Re: [c-nsp] ASR9K to ASR920 MPLS issue

2021-01-05 Thread Emille Blanc
We have had problems with MPLS VC's on ASR's in the past, if the MTU on both sides don't match. Though the behavior is erratic - sometimes the VC comes up and won't pass traffic, sometimes it doesn't come up at all. We've also never tried an xconnect on an ASR physical interface. Though I don't

Re: [c-nsp] logging suppress duplicates

2020-09-28 Thread Emille Blanc
Logging discriminators have been hit or miss for us for as long as I can remember (and flat-out doesn't work in some versions of IOS). We have had more success with TCL filters which you might want to try. Eg; file flash:YOURFILTER.tcl if [string match "by\ snmp$" $::orig_msg] { return "" }

Re: [c-nsp] cisco ACL filter outbound only

2020-09-15 Thread Emille Blanc
> Again, the cli seems to indicate support for all the things > necessary, which includes the idea of 'established', which is why I ask > if THIS platform does in fact do what the cli suggests: No, the ASR920 (Unless it's hiding in a recent IOS release), does not do any kind of state

Re: [c-nsp] ASR920 is a ticking timebomb (CSCvk35460)

2019-01-27 Thread Emille Blanc
We've happily displaced the ASR901, and ASR920 with Juniper's ACX1100 in most parts of our network. It has a few interesting limitations (IPSEC, NAT), but nothing that has caused us any problems doing P, PE and Aggregation work. From: cisco-nsp

Re: [c-nsp] VPN tunnel between two Cisco 3825's

2018-05-01 Thread Emille Blanc
Forgive the obvious question; Are your 3800's licensed for IPSEC, and or the grace period hasn't been exhausted if not? They require the SECK9 license. I'd maybe specify the local source-address in your crypto maps. Otherwise, nothing stands out as erroneous to me. -Original Message-

Re: [c-nsp] ASR-920 - Remote UPGRADE

2017-01-13 Thread Emille Blanc
We've not run into any post-upgrade operational problems so far. The only 'excitement' we've encountered is some automatic FPGA upgrades between some images. No problems with that process to date, but it does cause some nail biting as the router takes 10-15 minutes to complete this process and

Re: [c-nsp] Help needed regarding the Eompls tunnel in Juniper & Cisco

2016-12-01 Thread Emille Blanc
You are describing something I ran into last week when I did some testing with Juniper ACX1100 and SRX300's, and a Cisco 7301 in our lab. I realize that the 7301 is a far cry from a 6500, but perhaps the anecdote will help. A Cisco 7301 was our P router in the lab, and had LDP propagation

Re: [c-nsp] ISR4431-AX/K9

2016-07-13 Thread Emille Blanc
I happen to be staring at an ISR4431/K9 with the APPX license (purchased for the L2 features), and it allows nbar configuration for ipv4 and ipv6. I have none without said license pre-loaded, so cannot confirm if it's required or not. It doesn't seem to complain or spam the license EULA if I

Re: [c-nsp] ASR 901 and net-flow

2015-11-16 Thread Emille Blanc
As of 15.5(2r)S with the AdvancedMetroIPAccess license, ip flow ingres/egress can be enabled on SVI's, but nothing to configure anything useful like top talkers, or export flow data to a collector. There's no mention of it in any of the technical deep dive powerpoints or software

Re: [c-nsp] BVI Configuration on 1600 Access Points

2015-08-26 Thread Emille Blanc
In my experience, 'bridge foo route ip' on BVI's other than bridge '1', is broken on all Aironet products that have come across my desk, since the 1200 series. Moving bridge-group 1 to the VLAN you wish to use for management - though goofy to look at - works. This comes with the caveat of your

Re: [c-nsp] Rancid permissions

2015-01-20 Thread Emille Blanc
In our experience, RANCID requires privilege level 15. The following from our tacacs conf works on IOS v15 devices. I'm sure you could do it just as easily with a parser view or some such. user = rancid { # default service = permit name = RANCID daemon login = (some password) # RANCID