<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel"><head><META content="text/html; charset=iso-8859-1" http-equiv="Content-Type">
<STYLE><!-- /* Style Definitions */ p.d152bf90-79e0-4ab1-a59e-10bb3b622505, li.d152bf90-79e0-4ab1-a59e-10bb3b622505, div.d152bf90-79e0-4ab1-a59e-10bb3b622505, table.d152bf90-79e0-4ab1-a59e-10bb3b622505Table {margin:0cm; margin-bottom:.0001pt;} div.Section1 {page:Section1;} --></STYLE>
<meta content="Microsoft Word 14 (filtered medium)" name=Generator><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-GB;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><BODY>
<DIV STYLE="PADDING-BOTTOM: 1em; PADDING-LEFT: 1em; PADDING-RIGHT: 1em; PADDING-TOP: 1em"><FONT FACE="Arial"><FONT SIZE="2"><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi Andras,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Yes that has indeed applied without error, however as you point out it does not meet with the requirements I have from the customer. In short, the customer needs a limit which is applied per IP (of his clients) to restrict inbound traffic in the direction Internet->Client. This is because downstream of us the client has several links which are only 1GB serving large numbers of his clients. I know there are several ways this could be resolved (not least of which a switch upgrade within the client’s network) however they are not currently options so we are trying to come up with something for them which we can deploy ahead of their connection with us.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>My understanding of the full-flow mask is that it will limit flow, only, so two transfers to the same IP will count as 2 x the limit. Which in this scenario makes it inappropriate unfortunately.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>So, it looks like we will have to deploy it for IPv4 for them only; and skip IPv6, which is a shame because the client is a growing IPv6 user so I can see the problem surfacing again soon.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Interestingly, can anyone confirm that the Sup-2T can do what we are trying to do without this IPv6 oddness?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Once again, my thanks to you!<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Tóth András [mailto:diosbejgli@gmail.com] <br><b>Sent:</b> 09 December 2012 17:16<br><b>To:</b> Robert Williams<br><b>Cc:</b> cisco-nsp NSP<br><b>Subject:</b> Re: [c-nsp] Multiple flow-masks<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi Robert,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Thanks for the clarification. What I meant is that QoS microflow policy which needs to have full-flow mask, otherwise you might likely have a conflict with NDE. I understand that it's a requirement for you to have destination based policing.<o:p></o:p></p></div><div><p class=MsoNormal>In addition to that, if the NDE flowmask is interface-full-flow, it will not work with QoS microflow policing.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Try configuring the following:<o:p></o:p></p></div><div><div><p class=MsoNormal>mls flow ip interface-destination-source<o:p></o:p></p></div><div><p class=MsoNormal>mls flow ipv6 full<o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><p class=MsoNormal>policy-map test-policy<o:p></o:p></p></div><div><p class=MsoNormal> class class-default<o:p></o:p></p></div><div><p class=MsoNormal> police flow mask full-flow 200000000 512000 conform-action transmit exceed-action drop<o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>This should work but this will use full-flow mask for the QoS.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Best regards,<o:p></o:p></p></div><div><p class=MsoNormal>Andras<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Sun, Dec 9, 2012 at 4:36 PM, Robert Williams <<a href="mailto:Robert@custodiandc.com" target="_blank">Robert@custodiandc.com</a>> wrote:<o:p></o:p></p><div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Hi Andras,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Many thanks for that – sorry the outputs were misleading but I have already tried all 6 variants of the mls flow ipv6 <…> command, including "mls flow ipv6 full" – they all produce the same results, culminating in the %FM-2-FLOWMASK_CONFLICT error.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>I have removed all other policies off the device to rule them out, so a clean test / demonstration of the issue is as follows:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>mls commands currently set:<o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>mls ipv6 acl compress address unicast<o:p></o:p></span></p></div></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>mls netflow interface <- (there is no non-interface version of this command)<o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-family:"Courier New"'>mls nde sender<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>mls qos<o:p></o:p></span></p></div></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>mls flow ip interface-destination-source <- (there is no version of this command which doesn’t include the ‘interface’ keyword for ipv4)<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>mls flow ipv6 full<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>flow commands currently set:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>ip flow-export source xx<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>ip flow-export version 9<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>ip flow-export destination x.x.x.x xxxx<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>ip flow-top-talkers<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>With all the above in place, I do get the Full Flow mask as you say:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 0 reserved none<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 1 Full Flo FM_IPV6_GUARDIAN <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 2 Null <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 3 reserved none<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Plus there is a space in slot 2 - however, when I try to apply my policy:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>policy-map test-policy<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> class class-default<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> police flow mask dest-only 200000000 512000 conform-action transmit exceed-action drop<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>interface xx<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>service-policy input test-policy<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>I still get: %FM-2-FLOWMASK_CONFLICT: Features configured on interface xx have conflicting flowmask requirements, traffic may be switched in software<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>My policy has to be destination based so I cannot change that, but apart from that I think I'm trying what you are describing, but my apologies if I'm still missing the point!<o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Cheers!<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>From: Tóth András [<a href="mailto:diosbejgli@gmail.com" target="_blank">mailto:diosbejgli@gmail.com</a>] <o:p></o:p></span></p></div></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Sent: 09 December 2012 14:47<o:p></o:p></span></p></div><div><div><div><p class=MsoNormal><span style='font-family:"Courier New"'>To: Robert Williams<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Cc: cisco-nsp NSP<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Subject: Re: [c-nsp] Multiple flow-masks<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>The outputs you pasted suggests that you're using "interface-full" flowmask. The workaround is to use "full" flowmask instead of "interface-full" as mentioned in my last email. IPv6 entries consume more TCAM space than IPv4, so comparing them should take this fact into account.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Best regards,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Andras<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>On Sun, Dec 9, 2012 at 2:52 PM, Robert Williams <<a href="mailto:Robert@custodiandc.com" target="_blank">Robert@custodiandc.com</a>> wrote:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Hi,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Thanks very much for that, I’ll have to run through everything in that document because the tests I’m doing suggest that it ‘should’ work, for example: <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>With both my policy and the mls ipv6 flow interface-full disabled I see one entry, which is presumably because ‘mls qos’ is enabled:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 1 Intf Ful FM_IPV6_QOS <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 2 Null <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Then if I enable only “mls ipv6 flow interface-full”, the FM_IPV6_GUARDIAN ‘feature’ appears:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 1 Intf Ful FM_IPV6_GUARDIAN FM_IPV6_QOS <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 2 Null <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>As you can see there is still a gap for the policy to take the second flow mask and use whatever type of mask it wants.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>As a test - if I disable the ipv6 flow and just enable my policy by itself, it goes in the second slot correctly - and uses the Destination Only mask:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 1 Intf Ful FM_IPV6_QOS <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 2 Dest onl FM_IPV6_QOS<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>So, I was assuming that a combination of these two features would be acceptable to it, since they operate in different mask slots when enabled separately anyway I didn’t see why they should collide.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>I am correct as far as its operation in IPv4 goes because for v4 there is no conflict warning (and the policy works in hardware perfectly!). However, in IPv6 that does not appear to be the case.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Looks like yet another unhappy IPv6 feature on the Sup-720, unless anyone can see a way around it that I’m missing?<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>As an aside, does anybody know why it is called FM_IPV6_GUARDIAN instead of FM_IPV6_QOS (like in v4)? I’m wondering if this difference is the reason for its inability to combine the two masks successfully…<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Cheers!<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>From: Tóth András [<a href="mailto:diosbejgli@gmail.com" target="_blank">mailto:diosbejgli@gmail.com</a>] <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Sent: 08 December 2012 21:09<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>To: Robert Williams<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Cc: cisco-nsp NSP<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Subject: Re: [c-nsp] Multiple flow-masks<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Hi Robert,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>A few things to keep in mind.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>With Release 12.2(33)SXI4 and later releases, when appropriate for the configuration of the policer, microflow policers use the interface-full flow mask, which can reduce flowmask conflicts. Releases earlier than Release 12.2(33)SXI4 use the full flow mask.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>The flowmask requirements of QoS, NetFlow, and NetFlow data export (NDE) might conflict, especially if you configure microflow policing.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'><a href="http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/qos.html" target="_blank">http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/qos.html</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>To add to this, note the following restrictions/recommendations well:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>The micro-flow policing full flow mask is compatible with NDE’s flow masks that are shorter than or equal to full flow (except for destination source interface).<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>With any micro-flow policing partial mask an error message is displayed and either the micro-flow policer or NDE might get disabled.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Best regards,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Andras<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>On Sat, Dec 8, 2012 at 3:50 PM, Robert Williams <<a href="mailto:Robert@custodiandc.com" target="_blank">Robert@custodiandc.com</a>> wrote:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Hi,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Unfortunately we use Netflow for an automated system we have (it doesn't need to accurately record everything, just the highest number of flows / packets etc). So I cannot just remove it, however I have made some progress.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>I've tracked it down to the problem actually being with the IPv6 netflow / masks. With all netflow removed I am able to add my policy-map in and it works. Then by adding netflow commands back in I can get everything back except the command:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> mls flow ipv6 <any command><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>So even if I specify:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> mls flow ipv6 destination<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>I still get:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>%FM-2-FLOWMASK_CONFLICT: Features configured on interface <name> have conflicting flowmask requirements, traffic may be switched in software<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>At this point in time, with my policy attached and working I'm showing:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> Flowmasks: Mask# Type Features<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv4: 0 reserved none<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv4: 1 Intf Ful FM_QOS Intf NDE L3 Feature<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv4: 2 Dest onl FM_QOS <--- My policy (V4)<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv4: 3 reserved none<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 0 reserved none<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 1 Intf Ful FM_IPV6_QOS<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 2 Dest onl FM_IPV6_QOS <--- My policy (V6)<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> IPv6: 3 reserved none<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>The command "mls flow ipv6 <anything>" just plain refuses to go active in the config, so if I re-send it I get the error shown above every time.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>The flowmasks are correctly showing "Intf Full" and "Dest only" in slots 1 and 2 respectively. So, why does my netflow request not attach alongside either one of them when it's looking for the same mask as is already active in those slots?<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>The policy itself is working correctly at this point, but I cannot enable IPv6 netflow.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Can anyone help?<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Robert Williams<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Backline / Operations Team<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Custodian DataCentre<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>tel: <a href="tel:%2B44%20%280%291622%20230382" target="_blank">+44 (0)1622 230382</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>email: <a href="mailto:Robert@CustodianDC.com">Robert@CustodianDC.com</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'><a href="http://www.custodiandc.com/disclaimer.txt" target="_blank">http://www.custodiandc.com/disclaimer.txt</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Robert Williams<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Backline / Operations Team<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>Custodian DataCentre<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>tel: <a href="tel:%2B44%20%280%291622%20230382" target="_blank">+44 (0)1622 230382</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>email: <a href="mailto:Robert@CustodianDC.com">Robert@CustodianDC.com</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'><a href="http://www.custodiandc.com/disclaimer.txt" target="_blank">http://www.custodiandc.com/disclaimer.txt</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><br><b><span style='color:gray'>Robert Williams</span></b></span><span style='font-family:"Courier New"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:gray'>Backline / Operations Team</span><span style='font-family:"Courier New"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:gray'>Custodian DataCentre</span><span style='font-family:"Courier New"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:gray'>tel: <a href="tel:%2B44%20%280%291622%20230382" target="_blank">+44 (0)1622 230382</a></span><span style='font-family:"Courier New"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:gray'>email: <a href="mailto:Robert@CustodianDC.com">Robert@CustodianDC.com</a></span><span style='font-family:"Courier New"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><a href="http://www.custodiandc.com/disclaimer.txt" target="_blank">http://www.custodiandc.com/disclaimer.txt</a><br><br></span><span style='font-family:"Courier New"'></span></p></div></div></div></div></div></div></div></FONT> <BR>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><FONT COLOR="#808080" FACE="Arial" SIZE="2"><STRONG>Robert Williams</STRONG></FONT></P>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><FONT COLOR="#808080" FACE="Arial" SIZE="2">Backline / Operations Team</FONT></P>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"></P>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"></P>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"></P>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"></P>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"></P>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"></P>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"></P></FONT>
<TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0" CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505Table" STYLE="BORDER-COLLAPSE: collapse" WIDTH="900">
<TBODY>
<TR>
<TD NOWRAP="NOWRAP" STYLE="PADDING-RIGHT: 1em" WIDTH="300">
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><FONT FACE="Arial" SIZE="2"><STRONG><FONT COLOR="#be5c2c"></FONT></STRONG><A HREF="http://www.CustodianDC.com/"><IMG ALIGN="baseline" ALT="Custodian DataCentre" BORDER="0" HSPACE="0" SRC="cid:imageb9d65d.jpg@acf57610.0c8a4454"></A></FONT></P></TD>
<TD STYLE="BACKGROUND-COLOR: #a3b901; WIDTH: 0.3em">
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><FONT STYLE="BACKGROUND-COLOR: #a4ba00"></FONT></P></TD>
<TD NOWRAP="NOWRAP" STYLE="BACKGROUND-COLOR: white; PADDING-LEFT: 1em; PADDING-RIGHT: 1em" WIDTH="300">
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505">
<TABLE BORDER="0" CELLPADDING="0" CELLSPACING="0" CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505Table" ID="d152bf90-79e0-4ab1-a59e-10bb3b622505excontact" NAME="d152bf90-79e0-4ab1-a59e-10bb3b622505excontact" STYLE="BORDER-COLLAPSE: collapse">
<TBODY>
<TR>
<TD>
<P ALIGN="right" CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><STRONG><FONT SIZE="2"><FONT FACE="Arial"><FONT COLOR="#808080"><FONT COLOR="#333333">Tel:</FONT> </FONT></FONT></FONT></STRONG></P></TD>
<TD>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><FONT COLOR="#a3b901" FACE="Arial" SIZE="2"><STRONG>+44 (0)1622 230 382</STRONG></FONT></P></TD></TR>
<TR>
<TD>
<P ALIGN="right" CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><STRONG><FONT SIZE="2"><FONT FACE="Arial"><FONT COLOR="#333333">Email: </FONT></FONT></FONT></STRONG></P></TD>
<TD><FONT COLOR="#00aeef" FACE="Arial" SIZE="2"><A HREF="mailto:support@CustodianDC.com" STYLE="TEXT-DECORATION: none"><FONT COLOR="#a3b901" FACE="Arial" SIZE="2"><STRONG>Robert@CustodianDC.com</STRONG></FONT></A></FONT></TD></TR>
<TR>
<TD>
<P ALIGN="right" CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><STRONG><FONT SIZE="2"><FONT FACE="Arial"><FONT COLOR="#333333">Web: </FONT></FONT></FONT></STRONG></P></TD>
<TD>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><A HREF="http://www.CustodianDC.com/" STYLE="TEXT-DECORATION: none"><FONT COLOR="#a3b901" FACE="Arial" SIZE="2"><STRONG>www.CustodianDC.com</STRONG></FONT></A></P></TD></TR>
<TR>
<TD>
<P ALIGN="right" CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><STRONG><FONT SIZE="2"><FONT FACE="Arial"><FONT COLOR="#333333">Status: </FONT></FONT></FONT></STRONG></P></TD>
<TD>
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"><A HREF="http://status.custdc.net/" STYLE="TEXT-DECORATION: none"><FONT COLOR="#a3b901" FACE="Arial" SIZE="2"><STRONG>status.CustDC.net</STRONG></FONT></A></P></TD></TR></TBODY></TABLE></P></TD>
<TD STYLE="BACKGROUND-COLOR: #a3b901; WIDTH: 0.3em">
<P CLASS="d152bf90-79e0-4ab1-a59e-10bb3b622505"></P></TD>
<TD NOWRAP="NOWRAP" STYLE="BACKGROUND-COLOR: white; PADDING-LEFT: 1em; PADDING-RIGHT: 1em" WIDTH="175">
<P ALIGN="center"><STRONG><IMG ALIGN="baseline" ALT BORDER="0" HSPACE="0" SRC="cid:image9e7fb8.png@d5057fdf.12c14486"><BR><FONT FACE="Arial" SIZE="2">ISO:27001 IS:567248</FONT></STRONG></P></TD></TR></TBODY></TABLE>
<P></P>
<P></P><FONT FACE="Arial" SIZE="2"><A HREF="http://www.custodiandc.com/disclaimer.txt"><FONT COLOR="#000000" SIZE="1">Click to view our email disclaimer</FONT></A><BR><BR><div class=WordSection1><div><div><div><div><div><div><p class=MsoNormal><span style='font-family:"Courier New"'>_______________________________________________</span></p></div></div></div></div></div></div></div><div class=WordSection1><div><div><div><div><div><div><p class=MsoNormal><span style='font-family:"Courier New"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>cisco-nsp mailing list <a href="mailto:cisco-nsp@puck.nether.net" target="_blank">cisco-nsp@puck.nether.net</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'><a href="https://puck.nether.net/mailman/listinfo/cisco-nsp" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-nsp</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'>archive at <a href="http://puck.nether.net/pipermail/cisco-nsp/" target="_blank">http://puck.nether.net/pipermail/cisco-nsp/</a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Courier New"'> <o:p></o:p></span></p></div></div></div></div></div><p class=MsoNormal><o:p> </o:p></p></div></div></FONT>
<P></P>
<P></P>
<P></P>
<P></P>
<P></P>
<P></P>
<P></P>
<P></P></DIV></BODY></HTML>