RFC1918 addresses.
>
Well yes, I agree but...
 
> Just don't go there.  If your routers are going to source packets from
> those addresses (traceroute responses or - much worse! - ICMP packet too
> big messages), use public addresses.  That's what they are there for.
> 
I just don't want to burn public routable addresses on point-to-point 
links needlessly when there is a perfectly good routable address on 
Loopback0.  These link are there just to steer traffic down and 
distribute routing tables, the kit should not be responding with these 
addresses for anything...I don't want them to.

I was hoping someone knew of some cunningness and/or magic trick I could 
call upon?

> On non-ethernet point-to-point links, you could use "ip unnumbered"...
> 
Alas, it's all Ethernet here.

Cheers

-- 
Alexander Clouter
.sigmonster says: To err is human, but I can REALLY foul things up.


From lukasz at bromirski.net  Sat Jun 20 14:19:29 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sat, 20 Jun 2009 20:19:29 +0200
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <dhfvg6-nf1.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>	<20090620154953.GM290@greenie.muc.de>
	<dhfvg6-nf1.ln1@woodchuck.wormnet.eu>
Message-ID: <4A3D2831.2030801@bromirski.net>

On 2009-06-20 18:32, Alexander Clouter wrote:

> I just don't want to burn public routable addresses on point-to-point
> links needlessly when there is a perfectly good routable address on
> Loopback0.

You can easily run /31 on p2p links instead of /30.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From roger.wiklund at gmail.com  Sat Jun 20 16:42:54 2009
From: roger.wiklund at gmail.com (Roger Wiklund)
Date: Sat, 20 Jun 2009 22:42:54 +0200
Subject: [c-nsp] BGP Load balance for the uplink
In-Reply-To: <4A3A6C27.1030502@gmail.com>
References: <4A3A6C27.1030502@gmail.com>
Message-ID: <c960e2120906201342h104bb19dqff0d7438fd7c4638@mail.gmail.com>

How about just using
maximum-path x, and then do some route maps forcing only
some traffic to only use the faster link unless its down. Then you can
loadbalance on evetyhing else but the specific traffic. Then you might
get a more even utilization of the links.

Or perhaps if you can try the disable-connected-check, but it probably wont
work with dmzlink-bw

Regards
Roger

On Thu, Jun 18, 2009 at 6:32 PM, Georgi Genov <linuxloader at gmail.com> wrote:

>
>
> Here is my scenario , i have 2 uplink providers , one with 2 backup
> sessions on two different vlans with 2x /30 ip addr and other with multihop
> bgp .First provider with the 2 sessions i have 2:1 speed compare against the
> second . I advertise at the both providers same prefix lists . ( 2x /18 and
> one /24 ) . dmzlink-bw is one solution , but it didn`t work at multihop bgp
> . Some other suggestions .
>
> PS: Ruter is RSP720-3CXL-GE with Cisco IOS Software, c7600rsp72043_rp
> Software (c7600rsp72043_rp-ADVIPSERVICES-M), Version 12.2(33)SRB5a, RELEASE
> SOFTWARE (fc1)
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>

From copse at xy.org  Sat Jun 20 16:43:58 2009
From: copse at xy.org (Roger Wiklund)
Date: Sat, 20 Jun 2009 22:43:58 +0200
Subject: [c-nsp] BGP Load balance for the uplink
In-Reply-To: <c960e2120906201342h104bb19dqff0d7438fd7c4638@mail.gmail.com>
References: <4A3A6C27.1030502@gmail.com>
	<c960e2120906201342h104bb19dqff0d7438fd7c4638@mail.gmail.com>
Message-ID: <c960e2120906201343w2f203f5dt1142dc1f027f4d3e@mail.gmail.com>

How about just using
maximum-path x, and then do some route maps forcing only
some traffic to only use the faster link unless its down. Then you can
loadbalance on evetyhing else but the specific traffic. Then you might
get a more even utilization of the links.

Or perhaps if you can try the disable-connected-check, but it probably wont
work with dmzlink-bw

Regards
Roger

On Sat, Jun 20, 2009 at 10:42 PM, Roger Wiklund <roger.wiklund at gmail.com>wrote:

> How about just using
> maximum-path x, and then do some route maps forcing only
> some traffic to only use the faster link unless its down. Then you can
> loadbalance on evetyhing else but the specific traffic. Then you might
> get a more even utilization of the links.
>
> Or perhaps if you can try the disable-connected-check, but it probably wont
> work with dmzlink-bw
>
> Regards
> Roger
>
> On Thu, Jun 18, 2009 at 6:32 PM, Georgi Genov <linuxloader at gmail.com>wrote:
>
>>
>>
>> Here is my scenario , i have 2 uplink providers , one with 2 backup
>> sessions on two different vlans with 2x /30 ip addr and other with multihop
>> bgp .First provider with the 2 sessions i have 2:1 speed compare against the
>> second . I advertise at the both providers same prefix lists . ( 2x /18 and
>> one /24 ) . dmzlink-bw is one solution , but it didn`t work at multihop bgp
>> . Some other suggestions .
>>
>> PS: Ruter is RSP720-3CXL-GE with Cisco IOS Software, c7600rsp72043_rp
>> Software (c7600rsp72043_rp-ADVIPSERVICES-M), Version 12.2(33)SRB5a, RELEASE
>> SOFTWARE (fc1)
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
>

From rekordmeister at gmail.com  Sat Jun 20 17:44:22 2009
From: rekordmeister at gmail.com (MKS)
Date: Sat, 20 Jun 2009 21:44:22 +0000
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <fad2fb270906201444m26b4652u85a5128fd5d71c69@mail.gmail.com>

>I see in your original post you mentioned netflow - you will probably
>want to have a look through the archives for the (many, long) threads
>where people document their problems with netflow on this platform.
>Specifically, like the FIB, the DFCs have limited TCAM slots for netflow
>entries (256k/1M on non-XL/XL) and you can over-run this TCAM if you
>have a lot of traffic.
>
>If the netflow is important to you, and you're likely to have >1M flows
>at any given time, you might want to consider alternatives.

What alternatives are out there for a similar amount of money?

Regards
MKS

From lists at memetic.org  Sat Jun 20 17:54:03 2009
From: lists at memetic.org (Adam Armstrong)
Date: Sat, 20 Jun 2009 22:54:03 +0100
Subject: [c-nsp] ipv4 link-local for eigrp
In-Reply-To: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
References: <3i2vg6-1j.ln1@woodchuck.wormnet.eu>
Message-ID: <4A3D5A7B.6050506@memetic.org>

Alexander Clouter wrote:
> Hi,
>
>
> The biggest issue is all the rfc1918 usage used in the /30 used to force 
> the L3 routes out to the edge of the network which make traceroutes 
> ugly.  I really do not want to put aside publicly routable addresses 
> that are just used to pass EIGRP data around, as that would involve 
> soaking up over 50 /30's, a bit of a waste.
>
> So what to use, I am pretty keen to use link-local IPv4 addresses 
> (169.254.0.0/16) much like I plan to for IPv6 to build up the L3 
> point-to-point links and they are perfect for this situation.  The 
> downside is that I run into the following issues:
>  1. 169.254.0.0/16 can start to appear in the distributed EIGRP listings
>  2. traceroutes have 169.254.0.0/16 addresses in them
>  3. 169.254.0.0/16 is pingable by edge hosts as the switch they are
>         plugged into knows of at least one 169.254.0.0/16 address.
> 	These addresses should never escape the local subnet
>   
Using rfc addressing space for links that internet traffic traverse is a 
little bit filthy, imo. It makes a mess of traceroute and potentially 
sources traffic onto the internet from those addresses (which, 
hopefully, is subsequently dropped by filters/urpf).

If you're really worried about an wasting a couple of addresses, switch 
all of your links to /31s and bask in the knowledge that you've done 
more than most.

We've just migrated all of our linknets from 10/8 space to publicly 
addressable space, partly because i believe "it's the right thing to do" 
and partly because it irritated customers.

IMO, using RFC space gives you no benefits, other than having saved a 
few addresses (it does not give *you* more addresses, it saves teh world 
some addresses). It does, however, have a number of drawbacks.

adam.

From amolsapkal at gmail.com  Sat Jun 20 18:46:48 2009
From: amolsapkal at gmail.com (Amol Sapkal)
Date: Sun, 21 Jun 2009 02:46:48 +0400
Subject: [c-nsp] PoE switches and biometric devices (strange behaviour)
Message-ID: <ef4028ae0906201546x5d101c87tab76dba72129bf98@mail.gmail.com>

Hi all,

Here is the setup:
I have a PoE switch, which is connected to 2 other PoE switches.
All switches are cat 3560 switches (WS-C3560G-48PS)
Biometric devices (Finger-printers) connect on to one port of each downlink
switches (there are 2 downlink switches)
I have disabled inline power on all the ports of these 3 switches, as there
are no PoE devices connected
The uplink cables for the downlink switches are CAT6 and under 20m.
All access ports are marked as portfast (including the biometric device's
port)
IOS: 12.2(35)SE5 (IP Services)

Before the inline power was disabled, one of the switches displayed an
inline power error for the biometric device's port, which on further checks
with cisco.com, pointed to the bug CSCeb24148 (related to Electro-static
Discharge). Since then, I have upgraded the IOS, as per the recommendations.

The problem:
Before inline power was disabled, the biometric device port went down,
without any logs (apart from the inline power error, which was generated
only once in multiple port checks).  Also, the reliability of the port goes
down to 254/255. After the IOS upgrade, the switch no longer throws up the
inline power issue. As a precaution, I disabled inline power on all ports
using the 'power inline never' command.

Still, the biometric device disconnected.

Post that, the following was done:
Cabling was changed/verified
Trunking was disabled (as this was a cascade environment with no vlans, it
did not make any difference - all 3 switches belong to a single broadcast
domain)
Various duplex/speed combinations were tested
Non-PoE switches were tested in standalone modes, and they did not
disconnect the biometric device.
 Non-PoE switches were tested in standalone modes, and in the same cabling
closet and they did not disconnect the biometric device (to verify static
charges issues)
When cascaded with PoE switches, the non-PoE switched disconnected the
biometric device!
The switches were configured to NOT errdisable a port on detecting a
loopback

None of the above helped.

Now, I get the following logs on the non-PoE switch (3560), before the
biometric device's port disconnects:

04:19:26: ILP Start PHY Cisco IP phone detection ( Fa0/48 ) Okay
04:19:27: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/48,
changed state to down
04:19:28: %LINK-3-UPDOWN: Interface FastEthernet0/48, changed state to down

I fail to understand as to why the non-PoE switch is trying to detect a
cisco IP phone, on a port to which the biometric device connects (port
fa0/48). This is inspite the fact that the uplink switch has been configured
to disable inline power on all ports, including the downlink port. Even, the
other downlink switch is configured to disable inline power.

Question: Can anyone kindly help me to understand the above behaviour?
Question 2: How can I disable the detection of the Cisco IP phone on any
PoE/non-PoE switch?

Another thing that I am unable to figure out is the possibility of static
charge generation in the cabling closet.


-- 
Warm regards,

Amol Sapkal

-------------------------------------------------------------------
"When I'm not in my right mind, my left mind
gets pretty crowded"
-------------------------------------------------------------------

From lukasz at bromirski.net  Sun Jun 21 02:50:32 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sun, 21 Jun 2009 08:50:32 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <fad2fb270906201444m26b4652u85a5128fd5d71c69@mail.gmail.com>
References: <fad2fb270906201444m26b4652u85a5128fd5d71c69@mail.gmail.com>
Message-ID: <4A3DD838.5000405@bromirski.net>

On 2009-06-20 23:44, MKS wrote:

> What alternatives are out there for a similar amount of money?

For example ASR 1k with RP1 or RP2 end properly sized ESP. Look for the
cisco.com site for details.

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From lukasz at bromirski.net  Sun Jun 21 02:58:45 2009
From: lukasz at bromirski.net (=?UTF-8?B?xYF1a2FzeiBCcm9taXJza2k=?=)
Date: Sun, 21 Jun 2009 08:58:45 +0200
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
In-Reply-To: <4A3BC04D.3090008@imperial.ac.uk>
References: <43692.69.30.17.85.1245423295.squirrel@www.woofpaws.com>	<000001c9f0f3$1defbe20$59cf3a60$@org>	<44498.69.30.17.85.1245429145.squirrel@www.woofpaws.com>
	<4A3BC04D.3090008@imperial.ac.uk>
Message-ID: <4A3DDA25.5050407@bromirski.net>

On 2009-06-19 18:43, Phil Mayers wrote:

> I see in your original post you mentioned netflow - you will probably
> want to have a look through the archives for the (many, long) threads
> where people document their problems with netflow on this platform.
> Specifically, like the FIB, the DFCs have limited TCAM slots for netflow
> entries (256k/1M on non-XL/XL) and you can over-run this TCAM if you
> have a lot of traffic.

Correction: NetFlow entries are 128k on non-XL and 256k on XL PFCs/DFCs.
However, it's worth to note, that if the chassis is equipped with
DFCs, the collection of NetFlow entries happens independently - so,
theoretically, each of DFC-equipped LCs could go up to 128k if that
would be DFC3B/C, or up to 256k for DFC3BXL/3CXL.

http://cisco.com/en/US/prod/collateral/switches/ps5718/ps708/product_data_sheet09186a0080159856.html

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net

From zivl at gilat.net  Sun Jun 21 03:37:05 2009
From: zivl at gilat.net (Ziv Leyes)
Date: Sun, 21 Jun 2009 10:37:05 +0300
Subject: [c-nsp] Long Uptime
In-Reply-To: <480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>
	<480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>
Message-ID: <EC993E87D960A541A66BF21D62AA42A623012385CA@exch2k7.gilat.local>

I second that, besides, back then, there were not so many bugs as today, as with every new feature and more complex technology comes also a lot of bugs.
When systems were simpler, there were less problems, how many times do you remember having to hard reset your PC when using DOS 6.2 because it "hanged" and nothing else could be done?? 
Also, the exploits that might be there on such an old device are SO old that nobody will think to try, is like to try to find a computer with "Netbus" Trojan open for you to just hack in... heheh






-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Aaron
Sent: Saturday, June 20, 2009 2:47 AM
To: Gustavo Rodrigues Ramos
Cc: Nic McCartney; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Long Uptime

If it is an OOB system and it works why not?

Aaron

On Fri, Jun 19, 2009 at 10:25, Gustavo Rodrigues Ramos <
gustavo at nexthop.com.br> wrote:

> Is this suppose to be a good thing? (not patching your systems for
> almost 10 years?)...
>
> Gustavo.
>
>
> On Fri, Jun 19, 2009 at 10:22 AM, Nic McCartney<nic at gblx.net> wrote:
> > Not techy, just interesting anyone beat this uptime?
> >
> > Liverpool_St_A#sho ver
> > Cisco Internetwork Operating System Software IOS (tm) 3000 Software
> > (IGS-J-L), Version 11.0(13), RELEASE SOFTWARE (fc1) Copyright (c)
> 1986-1996
> > by cisco Systems, Inc.
> > Compiled Mon 09-Dec-96 19:48 by athavale Image text-base: 0x030348D8,
> > data-base: 0x00001000
> >
> > ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
> > ROM: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE
> > SOFTWARE (fc1)
> >
> > Liverpool_St_A uptime is 529 weeks, 3 days, 9 hours, 2 minutes System
> > restarted by power-on System image file is "flash:igs-j-l.110-13", booted
> > via flash
> >
> > cisco 2500 (68030) processor (revision F) with 4096K/2048K bytes of
> memory.
> > Processor board ID 04812778, with hardware revision 00000000 Bridging
> > software.
> > SuperLAT software copyright 1990 by Meridian Technology Corp).
> > X.25 software, Version 2.0, NET2, BFE and GOSIP compliant.
> > TN3270 Emulation software (copyright 1994 by TGV Inc).
> > 1 Ethernet/IEEE 802.3 interface.
> > 2 Serial network interfaces.
> > 32K bytes of non-volatile configuration memory.
> > 8192K bytes of processor board System flash (Read ONLY)
> >
> > Configuration register is 0x2102
> >
> > Liverpool_St_A#
> >
> >
> > Thanks
> >
> > Nic
> >
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


 
 
************************************************************************************
This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses.
************************************************************************************


From p.mayers at imperial.ac.uk  Sun Jun 21 04:13:59 2009
From: p.mayers at imperial.ac.uk (Phil Mayers)
Date: Sun, 21 Jun 2009 09:13:59 +0100
Subject: [c-nsp] Sup720 vs RSP720 - Difference?
Message-ID: <b3tMhzlyZxTR.PskfzRhB@smtp.cc.ic.ac.uk>

Oops. Yes of course, thanks for that! The point about distributed netflow is a good one - we'd certainly exceed the tcam limits without it

-original message-
Subject: Re: [c-nsp] Sup720 vs RSP720 - Difference?
From: ?ukasz Bromirski <lukasz at bromirski.net>
Date: 21/06/2009 07:58

On 2009-06-19 18:43, Phil Mayers wrote:

> I see in your original post you mentioned netflow - you will probably
> want to have a look through the archives for the (many, long) threads
> where people document their problems with netflow on this platform.
> Specifically, like the FIB, the DFCs have limited TCAM slots for netflow
> entries (256k/1M on non-XL/XL) and you can over-run this TCAM if you
> have a lot of traffic.

Correction: NetFlow entries are 128k on non-XL and 256k on XL PFCs/DFCs.
However, it's worth to note, that if the chassis is equipped with
DFCs, the collection of NetFlow entries happens independently - so,
theoretically, each of DFC-equipped LCs could go up to 128k if that
would be DFC3B/C, or up to 256k for DFC3BXL/3CXL.

http://cisco.com/en/US/prod/collateral/switches/ps5718/ps708/product_data_sheet09186a0080159856.html

-- 
"Everything will be okay in the end. |                  ?ukasz Bromirski
  If it's not okay, it's not the end. |       http://lukasz.bromirski.net


From eng_mssk at hotmail.com  Sun Jun 21 04:14:27 2009
From: eng_mssk at hotmail.com (Mohammad Khalil)
Date: Sun, 21 Jun 2009 11:14:27 +0300
Subject: [c-nsp] OSPF
Message-ID: <BLU102-W18CAFFFFF111606A7458DAFA380@phx.gbl>


hey all 
i have ring of 11 routers and i have access routers connected to these core routers
if i have for example a device (name it x) connected directly to core 2 and the access number 1 is connected directly to core 2 
if the link is failed between the device x and core 2 
how much time will need access 1 to reach the device x across the ring ??
the network is based on OSPF

Thanks



_________________________________________________________________
Drag n? drop?Get easy photo sharing with Windows Live? Photos.

http://www.microsoft.com/windows/windowslive/products/photos.aspx

From george at mang.gr  Sun Jun 21 06:51:34 2009
From: george at mang.gr (Giorgos Manousakis)
Date: Sun, 21 Jun 2009 13:51:34 +0300
Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
In-Reply-To: <483E6B0272B0284BA86D7596C40D29F9C381C1434E@PUR-EXCH07.ox.com>
Message-ID: <20090621105141.437A82FF06@geomanous.awmn>

Thanks for the reply,

Still there must be a way to prioritize (or block) skype traffic. In my
scenario just because of the small uplink bandwidth I need to give it
priority. 
I tried a packet capture on my pc and random ports were used. 
But maybe I can give priority to traffic destined to Level 3
communications... if I can define any prefixes on that... 

Can I download (from anywhere) skype nbar pdlm to give a shot? I cannot find
it.

BR

-----Original Message-----
From: Matthew Huff [mailto:mhuff at ox.com] 
Sent: Friday, June 19, 2009 10:58 PM
To: 'Giorgos Manousakis'; 'cisco-nsp at puck.nether.net'
Subject: RE: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2

Even with the newest Skype nbar pdlm or built-in nbar in 12.4T(x), it is
pretty useless. The majority of Skype traffic is sent now encrypted over
port 443. The only way I know to monitor/block it is with something like
bluecoat/websense, and then only at the point of origin (since you have to
proxy the ssl traffic at the source). I'd be happy to be proved wrong, but I
believe, at least for now, that Skype has won the war. 

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Giorgos Manousakis
> Sent: Friday, June 19, 2009 3:28 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
> 
> Dear All,
> 
> i am trying to apply QoS on my aDsl interface (2048/256) and i need to
> give
> strict priority to voice traffic, including skype and g711.
> 
> I suppose that i can match the g711 by using nbar rtp audio protocol or
> by
> using source ports that are know on my asterisk server.
> 
> Because of randomness of skype protocol that kind of handling does not
> apply.
> I found that skype is included in nbar but only after 12.4 version.
> Unfortunately i cannot upgrade the ios of my 837 cause of lack of DRAM,
> which is not upgradable.
> So i tried to find a pdlm addon for skype, but it is not available for
> stand
> alone download (http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm).
> 
> Can i found anywhere a skype.pdlm file? Is there any other way that i
> can
> match this traffic? Could i try rtp audio for that one too?
> 
> Thanks
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From drrtuy at ya.ru  Sun Jun 21 07:59:26 2009
From: drrtuy at ya.ru (Roman A. Nozdrin)
Date: Sun, 21 Jun 2009 14:59:26 +0300
Subject: [c-nsp] OSPF
In-Reply-To: <BLU102-W18CAFFFFF111606A7458DAFA380@phx.gbl>
References: <BLU102-W18CAFFFFF111606A7458DAFA380@phx.gbl>
Message-ID: <4A3E209E.2060502@ya.ru>

Hello.

> i have ring of 11 routers and i have access routers connected to these core routers
> if i have for example a device (name it x) connected directly to core 2 and the access number 1 is connected directly to core 2 
> if the link is failed between the device x and core 2 
> how much time will need access 1 to reach the device x across the ring ??
> the network is based on OSPF

Are you talking about OSPF reconverge time it the situation? If you are, 
  the answer is 4 x OSPF hello timer configured on interfaces.( by 
default: 40 secs for  broadcast-multiaccess and point-to-point and 120 
secs for NBMA links).

WBR
Roman A. Nozdrin

From rinse.kloek at isp.solcon.nl  Sun Jun 21 08:19:16 2009
From: rinse.kloek at isp.solcon.nl (Rinse Kloek)
Date: Sun, 21 Jun 2009 14:19:16 +0200
Subject: [c-nsp] ETSI Rack mounts for 4500
In-Reply-To: <91dee5fc0906200524l22d6c5d2gdf358306e67e7eec@mail.gmail.com>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>	
	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>	
	<4A3BA55C.6070101@isp.solcon.nl>
	<91dee5fc0906200524l22d6c5d2gdf358306e67e7eec@mail.gmail.com>
Message-ID: <4A3E2544.3020305@isp.solcon.nl>

Those ETSI racks are about 20.5 inch width (From mounting hole to 
mounting  hole). So the 23 inch convertors won't fit.

Rinse


Jeremy Parr schreef:
> You can purchase generic rack extenders for 23" racks at racksolutions.com
>
> On 6/19/09, Rinse Kloek <rinse.kloek at isp.solcon.nl> wrote:
>   
>> All,
>>
>> I am looking for some ERSI Rack mount ears to place some Cisco 4506's in
>> special Telco cabinets. The cabinets are 1,5 inch wider than the normal
>> 19 inch cabinets.
>> Does Cisco have these rack ears ?
>>
>> regards,
>> Rinse
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>     
>
>   

From ip at ioshints.info  Sun Jun 21 08:19:23 2009
From: ip at ioshints.info (Ivan Pepelnjak)
Date: Sun, 21 Jun 2009 14:19:23 +0200
Subject: [c-nsp] OSPF
In-Reply-To: <4A3E209E.2060502@ya.ru>
References: <BLU102-W18CAFFFFF111606A7458DAFA380@phx.gbl>
	<4A3E209E.2060502@ya.ru>
Message-ID: <000e01c9f26a$8421e9c0$0a00000a@nil.si>

> Are you talking about OSPF reconverge time it the situation? 
> If you are,
>   the answer is 4 x OSPF hello timer configured on interfaces.( by
> default: 40 secs for  broadcast-multiaccess and 
> point-to-point and 120 secs for NBMA links).

Plus (worst case) the LSA origination timer (default: 5 seconds) + LSA
flooding timer + SPF interval (which could be exponential, default maximum
value is 10 seconds). In most cases, unless you've tuned your network, you
can add a few seconds to the hello timers calculation due to initial SPF
delay (default: 5 seconds)

Ivan
 
http://www.ioshints.info/about
http://blog.ioshints.info/


From oboehmer at cisco.com  Sun Jun 21 09:47:27 2009
From: oboehmer at cisco.com (Oliver Boehmer (oboehmer))
Date: Sun, 21 Jun 2009 15:47:27 +0200
Subject: [c-nsp] OSPF LSA timers
In-Reply-To: <OF603BD14F.B6929832-ONCC2575C9.0020532A-CC2575C9.0021EB3B@nz1.ibm.com>
References: <OF603BD14F.B6929832-ONCC2575C9.0020532A-CC2575C9.0021EB3B@nz1.ibm.com>
Message-ID: <70B7A1CCBFA5C649BD562B6D9F7ED7840789F869@xmb-ams-333.emea.cisco.com>

Raymond Lucas <> wrote on Tuesday, June 02, 2009 08:10:

> Hi,
> 
> I have been gradually rolling out OSPF across a network including the
> following bit of config:
> 
> router ospf 172
>  ispf
>  timers throttle lsa all 10 100 5000
>  timers lsa arrival 80
> 
> Which was fine until I arrived at a couple of 6506s with SUP2/MSFC2
> running 12.2(17d)SXB9 which don't support those commands.  Seems they
were
> only introduced in 12.2(18)SXF according to Software Advisor.
> 
> We can't upgrade to 12.2(18)SXF due to a lack of memory on the switch
> processors.  I'm not too worried by the "ispf" business, but I have a
> bad feeling about having a couple of devices different from their
> neighbours with the LSA stuff.  To really up the nerves, these 6506s
> are are part of the core.  I can imagine it working well most of the
> time but then failing badly when the pressure is on.
> 
> So I guess my questions are:
> 
> - Am I right to be worried, or will things work fine if I miss these
> commands from these devices?

It'll work most of the time, until you run into situation where you need
to issue more than one LSA update per second (for the very same LSA id).
As the other devices will ignore the 2nd LSA update, you'll have to
retransmit and convergence will be delayed.

> - Since these timers can only be set on a per device basis, as
> opposed to per interface, is there an elegant way to deal with this
> scenario? Obviously I would not be keen to remove the modified timers
> from the rest of the network!

Well, if you really need these timers to meet your convergence targets,
you're out of luck and need to upgrade the devices. I would argue,
however, that you'll be able to get away with less aggressive LSA update
timers (i.e. timers throttle lsa update 10 1000 5000) in most scenarios.
Tuning SPF timers is usually more important..

	oli

From ploopster at gmail.com  Sun Jun 21 13:19:58 2009
From: ploopster at gmail.com (Sridhar Ayengar)
Date: Sun, 21 Jun 2009 13:19:58 -0400
Subject: [c-nsp] Long Uptime
In-Reply-To: <EC993E87D960A541A66BF21D62AA42A623012385CA@exch2k7.gilat.local>
References: <018201c9f0e0$f65e3740$e31aa5c0$@net>	<73d1f88a0906190725q440718b5kacb829140f0c6a83@mail.gmail.com>	<480dad640906191646v32ba8f92uaa5a9b63747823d9@mail.gmail.com>
	<EC993E87D960A541A66BF21D62AA42A623012385CA@exch2k7.gilat.local>
Message-ID: <4A3E6BBE.4090401@gmail.com>

Ziv Leyes wrote:
> I second that, besides, back then, there were not so many bugs as today, as with every new feature and more complex technology comes also a lot of bugs.
> When systems were simpler, there were less problems, how many times do you remember having to hard reset your PC when using DOS 6.2 because it "hanged" and nothing else could be done?? 
> Also, the exploits that might be there on such an old device are SO old that nobody will think to try, is like to try to find a computer with "Netbus" Trojan open for you to just hack in... heheh

Besides that, there are operating systems that can be updated without a 
reboot.

Peace...  Sridhar

From mhuff at ox.com  Sun Jun 21 16:47:11 2009
From: mhuff at ox.com (Matthew Huff)
Date: Sun, 21 Jun 2009 16:47:11 -0400
Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
In-Reply-To: <20090621105141.437A82FF06@geomanous.awmn>
References: <483E6B0272B0284BA86D7596C40D29F9C381C1434E@PUR-EXCH07.ox.com>
	<20090621105141.437A82FF06@geomanous.awmn>
Message-ID: <483E6B0272B0284BA86D7596C40D29F9C381C14352@PUR-EXCH07.ox.com>

I'm afraid you are out of look. In order to get skype 3.0 into IOS, Cisco had to leave behind PDLM and hard code it. Even then it's pretty useless. Only solution is to get to 12.4(22)T+



----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com? | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139

-----Original Message-----
From: Giorgos Manousakis [mailto:george at mang.gr] 
Sent: Sunday, June 21, 2009 6:52 AM
To: Matthew Huff; cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2

Thanks for the reply,

Still there must be a way to prioritize (or block) skype traffic. In my
scenario just because of the small uplink bandwidth I need to give it
priority. 
I tried a packet capture on my pc and random ports were used. 
But maybe I can give priority to traffic destined to Level 3
communications... if I can define any prefixes on that... 

Can I download (from anywhere) skype nbar pdlm to give a shot? I cannot find
it.

BR

-----Original Message-----
From: Matthew Huff [mailto:mhuff at ox.com] 
Sent: Friday, June 19, 2009 10:58 PM
To: 'Giorgos Manousakis'; 'cisco-nsp at puck.nether.net'
Subject: RE: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2

Even with the newest Skype nbar pdlm or built-in nbar in 12.4T(x), it is
pretty useless. The majority of Skype traffic is sent now encrypted over
port 443. The only way I know to monitor/block it is with something like
bluecoat/websense, and then only at the point of origin (since you have to
proxy the ssl traffic at the source). I'd be happy to be proved wrong, but I
believe, at least for now, that Skype has won the war. 

----
Matthew Huff?????? | One Manhattanville Rd
OTA Management LLC | Purchase, NY 10577
http://www.ox.com  | Phone: 914-460-4039
aim: matthewbhuff? | Fax:?? 914-460-4139



> -----Original Message-----
> From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-
> bounces at puck.nether.net] On Behalf Of Giorgos Manousakis
> Sent: Friday, June 19, 2009 3:28 PM
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] QoS for skype with nbar on 837 with 12.3(11)YZ2
> 
> Dear All,
> 
> i am trying to apply QoS on my aDsl interface (2048/256) and i need to
> give
> strict priority to voice traffic, including skype and g711.
> 
> I suppose that i can match the g711 by using nbar rtp audio protocol or
> by
> using source ports that are know on my asterisk server.
> 
> Because of randomness of skype protocol that kind of handling does not
> apply.
> I found that skype is included in nbar but only after 12.4 version.
> Unfortunately i cannot upgrade the ios of my 837 cause of lack of DRAM,
> which is not upgradable.
> So i tried to find a pdlm addon for skype, but it is not available for
> stand
> alone download (http://www.cisco.com/cgi-bin/tablebuild.pl/pdlm).
> 
> Can i found anywhere a skype.pdlm file? Is there any other way that i
> can
> match this traffic? Could i try rtp audio for that one too?
> 
> Thanks
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/


From peter at rathlev.dk  Sun Jun 21 17:05:55 2009
From: peter at rathlev.dk (Peter Rathlev)
Date: Sun, 21 Jun 2009 23:05:55 +0200
Subject: [c-nsp] Redirects / hair-pinning traffic vs. performance
In-Reply-To: <20090618183433.GB13882@rtp-cse-489.cisco.com>
References: <1245283261.15106.46.camel@localhost.localdomain>
	<1245345182.26970.13.camel@localhost.localdomain>
	<20090618183433.GB13882@rtp-cse-489.cisco.com>
Message-ID: <1245618355.2946.63.camel@localhost.localdomain>

On Thu, 2009-06-18 at 14:34 -0400, Rodney Dunn wrote: 
> Curious..I don't know that platform forwarding architecture.
> 
> But what does 'sh int stat' give you?

We've begun running some production traffic through the box now and it
doesn't seem to be overly loaded by more flows, but maybe it really has
to process switch "first packets". I thought the TCAM thingy was able to
do a hashed lookup based on source and destination IP and thus no need
to "install" flows.

Interface stats for the two relevant interfaces (policy map attached to
Vlan2176, policy routed traffic exits via Vlan507, non policy routed
exist via next hop on same interface as it arrived):

Vlan507
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor      73750    4426830     314407   20751714
             Route cache          1         90          0          0
                   Total      73751    4426920     314407   20751714
Vlan2176
          Switching path    Pkts In   Chars In   Pkts Out  Chars Out
               Processor     210884   13340863     323420   21776624
             Route cache         23       5081         24       5267
                   Total     210907   13345944     323444   21781891

And "show interfaces accounting":

Vlan507 XXX Internet
                Protocol    Pkts In   Chars In   Pkts Out  Chars Out
                      IP         41       3546     315061   19534782
                     ARP      73840    4431144         74       4440
Vlan2176 YYY Internet
                Protocol    Pkts In   Chars In   Pkts Out  Chars Out
                      IP     211382   13383337     324400   20584065
                     ARP        571      34260        131       7860

The processor switched "Pkts In" from Vlan507 are mostly ARP. The unit
has been live for a couple of days with light production traffic.

And the route-map:

route-map Inet_PBR, permit, sequence 10
  Match clauses:
    ip address (access-lists): RMIT_XXX_sources 
  Set clauses:
    ip next-hop A.B.C.D
  Policy routing matches: 0 packets, 0 bytes
route-map Inet_PBR, permit, sequence 20
  Match clauses:
    ip address (access-lists): RMIT_YYY_sources 
  Set clauses:
    ip next-hop A.B.C.E
  Policy routing matches: 3 packets, 216 bytes


> Also, sh ip traffic a couple times once you start the traffic.

The "show ip traffic" seems only to show traffic received. Should it
also show policy routed traffic?

IP statistics:
  Rcvd:  211589 total, 211565 local destination
         0 format errors, 0 checksum errors, 24 bad hop count
         0 unknown protocol, 0 not a gateway
         0 security failures, 0 bad options, 0 with options
  Opts:  0 end, 0 nop, 0 basic security, 0 loose source route
         0 timestamp, 0 extended security, 0 record route
         0 stream ID, 0 strict source route, 0 alert, 0 cipso, 0 ump
         0 other
  Frags: 0 reassembled, 0 timeouts, 0 couldn't reassemble
         0 fragmented, 0 couldn't fragment
  Bcast: 0 received, 0 sent
  Mcast: 201383 received, 630608 sent
  Sent:  639832 generated, 255251197 forwarded
  Drop:  0 encapsulation failed, 0 unresolved, 0 no adjacency
         0 no route, 0 unicast RPF, 0 forced drop
         0 options denied, 0 source IP address zero

ICMP statistics:
  Rcvd: 0 format errors, 0 checksum errors, 1 redirects, 0 unreachable
        144 echo, 24 echo reply, 0 mask requests, 0 mask replies, 0
quench
        0 parameter, 0 timestamp, 0 info request, 0 other
        0 irdp solicitations, 0 irdp advertisements
  Sent: 0 redirects, 108 unreachable, 25 echo, 144 echo reply
        0 mask requests, 0 mask replies, 0 quench, 0 timestamp
        0 info reply, 386 time exceeded, 0 parameter problem
        0 irdp solicitations, 0 irdp advertisements

TCP statistics:
  Rcvd: 6307 total, 26 checksum errors, 30 no port
  Sent: 4655 total

UDP statistics:
  Rcvd: 205062 total, 0 checksum errors, 117 no port
  Sent: 634518 total, 0 forwarded broadcasts

(... snipped irrelevant protocol counte