[c-nsp] cisco-nsp Digest, Vol 107, Issue 89

Fri, 28 Oct 2011 13:18:54 -0700 

Send cisco-nsp mailing list submissions to
        [email protected]

To subscribe or unsubscribe via the World Wide Web, visit
        https://puck.nether.net/mailman/listinfo/cisco-nsp
or, via email, send a message with subject or body 'help' to
        [email protected]

You can reach the person managing the list at
        [email protected]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of cisco-nsp digest..."


Today's Topics:

   1. Re: VPLS/Layer2 Egress Policing (ar)
   2. Re: Smaller MPLS/EoMPLS capable router (Christophe Lucas)
   3. Re: Smaller MPLS/EoMPLS capable router (Lars Christensen)
   4. Re: "Strange" Cisco ASA5520 errors - Connection limit
      exceeded (David White, Jr. (dwhitejr))
   5. 3750E as backup edge router default only (Jeffrey G. Fitzwater)
   6. Re: 3750E as backup edge router default only (-Hammer-)
   7. Re: 3750E as backup edge router default only (-Hammer-)


----------------------------------------------------------------------

Message: 1
Date: Fri, 28 Oct 2011 17:46:48 +0800 (SGT)
From: ar <[email protected]>
To: Pavel Skovajsa <[email protected]>
Cc: "[email protected]" <[email protected]>
Subject: Re: [c-nsp] VPLS/Layer2 Egress Policing
Message-ID:
        <[email protected]>
Content-Type: text/plain; charset=iso-8859-1

Thanks. So is there a way to do egress police on the WS cards?



________________________________
From: Pavel Skovajsa <[email protected]>
To: ar <[email protected]>
Cc: "[email protected]" <[email protected]>
Sent: Thursday, October 27, 2011 4:45 AM
Subject: Re: [c-nsp] VPLS/Layer2 Egress Policing

This is by design since the WS-6748 cards are for LAN environment. You
would need to use either a SPA module, or better the ES cards:
http://www.cisco.com/en/US/prod/collateral/routers/ps368/data_sheet_c78-49152.html

-pavel

On Tue, Oct 25, 2011 at 10:14 AM, ar <[email protected]> wrote:

Hi Guys.
I am searching for a good docs for Layer2 or VPLS Egress Policing (PE-to-CE). Any one knows how to do this? I'm using 7600 with WS-6748 line card. Egress policing facing is not allowed. 


thanks
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



------------------------------

Message: 2
Date: Fri, 28 Oct 2011 11:33:56 +0200
From: Christophe Lucas <[email protected]>
To: [email protected], [email protected]
Subject: Re: [c-nsp] Smaller MPLS/EoMPLS capable router
Message-ID: <[email protected]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Le 27/10/2011 20:41, Andrew K. a ?crit :

I've been waiting for my SE to get back to me on this but I wanted to
ping the community to see what has been successfully used in the field. 

Proving WAN services in a remote rural area we have several small POP
sites providing minimal customers (some 10 or less).

We are looking to run MPLS in these area for loop prevention.
From my digging around the smallest device I can see supporting these 
features would be a 2811.

Anyone use anything smaller?



Thanks in advance for any input.
Andrew.


Hi,

ME3750 is able to do this.

Best regards,
--
Christophe Lucas - Network Engineer - [email protected]
Tel : +33(0)974.762.595 - Fax : +33(0)09.72.19.53.58

"Ce message et toutes les pieces jointes sont etablis a l'attention
exclusive de ses destinataires et sont confidentiels. L'internet ne
permettant pas d'assurer l'integrite de ce message, le contenu de ce
message ne represente en aucun cas un engagement de la part de notre
societe. Si vous recevez ce message par erreur, merci de le detruire et
d'en avertir immediatement l'expediteur.

This message contains privileged and confidential information. Given
that the internet does not allow us to make sure of the communication's
integrity, the content of this message does not represent in any case a
commitment from our company. If you are not the intended recipient,
please notify us immediately and delete this e-mail (including any
attachments) from your system."


------------------------------

Message: 3
Date: Fri, 28 Oct 2011 15:04:13 +0200
From: Lars Christensen <[email protected]>
To: Christophe Lucas <[email protected]>
Cc: "[email protected]" <[email protected]>
Subject: Re: [c-nsp] Smaller MPLS/EoMPLS capable router
Message-ID: <7333239211811024957@unknownmsgid>
Content-Type: text/plain; charset=ISO-8859-1

Me3750 has been announced EoS a few months ago. Therefore I don't
recommend for new installations.

BR
Lars
Den 28/10/2011 kl. 12.31 skrev Christophe Lucas <[email protected]>: 


Le 27/10/2011 20:41, Andrew K. a ?crit :
I've been waiting for my SE to get back to me on this but I wanted to ping the community to see what has been successfully used in the field.
Proving WAN services in a remote rural area we have several small POP 
sites providing minimal customers (some 10 or less).

We are looking to run MPLS in these area for loop prevention.
From my digging around the smallest device I can see supporting these 
features would be a 2811.

Anyone use anything smaller?



Thanks in advance for any input.
Andrew.


Hi,

ME3750 is able to do this.

Best regards,
--
Christophe Lucas - Network Engineer - [email protected]
Tel : +33(0)974.762.595 - Fax : +33(0)09.72.19.53.58
"Ce message et toutes les pieces jointes sont etablis a l'attention exclusive de ses destinataires et sont confidentiels. L'internet ne permettant pas d'assurer l'integrite de ce message, le contenu de ce message ne represente en aucun cas un engagement de la part de notre societe. Si vous recevez ce message par erreur, merci de le detruire et d'en avertir immediatement l'expediteur.
This message contains privileged and confidential information. Given that the internet does not allow us to make sure of the communication's integrity, the content of this message does not represent in any case a commitment from our company. If you are not the intended recipient, please notify us immediately and delete this e-mail (including any attachments) from your system." 
_______________________________________________
cisco-nsp mailing list  [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/




------------------------------

Message: 4
Date: Fri, 28 Oct 2011 09:21:52 -0400
From: "David White, Jr. (dwhitejr)" <[email protected]>
To: Peter Adkins <[email protected]>
Cc: "[email protected]" <[email protected]>
Subject: Re: [c-nsp] "Strange" Cisco ASA5520 errors - Connection      limit
        exceeded
Message-ID: <[email protected]>
Content-Type: text/plain; charset=ISO-8859-1

Hi Peter,

It looks like you are running into known bug CSCtl23397, which is fixed
in 8.2.5.6 and higher images.

I would recommend upgrading to 8.2.5.13, which is currently posted to
Cisco.com

http://www.cisco.com/cisco/software/release.html?mdfid=279916878&flowid=4819&softwareid=280775065&release=8.2.5%20Interim&rellifecycle=&relind=AVAILABLE&reltype=all

Sincerely,

David.


Peter Adkins wrote:

-----Original Message-----
From: [email protected] [mailto:
[email protected]] On Behalf Of Peter Adkins
Sent: Friday, 28 October 2011 3:13 PM
To: [email protected]
Subject: [c-nsp] "Strange" Cisco ASA5520 errors - Connection limit exceeded 

Hi all,
The scenario is that we have two 5520s for this environment configured for fail-over, these devices currently terminate a whopping 2x L2L IPSec VPNs 
and a handful of SSL VPN sessions.
This morning we encountered a strange issue which was originally believed 
to
be due to ACLs not permitting traffic; effectively, if I were to log in to one of the configured SSL VPNs I was unable to connect to any services configured to be permitted through the VPN filter. As a last ditch effort 
to work out what was wrong I permitted ANY IP traffic through to the
required network, however, this still didn't fix the issue.
As an example of what we were seeing, when attempts to telnet into TCP port 
1433 were failing, the following was found in the logs:

   ...
%ASA-3-201011: Connection limit exceeded -35/5000 for input packet from 
X.X.X.X/65374 to Y.Y.Y.Y/1433 on interface outside
%ASA-3-201011: Connection limit exceeded -35/5000 for input packet from 
X.X.X.X/65374 to Y.Y.Y.Y/1433 on interface outside
%ASA-3-201011: Connection limit exceeded -35/5000 for input packet from 
X.X.X.X/65374 to Y.Y.Y.Y/1433 on interface outside
%ASA-3-201011: Connection limit exceeded -35/5000 for input packet from 
X.X.X.X/65375 to Y.Y.Y.Y/1433 on interface outside
%ASA-3-201011: Connection limit exceeded -35/5000 for input packet from 
X.X.X.X/65375 to Y.Y.Y.Y/1433 on interface outside
%ASA-3-201011: Connection limit exceeded -35/5000 for input packet from 
X.X.X.X/65375 to Y.Y.Y.Y/1433 on interface outside
   ...
The Cisco website indicates that these sorts of messages would be presented if the configured connection limits were, well, exceeded. However, I am slightly perplexed as to the current count staying at -35 for all reported 
messages -- as there was a large number of them.

   ...
   Interface outside:
     Service-policy: CONNS
       Class-map: CONNS
         Set connection policy: conn-max 5000 embryonic-conn-max 30
           current embryonic conns 0, current conns -35, drop 5622
         Set connection timeout policy:
           embryonic 0:40:00 half-closed 0:20:00 idle 2:00:00
           DCD: enabled, retry-interval 0:00:15, max-retries 5
DCD: client-probe 530, server-probe 0, conn-expiration 106 
   ...
I could understand if we were reaching a session limit, however, with only two clients connected and a max of 5000 I don't believe this to be the 
case.
Also, as mentioned, the current session index being 'stuck' at -35 concerns 
me slightly.
In the end, we had failed over to the redundant node which did not exhibit this issue. However, as soon as we failed back the problem came straight 
back. The only way to resolve the issue was a reload.
I'm trying to work out whether anyone has encountered this issue before on an ASA55x0 running 8.2(4). Mainly to determine whether this was something strange, or me just being daft. As much as I'd like to log a TAC case for this one, this particular device does not have a valid support contract. 
However, for my sanity I'd like to establish whether this is / was a
potential code issue, or a problem with the device itself.

Regards,
Peter Adkins
_______________________________________________
cisco-nsp mailing list  [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Members save 1%* p.a. on car loan rates with no ongoing fees. Apply today 
at http://www.racq.com.au/promotions/racq_car_loans
Please Note: If you are not the intended recipient, please delete this email as its use is prohibited. RACQ does not warrant or represent that this email is free from viruses or defects. If you do not wish to receive 
any further commercial electronic messages from RACQ please e-mail
[email protected] or contact RACQ on 13 19 05.



_______________________________________________
cisco-nsp mailing list  [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/





------------------------------

Message: 5
Date: Fri, 28 Oct 2011 13:31:28 +0000
From: "Jeffrey G. Fitzwater" <[email protected]>
To: "[email protected]" <[email protected]>
Subject: [c-nsp] 3750E as backup edge router default only
Message-ID:
        <[email protected]>
Content-Type: text/plain; charset="us-ascii"
We would like to try a 3750E as a backup router should we have a catastrophic failure of our current 6500 that has 3 ISP attached. This would only be used as a temp ISP backup.
The 3750E would only need to connect to one ISP at 1G and only need DEFAULT to peer. 


Is there any issues with it acting as a router with apron. 16 subnets?
If I run the 3750E in ROUTER mode vs VLAN mode will there be an issue with the MAC table size being only 3K ROUTE vs 16K VLAN mode?
We are concerned with the size of the ARP and BRIDGING tables possibly maxing out. Maybe it's not really an issue, but just asking for advise. 



We would be using a 3750E because we already have them used elsewhere.



Thanks for any advise.



Jeff Fitzwater
OIT Networking & Communications Systems
Princeton University


------------------------------

Message: 6
Date: Fri, 28 Oct 2011 08:52:04 -0500
From: -Hammer- <[email protected]>
To: [email protected]
Subject: Re: [c-nsp] 3750E as backup edge router default only
Message-ID: <[email protected]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Just default route? No big route table? Sure it can be done. I wouldn't
recommended but I'm not in your shoes. Remember that some security
features you would use to protect yourself may not be on the switch IOS
in the same way they are on a router IOS. CoPPs for example...

https://supportforums.cisco.com/thread/2015437

-Hammer-

"I was a normal American nerd"
-Jack Herer



On 10/28/2011 08:31 AM, Jeffrey G. Fitzwater wrote:
We would like to try a 3750E as a backup router should we have a catastrophic failure of our current 6500 that has 3 ISP attached. This would only be used as a temp ISP backup.
The 3750E would only need to connect to one ISP at 1G and only need DEFAULT to peer.
Is there any issues with it acting as a router with apron. 16 subnets?
If I run the 3750E in ROUTER mode vs VLAN mode will there be an issue with the MAC table size being only 3K ROUTE vs 16K VLAN mode?
We are concerned with the size of the ARP and BRIDGING tables possibly maxing out. Maybe it's not really an issue, but just asking for advise.
We would be using a 3750E because we already have them used elsewhere. 



Thanks for any advise.



Jeff Fitzwater
OIT Networking&  Communications Systems
Princeton University
_______________________________________________
cisco-nsp mailing list  [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/




------------------------------

Message: 7
Date: Fri, 28 Oct 2011 09:16:36 -0500
From: -Hammer- <[email protected]>
To: [email protected]
Subject: Re: [c-nsp] 3750E as backup edge router default only
Message-ID: <[email protected]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Also I'm struggling with your ARP concerns. You will be "routing" on
this device right? How much local (broadcast domain) activity will you
have where you would be building up a large ARP cache? Would this be a
stack with a bunch of flat stuff staggered off it as will as performing
the routing function?

-Hammer-

"I was a normal American nerd"
-Jack Herer



On 10/28/2011 08:31 AM, Jeffrey G. Fitzwater wrote:
We would like to try a 3750E as a backup router should we have a catastrophic failure of our current 6500 that has 3 ISP attached. This would only be used as a temp ISP backup.
The 3750E would only need to connect to one ISP at 1G and only need DEFAULT to peer.
Is there any issues with it acting as a router with apron. 16 subnets?
If I run the 3750E in ROUTER mode vs VLAN mode will there be an issue with the MAC table size being only 3K ROUTE vs 16K VLAN mode?
We are concerned with the size of the ARP and BRIDGING tables possibly maxing out. Maybe it's not really an issue, but just asking for advise.
We would be using a 3750E because we already have them used elsewhere. 



Thanks for any advise.



Jeff Fitzwater
OIT Networking&  Communications Systems
Princeton University
_______________________________________________
cisco-nsp mailing list  [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/




------------------------------

_______________________________________________
cisco-nsp mailing list
[email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp

End of cisco-nsp Digest, Vol 107, Issue 89
******************************************

_______________________________________________
cisco-nsp mailing list  [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

Reply via email to