Re: [c-nsp] BGP routes disappearing

2024-06-10 Thread Hank Nussbacher via cisco-nsp
ost-specific route to the BGP session over the BGP session. On Mon, 10 Jun 2024 at 11:09, Hank Nussbacher via cisco-nsp wrote: I have a simple iBGP peer defined as follows: neighbor 128.139.197.146 remote-as 378 update-source Loopback0 address-family ipv4 unicast I have a GigE interface defi

Re: [c-nsp] BGP routes disappearing

2024-06-10 Thread Hank Nussbacher via cisco-nsp
On 10/06/2024 11:05, Hank Nussbacher wrote: Ignore.  There was an ACL on GigabitEthernet0/0/0/43.1  that blocked the traffic. Nothing like solving your own issues. -Hank I have a simple iBGP peer defined as follows:  neighbor 128.139.197.146   remote-as 378   update-source Loopback0  

[c-nsp] BGP routes disappearing

2024-06-10 Thread Hank Nussbacher via cisco-nsp
I have a simple iBGP peer defined as follows:  neighbor 128.139.197.146   remote-as 378   update-source Loopback0   address-family ipv4 unicast I have a GigE interface defined as: interface GigabitEthernet0/0/0/43.1  ipv4 address 192.0.2.1 255.255.255.0  encapsulation dot1q 1 This iBGP peer

Re: [c-nsp] Firepower Threat Defense Geolocation DB

2024-03-27 Thread Hank Nussbacher via cisco-nsp
On 26/03/2024 17:29, Jon Lewis via cisco-nsp wrote: Find out from Cisco where you can publish your geo-location data as per: https://www.rfc-editor.org/rfc/rfc8805.html If it is Google related, report the issue here: https://support.google.com/websearch/workflow/9308722?hl=en or define your

Re: [c-nsp] Acceptable port configurations for ASR 9902 (gripe)

2024-01-27 Thread Hank Nussbacher via cisco-nsp
On 26/01/2024 15:49, Drew Weaver via cisco-nsp wrote: Hello, I just have a general gripe that I want to share regarding the ASR9902 and since there is nobody to talk to at Cisco about any of this anymore, I figured I would just share it here. This is an acceptable configuration: 1x100GE,

Re: [c-nsp] ASR9901 licensing configuration

2023-12-21 Thread Hank Nussbacher via cisco-nsp
On 21/12/2023 22:35, Shawn L via cisco-nsp wrote: Running on IOS-XR 7.5.2 I get: RP/0/RSP0/CPU0:GP1#license smart ? deregister De-register Device from Cisco Cloud mfg Factory license reservation feature registerRegister Device With Cisco Cloud renew Renewal Message to

Re: [c-nsp] ASR9902 fpd upgrade

2023-12-20 Thread Hank Nussbacher via cisco-nsp
On 20/12/2023 17:31, Drew Weaver via cisco-nsp wrote: Only a week? I have found this list far more helpful than TAC, which usually takes 2-3 weeks to request all the necessary logs, with commands that don't work. It used to be TAC was a main selling card of Cisco vs competitors. Not any

Re: [c-nsp] ACL to block udp/0?

2023-12-05 Thread Hank Nussbacher via cisco-nsp
On 05/12/2023 23:44, Gert Doering wrote: D'Wayne Saunders already pointed at this most likely being fragments - large packet reflections, and all non-initial fragments being reported by IOS* as "port 0" (so you should see 1500 byte regular UDP as well, with a non-0 port number) IOS XR syntax

[c-nsp] ACL to block udp/0?

2023-12-05 Thread Hank Nussbacher via cisco-nsp
We encountered something strange.  We run IOS-XR 7.5.2 on ASR9K platform. Had a user under udp/0 attack.  Tried to block it via standard ACL: ipv4 access-list block-zero  20 deny udp any any eq 0  30 deny tcp any any eq 0  40 permit ipv4 any any Applied to interface:  ipv4 access-group 

Re: [c-nsp] Netflow vs SNMP

2023-10-02 Thread Hank Nussbacher via cisco-nsp
On 02/10/2023 10:10, Dobbins, Roland wrote: Ensure that the active flow timer is set to 60s, that the inactive flow timer is set to 5s, and that the NetFlow capture/analysis system is configured with those values. For SNMP, ensure that the counter tabulation values are set to 60s/1m, and

[c-nsp] Netflow vs SNMP

2023-10-02 Thread Hank Nussbacher via cisco-nsp
Running ASR9906 w/ IOS-XR version 7.5.2 and doing 1:15 Netflow export on all interfaces (ingress only). When comparing traffic stats with SNMP, Netflow stats always appear too low (see attachment). Opened a TAC case and their recommendation is to do 1:1 and I quote: "Irrespective of the

[c-nsp] Newbie assistance about filtering netflow export (ascii clean)

2023-03-02 Thread Hank Nussbacher via cisco-nsp
[something screwy happened to my plaintext.  Hopefully this is better] I hope someone here has done this. On IOS-XR I want the ability to filter certain IP ranges when doing a Netflow export. I have looked here:

[c-nsp] Newbie assistance about filtering netflow export

2023-03-02 Thread Hank Nussbacher via cisco-nsp
I hope someone here has done this. On IOS-XR I want the ability to filter certain IP ranges when doing a Netflow export. I have looked here:

Re: [c-nsp] Internet border router recommendations and experiences

2023-02-23 Thread Hank Nussbacher via cisco-nsp
On 23/02/2023 19:32, Mark Tinka via cisco-nsp wrote: Cisco have lost the plot, IMHO. Every solution at every level of the network is now a bulldozer searching for a tiny nail to hammer. Mark. So well said. -Hank ___ cisco-nsp mailing list

Re: [c-nsp] Internet border router recommendations and experiences

2023-02-22 Thread Hank Nussbacher via cisco-nsp
On 23/02/2023 0:19, Eric Louie via cisco-nsp wrote: Oh geez, I just realized I left a zero off the interface - we need 100G interfaces both upstream (x1) and downstream (x2) That probably changes the product choices a little bit. Anyone with 100G Internet feeds want to let me know what you're

Re: [c-nsp] Internet border router recommendations and experiences

2023-02-22 Thread Hank Nussbacher via cisco-nsp
On 22/02/2023 20:25, zzif via cisco-nsp wrote: 22.2.2023, 5:31, Eric Louie via cisco-nsp wrote: For a 10G (or maybe 2x10G) Cisco ASR1001-HX is adequate, rock solid and relatively cheap. If you have more budget, need 100G etc. there are a lot of other options too. Br, EA A fully licensed

[c-nsp] Where have all the skilled people gone?

2023-02-15 Thread Hank Nussbacher via cisco-nsp
These days a lot of experience is getting lost, and the industry hasn’t found a way to transfer that knowledge to new generations. Cheers, Sander It makes me sadder that people in Cisco don't know how to spell "iput", "recieved" or "byetes" and there is no QA using spellcheck: rtr#sh

Re: [c-nsp] How can one escalate within Cisco TAC?

2023-02-08 Thread Hank Nussbacher via cisco-nsp
On 08/02/2023 15:27, Mark Tinka via cisco-nsp wrote: On 2/8/23 10:23, Saku Ytti via cisco-nsp wrote: Working would be much more pleasurable if half the world's white collar workers wouldn't be unemployed plat card holders and cruising without output, while looking down on people doing 3 jobs

[c-nsp] How can one escalate within Cisco TAC?

2023-02-07 Thread Hank Nussbacher via cisco-nsp
We opened a case on Jan 22 (Case #694936467).  Since then we have exchanged countless email, countless logs and countless command output captures. On Jan 31 we requested transfer to a more senior IOS-XR team. The case was transferred to Mexico TAC on Jan 31 and was assigned an engineer, yet

[c-nsp] IOS-XR and call-home

2023-01-31 Thread Hank Nussbacher via cisco-nsp
For the past week we have exchanged countless emails, logs and command outputs with Cisco TAC in regards to call-home not working on our IOS-XRs. At one point Cisco TAC suggested CSCwd36654 but that didn't help.  All our IOS-XEs manage to call-home and register fine. What trick or tip can you

Re: [c-nsp] call-home and IOS XR

2023-01-02 Thread Hank Nussbacher via cisco-nsp
<https://tools.cisco.com/its/service/oddce/services/DDCEService>   destination transport-method email disable   destination transport-method http  ! ! You also have some commands to test it and to to trace it license smart renew auth call-home test ... Nitzan On Mon, Jan 2, 2023 at 2:07 PM Hank Nu

[c-nsp] call-home and IOS XR

2023-01-02 Thread Hank Nussbacher via cisco-nsp
When running call-home licensing we add on all our IOS XE routers:  http resolve-hostname ipv4-first and that works. But now that we have a new ASR9906, call-home is not working and the above command is not valid. What magic command do you use to get call-home to work on IOS XR? Thanks,

Re: [c-nsp] How to disable ILMI/SNMP CSCvs33325

2022-09-20 Thread Hank Nussbacher via cisco-nsp
On 20/09/2022 15:54, Simon Leinen wrote: Gert Doering via cisco-nsp writes: Hi, On Mon, Sep 19, 2022 at 03:47:09PM +0300, Hank Nussbacher via cisco-nsp wrote: On 19/09/2022 15:40, Gert Doering wrote: https://www.cisco.com/c/dam/en/us/support/docs/csa/cisco-sa-20010227-ios-snmp-ilmi.html

Re: [c-nsp] How to disable ILMI/SNMP CSCvs33325

2022-09-19 Thread Hank Nussbacher via cisco-nsp
On 19/09/2022 15:40, Gert Doering wrote: HI, On Mon, Sep 19, 2022 at 02:29:06PM +0300, Hank Nussbacher via cisco-nsp wrote: Recently Shodan has been showing how it probes all our IOS-XE routers via SNMP even though we have an ACL on all our SNMP.  We then found that there is a bugid

[c-nsp] How to disable ILMI/SNMP CSCvs33325

2022-09-19 Thread Hank Nussbacher via cisco-nsp
Recently Shodan has been showing how it probes all our IOS-XE routers via SNMP even though we have an ACL on all our SNMP.  We then found that there is a bugid on the issue (ILMI can't be blocked by ACL): CSCvs33325 As well as an internal TAC bugid: CSCdp11863 Basically, none of the commands

[c-nsp] Total b/w across all physical interfaces

2022-08-07 Thread Hank Nussbacher via cisco-nsp
I am looking for an IOS-XR command that can show me the total in+out b/w across all physical interfaces. Thanks, Hank ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at