Re: [c-nsp] Mac address flapping..

2009-07-13 Thread A . L . M . Buxey
hi, i originally thought on the same lines too - but then having been told this still happens if theres only one link to the 4500s to the client - which makes the 6506-b almost a router at the end of a stick for that network things started to look a little 'wonky'. it wouldnt be taking traffic

[c-nsp] VSS out-of-band mgmt

2009-07-13 Thread Holemans Wim
I have a VSS router that I want to do some out-of-band mgmt with. Is this possible with VRF-lite ? I would like to build a channel with the UTP ports on the sup720, give the VSS an address on this trunk but keep this interface out of the standard routing table. Can this be done with VRF-lite ? Or

Re: [c-nsp] Mac address flapping..

2009-07-13 Thread Mateusz Blaszczyk
Alan, But why only 1 MAC is flapping? HSRP sends dest-mac as multicast address so there are clearly 2 paths between these switches. Unless the connection is unidrecional somehow, how on earth he doesn't see same on second 6509-b? It's confusing. -mat 2009/7/13 a.l.m.bu...@lboro.ac.uk: hi,

Re: [c-nsp] IP multicast traffic overwhelms switches

2009-07-13 Thread victor
On Sat, 11 Jul 2009 00:00:00 +0400, Łukasz Bromirski luk...@bromirski.net wrote: Thank you guys who cared to contribute to the solution of the problem. There is a list of possible reasons of doing multicast L3 switching in software. They are described in the related software configuration

Re: [c-nsp] Help with output drops

2009-07-13 Thread Randy McAnally
Hi Tony, After disabling QoS there are no longer any output drops. Thanks for the suggestion. Are there any features that rely on QoS, or is it a default setting? I'm trying to figure out something reasonable as to why it was enabled in the first place. -- Randy -- Original Message

Re: [c-nsp] Mac address flapping..

2009-07-13 Thread James Ashton
The most confusing thing is.. The Mac that is flapping is the Mac address for the vlan interface (VLan 42 of course) from 6509-b. But I am only seeing the log entries on 6509-a. I am looking at the entire path of the vlan now. Maybe it is patched into another vlan at some point that I am

Re: [c-nsp] Mac address flapping..

2009-07-13 Thread James Ashton
Alan, You guessed it. The customer had vlan 42 and another vlan tied together in their switch. That’s where the errors were coming from. Thanks for all of the ideas. James -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On

Re: [c-nsp] Mac address flapping..

2009-07-13 Thread A . L . M . Buxey
Hi, You guessed it. The customer had vlan 42 and another vlan tied together in their switch. That’s where the errors were coming from. Thanks for all of the ideas. yay - I get a +1 NSP score - thats cool you've sorted it anyway. and anyway - this thread has been VERY useful to me

[c-nsp] Power Upgrade 7600

2009-07-13 Thread Paul Stewart
Hey folks.. Does anyone know how the 7600 chassis (7606) handles power inbalance? To explain a bit more, we have a pair of 2700Watt DC power supplies in a 7606 that needs to be upgraded soon. To avoid downtime, we are looking at upgrading one side and then the other. They are running

Re: [c-nsp] Extended demarc

2009-07-13 Thread Pete Templin
james edwards wrote: What is a real word limit on how far you can extend the demarc ? This is on Cat5e cable. I get wildly different figures from Google. Late to the dance, so blame my vacation... For T1s, Kentrox had a great white paper showing that you can go 1000-2000 feet on Cat5 cable.

Re: [c-nsp] Power Upgrade 7600

2009-07-13 Thread Mikael Abrahamsson
On Mon, 13 Jul 2009, Paul Stewart wrote: So, can you install a larger power supply on one side and then the other without any effect? Yes, but you have to switch it to combined power mode before putting in the higher rated one, power it up, check that everything looks ok, take out the

Re: [c-nsp] IGMP snooping ME6500

2009-07-13 Thread Adrian Minta
Tim Stevenson wrote: Note that you can have a pim-enabled interface with ip multicast-routing disabled and that should work too - though then the RP CPU will be setting up state (at L3) for no particularly good reason. The querier function is to avoid all that. Let us know if it improves

Re: [c-nsp] VSS out-of-band mgmt

2009-07-13 Thread Alasdair McWilliam
Yes, a management VRF will do exactly what you want :-) Al On 13 Jul 2009, at 13:03, Holemans Wim wrote: I have a VSS router that I want to do some out-of-band mgmt with. Is this possible with VRF-lite ? I would like to build a channel with the UTP ports on the sup720, give the VSS an

Re: [c-nsp] IGMP snooping ME6500

2009-07-13 Thread Tim Stevenson
Please do a sh ip igmp snooping mrouter - is the trunk being learned as a mrouter port? Note that mrouter ports get all multicast traffic for all groups. Tim At 11:25 AM 7/13/2009, Adrian Minta asserted: Tim Stevenson wrote: Note that you can have a pim-enabled interface with ip

Re: [c-nsp] IGMP snooping ME6500

2009-07-13 Thread Adrian Minta
Tim Stevenson wrote: Please do a sh ip igmp snooping mrouter - is the trunk being learned as a mrouter port? Note that mrouter ports get all multicast traffic for all groups. Tim #sh ip igmp snooping mrouter vlanports -+ 200 Gi1/26

Re: [c-nsp] VSS out-of-band mgmt

2009-07-13 Thread Buhrmaster, Gary
Yes, a management VRF will do exactly what you want :-) Perhaps things have improved, but at one time for the 6500 platform certain functions could only be performed in the native(? is that the right word) context, and you needed to place all the rest of your traffic/interfaces in a VRF leaving

Re: [c-nsp] VSS out-of-band mgmt

2009-07-13 Thread Peter Rathlev
On Mon, 2009-07-13 at 10:47 -0700, Buhrmaster, Gary wrote: Perhaps things have improved, but at one time for the 6500 platform certain functions could only be performed in the native(? is that the right word) context, and you needed to place all the rest of your traffic/interfaces in a VRF

Re: [c-nsp] VSS out-of-band mgmt

2009-07-13 Thread Peter Rathlev
On Mon, 2009-07-13 at 14:03 +0200, Holemans Wim wrote: I have a VSS router that I want to do some out-of-band mgmt with. Is this possible with VRF-lite ? I would like to build a channel with the UTP ports on the sup720, give the VSS an address on this trunk but keep this interface out of the

[c-nsp] Software Download Area is Unavailable at this time

2009-07-13 Thread Jared Mauch
We apologize for any inconvenience. Software Download Area is unavailable at this time. New enhanced features for downloading software have arrived. Get a sneak preview here. If you are receiving an Error while downloading software and used a home address in your profile, please provide

Re: [c-nsp] IGMP snooping ME6500

2009-07-13 Thread Tim Stevenson
Ok - if you have mrouter ports being learned, then the upstream router should be sending IGMP queries already IGMP snooping querier is not required. You may want to check the igmp snooping stats see what type of joins etc are being seen on 1/26. Also what is the downstream switch doing

Re: [c-nsp] Software Download Area is Unavailable at this time

2009-07-13 Thread Christian Koch
I am still able to DL code via FTP , their web UI stinks anyways.. why bother? On Mon, Jul 13, 2009 at 12:45 PM, Jared Mauch ja...@puck.nether.net wrote: We apologize for any inconvenience. Software Download Area is unavailable at this time. New enhanced features for downloading software

[c-nsp] ASA IPsec Tunnel Failover

2009-07-13 Thread Munoz, Jeff
Hey guys, I have two main sites (site A and site B) and one remote site (site C). Sites A and B have a metroethernet connection between them. Remote site C has an IPsec tunnel back to site A. I'd like to setup failover so in case site A's ASA is down the remote site C ASA sends the

Re: [c-nsp] Software Download Area is Unavailable at this time

2009-07-13 Thread Peter Rathlev
On Mon, 2009-07-13 at 15:45 -0400, Jared Mauch wrote: We apologize for any inconvenience. Software Download Area is unavailable at this time. Same here. New enhanced features for downloading software have arrived. Get a sneak preview here. That video almost made me puke when I saw it

[c-nsp] disable break on boot for IOS??

2009-07-13 Thread neal rauhauser
I have a situation with a former employee who still has legitimate physical access to a shared space where we have some Cisco equipment. Today one of our field guys located a UBR924 attached to our cable modem plant with the cutest little rogue Linux machine attached to its ethernet port. I

Re: [c-nsp] Software Download Area is Unavailable at this time

2009-07-13 Thread Jared Mauch
Crypto software is not available via FTP. Jared Mauch On Jul 13, 2009, at 4:18 PM, Christian Koch christ...@automatick.net wrote: I am still able to DL code via FTP , their web UI stinks anyways.. why bother? On Mon, Jul 13, 2009 at 12:45 PM, Jared Mauch ja...@puck.nether.net wrote:

Re: [c-nsp] disable break on boot for IOS??

2009-07-13 Thread A . L . M . Buxey
Hi, I have a situation with a former employee who still has legitimate physical access to a shared space where we have some Cisco equipment. Today one of our field guys located a UBR924 attached to our cable modem plant with the cutest little rogue Linux machine attached to its ethernet

Re: [c-nsp] disable break on boot for IOS??

2009-07-13 Thread Matthew Huff
If you are running a newer IOS and newer ROMMON you can disable password-recover (i.e. break during boot) using no service password-recovery. Make sure to read http://www.cisco.com/en/US/docs/ios/12_3/12_3y/12_3ya8/gtnsvpwd.html completely, you can brick a router otherwise. Matthew

Re: [c-nsp] Maximum spannig tree instances

2009-07-13 Thread Nicolas Rolans
This supportwiki articlehttp://supportwiki.cisco.com/ViewWiki/index.php/The_%22PM-SP-4-LIMITS:%22_or_%22PM-SP-STDBY-4-LIMITS:%22_error_message_is_received_in_Catalyst_switches_that_run_Cisco_IOS_Softwarecould be what you're looking for. I confirm the 1800 instances/slot limit. -Nicolas

[c-nsp] multiple vlans on a port

2009-07-13 Thread Cord MacLeod
I realize this is impossible, at least I have read it is on an access port. So if I sent up a trunk port with the machine, does the machine need to speak 802.1q as well? interface GigabitEthernet0/15 switchport access vlan 120 switchport trunk native vlan 120 switchport trunk allowed

Re: [c-nsp] multiple vlans on a port

2009-07-13 Thread Ge Moua
Yes, I've done this on a few Xen boxes myself; contact me off-line and I can send you my install notes. Regards, Ge Moua | Email: moua0...@umn.edu Network Design Engineer University of Minnesota | Networking Telecommunications Services Cord MacLeod wrote: I realize this is impossible, at

Re: [c-nsp] Maximum spannig tree instances

2009-07-13 Thread A . L . M . Buxey
Hi, This supportwiki articlehttp://supportwiki.cisco.com/ViewWiki/index.php/The_%22PM-SP-4-LIMITS:%22_or_%22PM-SP-STDBY-4-LIMITS:%22_error_message_is_received_in_Catalyst_switches_that_run_Cisco_IOS_Softwarecould be what you're looking for. I confirm the 1800 instances/slot limit. ...and

Re: [c-nsp] multiple vlans on a port

2009-07-13 Thread A . L . M . Buxey
Hi, I realize this is impossible, at least I have read it is on an access port. So if I sent up a trunk port with the machine, does the machine need to speak 802.1q as well? interface GigabitEthernet0/15 switchport access vlan 120 switchport trunk native vlan 120 switchport trunk

Re: [c-nsp] Software Download Area is Unavailable at this time

2009-07-13 Thread Jared Mauch
The text on the page has changed to: New enhanced features for downloading software coming soon. Get a sneak preview here. They are now claiming the site is fixed, but I'm asking for a RFO and what their maint policy is on the website. If my bank can tell me when they do

Re: [c-nsp] Maximum spannig tree instances

2009-07-13 Thread Peter Rathlev
On Mon, 2009-07-13 at 23:38 +0200, Nicolas Rolans wrote: This supportwiki article [snip] could be what you're looking for. I confirm the 1800 instances/slot limit. ... but it doesn't say anything about the number of STP instances. I tested it on a Sup720 SXI1 and could create more than 1800

Re: [c-nsp] multiple vlans on a port

2009-07-13 Thread Matthew Huff
Yes, the machine will need to speak 802.1q. Most modern OS have no trouble with that. Windows, Linux, Solaris, etc.. work fine with 802.1Q. One thing more, unless Linux has started speaking Cisco DTP (which I doubt), you want to disable DTP messages from sending to the host. Dynamic Trunking

Re: [c-nsp] Software Download Area is Unavailable at this time

2009-07-13 Thread Peter Rathlev
On Mon, 2009-07-13 at 14:22 -0700, Scott Granados wrote: Lets face it, there's a trend here. It's more of this shielding the user from the equipment BS which wraps itself in to the company web front end as well. Try configuring some of the VPN hardware with out pointing and clicking. It's

Re: [c-nsp] multiple vlans on a port

2009-07-13 Thread Cord MacLeod
Thank you everyone for your replies. Fantastic information. On Jul 13, 2009, at 3:38 PM, Matthew Huff wrote: Yes, the machine will need to speak 802.1q. Most modern OS have no trouble with that. Windows, Linux, Solaris, etc.. work fine with 802.1Q. One thing more, unless Linux has

Re: [c-nsp] Help with output drops

2009-07-13 Thread Tony
Hi Randy, I can't answer why it was enabled either, the default on this platform is for QOS to be disabled until you manually enable it with the mls qos command. The problem you came across is why it is disabled by default so you don't have performance issues out of the box. When I

Re: [c-nsp] ASA IPsec Tunnel Failover

2009-07-13 Thread Prabhu Gurumurthy
Answer is: BGP On Jul 13, 2009, at 1:14 PM, Munoz, Jeff wrote: Hey guys, I have two main sites (site A and site B) and one remote site (site C). Sites A and B have a metroethernet connection between them. Remote site C has an IPsec tunnel back to site A. I'd like to setup failover so

Re: [c-nsp] disable break on boot for IOS??

2009-07-13 Thread neal rauhauser
This is good advice for newer machines but I've got a UBR 924 with 12.1T code on it - 'no service password-recover' isn't an option for me. Which config-register setting will do what I need? Seems like maybe 0x8102 would do it, but I'm in no mood to experiment across twenty miles, especially

Re: [c-nsp] disable break on boot for IOS??

2009-07-13 Thread Ivan Pepelnjak
Just make sure you test the feature (for each ROMMON release you're using) with a known enable password first. It's somewhat impossible to break into some ROMMON versions. http://blog.ioshints.info/2007/12/recovering-from-disabled-password.html Ivan http://www.ioshints.info/about