Re: [c-nsp] Add Path IOS

2012-03-20 Thread Christian Meutes

On 2012-03-19 21:41, Nick Hilliard wrote:


It's already available on SR (i.e. 7200 / 7600).


Good to know, I should consider upgrading then.
What about SX and 15.x train? Any chance that it will be available 
soon?


Incidentally if you're starting a new thread, please start a new 
thread and
don't do it by hitting reply to an existing thread.  Otherwise your 
posting

will get lost.


Oh, yeah you are right - mail is so damn complicated.

--
Christian
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] IP helper-address source from loopback?

2012-03-20 Thread Arie Vayner (avayner)
Jay,

Take a look here... I think this should do the trick.
http://www.cisco.com/en/US/docs/ios/ipaddr/configuration/guide/iad_dhcps
ervidlink_mcp.html#wp1058967

Arie

-Original Message-
From: cisco-nsp-boun...@puck.nether.net
[mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Jay Hennigan
Sent: Tuesday, March 20, 2012 07:37
To: cisco-nsp@puck.nether.net
Subject: [c-nsp] IP helper-address source from loopback?

We have a setup where an external global DHCP server is used to assign
pools within a few VRFs on 7206VXR, IOS 12.4.  Interface configuration
looks like this:

interface Port-channel1.3004
 description Test
 encapsulation dot1Q 3004
 ip vrf forwarding net21
 ip address 10.21.97.126 255.255.255.192  ip helper-address global
w.x.y.z

We're using option 82 to communicate the vrf subnet information and it
all works well.

The problem that I'm trying to solve is to use a loopback as the global
source interface from which the DHCP requests originate.  With the above
configuration the router uses the closest egress interface to the DHCP
server.  This is quite usable but I'd prefer it originate on a loopback
for cleanliness and redundancy.

IOS has tweaks to manipulate the source address of telnet, RADIUS, ftp,
tftp, rcmd, and the like but I don't see an obvious way to specify the
source of the DHCP relay packets.

I'm considering attempting a local route-map as a possible solution but
that seems like a pretty big hammer for a small tweak if it works at
all.

Any suggestions from the assorted Cisco wizards?


--
Jay Hennigan - CCIE #7880 - Network Engineering - j...@impulse.net
Impulse Internet Service  -  http://www.impulse.net/ Your local
telephone and internet company - 805 884-6323 - WB6RDV
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Firewall/IPS Load Balancing

2012-03-20 Thread Eugeniu Patrascu
On Tue, Mar 20, 2012 at 00:50, Murphy, William
william.mur...@uth.tmc.edu wrote:
 I thought I would poll the list to solicit recommendations on how to do 
 firewall/IPS load balancing.  I am considering a traffic distribution switch 
 from GigaMon but I am curious what other products might be out there, or 
 perhaps even features in Cisco 6500 product that would achieve the same 
 result.  I am not interested in paying for full blown ADC/SLB boxes (ACE or 
 whatever) with more features than I need, and the GigaMon approach seems like 
 it fits that bill.  Thanks in advance for your feedback.

Hi,

I think you are a bit confused: GigaMon does not produce/sell load
balancing switches. What they do sniffing equipment that has the
possibility to be very granular at what you want to capture and to
audit this (like before receibing traffic you have to authenticate to
the device).
If you want firewall high availability, the simplest solution is to
buy two firewalls and run them in A/A or A/P configuration.
ACE or another SLB solution will balance incoming traffic to a pool of
servers based on some criteria that you can usually choose from.

I think you need to better describe what are your needs and what you
want to accomplish.

HTH,
Eugeniu

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Firewall/IPS Load Balancing

2012-03-20 Thread Phil Mayers

On 03/20/2012 09:31 AM, Eugeniu Patrascu wrote:


I think you are a bit confused: GigaMon does not produce/sell load
balancing switches. What they do sniffing equipment that has the


Maybe he means this?

http://www.gigamon.com/g-secure-0216


I think you need to better describe what are your needs and what you
want to accomplish.


Very much so; firewall load balancing is way too generic a term to 
give useful advice on.

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Add Path IOS

2012-03-20 Thread Nick Hilliard
On 20/03/2012 06:46, Christian Meutes wrote:
 Good to know, I should consider upgrading then.
 What about SX and 15.x train? Any chance that it will be available soon?

You'll have to ask your SE about this.

Note that this is ibgp add-path support only.  There is no support for ebgp
add-path on any cisco platform at the moment.

Nick
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] About Cisco ASR 1006 Router performance

2012-03-20 Thread Md. Jahangir Hossain
Dear honorable member:


Wishes all are fine.


i need   suggestion from you about CISCO ASR 1006 router performance. i want to 
buy  this router for IP Transit provider where i received  all global routes .


it would be nice please put your valued suggestion about this issue.





thanks
jahangir
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] About Cisco ASR 1006 Router performance

2012-03-20 Thread Farhan Jaffer
Stable product. Not sure about full internet feed but I am using 7609 for
the same purpose  it is perfectly running. ASR is the high end series 
should work.

-FJ

On Tue, Mar 20, 2012 at 4:19 PM, Md. Jahangir Hossain
jrjahan...@yahoo.comwrote:

 Dear honorable member:


 Wishes all are fine.


 i need   suggestion from you about CISCO ASR 1006 router performance. i
 want to buy  this router for IP Transit provider where i received  all
 global routes .


 it would be nice please put your valued suggestion about this issue.





 thanks
 jahangir
 ___
 cisco-nsp mailing list  cisco-nsp@puck.nether.net
 https://puck.nether.net/mailman/listinfo/cisco-nsp
 archive at http://puck.nether.net/pipermail/cisco-nsp/

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] About Cisco ASR 1006 Router performance

2012-03-20 Thread Nick Hilliard
On 20/03/2012 11:19, Md. Jahangir Hossain wrote:
 i need   suggestion from you about CISCO ASR 1006 router performance. i
 want to buy  this router for IP Transit provider where i received  all
 global routes .

ASR1k performance depends completely on the ESP card used. ESP cards come
with a number (e.g. ESP5 / ESP10 / ESP20, etc).  This number tells you how
much traffic the router can handle.  Specifically, the ASR1k operates using
centralised forwarding, and the number is a measure of how much traffic can
leave the central forwarding engine.  If you're handling just unicast
traffic, this will be the same as the ingress traffic.  If you're planning
on multicast, outbound multicast traffic counts towards this total.

Nick
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] About Cisco ASR 1006 Router performance

2012-03-20 Thread Christian Meutes

Hi,

On 2012-03-20 13:19, Md. Jahangir Hossain wrote:


i need   suggestion from you about CISCO ASR 1006 router performance.
i want to buy  this router for IP Transit provider where i received 
all global routes .


it would be nice please put your valued suggestion about this issue.


regarding PE and RR scalability the ASR1k is afaik the best product
from Cisco (~4M routes FIB, ~25M routes RIB/RR, 8k BGP-Sessions).

--
Christian
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

[c-nsp] PPPOE pass through Cisco Routers

2012-03-20 Thread Cipriano Montero, Infostock
 

As an environment as Wireless ISP, we are trying to deliver PPPOE
connections to our clients, in a routed network. So, our first problem is to
pass through PPPoE protocol over one or several cisco routers. Could
somebody help us with this task?

 

Thanks very much in advance.

 

Gracias y saludos,

Cipriano Montero

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] PPPOE pass through Cisco Routers

2012-03-20 Thread Arie Vayner (avayner)
Hi,

You most likely need to look into Layer 2 VPN options... Either over
MPLS (EoMPLS/ATOM/VPLS) or over IP using L2TPv3.
Be careful with MTU...

Arie

-Original Message-
From: cisco-nsp-boun...@puck.nether.net
[mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Cipriano
Montero, Infostock
Sent: Tuesday, March 20, 2012 14:07
To: cisco-nsp@puck.nether.net
Cc: Juan Luis Hoyo Herbello
Subject: [c-nsp] PPPOE pass through Cisco Routers


 

As an environment as Wireless ISP, we are trying to deliver PPPOE
connections to our clients, in a routed network. So, our first problem
is to pass through PPPoE protocol over one or several cisco routers.
Could somebody help us with this task?

 

Thanks very much in advance.

 

Gracias y saludos,

Cipriano Montero

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] PPPOE pass through Cisco Routers

2012-03-20 Thread Mike

On 03/20/2012 05:07 AM, Cipriano Montero, Infostock wrote:



As an environment as Wireless ISP, we are trying to deliver PPPOE
connections to our clients, in a routed network. So, our first problem is to
pass through PPPoE protocol over one or several cisco routers. Could
somebody help us with this task?



This isn't the cisco answer you are looking for, however

	PPPoE is a layer 2 protocol, and it (normally) requires that your 
clients are in the same broadcast domain as your PPPoE termination 
device (eg: plugged into the same switch for example). So, in a routed 
network, there won't normally be a layer 2 path here since you've got 
vlan's and / or routers connecting your network segments.


	One choice could be to use a PPPoE relay agent. This would have a 
router listen on some interface for PPPoE frames and then relay them to 
another interface where your PPPoE server is residing. This works for 1 
hop when you have clients on one interface and the server is on another, 
but I don't think you want to try extending it beyond 1 hop.


	Another choice - and the one I myself use - is to create a layer 2 vpn. 
I know there are cisco mpls solutions for this which someone else can 
comment on. I happen to use an opensource package called OpenVPN and 
it's stable and reliable. Effectively you'd have two boxes - one out in 
your network facing your wireless customers, and then another near your 
PPPoE server, and there would be a tunnel built on UDP that the traffic 
would pass thru. MTU isn't really a problem although if you have jumbo 
frame support internally it would reduce your packet fragmentation.


Good luck.

Mike-
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Firewall/IPS Load Balancing

2012-03-20 Thread Murphy, William
Thanks for your feedback, but I don't think I am confused.  GigaMon produces a 
G-Secure-0216 device which allows you to take a 10G link and split the 
flows/conversations across up to 8 1G links.  They basically call it a security 
device load balancer.  The device operates at close to line rate and can 
allocate the flows using mac-address, IP address. and even layer-4 ports (user 
configurable).  What I am trying to achieve is independence from vendor 
proprietary clustering, load sharing approaches and have something that is more 
linearly scalable simply by adding another parallel device into the path.  I 
won't name names but certain security vendors don't do A/A very well...

Bill


-Original Message-
From: Eugeniu Patrascu [mailto:eu...@imacandi.net] 
Sent: Tuesday, March 20, 2012 4:32 AM
To: Murphy, William
Cc: cisco-nsp@puck.nether.net
Subject: Re: [c-nsp] Firewall/IPS Load Balancing

On Tue, Mar 20, 2012 at 00:50, Murphy, William william.mur...@uth.tmc.edu 
wrote:
 I thought I would poll the list to solicit recommendations on how to do 
 firewall/IPS load balancing.  I am considering a traffic distribution switch 
 from GigaMon but I am curious what other products might be out there, or 
 perhaps even features in Cisco 6500 product that would achieve the same 
 result.  I am not interested in paying for full blown ADC/SLB boxes (ACE or 
 whatever) with more features than I need, and the GigaMon approach seems like 
 it fits that bill.  Thanks in advance for your feedback.

Hi,

I think you are a bit confused: GigaMon does not produce/sell load balancing 
switches. What they do sniffing equipment that has the possibility to be very 
granular at what you want to capture and to audit this (like before receibing 
traffic you have to authenticate to the device).
If you want firewall high availability, the simplest solution is to buy two 
firewalls and run them in A/A or A/P configuration.
ACE or another SLB solution will balance incoming traffic to a pool of servers 
based on some criteria that you can usually choose from.

I think you need to better describe what are your needs and what you want to 
accomplish.

HTH,
Eugeniu

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] IP helper-address source from loopback?

2012-03-20 Thread Jay Hennigan
On 3/19/12 11:56 PM, Arie Vayner (avayner) wrote:
 Jay,
 
 Take a look here... I think this should do the trick.
 http://www.cisco.com/en/US/docs/ios/ipaddr/configuration/guide/iad_dhcps
 ervidlink_mcp.html#wp1058967
 
 Arie

It indeed does!  It's only in the SE train, so now I need to analyze how
much I want this and what might break...


--
Jay Hennigan - CCIE #7880 - Network Engineering - j...@impulse.net
Impulse Internet Service  -  http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] PPPOE pass through Cisco Routers

2012-03-20 Thread Vinny_Abello
Congruent with your last suggestion, what about using L2TPv3 in a LAC/LNS sort 
of configuration? It's very easy to setup if you don't already have an MPLS 
enabled network deployed.

-Vinny

-Original Message-
From: cisco-nsp-boun...@puck.nether.net 
[mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Mike
Sent: Tuesday, March 20, 2012 9:28 AM
To: cisco-nsp@puck.nether.net
Subject: Re: [c-nsp] PPPOE pass through Cisco Routers

On 03/20/2012 05:07 AM, Cipriano Montero, Infostock wrote:


 As an environment as Wireless ISP, we are trying to deliver PPPOE
 connections to our clients, in a routed network. So, our first problem is to
 pass through PPPoE protocol over one or several cisco routers. Could
 somebody help us with this task?


This isn't the cisco answer you are looking for, however

PPPoE is a layer 2 protocol, and it (normally) requires that your 
clients are in the same broadcast domain as your PPPoE termination 
device (eg: plugged into the same switch for example). So, in a routed 
network, there won't normally be a layer 2 path here since you've got 
vlan's and / or routers connecting your network segments.

One choice could be to use a PPPoE relay agent. This would have a 
router listen on some interface for PPPoE frames and then relay them to 
another interface where your PPPoE server is residing. This works for 1 
hop when you have clients on one interface and the server is on another, 
but I don't think you want to try extending it beyond 1 hop.

Another choice - and the one I myself use - is to create a layer 2 vpn. 
I know there are cisco mpls solutions for this which someone else can 
comment on. I happen to use an opensource package called OpenVPN and 
it's stable and reliable. Effectively you'd have two boxes - one out in 
your network facing your wireless customers, and then another near your 
PPPoE server, and there would be a tunnel built on UDP that the traffic 
would pass thru. MTU isn't really a problem although if you have jumbo 
frame support internally it would reduce your packet fragmentation.

Good luck.

Mike-
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Cisco ASA IPSec VPN Problem

2012-03-20 Thread Covalciuc Piotr
Hello,

We have the following problem with IPSec Site-to-Site VPN between Cisco ASA.
The VPN establishes (IKE and IPSec phases are passed), but on my end I have
only TX traffic, no RX.

We've checked NAT (Exempt), ACL, routing. We've recreated the VPN from
scratch. But, without success.

And this problem is only with specific subnet: when we add another subnet
in VPN config, it works.

Do you know what else we have to check?

Thanks,
Piotr
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Cisco ASA IPSec VPN Problem

2012-03-20 Thread Jon Lewis

On Tue, 20 Mar 2012, Covalciuc Piotr wrote:


We have the following problem with IPSec Site-to-Site VPN between Cisco ASA.
The VPN establishes (IKE and IPSec phases are passed), but on my end I have
only TX traffic, no RX.


Who controls the other end?  So you're sending traffic via the VPN, but 
not receiving any?



And this problem is only with specific subnet: when we add another subnet
in VPN config, it works.


Can you elaborate on what you mean by add another subnet?


Do you know what else we have to check?


Probably the config at the other end...the one that's receiving your 
traffic but not sending any back.


--
 Jon Lewis, MCP :)   |  I route
 Senior Network Engineer |  therefore you are
 Atlantic Net|
_ http://www.lewis.org/~jlewis/pgp for PGP public key_
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] N7k CoPP versus rate-limiters

2012-03-20 Thread Tóth András
Hi Phil,

There are certain exceptions for packets being forwarded which are not
handled by CoPP, these are covered by the HW Rate Limiters.

Hardware rate-limiters protect the supervisor CPU from excessive
inbound traffic. The traffic rate allowed by the hardware
rate-limiters is configured globally and applied to each individual
I/O module. The resulting allowed rate depends on the number of I/O
modules in the system. CoPP provides more granular supervisor CPU
protection by utilizing the modular quality-of-service CLI (MQC).

Note that CoPP is applied per-linecard, so each module is allowed to
transmit the configured rate. There are 3 templates you can use for
CoPP, lenient, moderate and strict. The documentation describes them
and their values in detail. You can apply one or the other with the
'copp profile' command.


You can read more in detail about Configuring Rate Limits on the following link:
http://www.cisco.com/en/US/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6.x_chapter_011010.html

Below you can find the documentation for CoPP:
http://www.cisco.com/en/US/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6.x_chapter_011001.html


Best regards,
Andras


On Wed, Mar 14, 2012 at 12:41 PM, Phil Mayers p.may...@imperial.ac.uk wrote:
 All,

 We've just taken delivery of our first pair of N7k (and so far I'm
 impressed).

 I'm playing with porting our standard 6500 config to an equivalent N7k
 config, and I'm a bit puzzled by the interaction of CoPP and the hardware
 rate-limiters.

 On 6500/Sup720 these two features have well documented limitations and
 interaction - specifically HW rate-limiters pre-empt CoPP. I can't seem to
 find detailed information on how that works in the N7k.

 In general, what should I be using, for what?

 This is NX-OS 6, with M1 series linecards doing routing (MPLS).
 ___
 cisco-nsp mailing list  cisco-nsp@puck.nether.net
 https://puck.nether.net/mailman/listinfo/cisco-nsp
 archive at http://puck.nether.net/pipermail/cisco-nsp/

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] 2960S IOS

2012-03-20 Thread John Elliot

Hi Guys,
Have a pair of new 2960S's that are running 12.2(55)SE3 - Just after a 
recommendation on whether to upgrade to 12.2.58-SE2 or go to 15.0.1-SE2 ?
Cheers.   
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] 2960S IOS

2012-03-20 Thread John Elliot

 
 Hi John,
 
 I just upgrade our branch fleet of 2960s' to 15.0.1-SE2 if that helps.
 

Thanks Simon - No issues as yet I assume?

  
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] 2960S IOS

2012-03-20 Thread Alan Buxey
12.2.58 is not going anywhere, we're halfway through upgrading to 15.0 (first 
versions had some show stoppers but latest version okay..so far! ;) )

alan

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Filtering Routes with Private AS Numbers in the AS Path

2012-03-20 Thread Ivan
Hi,

For filtering private as numbers (64512-65535) using an as-path
access-list there are a few options I have seen:

1). All in one line
ip as-path access-list 66 permit
_(6451[2-9]|645[2-9][0-9]|64[6-9][0-9][0-9]|65[0-4][0-9][0-9]|655[0-2][0-9]|6553[0-5])_

2). The above modified hopefully to be better in terms or regexp
processing but perhaps not readability
ip as-path access-list 66 permit
_6(4(5(1[2-9]|[2-9][0-9])|[6-9][0-9][0-9])|5([0-4][0-9][0-9]|5([0-2][0-9]|3[0-5])))_

3). Separate lines
ip as-path access-list 66 permit _6451[2-9]_
ip as-path access-list 66 permit _645[2-9][0-9]_
ip as-path access-list 66 permit _64[6-9][0-9][0-9]_
ip as-path access-list 66 permit _65[0-4][0-9][0-9]_
ip as-path access-list 66 permit _655[0-2][0-9]_
ip as-path access-list 66 permit _6553[0-5]_

I would appreciate any feedback as to which is the least CPU intensive and
if there is a better way to optimise 2 above.

Thanks

Ivan


___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] 2960S IOS

2012-03-20 Thread Thomason, Simon
Hi John,

I just upgrade our branch fleet of 2960s' to 15.0.1-SE2 if that helps.

Cheers,

Simon.


-Original Message-
From: cisco-nsp-boun...@puck.nether.net 
[mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of John Elliot
Sent: Wednesday, 21 March 2012 9:13 AM
To: cisco-nsp
Subject: [c-nsp] 2960S IOS


Hi Guys,
Have a pair of new 2960S's that are running 12.2(55)SE3 - Just after a 
recommendation on whether to upgrade to 12.2.58-SE2 or go to 15.0.1-SE2 ?
Cheers.
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


RACQ gets more than 9 out of 10 cars going again – quick smart. That’s 
Australia’s highest success rate! Be part of Queensland’s largest club. Visit 
racq.com/roadsiderescue

Please Note: If you are not the intended recipient, please delete this email as 
its use is prohibited.  RACQ does not warrant or represent that this email is 
free from viruses or defects.  If you do not wish to receive any further 
commercial electronic messages from RACQ please e-mail unsubscr...@racq.com.au 
or contact RACQ on 13 19 05.
Please Note: 
If you are not the intended recipient, please delete this email as its use is 
prohibited. 
RACQ does not warrant or represent that this email is free from viruses or 
defects.
If you do not wish to receive any further commercial electronic messages from 
RACQ
please e-mail unsubscr...@racq.com.au or contact RACQ on 13 19 05.

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] 2960S IOS

2012-03-20 Thread Thomason, Simon
Not certain if anyone is looking into smart install or vstack but when you go 
to 15 train you get a few nicer features which is one of the reasons we have 
gone into the 15 train where we can.




-Original Message-
From: cisco-nsp-boun...@puck.nether.net 
[mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Thomason, Simon
Sent: Wednesday, 21 March 2012 9:16 AM
To: 'John Elliot'; cisco-nsp
Subject: Re: [c-nsp] 2960S IOS

Hi John,

I just upgrade our branch fleet of 2960s' to 15.0.1-SE2 if that helps.

Cheers,

Simon.


-Original Message-
From: cisco-nsp-boun...@puck.nether.net 
[mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of John Elliot
Sent: Wednesday, 21 March 2012 9:13 AM
To: cisco-nsp
Subject: [c-nsp] 2960S IOS


Hi Guys,
Have a pair of new 2960S's that are running 12.2(55)SE3 - Just after a 
recommendation on whether to upgrade to 12.2.58-SE2 or go to 15.0.1-SE2 ?
Cheers.
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


RACQ gets more than 9 out of 10 cars going again – quick smart. That’s 
Australia’s highest success rate! Be part of Queensland’s largest club. Visit 
racq.com/roadsiderescue

Please Note: If you are not the intended recipient, please delete this email as 
its use is prohibited.  RACQ does not warrant or represent that this email is 
free from viruses or defects.  If you do not wish to receive any further 
commercial electronic messages from RACQ please e-mail unsubscr...@racq.com.au 
or contact RACQ on 13 19 05.
Please Note:
If you are not the intended recipient, please delete this email as its use is 
prohibited.
RACQ does not warrant or represent that this email is free from viruses or 
defects.
If you do not wish to receive any further commercial electronic messages from 
RACQ
please e-mail unsubscr...@racq.com.au or contact RACQ on 13 19 05.

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

RACQ gets more than 9 out of 10 cars going again – quick smart. That’s 
Australia’s highest success rate! Be part of Queensland’s largest club. Visit 
racq.com/roadsiderescue

Please Note: If you are not the intended recipient, please delete this email as 
its use is prohibited.  RACQ does not warrant or represent that this email is 
free from viruses or defects.  If you do not wish to receive any further 
commercial electronic messages from RACQ please e-mail unsubscr...@racq.com.au 
or contact RACQ on 13 19 05.
Please Note: 
If you are not the intended recipient, please delete this email as its use is 
prohibited. 
RACQ does not warrant or represent that this email is free from viruses or 
defects.
If you do not wish to receive any further commercial electronic messages from 
RACQ
please e-mail unsubscr...@racq.com.au or contact RACQ on 13 19 05.

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] 2960S IOS

2012-03-20 Thread Jiri Prochazka

John,


we're using 15.0.1-SE2 (and 15.0.1-SE1) on aproximately 20 2960S's for a 
while and we have no problem so far.




Regards,


Jiri


Dne 21.3.2012 0:13, John Elliot napsal(a):


Hi Guys,
Have a pair of new 2960S's that are running 12.2(55)SE3 - Just after a 
recommendation on whether to upgrade to 12.2.58-SE2 or go to 15.0.1-SE2 ?
Cheers. 
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


--

Jiri Prochazka
network administrator (AS39392)
SuperNetwork s.r.o.

m: +420 777 87 37 67
w: http://www.superhosting.cz
e: jiri.procha...@superhosting.cz
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] 2960S IOS

2012-03-20 Thread John Elliot


 
 John,
 
 
 we're using 15.0.1-SE2 (and 15.0.1-SE1) on aproximately 20 2960S's for a 
 while and we have no problem so far.
 


Thanks to all who responded - have upgraded to 15.0(1)SE2...fingers crossed we 
encounter no issues :) 
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/