The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›20 »

ragzilla: Sep 9, 2005; don't ask me, i only work here

inignot posted:

I don't think LACP is going to work in scenario 2 or 3. Active/Active load balanced connections need to terminate to the same switch (or switch stack). See if your nics or os support some kind of active/standby failover option based on link status or ping polling.

Alternately you could run your Active/Active at layer 3 instead of layer 2, by running a routing protocol on the server (like ospf using quagga), and let CEF/OSPF ECMP do your load balancing at layer 3.

# ¿ Oct 2, 2007 02:25

Adbot: ADBOT LOVES YOU

# ¿ May 15, 2024 06:08

ragzilla: Sep 9, 2005; don't ask me, i only work here

ChimpyMonkey posted:

Dear Cisco,

Please make a working bug toolkit, with accurate data for current IOS releases.

Thank you,
The Internet

Anyone actually seen the "new" bug toolkit work? I keep trying but all I ever get is this error: "Error occurred while fetching bug summary from database. Please try later."

I've used it to find (and even monitor!) bug IDs that TAC claim are affecting us, but trying to find anything yourself is usually a losing proposition unless it's sev1/sev2.

# ¿ Oct 3, 2007 00:08

ragzilla: Sep 9, 2005; don't ask me, i only work here

dwarftosser posted:

Well that depends, what they mean is when your first connection goes down you need someway to notify the outside world that they need to take a different route to get into your network. To do this seamlessly, you need to have your own ASN and have BGP properly configured.

Or a global load balancing appliance sitting out in a datacenter somewhere, but that's just swapping 1 SPoF for another.

# ¿ Oct 23, 2007 05:51

ragzilla: Sep 9, 2005; don't ask me, i only work here

jwh posted:

Or, alternatively, make your native vlan a dedicated management vlan. Things get weird when you've got two production vlans, one of which happens to also be the trunk native, versus the other, tagged vlan.

Better off leaving your native as a go-nowhere VLAN (on 12.1+ switch IOS code I think you can even prune the native off of trunks by not including it in "switchport trunk allowed vlans"). Native as a management isn't a good practice since you can plug stuff you didn't mean to into your management network by accident, rather than having to make a conscious decision to put something in there.

# ¿ Nov 3, 2007 00:40

ragzilla: Sep 9, 2005; don't ask me, i only work here

mezoth posted:

A side note : did you know the CRS 8x10g cards are oversubscribed? Only 40g backplane per linecard!

I wonder if that's something they can upgrade with new fabric modules in the field, it would suck if IEEE decides to standardize on 100GbE instead of 40GbE and everyone who bought into CRS had to forklift to get non-oversubscribed interfaces.

The 6500/7600 8x 10GbE cards are also 2:1 oversubscribed (Cisco seems to like their 40G/slot fabrics)

# ¿ Nov 6, 2007 13:44

ragzilla: Sep 9, 2005; don't ask me, i only work here

jwh posted:

Everything old is new again:
http://cisco.com/en/US/products/hw/switches/ps4324/products_announcement0900aecd806ed5d2.html

I see your 4500-E, and raise you a Catalyst Virtual Switching System (VSS) 1440:
http://cisco.com/en/US/products/ps9336/index.html

inignot posted:

That can be a misleading metric though, the whole point of the distributed switching cards is that intra slot switching doesn't have to touch the backplane.

I think I've seen a block diagram of it once, I forget how the ASICs and ports are connected on the card... From the spec sheet, it supports up to 64 Gbps of local switching (probably 32Gbps/ASIC). Ports are split down the middle between the ASICs (1-4 to ASIC 1, 5-8 to ASIC 2). I don't know if there's an intra-card connection between the ASICs though. It does have much deeper buffers than X6704 though (200MB/port instead of 16).

# ¿ Nov 6, 2007 21:24

ragzilla: Sep 9, 2005; don't ask me, i only work here

XakEp posted:

The procedure on a 3500 series is to hold down the mode button while the box is off, power it up and release the button when the port 1 LED turns off. I've done that, but still nothing on my terminal.

Unless I have two bad cables/rj45 adapters I have no loving clue.

If you're using an actual cisco rj45 adapter, you need to use a rollover cable between the adapter and the switch, do you have a molded cable, or can you make a rollover?

# ¿ Dec 3, 2007 05:50

ragzilla: Sep 9, 2005; don't ask me, i only work here

XakEp posted:

vvvv My understanding is the default route will be used after all other routes in the routing table dont match vvvv

Confirming this, routing table (assuming static and no ECMP/UCMP dynamic routing is going on) routes based on:
1) Longest match.
2) Lowest metric/cost.

So the most specific entry will take the traffic.

# ¿ Dec 3, 2007 17:19

ragzilla: Sep 9, 2005; don't ask me, i only work here

Wicaeed posted:

I'm looking for a way to throttle my Bittorent traffic not from my own computer, but over the network. And not really throttle it, but prioritize web traffic, in fact most other traffic over bittorent traffic, so I can browse the internet, play games, etc etc while dynamically throttleing the traffic? I know I can go and buy a router that supports QoS, but are there any OS based solutions that I can impliment between my router and DSL modem? Something that would act like an network fire wall, and as device that supports QoS?

Linux (with iptables/tc, wondershaper would probably work here), or BSD (pfSense, m0n0wall).

Wicaeed posted:

What I'd like to do is plug the PIX into my network (assuming it works this way) like this:

Fa0/0 DSL Modem to internet

Fa0/1 Wireless router w/AAA set up (gently caress you wardrivers)
Fa0/2 Connects to Linksys BEFSR81 upstairs with 3 computers on it
Fa0/3 Mom's Mac

Can I do it like that? Or am I doing it wrong? I realize that what I am doing is so beyond what I need, but I really don't care, I need the experience.

It only has 2 interfaces (labelled inside and outside in the PIX). The 5 (?) inside ports on the back are plugged into an internal switch into the inside port.

Wicaeed posted:

One other question: Does the PIX support uPnP?

I don't believe it can do uPNP, you can work around this somewhat by assigning a port range to each computer (eg, 56400-56499 goes to internal IP .64, etc) and configuring the computers with DHCP reservations/static IPs and telling applications to use that dynamic port range. Or if it's a protocol that the PIX understands (non-encrypted FTP, SIP) you can let the PIX do fixup.

The one thing that'll suck on a 501 is that you're stuck on 6.0 code, PDM sucks compared to ASDM imo.

# ¿ Dec 5, 2007 13:55

ragzilla: Sep 9, 2005; don't ask me, i only work here

InferiorWang posted:

Would you guys talk to me a little bit about how you handle routing? What's your organization size, number of subnets, type of routing? Do you use static or dynamic? I'd like to read a bit about some real world applications.

medium sized ISP/NSP/colo

subnets:
$ grep - route | grep -vi unused | wc -l
921
(roughly, all allocated all over the place too).

we make heavy use of dynamic routing protocols (ospf containing customer routed subnets and loopback addresses, redist'd from statics on the actual layer3 device the customer connects to (we redist static/connected into ospf)), bgp just contains our aggregates, and prefixes learned from other bgp speakers (customers/peers/upstreams).

ideally we should be doing more aggregation/hierarchy in our IGP (allocate a /22 or something to a customer agg router, and slice it up for bridges/customer prefixes) but that makes it harder renumbering/moving customers from router to router if we need to, so we haven't done any real aggregation of that kind except for remote POPs (null route a /24 on the 'edge'/'core' router of the remote POP, let that advertise back to the main network, then advertise more specifics inside the POP for customers/bridges.

# ¿ Dec 7, 2007 06:26

ragzilla: Sep 9, 2005; don't ask me, i only work here

brent78 posted:

I want to VPN in to a ASA 5510. I'm confused by the webvpn, ssl vpn, easyvpn options. Can someone post a simple ipsec config for use with the cisco client, or even pptp if its supported. I want to authenticate local users only.

Do you have ASDM installed on the device? If so, go to VPN in ASDM, click "VPN Wizard". It's probably the easiest and quickest way to configure VPN on an ASA/PIX.

# ¿ Dec 7, 2007 15:49

ragzilla: Sep 9, 2005; don't ask me, i only work here

brent78 posted:

I used the wizard to create an L2TP VPN. When I try to connect from my Windows XP client I get "Error 789: The L2TP connection attempt failed because the security layer encountered a process error during initial negotiations with the remote computer".

I don't believe its a firewall issue on my client side because I can connect to other L2TP VPNs just fine.

Never tried to use the L2TP/IPsec using the windows native client, I've always had to use the Cisco VPN client.

# ¿ Dec 7, 2007 18:44

ragzilla: Sep 9, 2005; don't ask me, i only work here

CrazyLittle posted:

motherf- yep that was it. Thanks!

... okay spoke too soon. Uploaded c1841-ipbase-mz.124-18.bin and that doesn't seem to be fixing it.

12.4(15)T

have you tried 12.4.15T1? It's under ED code on the upgrade planner. T is the 'experimental' train I believe, for features to be included in mainline 12.5, the HWIC-1FE stuff might not be in mainline 12.4 yet.

# ¿ Dec 11, 2007 01:34

ragzilla: Sep 9, 2005; don't ask me, i only work here

Spazz posted:

Stupid question: What does the XM mean on the tail of router models? ie: 2620 vs 2620XM.

Thanks

I don't know that it stands for anything, but the XM routers came out after the 2600 series, replacing them for the most part. The major difference is new proc / support for more memory/flash/WICs.

# ¿ Jan 7, 2008 03:22

ragzilla: Sep 9, 2005; don't ask me, i only work here

para posted:

Also telnet and ssh don't seem to let me redirect std input into them so I can't send a bunch of prewritten commands to the router. If I want to run a bunch of prewritten commands on a router and perhaps capture the output (equivalent to '# cat input.txt | ssh admin@router > output.txt' if ssh would let me do that) what would be the choice method of doing it?

I hope this question wasn't too long for this thread. Thanks.

You probably want to look into a tool called RANCID (from shrubbery networks), in particular, the 'clogin' command distributed with it: http://www.shrubbery.net/rancid/man/clogin.1.html

# ¿ Jan 8, 2008 01:30

ragzilla: Sep 9, 2005; don't ask me, i only work here

Ninja Rope posted:

Putting two DHCP servers on the same broadcast domain won't work. inignot's solution will.

Actually... you could configure your DHCP servers with manual/sticky leases, or if you were using something like isc-dhcpd you could tell it to filter based on the MAC address, so only 1 server would answer for a particular subset of MACs, and the other server would be configured to not answer for that subset.

But that'd require a fair bit of configuration, and not all DHCP servers support that level of tweaking, so best practice would be putting it on separate voice VLAN.

# ¿ Jan 9, 2008 16:36

ragzilla: Sep 9, 2005; don't ask me, i only work here

InferiorWang posted:

I might be mistaken, but you don't need the contract for a CCO login. However, it's really just a guest login and you need the various support contracts to unlock parts of the site.

Off that topic, does anyone have any thoughts or opinions on the ASA 5510, specifically how it might stack up against PfSense? Right now I have a carped/pfsync pfsense setup with two PCs. It seems to work well, but the marketing speak for the ASA talks about Application Inspection, voice protection, VLAN capabilities, and of course VPN duties. None of those are supported by pfsense as far as I know. We have roughly 900 workstations and 30 servers. The biggest drawback I see is that I'm losing the redundancy I have right now.

pfSense will do VLANs, and VPN (PPTP, IPSec, and OpenVPN).

Probably the biggest advantage with going to a commercial firewall is that you can pay for support- so if the one guy that knows how to deal with the firewalls is on holidays and unreachable you can actually make an attempt at getting them fixed without needing to track him down.

CrazyLittle posted:

This is more valuable than you would even guess until you actually need it. There's hundreds of Cisco techs around who are a phone call away 24/7. The same can't be said for PfSense and m0n0wall.

Couldn't agree more. In the datacenter I work in (~ 300 cabinets), I think we are only company running non-commercial firewalls- and even those are supposed to be swapped out for a PIX sometime in the near future now that the guy who built/maintained them has moved on.

ragzilla fucked around with this message at 04:57 on Jan 12, 2008

# ¿ Jan 12, 2008 04:21

ragzilla: Sep 9, 2005; don't ask me, i only work here

H110Hawk posted:

Primarily I need it to output debugging messages onto a virtual terminal session, or into `show log`.

If you've already turned on the debugs, you should be able to use the command 'term mon' to have it drop debug prints to your vty

Usually when troubleshooting NTP I try to go to the other end and just sniff there and see what's going on.

# ¿ Jan 23, 2008 06:16

ragzilla: Sep 9, 2005; don't ask me, i only work here

one big catch on the 3560G/3750 platforms is that you're only supposed to set up 8 (or is it 12?) SVIs or routed ports, while they will run with more than the recommended number, it's not supported by TAC.

# ¿ Jan 24, 2008 01:14

ragzilla: Sep 9, 2005; don't ask me, i only work here

jwh posted:

Really? That sounds bad.

Does Cisco make a fixed-configuration layer 3 switch that will route all interfaces? 4948?

Yeah, the 4948 (internally based off a 4500 I believe) will do (supported) layer 3 on every single port, up to 2048 SVIs or something crazy. But it'll cost you.

From the docs, the 3550/3560/3750 there's no "hard" limit, but sdm tells you not to go over 8 SVIs.

# ¿ Jan 24, 2008 02:38

ragzilla: Sep 9, 2005; don't ask me, i only work here

ionn posted:

If the limit somehow really is "8 SVI's at full speed and everything else with reduced performance", it would be no problem at all. Can anyone find any hard facts about this recommendation?

The 8 SVIs is really a recommendation on Cisco's part. The true limit is the TCAM size, so long as you can stay within the TCAM limits it will do full wire speed on as many SVIs as you want. But once you run out of TCAM space you'll be hurting due to traffic getting punted.

# ¿ Jan 24, 2008 13:50

ragzilla: Sep 9, 2005; don't ask me, i only work here

jwh posted:

There are newer 'xl' PFCs that support up to 512k prefixes, tunable to 1024k. I don't know much about them.

They're exactly the same as the non-XL PFCs (and DFCs), the only difference is prefix count. Pretty much everyone running full internet tables should be on XLs now, unless they're planning on filtering prefixes...

code:

>show ip bgp summary 
BGP router identifier 206.53.255.91, local AS number 7332
BGP table version is 43841221, main routing table version 43841221
239062 network entries using 28926502 bytes of memory

Only 8000 more prefixes or so before people start to hit the 247k count in the non-XL FCs. There are also some subtle differences between 3B and 3C- the only one that comes to mind off hand is increased TCAM space for Ethernet MACs.

# ¿ Jan 24, 2008 22:46

ragzilla: Sep 9, 2005; don't ask me, i only work here

H110Hawk posted:

So why do you have less entries using more ram?
code:
#sh ip bgp summ
BGP router identifier 66.33.201.194, local AS number 26347
BGP table version is 362005910, main routing table version 362005893
240846 network entries using 27215598 bytes of memory
Guess we're going to have to start looking in to 3CXL cards. We finally just got everything loaded onto 3BXL cards, too!

3BXLs have the same prefix table size as the 3CXL, all the 3CXL has (which requires the RSP720 anyway) is a bigger Ethernet TCAM- since it's aimed at the carrier ethernet aggregation market.

YOu're fine with the 3BXLs.

Also, I think our mem usage is a bit higher because someone probably turned on soft reconfig, how many (full table) sessions do you have on that box?

-edit-

code:

#show platform hardware capacity forwarding 
L2 Forwarding Resources
           MAC Table usage:   Module  Collisions  Total       Used       %Used
                              1                0  98304         15          1%
                              2                0  98304         15          1%
                              5                0  98304         15          1%
                              6                0  98304         15          1%

             VPN CAM usage:                       Total       Used       %Used
                                                    512          0          0%
L3 Forwarding Resources
             FIB TCAM usage:                     Total        Used       %Used
                  72 bits (IPv4, MPLS, EoM)     524288      240151         46%
                 144 bits (IP mcast, IPv6)      262144           3          1%

if you check plat hardware capacity forwarding on your 3BXLs, it'll show 65k possible MAC entries, instead of 98k. But if you check the L3 forwarding resources you should see the same totals (512k+256k).

ragzilla fucked around with this message at 02:56 on Jan 25, 2008

# ¿ Jan 25, 2008 02:51

ragzilla: Sep 9, 2005; don't ask me, i only work here

Recluse posted:

I too would be interested in this, or something similar. We currently are using two 7120s and were attacked 3 times in the past week with tens of thousands of UDP packets per second to our internal NAT server from three different probably spoofed IP addresses. We're looking for something that could hopefully limit the pps per IP address; or, if someone has any other ideas about preventing/stopping a DoS attack I'd really like to hear it.

Preventing/Stopping a DoS attack on the customer side of a circuit is going to be difficult as chances are your pipe out to the world is the smallest link, so the attacker can just saturate that and it doesn't matter what kind of rate limiting or filtering you have on your side of the connection. The best solution to this (if you're talking BGP w/ your provider) is to use BGP remote triggered blackholing, where you can send a /32 prefix up to your provider over your BGP session with them, with a community tag that tells your provider to null route / blackhole the traffic before sending it to you. You can only do this for your own IPs though, so you lose whatever apps are running on the IP you blackhole, but it saves you the bandwidth to your provider so everything else keeps running.

# ¿ Jan 28, 2008 16:37

ragzilla: Sep 9, 2005; don't ask me, i only work here

jwh posted:

I'm also willing to bet that NX-OS will never see feature-parity to IOS.

The way they're talking about NX-OS, it sounds a LOT like what they're claiming/pushing with regards to IOS-XR...

quote:

Virtual Device Contexts (VDCs) to maximize software and hardware resource utilization while providing strong security and software fault isolation

Sound like SDR to anyone?

quote:

Comprehensive XML API for total platform control

Also an IOS-XR feature...

I'm guessing the next version will be the multi-chassis nexus system like the CRS-1 multi-chassis, where you throw some fabric shelves in your switching room, then drop NEXUS line card shelves out near your servers, and run a bunch of fiber between the LC shelf and your central point, giving you FC/Ethernet/whatever you want all in 1 giant fabric.

H110Hawk posted:

If those are what I believe them to be, there are two of them in our datacenter already. DirecTV has a pair of them. They came in HUGE crates. They're pretty awesome looking, and they seem to be consolidating a lot of bandwidth onto them. Near as I can tell they're turning 5 racks of metro fiber gear into a pair of those.

If DirecTV already has some, they're probably not Nexus since I don't think it's shipping yet, the other Cisco full rack routers would be the CRS-1 single chassis, and I think there's also a GSR (XR) that takes up a full bay.

ragzilla fucked around with this message at 02:04 on Jan 29, 2008

# ¿ Jan 29, 2008 02:02

ragzilla: Sep 9, 2005; don't ask me, i only work here

MrZodiac posted:

I keep tabs on NANOG when work gets slow and I heard from there and other places that the replacement cable for the Sicily-Egypt line that recently went down is going to be pushing 10Tbit/s. What the hell terminates that kind of line? Is it a cage full of 6513s? Even with the 720 sup you're looking at at least 15 units, and that's with all of them running at near capacity.

The capacity is usually listed as TDM/SONET capacity, not all of that gets used for internet. You land it into DWDM equipment initially, which then splits the 'white' light on the undersea cable off into a the different lambdas/colors that make it up. Then depending on what kind of DWDM gear you use and what channel separation it provides, you can do either 10G or 40G over each lambda, I think Alcatel/Lucent has a box that does 128 lambdas @ 40G each for a total of 5.12Tb/s

# ¿ Feb 1, 2008 03:06

ragzilla: Sep 9, 2005; don't ask me, i only work here

Have you tried running packet tracer to see what rule (or lack thereof) it points to as the problem?

You're going to need a NAT rule, _and_ an incoming access rule on the Outside interface.

# ¿ Feb 7, 2008 03:53

ragzilla: Sep 9, 2005; don't ask me, i only work here

inignot posted:

1. Since their black magic routes differ from native BGP they are by definition creating asymmetric routing. Granted, this may or may not happen on the internet anyway.

This is going to happen on the internet anyway, asymmetry is a fact of life and it will not be avoided.

inignot posted:

Multihoming with internap and another ISP would be an adventure as well. You would have to prepend the AS path with the non internap ISP since the internap connection has their clown AS between you and the ISPs they are connected to.

Multihoming with internap is a bitch, one of our transits/peers we had an arrangement with for a few years (cheap bandwidth in exchange for "here's full tables and we'll back you up if your links out of the city are ever out") had an InterNAP connection and their (Internap's) default route policy is to localpref everything they get from you- so all our traffic swung away from our main transits and onto them. And they only had 155mbps into the POP we were out of. Trying to cram 300-400mbps down a 155mbps pipe (that's being shared with other people) reaaaaaly hurts.

# ¿ Feb 27, 2008 02:02

ragzilla: Sep 9, 2005; don't ask me, i only work here

CrazyLittle posted:

Have any of you guys used a Cisco multi-service router (like a 2800 series) to deliver a PRI to a PBX system?

What kind of hardware are you using?
What IOS?
What does the configuration look like (you can PM if you don't want it publicly visible.)

Not quite an ISR/MSR, but we use 2431s for this purpose:

code:

#sh ver
Cisco IOS Software, 2400 Software (C2400-IS-M), Experimental Version 12.3(20050912:183856) [mikepham-14t 115]
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Fri 16-Sep-05 13:23 by mikepham

ROM: System Bootstrap, Version 12.3(7r)T2, RELEASE SOFTWARE (fc1)
ROM: Cisco IOS Software, 2400 Software (C2400-IS-M), Version 12.3(7)T10, RELEASE SOFTWARE (fc2)

Paws uptime is 2 weeks, 4 days, 1 hour, 56 minutes
System returned to ROM by power-on
System restarted at 21:39:56 UTC Fri Feb 15 2008
System image file is "flash:c2430-is-mz"

Cisco IAD2431 (R527x) processor (revision 4.0) with 119808K/11264K bytes of memory.
Processor board ID FHK0931F0A6
R527x CPU at 225MHz, Implementation 40, Rev 3.1
2 FastEthernet interfaces
25 Serial interfaces
2 Channelized T1/PRI ports
DRAM configuration is 64 bits wide with parity disabled.
63K bytes of non-volatile configuration memory.
System fpga version is 250025
System readonly fpga version is 250025
Option for system fpga is 'system'.
62720K bytes of ATA System CompactFlash (Read/Write)
0K bytes of ATA Slot0 CompactFlash (Read/Write)

Configuration register is 0x2102

code:

# show run
...
network-clock-participate T1 1/0
network-clock-participate T1 1/1
!
isdn switch-type primary-ni
!
voice-card 0
!         
voice rtp send-recv
!
voice class codec 10
 codec preference 1 g711alaw
 codec preference 2 g711ulaw
!
controller T1 1/0
 framing esf
 linecode b8zs
 cablelength short 133
 channel-group 0 timeslots 1-24
!
controller T1 1/1
 framing esf
 clock source internal
 linecode b8zs
 cablelength short 133
 pri-group timeslots 1-24
!
interface Serial1/0:0
 description WAN
 ip address xxx.xxx.xxx.158 255.255.255.252
 encapsulation ppp
 ip tcp header-compression iphc-format
 fair-queue
 ip rtp header-compression iphc-format
 ip rtp priority 32768 4032 1152
!
interface Serial1/1:23
 no ip address
 no logging event link-status
 isdn switch-type primary-ni
 isdn protocol-emulate network
 isdn incoming-voice voice
 isdn supp-service name calling
 isdn outgoing ie progress-indicator 
 isdn outgoing display-ie
 no cdp enable
!
!         
!
!
control-plane
!
!
voice-port 1/1:23
!
!
!
!
dial-peer voice 1 voip
 description "SIP connection back to Provider"
 service session
 destination-pattern 1..........
 voice-class codec 10
 session protocol sipv2
 session target sip-server
 session transport udp
 no vad
!
dial-peer voice 2 pots
 tone ringback alert-no-PI
 service session
 destination-pattern ^....$
 progress_ind setup enable 3
 direct-inward-dial
 port 1/1:23
 authentication username xxxxxx2220 password <redacted> realm metaswitch.provider.com
!
dial-peer voice 3 voip
 description "SIP connection back to Provider"
 service session
 destination-pattern ^.......$
 voice-class codec 10
 session protocol sipv2
 session target sip-server
 session transport udp
 no vad
!         
dial-peer voice 10 voip
 description "SIP connection back to Provider"
 service session
 destination-pattern 011
 voice-class codec 10
 session protocol sipv2
 session target sip-server
 session transport udp
 no vad
!
dial-peer voice 11 voip
 description "SIP connection back to Provider"
 service session
 destination-pattern 0
 voice-class codec 10
 session protocol sipv2
 session target sip-server
 session transport udp
 no vad
!
dial-peer voice 12 voip
 description "SIP connection back to Provider Information"
 service session
 destination-pattern 411
 voice-class codec 10
 session protocol sipv2
 session target sip-server
 session transport udp
 no vad
!
dial-peer voice 13 voip
 description "SIP connection back to Provider Information"
 service session
 destination-pattern 1411
 voice-class codec 10
 session protocol sipv2
 session target sip-server
 session transport udp
 no vad   
!
dial-peer voice 14 voip
 description "SIP connection back to Provider TTY Relay"
 service session
 destination-pattern 711
 voice-class codec 10
 session protocol sipv2
 session target sip-server
 session transport udp
 no vad
!
dial-peer voice 15 voip
 description "SIP connection back to Provider Emergency"
 service session
 destination-pattern 911
 voice-class codec 10
 session protocol sipv2
 session target sip-server
 session transport udp
 no vad
!
sip-ua 
 calling-info pstn-to-sip from number set xxxxxx2220
 timers trying 1000
 sip-server ipv4:xxx.xx.xxx.21
!

The 'network-clock-participate' is quite important- if you want to avoid slips.

# ¿ Mar 5, 2008 00:40

ragzilla: Sep 9, 2005; don't ask me, i only work here

H110Hawk posted:

The TAC can be frustrating at times. We were trying to figure out why one of our etherchannel ports was getting 2x the bandwidth of the others, regardless of the balancing algorithm we picked. Lots of back and forth, disruptive troubleshooting, etc.

http://www.cisco.com/warp/public/473/4.html#cat6k

Fuckers. (Sorry for the rant.) Way to sell more switchports. Yesterday I had to burn 3 extra Cat6k GigE ports to make this actually not drop packets:
code:
  MTU 1500 bytes, BW 8000000 Kbit, DLY 10 usec,
  5 minute input rate 3572908000 bits/sec, 756909 packets/sec
  5 minute output rate 4257996000 bits/sec, 747013 packets/sec
(I can hear the cash register ringing in M@'s head.)

What are you up to, 8GbE ports? Wouldn't it be cheaper at that point (assuming you're using 6724s) to get some 6704s in and do 1x10GbE instead of 8x1GbE etherchannel? Or could you just do OSPF ECMP over a pair of 2-3x1GbE etherchannels and load balance at layer 3?

# ¿ Mar 26, 2008 17:52

ragzilla: Sep 9, 2005; don't ask me, i only work here

H110Hawk posted:

We're using 6748's hooked up to 4948's. Most of this is L2 traffic going from web servers to their NAS boxes. I could swap out the 4948 for a 4948-10GE and burn the last 10gig port on my 6708-10GE-3CXL, plus a few grand in X2 modules, but 8x1gig copper seems cheaper to me.

Perhaps I should put a second 6509 in place and just load it to the gills with 6748's and use it for rack aggregation? Use a 10gig etherchannel to get it to hit our BGP gateways, and move most of the OSPF stuff for those racks to the new copper monster.

If you don't need full tables, you could save some cash and do a 4500, (or if you really like the 6500, a Sup32), throw the 10GbE links on the sup (since assuming you run single sup if it's a manned facility, if the sup fails the node is down anyway) and load it up with 6548s (or the 4500 equiv). Then you could save some cash on the line cards since you won't get anything out of the fabric enabled cards- just have to make sure your total switching capacity (port-to-port and port-to-uplink) is under 32Gbps

# ¿ Mar 26, 2008 21:06

ragzilla: Sep 9, 2005; don't ask me, i only work here

CrazyLittle posted:

Stupid question:

Can you throw dissimilar interfaces into one multilink MLPPP bundle? IE - 2x ADSL + 1 ISDN + 1 DSU = fat pipe?

I wouldn't recommend it, is the equipment on both sides 'trusted'? You could run something like EIGRP between the nodes and do unequal-cost-multipath and let CEF load balance for you.

# ¿ Apr 9, 2008 00:56

ragzilla: Sep 9, 2005; don't ask me, i only work here

XakEp posted:

Not likely. I can plug them into my linksys broadband router (not being used on my network so dont give me poo poo) and the problem goes away. In fact, I can plug into any other switch and it works. PVLANs arent setup by default are they?

Not unless it's stored in the vlan database. If you don't mind fully resetting the switch, try the following commands while enabled:

code:

write erase
delete flash:/vlan.dat
reload

which will kill the current config, and the vlan database (so if you've added any vlans you'll need to re-add them).

# ¿ Apr 14, 2008 13:49

ragzilla: Sep 9, 2005; don't ask me, i only work here

InferiorWang posted:

How does everyone here use to keep track of your configs? CVS? Does cisco have any tools to make archiving configs more stream lined that cutting and pasting?

You want (assuming you're looking for something free) RANCID. RANCID RANCID RANCID.
http://www.shrubbery.net/rancid/
Which will back up most of your devices configs (as well as other info like "show ver" and hardware info) into CVS/SVN (although SVN is a bunch of work to set up).

Otherwise Cisco has their own solution in CiscoWorks (Resource Manager) I believe. And Solarwinds also does config backups via their Cirrus product.

# ¿ Apr 29, 2008 14:54

ragzilla: Sep 9, 2005; don't ask me, i only work here

InferiorWang posted:

Well then, I guess you all wouldn't mind if I brought this up then?

I've been working on trying to get rancid running on a SLES 10 box and I'm getting this error in rancid/var/logs:
code:
mis-s1:/usr/local/rancid/var/logs # more networking.20080429.112652
starting: Tue Apr 29 11:26:52 EDT 2008

cvs commit: cannot open CVS/Entries for reading: No such file or directory
cvs commit: nothing known about `router.db'
cvs [commit aborted]: correct above errors first!
I'm guessing I haven't configured something right with CVS, but my searches have not been fruitful as of yet.

What you'll typically want to do for CVS (if I recall, it's been awhile).
- create a local copy with your layout
- commit this to a repository in a shared location on your server
- delete/move your local copy
- check out your local copy
- check out another copy under your rancid user, and tell rancid to use that copy

# ¿ Apr 29, 2008 18:25

ragzilla: Sep 9, 2005; don't ask me, i only work here

bitprophet posted:

I've got an old 2501 to which I do not have the security password, and it's running IOS 11.0 which seems to be pretty outdated. What are my options if I just want to dick around with it for learning's sake (haven't touched any advanced networking voodoo since uni, so I have a vague memory of how to use IOS but no specifics)?

I'm guessing I want to re-flash it with a "new" (even if it's the same version) OS...can the 2501 use IOS 12.x? What is generally required to flash it? I've successfully connected to the console port via Linux / rolled cable / serial port / minicom.

I also don't remember offhand just what is possible, if anything, without entering the secure mode. What's the general breakdown between the two modes?

The 2501 should support probably a 12.0 or 12.1 train code- but you'll probably have trouble getting your hands on it unless you have a CCO account to download it off cisco.com. That said you pretty much can't do anything without the enable password, so you'll probably want to use the enable secret recovery procedure to change the enable secret.

flashing a new ios image to the router is typically done over tftp (it can be done over a console cable but it's excruciatingly slow), so you'd need to connect it via ethernet to a box running a tftp server (such as atftpd on linux, or tftpd32 on windows).

# ¿ May 7, 2008 12:20

ragzilla: Sep 9, 2005; don't ask me, i only work here

jbusbysack posted:

I've recently been tasked with investigating multicasting as a routable solution. There are 3 main sites and the idea is to route multicast traffic between all 3 sites (that are all interconnected) over point-to-point links.

Is there anything crazy I need to be aware of? From what I've researched it looks like MOSPF (ospf w/multicast) seems to be the solution. It's basically the same as rigging PVST+ with regards to segregating flow patterns.

It seems like the de-facto mcast protocol (assuming you're running cisco kit everywhere) is pim sparse. Other than that the only option I'm aware of is DVMRP as Cisco doesn't support MOSPF/CBT. Or you can also carry mcast in MBGP.

The netcraftsmen papers have a pretty good basic coverage to get you up to speed with the various protocols and concepts: http://www.netcraftsmen.net/welcher/papers/multicast01.html

# ¿ May 8, 2008 02:03

ragzilla: Sep 9, 2005; don't ask me, i only work here

jbusbysack posted:

I looked up the pim sparse settings with declaring the match statement akin to a crypto map and setting the interfaces to flood the traffic out. Is there much more to it than that?

Thank you for the links, will dive through those tonight.

You need to designate 1 or more RPs in your network, and tell all your PIM edges what the RP addresses are (this can be handled automatically with PIMv2). Papers 3 & 4 cover sparse mode, and RP strategies respectively.

# ¿ May 8, 2008 02:27

ragzilla: Sep 9, 2005; don't ask me, i only work here

jbiel posted:

Ours is pretty much the same. I usually get all ACL messages, but nothing about BGP exchanges other than neighbor up / down style stuff. Just aggravating at times.

oh, nm, you are seeing neighbor up/down, what kind of BGP messages are you expecting to see in the logs?

logging trap debugging & setting up the appropriate debug statements should send the debug to syslog, and if that's not working, you want to call TAC and see if they have a solution?

ragzilla fucked around with this message at 18:47 on May 15, 2008

# ¿ May 15, 2008 18:44

Adbot: ADBOT LOVES YOU

# ¿ May 15, 2024 06:08

ragzilla: Sep 9, 2005; don't ask me, i only work here

jbiel posted:

logging trap debug should catch EVERY message, from neighbor up / down to route exchanges etc to my understanding. I shouldn't have to turn on "debug bgp all" as well. Not from what I gather, but I have been so fed up at it, I could be reading it wrong.

But it'll only work if the message is actually created- which I don't think it is unless the debug statement is turned on.

# ¿ May 15, 2008 20:16

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›20 »