Re: [c-nsp] terminating many l2l tunnels on an ASA

2008-09-19 Thread Alex Balashov
Well, the ASAs do have a nice Java GUI with a high level of sophistication similar to the PIX's and VPN Concentrators. That can definitely help cut down on management clutter, and is the easier way to manage an ASA anyhow, seeing as its config format is just as abstruse and different from

Re: [c-nsp] Cisco ASA VPN Active/Standby - license requirements

2008-09-19 Thread Garry
Petreski, Samuel wrote: Hi everyone, I was wondering if any of you are running Cisco ASA 5500 in a VPN failover mode and if you would be willing to share the license requirements. I am thinking of running two boxes in Active/Standby mode and was wondering if I need to purchase the same

Re: [c-nsp] PA-POS-1OC3 vs. PA-A3-OC3SMI

2008-09-19 Thread marco
Yep. The PA-MC-STM-1: http://www.cisco.com/en/US/prod/collateral/modules/ps2033/ps2762/product_data_sheet09186a008007d6c0.html This card looks like it's more at home on the Europe side of the pond, i.e. handling STM1s, and breaking service down to E1s. You're absolutely right, of course.

Re: [c-nsp] PA-POS-1OC3 vs. PA-A3-OC3SMI

2008-09-19 Thread Eric Van Tol
-Original Message- From: [EMAIL PROTECTED] [mailto:cisco-nsp- [EMAIL PROTECTED] On Behalf Of Rubens Kuhl Jr. Sent: Friday, September 19, 2008 12:12 AM To: David Aldworth Cc: cisco-nsp@puck.nether.net Subject: Re: [c-nsp] PA-POS-1OC3 vs. PA-A3-OC3SMI PE-1CHOC3-SMIR-QPP PIC for the

Re: [c-nsp] PA-POS-1OC3 vs. PA-A3-OC3SMI

2008-09-19 Thread nasir.shaikh
Sorry for cutting in into this thread but from the responses looks like my question would fit here too. We are about to provide a customer with a price for upgrading one of the STM-1 ISP links to an STM-4 link with a 200 Mb port. The router we have in place is a 7206 VXR NPE G1. What card would

Re: [c-nsp] PA-POS-1OC3 vs. PA-A3-OC3SMI

2008-09-19 Thread sthaug
We are about to provide a customer with a price for upgrading one of the STM-1 ISP links to an STM-4 link with a 200 Mb port. The router we have in place is a 7206 VXR NPE G1. What card would be suitable in this router to do the trick? I can't find an OC12 card using the configurator. The

Re: [c-nsp] Cisco ASA VPN Active/Standby - license requirements

2008-09-19 Thread Tony Varriale
Garry is correct. Both boxes must be the same, including licenses. Unfortunately, it doesn't work like the ol' days. I brought this up (amongst other items) to the ASA PM recently. tv - Original Message - From: Garry [EMAIL PROTECTED] To: Petreski, Samuel [EMAIL PROTECTED] Cc:

[c-nsp] Switch Module

2008-09-19 Thread Ahmed Mohamed
Hello , i have CS65013 switches with some new modules installed on it due to a documentation problem, i don't know which module was installed recently is there any command that can give me the uptime of the module? ___ cisco-nsp mailing list

Re: [c-nsp] PA-POS-1OC3 vs. PA-A3-OC3SMI

2008-09-19 Thread Lamar Owen
On Thursday 18 September 2008 14:43:19 David Aldworth wrote: We are looking for a fully channelized OC3 interface for a Cisco 7200 VXR. Something that we can break individual T1's off of. In researching this there are two routes: PA-POS-1OC3 or PA-A3-OC3SMI. The first is SONET and the second

Re: [c-nsp] PA-POS-1OC3 vs. PA-A3-OC3SMI

2008-09-19 Thread Robert Boyle
At 02:43 PM 9/18/2008, David Aldworth wrote: We are looking for a fully channelized OC3 interface for a Cisco 7200 VXR. Something that we can break individual T1's off of. In researching this there are two routes: PA-POS-1OC3 or PA-A3-OC3SMI. The first is SONET and the second is ATM. Other than

Re: [c-nsp] PA-POS-1OC3 vs. PA-A3-OC3SMI

2008-09-19 Thread Justin M. Streiner
On Fri, 19 Sep 2008, [EMAIL PROTECTED] wrote: Sorry for cutting in into this thread but from the responses looks like my question would fit here too. We are about to provide a customer with a price for upgrading one of the STM-1 ISP links to an STM-4 link with a 200 Mb port. The router we

Re: [c-nsp] ISIS and CoPP on 760X

2008-09-19 Thread Justin Shore
My understanding is that you have to use class-default to match IS-IS and a bunch of other things. The Press book Router Security Strategies has a good amount of info on CoPP, complete with sample config. Justin Frederic LOUI wrote: Hi all, We're currently using Receive-ACL(s) in order to

Re: [c-nsp] ISIS and CoPP on 760X

2008-09-19 Thread Frederic LOUI
Hi, My understanding is that you have to use class-default to match IS-IS and a bunch of other things. The Press book Router Security In terms of security, I prefer to have a strict policy so that in class-default section, I'd rather drop everything that I'm not aware of. Strategies

Re: [c-nsp] ISIS and CoPP on 760X

2008-09-19 Thread Saku Ytti
On (2008-09-19 09:28 -0500), Justin Shore wrote: My understanding is that you have to use class-default to match IS-IS and a bunch of other things. The Press book Router Security Strategies has a good amount of info on CoPP, complete with sample config. I would recommend against using

Re: [c-nsp] ISIS and CoPP on 760X

2008-09-19 Thread Saku Ytti
On (2008-09-19 16:38 +0200), Frederic LOUI wrote: The cornerstone for me is to identify if match protocol clns|clns_is|clns_es is available and can be applied on 760X using 122-33SRC1 so that I can match ISIS pack in my IGP class and finally drop/apply low rate to everything in

Re: [c-nsp] separation of transit, peerings and this-AS traffic (long)

2008-09-19 Thread Gert Doering
Hi, On Sun, Sep 14, 2008 at 11:48:45PM +0200, Tomas Hlavacek wrote: The point is how to make packets traveling from upstreams of AS1 to AS2 not to take path via IX, but via direct Ethernet connection while traffic originating in AS1 and traffic from AS3 traveling trough AS1 take path via

Re: [c-nsp] SXH3 ghost bugs - more details

2008-09-19 Thread Gert Doering
Hi, On Thu, Sep 18, 2008 at 08:36:43PM -0400, Jared Mauch wrote: On Thu, Sep 18, 2008 at 10:13:16PM +0200, Gert Doering wrote: On Tue, Sep 16, 2008 at 06:58:49PM +0200, Gert Doering wrote: I've got no bug ID, but it's on case SR 609537689. Thanks. I'll forward this - and let's see

Re: [c-nsp] SXH3 ghost bugs - more details

2008-09-19 Thread Peter Rathlev
On Fri, 2008-09-19 at 18:51 +0200, Gert Doering wrote: On Thu, Sep 18, 2008 at 08:36:43PM -0400, Jared Mauch wrote: Your bug (CSCsu59917) should also be listed on CCO. cut What does CCO say about it, right now? (Don't want to check - $very expensive GPRS link...) Probably not totally

Re: [c-nsp] SXH3 ghost bugs - more details

2008-09-19 Thread Winders, Timothy A
On 9/19/08 12:23 PM, Peter Rathlev [EMAIL PROTECTED] wrote: On Fri, 2008-09-19 at 18:51 +0200, Gert Doering wrote: On Thu, Sep 18, 2008 at 08:36:43PM -0400, Jared Mauch wrote: Your bug (CSCsu59917) should also be listed on CCO. cut What does CCO say about it, right now? (Don't want to check

[c-nsp] RES: Switch Module

2008-09-19 Thread Leonardo Gama Souza
attach mod_number show ver Cheers, Leonardo Gama. De: [EMAIL PROTECTED] em nome de Ahmed Mohamed Enviada: sex 19/9/2008 09:45 Para: cisco-nsp@puck.nether.net Assunto: [c-nsp] Switch Module Hello , i have CS65013 switches with some new modules installed on

Re: [c-nsp] RES: Switch Module

2008-09-19 Thread Tassos Chatzithomaoglou
Or the one-liner: remote command module X sh ver | i uptime -- Tassos Leonardo Gama Souza wrote on 19/09/2008 22:20: attach mod_number show ver Cheers, Leonardo Gama. De: [EMAIL PROTECTED] em nome de Ahmed Mohamed Enviada: sex 19/9/2008 09:45 Para:

Re: [c-nsp] ISIS and CoPP on 760X

2008-09-19 Thread Shankar Vemulapalli (svemulap)
Take a look at the release note of the CSCsb96106 on CCO which offers good config. info. Also, you need to have 'mls qos protocol isis pass-through' global command. http://www.cisco.com/en/US/docs/ios/qos/command/reference/qos_m2.html#wp 1014614 Hope it helps. /Shankar -Original

Re: [c-nsp] Cisco ZX and HP LH

2008-09-19 Thread Tim Durack
Should work - they are both 1550 optics. You might need some attenuators on either side. HP says: Maximum distance: - 10-70,000 m (singlemode fiber) *Notes* For distances less than 20km, a 10dB attenuator must be used. For distances between 20km and 40km, a 5dB attenuator must be used.

[c-nsp] VPLS and cisco

2008-09-19 Thread MKS
Which cisco boxes do VPLS out of the box ? I know about the 7600 uplink line card issues. What about 7200 / 7300 / ASR / GSR etc. Is there any combo of hw / sw that runs VPLS sufficiently stable for an SP and without the mirard of bugs (unlike SRB1/2 for 7600) regards MKS

[c-nsp] GRE over IPSec

2008-09-19 Thread Justin Shore
I'm trying to figure out if a router can push a GRE tunnel over top of an IPSec tunnel that's originated on the same router, through an ASA terminating the other end of the IPSec tunnel and to another IOS router behind the ASA. I've seen this done with an ASA at both sites in front of the

Re: [c-nsp] Cisco 2820 Password Recovery

2008-09-19 Thread Daniel Hooper
Don’t you mean 2620? 28xx isn’t ancient by any means. Sending a break to the console during the router booting is the only way I've known to recover from a lost password. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Crist Clark Sent: Saturday, 20

Re: [c-nsp] Cisco 2820 Password Recovery

2008-09-19 Thread Church, Charles
Not sure what version you've got, but they talk about it here: http://www.cisco.com/en/US/products/hw/switches/ps574/products_password_recovery09186a00800a6c79.shtml Chuck -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Crist Clark Sent: Friday,

Re: [c-nsp] Cisco 2820 Password Recovery

2008-09-19 Thread Crist Clark
On 9/19/2008 at 4:38 PM, Daniel Hooper [EMAIL PROTECTED] wrote: Don’t you mean 2620? No, I mean Catalyst 2820, http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps597/prod_end-of-life_notice0900aecd8055eb4d.html Sending a break to the console during the router booting is the only

Re: [c-nsp] terminating many l2l tunnels on an ASA

2008-09-19 Thread Christian Koch
I don't believe that is what he is asking.. The way I interperted his question was If there is a way to consolidate his configuration... Something like using peer-groups and peer-templates with BGP to group identical-configuration-items... If so, I don't know of anyway to do so..but if there is

Re: [c-nsp] GRE over IPSec

2008-09-19 Thread Luan Nguyen
Justin, You could try the following: crypto isakmp policy 10 encr 3des authentication pre-share group 2 crypto isakmp key cisco address j.j.j.j ! ! crypto ipsec transform-set 3dessha esp-3des esp-sha-hmac ! crypto map vpn 10 ipsec-isakmp set peer j.j.j.j set transform-set 3dessha set pfs

Re: [c-nsp] Cisco 2820 Password Recovery

2008-09-19 Thread Farhan Ali Khan
Clark Go through with following http://www-tss.cisco.com/eservice/compass/common/activities/password_cat_190 0.htm For both firmware 1.09 1.10 v. Regards Farhan Ali Khan -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Crist Clark Sent: 20 September,

Re: [c-nsp] VPLS and cisco

2008-09-19 Thread Farhan Ali Khan
7206 and above Regards Farhan Ali Khan -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of MKS Sent: 20 September, 2008 1:56 AM To: cisco-nsp@puck.nether.net Subject: [c-nsp] VPLS and cisco Which cisco boxes do VPLS out of the box ? I know about the 7600