[c-nsp] CRS-1 Policy change

2011-02-23 Thread Vikas Sharma
Hi, I have a policy which I can see currently not applied on any interface, I am trying to modify the policy (remove existing class-map and add new class-map), but when I commit I see following message !!% Policy manager does not support this feature: Platform does not support policy-map

Re: [c-nsp] CRS-1 Policy change

2011-02-23 Thread Farhan Jaffer
Can you please confirm the modified configuration / new class-map? We are running same version on CRS-1s with no. of policies modification on need basis. This should not be the case... -FJ On Wed, Feb 23, 2011 at 1:14 PM, Vikas Sharma vikasshar...@gmail.comwrote: Hi, I have a policy which I

Re: [c-nsp] CRS-1 Policy change

2011-02-23 Thread Vikas Sharma
Hi Farhan, All other policies I am able to modify except this. Also this is the only policy with qos-group (for incoming packets) policy-map CR_QOS_FROM_PE-CORE class Premium-From-PE_CORE set qos-group 5 ! class Business1-From-PE-CORE set qos-group 3 ! class Business2-From-PE-CORE set

[c-nsp] CRC Errors on Ethernet Router

2011-02-23 Thread alex nyagah
Hi All, I am noting CRC errors on my Ethernet port on my cisco router, what could it be causing it.. -- ** ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at

Re: [c-nsp] CRC Errors on Ethernet Router

2011-02-23 Thread James Paussa
On 23/02/2011 9:19 PM, alex nyagah wrote: Hi All, I am noting CRC errors on my Ethernet port on my cisco router, what could it be causing it.. duplex mismatch, bad cable, cosmic rays. Send though a show interface from both ends. -James. ___

Re: [c-nsp] CRC Errors on Ethernet Router

2011-02-23 Thread Jon Harald Bøvre
duplex? On 23.02.2011 12:19, alex nyagah wrote: Hi All, I am noting CRC errors on my Ethernet port on my cisco router, what could it be causing it.. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net

Re: [c-nsp] CRC Errors on Ethernet Router

2011-02-23 Thread Mikael Abrahamsson
On Wed, 23 Feb 2011, alex nyagah wrote: I am noting CRC errors on my Ethernet port on my cisco router, what could it be causing it.. You have to provide more information. Is this copper or fiber, what speed, what is at the other end, how long is the cable etc. -- Mikael Abrahamsson

[c-nsp] Integration of Cisco CSM 3.3.1 with Cisco ACS 4.2

2011-02-23 Thread Farooq Razzaque
Dear I intergrated Cisco CSM 3.3.1 with Cisco ACS 4.2. After intergreting i am able to login with ACS users and user defined in system identity setup but i have don't have the sufficient previledge assiged (even i can't see the devices added in CMS). Also when CSM communicate first time

Re: [c-nsp] CRC Errors on Ethernet Router

2011-02-23 Thread Harold 'Buz' Dale
First thing I would do would be to check for a duplex mismatch and then check the wiring (either by replacing the cable if it's a simple patch or using a cable tester over the span.) You might also just physically trace it and see if someone decided to hang a fluorescent light off of it or

Re: [c-nsp] CRC Errors on Ethernet Router

2011-02-23 Thread Kasper Adel
Hi, Usually when Cyclic Redundancy Check (CRC) errors are incrementing in the show interface command output, it indicates that the cyclic redundancy checksum generated by the originating LAN/WAN device does not match the checksum calculated from the data received. On a LAN, this usually indicates

Re: [c-nsp] CRC Errors on Ethernet Router

2011-02-23 Thread alex nyagah
Thanks so much, I now have a point to start checking... alex On Wed, Feb 23, 2011 at 5:37 PM, Kasper Adel karim.a...@gmail.com wrote: Hi, Usually when Cyclic Redundancy Check (CRC) errors are incrementing in the show interface command output, it indicates that the cyclic redundancy

Re: [c-nsp] cisco-nsp Digest, Vol 99, Issue 67

2011-02-23 Thread Said Izawi
Hello umair: CONFIGURING BFD BFD can be configured in two steps. The first step in configuring BFD is setting the baseline parameters for all BFD sessions on an interface. The configuration occurs at the interface level and the syntax is as follows: [no] bfd interval 50-999 min_rx

[c-nsp] Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch

2011-02-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch Advisory ID: cisco-sa-20110223-telepresence-ctms Revision 1.0 For Public Release 2011 February 23

[c-nsp] Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server

2011-02-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server Advisory ID: cisco-sa-20110223-telepresence-ctrs Revision 1.0 For Public Release 2011 February 23 1600 UTC (GMT

Re: [c-nsp] the number of users decreas sharply on lns

2011-02-23 Thread David Rothera
A few months ago we started having issues on one of our LNS's (7602-VXR) and the issue was that the bearer that we had from the supplier (BT in our case) was being ~100% utilised for the bandwidth we had purchased but because it was only a percentage of the interface speed our NMS was not

[c-nsp] Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances

2011-02-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances Advisory ID: cisco-sa-20110223-asa Revision 1.0 For Public Release 2011 February 23 1600 UTC (GMT

[c-nsp] Cisco Security Advisory: Cisco Firewall Services Module Skinny Client Control Protocol Inspection Denial of Service Vulnerability

2011-02-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Cisco Firewall Services Module Skinny Client Control Protocol Inspection Denial of Service Vulnerability Document ID: 112893 Advisory ID: cisco-sa-20110223-fwsm Revision 1.0 For Public Release 2011 February 23 1600 UTC

[c-nsp] Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Endpoint Devices

2011-02-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Endpoint Devices Advisory ID: cisco-sa-20110223-telepresence-cts Revision 1.0 For Public Release 2011 February 23 1600

[c-nsp] Log Egress IP packet delivered via legacy inject pat

2011-02-23 Thread Righa Shake
Am getting numerous logs with the following message: Feb 23 20:54:02: %LSMPI-4-INJECT_FEATURE_ESCAPE: Egress IP packet delivered via legacy inject pat cant seems to make heads or tails of it. Kindly assist Regards, Righa Shake ___ cisco-nsp mailing

Re: [c-nsp] cisco 6500 and 40G

2011-02-23 Thread Nick Hilliard
On 23/02/2011 18:57, Dinesh wrote: Does Cisco 6500 (6500-E) support 40G interface ? Not currently, no. Nick ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at

[c-nsp] debug to see what IP is trying to log in via telnet

2011-02-23 Thread Alan Buxey
hi, okay...i appear to have mislaid some memory cells over the past month which coincides with a major bout of unable to drive google/bing or cisco.com properly(!) ;-) basically, auth logs show a device somewhere is trying to log into some switches with wrong user/pass. and I cant

Re: [c-nsp] debug to see what IP is trying to log in via telnet

2011-02-23 Thread Greg Whynott
wouldn't the IP of the host it speaks of in the logs? or does it just say failed log in from somewhere out on the network…? my logs have a src… %SEC-6-IPACCESSLOGP: list denied tcp 88.243.16.148(3900) - 10.142.7.1(23), 1 packet -g On Feb 23, 2011, at 2:40 PM, Alan Buxey wrote: hi,

Re: [c-nsp] debug to see what IP is trying to log in via telnet

2011-02-23 Thread Alan Buxey
Hi, wouldn't the IP of the host it speaks of in the logs? or does it just say failed log in from somewhere out on the network…? my logs have a src… %SEC-6-IPACCESSLOGP: list denied tcp 88.243.16.148(3900) - 10.142.7.1(23), 1 packet the device is on a legit bit of network so will be

Re: [c-nsp] debug to see what IP is trying to log in via telnet

2011-02-23 Thread Tóth András
Hi Alan, The following command might help. It needs aaa new-model to be enabled I believe. login on-failure log Feb 23 21:46:23.922: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: test] [Source: 10.0.0.1] [localport: 22] [Reason: Login Authentication Failed] at 21:46:23 CET Wed Feb 23 2011

Re: [c-nsp] debug to see what IP is trying to log in via telnet

2011-02-23 Thread Andrew Koch
On Wed, Feb 23, 2011 at 14:21, Alan Buxey a.l.m.bu...@lboro.ac.uk wrote: Hi, wouldn't the IP of the host it speaks of in the logs?  or does it just say failed log in from somewhere out on the network…? my logs have a src…  %SEC-6-IPACCESSLOGP: list  denied tcp 88.243.16.148(3900) -

Re: [c-nsp] debug to see what IP is trying to log in via telnet

2011-02-23 Thread Erik Soosalu
This seems to come back with the info in the log: login on-failure log sh log shows this: Feb 23 15:39:53.667: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] [Source: X.X.X.X] [localport: 23] [Reason: Login Authentication Failed] at 15:39:53 EST Wed Feb 23 2011 Thanks, Erik -Original

Re: [c-nsp] debug to see what IP is trying to log in via telnet

2011-02-23 Thread Alan Buxey
Hi, This seems to come back with the info in the log: login on-failure log sh log shows this: Feb 23 15:39:53.667: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] [Source: X.X.X.X] [localport: 23] [Reason: Login Authentication Failed] at 15:39:53 EST Wed Feb 23 2011 oh, if only all

Re: [c-nsp] debug to see what IP is trying to log in via telnet

2011-02-23 Thread Alan Buxey
Hi, You can log the successful ACL attempts too, even though the login ..of course! i'm always thinking of logging the bad things. thanks! alan ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp

Re: [c-nsp] cisco 6500 and 40G

2011-02-23 Thread Nick Hilliard
On 23/02/2011 22:07, Dinesh wrote: Thanks one of link on cisco website showed 2010 as the time line for 40G on 6500. if you know of the current time line ? is there any 40G planned for Cisco7606 ? 40G support depends on the sup2t, which has been delayed for some years. Cisco say it's due out

[c-nsp] RFC 1483 Bridged to PPPoE migration with Cisco 7401

2011-02-23 Thread Ned Schumann
We’re currently aggregating DSL connections with a Cisco 7401 using RFC 1483 bridged. We want to migrate from bridged to PPPoE and authenticate and assign IP addresses with RADIUS. We’re looking for sample configurations which have both 1483 bridged and PPPoE interfaces on the same box. We'd

Re: [c-nsp] cisco 6500 and 40G

2011-02-23 Thread Peter Rathlev
On Wed, 2011-02-23 at 14:07 -0800, Dinesh wrote: one of link on cisco website showed 2010 as the time line for 40G on 6500. if you know of the current time line ? Just like Sup2T and N7k MPLS, it's permanently available at the end of $(( $current_month + 4 )) or something. :-) -- Peter

[c-nsp] Bonded T3 Bandwidth issue

2011-02-23 Thread Lawrence
I have a bonded T3 that I have never been able to get over 45mbs. I have been on the phone with my ISP and they are able to verify that both circuits work and they feel bonded circuits are working fine and that any problem is on my side Does anybody know what could cause a bonded T3 not to be

Re: [c-nsp] Bonded T3 Bandwidth issue

2011-02-23 Thread John Neiberger
On Wed, Feb 23, 2011 at 8:40 PM, Lawrence cisco-...@theindianmaiden.com wrote: I have a bonded T3 that I have never been able to get over 45mbs. I have been on the phone with my ISP and they are able to verify that both circuits work and they feel bonded  circuits are working fine and that any

[c-nsp] Multicast Packet Loss over GRE

2011-02-23 Thread Dav A
Hi All, Was hoping someone can provide some advice with regards to troubleshooting a particularly painful multicast issue. The set up isnt particularly complex: Servers SwitchTunnel router (RP) GRE over WAN Tunnel router SwitchServers The tunnel router interfaces have been configured

Re: [c-nsp] Bonded T3 Bandwidth issue

2011-02-23 Thread Tim Pozar
How have you bonded the DS3? Typically load balancing on cisco boxes are per session so you will never get over anything beyond the speed of the link (45Mb/s). In order to do something beyond that, you need to load balance per packet. I wrote up this paper in '96 about how to do this with DS1s.

Re: [c-nsp] Bonded T3 Bandwidth issue

2011-02-23 Thread Stevan Zupanic
Keep in mind the Windows TCP scaling limitations, with default window sizes an RTT of 10ms gives you a maximum of 52Mbps. http://cisconet.com/traffic-analysis/throughput/104-tcp-throughput-calculati on-formula.html I am seeing a lot of this as customer bandwidth demands increase, this is the