Re: [c-nsp] QSFP to SFP+ over 300 meters: Can it be done out of box?

2013-06-21 Thread Lincoln Dale
On Fri, Jun 21, 2013 at 12:08 PM, Troy Lucero t...@osihardware.com wrote: Anyone care to comment on trying to go from a 40gig port to a 10gig port over 300 meters? Yes its possible. No idea if Cisco offer it but certainly other vendors do. Its not a IEEE 'standard' but it certainly exists,

Re: [c-nsp] Increasing hold-queue to alleviate microbursts with small hardware queues

2012-08-17 Thread Lincoln Dale
On Fri, Aug 17, 2012 at 4:02 PM, John Neiberger jneiber...@gmail.comwrote: Would this even do what we want? It won't do anything. 'hold-queue' is only for software based forwarding platforms. it would help if you had a burst of packets back-to-back going for software forwarding, but if you

Re: [c-nsp] Cisco's new 4500-X 10G Aggregation Switches

2012-02-16 Thread Lincoln Dale
On 16/02/2012, at 5:06 PM, Saku Ytti s...@ytti.fi wrote: On (2012-02-16 17:44 +1100), Skeeve Stevens wrote: Just a question with the 4500-X. Why would the routing performance be halved for v4 vs v6? IPv4 Routing Performance: 245Mpps IPv6 Routing Performance: 122Mpps I'd like to

Re: [c-nsp] high performance open source DHCP solution?

2011-07-20 Thread Lincoln Dale
On 20/07/2011, at 12:24 PM, Rogelio wrote: The free DHCP solution, ISC, seems to be having scaling issues (i.e. handling only about 200 DHCPDISCOVER and 20 DHCPRENEW requests), and I was wondering if anyone had any open source suggestions of solutions that could scale much better?

Re: [c-nsp] converting N5K to FI6100

2011-07-07 Thread Lincoln Dale
On 08/07/2011, at 6:39 AM, krunal shah wrote: Does anyone get any success to convert N5K to FI 6100?? As far as I know both uses same chassis. they are 'similar'. but they are not the 'same'. you cannot convert one to the other. cheers, lincoln.

Re: [c-nsp] Nexus vPC loop avoidance details?

2011-04-27 Thread Lincoln Dale
whether a device sends to the 'right' or 'wrong' N7K depends on which physical link it chooses to use in a LAG bundle. as the neighboring device has no idea its a point-to-multipoint bundle, its not really in a position to choose the 'right' or 'wrong' link. This makes complete sense.

Re: [c-nsp] Nexus vPC loop avoidance details?

2011-04-26 Thread Lincoln Dale
On 23/04/2011, at 11:08 AM, Adrian Chung wrote: The 6500s each have two ten gigE interfaces in a port-channel connected up to vPCs on the 7K side. On top of this, each 6500 is forming an OSPF adjacency with each 7K. The adjacencies form without a problem, and we're not using peer-gateway.

Re: [c-nsp] Fabricpath on Nexus

2011-03-28 Thread Lincoln Dale
On 29/03/2011, at 6:41 AM, Asbjorn Hojmark - Lists wrote: We are considering deploying a pair of Nexus 7010 switches using fabricpath for L2 and HSRP for Layer 3. If it really is only two boxes, FabricPath provides *no* benefits, only more complexity strongly disagree. more than happy to

Re: [c-nsp] Fabricpath on Nexus

2011-03-28 Thread Lincoln Dale
References: aanlktim_xe9tfrbrn7vsxxui8for_s1b-g64yjijo...@mail.gmail.com 2503de55ba5e394390f26298212b1381026e6b44f...@exvmbx017-1.exch017.msoutlookonline.net 4d87ac26.8090...@imperial.ac.uk 2503de55ba5e394390f26298212b1381026e6b450...@exvmbx017-1.exch017.msoutlookonline.net

Re: [c-nsp] NEXUS and RIP?

2011-03-21 Thread Lincoln Dale
On 21/03/2011, at 10:50 AM, Jeff Fitzwater wrote: Since the NXOS only supports RIP V2 (from what I have read), is there any undocumented support for RIP V1? no. RIPv1 is long since dead, may it rest in peace. maybe you can re-purpose a c2500 on the subnet to announce the RIPv1 default

Re: [c-nsp] What is the lowest latency switch?

2011-03-20 Thread Lincoln Dale
On 20/03/2011, at 12:32 AM, Ziv Leyes wrote: I would love to see a fully functional shell cli on network devices that would allow us to gather information more effectively using grep,awk,sed,etc... speaking for NX-OS, you have all of awk/sed/grep/tr/wc/sort/uniq/diff already available

Re: [c-nsp] Nexus OTV Question

2011-02-27 Thread Lincoln Dale
hi Martin, On 28/02/2011, at 10:16 AM, Martin Clifton wrote: I have a concern about the table that is displayed when you enter the command sh otv route. This table shows entries for site (ie local) and overlay (ie other DC) mac addresses.The issue is with the Uptime data. For the

Re: [c-nsp] ASR9k - input drops

2011-02-16 Thread Lincoln Dale
On 17/02/2011, at 7:48 AM, Oliver Boehmer (oboehmer) wrote: That helps a lot. Any idea what those counters actually count? We seem to have a very high PARSE_INGRESS_DROP_CNT (around 1000pps) and UIDB_TCAM_MISS_AGG_DROP (another 1000pps)? I'm not an expert, but these two could be related:

Re: [c-nsp] Nexus 7000 - vPC during NX-OS upgrade (ISSU)

2011-01-27 Thread Lincoln Dale
On 27/01/2011, at 10:19 PM, Manu Chao wrote: I need to upgrade (ISSU) multiples N7K Dual Supervisor running vPC domains from NX-OS 4.2(6) to 5.1(1a). ISSU from 4.2(6) to 5.1(1a) is non-disruptive. you should be able to upgrade with no disruption to service. having said that, always

Re: [c-nsp] Nexus 7000 - vPC during NX-OS upgrade (ISSU)

2011-01-27 Thread Lincoln Dale
On 28/01/2011, at 10:12 AM, Manu Chao wrote: Because FPGA/EPLD upgrade operation is a disruptive operation, it is not always possible to upgrade both software and firmware. -- Do you think or may be do you know if it is an issue having an up-to-date NX-OS 5.x with old EPLD release 4.x?

Re: [c-nsp] CoPP IS-IS traffic on N7k

2011-01-25 Thread Lincoln Dale
On 25/01/2011, at 11:57 PM, Matthew Melbourne wrote: I managed to catch it, and for some strange reason iSCSI data-plane traffic is hitting the control-place. When netstack is not running at 100%, I see the usual control plane traffic, e.g. HSRP, STP, ARP (etc), but when it's at 100% I see

Re: [c-nsp] CoPP IS-IS traffic on N7k

2011-01-24 Thread Lincoln Dale
On 25/01/2011, at 12:23 AM, Matthew Melbourne wrote: Thanks Lincoln. I've manually added the CoPP entries for IS-IS/FabricPath to the policy, but we are still seeing IS-IS adjacencies drop, so I'm not convinced CoPP is the issue here. you can ascertain if CoPP may be limiting you by

Re: [c-nsp] CoPP IS-IS traffic on N7k

2011-01-24 Thread Lincoln Dale
On 25/01/2011, at 9:44 AM, Roland Dobbins wrote: On Jan 25, 2011, at 5:37 AM, Lincoln Dale wrote: key is probably to find out what traffic is hitting it. NetFlow may be useful to help determine this, as well. sure - might be - but netflow won't - for example - show if 100K packets

Re: [c-nsp] CoPP IS-IS traffic on N7k

2011-01-24 Thread Lincoln Dale
show if 100K packets arrived in 1 second or 100 seconds. Actually, it will - most any NetFlow collection/analysis system (open-source or commercial) derives this information based upon the received flow timestamps and the reported number of flows/NDE packet. and if they constitute a

Re: [c-nsp] CoPP IS-IS traffic on N7k

2011-01-24 Thread Lincoln Dale
On 25/01/2011, at 12:53 PM, Roland Dobbins wrote: On Jan 25, 2011, at 8:45 AM, Lincoln Dale wrote: and if they constitute a single flow? Each NDE record lists the number of packets in a given flow, so, yes, absolutely. Operators make use of this NetFlow capability all the time. sigh

Re: [c-nsp] Switch Port Question

2011-01-24 Thread Lincoln Dale
On 25/01/2011, at 12:48 PM, Aaron Riemer wrote: This is a really basic question and I should know the answer. I am just pondering over loop guard and UDLD and take this for example: note that at a fundamental level, mechanisms in Spanning Tree are always going to be different to those that

Re: [c-nsp] Switch Port Question

2011-01-24 Thread Lincoln Dale
On 25/01/2011, at 2:13 PM, Aaron Riemer wrote: Hi Lincoln, yes, swltch 2 would consider the interface to be operationally down (loss of light). switch 1 is still receiving light. If the interface is considered to be operationally down why does it still transmit light out its TX

Re: [c-nsp] 3560E TCAM Question

2011-01-20 Thread Lincoln Dale
On 21/01/2011, at 5:07 AM, Jose Madrid wrote: I have a 3560 and when do I show platform tcam utilization it says that I have 1365 directly connected routes. This is definitely not the case and when I do a show ip route connected there are various IP blocks shown, but none longer than a /26

Re: [c-nsp] Nexus support for BIDI SFP's?

2011-01-16 Thread Lincoln Dale
On 14/01/2011, at 5:22 AM, s...@lists.esoteric.ca wrote: Wondering if someone from Cisco can chime in on this one, since I can't find any roadmap information on the Cisco site. yep. generally speaking, cisco doesn't publish roadmap information on cisco.com :) Will the Nexus 7000 NX-OS

Re: [c-nsp] CoPP IS-IS traffic on N7k

2011-01-16 Thread Lincoln Dale
On 17/01/2011, at 7:02 AM, Matthew Melbourne wrote: We are currently seeing IS-IS adjacencies flap on one of our pair of N7k boxes (eachN7k is dual-attached to two upstream edge routers): [..] I am wondering whether the default CoPP policy is classifying IS-IS CLNS traffic its class-default

Re: [c-nsp] Cheap switch that runs same version of NX-OS that the nexus 7000 runs?

2011-01-16 Thread Lincoln Dale
On 16/01/2011, at 3:12 AM, Drew Weaver wrote: Are there any cheap/old switches out there that you can install the same version of the OS that the Nexus 7000 runs? The main benefit of this would be learning the new commands, etc but not having to buy a Nexus 7000. no. you could purchase a

Re: [c-nsp] CoPP for SSH on nexus 7k. Confused!

2010-10-20 Thread Lincoln Dale
On 20/10/2010, at 4:42 PM, Shanawaz wrote: 1. I assume this is happening because all traffic is matching the deny statement in the ACL copp-system-acl-telnet. What does the deny in an CoPP ACL do? in the context of a CoPP policy: nothing. its not valid to have a 'deny' IP ACL matching a

Re: [c-nsp] CoPP for SSH on nexus 7k. Confused!

2010-10-20 Thread Lincoln Dale
On 21/10/2010, at 2:49 AM, Justin M. Streiner wrote: It's my understanding that more IOS-like VTY ACLs are coming NX-OS 5.1, indeed, NX-OS 5.1 does have VTY ACLs: ltd-n7010-1# conf t Enter configuration commands, one per line. End with CNTL/Z. ltd-n7010-1(config)#

Re: [c-nsp] CoPP for SSH on nexus 7k. Confused!

2010-10-20 Thread Lincoln Dale
On 21/10/2010, at 12:05 PM, Shanawaz wrote: If my testing doesnot make sense, I can try explaining again. your tests make perfect sense and just reiterate what i said up front. a 'deny' won't do what you think it does. net-net: 1. use a 'permit' ACL to match the traffic you want, set a

Re: [c-nsp] Books for Nexus Arch

2010-10-19 Thread Lincoln Dale
as well as the books, if you have access to Cisco Networkers/Live material then the NX-OS Software Architecture and Nexus Hardware Architecture session(s) but together by your friendly clueful Cisco folks are likely useful too. there are a few of us who are on this list who have spent countless

Re: [c-nsp] Nexus evolution

2010-09-28 Thread Lincoln Dale
On 28/09/2010, at 9:44 AM, William Cooper wrote: I'm still a bit confused... I've a pretty significant investment in the 65/7600's; am I vested in having a 3 tier architecture for the foreseeable future? the historical reasons as to why a certain number of tiers were chosen was mostly around

Re: [c-nsp] Nexus vpc port channels between 5Ks and 7Ks

2010-09-26 Thread Lincoln Dale
On 27/09/2010, at 1:44 AM, scott owens wrote: The reasoning to want to run parallel paths is that with a cable/gbic failure the traffic will not flow in the VDC/VPC/multichannel etherchannel fashion but rather will end up traversing links between the 7Ks and 5Ks in an odd fashion. you can

Re: [c-nsp] 10G DWDM UP/DOWN

2010-09-22 Thread Lincoln Dale
On 23/09/2010, at 7:43 AM, Good One wrote: I have a 10G circuit over DWDM which is flapping very frequently occasionally. DOWN to UP state takes 5 second most of the time, just wondering what could be causing this. Sep 22 21:47:46 T12 mib2d[2061]: SNMP_TRAP_LINK_DOWN: ifIndex 117,

Re: [c-nsp] Handling of broadcast traffic on ASR with LAG

2010-09-20 Thread Lincoln Dale
On 21/09/2010, at 7:49 AM, Robert Larsen wrote: Does anyone know how this is handled? Is all broadcast traffic sent out of one physical interface, and is this hard-configured or automatically chosen? This is on the ASR9k with the 8-port 10GigE card. Not sure about the version of IOS, but

Re: [c-nsp] n5k caches usernames logged in

2010-09-19 Thread Lincoln Dale
On 19/09/2010, at 10:12 PM, Tassos Chatzithomaoglou wrote: I noticed that when a remote user logs into a n5k and then logs out, the show user-account command still displays the user credentials. Waiting for some time or clearing manually the user from config mode (?), fixes the above. Is

Re: [c-nsp] Storm-Control on server switch uplinks.

2010-08-25 Thread Lincoln Dale
On 24/08/2010, at 8:59 PM, Saku Ytti wrote: First CSCO box to support policing unknown unicast is EARL7.5 but it is per chassis instead of per port. I'm not sure if any Cisco can support per port unknown unicast policing, but if Nexus7k/EARL8 doesn't do it, I'm betting there isn't any box

Re: [c-nsp] Cisco Nexus and Peer bit troubleshooting

2010-08-17 Thread Lincoln Dale
On 18/08/2010, at 1:24 AM, Jmail Clist wrote: Troubleshooting black hole issues again with the Nexus 7k. My question is.. is there a way to track when the peer bit is set/flagged so I can find when my packets are going nowhere? no idea what you mean by peer bit. contact me off list with some

Re: [c-nsp] How to remove known_hosts on Nexus

2010-08-16 Thread Lincoln Dale
On 16/08/2010, at 7:22 PM, Sai wrote: How can I clean/remove/edit known_hosts file on Nexus? clear ssh hosts cheers, lincoln. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at

Re: [c-nsp] ACL logging on n5k

2010-08-11 Thread Lincoln Dale
On 11/08/2010, at 3:54 PM, Tassos Chatzithomaoglou wrote: Just another quick question : can ethanalyser capture traffic *before *being dropped by an acl? N7K: yes. and in fact, because the way we actually do it is implement the data plane forwarding in the h/w (ASIC) path with a 'rate limited

Re: [c-nsp] Nexus 7000 MSDP peering policy woes

2010-08-11 Thread Lincoln Dale
g'day, On 12/08/2010, at 8:26 AM, christopher.mar...@usc-bt.com wrote: I'm trying to implement PBR-filtering of MSDP messages from a Nexus 7000 running 5.0(2a), and I'm starting to think that the route-map is being interpreted wrong. The relevant parts of the configuration are: feature

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Lincoln Dale
On 10/08/2010, at 5:43 PM, David Freedman wrote: Can't seem to find anything suggesting a feature which could quite easily be a superb alternative to bridging is even remotely vrf aware. Any advice/pointers appreciated. 1. OTV

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Lincoln Dale
[i had replied to David off list but it seems his reply to me was bcc'd here. so to keep things relevant i'm posting the reply here too] On 10/08/2010, at 6:53 PM, David Freedman wrote: I should have mentioned that my target trains are 12.2SX and 12.2SR :) 6500/7600 are capable of

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Lincoln Dale
On 10/08/2010, at 6:35 PM, Alexander Clouter wrote: I was toying with the idea internally of putting a tiny OSPF router into our VM cluster to drag IP's from one side of our organisation to the other. reality is that many hosts and applications require and expect layer 2 connectivity for

Re: [c-nsp] LAM / Mobile IP in modern times

2010-08-10 Thread Lincoln Dale
g'day, The only remaining question is why for it's money have VMWare not done the trivial task of making OSPF part of their VMotion malarkey...*sigh* because its not /quite/ as simple as you suggest. The awkward part I see is host based (not service) L3 connectivity. The operating

Re: [c-nsp] ACL logging on n5k

2010-08-10 Thread Lincoln Dale
N7K supports ACL logging, ACL time ranges, MAC packet-classify functionality etc., N5K does not currently support them. the mistake is that documentation was carried over to N5K from N7K without being changed. cheers, lincoln. On 11/08/2010, at 5:58 AM, Arie Vayner (avayner) wrote: Yes,

Re: [c-nsp] Nexus 7k and OTV

2010-07-26 Thread Lincoln Dale
' then the blocked link would be on the access layer since the STP root would be in the Agg layer? not sure what benefit you'll get from a square in a vPC world cheers, lincoln. On 22 July 2010 13:13, Lincoln Dale l...@cisco.com wrote: On 22/07/2010, at 8:16 PM, Matthew Melbourne wrote

Re: [c-nsp] NX-OS - Fabric Path

2010-07-25 Thread Lincoln Dale
...@mail.utexas.edu] Sent: Saturday, July 24, 2010 6:57 PM To: Church, Charles Cc: Manu Chao; Peter Rathlev; Lincoln Dale; cisco-nsp@puck.nether.net Subject: Re: [c-nsp] NX-OS - Fabric Path Thanks for posting this. I am seeing the same thing and since I know that I am the only person with access

Re: [c-nsp] Nexus 7k and OTV

2010-07-22 Thread Lincoln Dale
On 22/07/2010, at 8:16 PM, Matthew Melbourne wrote: Is it possible to extend two vDCs between Data Centres using OTV (pair of N7k on each site) - it's not clear how OTV uses vDCs to extend the L2 domain. yes, its possible. there are 3 methods: 1. OTV runs inside a Virtual Device Context.

Re: [c-nsp] NX-OS - Fabric Path

2010-07-21 Thread Lincoln Dale
On 21/07/2010, at 9:13 PM, j.vaningensche...@utwente.nl j.vaningensche...@utwente.nl wrote: Is it just me or did others also receive a duplicate of the message below? Not only this one, but also others that had mr LTD as recipient and the list in CC... The duplicate comes later and has

Re: [c-nsp] NX-OS - Fabric Path

2010-07-19 Thread Lincoln Dale
On 19/07/2010, at 11:08 PM, Manu Chao wrote: DRILL... *Will Fabric Path* be based on OTV? no. OTV is a technology that allows us to extend L2 across any L3 (IP) infrastructure. Cisco Fabric Path is in essence the ability to run L2 networks without spanning tree and all links active.

Re: [c-nsp] NX-OS - Fabric Path

2010-07-19 Thread Lincoln Dale
To: Peter Rathlev Cc: Lincoln Dale; cisco-nsp@puck.nether.net Subject: Re: [c-nsp] NX-OS - Fabric Path Yes, but Nexus hardware is the right platform if you don't want to loose any packet in your DC ;) On Tue, Jul 20, 2010 at 12:56 AM, Peter Rathlev pe...@rathlev.dk wrote: On Tue

Re: [c-nsp] Brief CPU spikes on 6500 Sup 720

2010-07-17 Thread Lincoln Dale
On 17/07/2010, at 9:58 AM, Aaron Riemer wrote: Enabled SNMP traps and MAC-notifications and this brought another issue to my attention. There is a huge amount of mac-flapping going on (not for this host) but our ESX hosts that have vmnics trunking to both our cores. The VM guys are sending

Re: [c-nsp] Brief CPU spikes on 6500 Sup 720

2010-07-17 Thread Lincoln Dale
On 17/07/2010, at 4:55 PM, Aaron Riemer wrote: Thanks Lincoln. The server team must be using the Route based on IP hash method then. All adapters in the NIC team must be attached to the same physical switch or an appropriate set of stacked physical switches. also ensure you pay

Re: [c-nsp] PFC for iSCSI on Nexus

2010-07-09 Thread Lincoln Dale
Tom, iSCSI runs atop of TCP. generally speaking, the TCP state machine uses packet drop (lost segments) to tune its transmit rate to the capabilities of the network end-to-end. PFC will essentially provide a no-drop environment which while in face value may seem to be beneficial in reality

Re: [c-nsp] MST Reserved VLANs on Nexus 5010

2010-07-08 Thread Lincoln Dale
anywhere. GG On Mon, Jun 28, 2010 at 7:22 PM, Lincoln Dale l...@cisco.com wrote: On 29/06/2010, at 12:26 AM, Gary T. Giesen wrote: Any idea on when that might be? I can't even view the bug report. the next NX-OS 4.2 maintenance release for the N5K is due to be posted on cisco.com in Q4

Re: [c-nsp] MST Reserved VLANs on Nexus 5010

2010-06-28 Thread Lincoln Dale
Gary, On 28/06/2010, at 1:04 AM, Gary T. Giesen wrote: NX-OS definitely prevents you from mapping them to *any* instance. I'll open a TAC case with Cisco tomorrow and see if I get anywhere. CSCtc54335 covers this. its due to be sync'd to the next 4.2(x) maintenance release on N5K. cheers,

Re: [c-nsp] MST Reserved VLANs on Nexus 5010

2010-06-28 Thread Lincoln Dale
automatically alerted to the problem. indeed, the person that filed the bug marked it as internal only. i'll ask them to fix that. clearly it should be visible. cheers, lincoln. GG On Mon, Jun 28, 2010 at 3:33 AM, Lincoln Dale l...@cisco.com wrote: Gary, On 28/06/2010, at 1:04 AM, Gary T

Re: [c-nsp] HSRP forwarding question

2010-06-17 Thread Lincoln Dale
On 18/06/2010, at 4:24 AM, Chris Boyd wrote: Having a discussion with a colleague about forwarding on HSRP. I seem to remember seeing datagrams that were addressed to the virtual IP address, but were delivered to the standby router getting forwarded from the standby to the active for

Re: [c-nsp] Nexus 7k support for Twin-ax cables with N7K-M132XP-12 line card

2010-06-16 Thread Lincoln Dale
they seem to work but trust me when i state (with a Cisco hat on) that there are good reasons we don't list the 1m/3m/5m passive CX1 as officially supported on N7K-M132XP-12 module. if you are going to use them - either cisco branded or 3rd party ones - strongly suggest you actually 'test' them

Re: [c-nsp] Nexus family rate-limit monitor via SNMP

2010-06-08 Thread Lincoln Dale
On 09/06/2010, at 7:47 AM, Livio Zanol Puppim wrote: Does anybody knows if it's possible to monitor rate-limit utilization using SNMP in any equipements of the nexus family? I haven't found any MIB with this information

Re: [c-nsp] sup2t -- where the deets' at?

2010-05-29 Thread Lincoln Dale
On 30/05/2010, at 6:59 AM, Justin M. Streiner wrote: Having just recently muscled a Nexus 7k into a rack (not fun, btw) I've been noticing an increasing trend of manufacturers not taking typical rack dimensions (particularly depth) into account when designing new products. The 7k is about

Re: [c-nsp] Link Discovery Error

2010-05-27 Thread Lincoln Dale
On 28/05/2010, at 12:01 AM, Peter Rathlev wrote: On Thu, 2010-05-27 at 18:45 +0530, jaikar gupta wrote: Thanks peter but i want to Know MAC-addresses. Then you use BRIDGE-MIB for switches, and RFC1213-MIB for routers. :-) Disregarding certain special cases a router will only know MAC

Re: [c-nsp] Link Discovery Error

2010-05-26 Thread Lincoln Dale
On 26/05/2010, at 10:30 PM, jaikar gupta wrote: But when we introduce the Cisco Routers (2509 series) in the network and run the discovery it doesnt show the links between the Router-Switch as well as Router-Router, The problem with the Link discover is that their is no value in the

Re: [c-nsp] Link Discovery Error

2010-05-26 Thread Lincoln Dale
27, 2010 at 6:55 AM, Lincoln Dale l...@cisco.com wrote: On 26/05/2010, at 10:30 PM, jaikar gupta wrote: But when we introduce the Cisco Routers (2509 series) in the network and run the discovery it doesnt show the links between the Router-Switch as well as Router-Router, The problem

Re: [c-nsp] Nexus 7k CoPP

2010-05-23 Thread Lincoln Dale
On 24/05/2010, at 12:02 AM, Mark Tinka wrote: Cisco said they are working on getting the old features added back in as a feature enhancement later on. Eeek - CoPP is a good workaround but seems like too much muscle for a simple task like this. Well, at least the IOS-way will make it

Re: [c-nsp] Nexus 7k CoPP

2010-05-23 Thread Lincoln Dale
On 24/05/2010, at 11:18 AM, Dobbins, Roland wrote: On May 24, 2010, at 4:51 AM, Lincoln Dale wrote: the irony is that CoPP is actually a superior solution to the problem, as CoPP is enforced in the h/w forwarding path - whereas a vty access-class is applied in software once the packets

Re: [c-nsp] Nexus 7k CoPP

2010-05-21 Thread Lincoln Dale
On 21/05/2010, at 12:53 PM, Jason Leblanc wrote: We are deploying a ton of Nexus 7ks right now. Our traditional standard had a named ACL for SNMP, we also use transport input ssh and have an ACL allowing access for that, Our tools are only allowed from certain segments etc... On the 7k's

Re: [c-nsp] NX-OS - Cisco TrustSec

2010-05-11 Thread Lincoln Dale
On 11/05/2010, at 2:12 PM, Manu Chao wrote: I need to encrypt L2 trafic over a MAN between 2 Nexus 7K. The feature CTS seems to be the right feature to use with 802.1x. Correct? Question is could we have a local authentication/authorization instead classical Radius/ACS query/reply since it

Re: [c-nsp] NX-OS - Cisco TrustSec

2010-05-11 Thread Lincoln Dale
On 11/05/2010, at 5:31 PM, Erik Witkop wrote: But all the tags and policies come from the ACS. I could be wrong, but I don't think it can currently be done locally. Unless something has changed in the last 2 years or so. we've always had the ability to do CTS crypto or CTS SGT/SGACL manually

Re: [c-nsp] Nexus 5000 / Nexus 2000 SFP+ with LRM

2010-05-07 Thread Lincoln Dale
On 07/05/2010, at 9:43 PM, Asbjorn Hojmark - Lists wrote: Has anyone successfully run Nexus 5000s and Nexus 2000s with 3rd party 10Gbase-LRM SFP+? (LRM SFP+ is not supported from Cisco (yet?)). i doubt anyone has successfully deployed it as LRM is not supported on N5K or N2K. there are

Re: [c-nsp] nexus 5xx vpc peer keepalives

2010-05-03 Thread Lincoln Dale
On 04/05/2010, at 6:01 AM, Charles Spurgeon wrote: On Mon, May 03, 2010 at 10:19:53AM +1000, Lincoln Dale wrote: the keepalive link is not mandatory - but certainly best practice would be for it to be operational as much as possible rather than having it on a network that didn't have

Re: [c-nsp] nexus 5xx vpc peer keepalives

2010-05-02 Thread Lincoln Dale
On 01/05/2010, at 10:09 PM, christopher.mar...@usc-bt.com christopher.mar...@usc-bt.com wrote: It hasn't given me any surprises. TAC reviewed it, told me I should be fine, didn't seem to share my (or the OP's) concern about making the keepalive robust. the L3 (IP) based vPC keepalive is

Re: [c-nsp] nexus 5xx vpc peer keepalives

2010-05-02 Thread Lincoln Dale
the L3 (IP) based vPC keepalive is purely intended to assist in dealing with split-brain if the vPC peer-link is non-functional. having simultaneous failure of both would be an unusual circumstance, particularly if you follow best-practice on the vPC peer-link itself.. This is what I had

Re: [c-nsp] nexus 5xx vpc peer keepalives

2010-05-02 Thread Lincoln Dale
On 03/05/2010, at 12:35 PM, chris stand wrote: How about power outage in the data center what about it? not sure i get the context of your question or whether its actually a question. cheers, lincoln. ___ cisco-nsp mailing list

Re: [c-nsp] Access-list not working on eth sub if

2010-04-28 Thread Lincoln Dale
On 29/04/2010, at 8:15 AM, james edwards wrote: The access-lists seem to not work when configed out but works fine configured in ACLs don't match locally-originated traffic from the router. cheers, lincoln. ___ cisco-nsp mailing list

Re: [c-nsp] Cisco manufacturing delays?

2010-04-15 Thread Lincoln Dale
On 15/04/2010, at 7:26 PM, Skeeve Stevens wrote: Seems a bunch of Cisco kit... 887M, ASA5510 and others all have June or July on their delivery expectations I've heard there are some problems, but only vague rumours... nothing concentre.. if you want a concrete answer, talk to your

Re: [c-nsp] OID that measures total traffic?

2010-03-26 Thread Lincoln Dale
On 25/03/2010, at 7:40 PM, Gert Doering wrote: Hi, On Wed, Mar 24, 2010 at 02:01:01PM +0100, Per Carlson wrote: Is there an SNMP OID that reports total traffic that passes through a router? From RFC1213-MIB: ipForwDatagrams OBJECT-TYPE SYNTAX Counter Is that implemented in

Re: [c-nsp] Cheap 10G between 7600 and Procurve 5406zl

2010-03-18 Thread Lincoln Dale
On 18/03/2010, at 7:10 PM, Marian Ďurkovič wrote: In addition, by buying kit which takes X2 modules, you're committing a huge amount of transceiver capex on a particular vendor (i.e. Cisco or HP) which cannot then be moved to another vendor, because no-one else in the industry uses them. This

Re: [c-nsp] Cheap 10G between 7600 and Procurve 5406zl

2010-03-17 Thread Lincoln Dale
On 17/03/2010, at 7:05 PM, Marian Ďurkovič wrote: On Wed, Mar 17, 2010 at 09:54:13AM +1100, Lincoln Dale wrote: from a switch design standpoint if you are designing a switch that could be used in many places in the network then reality is one probably needs to support multiple transceiver

Re: [c-nsp] Cheap 10G between 7600 and Procurve 5406zl

2010-03-17 Thread Lincoln Dale
On 17/03/2010, at 9:16 PM, Phil Mayers wrote: certainly if you are most focussed on long-distance optics or DWDM then indeed SFP+ is probably not for you. True, but... Hearing statements which add up to this whole transceiver platform depends on the transceiver, linecard hardware and

Re: [c-nsp] Cheap 10G between 7600 and Procurve 5406zl

2010-03-17 Thread Lincoln Dale
On 18/03/2010, at 9:10 AM, Nick Hilliard wrote: On 17/03/2010 21:28, Lincoln Dale wrote: this assertion is also false. i can categorically state that there has not been, there have been any number of quirks with standards compliant MSA transceivers. To be fair, Lincoln, Marian is talking

Re: [c-nsp] Cheap 10G between 7600 and Procurve 5406zl

2010-03-16 Thread Lincoln Dale
On 17/03/2010, at 12:54 AM, Marian Ďurkovič wrote: [..] Thus, the massive rush towards SFP+ might at the end of the day turn out to be a serious flaw, [..] you list downsides without giving fair balance to the upsides. like many things engineering, its often not a case of something being

Re: [c-nsp] Dynamic TCAM allocation/optimization? (was Re: N7K tcam handling)

2010-03-15 Thread Lincoln Dale
On 15/03/2010, at 7:37 PM, Richard A Steenbergen wrote: The real mess here is the non-deterministic nature of what you're doing. Someone flaps that /16 and now you've added 1000 new more specifics, which might push you over the edge in FIB usage, with no way to predict when or where it will

Re: [c-nsp] Cheap 10G between 7600 and Procurve 5406zl

2010-03-14 Thread Lincoln Dale
On 15/03/2010, at 5:54 AM, christopher.mar...@usc-bt.com christopher.mar...@usc-bt.com wrote: These days you can get cheap twinax 10G cables with SFP+ at the ends to connect two Cisco switches or two Procurves. Short distance only of course, but very cheap. They're also useful for

Re: [c-nsp] Cheap 10G between 7600 and Procurve 5406zl

2010-03-14 Thread Lincoln Dale
On 15/03/2010, at 7:57 AM, christopher.mar...@usc-bt.com christopher.mar...@usc-bt.com wrote: twinax support claims I've seen to date. I'm hopeful that vendors will come to their senses on pluggables, at least for twinax cabling. HP are currently locking in to HP transceivers. email

Re: [c-nsp] Dynamic TCAM allocation/optimization? (was Re: N7K tcam handling)

2010-03-11 Thread Lincoln Dale
On 12/03/2010, at 6:23 AM, Chris Woodfield wrote: Can you elaborate (or point me to docs) on how this dynamic allocation works? Is the TCAM populated on demand based on traffic? I imagine the old horror of the Sup1A's flow-based forwarding every time I hear this... no very very different.

Re: [c-nsp] /31 on a PTP Ethernet interface

2010-03-08 Thread Lincoln Dale
On 09/03/2010, at 5:36 AM, sth...@nethelp.no wrote: Some of us have tried (hard) to get Cisco and Juniper to come forward with an official statement about whether /31 is supported or not on Ethernet links. We have been entirely unsuccessful - the answer we receive is always of the type try

Re: [c-nsp] bpduguard and trunks?

2009-12-05 Thread Lincoln Dale
On 05/12/2009, at 7:18 AM, Geert Nijs wrote: Lincoln, Just to be clear: all 'edge' ports should be running with BPDU guard enabled. 'edge ports' (those facing hosts) should NEVER send BPDUs out. BPDU guard is there to detect if they do - and if they do, its a sign that they have

Re: [c-nsp] bpduguard and trunks?

2009-12-03 Thread Lincoln Dale
On 04/12/2009, at 1:29 AM, Howard Jones wrote: I've just run into an odd problem, and was wondering if anyone else could clarify this for me. [c1]---[Sw1]--[Sw2]---[c2] c1 and c2 are client devices. Sw1 and Sw2 are 3750Gs with a trunk between them. c1 has a trunk to Sw1. One of

Re: [c-nsp] ASR1004 vs 7606(RSP720-CXL)

2009-11-27 Thread Lincoln Dale
On 27/11/2009, at 6:41 PM, Asbjorn Hojmark - Lists wrote: On Fri, 27 Nov 2009 14:33:37 +1100, you wrote: Except, of cause, the N7K doesn't currently do MPLS and won't for another year, and when it does it will, as always, be released in fases. fast forward to now from Nexus first release

Re: [c-nsp] ASR1004 vs 7606(RSP720-CXL)

2009-11-27 Thread Lincoln Dale
On 28/11/2009, at 2:33 AM, Justin Shore wrote: Exactly. These days MPLS/VPNs is as much a DC feature as basic switching. Our DC couldn't operate with MPLS/VPNs. so some extent it depends on exactly how far 'down' into your DC you extend MPLS VPNs. for example, do you extend it down to the

Re: [c-nsp] Loop guard and Bridge Assurance

2009-11-26 Thread Lincoln Dale
On 27/11/2009, at 8:14 AM, samuel vuillaume wrote: Can someone see a benefit of bridge assurance instead of using loop guard? I understand what BA does, but i can't see any benefits over loop guard. there are a few scenarios where LoopGuard would not be effective at detecting loops and/or

Re: [c-nsp] ASR1004 vs 7606(RSP720-CXL)

2009-11-26 Thread Lincoln Dale
On 27/11/2009, at 12:14 AM, Asbjorn Hojmark - Lists wrote: If there's a 4 slot chassis in the 2nd generation then I could see N7K and N5K / N4K as a possible end-to-end platform for L3/MPLS core, L2/L3 aggregation, and L2 access. And it would all run the same software !!! Except, of

Re: [c-nsp] IRIS Project

2009-11-25 Thread Lincoln Dale
On 16/11/2009, at 12:58 AM, luismi wrote: IS there anyone in this mailing list involved with the IRIS project? i can put you in contact with the relevant folks if you want. there are links to folks at http://www.cisco.com/web/strategy/government/space-routing.html its been a big week for

Re: [c-nsp] BPDU Guard issue

2009-11-04 Thread Lincoln Dale
On 03/11/2009, at 5:25 PM, Stanly Johns wrote: Is it possible for a BPDU guard enabled switch port to get disabled without connecting any other device than the IP Phone and a PC ? I had to do a shut and no shut to bring it up ! The logs are as follows. your inputs are highly appreciated.

Re: [c-nsp] ISR G2 multicore?

2009-10-30 Thread Lincoln Dale
On 29/10/2009, at 9:58 AM, David Hughes wrote: On 28/10/2009, at 11:18 PM, Roland Dobbins wrote: The smartest/sanest thing to do, IMHO, would be to work at migrating to NX-OS, feature-set by feature-set. It's by far the cleanest and best-designed OS platform Cisco have come out with to

Re: [c-nsp] Monitoring the Nexus 7000 platform

2009-09-10 Thread Lincoln Dale
On 11/09/2009, at 5:19 AM, Lee Calcote wrote: Does anyone know what user account privilege level is needed to run netconf commands on the Nexus 7000? short answer: it doesn't matter what priv you have. that won't dictate whether you can use NetConf. longer answer: whether you're doing

Re: [c-nsp] Catalyst vs. Nexus

2009-09-09 Thread Lincoln Dale
hi Todd, a few of the cisco folks that are subscribed to cisco-nsp focus on the Nexus range we're a pretty friendly bunch. there's a few things below that aren't quite correct. see inline below... On 09/09/2009, at 8:43 PM, Todd, Douglas M. wrote: A few other thoughts on the Nexus

Re: [c-nsp] MST and Uplinkfast

2009-08-27 Thread Lincoln Dale
On 28/08/2009, at 9:18 AM, Andy Saykao wrote: I have noticed that with MST and rapid failover that those ports which are not boundary ports or do not have portfast enabled go through the blocking, listening and learning states again before forwarding. whether its PVRST+ or MST used, you

Re: [c-nsp] Monitoring Nexus 7000 platform

2009-08-18 Thread Lincoln Dale
On 18/08/2009, at 11:48 PM, Ross Vandegrift wrote: Those namespaces are specified as versions of the netconf namespace, not as Cisco-specific namespaces. Those will change only for subsequent versions of the top-most, Netconf-defined tags. Unfortunately, JUNOS does encode generating versions

  1   2   >