CSR1000v – AWS
Ook voor de CSR1000v als startpunt de datasheet (Table 6 t/m 9):
Release Notes:
http://www.cisco.com/c/en/us/td/docs/routers/csr1000/release/notes/csr1000v_3Srn.html#pgfId-3017606
Licensing (in de configuration guide):
Categorie: Netwerk (C-NSP)
A9K-RSP440 SFP+ ports
>> So I am guessing they are normal ports which can be configured to be cluster ports and could used normally to link up to rest of the network?
>
They are not, as far as I’m aware. Very much the opposite to 6500/7600supervisors. Certainly there are no ‘interfaces’ that I can configure on RSP-440!
Correct, they are only for nV clustering, and control-plane only at that. You still need to use line card 10G ports for data plane clustering.
Cisco 6500-E and Modules
1- As far as I understood, If we use SUP-2T on C6513-E, the Fabric Switch Capacity will be 80Gbps(2x40Gbps Channels). Is this correct?
yes in 11 slots
2- We can install WS-x6748-SFP on this setup with DFC4. Is this Correct?
Yes
3- Can we install WS-x6708-10G on this setup with DFC4 or Not?
6708 does not have DFC4 or CFC modes, so is not compatible with sup2t, you can use ws-6908-10g.
4- If no then can we use WS-x6716-10G with DFC4?
Yes
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/hardware/Config_Notes/OL_24918.pdf
C6708-10GE-3CXL Local Switching:
http://www.gossamer-threads.com/lists/cisco/nsp/145906
Only 69xx modules are 40 or more per channel, all the 67xx and the upgraded 67xx ones with dfc4 (rebadged to 68xx) will still be 20 per channel, the DFC does not matter, the fabric asic and hardware on the older modules is all 20g per channel (40g total on dual channel cards).
Cisco EEM
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-e1.html#wp2241131084
A state is not an event.
A state *change* is an event.
ip sla 1 icmp-echo 1.1.1.1 source-ip 1.1.1.2 vrf GREEN tag SITE-DOWN frequency 5 ! ip sla schedule 1 life forever start-time now ! event manager applet SITE-DOWN description Site 1.1.1.1 is down event ipsla operation-id 1 action 1.0 syslog priority critical msg "ALERT: Site 1.1.1.1 is down" !
And here is what I see when I look the status of the IP SLA entry and the EEM entry. IP SLA looks fine, the EEM isn’t triggering despite being registered.
rtr5#sh ip sla statistics 1 IPSLAs Latest Operation Statistics IPSLA operation id: 1 Latest RTT: NoConnection/Busy/TimeoutLatest operation start time: 11:42:21 EST Mon Jan 18 2016 Latest operation return code: Timeout Number of successes: 0 Number of failures: 301 Operation time to live: Forever !
rtr5#sh event manager policy registered
No. Class Type Event Type Trap Time Registered
Name
1 applet user ipsla Off Mon Jan 18 11:24:46
2016 SITE-DOWN
operation-id {1}
maxrun 20.000
action 1.0 syslog priority critical msg "ALERT: Site 1.1.1.1 is down"
!
rtr5sh event manager statistics polic
Average MaximumNo. Class Triggered Suppressed Run Time Run Time Name
-------------------------------------------------------------------------------
1 applet 0 0 0.000 0.000
SITE-DOWN
event {} ipsla
MPLS and links with limited MTU size
When deal with Mtu issues on all out site to site vpn. Gre plus IPSec plus other uses up 60 to 90 bytes.
There are some good docs on cisco site. Standard solution for tcp flows is, … for the constrained or tunnel int.
"IP Mtu 1400" "IP tcp adjust-mss 1360"
This will cause the tcp 3way setup to negotiate a 1360byte mss which then fits into the 1500 byte max physical Mtu size.
In theory, setting the Mtu to 1400 will also cause the pmtu discovery process to auto adjust as well. This is hit or miss, depending on stack and if icmp is being filtered in the path.
Windows tries hard to guess the Mtu and usually sets the do not frag bit on most packets. The above usually works. But we often find some non-tcp app defaults to 1500 bytes anyway. Since windows sends it with do not frag, the router drops it. To fix this use a route-map to clear the DF bit. I only do this for udp now. Seems a good compromise.
All this would be done on your Cpe or other edge router. Tunnelled ddos mitigation vendors also do this to avoid Mtu issues.
IP-SLA
You are missing a bit more specifics on your event definition… It just doesn’t match a reaction event from IP SLA.
If you look here:
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-e1.html#wp2241131084
You can see that there are quite a few options to set what exactly you want to trigger on with regards to IP SLA.
I think you have to define reactions or triggers to match on IP SLA related events (events being state transitions… up to down, down to up, threshold limits, etc)
To be honest, I got best results from EEM and IP SLA by EEM matching on the syslog messages IP SLA produces…
working on an EEM script which is triggered by an IP SLA down
> state on an ASR1000 running IOS-XE 3.11.1S. While the IP SLA entry
> detects the state properly, the EEM does not trigger. I’m not finding
> anything relevant on the bug toolkit, and I am not seeing anything
> with my Google-fu.
>
> Here’s the configuration:
>
> ip sla 1
> icmp-echo 1.1.1.1 source-ip 1.1.1.2
> vrf GREEN
> tag SITE-DOWN
> frequency 5
> ip sla schedule 1 life forever start-time now !
> event manager applet SITE-DOWN
> description Site 1.1.1.1 is down
> event ipsla operation-id 1
> action 1.0 syslog priority critical msg “ALERT: Site 1.1.1.1 is down”
> !
>
> And here is what I see when I look the status of the IP SLA entry and
> the EEM entry. IP SLA looks fine, the EEM isn’t triggering despite
> being registered.
>
>
> rtr5#sh ip sla statistics 1
> IPSLAs Latest Operation Statistics
>
> IPSLA operation id: 1
> Latest RTT: NoConnection/Busy/Timeout Latest operation start
> time: 11:42:21 EST Mon Jan 18 2016 Latest operation return code:
> Timeout Number of successes: 0 Number of failures: 301 Operation time
> to live: Forever !
> rtr5#sh event manager policy registered
> No. Class Type Event Type Trap Time Registered
> Name
> 1 applet user ipsla Off Mon Jan 18 11:24:46
> 2016 SITE-DOWN
> operation-id {1}
> maxrun 20.000
> action 1.0 syslog priority critical msg “ALERT: Site 1.1.1.1 is down”
> !
> rtr5sh event manager statistics policy
>
> Average Maximum
> No. Class Triggered Suppressed Run Time Run Time Name
>
> ——————————————————————————-
> 1 applet 0 0 0.000 0.000
> SITE-DOWN
event {} ipsla
>(Specifically what I’m looking for is something that hooks into IP SLA
>or Ethernet OAM/CFM and takes a link out of IGP routing if packet loss
>crosses a certain threshold – we recently had a carrier break their
>metro network in interesting ways, leading to 50% packet loss, which
>was enough to effectively take the site offline, but IGP stubbornly
>clung to “I have seen a keepalive!”)
something like this could get you started, Gert?
1) Trigger based on SNMP interface error counters.
Rate is always calculated per second. Average factor identifies number of data points (one for each poll-interval) will be averaged for calculation of rate. Average factor needs to be a minimum of 2.
event manager applet INTERFACE-ERROS trap event snmp oid ifEntry.14.XX get-type exact entry-op ge entry-val 10 entry-type rate average-factor 2 poll-interval 5 action 20.0 syslog msg “disabling Gigxxx due to errors”
action 30.0 cli command “enable”
action 30.1 cli command “config terminal”
action 40.0 cli command “interface Gig XX”
action 50.0 cli command “ip ospf cost 9999”
action 60.0 cli command “end”
and a reverse to reduce the cost back in case error rates falls below a threshold?
you can also trigger based on IP-SLA, for example below trigger
2) Trigger based on RTT delay mib:
Use RTT delay mib associated with RTR probes to trigger when the delay is too long. rttMonLatestJitterOperRTTSum shows the sum of delays for probes sent during the last interval. By default 10 probes are sent. To trigger on 10ms RTT delay trigger value must be set below 100.
event manager applet TEST3-SNMP-RTT-Delay trap event snmp oid rttMonLatestJitterOperRTTSum.1 get-type exact entry-op ge entry-val 90 entry-type value exit-op le exit-val 20 poll-interval 10 […]
for Ethernet OAM/CFM, you could hook EEM into the syslog messages produced by the syslog? You can also parse the syslog string using regexp, check the applet I found somewhere:
event manager applet TunnelLost
event syslog occurs 1 pattern “OSPF-5-ADJCHG.*on Tunnel.*FULL to DOWN”
period 1
action 100 regexp “on (Tunnel[0-9]+) from” “$_syslog_msg” match ifname action 200 if $_regexp_result eq 1 action 210 cli command “show interface $ifname | include Description:”
…
ASR920 – Rosen-VPN
Just to avoid the confusion regarding MVPN profiles in the future Cause NG-MVPN could be RSVP or mLDP based and there is Rosen in there as well So I suggest using descriptions:
Rosen-mGRE profiles (profiles- 0, 3,11)
Rosen-mLDP profiles (profiles- 1,9, 12, 13,17) mLDP profiles (profiles- 2,4,5,14,15) inband mLDP profiles (profiles- 6,7)
List of profiles:
Profile 0 Default MDT – GRE – PIM C-mcast Signaling Profile 1 Default MDT – MLDP MP2MP PIM C-mcast Signaling Profile 2 Partitioned MDT – MLDP MP2MP – PIM C-mcast Signaling Profile 3 Default MDT – GRE – BGP-AD – PIM C-mcast Signaling Profile 4 Partitioned MDT – MLDP MP2MP – BGP-AD – PIM C-mcast Signaling Profile 5 Partitioned MDT – MLDP P2MP – BGP-AD – PIM C-mcast Signaling Profile 6 VRF MLDP – In-Band Signaling Profile 7 Global MLDP In-band Signaling Profile 8 Global Static – P2MP-TE Profile 9 Default MDT – MLDP – MP2MP – BGP-AD – PIM C-mcast Signaling Profile 10 VRF Static – P2MP TE – BGP-AD Profile 11 Default MDT – GRE – BGP-AD – BGP C-mcast Signaling Profile 12 Default MDT – MLDP – P2MP – BGP-AD – BGP C-mcast Signaling Profile 13 Default MDT – MLDP – MP2MP – BGP-AD – BGP C-mcast Signaling Profile 14 Partitioned MDT – MLDP P2MP – BGP-AD – BGP C-mast Signaling Profile 15 Partitioned MDT – MLDP MP2MP – BGP-AD – BGP C-mast Signaling Profile 16 Default MDT Static – P2MP TE – BGP-AD – BGP C-mcast Signaling Profile 17 Default MDT – MLDP – P2MP – BGP-AD – PIM C-mcast Signaling Profile 18 Default Static MDT – P2MP TE – BGP-AD – PIM C-mcast Signaling Profile 19 Default MDT – IR – BGP-AD – PIM C-mcast Signaling Profile 20 Default MDT – P2MP-TE – BGP-AD – PIM – C-mcast Signaling Profile 21 Default MDT – IR – BGP-AD – BGP – C-mcast Signaling Profile 22 Default MDT – P2MP-TE – BGP-AD BGP – C-mcast Signaling Profile 23 Partitioned MDT – IR – BGP-AD – PIM C-mcast Signaling Profile 24 Partitioned MDT – P2MP-TE – BGP-AD – PIM C-mcast Signaling Profile 25 Partitioned MDT – IR – BGP-AD – BGP C-mcast Signaling Profile 26 Partitioned MDT – P2MP TE – BGP-AD – BGP C-mcast Signaling
For more info please refer to:
as well as:
all the way down to:
Summary of Supported MVPN Profiles
draft rosen model, as stated here for IOS XE 3.17
http://www.cisco.com/c/en/us/td/docs/routers/asr920/release/notes/ASR920_rel_notes/new_features.html#pgfId-1085169
protected port
you could simply use the “protected port” feature.
Devices connected to a Protected port are not able to talk to each other, even if they are within the same vlan.
conf t
int gi 0/1
switchport mode access
switchport acess vlan x
switchport protected
spanning-tree portfast
The protected port feature only works local on a switch while private vlans could span over multiple switches. Much easier then configure private vlans and should work for your use case just fine
ASR1k Port-channel hash algo
Does the ASR1K not support layer-4 port # hash (src/dst IP + tcp ports) for port-channel load balancing?
All I can see that can be configured is src/dst IP:
asr1k(config)#port-channel load-balance-hash-algo ?
dst-ip Destination IP
dst-mac Destination MAC
src-dst-ip Source XOR Destination IP Addr
src-dst-mac Source XOR Destination MAC
src-ip Source IP
src-mac Source MAC
asr1k#sh etherchan load | in channel
Port-channel1 : flow-based (Source Destination IP)
Should be flow-based by default (just don’t configure anything else):
Cisco netwerk overnames
Insieme is the skunkworks venture Cisco backed group they use for some new tech. These guys operate outside Cisco and develop Product to eventually be bought / acquired.
Nx9k is the latest example. I’m told the original catalyst and cat5k were similar.
No, the Catalysts were external acquisitions. Low end stuff like the 1900 came from Grand Junction, the 3K was Kalpana, and the 5K & 6K Crescendo.
>
> On Thu, Dec 31, 2015 at 04:17:07PM +0000, Justin Ream wrote:
>> As far as internal Cisco politics go: I’ve heard the situation has
>> changed with the new CEO. Nexus 7000/7700 sits in the same BU as
>> Cat6k. The Insieme/Nexus 9k guys operate in their own separate unit.