Re: [c-nsp] Policy-routing for a protocol

2010-03-09 Thread Gert Doering
Hi, On Mon, Mar 08, 2010 at 04:54:56PM -0500, Church, Charles wrote: Outbound seems a bit trickier. Seems like I need to policy route the traffic, matching on the source address of the VTC gear. The next hop is what I'm getting stuck on, since I could be black-holing VTC traffic if

[c-nsp] Incorrect bandwidth

2010-03-09 Thread nasir.shaikh
Hi, I have an 2621XM running c2600-ik9s-mz.123-22a.bin and I noticed something strange. Reports were showing utilisation of more than 100%. This can be true in some cases but for E1 interfaces I always thought that the router calculates the correct bw depending on the number of channels used. e.g

Re: [c-nsp] IPSec crypto map on MPLS enabled interface?

2010-03-09 Thread Phil Mayers
I the tried changing the ISAKMP profile VRF, et voila, it worked. :-) I have reloaded the box to make sure it's not just good luck that it works now. It seems to work fine after a reload, with MPLS on the core facing interfaces. Interesting. Are the packets arriving at the box labelled? FWIW

[c-nsp] Spanning-Tree vs. EoMPLS links in SXI2?

2010-03-09 Thread Gert Doering
Hi, maybe a stupid question: are there any issues known with Rapid-PVSTP, EoMPLS links, and IOS SXI2? We just had a nice problem due to a broadcast loop which should have been broken by STP in the first place, but wasn't - and investigation afterwards showed an EoMPLS link that just refuses to

Re: [c-nsp] VPLS on Cisco7600 Platform

2010-03-09 Thread Daniska, Tomas
On Tue, 9 Mar 2010, Anthony Gown - Comm-AG Networks P/L wrote: HI, Anyone running VPLS on Cisco7600; need some assistance spec'ing the hardware and identifying the correct IOS to use. Correct IOS is the SR train, howver for VPLS you need either SIP/SPA cards or ES(+) cards.

Re: [c-nsp] IPSec crypto map on MPLS enabled interface?

2010-03-09 Thread Peter Rathlev
On Tue, 2010-03-09 at 10:49 +, Phil Mayers wrote: I the tried changing the ISAKMP profile VRF, et voila, it worked. :-) I have reloaded the box to make sure it's not just good luck that it works now. It seems to work fine after a reload, with MPLS on the core facing interfaces.

[c-nsp] ASA output of show dhcpd binding - odd hardware address?

2010-03-09 Thread Jeff Wojciechowski
Greetings all: Running 8.2(1) on an ASA 5505 and am curious if anyone can tell me what the +.12 is after the MAC address bound to 172.20.48.37? Diane-VPN# show dhcpd binding IP address Hardware addressLease expirationType 172.20.48.36 0019.6983.7339

[c-nsp] N1KV woes

2010-03-09 Thread Ryan Lambert
Hi everyone, Not sure how many folks have experience with the Nexus 1000v, but wanted to throw this out to the group to see if anyone has conquered this before. I am fresh out of ideas, and the TAC rep I am talking with right now is scratching his head in confusion as well. Version is 4.0(4)SV1.2

[c-nsp] MAC Address 'static' and HSRP failover

2010-03-09 Thread mark walters
Hi, Was hoping someone could help. It’s a relatively set up but Im having a few issues. In a nut shell, we have 2 routers connecting to two provider routers via a switch. Each router pair are running HSRP for redundancy. Switches are configured to connect devices over a single VLAN.

[c-nsp] N7K tcam handling

2010-03-09 Thread Tim Durack
Anyone know if the N7K handles tcam exhaustion more gracefully than the 6500? (If you've lived through that experience, you'll know why I'm asking.) Docs suggest the N7K is generally smarter about handling tcam than the 6500. Or maybe NX-OS is smarter. Heres an idea for Cisco: how about porting

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Dobbins, Roland
On Mar 9, 2010, at 11:01 PM, Tim Durack wrote: Anyone know if the N7K handles tcam exhaustion more gracefully than the 6500? (If you've lived through that experience, you'll know why I'm asking.) Yes, it does, due to the EARL8. NetFlow works well, uRPF modes are flexible on a per-interface

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Tim Stevenson
Hi Tim, please see inline below: At 08:01 AM 3/9/2010, Tim Durack clamored: Anyone know if the N7K handles tcam exhaustion more gracefully than the 6500? (If you've lived through that experience, you'll know why I'm asking.) Yes, it does. I say that because n7k will reject your configuration

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Tim Durack
On Tue, Mar 9, 2010 at 12:10 PM, Tim Stevenson tstev...@cisco.com wrote: Yes, it does. I say that because n7k will reject your configuration if it won't fit within the constraints of the hw resources. C6K will instead punt to software to let the RP CPU enforce the ACL (and you can probably

Re: [c-nsp] MAC Address 'static' and HSRP failover

2010-03-09 Thread Peter Rathlev
On Tue, 2010-03-09 at 23:05 +1030, mark walters wrote: [...] The config is pretty vanilla but the one thing that is really strange is the fact that both switches are learning the virtual MAC and neither is purged during failover. In previous configs port-security has caused the MAC addresses

Re: [c-nsp] ASA output of show dhcpd binding - odd hardware address?

2010-03-09 Thread Church, Charles
There isn't a .12 appended to the end. It's actually the '01' at the front that was prepended. I think it has something to do with bootp clients vs. DHCP clients that causes the '01' to show up. I believe '01' indicates ethernet, if memory serves me correctly. Chuck Church Network Planning

Re: [c-nsp] IPSec crypto map on MPLS enabled interface?

2010-03-09 Thread Tim Devries
-Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Peter Rathlev Sent: March-09-10 7:36 AM To: Phil Mayers Cc: cisco-nsp Subject: Re: [c-nsp] IPSec crypto map on MPLS enabled interface? On Tue, 2010-03-09 at 10:49 +,

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Tim Stevenson
Hi Tim, Sorry about that, assumed you were talking about ACL TCAM, but you are referring to FIB TCAM. In the scenario you mention, prefixes are installed in the FIB TCAM on a first come first served basis. Packets not matching a prefix in the FIB TCAM are punted to the CPU, but such traffic

Re: [c-nsp] Incorrect bandwidth

2010-03-09 Thread Andy Koch
On Tue, Mar 9, 2010 at 03:26, nasir.sha...@bt.com wrote: Hi, I have an 2621XM running c2600-ik9s-mz.123-22a.bin and I noticed something strange. Reports were showing utilisation of more than 100%. This can be true in some cases but for E1 interfaces I always thought that the router

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Tim Durack
On Tue, Mar 9, 2010 at 1:59 PM, Tim Stevenson tstev...@cisco.com wrote: As you probably know, n7k today has a 128K FIB TCAM, inadequate to hold full routes anyway. Near-term we will have an XL card that holds 900K prefixes. In that case, you should not run out of FIB TCAM in the case you

Re: [c-nsp] ASA output of show dhcpd binding - odd hardware address?

2010-03-09 Thread David White, Jr. (dwhitejr)
The heading of the column is incorrect. It says Hardware address, but what is really being presented is the DHCP Client Identifier (if sent), or hardware address. If you would like this changed, please open a TAC case and let me know the case number. There is a bug for this, but it was closed,

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Tony Varriale
- Original Message - From: Tim Stevenson tstev...@cisco.com To: Tim Durack tdur...@gmail.com Cc: cisco-nsp@puck.nether.net Sent: Tuesday, March 09, 2010 12:59 PM Subject: Re: [c-nsp] N7K tcam handling Hi Tim, Sorry about that, assumed you were talking about ACL TCAM, but you are

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Tim Stevenson
Hi Tony, The FIB TCAM is already dynamically allocated as of 4.2 (ie, no static/fixed allocation, blocks of various width entries grow/shrink as necessary). At the control plane, you can control the max prefixes for each, which naturally limits the h/w consumption to those numbers as well.

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Gert Doering
Hi, On Tue, Mar 09, 2010 at 11:01:47AM -0500, Tim Durack wrote: Heres an idea for Cisco: how about porting NX-OS to the 6500? Or release a new Sup that makes the C6K an N6.5K? I think you would make a lot of customers happy. Seconded. Wanna-have! (Only positive words in here!!) gert --

Re: [c-nsp] N7K tcam handling

2010-03-09 Thread Gert Doering
Hi, On Tue, Mar 09, 2010 at 09:10:55AM -0800, Tim Stevenson wrote: C6K will continue to evolve and they do have a roadmap to a new sup fabric. new sup and fabric is nice and dandy, but working OS with modularity, memory protection and all the 21st century stuff (= NX-OS :) ) would be much

Re: [c-nsp] GSR: Failed to Allocate MBUS Channel / Fabric Handing Faield: Invalid bandwidth mode.

2010-03-09 Thread e ninja
Bharath, You didn't send the requested sh contr fia from the attach sessions to the LCs. Anyhow, the error messages below indicate your fabric bandwidth mode is invalid. This should be corrected. Remember, the 12012 can operate in full and quarter (with only Eng 0 LCs support) bandwidth. See

Re: [c-nsp] Spanning-Tree vs. EoMPLS links in SXI2?

2010-03-09 Thread Peter Rathlev
On Tue, 2010-03-09 at 21:26 +0100, Gert Doering wrote: On cisco.com, I found configuration options for 12.0S on GSRs to enable/disable forwarding of VTP, STP, CDP individually (l2protocol stp ...), but that's not available on SXI2. There seems to be a l2protocol-tunnel proto interface config

[c-nsp] SXI4 release date?

2010-03-09 Thread Adam Korab
Hi folks, Anybody heard anything as to when SXI4 will be made available? We're currently debating deploying a dev image due to a bug in SXI3 affecting VSS operation, but if it's coming Real Soon Now, we may just stay with the devil we know. Thanks in advance, --Adam

Re: [c-nsp] SXI4 release date?

2010-03-09 Thread Jason Lixfeld
I hear that it's supposed to be at some point in April. I'm sitting on a CSM sync bug in SXI3 that is supposed to be fixed in 4. On 2010-03-09, at 5:13 PM, Adam Korab adam.ko...@gmail.com wrote: Hi folks, Anybody heard anything as to when SXI4 will be made available? We're currently

[c-nsp] changing password on catos

2010-03-09 Thread Sony Scaria
Hello, I was trying to change the password on catos, and this is how the device responded. I want to know whether this (Usage: set password) is just a warning or the password has never been changed!!. Since i use tacacs and the device is in a remote place, i cant test the POLR right now. 6509

Re: [c-nsp] changing password on catos

2010-03-09 Thread Dale Shaw
Hi, On Wed, Mar 10, 2010 at 12:16 PM, Sony Scaria sony.sca...@gmail.com wrote: I was trying to change the password on catos, and this is how the device responded. I want to know whether this (Usage: set password) is just a warning or the password has never been changed!!. Since i use tacacs

Re: [c-nsp] rtmcmd.sh generates errors

2010-03-09 Thread Пономарев Алексей
On 03/06/2010 04:32 AM, Abdel Bidar wrote: Hi Guys, I would like to use mrtg to report on our SCE. I have followed Cisco documentation. When I run the script rtmcmd.sh I get some errors. Have someone had the same issues ? I am running on Linux server. Thanks Regards Abdel

[c-nsp] Cisco VPN Client Assigns Incorrect Default Gateway

2010-03-09 Thread Aaron Riemer
Hi Guys, I am hoping someone may be able to help me out here. I am trying to assign a block of IP Addresses to my VPN clients (specifically the subnet 192.168.254.0/24) that is not on use on the internal network. For some reason the clients are assigned a default gateway even though this is

[c-nsp] 3560 leaking broadcasts

2010-03-09 Thread Ian Henderson
Hi folks, Has anyone ever seen broadcasts leaking from an SVI into a layer 3 interface on a 3560? We've got a managed Ethernet link between a 3560G-48TS (Auckland, 12.2(50)SE1 IP Services) and a 3750G-24TS (Sydney, 12.2(53)SE IP Services) configured as a /31 layer 3 interface on both