[c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread David Freedman
Had the idea of testing LAM to support an application without resorting to inter-datacenter bridging(*) (Vmotion in this case) , Astonished to find the documentation old and out of date, coupled with a lack of vrf support (no redistribute mobile in the VRF BGP context) , Can't seem to find

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Lincoln Dale
On 10/08/2010, at 5:43 PM, David Freedman wrote: Can't seem to find anything suggesting a feature which could quite easily be a superb alternative to bridging is even remotely vrf aware. Any advice/pointers appreciated. 1. OTV

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread David Freedman
I should have mentioned that my target trains are 12.2SX and 12.2SR :) 1. OTV http://www.ciscosistemi.net/en/US/prod/switches/ps9441/nexus7000_promo.html 2. EoMPLSoGRE http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/white_paper_ c11_493718.pdf Great, but both layer 2

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Alexander Clouter
David Freedman david.freed...@uk.clara.net wrote: Had the idea of testing LAM to support an application without resorting to inter-datacenter bridging(*) (Vmotion in this case) , Astonished to find the documentation old and out of date, coupled with a lack of vrf support (no redistribute

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Lincoln Dale
[i had replied to David off list but it seems his reply to me was bcc'd here. so to keep things relevant i'm posting the reply here too] On 10/08/2010, at 6:53 PM, David Freedman wrote: I should have mentioned that my target trains are 12.2SX and 12.2SR :) 6500/7600 are capable of

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Lincoln Dale
On 10/08/2010, at 6:35 PM, Alexander Clouter wrote: I was toying with the idea internally of putting a tiny OSPF router into our VM cluster to drag IP's from one side of our organisation to the other. reality is that many hosts and applications require and expect layer 2 connectivity for

Re: [c-nsp] ACL logging on n5k

2010-08-10 Thread Tassos Chatzithomaoglou
I'm using 4.1(3)N2(1) and the log option is not available. Should i guess an upgrade is needed, although release notes do not mention anything? -- Tassos Arie Vayner (avayner) wrote on 10/08/2010 12:43: Tassos, Looking here:

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Lincoln Dale
g'day, The only remaining question is why for it's money have VMWare not done the trivial task of making OSPF part of their VMotion malarkey...*sigh* because its not /quite/ as simple as you suggest. The awkward part I see is host based (not service) L3 connectivity. The operating

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Alexander Clouter
Hi, * Lincoln Dale l...@cisco.com [2010-08-10 19:56:21+1000]: On 10/08/2010, at 6:35 PM, Alexander Clouter wrote: I was toying with the idea internally of putting a tiny OSPF router into our VM cluster to drag IP's from one side of our organisation to the other. reality is that

Re: [c-nsp] ACL logging on n5k

2010-08-10 Thread Arie Vayner (avayner)
Seems to be in 4.1(3) too... http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/command /reference/rel_4_1/security_cmd_ref.html#wp1279114 Strange... Arie -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread David Freedman
i believe the common case is that vCenter today 'forces' all hosts in a 'cluster' to be in a common L2 domain, although i read something somewhere that said that it can be overruled. i haven't found the nerd knob to set that if there is such a thing. but even if there is such a nerd knob,

Re: [c-nsp] ACL logging on n5k

2010-08-10 Thread Tassos Chatzithomaoglou
n5k(config-acl)# deny ip any any ? CR dscpMatch packets with given dscp value fragments Check non-initial fragments precedence Match packets with given precedence value n5k(config-acl)# deny ip any any log ^ % Invalid ip address at '^' marker.

Re: [c-nsp] Bundling ports on different WS6704 linecards

2010-08-10 Thread Rin
A friend of mine suggests that all linecards should have the same DFC (3C, 3CXL, 3B etc...), else the port channel might not work properly. In our case, all of the linecards are DFC3B no service modules will be used so I believe it should be ok. Thanks, -Original Message- From:

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Alexander Clouter
Hi, * Lincoln Dale l...@cisco.com [2010-08-10 20:46:53+1000]: The only remaining question is why for it's money have VMWare not done the trivial task of making OSPF part of their VMotion malarkey...*sigh* because its not /quite/ as simple as you suggest. The awkward part I see is

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Alexander Clouter
Hi, * David Freedman david.freed...@uk.clara.net [2010-08-10 12:01:16+0100]: i believe the common case is that vCenter today 'forces' all hosts in a 'cluster' to be in a common L2 domain, although i read something somewhere that said that it can be overruled. i haven't found the nerd

Re: [c-nsp] Problems with dot1q trunk over EoMPLS with WS-X6148-GE-TX

2010-08-10 Thread Dan Voyer
Yo, the WS-6148-GE-TX does not support large frame. You need the WS-6748 for large frame ! And i believe you have a sup32, well that doesnt support large frame either, unless it's a sup32-10GE. Maybe you could use 1 port for each VLAN, that way you don't need the 4 bytes header from 802.1Q -

Re: [c-nsp] Problems with dot1q trunk over EoMPLS with WS-X6148-GE-TX

2010-08-10 Thread Dan Voyer
here it is: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/intrface.html#wpmkr1044296 have fun. On Tue, Aug 10, 2010 at 8:13 AM, Dan Voyer danvo...@gmail.com wrote: Yo, the WS-6148-GE-TX does not support large frame. You need the WS-6748 for large

Re: [c-nsp] Bundling ports on different WS6704 linecards

2010-08-10 Thread Phil Mayers
On 10/08/10 12:15, Rin wrote: A friend of mine suggests that all linecards should have the same DFC (3C, 3CXL, 3B etc...), else the port channel might not work properly. I don't see why (modulo the different QoS stuff I mentioned). We do port channels with one member on a 6716 and one on

Re: [c-nsp] ACL logging on n5k

2010-08-10 Thread Arvind .cisconsp
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetailsbugId=CSCth28899 http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetailsbugId=CSCth28899State: New Severity: Enhancement Version: 4.2(1)N1(1) On Tue, Aug 10, 2010 at 7:09 AM,

Re: [c-nsp] linux vpn client

2010-08-10 Thread Deric Kwok
yes. it works, thank you but I have to type every time. How can I save configure? ls it possible I can use the GUI to connect? Thank you On Mon, Aug 9, 2010 at 2:10 PM, Gabriel jarod...@gmail.com wrote: vpnc On Aug 9, 2010 9:07 PM, Deric Kwok deric.kwok2...@gmail.com wrote: Hi all Can

Re: [c-nsp] Bundling ports on different WS6704 linecards

2010-08-10 Thread David Hughes
On 09/08/2010, at 5:47 PM, Rin wrote: We are building a Core network of 3 7609 routers connecting as a 40Gbps ring. On each router we have 4 WS6704 linecards. Each router will be connected to other routers via 4 10G-links, these links will be configured as Port-Channel. The use of 6704

Re: [c-nsp] Problems with dot1q trunk over EoMPLS with WS-X6148-GE-TX

2010-08-10 Thread Everton da Silva Marques
On Tue, Aug 10, 2010 at 08:13:37AM -0400, Dan Voyer wrote: Yo, the WS-6148-GE-TX does not support large frame. You need the WS-6748 for large frame ! 6148 does not support jumbo frames, 6148A does. Everton ___ cisco-nsp mailing list

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread cisconsp
Not to side step the original question, but I see this kind of discussion frequently. This is another example of where the network can be made to solve a problem that it's best leaving up to a higher-level mechanism. In this case, if you have multi-site fault tolerance requirements between N

[c-nsp] Erspan on 7600

2010-08-10 Thread Martin Moens
Hi list, Does someone have experience with erspan on a 7600? Is this loading the CPU (rsp720 / ws-x6748-ge-tx) or is it handled in hardware? Martin ___ cisco-nsp mailing list cisco-nsp@puck.nether.net

Re: [c-nsp] Problems with dot1q trunk over EoMPLS with WS-X6148-GE-TX

2010-08-10 Thread Heath Jones
Im not sure if it helps, but I remember having a lot of trouble back doing DSL stuff - similar issues. There was a command: 'ip tcp mss-adjust' or something similar - might be worth having a look at.. On 8 August 2010 12:02, Marco Matarazzo marm...@gmail.com wrote: Hi all, was trying to

Re: [c-nsp] linux vpn client

2010-08-10 Thread Jan Gregor
Hi, there exists network-manager plugin for vpnc. Never used it though. Best regards, Jan On 08/10/2010 02:54 PM, Deric Kwok wrote: yes. it works, thank you but I have to type every time. How can I save configure? ls it possible I can use the GUI to connect? Thank you On Mon, Aug

Re: [c-nsp] Erspan on 7600

2010-08-10 Thread Tim Stevenson
Hi Martin, ERSPAN is handled by the hardware, either the central replication engine on the sup, or by the REs on the linecards themselves (depends on which sup LCs you have). In no case do we use the sup CPU to perform ERSPAN encap/decap. Tim At 07:10 AM 8/10/2010, Martin Moens averred:

Re: [c-nsp] Erspan on 7600

2010-08-10 Thread Martin Moens
Thanks Tim, Exactly what I wanted to hear :-) Martin Tim Stevenson mailto:tstev...@cisco.com wrote on 10/08/2010 16:59: Hi Martin, ERSPAN is handled by the hardware, either the central replication engine on the sup, or by the REs on the linecards themselves (depends on which sup LCs you

Re: [c-nsp] linux vpn client

2010-08-10 Thread Quinn Snyder
network-manager-vpnc in the ubuntu repos. little buggy. in my experience, no one client works for all profiles or vpn endpoints. shrewsoft, kvpnc, and nm-vpnc all are used on my system. ynmv. q. -= sent via iphone. please excuse spelling, grammar, and brevity =- On Aug 10, 2010, at 9:57, Jan

Re: [c-nsp] ACL logging on n5k

2010-08-10 Thread Arie Vayner (avayner)
Yes, it seems that ACL logging is not yet support on N5K, and CSCth28899 is there to track its introduction (no timeframe yet...) I am checking why the command reference shows as if it is supported... Arie -Original Message- From: cisco-nsp-boun...@puck.nether.net

Re: [c-nsp] 7606 config issue !!!

2010-08-10 Thread David Hughes
On 23/07/2010, at 9:45 AM, Jared Mauch wrote: Cisco has posted sxi4a. Has anyone identified any early issues with sxi4a ? Thanks David ... ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp

Re: [c-nsp] Nice EEM applet to protect against certain DDoS situations (sup720)

2010-08-10 Thread bas
On Mon, Aug 9, 2010 at 3:25 AM, Dobbins, Roland rdobb...@arbor.net wrote: On Aug 9, 2010, at 2:47 AM, bas wrote: And now imagine if I were a bad guy that has control over 50 compromised servers in networks that do not filter outbound spoofed traffic. We don't have to imagine it; this is

Re: [c-nsp] 7606 config issue !!!

2010-08-10 Thread Ge Moua
we just upgrade one of our core 6509 / 3bxl to this code a few days ago and so far no problem; you're probably looking for feedback on the the 7600 platform though. -- Regards, Ge Moua Network Design Engineer University of Minnesota | OIT - NTS -- On 8/10/10 4:28 PM, David Hughes wrote:

Re: [c-nsp] Erspan on 7600

2010-08-10 Thread Mack McBride
What about software switched traffic (mostly glean traffic)? Doesn't that get handled by the RP? Mack McBride Network Engineer Viawest, Inc. -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Tim Stevenson Sent: Tuesday,

[c-nsp] IPv6 ACL

2010-08-10 Thread Ivan
Can anyone confirm that IPv6 ACLs successfully match packets on upper layer protocols (ULP) such as TCP even when the Hop-by-Hop EH (extension header) is present? I found some information regarding matching ULPs when the AH extension header is present but have been unable to do the same for the

Re: [c-nsp] ACL logging on n5k

2010-08-10 Thread Lincoln Dale
N7K supports ACL logging, ACL time ranges, MAC packet-classify functionality etc., N5K does not currently support them. the mistake is that documentation was carried over to N5K from N7K without being changed. cheers, lincoln. On 11/08/2010, at 5:58 AM, Arie Vayner (avayner) wrote: Yes,