[c-nsp] cisco regex puzzle of the day

2015-03-10 Thread Job Snijders
Hi all, On Juniper you can match in a single regular expression, any and all downstream customers of a peer, but not the peer itself (even prepended) with the following: "^64500+ [^64500]" This junos beauty will match for example: "64500 64500 123 123 444", but not "64500 64500" or "6450

Re: [c-nsp] cisco regex puzzle of the day

2015-03-12 Thread Job Snijders
Dear Mack, On Wed, Mar 11, 2015 at 05:28:06PM +, Mack McBride wrote: > I haven't tested this but it should work: > > (65400_)+([1-57-9][0-9]*_|6[01-35-9][0-9]*_|64[01-46-9][0-9]*_|645[1-9][0-9]*_|6450[1-9][0-9]*_|64500[0-9]+_)+ This solution meets the requirements. Extra points for avoiding

Re: [c-nsp] power requirement for WS-X614E-GE-45AT in reverse POE mode

2015-04-01 Thread Job Snijders
Hi Gert, On Wed, Apr 01, 2015 at 09:38:45AM +0200, Gert Doering wrote: > quick question, because I cannot find the answer on cisco.com. > > If I run a WS-X6148E-GE-45AT in reverse POE mode (feeding power into > the 6500), but do not use the ports for actual switching, will the line > card still r

Re: [c-nsp] power requirement for WS-X614E-GE-45AT in reverse POE mode

2015-04-01 Thread Job Snijders
On Wed, Apr 01, 2015 at 02:18:28PM +0100, Nick Hilliard wrote: > On 01/04/2015 14:04, Łukasz Bromirski wrote: > > PoE over fibre? Nah, you must have had misunderstood the specs. > > actually the theory is sound. They're injecting at +70dBm per strand, > which gives about 18kW power-over-fibre out

Re: [c-nsp] Cache DNS servers

2015-12-01 Thread Job Snijders
PowerDNS is really fast, I'd also evaluate "unbound" as caching server. You can use powerdns' loadbalancer "dnsdist" in front of whatever you end up using. All these are free.  Kind regards, Job   Original Message   From: Murat Kaipov Sent: dinsdag 1 december 2015 19:06 To: cisco-nsp@puck.neth

Re: [c-nsp] Stop IP Fragmentation attck

2016-04-26 Thread Job Snijders
On Tue, Apr 26, 2016 at 11:17:29AM -0700, Mike wrote: > On 04/26/2016 10:54 AM, Roland Dobbins wrote: > > But you really aren't being smart about this. Why not use S/RTBH on > > your edge router to simply block the sources, since they aren't spoofed? > > > > Export NetFlow from your edge router t

Re: [c-nsp] Stop IP Fragmentation attck

2016-04-26 Thread Job Snijders
On Tue, Apr 26, 2016 at 08:04:23PM +0100, Howard Jones wrote: > On 26/04/2016 19:24, Job Snijders wrote: > > FastNetMon: https://github.com/pavel-odintsov/fastnetmon > > Here is a presentation about one deployment: > > https://www.youtube.com/watch?v=0ahdxp_btHY > >

Re: [c-nsp] IPV6 RTBH on IOS

2016-05-02 Thread Job Snijders
On Mon, May 02, 2016 at 07:55:25PM +0200, Marco Marzetti wrote: > Do you have any ideas? Have you tried the same setup but with the following more-specific discard route instead of the /64? ipv6 route 100::1/128 null0 You also may want to set: interface null0 no ipv6 u

Re: [c-nsp] IPV6 RTBH on IOS

2016-05-02 Thread Job Snijders
On Mon, May 02, 2016 at 09:44:14PM +0200, Job Snijders wrote: > On Mon, May 02, 2016 at 07:55:25PM +0200, Marco Marzetti wrote: > > Do you have any ideas? > > ipv6 route 100::1/128 null0 Some testing showed that the above doesn't change the situation. As discussed

Re: [c-nsp] Bug in stat counters with VLANs?

2016-06-06 Thread Job Snijders
Do you have urpf (loose) enabled? Job   Original Message   From: Hank Nussbacher Sent: maandag 6 juni 2016 14:10 To: c-nsp Subject: [c-nsp] Bug in stat counters with VLANs? Running IOS-XR v.5.1.3 on ASR9010 and the "show interface" stats for sub-VLANs seems to be totally off: TenGigE0/1/1/7 is

Re: [c-nsp] Bug in stat counters with VLANs?

2016-06-06 Thread Job Snijders
Could be CSCut70604 - Logical interface counters doubled when uRPF enabled   Original Message   From: Job Snijders‎ Sent: maandag 6 juni 2016 14:14 To: Hank Nussbacher; c-nsp Subject: Re: [c-nsp] Bug in stat counters with VLANs? Do you have urpf (loose) enabled? Job   Original Message   From:

Re: [c-nsp] Products for dealing with packet re-ordering?

2018-01-10 Thread Job Snijders
On Thu, Jan 11, 2018 at 01:16:44AM +0200, Saku Ytti wrote: > On 11 January 2018 at 01:02, heasley wrote: > > is that entirely true? misorder is not (should not be) immediately > > interpretted as loss. it does imply loss and might encite an > > implementation to ACK or duplicate ACK a preceding se

Re: [c-nsp] IOS-XR BGP RR MCID (Multiple Cluster ID)

2018-03-11 Thread Job Snijders
On Sun, Mar 11, 2018 at 12:39:13PM +0200, Mark Tinka wrote: > Each major PoP has been configured with its unique, global Cluster-ID. > > This has been scaling very well for us. > > I think the Multiple Cluster-ID is overkill. Have you considered the downsides of sharing a Cluster-ID across multi

Re: [c-nsp] IOS-XR BGP RR MCID (Multiple Cluster ID)

2018-03-11 Thread Job Snijders
On Sun, Mar 11, 2018 at 01:57:01PM +0200, Mark Tinka wrote: > On 11/Mar/18 12:50, Job Snijders wrote: > > Have you considered the downsides of sharing a Cluster-ID across > > multiple boxes, > > IIRC, the biggest issue with this was if the RR was in-path (as it > used to b

Re: [c-nsp] IOS-XR BGP RR MCID (Multiple Cluster ID)

2018-03-11 Thread Job Snijders
On Sun, Mar 11, 2018 at 02:46:31PM +0200, Mark Tinka wrote: > On 11/Mar/18 14:20, Job Snijders wrote: > > > Folks - i'm gonna cut short here: by sharing the cluster-id across > > multiple devices, you lose in topology flexibility, robustness, and > > simplicity. >

Re: [c-nsp] IOS-XR BGP RR MCID (Multiple Cluster ID)

2018-03-12 Thread Job Snijders
On Mon, Mar 12, 2018 at 03:06:25PM +0200, Saku Ytti wrote: > Routing loop to me sounds like operational problem, that things are > broken. That will not happen. Indeed, that is what ORIGINATOR_ID is for. Kind regards, Job ___ cisco-nsp mailing list ci

Re: [c-nsp] XOS-XE bgp default neighbor shutdown ???

2018-09-26 Thread Job Snijders
On Wed, Sep 26, 2018 at 07:44:43PM +0200, Gert Doering wrote: > On Wed, Sep 26, 2018 at 04:44:55PM +, Matthew Huff wrote: > > Is there any way in IOS to set that all neighbors are by default > > shutdown until unshut? > > No, but the usual trick > > neigh 1.2.3.4 remote-as 5678 shutdown >

Re: [c-nsp] RPKI extended-community RFC8097

2020-04-18 Thread Job Snijders
On Sat, Apr 18, 2020 at 03:23:33PM +0200, Gert Doering wrote: > On Sat, Apr 18, 2020 at 12:41:43PM +, Ben Maddison wrote: > > Feel free to tell your Cisco SE if you think that's dumb. > > Indeed, that's dumb... and worse, nonintuitively dangerous. And this comes on top of XE's lack of RFC 821

Re: [c-nsp] RPKI extended-community RFC8097

2020-04-21 Thread Job Snijders
On Tue, Apr 21, 2020, at 23:34, Radu-Adrian FEURDEAN wrote: > On Tue, Apr 21, 2020, at 22:42, Nick Hilliard wrote: > > > BIRD. And RFC8097 doesn't exactly match that scenario either. > > > > RFC8097 is ibgp only. There are compelling reasons not to do this with > > ebgp. > > That's why it "does