Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Aivars
Well, 19xx with a proper licensing will work. Everything else depends on pps and scale. Aivars I would recommend looking at the lower end ASR1Ks for that... Maybe ASR1001... Arie -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net]

Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Reuben Farrelly
No it won't. The OP wants a device which can handle 1G of throughput. A 1941 has the required MPLS, MTU and crypto functionality with a DATA and SECURITY license (and are quite adequate as a low end MPLS device of say, sub 100M) but it won't handle anywhere /remotely/ near 1G of throughput -

Re: [c-nsp] Cisco 7200 LNS Multilink per-user RADIUS attributes

2012-08-08 Thread Steve Glendinning
Thanks for your reply Hitesh. On 8 August 2012 04:49, Hitesh Vinzoda vinzoda.hit...@gmail.com wrote: Try using Radreply as Cisco-Avpair += multilink:max-links=2 instead of = RADIUS is all served from a database and is configured correctly. I've checked on the LNS, and all the attributes

Re: [c-nsp] Cisco 7200 LNS Multilink per-user RADIUS attributes

2012-08-08 Thread Steve Glendinning
Hi Wayne, On 8 August 2012 10:23, Wayne Lee linkconn...@googlemail.com wrote: Let's see the virtual-template. Our's has ppp multilink set in it. Here it is, and ppp multilink is set: multilink virtual-template 1 interface Virtual-Template1 ip unnumbered Loopback1 ip verify unicast

Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Aivars
Alright, sorry. Missed the part about 1G. In that case I agree, that the smallest ASR1k will be needed. Aivars No it won't. The OP wants a device which can handle 1G of throughput. A 1941 has the required MPLS, MTU and crypto functionality with a DATA and SECURITY license (and are quite

Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Gert Doering
Hi, On Wed, Aug 08, 2012 at 10:16:56AM +0300, Aivars wrote: Well, 19xx with a proper licensing will work. Everything else depends on pps and scale. I want to see that. MPLS over GRE over *IPSEC* with 1 Gbit/sec using a 19xx (the original poster explicitely mentioned 1 Gbit/sec as

Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Gert Doering
Hi, On Wed, Aug 08, 2012 at 01:50:21PM +0300, Aivars wrote: Alright, sorry. Missed the part about 1G. In that case I agree, that the smallest ASR1k will be needed. Can the ASR1k *do* this, as in it is implemented, officially supported, and documented to work? gert -- USENET is *not* the

Re: [c-nsp] Cisco 7600/SUP720-3BXL SRD - SRE = Egress - Ingress Multicast Replication Mode

2012-08-08 Thread Emanuel Popa
After opening a SR for the issue below, Cisco TAC called to tell us that SRE defaults to ingress replication without giving us any solid reason for it. Also the TAC engineer clearly stated that we will see no big difference between ingress and egress replication mode. He also advised that if we

Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Andrew Miehs
Sent from a mobile device On 08/08/2012, at 21:11, Gert Doering g...@greenie.muc.de wrote: Hi, On Wed, Aug 08, 2012 at 01:50:21PM +0300, Aivars wrote: Alright, sorry. Missed the part about 1G. In that case I agree, that the smallest ASR1k will be needed. Can the ASR1k *do* this, as in

[c-nsp] me3600 svi's not showing in and out bit counts that i see on corresponding phy int

2012-08-08 Thread Aaron
anybody know why me3600 svi doesn't seem to show in and out bit counts that the underlying phy int shows? all svi's (10,11,13) are in a vrf running over mpls l3vpn 3600#sh int vl 10 | in 30 sec 30 second input rate 2000 bits/sec, 3 packets/sec 30 second output rate 1000 bits/sec, 3

Re: [c-nsp] ASR9K bundle-id 123 mode on

2012-08-08 Thread adam vitkovsky
Oooh yes you're right I totally forgot about that, right the standby ASR9K has to keep the port on dual homed device in check Though that can be done either via LACP priority change or via Brute-force -meaning the standby ASR9K will shut-down the standby port -I'll try the second mode of operation

Re: [c-nsp] Cisco 7600/SUP720-3BXL SRD - SRE = Egress - Ingress Multicast Replication Mode

2012-08-08 Thread John Neiberger
On Wed, Aug 8, 2012 at 5:30 AM, Emanuel Popa emanuel.p...@gmail.com wrote: After opening a SR for the issue below, Cisco TAC called to tell us that SRE defaults to ingress replication without giving us any solid reason for it. Also the TAC engineer clearly stated that we will see no big

[c-nsp] Loop/Unreachable problem with C6500/SUP720

2012-08-08 Thread Sebastian Wiesinger
Hello, I'm having a strange problem with a Cisco 6500/SUP720 running 12.2(33)SXJ3. Currently we're testing this router in the lab. We have one OSPF connection to the outside and iBGP enabled. As soon as I enable the iBGP i get really strange effects: I have 10.1.66.0/25 connected to a SVI

Re: [c-nsp] Cisco 7600/SUP720-3BXL SRD - SRE = Egress - Ingress Multicast Replication Mode

2012-08-08 Thread Emanuel Popa
On Wed, Aug 8, 2012 at 5:14 PM, John Neiberger jneiber...@gmail.com wrote: On Wed, Aug 8, 2012 at 5:30 AM, Emanuel Popa emanuel.p...@gmail.com wrote: After opening a SR for the issue below, Cisco TAC called to tell us that SRE defaults to ingress replication without giving us any solid reason

Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Robert E. Seastrom
Gert Doering g...@greenie.muc.de writes: Hi, On Wed, Aug 08, 2012 at 10:16:56AM +0300, Aivars wrote: Well, 19xx with a proper licensing will work. Everything else depends on pps and scale. I want to see that. MPLS over GRE over *IPSEC* with 1 Gbit/sec using a 19xx (the original poster

Re: [c-nsp] me3600 svi's not showing in and out bit counts that i see on corresponding phy int

2012-08-08 Thread Xu Hu
Try to set the load-interval to 30s, then check again. Thanks and regards, Xu Hu On 8 Aug, 2012, at 21:54, Aaron aar...@gvtc.com wrote: anybody know why me3600 svi doesn't seem to show in and out bit counts that the underlying phy int shows? all svi's (10,11,13) are in a vrf running

Re: [c-nsp] Loop/Unreachable problem with C6500/SUP720

2012-08-08 Thread Xu Hu
Are this routes all running in the ospf and bgp at the same time? If yes, it is a normal behaviour. Thanks and regards, Xu Hu On 8 Aug, 2012, at 22:27, Sebastian Wiesinger cisco-...@ml.karotte.org wrote: Hello, I'm having a strange problem with a Cisco 6500/SUP720 running 12.2(33)SXJ3.

Re: [c-nsp] Loop/Unreachable problem with C6500/SUP720

2012-08-08 Thread Gert Doering
Hi, On Thu, Aug 09, 2012 at 12:29:12AM +0800, Xu Hu wrote: Are this routes all running in the ospf and bgp at the same time? If yes, it is a normal behaviour. This is a *connected* network, and as such, by no means normal - and from the output of the show commands Sebastian posted, you can

Re: [c-nsp] Loop/Unreachable problem with C6500/SUP720

2012-08-08 Thread Tim Densmore
On 8/8/2012 10:29 AM, Xu Hu wrote: If yes, it is a normal behaviour. Hi, Can you explain in what circumstance this would be normal? IIRC, OSPF has an AD of 110 and iBGP 200, so even if the routes weren't known via connected, how would they randomly compete for space in the FIB? I don't

Re: [c-nsp] Cisco 7600/SUP720-3BXL SRD - SRE = Egress - Ingress Multicast Replication Mode

2012-08-08 Thread John Neiberger
On Wed, Aug 8, 2012 at 8:41 AM, Emanuel Popa emanuel.p...@gmail.com wrote: On Wed, Aug 8, 2012 at 5:14 PM, John Neiberger jneiber...@gmail.com wrote: On Wed, Aug 8, 2012 at 5:30 AM, Emanuel Popa emanuel.p...@gmail.com wrote: After opening a SR for the issue below, Cisco TAC called to tell us

Re: [c-nsp] Loop/Unreachable problem with C6500/SUP720

2012-08-08 Thread Sebastian Wiesinger
* Xu Hu jstuxuhu0...@gmail.com [2012-08-08 18:30]: Are this routes all running in the ospf and bgp at the same time? If yes, it is a normal behaviour. Hello, as Gert pointed out, the networks are connected (I also have another network, which is a static route (redistributed into OSPF), which

Re: [c-nsp] Loop/Unreachable problem with C6500/SUP720

2012-08-08 Thread Randy
As Gert has already pointed out, under no circumstances is the *normal behavior*. This is the result of either a mis-configuration or bug - hard to tell without looking at OP's ospf/bgp config. I am on sxi; similar setup with no issues. ./Randy --- On Wed, 8/8/12, Tim Densmore

Re: [c-nsp] Loop/Unreachable problem with C6500/SUP720

2012-08-08 Thread Randy
...also curious: If there is a discrepancy between sh ip cef perfix and sh ip cef prefix internal for prefixes in question. Regards, ./Randy --- On Wed, 8/8/12, Sebastian Wiesinger cisco-...@ml.karotte.org wrote: From: Sebastian Wiesinger cisco-...@ml.karotte.org Subject: Re: [c-nsp]

Re: [c-nsp] Loop/Unreachable problem with C6500/SUP720

2012-08-08 Thread Juergen Marenda
(proxy-) ARP on wrong Interface / vlan ? You have random /32 more specific host-routes, compare mac-address table and arp-cache for the current wrong routed ip. Or are the ip's those found as ospf router-id ? Hope this help's, Juergen -Original Message- From:

Re: [c-nsp] me3600 svi's not showing in and out bit counts that isee on corresponding phy int

2012-08-08 Thread Juergen Marenda
on 4900M ! int vlan NNN counter ! did help (yes i know the 4900M ist not a metro switch) Mit freundlichen Gru?en Kind regards Veuillez agreer mes salutations distinguees Met vriendelijke groet Juergen. Try to set the load-interval to 30s, then check again. Xu Hu On 8 Aug, 2012,

Re: [c-nsp] MPLS over GRE/IPSEC

2012-08-08 Thread Arie Vayner (avayner)
Well, ASR1K can do MPLSoGREoIPSec Encryption is done in HW on a dedicated resource, so it does not impact performance (but has its own capacity per ESP module type, which is way above 1Gbps on any of the models) The QOS marking would be based on precedence (only 3 bits), as the original IP