Re: [c-nsp] ASR1k IOS recommendation

2010-11-19 Thread Elmar K. Bins
g...@greenie.muc.de (Gert Doering) wrote: currently, there's 2.4 through 2.6 and 3.1S available for download, Rest assured, this problem is going to be solved. I guess what you mean is that the part with the accessibility is going to be solved, right? ;-) Elmi. -- Machen Sie sich erst

[c-nsp] Cat6500 ipv6 nd raguard feature

2010-11-19 Thread Daniel Verlouw
(apologies for duplicates, thought this might be interesting for folks on both lists): Hi, In case anyone is looking into deploying the 'ipv6 nd raguard' feature introduced in SXI4 on Cat6.5k: I suggest you don't (for now, at least). We found an issue with it causing it to intermittently drop

Re: [c-nsp] ASR 1k, 3.1.0S MTU issues on PortChannel interfaces

2010-11-19 Thread Mark Tinka
On Friday, November 19, 2010 05:20:49 am Pshem Kowalczyk wrote: Yet another update. I turns out that the old 'turn it off and on again' worked. After I reload the box I got the MTU of the subinterfaces at 4400, which is good. I still had to use clns mtu (of 4379) to make it work. Which box

Re: [c-nsp] GLC-LH-SM vs SFP-GE-L

2010-11-19 Thread Mark Tinka
On Thursday, November 18, 2010 01:32:58 am Nick Hilliard wrote: because the 7600 is a router and the 6500 is a switch? You mean by wording? Because in practice, I sort of found the 7600 to be a switch too, pretending to be a router (when ES cards aren't in use) :-). Glad we never did buy

Re: [c-nsp] ASR1k IOS recommendation

2010-11-19 Thread Garry
On 19.11.2010 09:32, Elmar K. Bins wrote: g...@greenie.muc.de (Gert Doering) wrote: currently, there's 2.4 through 2.6 and 3.1S available for download, Rest assured, this problem is going to be solved. I guess what you mean is that the part with the accessibility is going to be solved,

Re: [c-nsp] Blackhole Inbound Traffic

2010-11-19 Thread Mark Tinka
On Thursday, November 18, 2010 11:21:05 am Pete Templin wrote: Likewise, your blackhole routes need to be longer than existing routing entries, or the more-specific routes will take precedence, regardless of local-pref. Which is why we limit customers to /32 (v4) and /128 (v6) when sending

Re: [c-nsp] GLC-LH-SM vs SFP-GE-L

2010-11-19 Thread Gert Doering
Hi, On Fri, Nov 19, 2010 at 04:26:14PM +0800, Mark Tinka wrote: Glad we never did buy these platforms. I'd be kicking myself right about now. Given the alternatives at the time, I still think we go the right choice - lots of port, lots of forwarding power, affordable price. We knew that

[c-nsp] MPLS TE tunnel and load-sharing via two P routers

2010-11-19 Thread Robert Hass
Hi I have small network consist 4 routers (all are VXRs, IOS 12.2(33)SRE2). PE1 is connected to P1 and P2 using STM-1 POS. PE-2 is connected like PE-1 by STM-1 links to P1 and P2 routers. Core P1 and P2 routers are interconnected by GigabitEthernet. Here is network diagram: p1 /|\ pe1 |

Re: [c-nsp] GLC-LH-SM vs SFP-GE-L

2010-11-19 Thread sthaug
For the next round of purchases, I'm not sure what we'll end up at. All real routers from $C tend to be a bit on the expensive side of things, so we might go for just a switch from $J - the MXes really look promising... and less politics there. A significant difference from 6500/7600

Re: [c-nsp] MPLS TE tunnel and load-sharing via two P routers

2010-11-19 Thread Oliver Boehmer (oboehmer)
p1 /|\ pe1 | pe2 \|/ p2 Are routers has iBGP, IS-IS, MPLS (LDP) and MPLS TE Tunnels enabled. I established MPLS TE tunnels from PE1 to PE2 but traffic is going only via path pe1-p1-pe2. Can I configure something inside TE Tunnel configuration to use both paths eg

Re: [c-nsp] ASR1k IOS recommendation

2010-11-19 Thread Mark Tinka
On Thursday, November 18, 2010 03:41:31 pm Garry wrote: we'll be receiving two ASR1k boxes these days (another one to be ordered shortly), and I was wondering which IOS I should be using ... we did some tests on a router provided by Cisco, which hasn't been long ago, and it seems like

Re: [c-nsp] MPLS TE tunnel and load-sharing via two P routers

2010-11-19 Thread Robert Hass
configure a different bandwidth, or use tunnel mpls traffic-eng load-share to distribute the traffic accordingly. this will modify the CEF hash results. Thanks for help Oli. I established second tunnel with explicit path and configured 'tunnel mpls traffic-eng load-share' on both. It works

Re: [c-nsp] Cat6500 ipv6 nd raguard feature

2010-11-19 Thread Andrew Yourtchenko
Daniel, excellent, thanks a lot for the info - I've updated the bug record so the others can benefit from this finding. cheers, andrew On Fri, 19 Nov 2010, Daniel Verlouw wrote: (apologies for duplicates, thought this might be interesting for folks on both lists): Hi, In case anyone is

[c-nsp] NAT translation rate limit issue

2010-11-19 Thread gregory williamson
Hi I could use some assitance. We are trying to limit simaltaneous connections by users and 1 for everything else. This is to prevent users from using certain programs like bit torrent, etc. When we add the following command to the router the NAT translation table fills and crashes and

Re: [c-nsp] GLC-LH-SM vs SFP-GE-L

2010-11-19 Thread Mark Tinka
On Friday, November 19, 2010 05:30:24 pm Gert Doering wrote: Given the alternatives at the time, I still think we go the right choice - lots of port, lots of forwarding power, affordable price. We knew that there were hardware limitations (VLAN space, netflow/tcp flags) but the alternatives

[c-nsp] New ACE30

2010-11-19 Thread Antonio Soares
New ACE30: http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps6906/product_bul letin_c25_632385.html And new Software: http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA4_ 1_0/release/note/ACE_mod_rn_A410.html So it’s possible to convert one ACE10 or ACE20 to

Re: [c-nsp] GLC-LH-SM vs SFP-GE-L

2010-11-19 Thread Mark Tinka
On Friday, November 19, 2010 05:51:27 pm sth...@nethelp.no wrote: We use our MX boxes purely as routers and are very happy with them in that role. Juniper, just so they can play in a larger space in your network, will even propose that you use the MX as a core switch. While it is feasible

[c-nsp] switch2950 feature

2010-11-19 Thread Deric Kwok
Hi There is resale switch2950(48 ports). I would like to buy it for office use. How do I know it is good? ls all regular switchs to support the truckport setting vlan to router? if not, how can I know this switch can have this feature? Thank you ___

Re: [c-nsp] PIX or ASA Privilege level access issue

2010-11-19 Thread David White, Jr. (dwhitejr)
Hi Edward, It sounds like you are missing the following line in your configuration: aaa authorization exec authentication-server Issue show curpriv after the user logs in to verify they are assigned the correct privilege level from the Radius server. Sincerely, David. Edward Iong wrote:

Re: [c-nsp] PIX or ASA Privilege level access issue

2010-11-19 Thread Robert Maier
simple answer Its NOT possible to assign priv level on PIX/ASAm you still have to type in enable. there is no such thing like exec authorization via aaa in the OS of the firewalls. It´s only possible in CATOS/IOS/NX-OS Am 19.11.2010 15:29, schrieb David White, Jr. (dwhitejr): Hi Edward,

Re: [c-nsp] switch2950 feature

2010-11-19 Thread Robert Maier
If you can deal with Fastethernet, then yes, it´s a perfect an simple Office switch. with the right IOS,also 802.1X with dynamic vlan aissgnment is possible. And yes 802.1Q is also no problem. Am 19.11.2010 15:19, schrieb Deric Kwok: Hi There is resale switch2950(48 ports). I would like to

[c-nsp] SPAs for ASR1k

2010-11-19 Thread Elmar K. Bins
Re guys, maybe someone here can help me with some reassurement. I've been looking for ASR-compatible ASRs, and the data sheet for SPA support points to a few documents about SPAs. In my case, the interesting one is the one about the Ethernet SPAs, at:

Re: [c-nsp] SPAs for ASR1k

2010-11-19 Thread Mark Tinka
On Friday, November 19, 2010 11:37:29 pm Elmar K. Bins wrote: I wonder now, whether anyone of you guys would know if that's just the typical Cisco sloppyness when it comes to documentation,... Yes, that'll work :-). So, what SPAs are you using in ASRs? We have the 5-port Gig-E SPA working

[c-nsp] DHCP Server - Default-router List

2010-11-19 Thread Tom
Does anyone know when you would specify multiple default routers in a dhcp pool? How would a client know which router to use? R1#sh run | s pool ip dhcp pool TEST network 155.1.146.0 255.255.255.0 default-router 155.1.146.10 155.1.146.1 --- dns-server 155.1.146.1 thank you in

Re: [c-nsp] 7609_uRFP Performance Impact

2010-11-19 Thread Nick Hilliard
On 18/11/2010 20:02, Victor Lyapunov wrote: I am examining the prospect of enabling urfp in a cisco 7609 / RSP 720 platform, for subscriber facing interfaces. Just be aware that enabling ipv6 urpf on an interface will cause that ipv6 traffic to be forwarded in software. Nick

Re: [c-nsp] 7609_uRFP Performance Impact

2010-11-19 Thread Grzegorz Janoszka
On 19-11-10 17:58, Nick Hilliard wrote: On 18/11/2010 20:02, Victor Lyapunov wrote: I am examining the prospect of enabling urfp in a cisco 7609 / RSP 720 platform, for subscriber facing interfaces. Just be aware that enabling ipv6 urpf on an interface will cause that ipv6 traffic to be

Re: [c-nsp] 7609_uRFP Performance Impact

2010-11-19 Thread Nick Hilliard
On 19/11/2010 17:38, Grzegorz Janoszka wrote: I guess it is also a case with 6500 sup720, isn't it? Does it depend on software version? it's an EARL7 limitation, so it affects everything up to and including the PFC3C and it doesn't depend on software revision. Nick

Re: [c-nsp] ASR1k IOS recommendation

2010-11-19 Thread Gert Doering
Hi, On Fri, Nov 19, 2010 at 09:32:03AM +0100, Elmar K. Bins wrote: g...@greenie.muc.de (Gert Doering) wrote: currently, there's 2.4 through 2.6 and 3.1S available for download, Rest assured, this problem is going to be solved. I guess what you mean is that the part with the

[c-nsp] Legitimate Access to IOS for Legacy/EOL devices

2010-11-19 Thread Brian Raaen
I was wondering if there was any legitimate way to get access to IOS for legacy devices. I have a 2611, 3725 and pair of 2950's in my home lab that I would like to test some things on. Thanks --- Brian Raaen ___ cisco-nsp mailing list

Re: [c-nsp] Legitimate Access to IOS for Legacy/EOL devices

2010-11-19 Thread Nick Hilliard
On 19/11/2010 22:07, Brian Raaen wrote: I was wondering if there was any legitimate way to get access to IOS for legacy devices. I have a 2611, 3725 and pair of 2950's in my home lab that I would like to test some things on. Thanks You could look back through Cisco's security advisories and

Re: [c-nsp] Legitimate Access to IOS for Legacy/EOL devices

2010-11-19 Thread Seth Mattinen
On 11/19/2010 14:07, Brian Raaen wrote: I was wondering if there was any legitimate way to get access to IOS for legacy devices. I have a 2611, 3725 and pair of 2950's in my home lab that I would like to test some things on. Thanks Right now any valid service contract will get you access

Re: [c-nsp] 7609_uRFP Performance Impact

2010-11-19 Thread Łukasz Bromirski
On 2010-11-19 19:06, Nick Hilliard wrote: On 19/11/2010 17:38, Grzegorz Janoszka wrote: I guess it is also a case with 6500 sup720, isn't it? Does it depend on software version? it's an EARL7 limitation, so it affects everything up to and including the PFC3C and it doesn't depend on software

Re: [c-nsp] Legitimate Access to IOS for Legacy/EOL devices

2010-11-19 Thread Tom Ammon
What happens on Dec. 13? On 11/19/2010 3:52 PM, Seth Mattinen wrote: On 11/19/2010 14:07, Brian Raaen wrote: I was wondering if there was any legitimate way to get access to IOS for legacy devices. I have a 2611, 3725 and pair of 2950's in my home lab that I would like to test some things

Re: [c-nsp] Legitimate Access to IOS for Legacy/EOL devices

2010-11-19 Thread David Rothera
They are moving over to a system where you will only be able to download SW for devices that you have active service contracts for. In comparison to the setup at the moment where as long as you have a valid contract for 1 device you can actually download the software for any device. On Sat, Nov