Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Adam Vitkovsky
However, we also configure the routers with eBGP peers to originate defaults into the IGP, presumably for faster convergence, although given the design I really don't know that convergence will be that much faster. So than you must also be using the bgp nexthop route-map or nexthop

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Saku Ytti
On (2013-01-20 09:41 -0700), John Neiberger wrote: This is sort of a follow-up to a question I had a few weeks ago about how to configure conditional default origination in IOS XR. It seems that ISIS default origination in both IOS and IOS XR behaves in a pretty suboptimal way. I don't have a

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
Hi Pete, Interesting point. I'll verify this tomorrow. Thank you. Best Regards, Alex. On Jan 22, 2013 5:55 AM, Pete Lumbis alum...@gmail.com wrote: Do you have any ports in that VLAN that are not on the SIP? On Mon, Jan 21, 2013 at 7:19 PM, Alex K. nsp.li...@gmail.com wrote: Hi Pete,

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
Hi Oliver, Exactly - not supported. It implies that *if it works (not on SIP-200), it must be software'. I came across this document before I sent the question. As it seems, that what I'll use. I'm looking for a document that say implicitly 'NBAR implementation is software based' to be sure we

[c-nsp] advertise best-external

2013-01-22 Thread Adam Vitkovsky
Hi Folks, I know I mentioned this one on the list earlier But I just want to put the rumors to the rest once and forever So is it alright to configure the advertise best-external on all PEs under the vpnv4 address-family? Or do I need to be worried about some weird loop voodoo? And thus

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
* say explicitly ... On Jan 22, 2013 11:47 AM, Alex K. nsp.li...@gmail.com wrote: Hi Oliver, Exactly - not supported. It implies that *if it works (not on SIP-200), it must be software'. I came across this document before I sent the question. As it seems, that what I'll use. I'm looking

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Oliver Boehmer (oboehmer)
Alex, not sure what you're looking for. Not supported means you're on your own, use it at your own risk and expect things can go wrong. It could be switched in software in one release (which might be fine and serve your purpose as long as the traffic stays below given threshold or it doesn't

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Andrew Miehs
On Tue, Jan 22, 2013 at 8:20 PM, Saku Ytti s...@ytti.fi wrote: On (2013-01-20 09:41 -0700), John Neiberger wrote: This is sort of a follow-up to a question I had a few weeks ago about how to configure conditional default origination in IOS XR. It seems that ISIS default origination in

Re: [c-nsp] 7204VXR reboots

2013-01-22 Thread Gert Doering
Hi, On Mon, Jan 21, 2013 at 01:10:51PM -0800, Joe Pruett wrote: i have a general question about the 12.x vs 15.x versions. i have been running 12.4.25 on my 7206 vxr boxes and have been thinking of trying the 15.x stuff. there are a couple things that i haven't been able to figure out. 1.

Re: [c-nsp] 7204VXR reboots

2013-01-22 Thread Reuben Farrelly
On 22/01/2013 9:59 PM, Gert Doering wrote: Nobody knows what's inside any given IOS build. As a rule of thumb, whenever you want to turn on something new, the specific combination of hardware + software + feature pack that you have will not support it. (Yes, this does annoy me to no end)

[c-nsp] ASR Faulty Sensor

2013-01-22 Thread Antonio Soares
Group, Anyone has seen something like this ? +++ ASR1006# show facility-alarm status System Totals Critical: 1 Major: 0 Minor: 0 Source Severity Description [Index] -- ---

Re: [c-nsp] ASA5585-X IPS Upgrade causes ASA failover

2013-01-22 Thread Antonio Soares
TAC tells me that is related with this bug: +++ CSCud41702 Bug Details IPS: After IPS config change, a false failover occurs with the ASA Symptom: Immediately after an IPS config change, an ASA failover occurs with the following messages: Nov 14 23:01:41

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
Yes I know. I'm looking for a best match. I've already sent an email to my local SE. The point is that I need something official that will state 'yes, it's done by software, cpu impact is expected'. Best Regards, Alex. On Jan 22, 2013 11:58 AM, Oliver Boehmer (oboehmer) oboeh...@cisco.com

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Andy Ellsworth
If the PFC doesn't support it, it's done in software (or not at all). This is Cat6500 fundamentals. Q.E.D. On Tue, Jan 22, 2013 at 5:32 AM, Alex K. nsp.li...@gmail.com wrote: Yes I know. I'm looking for a best match. I've already sent an email to my local SE. The point is that I need

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Pete Lumbis
I can tell you from internal documentation that this is what happens. Only SIP-200 possesses the hardware to do these operations on the card. Everything else will hit a hardware forwarding exception and punt to CPU to see if the CPU can figure out what to do with it. On Tue, Jan 22, 2013 at 6:32

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Saku Ytti
On (2013-01-22 21:38 +1100), Andrew Miehs wrote: If you have a full routing table, you don't need a default route. If you don't have full routing tables, or want/ need a default route - point it to your two major up-streams. If one of the up-streams gets disconnected from core, only

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
Hi Andy, Cat6500 is a distributed environment. Not only PFC (or any other one part for this matter) is responsible for capabilities. Alex. On Jan 22, 2013 2:27 PM, Andy Ellsworth a...@dar.net wrote: If the PFC doesn't support it, it's done in software (or not at all). This is Cat6500

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
Hi Pete, Thank you. By any chance, some of this may become public? Someone asked me to prove that the vendor officially states that those packets will be punted. Alex. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Pete Lumbis
I think the documentation comes back to what others have said. If it's not supported on the PFC then it will be punted to software. I'm not sure if this fact is explicitly documented somewhere, but I'd look for general sup720 architecture information. On Tue, Jan 22, 2013 at 8:06 AM, Alex K.

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Nick Hilliard
On 22/01/2013 13:06, Alex K. wrote: Thank you. By any chance, some of this may become public? If it's on cisco-nsp, it's public. Someone asked me to prove that the vendor officially states that those packets will be punted. see what Oli said earlier this morning:

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Andy Ellsworth
On Tue, Jan 22, 2013 at 6:56 AM, Alex K. nsp.li...@gmail.com wrote: Cat6500 is a distributed environment. Not only PFC (or any other one part for this matter) is responsible for capabilities. You might want to read up on the role of the PFC. If NBAR were to be implemented in hardware, it would

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
Hi Nick, Yes, it is clear. That's not the point. This list isn't *Cisco official*. Alex. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
Yes Andy, I know. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Gert Doering
Hi, On Tue, Jan 22, 2013 at 07:29:27AM -0600, Andy Ellsworth wrote: On Tue, Jan 22, 2013 at 6:56 AM, Alex K. nsp.li...@gmail.com wrote: Cat6500 is a distributed environment. Not only PFC (or any other one part for this matter) is responsible for capabilities. You might want to read up

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Andy Ellsworth
On Tue, Jan 22, 2013 at 7:52 AM, Gert Doering g...@greenie.muc.de wrote: You miss the mention of SIP-200. That's a whole different beast again, the SIPs have local CPUs that can do things like VPLS, and possibly NBAR (note that I have no idea whether the SIP *can* do NBAR, but interfaces on

Re: [c-nsp] IOS auto mapping?

2013-01-22 Thread Chris Boyd
Le 20.01.13 16:16, Hank Nussbacher a écrit : I am looking to a freeware or payware tool that can take a bunch of IOS configs and generate reports about OSPF and BGP as well as auto create a network map based on the interfaces. I looked at building a tool for this a while back, but

Re: [c-nsp] NBAR on SVI on 7600 w/ Sup720

2013-01-22 Thread Alex K.
Please note that the rationale behind this question, was to verify the SVI functionality for ports on SIP-200 isn't offloaded to NBAR capable SIP-200. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net

Re: [c-nsp] advertise best-external

2013-01-22 Thread Oliver Boehmer (oboehmer)
I know I mentioned this one on the list earlier But I just want to put the rumors to the rest once and forever So is it alright to configure the advertise best-external on all PEs under the vpnv4 address-family? Or do I need to be worried about some weird loop voodoo? And thus advertise

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Saku Ytti
On (2013-01-23 01:28 +1100), Andrew Miehs wrote: If you loose a PE (and connected upstream) which connect back to your core - you have a bigger issue. You need to make sure that PE stops announcing your network blocks. If the PE is still default routing everything to that upstream - what

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Andrew Miehs
On Tue, Jan 22, 2013 at 11:41 PM, Saku Ytti s...@ytti.fi wrote: On (2013-01-22 21:38 +1100), Andrew Miehs wrote: If you have a full routing table, you don't need a default route. If you don't have full routing tables, or want/ need a default route - point it to your two major up-streams.

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread John Neiberger
We have static routes on the ASBRs that point to the loopback of the eBGP peer, then we redistribute those statics into ISIS. If a peer loopback goes away, the network converges pretty quickly to the other available connections. But thinking about that, it once again makes me wonder why we are

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Saku Ytti
On (2013-01-22 07:59 -0700), John Neiberger wrote: But thinking about that, it once again makes me wonder why we are redistributing the default into ISIS. If the default already exists in iBGP and the next-hop is in ISIS, that's going to converge pretty quickly. I'll have to think about this

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Gert Doering
Hi, On Tue, Jan 22, 2013 at 05:19:08PM +0200, Saku Ytti wrote: Now all your routers see all edge boxes as default destinations and will choose which ever is closest, in terms IGP metric. If one edge connection to INET, your 8.8.8.8 will be pulled, and static route won't recurse to that edge

Re: [c-nsp] IOS auto mapping?

2013-01-22 Thread David Barak
Le 20.01.13 16:16, Hank Nussbacher a écrit : I am looking to a freeware or payware tool that can take a bunch of IOS configs and generate reports about OSPF and BGP as well as auto create a network map based on the interfaces. Does Netbrain do what you're looking for? It's not the

Re: [c-nsp] unknown unicast flooding - particularly regarding fhrp's

2013-01-22 Thread Adrian Minta
mac address-table aging-time 14400 ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Saku Ytti
On (2013-01-22 17:50 +0100), Gert Doering wrote: I'm still not convinced that this is more elegant than the to-upstream edge routers just inject a static default route (pointing to the upstream peer) into IGP. What's the benefit of the extra recursion? If you point it at peer IP, it'll be

[c-nsp] CRS-8-DC-KIT-M

2013-01-22 Thread Antonio Soares
Hello group, I need to install the CRS-8-DC-KIT-M on a few CRS-8. Basically this means the change from the Fixed Configuration Power System to the Modular Power System. I'm not able to find anywhere the kit installation guide. I wonder if it really exists. I have queried the local SE and he was

Re: [c-nsp] CRS-8-DC-KIT-M

2013-01-22 Thread Andrew Koch
On Tue, Jan 22, 2013 at 12:21 PM, Antonio Soares amsoa...@netcabo.ptwrote: Hello group, I need to install the CRS-8-DC-KIT-M on a few CRS-8. Basically this means the change from the Fixed Configuration Power System to the Modular Power System. I'm not able to find anywhere the kit

[c-nsp] GetVPN with low speed links

2013-01-22 Thread henrry huaman
Hi Guys, Please could you help us with something information about if is recommended configure GETVPN in low speed links? (ie isdn, dial up, serial // 64Kbps, 128Kbps). Exists any document with parameters about BW for GetVPN? BR! Henrry ___

Re: [c-nsp] CRS-8-DC-KIT-M

2013-01-22 Thread Antonio Soares
Thanks. It seems there’s something. I was searching for the KIT PN but no luck… Regards, Antonio Soares, CCIE #18473 (RS/SP) mailto:amsoa...@netcabo.pt amsoa...@netcabo.pt http://www.ccie18473.net/ http://www.ccie18473.net From: gawu...@gmail.com [mailto:gawu...@gmail.com] On

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Gert Doering
Hi, On Tue, Jan 22, 2013 at 07:47:59PM +0200, Saku Ytti wrote: On (2013-01-22 17:50 +0100), Gert Doering wrote: I'm still not convinced that this is more elegant than the to-upstream edge routers just inject a static default route (pointing to the upstream peer) into IGP. What's the

[c-nsp] ASR Faulty Sensor

2013-01-22 Thread Hagen AMEN
Antonio Soares wrote: * Anyone has seen something like this ? ASR1006# show facility-alarm status System Totals Critical: 1 Major: 0 Minor: 0 Source Severity Description [Index] -- --- Temp: Center 0/15 CRITICAL

Re: [c-nsp] ASR Faulty Sensor

2013-01-22 Thread Antonio Soares
Thank you Hagen. Did they tell you what is the impact of this ? We are thinking about not doing anything :) Regards, Antonio Soares, CCIE #18473 (RS/SP) amsoa...@netcabo.pt http://www.ccie18473.net -Original Message- From: cisco-nsp-boun...@puck.nether.net

Re: [c-nsp] Rationale for ISIS default origination behavior

2013-01-22 Thread Saku Ytti
On (2013-01-22 23:02 +0100), Gert Doering wrote: And if 8.8.8.8 should ever disappear from the table for whatever reason (even Google might have an outage), your default route disappears - I'm not sure I consider *that* a very good idea. I covered this contingency multiple times, including