Just to avoid the confusion regarding MVPN profiles in the future Cause NG-MVPN could be RSVP or mLDP based and there is Rosen in there as well So I suggest using descriptions:

 

Rosen-mGRE profiles (profiles- 0, 3,11)

Rosen-mLDP profiles (profiles- 1,9, 12, 13,17) mLDP profiles (profiles- 2,4,5,14,15) inband mLDP profiles (profiles- 6,7)

 

List of profiles:

Profile 0 Default MDT – GRE – PIM C-mcast Signaling Profile 1 Default MDT – MLDP  MP2MP  PIM C-mcast Signaling Profile 2 Partitioned MDT – MLDP MP2MP – PIM C-mcast Signaling Profile 3 Default MDT – GRE – BGP-AD – PIM C-mcast Signaling Profile 4 Partitioned MDT – MLDP MP2MP – BGP-AD – PIM C-mcast Signaling Profile 5 Partitioned MDT – MLDP P2MP – BGP-AD – PIM C-mcast Signaling Profile 6 VRF MLDP – In-Band Signaling Profile 7 Global MLDP In-band Signaling Profile 8 Global Static – P2MP-TE Profile 9 Default MDT – MLDP – MP2MP – BGP-AD – PIM C-mcast Signaling Profile 10 VRF Static – P2MP TE – BGP-AD Profile 11 Default MDT – GRE – BGP-AD – BGP C-mcast Signaling Profile 12 Default MDT –  MLDP – P2MP – BGP-AD – BGP C-mcast Signaling Profile 13 Default MDT – MLDP – MP2MP – BGP-AD – BGP C-mcast Signaling Profile 14 Partitioned MDT – MLDP P2MP – BGP-AD – BGP C-mast Signaling Profile 15 Partitioned MDT – MLDP MP2MP – BGP-AD – BGP C-mast Signaling Profile 16 Default MDT Static – P2MP TE – BGP-AD – BGP C-mcast Signaling Profile 17 Default MDT – MLDP – P2MP – BGP-AD – PIM C-mcast Signaling Profile 18 Default Static MDT – P2MP TE – BGP-AD – PIM C-mcast Signaling Profile 19 Default MDT – IR – BGP-AD – PIM C-mcast Signaling Profile 20 Default MDT – P2MP-TE – BGP-AD – PIM – C-mcast Signaling Profile 21 Default MDT – IR – BGP-AD – BGP – C-mcast Signaling Profile 22 Default MDT – P2MP-TE – BGP-AD BGP – C-mcast Signaling Profile 23 Partitioned MDT – IR – BGP-AD – PIM C-mcast Signaling Profile 24 Partitioned MDT – P2MP-TE – BGP-AD – PIM C-mcast Signaling Profile 25 Partitioned MDT –  IR – BGP-AD – BGP C-mcast Signaling Profile 26 Partitioned MDT – P2MP TE – BGP-AD – BGP C-mcast Signaling

 

For more info please refer to:

http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/multiprotocol-label-switching-vpns-mpls-vpns/118983-configure-mpls-00.html#anc48

as well as:

http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-2/multicast/configuration/guide/b_mcast_cg42asr9k/b_mcast_cg42asr9k_chapter_01.html#concept_071C3FD3AAB24A57A9AA711FAE7BE78F

all the way down to:

Summary of Supported MVPN Profiles

 

draft rosen model, as stated here for IOS XE 3.17

http://www.cisco.com/c/en/us/td/docs/routers/asr920/release/notes/ASR920_rel_notes/new_features.html#pgfId-1085169

you could simply use the “protected port” feature.

Devices connected to a Protected port are not able to talk to each other, even if they are within the same vlan.

 

conf t

int gi 0/1

switchport mode access

switchport acess vlan x

switchport protected

spanning-tree portfast

 

The protected port feature only works local on a switch while private vlans could span over multiple switches. Much easier then configure private vlans and should work for your use case just fine

Does the ASR1K not support layer-4 port # hash (src/dst IP + tcp ports) for port-channel load balancing?

All I can see that can be configured is src/dst IP:

 

asr1k(config)#port-channel load-balance-hash-algo ?

dst-ip       Destination IP

dst-mac      Destination MAC

src-dst-ip   Source XOR Destination IP Addr

src-dst-mac  Source XOR Destination MAC

src-ip       Source IP

src-mac      Source MAC

 

 

asr1k#sh etherchan load | in channel

Port-channel1                   :  flow-based (Source Destination IP)

 

Should be flow-based by default (just don’t configure anything else):

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/lanswitch/configuration/xe-3s/asr1000/lanswitch-xe-3s-asr1000-book/lnsw-flow-portchannel-load.html

 

Insieme is the skunkworks venture Cisco backed group they use for some new tech.   These guys operate outside Cisco and develop Product to eventually be bought / acquired.

 

Nx9k is the latest example.   I’m told the original catalyst and cat5k were similar.

No, the Catalysts were external acquisitions. Low end stuff like the 1900 came from Grand Junction, the 3K was Kalpana, and the 5K & 6K Crescendo.

>

> On Thu, Dec 31, 2015 at 04:17:07PM +0000, Justin Ream wrote:

>> As far as internal Cisco politics go: I’ve heard the situation has

>> changed with the new CEO. Nexus 7000/7700 sits in the same BU as

>> Cat6k. The Insieme/Nexus 9k guys operate in their own separate unit.

 

This should be straigt forward.

Configure the trunk towards the 9k via Trunk EFP [1] and the port as per [2].

 

Config should look like this:

! slvans:

bridge-domain 1-5, 7, 9-12

!

interface gigabitethernet2/0/1

descr Trunk to ASR9k

service instance trunk 1 ethernet

encapsulation dot1q 1 – 5, 7, 9 – 12

rewrite ingress tag pop 1 symmetric

bridge-domain from-encapsulation

!

!

interface gigabitethernet2/0/2

descr Customer C-vlan range 100-200 in S-vlan 5  service instance 5 Ethernet

encapsulation dot1q 100-200

bridge-domain 5

 

[1] http://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/ce/b_ce_xe-313s-asr920-book/b_ce_xe-313s-asr920-book_chapter_00.html#GUID-FE6D829C-A814-46F3-A9E6-4AFC094AB066

[2] http://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/ce/b_ce_xe-313s-asr920-book/b_ce_xe-313s-asr920-book_chapter_01.html#ID-1384-00000345

 

 

Show flow monitor exporter statistics

 

You need to use the show commands to see if the ASR thinks the traffic is leaving: What is the output of show flow exporter? I always find it’s something like “SE linux” on the collector, and this stops you from seeing it in tcpdump.

 

On my cisco asr1001x nat logging does not work.

I do not see traffic on collector with tcpdump.

I tryning soft:

System image file is “bootflash:/asr1001x-universalk9.03.12.01.S.154-2.S1-std.SPA.bin”

System image file is “bootflash:/asr1001x-universalk9.03.15.00.S.155-2.S-std.SPA.bin”

 

 

interface TenGigabitEthernet0/0/0

description Downlink-to-X670

ip address 10.254.253.18 255.255.255.252  no ip redirects  no ip unreachables  ip nat inside  ip flow monitor flow_v5 input  ip flow monitor flow_v5 output  service-policy type control CTRL-IPOE  ip subscriber routed

initiator unclassified ip-address

end

 

ip nat settings mode cgn

no ip nat settings support mapping outside ip nat settings pap limit 60 ip nat log translations flow-export v9 udp destination 10.0.0.122 9995 source TenGigabitEthernet0/0/0 ip nat log translations flow-export v9 vrf 0 on ip nat translation timeout 300 ip nat translation tcp-timeout 1800 ip nat translation pptp-timeout 1800 ip nat translation udp-timeout 60 ip nat translation finrst-timeout 10 ip nat translation syn-timeout 10 ip nat translation dns-timeout 10 ip nat translation icmp-timeout 10 ip nat translation port-timeout tcp 80 360 ip nat translation port-timeout tcp 8080 360 ip nat translation port-timeout tcp 1600 180 ip nat translation port-timeout tcp 110 180 ip nat translation port-timeout tcp 25 180 ip nat translation max-entries all-host 2000 ip nat pool NAT_POOL_18.19.142 18.19.142.0 18.19.142.254 netmask 255.255.255.0 ip nat inside source list ACL_NAT_18.19.142 pool NAT_POOL_18.19.142 overload

 

 

 

flow exporter carbon4_v5

destination 172.1.1.2

transport udp 9996

export-protocol netflow-v5

!

!

flow monitor flow_v5

exporter carbon4_v5

cache timeout inactive 10

cache timeout active 1000

record netflow-original

 

Sweet!  This guy had the answer I was looking for…

https://supportforums.cisco.com/discussion/11517026/inter-vpls

 

…an RFC4761 trick in IOS XR fixed the missing mtu on my ASR9k when trying to setup LSP’s to Juniper.

 

******** this is what fixed it************* l2vpn  autodiscovery bgp

signaling-protocol bgp

mtu mismatch ignore

***********************************

 

…now pw’s are up (and I can ping from BVI on asr9k to ce’s behind junipers

 

RP/0/RSP0/CPU0:eng-lab-9k-1#sh l2v br gr v100 Sat Dec  5 22:49:06.395 CST

Legend: pp = Partially Programmed.

Bridge group: v100, bridge-domain: v100, id: 11, state: up, ShgId: 0, MSTi:

0

Aging: 300 s, MAC limit: 4000, Action: none, Notification: syslog

Filter MAC addresses: 0

ACs: 1 (1 up), VFIs: 1, PWs: 3 (3 up), PBBs: 0 (0 up)

List of ACs:

BV100, state: up, BVI MAC addresses: 1

List of Access PWs:

List of VFIs:

VFI v100 (up)

Neighbor 10.101.12.245 pw-id 10100, state: up, Static MAC addresses: 0

Neighbor 10.101.12.248 pw-id 10100, state: up, Static MAC addresses: 0

Neighbor 10.101.12.250 pw-id 10100, state: up, Static MAC addresses: 0

 

 

…pw’s are up even though junipers don’t seem to be sending the asr9k their mtu size.

 

RP/0/RSP0/CPU0:eng-lab-9k-1#sh l2v br gr v100 de | in MTU Sat Dec  5 22:49:12.265 CST

Bridge MTU: 1500

MTU 1514; XC ID 0x80000015; interworking none

MTU          1500                           unknown

MTU          1500                           unknown

MTU          1500                           1500

 

 

 

_______________________________________________

cisco-nsp mailing list  cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp

archive at http://puck.nether.net/pipermail/cisco-nsp/

Setting up a pair of Cisco ASRs for an small ISP. Each ASR has a connection to an upstream ISP. The ASRs are also connected to downstream customers with BGP. Am looking for some sample route-policies. The route policies should prevent the ISP from becoming transit for the entire Internet, but still be transit for the downstream customers.

The syntax may not be exactly correct, but the below gives a rough outline of a relatively simple setup using communities. You can use a prefix-set or as-path-set with all the prefixes/asns you advertise to filter outbound to transit instead of communities (or in addition to), but communities will scale better in the long run. There may be better ways to do it but this should give a good start.

— Apply to customer(s) —

Route-policy fulltable-out

If destination in bogons then

Drop

elseif community matches-any ( “LOCALPREFIX”, “CUSTPREFIX”, “PEERPREFIX, “TRANSITPREFIX” ) then

Pass

Endif

End-policy

 

Route-policy asCUSTASN-in

If destination in asCUSTASN then

Set community CUSTPFX

Endif

End-policy

 

Prefix-set asCUSTASN

CUS.PFX.A.0/20 le 24,

CUS.PFX.B.0/24,

Etc…

End-set

 

— Apply to Transit —

 

Route-policy transit-in

If destination in bogons then

Drop

Else

Set community TRANSITPREFIX

endif

End-policy

 

Route-policy transit-out

If destination in bogons then

Drop

elseif community matches-any ( “LOCALPREFIX”, “CUSTPREFIX” ) then

Pass

endif

End-policy

 

prefix-set bogons

0.0.0.0/8 le 32,

10.0.0.0/8 le 32,

100.64.0.0/10 le 32,

127.0.0.0/8 le 32,

169.254.0.0/16 le 32,

172.16.0.0/12 le 32,

192.0.0.0/24 le 32,

192.0.2.0/24 le 32,

192.168.0.0/16 le 32,

198.18.0.0/15 le 32,

198.51.100.0/24 le 32,

203.0.113.0/24 le 32,

224.0.0.0/4 le 32,

240.0.0.0/4 le 32,

0.0.0.0/0 ge 25

end-set