Re: [c-nsp] Limiting b/w per IP?

2009-09-23 Thread Arie Vayner (avayner)
Hank, This is available on the 6500/7600 through microflow policers: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/con figuration/guide/qos.html#wp1571584 Arie -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On

Re: [c-nsp] Limiting b/w per IP?

2009-09-23 Thread hank
Hank, This is available on the 6500/7600 through microflow policers: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/con figuration/guide/qos.html#wp1571584 Did I fail to mention that the router is much smaller? :-) -Hank Arie -Original Message- From:

Re: [c-nsp] Cisco 7600 vs ASR 9000

2009-09-23 Thread Dean Smith
The 7600 supports NSF/SSO (Non-Stop Forwarding, Stateful Supervisor O(something)) essentially giving you the 5sec recovery but the neighbors need to be NSF Aware. Or you can use RPR+ (the 30secs version) and ensure your layer3 network routes around the missing box in well under a second.

[c-nsp] Inter-AS L2VPN redundancy, option B (Ruzhanskaya Olga)

2009-09-23 Thread Ольга Ружанская
Hello List! My company is working on building Inter-AS VPN connection with other provider (both using MPLS). After researching on different option we've decided to use Option B (single-hop MP-EBGP). The only way to build l2vpn for option B is to use point-to-point VFI on ASBRs:

[c-nsp] OSPF to ISIS migartion

2009-09-23 Thread jack daniels
Hi all , I have got a project for an ISP ( also LDP configured ) runnning OSPF to migrate to IS-IS. I was planning to runnn dual IGP , as ospf with AD 110 and ISIS with AD 115 , OSPF will always be preffered. I was planning the challenges for migration, below are the ones which I could think of ,

Re: [c-nsp] OSPF to ISIS migartion

2009-09-23 Thread William F. Maton Sotomayor
On Wed, 23 Sep 2009, jack daniels wrote: Hi all , I have got a project for an ISP ( also LDP configured ) runnning OSPF to migrate to IS-IS. I was planning to runnn dual IGP , as ospf with AD 110 and ISIS with AD 115 , OSPF will always be preffered. I was planning the challenges for migration,

Re: [c-nsp] Enhanced download procedure

2009-09-23 Thread Jens Link
Jens Link li...@quux.de writes: On the bright side: Download worked for me using Debian Testing + Firefox. I stand corrected. It doesn't. :-( Jens -- - | Foelderichstr. 40 | 13595 Berlin, Germany | +49-151-18721264

Re: [c-nsp] OSPF to ISIS migartion

2009-09-23 Thread Joe Provo
On Wed, Sep 23, 2009 at 05:49:32AM -0400, William F. Maton Sotomayor wrote: On Wed, 23 Sep 2009, jack daniels wrote: Hi all , I have got a project for an ISP ( also LDP configured ) runnning OSPF to migrate to IS-IS. I was planning to runnn dual IGP , as ospf with AD 110 and ISIS with AD

Re: [c-nsp] OSPF to ISIS migartion

2009-09-23 Thread David Freedman
jack daniels wrote: Hi all , I have got a project for an ISP ( also LDP configured ) runnning OSPF to migrate to IS-IS. Please make sure you understand your reasons for doing so clearly before you get started with this, examples: Good reasons: - Want to completely re-engineer the IGP

Re: [c-nsp] Inter-AS L2VPN redundancy, option B (Ruzhanskaya Olga)

2009-09-23 Thread Andrey 'sshd' Petrenko
Book MPLS Configuration on Cisco IOS Software. Implementing Layer 2 VPNs over Inter-AS Topologies Using Layer 2 VPN Pseudo-Wire Switching. 23 сентября 2009 г. 11:10 пользователь Ольга Ружанская frosy...@mail.ruнаписал: Hello List! My company is working on building Inter-AS VPN connection

Re: [c-nsp] OSPF to ISIS migartion

2009-09-23 Thread Justin Shore
jack daniels wrote: Hi all , I have got a project for an ISP ( also LDP configured ) runnning OSPF to migrate to IS-IS. I was planning to runnn dual IGP , as ospf with AD 110 and ISIS with AD 115 , OSPF will always be preffered. I was planning the challenges for migration, below are the ones

Re: [c-nsp] Cisco SCE OIDs

2009-09-23 Thread Donato Dunguihual Morales
Hi Mohammad. Cisco recommend the utility rtmcd (windows and linux version) http://www.cisco.com/en/US/products/ps6135/products_user_guide09186a00808165dd.html#o16501 In my case it was impossible setup in linux server :-( , i did not probe in windows. Few days ago, Gergi Genov post a

[c-nsp] ospf hellos

2009-09-23 Thread Rens
Hi, Is there a way to prioritize ospf hello packets with 802.1p? The reason for this is that I have wireless link between 2 routers and often the ospf adjacency goes down/up very quickly and I can enable 802.1p priority on this wireless link. Regards, Rens

[c-nsp] Cisco Security Advisory: Cisco IOS Software Object-group Access Control List Bypass Vulnerability

2009-09-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software Object-group Access Control List Bypass Vulnerability Advisory ID: cisco-sa-20090923-acl Revision 1.0 For Public Release 2009 September 23

[c-nsp] Cisco Security Advisory: Cisco Unified Communications Manager Express Vulnerability

2009-09-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Manager Express Vulnerability Advisory ID: cisco-sa-20090923-cme Revision 1.0 For Public Release 2009 September 23

[c-nsp] Cisco Security Advisory: Cisco IOS Software Zone-Based Policy Firewall Vulnerability

2009-09-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software Zone-Based Policy Firewall Vulnerability Advisory ID: cisco-sa-20090923-ios-fw Revision 1.0 For Public Release 2009 September 23

[c-nsp] Cisco Security Advisory: Cisco IOS Software Network Time Protocol Packet Vulnerability

2009-09-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software Network Time Protocol Packet Vulnerability Advisory ID: cisco-sa-20090923-ntp Revision 1.0 For Public Release 2009 September 23

[c-nsp] Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability

2009-09-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20090923-sip Revision 1.0 For Public Release 2009 September 23

[c-nsp] Cisco Security Advisory: Cisco IOS Software Crafted Encryption Packet Denial of Service Vulnerability

2009-09-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software Crafted Encryption Packet Denial of Service Vulnerability Advisory ID: cisco-sa-20090923-tls Revision 1.0 For Public Release 2009 September 23

[c-nsp] Cisco Security Advisory: Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability

2009-09-23 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20090923-cm Revision 1.0 For Public Release 2009 September 23

Re: [c-nsp] ospf hellos

2009-09-23 Thread Jon Simola
On Wed, Sep 23, 2009 at 7:35 AM, Rens r...@autempspourmoi.be wrote: Is there a way to prioritize ospf hello packets with 802.1p? They are by default. See http://www.cisco.com/en/US/tech/tk543/tk544/technologies_tech_note09186a0080094612.shtml Cisco IOS assigns an IP precedence of 6 to routing

Re: [c-nsp] ospf hellos

2009-09-23 Thread Church, Charles
So as long as your router is correctly mapping the IP PREC to the COS (802.1P field), it sounds like it might help. These are 802.1Q tagged packets on the wireless, right? Chuck -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On

Re: [c-nsp] OSPF to ISIS migartion

2009-09-23 Thread joshua sahala
On Wed, Sep 23, 2009 at 1:50 AM, jack daniels jckdaniel...@gmail.com wrote: [cut] WHAT CONSIDERATIONS TO KEEP IN MIND BEFORE MIGRATION. as others have shared, vijay's presentation and methodology were spot on: - have ALL of your configurations pre-written/staged/tested - have a well

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability

2009-09-23 Thread Gert Doering
Hi Cisco PSIRT (and c-nsp), this one is specifically making me unhappy: On Wed, Sep 23, 2009 at 12:15:00PM -0400, Cisco Systems Product Security Incident Response Team wrote: Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability [..]

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability

2009-09-23 Thread Wendy Garvin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Gert, Gert Doering wrote: What exactly does this mean? - there will never be a fixed 12.0, 12.1, 12.2 or 12.3 IOS, and we have to upgrade all routers to 12.4 IOS, which is very likely to require DRAM and Flash upgrades, and in many

[c-nsp] Proxy Registered Route Object ....

2009-09-23 Thread Richard Golodner
If someone could hip me off list as to what a Proxy Registered Route Object is, I would be grateful. Google has presented too much information for me to glean through right now. It seems to be a favorite way to do something. I just can't figure out what that may be.

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability

2009-09-23 Thread Gert Doering
Hi, On Wed, Sep 23, 2009 at 01:06:40PM -0700, Wendy Garvin wrote: Gert Doering wrote: What exactly does this mean? - there will never be a fixed 12.0, 12.1, 12.2 or 12.3 IOS, and we have to upgrade all routers to 12.4 IOS, which is very likely to require DRAM and Flash

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability

2009-09-23 Thread ML
[..] The source and destination address must be the configured tunnel addresses. The source address does matter, but it is possible to spoof it. The destination address cannot be any address on the box, it must be the configured destination address. However, you must take into account that the

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability

2009-09-23 Thread Wendy Garvin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Gert, Clear words. Unhappy customer. (Going to 12.4 is painful enough, due to the necessary feature/bug testing required. But what is much worse is hardware replacements, due to hardware that's no longer supported - like various NPEs

[c-nsp] Download manager hell and latest Windows VPN Client?

2009-09-23 Thread Scott Granados
Hi, To add more to the comments against the new download management system, the download screens are totally inaccessible to users that require a screen reader. You can get as far as selecting the software to download, accepting the far to many terms and conditions and then once you select

Re: [c-nsp] Download manager hell and latest Windows VPN Client?

2009-09-23 Thread joshua sahala
On Wed, Sep 23, 2009 at 4:07 PM, Scott Granados gsgrana...@comcast.net wrote: [cut]   All that aside, does anyone have a non Cisco pointer or back way in to Cisco's site that I can use to download the latest V5.X windows XP VPN client?  Any pointers would be appreciated. check out the

Re: [c-nsp] Proxy Registered Route Object ....

2009-09-23 Thread joshua sahala
richard, On Wed, Sep 23, 2009 at 2:52 PM, Richard Golodner rgolod...@infratection.com wrote:        If someone could hip me off list as to what a Proxy Registered Route Object is, I would be grateful.        Google has presented too much information for me to glean through right now.        

Re: [c-nsp] NBAR + QoS - policing kills class-default traffic

2009-09-23 Thread Jon Simola
On Tue, Sep 22, 2009 at 2:07 PM, Matthew White ma...@vestas.com wrote: The policy polices HULU and PANDORA, counters don't increment for YOUTUBE (and doesn't get policed) and after 3 or 4 minutes ALL web traffic is policed. Has anyone seen this behavior before? Counters not incrementing for

Re: [c-nsp] Download manager hell and latest Windows VPN Client?

2009-09-23 Thread Jared Mauch
You really need to communicate this to GSA and perhaps DoJ. Many web developers do not take these issues into account, it's sad to continue to see the same regression of website access. I would love to see a way to access the downloads that does not require javascript (it can require

Re: [c-nsp] Download manager hell and latest Windows VPN Client?

2009-09-23 Thread Scott Granados
Hi, I plan on mentioning this to a few contacts. I don't think much will come of it what with the blind community being such a small subset of the market (far below the noise levels) but it can't hurt. It just surprises me that a company would show such lack of concern for their products and

Re: [c-nsp] Download manager hell and latest Windows VPN Client?

2009-09-23 Thread Justin M. Streiner
On Wed, 23 Sep 2009, Scott Granados wrote: To add more to the comments against the new download management system, the download screens are totally inaccessible to users that require a screen reader. You can get as far as selecting the software to download, accepting the far to many terms

Re: [c-nsp] Download manager hell and latest Windows VPN Client?

2009-09-23 Thread William F. Maton Sotomayor
On Wed, 23 Sep 2009, Justin M. Streiner wrote: All that aside, does anyone have a non Cisco pointer or back way in to Cisco's site that I can use to download the latest V5.X windows XP VPN client? Any pointers would be appreciated. [snip] Echoing Scott's request, if there is an 'off the

Re: [c-nsp] Download manager hell and latest Windows VPN Client?

2009-09-23 Thread Seth Mattinen
William F. Maton Sotomayor wrote: On Wed, 23 Sep 2009, Justin M. Streiner wrote: All that aside, does anyone have a non Cisco pointer or back way in to Cisco's site that I can use to download the latest V5.X windows XP VPN client? Any pointers would be appreciated. [snip] Echoing

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability

2009-09-23 Thread Bill Blackford
Can I ask a stupid question? What about the cat6.5k that ceilings out at 12.2(33)SXI2? Is this special case? -b From: cisco-nsp-boun...@puck.nether.net [cisco-nsp-boun...@puck.nether.net] On Behalf Of ML [...@kenweb.org] Sent: Wednesday, September 23,

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability

2009-09-23 Thread Bill Blackford
Sorry to reply to my own post. Someone on the list contacted me off-list to point out that this does *not* include the 12.2.S release. I apologize to the group. -b From: cisco-nsp-boun...@puck.nether.net [cisco-nsp-boun...@puck.nether.net] On Behalf