Cisco Guide to Harden Cisco IOS Devices
http://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html
http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=36857
Categorie: Cisco
IOS XR primer
And of course, the Master Command Listing for IOS XR was
very helpful too.
Once you have all this down, you can then dig into specific
topics such as RPL, e.t.c.
Here is a good one on RPL.
gives a baseline with some good info as to differences
and then move on to
http://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-xr-software/products-installation-and-configuration-guides-list.html
which gives the in depth topic by topic.
https://supportforums.cisco.com/community/5996/xr-os-and-platforms
Document tab as well as Blog tab will get you expert at IOS-XR in no time.
ciscolive.com pop “IOS-XR” into the search
Synchronization & Timing Self-Paced Online Bootcamp (Available Now)
Synchronization has three aspects Frequency, Phase & Time. The need for synchronization is becoming critical for the following industries and deployments,
– Service Providers: Mobile Networks, Performance Management in Carrier Ethernet Networks
– Industrial Solutions: More efficient Manufacturing
– Smart Grid: Replacing legacy Time Distribution with Ethernet
– High Frequency Trading: Regulatory and Market Differentiation
– Industrial Solutions: More efficient Manufacturing
– Smart Grid: Replacing legacy Time Distribution with Ethernet
– High Frequency Trading: Regulatory and Market Differentiation
However this topic is being perceived as complex especially if your core expertise is IP networking. Dennis Hagarty from Cisco Systems who is also an industry expert in this area, decided to solve this problem by developing “Synchronization & Timing Self-Paced Bootcamp” which covers technology fundamentals as well as configuration and verification. Complete bootcamp is available on Youtube and has three modules. Below are the Youtube links,
Synchronization & Timing Self-Paced Bootcamp
Playlist: http://youtu.be/N7nTCHxBitU?
Clocking & Sync Part 1/3: TDM and Packet-based Frequency Sync
http://youtu.be/N7nTCHxBitU?
Clocking & Sync Part 2/3: IEEE 1588 and PTPv2
http://youtu.be/250reOmrN70?
Clocking & Sync Part 3/3: Configuration of Clocking and Timing
http://youtu.be/eitxR-_lMxs?
Cisco IOS XR EEM
Hi , I have the below EEM script and am trying to do it using IOS XR
event
manager applet SLA_OUT
event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.2 get-type exact entry-op eq entry-val 1 exit-op eq exit-val 2 poll-interval 5
action 1.0 syslog msg “Test”
action 1.1 cli command “enable”
action 1.2 cli command “configure
terminal”
action 1.3 cli command “ip route 0.0.0.0
0.0.0.0 192.168.13.3”
action 1.4 syslog msg “There is a problem on our Primary connection , move all the traffic to the Secondary Line”
event
manager applet SLA_OK
event snmp oid 1.3.6.1.4.1.9.9.42.1.2.9.1.6.2 get-type exact entry-op eq entry-val 2 exit-op eq exit-val 1 poll-interval 5
action 1.0 syslog msg “OK”
action 1.1 cli command “enable”
action 1.2 cli command “configure
terminal”
action 1.3 cli command “no ip route
0.0.0.0 0.0.0.0 192.168.13.3”
action 1.4 syslog msg “Our Primary
connection is functionin again , stop using the Secondary Line”
Carrier Ethernet and Mobile Backhaul Video Tutorials
Carrier Ethernet and Mobile Backhaul Video Tutorials
Cisco has posted Ten New video tutorials on “Carrier Ethernet and Mobile Backhaul” on Cisco SPAG youtube channel.
Link:
http://youtu.be/uKwuge9DQl8?
Topics:
Introduction to ELINE Services
Configuring ELINE Services
Configuring CFNM on ELINE Service
Configuring Two Way Delay Measurement using Y1731PM Introduction to ELAN Services Configuring G8032 in an Access Ring Network Introduction to MPLS in Access Configuring ELAN Service using H-VPLS BGP Auto Discovery Configuring CE2.0 Layer 2 Protocol Forwarding Configuring Unified MPLS Transport
Cisco SPAG Youtube Channel
https://www.youtube.com/
ME3600 does not automatically copy DSCP into COS
ME3600 does not automatically copy DSCP into COS and also does not automatically copy EXP into COS T-T
Hi all,
I found the problem my customer’s TOS is rewritten.
Topology:
Tester1 (Send CoS=5) — Gi0/0/1/0 ASR9k 0/0/1/0.3604 — xconnect — Gi0/9 ME-3600X Gi0/24 — Gi0/14 ME-3400 Gi0/5 — Tester2 (rx CoS=0)
I open the TAC both ASR and ME Switch Team and this is the answer from ME Switch Team:
ME3600 does not automatically copy DSCP into COS and also does not automatically copy EXP into COS as described in the following document which was presented on Cisco Live event (page 44 and 45):
http://d2zmdbbm9feqrf.
Solution:
Please configure policy-map on interfaces to set a proper COS value basing on incoming DSCP.
ASR1000 BGP advertise best-external
>> > Is there any reason why RR running XE can’t advertise best external
>>to its
>> clients? That is nonsense!
>> > Why XR doesn’t have any problems with that?
>> > From a business point of view I understand it very well as you need
>>to buy
>> 4 instead of two routers but otherwise…
>>
>> i don’t use this feature, but the docs say it’s supported on RRs from
>>3.4S.
>>
>> Nick
>>
>Well yes it is but actually only for nonclients as one can’t advertise
>best external to a RR client.
>So if there’s a PE that happens to be a route reflector as well, then
>this feature is useless.
>On XR there’s no such limitation.
>> clients? That is nonsense!
>> > Why XR doesn’t have any problems with that?
>> > From a business point of view I understand it very well as you need
>>to buy
>> 4 instead of two routers but otherwise…
>>
>> i don’t use this feature, but the docs say it’s supported on RRs from
>>3.4S.
>>
>> Nick
>>
>Well yes it is but actually only for nonclients as one can’t advertise
>best external to a RR client.
>So if there’s a PE that happens to be a route reflector as well, then
>this feature is useless.
>On XR there’s no such limitation.
A RR needs to advertise the best path to each RR client, that’s its job.
If it should also send the best-external (which would be, by definition,
not the overall best path) to the clients, you need to use add-path as you
need to advertise more than one path. Have you enabled both? can you share
the config?
IIRC this is the same on XR, you also need to enable add-path on the RR..
Strange IOS as DHCP Client behevior
> My problem is that these routers are visible in DHCP binding database with
> very strange MAC:
>
> 10.2.2.140 0063.6973.636f.2d30. Dec 20 2014 11:44 AM
> Automatic
> 3035.302e.3536.6138.
> 2e34.6132.622d.4769.
> 302f.30
>
> Do you have idea why MAC is so weird ? Rest clients – Eg. Linux or Window
> boxes MACs is displayed correctly.
>
> 10.2.2.140 0063.6973.636f.2d30. Dec 20 2014 11:44 AM
> Automatic
> 3035.302e.3536.6138.
> 2e34.6132.622d.4769.
> 302f.30
>
> Do you have idea why MAC is so weird ? Rest clients – Eg. Linux or Window
> boxes MACs is displayed correctly.
It’s not a MAC address, it’s a client identifier. And IOS by default
chooses a text string as client identifier. In your case it’s:
“cisco-0050.56a8.4a2b-Gi0/0”
> Anything to configure at Cisco clients to have proper MAC in binding
> database ?
The above example is completely proper. I’m not aware of any method for
making IOS not use a client identifier, but you can change the
identifier it sends via e.g. “ip dhcp client client-id …” interface
command.
next-hop-self under address-family vpnv4 also?
next-hop-self under address-family vpnv4 also?
BGP PIC Edge would be recommended but if it is not supported, use different RDs even for the same VPN. This would allow second best path to be installed for the same prefix.
Next-hop-self is enabled automatically under vpnvX AF.
If the code supports it I’d recommend:
address-family vpnv4
bgp advertise-best-external <– enables best-external + pic(if supported).
no bgp recursion host <–disables recursive lookup for BGP NHs.
bgp nexthop route-map BGP_NHT <–specifies which prefixes qualify as BGP NHs.
bgp nexthop trigger delay 0 <–allows BGP to act on IGP events immediately(enable if FRR backup is available for the BGP NH).
route-map BGP_NHT permit 10
match ip address prefix-list PE_LOOPBACKS
match source-protocol “igp” <–if you are using hierarchical MPLS you need to add BGP there as well.
route-map BGP_NHT permit 20
match source-protocol connected
adam
> —–Original Message—–
> From: cisco-nsp [mailto:cisco-nsp-bounces@
> CiscoNSP List
> Sent: Friday, September 19, 2014 3:32 AM
> To: Will Tardy; cisco-nsp@puck.nether.net<
> Subject: Re: [c-nsp] next-hop-self under address-family vpnv4 also?
>
> Cheers.
>
> Any other “tweaks” to default config you recommend? i.e. timers etc?
>
>
> > From: will.tardy@vocus.com.au<
> > To: cisco-nsp@puck.nether.net<
> > Date: Fri, 19 Sep 2014 00:42:23 +0000
> > Subject: Re: [c-nsp] next-hop-self under address-family vpnv4 also?
> >
> > It¹s not needed.
> >
> >
> > “address-family vpnv4” section is used to define which routers
> > participate in the VPNv4. The underlying MPLS network will forward
> > labels between the
> > VPNv4 end-point CE’s. Next-hop-self isn¹t required. All that¹s
> > required is MPLS and IGP reachability between the CE¹s participating
> > in the vpnv4 domain.
> >
> > On 19/09/2014 10:31 am, “CiscoNSP List” <cisconsp_list@hotmail.com<
> wrote:
> >
> > >Is it recommended to add it under vpnv4 also?
> > >
> > >i.e.
> > >
> > >router bgp xxxxxx
> > >…
> > >neighbor iBGP-IPv4-PEERS update-source Loopback0 neighbor
> > >iBGP-IPv4-PEERS next-hop-self neighbor xxx.xxx.xxx.xxx peer-group
> > >iBGP-IPv4-PEERS…
> > >address-family vpnv4
> > > bgp redistribute-internal
> > > neighbor iBGP-IPv4-PEERS send-community extended
> > > neighbor iBGP-IPv4-PEERS next-hop-self
> > > neighbor xxx.xxx.xxx.xxx activate
> > >
> > >Cheers.
> > >
> > >
> > >
> > >_____________________________
> > >cisco-nsp mailing list cisco-nsp@puck.nether.net<
> > >https://puck.nether.net/
> > >archive at http://puck.nether.net/
> >
> >
> > ______________________________
bgp advertise-best-external <– enables best-external + pic(if supported).
no bgp recursion host <–disables recursive lookup for BGP NHs.
bgp nexthop route-map BGP_NHT <–specifies which prefixes qualify as BGP NHs.
bgp nexthop trigger delay 0 <–allows BGP to act on IGP events immediately(enable if FRR backup is available for the BGP NH).
route-map BGP_NHT permit 10
match ip address prefix-list PE_LOOPBACKS
match source-protocol “igp” <–if you are using hierarchical MPLS you need to add BGP there as well.
route-map BGP_NHT permit 20
match source-protocol connected
adam
> —–Original Message—–
> From: cisco-nsp [mailto:cisco-nsp-bounces@
> CiscoNSP List
> Sent: Friday, September 19, 2014 3:32 AM
> To: Will Tardy; cisco-nsp@puck.nether.net<
> Subject: Re: [c-nsp] next-hop-self under address-family vpnv4 also?
>
> Cheers.
>
> Any other “tweaks” to default config you recommend? i.e. timers etc?
>
>
> > From: will.tardy@vocus.com.au<
> > To: cisco-nsp@puck.nether.net<
> > Date: Fri, 19 Sep 2014 00:42:23 +0000
> > Subject: Re: [c-nsp] next-hop-self under address-family vpnv4 also?
> >
> > It¹s not needed.
> >
> >
> > “address-family vpnv4” section is used to define which routers
> > participate in the VPNv4. The underlying MPLS network will forward
> > labels between the
> > VPNv4 end-point CE’s. Next-hop-self isn¹t required. All that¹s
> > required is MPLS and IGP reachability between the CE¹s participating
> > in the vpnv4 domain.
> >
> > On 19/09/2014 10:31 am, “CiscoNSP List” <cisconsp_list@hotmail.com<
> wrote:
> >
> > >Is it recommended to add it under vpnv4 also?
> > >
> > >i.e.
> > >
> > >router bgp xxxxxx
> > >…
> > >neighbor iBGP-IPv4-PEERS update-source Loopback0 neighbor
> > >iBGP-IPv4-PEERS next-hop-self neighbor xxx.xxx.xxx.xxx peer-group
> > >iBGP-IPv4-PEERS…
> > >address-family vpnv4
> > > bgp redistribute-internal
> > > neighbor iBGP-IPv4-PEERS send-community extended
> > > neighbor iBGP-IPv4-PEERS next-hop-self
> > > neighbor xxx.xxx.xxx.xxx activate
> > >
> > >Cheers.
> > >
> > >
> > >
> > >_____________________________
> > >cisco-nsp mailing list cisco-nsp@puck.nether.net<
> > >https://puck.nether.net/
> > >archive at http://puck.nether.net/
> >
> >
> > ______________________________
IPv6 BGP peer info over SNMP
IPv6 BGP peers over SNMP
On 22/09/14 22:42, chiel wrote:
> So not yet for a 6500 with sup720? I believe 15.1 is the latest on that.
Looks to be the case….
7600 with SUP720 have 15.2, 15.3 & 15.4 releases:
On 23/09/2014 04:05, Frank Bulk wrote:
> Do you happen to have the OIDs or MIB name for that info?
> Do you happen to have the OIDs or MIB name for that info?