Re: [c-nsp] Multicast

2013-04-17 Thread M K
Hi allI have found out why this was happening , I already configured MPLS TE in 
my network and that's why the RPF check failure occured !
BR,

 CC: cisco-nsp@puck.nether.net
 From: thegame...@yahoo.com
 Subject: Re: [c-nsp] Multicast
 Date: Mon, 15 Apr 2013 07:03:13 -0400
 To: gunner_...@live.com
 
 I've seen that before when the RPF interface is one where PIM is not enabled. 
  Have you double checked  to make sure that PIM is up, working, and has 
 neighbors on all of the interfaces (don't forget loopbacks)?
 
 David Barak
 
 Sent from a mobile device, please forgive autocorrection.
 
 On Apr 15, 2013, at 4:53 AM, M K gunner_...@live.com wrote:
 
  The Unicast routing table is fine , I have checked all OSPF enabled and 
  routes are advertised correctlyI am wondering if R3 is suffering from RPF 
  check , why the rp mapping appeared ?
  R3#sh ip rpf 9.9.0.7RPF information for ? (9.9.0.7)  RPF interface: 
  GigabitEthernet0/0.34  RPF neighbor: ? (9.9.34.4)  RPF route/mask: 
  9.9.0.7/32  RPF type: unicast (ospf 9)  Doing distance-preferred lookups 
  across tables  RPF topology: ipv4 multicast base, originated from ipv4 
  unicast base
  R6#sh ip rpf 9.9.0.7 failed, no route existsR6#ping 9.9.0.7 souR6#ping 
  9.9.0.7 source lo0Type escape sequence to abort.Sending 5, 100-byte ICMP 
  Echos to 9.9.0.7, timeout is 2 seconds:Packet sent with a source address of 
  9.9.0.6 !Success rate is 100 percent (5/5), round-trip min/avg/max = 
  8/20/52 ms
  
  
  From: gunner_...@live.com
  To: cisco-nsp@puck.nether.net
  Subject: Multicast
  Date: Mon, 15 Apr 2013 09:21:19 +0300
  
  
  
  
  Hi allI have the below topology
  R2 -- R3 --  R5 |   |   |R7 -- R4 -- R6
  I have enabled multicast-routing on all the topology (ip pim sparse-mode on 
  all interfaces)I have configured R7 to be my RP
  ip pim bsr-candidate Loopback0 0ip pim rp-candidate Loopback0 priority 200
  Now , the issue is on R3 i have turned on R3 debug ip pim bsr
  R3#sh ip pim rp mapping PIM Group-to-RP Mappings
  Group(s) 224.0.0.0/4  RP 9.9.0.7 (?), v2Info source: 9.9.0.7 (?), via 
  bootstrap, priority 200, holdtime 150 Uptime: 07:48:54, expires: 
  00:02:27
  I can see the rp mapping but in the log messages
  *Apr 15 09:10:07.395: PIM-BSR(0): bootstrap (9.9.0.7) on non-RPF path 
  GigabitEthernet0/0.23 or from non-RPF neighbor 9.9.34.4 discarded*Apr 15 
  09:10:07.399: PIM-BSR(0): 9.9.0.7 bootstrap forwarded on Loopback0*Apr 15 
  09:10:07.403: PIM-BSR(0): 9.9.0.7 bootstrap forwarded on 
  GigabitEthernet0/0.23*Apr 15 09:10:07.403: PIM-BSR(0): 9.9.0.7 bootstrap 
  forwarded on GigabitEthernet0/0.35*Apr 15 09:10:07.407: PIM-BSR(0): 
  bootstrap (9.9.0.7) on non-RPF path Loopback0 or from non-RPF neighbor 
  9.9.34.4 discarded
  ?
  On R5 and R6 , i cannot see any informationR5#sh ip pim rp mapping PIM 
  Group-to-RP Mappings
  BR,   
  ___
  cisco-nsp mailing list  cisco-nsp@puck.nether.net
  https://puck.nether.net/mailman/listinfo/cisco-nsp
  archive at http://puck.nether.net/pipermail/cisco-nsp/
  
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] IPv6 Transition - IP/MPLS Backbone

2013-04-17 Thread Mattias Gyllenvarg
Beware of one thing 6PE can not do.

BGPv6 over multi-hop will not work as there is no recursive lookup from v6
too v4 in your BGP speaker.
This is a feature, not a bug... so it will not be fixed.

Otherwise 6PE is a breeze.


On 14 April 2013 21:56, Ahmed Hilmy hilmy...@gmail.com wrote:

 Hello Expert,

 We are planning to deploy IPv6 at our IPv4 Backbone, our PE to as Dual
 Stack and carry IPv6 packet through MPLS label.
 There are different scenarios, one of them is 6PE.
 Would you please guide me from where can i start ?

 Thanks,

 Ahmed
 ___
 cisco-nsp mailing list  cisco-nsp@puck.nether.net
 https://puck.nether.net/mailman/listinfo/cisco-nsp
 archive at http://puck.nether.net/pipermail/cisco-nsp/




-- 
*Med Vänliga Hälsningar - Best Regards*

*Mattias Gyllenvarg*
*Nätutveckling*
Bredband2

Tel: +46 406219712
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Config template utility?

2013-04-17 Thread Jimbo Jones
Hi,

Looking for any recommendations for a template utility - i.e., for adding new 
vrf's, interfaces, vlans to switches etc? Where you just enter in variables 
(eg,  vrf name, rd), and a pre-defined template is generated with the variables 
entered.

Has anyone used Solarwinds network config manager?

Cisco Template Manager? (http://www.gelogic.net/?page_id=3)

Thanks.   
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Config template utility?

2013-04-17 Thread Andrew Miehs
I use the template toolkit perl module.
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Switchport trunk allowed issues

2013-04-17 Thread amir agha
Hi
I am writing a EEM using Cisco ios cli, can anyone have valuable suggestion 
about how to materialize it. Following is the topic
Using following command on switch i.e
 
 switchport trunk allowed vlan add/remove/all/except/none range

However, if one forgets to include the add/remove/all/except/none keyword, 
the command defaults to replace:

switchport trunk allowed vlan range
 
the VLAN that has already been placed on vlan deleted and result in downtime

I would like to disable the use of: switchport trunk allowed vlan range, 
 
and replace it with a custom EEM command like: 
 
1. switchport trunk allowed vlan none.
2. switchport trunk allowed vlan add add range
3. switchport trunk allowed vlan add remove range
This would correct a dangerous IOS syntax.
 
Looking forward
Ami
Norway 
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Slow Inter-Vlan traffic

2013-04-17 Thread Sébastien MALHEIRO
HHi,



We’re having some issues with inter-vlan traffic going pretty slow on
6504-E chassis working in VSS (VS-S720-10G / WS-X6748-GE-TX), running IOS
version 12.2(33)SXH5.



Here’s the thing :

We have added 2 new Vlans on the swtichs (Vlan 41 : Production / Vlan 95 :
Admin).

Our customer told us that things are going pretty slow on both vlans (we
have seen 1.5Mbits/s of maximum bandwidth on Vlan 41).



Looking forward we saw that there is no distributed cache traffic on the
SVIs :



#sh interfaces Vlan41 stats

Vlan41

  Switching pathPkts In   Chars In   Pkts Out  Chars Out

   Processor  649544280562 1553329976305

 Route cache6116040  5895931568427463 10028760624

   Distributed cache  0  0  0  0

   Total6180994  5938737188582795 10038736929



#sh interfaces Vlan95 stats

Vlan95

  Switching pathPkts In   Chars In   Pkts Out  Chars Out

   Processor 732380   468870182009253  128644656

 Route cache8377033 49514069345756730  480387249

   Distributed cache  0  0  0  0

   Total9109413 49982939527765983  609031905



On older (working well) SVIs added on the switchs we saw that packets are
going to distributed cache.

I’m not a expert on this but as far as I understand I can see that our
linecards are working in acef mode and that cef is enabled on the 2 new
SVIs (the sh cef interface output is the same on all the SVIs configured on
the switchs) :

#sh cef interface Vlan 41

Vlan41 is up (if_number 460)

  Corresponding hwidb fast_if_number 460

  Corresponding hwidb firstsw-if_number 460

  Internet address is X.X.X.X/X

  ICMP redirects are always sent

  IP unicast RPF check is disabled

  Output features: HW Shortcut Installation

  Inbound access list is not set

  Outbound access list is not set

  IP policy routing is disabled

  BGP based policy accounting on input is disabled

  BGP based policy accounting on output is disabled

  Hardware idb is Vlan41

  Fast switching type 22, interface type 147

  IP CEF switching enabled

  IP CEF switching turbo vector

  IP Null turbo vector

  IP prefix lookup IPv4 mtrie generic

  Input fast flags 0x0, Output fast flags 0x0

  ifindex 459(459)

  Slot unknown (-1) Slot unit 41 VC -1

  Transmit limit accumulator 0x0 (0x0)

  IP MTU 1500



#sh cef interface vlan 95

Vlan95 is up (if_number 455)

  Corresponding hwidb fast_if_number 455

  Corresponding hwidb firstsw-if_number 455

  Internet address is X.X.X.X/X

  ICMP redirects are always sent

  IP unicast RPF check is disabled

  Output features: HW Shortcut Installation

  Inbound access list is not set

  Outbound access list is not set

  IP policy routing is disabled

  BGP based policy accounting on input is disabled

  BGP based policy accounting on output is disabled

  Hardware idb is Vlan95

  Fast switching type 22, interface type 147

  IP CEF switching enabled

  IP CEF switching turbo vector

  IP Null turbo vector

  IP prefix lookup IPv4 mtrie generic

  Input fast flags 0x0, Output fast flags 0x0

  ifindex 454(454)

  Slot unknown (-1) Slot unit 95 VC -1

  Transmit limit accumulator 0x0 (0x0)

  IP MTU 1500



Moreover the “show ip cef vlan” output show that the good prefixes are
attached to the SVIs.

We also saw in the “show interface vlan” output that there are no “L3
in/out Switched” packets going through.



We would like to know where we could look to find the origin of this
problem.

Any Idea would be appreciated.



 Thanks.
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Switchport trunk allowed issues

2013-04-17 Thread Phil Mayers

On 17/04/13 12:08, amir agha wrote:

Hi
I am writing a EEM using Cisco ios cli, can anyone have valuable suggestion 
about how to materialize it. Following is the topic
Using following command on switch i.e

  switchport trunk allowed vlan add/remove/all/except/none range

However, if one forgets to include the add/remove/all/except/none keyword, 
the command defaults to replace:

switchport trunk allowed vlan range

the VLAN that has already been placed on vlan deleted and result in downtime

I would like to disable the use of: switchport trunk allowed vlan range,

and replace it with a custom EEM command like:

1. switchport trunk allowed vlan none.
2. switchport trunk allowed vlan add add range
3. switchport trunk allowed vlan add remove range
This would correct a dangerous IOS syntax.


I don't know the specific answer to your question, except that I think 
it *is* possible to intercept CLI commands with EEM and stop them - no 
idea how though.


An easy alternative is;

alias interface tagvlan switchport trunk allowed vlan add
alias interface detagvlan switchport trunk allowed vlan remove

...then train your staff to do:

int Gi9/1
  tagvlan 100
  detagvlan 101


Or use TACACS to block the dangerous pattern.
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Slow Inter-Vlan traffic

2013-04-17 Thread Phil Mayers

On 17/04/13 12:21, Sébastien MALHEIRO wrote:


#sh interfaces Vlan41 stats
#sh cef interface Vlan 41


You have to be a bit careful with these types of commands on 6500. Some 
of them show software state, some of them hardware state, and it 
requires some experience to know which.


It sounds like one or both of the new SVIs are being forwarded on CPU. 
Check the output of sh run int xxx and try a shut / no shut. It 
could be a software bug or TCAM mis-program, or you've configured a 
feature which has disabled hardware forwarding.

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] EEM applet for Vlan for switches

2013-04-17 Thread amir agha
Hi 
In routers for writing EEM applet through Cisco IOS Cli we normally use 
following command
event manager applet (name) trap
 
Does anyone has idea or suggestion that which command is used on Switches to 
write EEM applet through Cisco IOS Cli as the above mentioned command is not 
working on switches. What is the syntax??
 
Any solid and concrete suggestion.?
Ami 
Norway
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Switchport trunk allowed issues

2013-04-17 Thread Saku Ytti
On 17 April 2013 14:08, amir agha monito...@yahoo.com wrote:

Hi Ami,


 However, if one forgets to include the add/remove/all/except/none keyword, 
 the command defaults to replace:

 switchport trunk allowed vlan range

 the VLAN that has already been placed on vlan deleted and result in downtime

Many have solved same problem in TACACS.

permit trunk allowed vlan add.*
permit trunk allowed vlan remove.*
permit trunk allowed vlan all.*
permit trunk allowed vlan none.*
permit trunk allowed vlan except.*
deny trunk allowed vlan .*


--
  ++ytti
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] EEM applet for Vlan for switches

2013-04-17 Thread A . L . M . Buxey
Hi,

 Does anyone has idea or suggestion that which command is used on Switches to 
 write EEM applet through Cisco IOS Cli as the above mentioned command is not 
 working on switches. What is the syntax??

WHAT switches are you dealing with as many dont have any EEM ability

alan
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Cisco Security Advisory: Cisco Network Admission Control Manager SQL Injection Vulnerability

2013-04-17 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Cisco Security Advisory: Cisco Network Admission Control Manager SQL Injection 
Vulnerability

Advisory ID: cisco-sa-20130417-nac

Revision 1.0

For Public Release 2013 April 17 16:00  UTC (GMT)

+--

Summary
===

Cisco Network Admission Control (NAC) Manager contains a vulnerability that
could allow an unauthenticated remote attacker to execute arbitrary code and
take full control of the vulnerable system. A successful attack could allow an
unauthenticated attacker to access, create or modify any information in the NAC
Manager database. 

Cisco has released free software updates that address this vulnerability. 

There are no workarounds for this vulnerability.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130417-nac
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.11 (GNU/Linux)

iF4EAREIAAYFAlFu1FEACgkQUddfH3/BbTr/jwD/UmdJ5/x0iKBt+h5P7CyDoCw1
XjSDuB/0AXMfEQLCIXIA/3eqYPgDyYs6Np3C/LGVU/HPNYsC7u7HQ/bV599WGwwb
=RRHX
-END PGP SIGNATURE-
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


[c-nsp] Cisco Security Advisory: Cisco TelePresence Infrastructure Denial of Service Vulnerability

2013-04-17 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Cisco Security Advisory: Cisco TelePresence Infrastructure Denial of Service 
Vulnerability

Advisory ID: cisco-sa-20130417-tpi

Revision 1.0

For Public Release 2013 April 17 16:00  UTC (GMT)

+--

Summary
===

Cisco TelePresence multipoint control unit (MCU) and Cisco TelePresence Server
contain a vulnerability that could allow an unauthenticated, remote attacker to
trigger the reload of an affected system.

Cisco has released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are not available. This advisory
is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130417-tpi
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.11 (GNU/Linux)

iF4EAREIAAYFAlFu1F0ACgkQUddfH3/BbTrooAD9Hd1bHNtH6qE25KH2qSKx0Xd5
55+2JOZHT4CmjoVhaSMA+wWqGdVUbbtVtzIK0OZ4b/7tVRNtTmtoIjr9FA60WxWS
=8gT5
-END PGP SIGNATURE-
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Slow Inter-Vlan traffic

2013-04-17 Thread Andrew Miehs
On 17/04/2013, at 21:21, Sébastien MALHEIRO s.mal...@gmail.com wrote:
 
 We’re having some issues with inter-vlan traffic going pretty slow on
 6504-E chassis working in VSS (VS-S720-10G / WS-X6748-GE-TX), running IOS
 version 12.2(33)SXH5.

This seems like a very old version - especially if you are running VSS.
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

[c-nsp] Terminating lots of double-tagged vlans

2013-04-17 Thread Simon Lockhart
All,

I'm working on a project which uses GPON to connect tens of thousands of 
properties in a fibre-to-the-home environment. Each property will be handed
off to me as a double-tagged vlan, one per property. Obviously I don't want
to manually create tens of thousands of subinterfaces on a router, and I'm 
sure there's a better way of doing this.

What I'd come up with is that I'd ignore the inner tags, and just use the 
outer S-Tag to put the properties into subnets (one per S-Tag), and then just
do DHCP. However, I'm not quite sure how I'd achieve this.

This is obviously a common problem for people to solve, so how do others sort
it out?

The devices I'd typically use include Cisco 6500/SUP720, ME3600, ASR1k, and
smaller stuff like the 3750/3560.

Any suggestions?

Many thanks,

Simon
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Terminating lots of double-tagged vlans

2013-04-17 Thread Simon Lockhart
On Wed Apr 17, 2013 at 12:57:05PM -0700, Bruce Pinsky wrote:
 Simon Lockhart wrote:
  What I'd come up with is that I'd ignore the inner tags, and just
  use the outer S-Tag to put the properties into subnets (one per
  S-Tag), and then just do DHCP. However, I'm not quite sure how I'd
  achieve this.
  
  The devices I'd typically use include Cisco 6500/SUP720, ME3600,
  ASR1k, and smaller stuff like the 3750/3560.
  
 
 http://www.cisco.com/en/US/docs/ios/lanswitch/configuration/guide/lsw_ieee_802.1q.html#wp1027258

Oh, great, that makes things easy :) I didn't realise you could do that.

Looks like what would work then is to plug the GPON handoff into an ME3600
and use the flexible vlan rewriting on that to ensure that the outer tag is
unique for my network, then aggregate it through our existing L2 access 
switches into an ASR1k doing access routing.

I think I must have been over-thinking the problem.

Many thanks,

Simon
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Terminating lots of double-tagged vlans

2013-04-17 Thread Bruce Pinsky
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Simon Lockhart wrote:
 All,
 
 I'm working on a project which uses GPON to connect tens of thousands
 of properties in a fibre-to-the-home environment. Each property will
 be handed off to me as a double-tagged vlan, one per property.
 Obviously I don't want to manually create tens of thousands of
 subinterfaces on a router, and I'm sure there's a better way of doing
 this.
 
 What I'd come up with is that I'd ignore the inner tags, and just
 use the outer S-Tag to put the properties into subnets (one per
 S-Tag), and then just do DHCP. However, I'm not quite sure how I'd
 achieve this.
 
 This is obviously a common problem for people to solve, so how do
 others sort it out?
 
 The devices I'd typically use include Cisco 6500/SUP720, ME3600,
 ASR1k, and smaller stuff like the 3750/3560.
 

http://www.cisco.com/en/US/docs/ios/lanswitch/configuration/guide/lsw_ieee_802.1q.html#wp1027258


- -- 
=
bep

-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlFu/pEACgkQE1XcgMgrtyYfzQCg+R40qBuc0FlafjNzgiPhPXTw
tU8AoKK6pyoZFjBH8qFSNWXTzo8u+GDq
=2xC3
-END PGP SIGNATURE-
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] BGP Filter - Best Practice

2013-04-17 Thread Ahmed Hilmy
Hello Nick,

Thanks for your reply, i am totally agree with you.

Regards,
Ahmed


On Tue, Apr 16, 2013 at 9:12 PM, Nick Hilliard n...@foobar.org wrote:

 On 15/04/2013 21:44, Ahmed Hilmy wrote:
  I am using Prefix-list and as-path for BGP filter.
  But if i  apply Prefix-list as inbound filter at PE, then from PE to RR (
  Route Reflector ) i apply as-path filter, i think it is more scalable
 than
  modify Prefix-list continuously ? or use community ?
  If my question not clear please ask me.

 it depends.

 Prefix lists are very fast because they are implemented as a trie, and it
 is very fast to look up an entry in a trie.

 Community lists can be fast (standard, i.e. integer comparison) or slow
 (extended, i.e. regular expression).

 as-path lists are slow because they use regular expressions.

 If you need to filter BGP updates, it is usually fastest to use prefix
 lists or standard community lists.  It makes little difference whether you
 use extended communities or as-path lists - both are slow.

 Nick


 ___
 cisco-nsp mailing list  cisco-nsp@puck.nether.net
 https://puck.nether.net/mailman/listinfo/cisco-nsp
 archive at http://puck.nether.net/pipermail/cisco-nsp/

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Switchport trunk allowed issues

2013-04-17 Thread Arie Vayner (avayner)
Something like this should do the trick:

event manager applet ALLOWED-VLAN
 event cli pattern switchport trunk allowed vlan +[0-9]+.* mode interface 
enter
 action 001 puts ERROR: switchport trunk allowed vlan is not allowed. Use 
Add/Remove
 action 002 set _exit_status 0


The regex on the cli pattern catches only the switchport trunk allowed vlan 
with numbers directly after the vlan keyword (skipping 1+ spaces).
If you try the add/remove/none options the regexp would not match.

I didn't test it too much, so please do before deploying in production.

Arie

-Original Message-
From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of amir 
agha
Sent: Wednesday, April 17, 2013 04:08
To: cisco-nsp@puck.nether.net
Subject: [c-nsp] Switchport trunk allowed issues

Hi
I am writing a EEM using Cisco ios cli, can anyone have valuable suggestion 
about how to materialize it. Following is the topic Using following command on 
switch i.e
 
 switchport trunk allowed vlan add/remove/all/except/none range

However, if one forgets to include the add/remove/all/except/none keyword, 
the command defaults to replace:

switchport trunk allowed vlan range
 
the VLAN that has already been placed on vlan deleted and result in downtime

I would like to disable the use of: switchport trunk allowed vlan range, 
 
and replace it with a custom EEM command like: 
 
1. switchport trunk allowed vlan none.
2. switchport trunk allowed vlan add add range
3. switchport trunk allowed vlan add remove range This would 
correct a dangerous IOS syntax.
 
Looking forward
Ami
Norway
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net 
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] 4500x - SFP-GE-T

2013-04-17 Thread CiscoNSP List
Just an update to this - I have found some third party SFP's(Copper) that work 
without issue from NHR - They are specifically designed for the 4500x's (But 
also work fine in ASR's/4948's etc etc)
SFP-GE-T-WIRE-NHR - 1000BASE-T SFP with
wire clip (mainly for 4500X)



 From: cisconsp_l...@hotmail.com
 To: cisco-nsp@puck.nether.net
 Date: Sat, 6 Apr 2013 08:11:31 +1100
 Subject: Re: [c-nsp] 4500x - SFP-GE-T
 
 Looks like I spoke too soon - Some of the NHR ones get stuck also :(
 
 
  From: cisconsp_l...@hotmail.com
  To: cisco-nsp@puck.nether.net
  Date: Fri, 5 Apr 2013 13:03:33 +1100
  Subject: Re: [c-nsp] 4500x - SFP-GE-T
  
  To reply to my own post - Found some spare NHR SFP's, and they work as 
  expected.if anyone has other alternatives they recommend, would be 
  greatly appreciated.
  
  Now have 2 ports with stuck Turbo X SFP's  :(
  
  
   From: cisconsp_l...@hotmail.com
   To: cisco-nsp@puck.nether.net
   Date: Fri, 5 Apr 2013 12:40:30 +1100
   Subject: [c-nsp] 4500x - SFP-GE-T
   
   Hi Guys,
   
   Hoping someone out there is using SFP-GE-T's in a 4500-X that are able to 
   be EASILY removed?
   
   I have some Turbo X ones that are impossible to remove from the 4500x 
   (But they work fine in an ASR)
   
   Cheers. 
   ___
   cisco-nsp mailing list  cisco-nsp@puck.nether.net
   https://puck.nether.net/mailman/listinfo/cisco-nsp
   archive at http://puck.nether.net/pipermail/cisco-nsp/

  ___
  cisco-nsp mailing list  cisco-nsp@puck.nether.net
  https://puck.nether.net/mailman/listinfo/cisco-nsp
  archive at http://puck.nether.net/pipermail/cisco-nsp/
 
 ___
 cisco-nsp mailing list  cisco-nsp@puck.nether.net
 https://puck.nether.net/mailman/listinfo/cisco-nsp
 archive at http://puck.nether.net/pipermail/cisco-nsp/
  
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Most Stable IOS-XR Version for ASR9K

2013-04-17 Thread Mohamed A. Monsef Abbas
Use the one in the CCIE-SP exam at least you can practise on it while using
it ;)


On Thu, Apr 18, 2013 at 4:55 AM, Xu Hu jstuxuhu0...@gmail.com wrote:

 Hi Folks,

 Any idea which version is the most stable one currently, need to deploy new
 ASR9K inside the network, am considering to use which version.

 No need additional features, just normal OSPF, BGP, MPLS, MPLS/TE,
 MPLS/VPN.

 Thanks in advance.

 Regards,
 Hu Xu
 ___
 cisco-nsp mailing list  cisco-nsp@puck.nether.net
 https://puck.nether.net/mailman/listinfo/cisco-nsp
 archive at http://puck.nether.net/pipermail/cisco-nsp/




-- 
--
Do you Think we Can Fly ?
Well I Do.

Eng. Mohamed A. Monsef Abbas
Cisco Networks Engineer
CCIE® #37569 (RS)
CCNP® - CCIP® - CCDP®
CS-RSSS® - IPv6-FGCE®
ITIL® - ISO/IEC 27002®
Cell Phone : +2 0109 255  
Land Line  : +2 02 24 66 2 33 8

eg.linkedin.com/pub/mohamed-a-monsef-abbas/25/456/a61/
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/


Re: [c-nsp] Most Stable IOS-XR Version for ASR9K

2013-04-17 Thread judy teng


Do you have a choice? 4.0.3 was stable for while then more issues came out. It 
has reached engineering support. You have to upgrade to 4.2.3 or 4.3.0.

Version 4.3.0 has more feature for BNG. If you do not need it, you can stay 
with 4.2.3 but you have to install mandatory SMUs.

-Judy




 From: Mohamed A. DAbbas m.abdelmon...@gmail.com
To: Xu Hu jstuxuhu0...@gmail.com 
Cc: cisco-nsp@puck.nether.net cisco-nsp@puck.nether.net 
Sent: Wednesday, April 17, 2013 8:08 PM
Subject: Re: [c-nsp] Most Stable IOS-XR Version for ASR9K
 

Use the one in the CCIE-SP exam at least you can practise on it while using
it ;)


On Thu, Apr 18, 2013 at 4:55 AM, Xu Hu jstuxuhu0...@gmail.com wrote:

 Hi Folks,

 Any idea which version is the most stable one currently, need to deploy new
 ASR9K inside the network, am considering to use which version.

 No need additional features, just normal OSPF, BGP, MPLS, MPLS/TE,
 MPLS/VPN.

 Thanks in advance.

 Regards,
 Hu Xu
 ___
 cisco-nsp mailing list  cisco-nsp@puck.nether.net
 https://puck.nether.net/mailman/listinfo/cisco-nsp
 archive at http://puck.nether.net/pipermail/cisco-nsp/




-- 
--
Do you Think we Can Fly ?
Well I Do.

Eng. Mohamed A. Monsef Abbas
Cisco Networks Engineer
CCIE® #37569 (RS)
CCNP® - CCIP® - CCDP®
CS-RSSS® - IPv6-FGCE®
ITIL® - ISO/IEC 27002®
Cell Phone : +2 0109 255  
Land Line  : +2 02 24 66 2 33 8

eg.linkedin.com/pub/mohamed-a-monsef-abbas/25/456/a61/
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
___
cisco-nsp mailing list  cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/