Re: [c-nsp] Feedback on: Security Advice for Routers and Switches

2007-05-06 Thread Mark Tinka
On Sunday 06 May 2007 21:43, Mark Tinka wrote: * recommend the use of IP prefix lists as opposed to distribute lists; the former are more cumbersome. s/former/latter Mark. pgpChl7X6X9tn.pgp Description: PGP signature ___ cisco-nsp mailing list

Re: [c-nsp] Feedback on: Security Advice for Routers and Switches

2007-05-06 Thread Mark Tinka
On Sunday 06 May 2007 03:39, Joel M Snyder wrote: Any and all feedback is welcome! Very good paper! On point 12a (page 27), though: * recommend the use of IP prefix lists as opposed to distribute lists; the former are more cumbersome. * I'm personally very wary of route-flap dampening, in

Re: [c-nsp] Feedback on: Security Advice for Routers and Switches

2007-05-07 Thread Mark Tinka
On Monday 07 May 2007 15:34, Pete Templin wrote: True, but distribute lists can be more powerful. I'm curious... in what way distribute lists would be more flexible than prefix lists (perhaps I've been using prefix lists far too long). Might you have an example? Mark. pgpCvKhHhboKl.pgp

Re: [c-nsp] Version of Cisco IOS not supported on NPE300

2007-05-27 Thread Mark Tinka
On Sunday 27 May 2007 09:55, Pelle wrote: i do fully agree with saku: in the choice of running outdated software with bugs and security issues (while supported) or using up-to-date software (while unsupported), i would choose the fresh software 10 times out of 10. We've been running

Re: [c-nsp] Turning on MPLS.

2007-05-28 Thread Mark Tinka
On Monday 28 May 2007 12:48, Alex A. Pavlenko wrote: Most works fine, but some customers began to complain that they can not access certain sites in the Internet. I'm not sure but the situation looks like there is MTU mismatch somewhere. Is it mandatory to check and adjust MTUs when turning

Re: [c-nsp] Large MTU on catalyst switch

2007-05-28 Thread Mark Tinka
On Monday 28 May 2007 22:50, Gert Doering wrote: Uh, admittedly I only I tried this on 2950G-12/24 yet. As the 10/100-only models are a bit different, they might or might not support 1530 - I can't say. The 2950's (non-G) do not support jumbo frames. Mark. pgpYRraSATgj8.pgp Description:

Re: [c-nsp] Applying ACL

2007-05-31 Thread Mark Tinka
On Thursday 31 May 2007 08:35, Gert Doering wrote: Just to correct this small bit: default in IOS for packet ACLs is default-permit *if the ACL is completely missing*. But usually you're dead in the water as soon as you copy-and-paste a new version of the ACL and the first line gets

Re: [c-nsp] Advice on upgrade

2007-07-07 Thread Mark Tinka
On Saturday 07 July 2007 17:06, Gary Stanley wrote: I'd look at the 7201, it has a couple gb of memory, quite a few gig ports, only consumes 84W(?) of power, and is in 1u form factor. Would this box be capable of anything beyond 1Gbps (much less a sustained 800Mbps throughput)? From previous

Re: [c-nsp] Quick question about redundant connections.

2007-08-10 Thread Mark Tinka
On Friday 10 August 2007 22:47, Drew Weaver wrote: Is there a particular scheme for downstream switches to verify that an upstream router is actually functioning properly on a periodic basis? Sounds like a probable candidate for BFD; but doesn't quite explain why your box stops routing.

[c-nsp] MPLS LDP Authentication Scaling

2007-08-17 Thread Mark Tinka
Hello all. I've been going over some thoughts about scaling MPLS LDP authentication in an environment where all MPLS LER's or LSR's on the same subnet require LDP authentication. I've had a look at the 'mpls ldp password option' and 'mpls ldp password required' features, but these require

Re: [c-nsp] Cisco 1700 Series and WIC 4T Card

2007-08-20 Thread Mark Tinka
On Monday 20 August 2007 14:01, Tojonirina RAONISOAFIANINANA wrote: I would like to ask if a Cisco Router 1700 Series supports WIC 4T Card. Do you mean the HWIC-4T (haven't heard of the WIC-4T, could be wrong). According to: http://tinyurl.com/2e2b7z the HWIC-4T is NOT supported on the:

Re: [c-nsp] Use of name parameter on ip route

2007-08-23 Thread Mark Tinka
On Friday 24 August 2007 02:57, Tuc at T-B-O-H.NET wrote: WHY is the name command used on ip route? WHEN is it proper to use it, and when is it improper? Has anyone gotten burned USING it or NOT using it? I have seen it provide *functional* use with cisco-avpair attributes under an AAA

Re: [c-nsp] MTU on WS-C2960G-8TC-L

2007-08-27 Thread Mark Tinka
On Tuesday 28 August 2007 02:46, Justin Shore wrote: Does anyone know if the MTU on the 8-port 2960G can be raised? I need to carry IP/MPLS on a VLAN through one of these switches. The radio backhauls go up to 1536 so I the 2960 needs to support that at least. According to:

Re: [c-nsp] BGP hardware requirements

2007-08-30 Thread Mark Tinka
On Thursday 30 August 2007 17:51, Dracul wrote: 1. My 2851 is already ok for 2x 2MB link BGP Right. 2. I need to upgrade my 256MB memory to 512 MB I would say take the full 1GB. It's always best to max. out the memory on the routers so you have one less problem to worry about, especially

Re: [c-nsp] L2TPv3 and PA-4E

2007-09-06 Thread Mark Tinka
On Tuesday 04 September 2007 21:06, Vincent De Keyzer wrote: The fact is that I can create a .1q interface on a PA-4E port -... Just curious; does the 802.1Q encapsulation actually work on this PA? IIRC, IOS did not originally support 802.1Q on 10Mbps-only Ethernet interface; you required

Re: [c-nsp] L2TPv3 and PA-4E

2007-09-06 Thread Mark Tinka
On Friday 07 September 2007 11:36, Adrian Chadd wrote: Yup! I just verified it between a 7204 (with PA-8E's and a PA-4E) via a 2924XL to a 3640: Interesting... thanks. Cheers, Mark. pgp46pMO0mxQY.pgp Description: PGP signature ___ cisco-nsp

Re: [c-nsp] Routing recommendations

2007-09-12 Thread Mark Tinka
On Tuesday 11 September 2007 22:04, Justin Shore wrote: I'd recommend a 7201 or a short-stack 7600. Skipping off a bit... considering that the 7600 uses the same Supervisor (say, in this case, SUP720-3BXL) across all supported chassis', I'd be careful in making sure I get a chassis that will

Re: [c-nsp] RSP720 Supported linecards

2007-09-12 Thread Mark Tinka
On Tuesday 11 September 2007 21:28, Justin Shore wrote: In particular I want to confirm support for the... Uncertain about the rest, but... ACE,... We looked into this a couple of weeks back. It turns out the ACE (well, at least the ACE20-MOD-K9) will only be supported on the RSP720 when

Re: [c-nsp] cap'ing each host/ip to bw limits

2007-09-15 Thread Mark Tinka
On Saturday 15 September 2007 20:51, a. rahman isnaini r. sutan wrote: Yup, too much money to spend. My solution last couple years, one allot replaced with up to 10 ETINCs for each service gateway we have been running on and the traffic load redistributed. Couldn't agree more. Mark.

Re: [c-nsp] Recommended 7206 12.2(x)SB for MPLS?

2007-09-18 Thread Mark Tinka
On Wednesday 19 September 2007 02:06, Vinny Abello wrote: I know we're up to SB9 last I checked, but I haven't tested that yet. On SB6, when I started configuring mpls ip and mpls traffic-eng tunnels on interfaces with other routers and the LDP adjacency comes up, I notice a slight level of

Re: [c-nsp] Where to use the ES20 over the 6704/8

2007-09-23 Thread Mark Tinka
On Saturday 22 September 2007 04:34, Gert Doering wrote: Don't forget that IPv6 and MPLS cost extra license per ES card. Technically, the v6 and MPLS code would still run if you configured it, but without the proper licensing, such a configuration would considered illegal and (TAC)

Re: [c-nsp] Dialup problems on a AS5300

2007-11-27 Thread Mark Tinka
On Tuesday 27 November 2007 07:16, Justin Shore wrote: Does anyone have any ideas what I can check? What causes the 5300 to think a modem is bad and is it really, in fact, bad? What IOS version are you running on this box? Cheers, Mark. pgpKLQkx314oj.pgp Description: PGP signature

Re: [c-nsp] Dialup problems on a AS5300

2007-11-27 Thread Mark Tinka
On Tuesday 27 November 2007 22:32, Justin Shore wrote: Hi, Vinny. Thanks for the reply. Yes, they are MICA modems. The IOS rev is 12.3(22) running the Enterprise Plus w/ crypto featureset. I bumped it up this spring during the migration. I think that could be your problem. You are most

Re: [c-nsp] NPE-G100 and G2 on 7304 Router

2008-01-10 Thread Mark Tinka
On Thursday 10 January 2008 18:47, William Jackson wrote: We are considering upgrading to G2 cards for more throughput and I want to ask about any possible limits with BGP tables etc that I see mentioned on other platforms? We once crudely tested multiple full BGP sessions on an NPE-G2 to

Re: [c-nsp] MPLS hardware

2008-01-10 Thread Mark Tinka
On Thursday 10 January 2008 15:56, Mohacsi Janos wrote: VPLS is only supported with SIP/SPA cards with SUP720 or RSP-720. VPLS requires extra processing power on ports that SIP/SPA cards have I find this bit annoying... it would have been nice if Cisco supported VPLS on most or all of

Re: [c-nsp] MPLS hardware

2008-01-10 Thread Mark Tinka
On Friday 11 January 2008 01:14, Phil Bedard wrote: There are certainly alternatives for doing VPLS termination that are cheaper than Cisco, when you look at the cost of the ES20. Foundry and Alcatel both make lighter weight dense MPLS-enabled switches that Cisco doesn't have a good

[c-nsp] QoS Policing Upstream

2008-01-16 Thread Mark Tinka
Hello all. We are trying to find a clever, scalable way to police customer upstream traffic (inbound into PE router from the CE router) if the destination is to a specific set of prefixes behind one or more routers. Matching an ACL that defines destination prefixes is not an option as the

[c-nsp] Fwd: QoS Policing Upstream - Update!

2008-01-16 Thread Mark Tinka
Looks like we found what we were looking for: - QPPB Cheers, Mark. -- Forwarded Message -- Subject: QoS Policing Upstream Date: Thursday 17 January 2008 11:45 From: Mark Tinka [EMAIL PROTECTED] To: cisco-nsp@puck.nether.net Hello all. We are trying to find a clever

Re: [c-nsp] Differences between cisco 7606 and 7606-s

2008-01-21 Thread Mark Tinka
On Monday 21 January 2008 23:32, Ultra wrote: Can anyone explain me the differences between the Cisco 7606 and the Cisco 7606-s? I can¡t see it in the documentation I downloaded from cisco.com Some differences taken off the 7606-S's data sheet: * As part of the Cisco 7600 Series, the

Re: [c-nsp] Help getting started

2008-02-05 Thread Mark Tinka
On Monday 04 February 2008, Whisper wrote: Moreover, you need to provide a show version if you want people to comment on whether an IOS versions supports a specific feature or not. My gut says though, that a 2600-NonXM with 12.2 is not going to have VPN support. Actually, 12.3(25) on the

Re: [c-nsp] Cisco7609 as P layer

2008-02-15 Thread Mark Tinka
On Wednesday 13 February 2008, Kim Onnel wrote: Plus it would be unfair to compare price and performance of 7600 to an M320 and Juniper would never put an M7i or M10 as P, so its all about Positioning not just 'pure technical' judgement. This depends on the size and complexity of the

Re: [c-nsp] 100G Switch

2008-02-26 Thread Mark Tinka
On Wednesday 27 February 2008, Ian MacKinnon wrote: Nexus 7000 I am sure has it on the roadmap. My understanding is the Nexus 7010 has little control plane support for typical Metro-E, i.e., MPLS, e.t.c. Otherwise I guess CRS-1... Cisco are currently positioning the CRS-1 as a 100Gbps/slot

Re: [c-nsp] Loopback Advertise in OSPF

2008-02-26 Thread Mark Tinka
On Wednesday 27 February 2008, Darryl Dunkin wrote: If you're using /32 masks for your loopbacks (as you should): router ospf redistribute connected subnets The key part is to define 'subnets'. I'd advise against using 'redistribute' to announce any kind of prefixes into any kind of

Re: [c-nsp] Loopback Advertise in OSPF

2008-02-27 Thread Mark Tinka
On Wednesday 27 February 2008, Phil Mayers wrote: I think that's probably a bit dramatic (no offence intended). We've used redis connected / static for customer routes (edge networks) for quite a while now here with no problesm; initially in a VRF-lite model: If you read further on in my

Re: [c-nsp] Loopback Advertise in OSPF

2008-02-27 Thread Mark Tinka
On Wednesday 27 February 2008, David Barak wrote: I prefer to use passive default, and then only enable the correct interfaces. Agree! I also like the fact the IOS has introduced interface-level commands in 12.4 to enable OSPFv2 - that's definitely welcome. Mark. signature.asc

Re: [c-nsp] Loopback Advertise in OSPF

2008-02-27 Thread Mark Tinka
On Thursday 28 February 2008, Phil Mayers wrote: Yes I read that, but I am having a hard time seeing what the fundamental difference is between redis connected inside a VRF versus not (for the same protocol). Surely if one is bad, the other is? Because a vanilla VPN VRF has a very limited

Re: [c-nsp] 100G Switch

2008-02-27 Thread Mark Tinka
On Thursday 28 February 2008, Tim Stevenson wrote: To clarify, this chassis is 80G per slot *ready* (as are all the E chassis versions) - but there is no 80G/slot fabric shipping today. Okay, this clarifies my earlier-posted doubts. My guess is folk would be more inclined to assume

Re: [c-nsp] Loopback Advertise in OSPF

2008-02-27 Thread Mark Tinka
On Thursday 28 February 2008, Brandon Price wrote: Does anyone have links to some good examples of this configuration? We normally cover this in regional workshops. Will send you a link to some slides that discuss this routing policy, tomorrow. I am in the process of moving our small ISP

Re: [c-nsp] 100G Switch

2008-02-27 Thread Mark Tinka
On Thursday 28 February 2008, Ramcharan, Vijay A wrote: There is also the 6509-V-E chassis (which kinda looks like the Nexus only less shiny) that supposedly offers 80Gbps/slot (which is not exactly what you are looking for I guess but still might be worth investigating). I'm curious how

Re: [c-nsp] 100G Switch

2008-02-27 Thread Mark Tinka
On Thursday 28 February 2008, Tim Stevenson wrote: We have (or will shortly - launched, but not shipping) - the Nexus 7000 has 230G per slot capacity. The initially shipping 10G card can leverage 80G of that, but the initially shipping fabric will scale to support much higher capacity LCs in

Re: [c-nsp] 100G Switch

2008-02-27 Thread Mark Tinka
On Thursday 28 February 2008, Dino Farinacci wrote: Nope, the Cat6K has many more applications. Here are some differences between the two platforms: I'm familiar with the various features of the 6500 and Nexus 7010; what I was asking was what plans Cisco have for customers that require

[c-nsp] Fwd: Re: Loopback Advertise in OSPF

2008-02-27 Thread Mark Tinka
-BGP-Techniques.pdf Cheers, Mark. -- Forwarded Message -- Subject: Re: [c-nsp] Loopback Advertise in OSPF Date: Thursday 28 February 2008 From: Mark Tinka [EMAIL PROTECTED] To: Brandon Price [EMAIL PROTECTED] On Thursday 28 February 2008, Brandon Price wrote: Does anyone have

Re: [c-nsp] 7200 LNS Rebooting

2008-02-27 Thread Mark Tinka
On Thursday 28 February 2008, Justin M. Streiner wrote: Unless you need a brand-new feature, or need to support brand-new hardware, T-train code should not be running on a production router. Agree. To hijack the thread some :-), we have a couple of boxes running 12.4 mainline due to some

Re: [c-nsp] 7200 LNS Rebooting

2008-02-28 Thread Mark Tinka
On Thursday 28 February 2008, Arie Vayner (avayner) wrote: I guess we are talking about 7200 routers,... Yes, I'm referring to the 7200 router family running 12.4 mainline. so I would suggest to wait a bit with SRC, and in the mean while deploy 12.2(31)SB. This train will remain alive for

Re: [c-nsp] output rate-limiting not working in 7609

2008-03-03 Thread Mark Tinka
On Monday 03 March 2008, Jimmy wrote: The output rate-limiting is not working. The traffic still can go above 310M and can hit 1G. I have created SR with cisco. They are saying there is no work around for this except that we use ES20 to use policy-map on the interface. Hmmh, I'm sure MQC is

Re: [c-nsp] 7200 vxr as analog dialup access server with PRI

2008-03-04 Thread Mark Tinka
On Tuesday 04 March 2008, Tassos Chatzithomaoglou wrote: The same happened to me too. 1 out of 10 AS5300 has failed the past year, mostly due to PSU. I've had better luck with the ones I've played with in recent years. The issue I had with them was that since they are, to put it in the

Re: [c-nsp] Cisco 10K MPLS VPN

2008-03-17 Thread Mark Tinka
On Monday 17 March 2008, FAHAD ALI KHAN wrote: Guys Hello. Im stuck in configuring MPLS L3VPN in Cisco + juniper in my test lab environment. As Oli has suggested, a copy of your configurations on both IOS and JunOS would help. Mark. signature.asc Description: This is a digitally signed

Re: [c-nsp] Something I was thinking about whilst idle the other day.

2008-03-21 Thread Mark Tinka
On Thursday 20 March 2008, Sam Stickland wrote: A structured grammar for IOS configuration :) Sounds like you're asking for IOS XR... well :-). I'd be happy if the number of IOS feature sets reduced to not more than 2 or 3, but I understand this is asking for too much given the history of

Re: [c-nsp] Proxy ARP -- To disable, or not to disable..

2008-03-21 Thread Mark Tinka
On Saturday 22 March 2008, Eric Cables wrote: A recent network audit has discovered that Proxy ARP is enabled on pretty much every L3 interface in the network. As a Cisco default, this isn't surprising, since no template configs have it disabled. The question is: whether or not I should go

[c-nsp] L3VPN VPNv4 NLRI - Route Reflector Scaling

2008-03-23 Thread Mark Tinka
Hello all. (posted to NANOG too; please excuse the length of the message) Considering the scaling techniques currently available for VPNv4/L3VPN deployments as regards MP-BGP route reflectors, what do folk think is currently the most elegant way to deploy this that provides an even

Re: [c-nsp] L3VPN VPNv4 NLRI - Route Reflector Scaling

2008-03-24 Thread Mark Tinka
On Monday 24 March 2008, Oliver Boehmer (oboehmer) wrote: Well, most of the L3VPN deployments I'm aware of (which includes some very large SPs) still use a single iBGP mesh of dedicated VPNv4 RRs, some flat, some using hierarchical RR structure. RR partioning via rr-group or using other

Re: [c-nsp] L3VPN VPNv4 NLRI - Route Reflector Scaling

2008-03-24 Thread Mark Tinka
On Monday 24 March 2008, Mark Tinka wrote: Beyond that is what we are thinking about. We might be able to live with additional routing information at the PE routers initially, but it would be an area of concern at scale. Perhaps to add, the implementation of RFC 4684 (Route Target

Re: [c-nsp] L3VPN VPNv4 NLRI - Route Reflector Scaling

2008-03-25 Thread Mark Tinka
On Tuesday 25 March 2008, Oliver Boehmer (oboehmer) wrote: what do you mean by this? The PEs would discard all routes they're not interested in anyway, or am I missing something? Or do you mean that you want to avoid advertising routes which will be dropped anyway? Correct - since the some

Re: [c-nsp] System MTU on trunks for Q in Q

2008-03-26 Thread Mark Tinka
On Thursday 27 March 2008, Tassos Chatzithomaoglou wrote: I still haven't found any reason for keeping a low MTU on L2 switches (although i don't know if any L2 protocols can generate such large frames which could possibly get dropped in a 1500 link). We have gone with 9,000 bytes across the

Re: [c-nsp] System MTU on trunks for Q in Q

2008-03-28 Thread Mark Tinka
On Thursday 27 March 2008, Dan Armstrong wrote: The reason I don't want to raise it too high - is if we're selling TLS services to a customer, (ie a VLAN provisioned on 2 ports on different switches, carried across our core/trunks) - I don't want them being able to send any packet larger

Re: [c-nsp] Cisco 7204 CPU utilisation.

2008-04-01 Thread Mark Tinka
On Tuesday 01 April 2008, Alex Balashov wrote: Naturally, a Layer 3 switch is a smarter idea than a big Layer 3 VLAN router-on-a-trunk-stick these days, but the budget isn't there right now. Not if you're doing heavy QoS. We've been hit with issues where QoS commands exist on Cisco desktop

Re: [c-nsp] Cat6500 - Support for MPLS and IPv6

2008-04-07 Thread Mark Tinka
On Monday 07 April 2008, Phil Mayers wrote: Honestly, I don't mean to sound too combative, but Cisco do not need to be diversifying at this point; they need to be focussing. Agree... IOS, IOS XR, IOS XE, NX-OS, CatOS, along with the various idiosyncrasies of each (and their *children*) does

Re: [c-nsp] Support of VPLS on 7200VXR?

2008-04-07 Thread Mark Tinka
On Tuesday 08 April 2008, Jose wrote: Hi group. I came across some mention of VPLS support for the 7200VXR on Feature Navigator with the 12.2(33)SRB/C IOS. I'm just curious what kind of VPLS support is available for this platform? I know it can do EoMPLS fairly easily but can it actually

Re: [c-nsp] BGP timers

2008-04-08 Thread Mark Tinka
On Tuesday 08 April 2008, Uddin, Tahir wrote: When connecting a CE to a PE, is there a minimum recommended BGP hold down timer. I am currently using 90 seconds with both of my carriers but it is causing applications to time out when there is a failure in one of the carriers network or if a

Re: [c-nsp] BGP timers

2008-04-08 Thread Mark Tinka
On Tuesday 08 April 2008, Oliver Boehmer (oboehmer) wrote: well, Fast Session Deactivation only helps you on non-directly connected eBGP sessions (i.e. multihop), possibly along with an IGP (or static routes with object tracking or something like this) to provide next-hop reachability, so

Re: [c-nsp] BGP timers

2008-04-08 Thread Mark Tinka
On Tuesday 08 April 2008, Uddin, Tahir wrote: With this picture, CE1-PE1MPLS cloud-PE2-CE2 If next hop tracking is enabled on CE1, and there is a problem between PE2 and CE2 or an issue in the cloud, would it still be useful? I cannot give you an experienced response as

Re: [c-nsp] BGP timers

2008-04-08 Thread Mark Tinka
On Tuesday 08 April 2008, Oliver Boehmer (oboehmer) wrote: well, no. For connected, you don't need any new feature, the fast-external-fallover feature causes the session to drop once the connected route goes away (i.e. the interface goes down). This has been default behaviour for years, no

Re: [c-nsp] 6500 vs. 7600 revisited again (was: CSM f or service providers)

2008-04-09 Thread Mark Tinka
On Wednesday 09 April 2008, Gert Doering wrote: Indeed. Worse, they are now building increasingly different chassis types with different capabilities - 6500-E with lots of power, and 7600-S with nice and shiny high-availability EOBC (if I understand the differences right). What I would

Re: [c-nsp] 6500 vs. 7600 revisited again

2008-04-09 Thread Mark Tinka
On Wednesday 09 April 2008, Phil Mayers wrote: I was under the impression the PFC is not an FRU. Well, AFAIK, you can upgrade a SUP720 with a PFC-3A to one with a PFC-3B or PFC-3BXL. The upgrade kit also comes with a label to attach to front of the supervisor module, identifying its PFC-type

Re: [c-nsp] Wanting to learn Juniper...

2008-04-10 Thread Mark Tinka
On Friday 11 April 2008, Jeff Cartier wrote: I'm fairly well versed in the Cisco devices and the configuration of those devices through the CLI using Cisco IOS...but I'm curious, and up for the learning experience, of starting to familiarize myself with Juniper. I'm looking for some

Re: [c-nsp] Wanting to learn Juniper...

2008-04-13 Thread Mark Tinka
On Friday 11 April 2008, Wink wrote: It seems easier to find things w/reference to the routing-instance you are dealing with or the interface you are dealing with at the moment, within the configuration. I've had a chance to play around with IOS XR - it's a good thing Cisco have done

[c-nsp] NPE-G2 12.2(33)SRC AFI Bug?

2008-04-13 Thread Mark Tinka
Hi all. We are lab'ing 12.2(33)SRC on an NPE-G2. We see the VPNv4 AFI configuration saving a duplicate configuration for a peer policy template inheritance: ... ! address-family vpnv4 neighbor x.x.x.x activate neighbor x.x.x.x send-community extended neighbor x.x.x.x inherit peer-policy

Re: [c-nsp] MPLS L3 VPN. How much longer?

2008-04-15 Thread Mark Tinka
On Wednesday 16 April 2008, [EMAIL PROTECTED] wrote: L2 point to point (Martini tunnel and similar) is okay. VPLS, not a chance. Agree... L2VPN's are great especially if your customers are clued. VPLS still has a lot more maturing to do, we think. We are approaching it cautiously, but see a

Re: [c-nsp] When are ACLs inserted to TCAM

2008-04-17 Thread Mark Tinka
On Friday 18 April 2008, Lincoln Dale wrote: obviously the recommendation would ba NAMED ACL every time. Except for where you can't use them, e.g., NTP access groups. But yes, we prefer named access lists as well, if not for anything else than their manageability, and use them wherever

Re: [c-nsp] When are ACLs inserted to TCAM

2008-04-18 Thread Mark Tinka
On Friday 18 April 2008, Lincoln Dale wrote: an enhancement we used for NX-OS is that there is no such thing as a standard ACL, extended ACL, numbered ACL, named ACL - everything is a named ACL including what you'd have for NTP. for legacy reasons, such a change would be hard to retrofit to

Re: [c-nsp] NPE-G2 12.2(33)SRC AFI Bug?

2008-04-20 Thread Mark Tinka
On Monday 21 April 2008, Scott Mace wrote: Im seeing duplicate advertise-map statements showing up in SRC with NPE-G1. Not sure if these are related. The case I logged with TAC resulted in bug ID CSCso72824, which was later superseded by bug ID CSCsj48902. Cheers, Mark. signature.asc

Re: [c-nsp] Cisco support for ASNv4 (4 byte ASN)

2008-05-05 Thread Mark Tinka
On Monday 05 May 2008, Skeeve Stevens wrote: Hey all, Can someone let me know if/when Cisco supports 4byte AS Numbers in BGP in the current IOS stream (not XR or XE). According to http://www.swissix.ch/asn32/doku.php, it's meant to be mid this year for 12.5T - you might want to check

Re: [c-nsp] Cisco support for ASNv4 (4 byte ASN)

2008-05-05 Thread Mark Tinka
On Monday 05 May 2008, Marco Huggenberger wrote: 12.5T late 2008 in the meantime use AS23456 ;) From the other side of the pond, J recently released 9.1, which now introduces support for 4-byte ASN's to their mainstream platforms. Cheers, Mark. signature.asc Description: This is a

Re: [c-nsp] Internet vrf, pros and cons

2008-05-06 Thread Mark Tinka
On Wednesday 07 May 2008, Rubens Kuhl Jr. wrote: The issue with VRFs is that it can't do policy routing, because it's already a routing table selection... I agree that box security should be taken care with CoPP. Put Internet customers on the main VRF, but carefully design ACL,

Re: [c-nsp] Internet vrf, pros and cons

2008-05-07 Thread Mark Tinka
On Wednesday 07 May 2008, Pete Templin wrote: What software and hardware are you using? JunOS (M-series) and IOS (7200-VXR). If it's the right stuff, there was a neat presentation at NANOG42 that showed a cool way to enforce peering policy on an interface, without having to dedicate a

Re: [c-nsp] SSH Authoized Keys?

2008-05-09 Thread Mark Tinka
On Friday 09 May 2008, Chris Riling wrote: I've done some research on SSH in IOS and I've only been able to find the usual information on how to implement SSH; (generate keys, change transport, etc.) but I'm more interested in seeing if I can use key files for authentication without a

Re: [c-nsp] Single strand SMF 10GbE

2008-05-29 Thread Mark Tinka
On Thursday 29 May 2008, MKS wrote: Hello List Is some vendor out there that offers single strand SMF 10GbE (X2/xenpak/whatever). Does someone know if this is on cisco's roadmap? Cisco aren't doing 10Gbps yet - they are doing mux'ed 1Gbps links over CWDM (can use LACP to connect up to

Re: [c-nsp] [j-nsp] IOS JUNOS MPLS-TE interoperability

2008-06-05 Thread Mark Tinka
On Thursday 05 June 2008, Rubens Kuhl Jr. wrote: Does anyone has experience with MPLS-TE interoperability between IOS (specifically ME6500, but it's probably like any other 12.2SX IOS) and JUNOS (recent/stable/good-for-service-providers version) ? In addition to Oli's comments, you might

Re: [c-nsp] BGP network stops being advertized

2008-06-09 Thread Mark Tinka
On Tuesday 10 June 2008, Deepak Jain wrote: In the old days, null was handled by CPU (software switched), so lots of us old-timers got into the habit of using loopback instead of null. On a modern platform it should make no operational difference provided you have everything you need set up

Re: [c-nsp] Best way to filter local traffic from Internet traffic

2008-06-09 Thread Mark Tinka
On Tuesday 10 June 2008, root net wrote: I have a customer that wants a 100/1000 Mb/s pipe into our network for our local customers. This customer is also a customer but he has a dedicated 10 Mb/s circuit to the Internet and is maxing out on bandwidth. Wishes to buy the 100/1000 Mb/s pipe

Re: [c-nsp] OSPF on Secondary IP addresses.

2008-06-12 Thread Mark Tinka
On Wednesday 11 June 2008, Jared Mauch wrote: No, you need to utilize the primary IP address for your routing protocols. Having cisco enforce this also will help you make fewer mistakes in your network configuration, or overcomplicate the topology. Agree, we find secondary IP

Re: [c-nsp] 7200s (VXRs and not) and MPLS capabilities

2008-06-13 Thread Mark Tinka
On Thursday 12 June 2008, Paolo Lucente wrote: Full featured QoS is there. IHMO, there is an interesting option of running the 12.2SR train onto it. Yeah, but be careful if you're looking at SRC. While comprehensive, it's riddled with bugs left, right and centre. We've tried it in some

Re: [c-nsp] IGP iBGP Configuration Problem in Transit AS

2008-06-17 Thread Mark Tinka
On Monday 16 June 2008, Vira W wrote: My first problem is in IGP configuration inside AS 100. I'm using OSPF. I still confused how to make non-BGP router (C,E,B,D) understand how route the packet transitting this AS. Well, if the routers can't talk BGP, then, as others have mentioned, some

Re: [c-nsp] Cisco 2811 / IPBasek9 / IPSec tunnels?

2008-06-19 Thread Mark Tinka
On Thursday 19 June 2008, Xavier Beaudouin wrote: I have been asked to make some tunnel / securisation of an internal using 2 cisco 2811 with IPBaseK9 IOS software. The commercial documentation says that Cisco 2811 can do IPSec... Now does IPBaseK9 can do that ? Is there any pointer about

Re: [c-nsp] BGP prefix announcement question..

2008-06-26 Thread Mark Tinka
On Wednesday 25 June 2008 11:13:55 pm Pete Templin wrote: Every BGP prefix in our network gets tagged with at least one community, that of a magic code, upon origination/learning/injection/whatevah. It's basically of the form ourAS:ABCDE, where A indicates the type of route (customer, ours,

Re: [c-nsp] Sup32 TCAM limit

2008-06-27 Thread Mark Tinka
On Friday 27 June 2008 09:38:25 pm Phil Bedard wrote: They are a good fit for Enterprise IP/MPLS networks which may not have full routes, since they generally default to a firewall somewhere for that. Also if you need something like a cheaper EoMPLS aggregation box they fit that need as

Re: [c-nsp] Sup32 TCAM limit

2008-06-27 Thread Mark Tinka
On Saturday 28 June 2008 06:38:46 am Gert Doering wrote: You could run 6PE - I find 6PE, personally, adding complexity. or just route IPv6 in the core, which will work fine (about 1100 IPv6 prefixes in the global BGP table as of these days). Which is what I'd prefer - dual stack is

Re: [c-nsp] Route Reflector Design

2008-07-02 Thread Mark Tinka
On Wednesday 02 July 2008 23:34:42 Mike Johnson wrote: How am I able to utilize thousands of devices in a flat IGP domain? I thought only a couple hundred is recommended before deploying multiple areas. Our school of thought has always been, build scalability from the beginning even though

Re: [c-nsp] Shutting Down Catalyst 6509?

2008-07-06 Thread Mark Tinka
On Friday 04 July 2008 20:54:48 Felix Nkansah wrote: Thanks guys. I thought it has some special shutdown procedures or commands. Which is something we wish for on Cisco's new ASR line, seeing as it has a hard drive and all. Current documented procedure to shutdown the ASR is to reload as

Re: [c-nsp] WS-X6748-SFP 7600 MPLS

2008-07-07 Thread Mark Tinka
On Monday 07 July 2008 17:58:33 Mark Tech wrote: Hi, I don't need anything special, I'm just wanting to make sure that I can label switch on these plain cards using RSP720's on a 7600 chassis as its not clear in the Cisco docs that I've found. If not I'd like to know what extra cards would

Re: [c-nsp] C3560 show version memory values

2008-07-10 Thread Mark Tinka
On Thursday 10 July 2008 06:03:31 Jose Leitao wrote: Today I upgraded a 3560 to c3560-advipservicesk9-mz.122-44.SE2, and looking at the output of show version, I noticed something rather peculiar: cisco WS-C3560-24PS (PowerPC405) processor (revision N0) with 0K/8184K bytes of memory

Re: [c-nsp] Question on 7204vxr modules

2008-07-10 Thread Mark Tinka
On Thursday 10 July 2008 20:58:26 Steven Pfister wrote: - As a first step, we're going to replace the I/O controller with the new one using a FE GBIC, and put the PA-GE in along with the PA-A6-OC3MM until its time to cut over to gigabit Ethernet. Is there any restrictions on where we can put

Re: [c-nsp] Cisco BFD support for Juniper / Huawei

2008-07-14 Thread Mark Tinka
On Monday 14 July 2008 13:44:02 Vikas Sharma wrote: My questio is - does BFD implementation in Cisco support Juniper / Huawei CPE? Does Cisco's implementation is as pe standard? has anyone tested it? We run BFD between our Cisco and Juniper kit - works fine, nothing fancy in the

Re: [c-nsp] Three STM-1 on one Cisco 7200vxr-npeG1

2008-07-16 Thread Mark Tinka
On Wednesday 16 July 2008 18:10:00 Garry wrote: Technically, it is supported, as each of the two buses have 600 bandwidth points, with an STM-1 interface taking up 300. Question is whether it might be recommendable to get a second router for redundancy reasons, e.g. if you are terminating

[c-nsp] IS-IS: Ignore Attached Bit

2008-07-17 Thread Mark Tinka
Folks, is there an elegant way to ignore the attached bit in IOS? Cheers, Mark. signature.asc Description: This is a digitally signed message part. ___ cisco-nsp mailing list cisco-nsp@puck.nether.net

Re: [c-nsp] IS-IS: Ignore Attached Bit

2008-07-17 Thread Mark Tinka
On Friday 18 July 2008 03:25:29 Oliver Boehmer (oboehmer) wrote: r(config)#router isis r(config-router)#ignore-attached-bit r(config-router)# I'm not kidding.. :-) it's a hidden command, though.. Thank you sir :-). Cheers, Mark. signature.asc Description: This is a digitally signed

Re: [c-nsp] Transparent Proxy

2008-07-22 Thread Mark Tinka
On Tuesday 22 July 2008 00:16:02 Rhino Lists wrote: access-list 111 deny tcp any any neq www access-list 111 deny tcp host 192.168.1.188 any access-list 111 permit tcp any any log Try this for your ACL, instead: deny   tcp host ip.of.squid.box any eq www permit tcp your.ip.net.block

Re: [c-nsp] ME6524 alternative

2008-07-22 Thread Mark Tinka
On Wednesday 23 July 2008 03:26:26 Justin Shore wrote: What I was told was that it was an unintended feature. Basically that means that while it worked it wasn't ever part of the intended design and wasn't ever tested. It could have adverse affects on other things; then again it also might

Re: [c-nsp] IS-IS: Ignore Attached Bit

2008-07-26 Thread Mark Tinka
On Thursday 24 July 2008 05:19:28 Asbjorn Hojmark - Lists wrote: r(config)#router isis r(config-router)#ignore-attached-bit r(config-router)# When/why would you want to do that? Just to add to what Shankar mentioned, in our particular case, we only use IS-IS to carry our infrastructure

Re: [c-nsp] ASR series

2008-07-28 Thread Mark Tinka
On Tuesday 29 July 2008 07:43:53 Andrew Gristina wrote: Operationally I haven't found them that different from other Cisco routers (other than the hardware). Same here, not that different. Just that with current IOS XE 2.1.1, some line cards are not supported, but that will come with later

  1   2   3   4   5   6   7   8   9   10   >