About Mark Pace Balzan

Mark Pace Balzan · ‎02-02-2016

Hi Stephen, I think you need to use split horizon to have roots and leaves in separate split horizon groups. Split Horizon groups in XR are not the most intuitive in my opinion but it works once you get your head around it. I dont have my config notes handy right now. let me know if you need anything else. Im pretty sure I got this to work in the lab. Mark

Mark Pace Balzan · ‎02-02-2016

thanks for your feedback Aaron I was trying to build some logic around "accept prefix (1) if prefix (2) is present" I agree that this would make no sense if the RPL is processed prefix at at time from the BGP peer, which was my suspicion, but was worth a shot, especially since prefix was accepted in the lab ! thanks Mark

Mark Pace Balzan · ‎02-01-2016

Hi, thanks for the pointer to the release notes. was looking for them on cco Is there a documented upgrade proecudre/guide from 5.x to 5.3.3 explaining mandatory bridge smus etc... as exists for other xr upgrades from version 'x' to version 'y' thanks Mark

Mark Pace Balzan · ‎01-28-2016

Hi, i came across a situation which gets me to ask about a detail of RPL logic which is deceiving me. Im mostly running asr9k with 5.1.3 or 5.2.4 in the lab although I doubt my query is platform specific So, If I apply RPL inbound on a BGP session upstream from where I receive a number of prefixes including default, how does XR/RPL handle the following ? if destination in (1.0.0.0/24) and destination in (2.0.0.0/24) then pass does the above even make sense logically, as in does the RPL examine one prefix at a time in the BGP feed ? If so 1.0.0.0/24 can never be 2.0.0.0/24, unless the RPL says I will accept 1.0.0.0/24 since I also have 2.0.0.0/24 being advertised to me via BGP from this same peer ? Quick test in the lab actually accepts 1.0.0.0/24 and installs it in FIB, so Im a little bit confused about the logic, since even if the parser allowed commit for something seeming illogical, XR is also generally a normally closed, deny all approach, as opposed to IOS, so I would have expected not to see prefix in FIB, but Im clearly missing something cheers Mark

Mark Pace Balzan · ‎12-07-2015

Hi, I need some feedback to verify if what Im seeing for IPv6 Neighbour Discovery state changes is correct and Im interpreting the behaviour and debugs correctly Neighbour on my router is in REACH state and traffic is flowing to/from this neighbour (using 2001:DB8 to hide real addressing) ROUTER#sh ipv6 nei IPv6 Address Age Link-layer Addr State Interface FE80::1849:F298:B1E2:A0AD 0 34e6.d739.01e3 REACH Fa0 2001:DB8:F100:100:609C:5839:F693:3F28 0 34e6.d739.01e3 REACH Fa0 FastEthernet0 has link local configured to be fe80::1 this is what we see in debug ipv6 nd 001495: *Dec 7 20:52:07.432 CET: ICMPv6-ND: REACH -> STALE: FE80::1849:F298:B1E2:A0AD 001496: *Dec 7 20:52:09.728 CET: ICMPv6-ND: Received NS for FE80::1 on FastEthernet0 from FE80::1849:F298:B1E2:A0AD 001497: *Dec 7 20:52:09.728 CET: ICMPv6-ND: Sending NA for FE80::1 on FastEthernet0 001498: *Dec 7 20:52:09.732 CET: ICMPv6-ND: STALE -> DELAY: FE80::1849:F298:B1E2:A0AD 001503: *Dec 7 20:52:14.788 CET: ICMPv6-ND: DELAY -> PROBE: FE80::1849:F298:B1E2:A0AD 001504: *Dec 7 20:52:14.788 CET: ICMPv6-ND: Sending NS for FE80::1849:F298:B1E2:A0AD on FastEthernet0 001505: *Dec 7 20:52:14.792 CET: ICMPv6-ND: Received NA for FE80::1849:F298:B1E2:A0AD on FastEthernet0 from FE80::1849:F298:B1E2:A0AD 001506: *Dec 7 20:52:14.792 CET: ICMPv6-ND: PROBE -> REACH: FE80::1849:F298:B1E2:A0AD 001525: *Dec 7 20:52:44.844 CET: ICMPv6-ND: REACH -> STALE: FE80::1849:F298:B1E2:A0AD My understanding is as follows: After 30 sec (default ipv6 nei reachabilty time) the neighbour will change from REACH to STALE reagrdless of whether there is traffic still flowing to the neighbour or not If traffic is still flowing to this neighbour when it moves to STALE, one of two things will happen i. either it will move from STALE to DELAY wait for (x time) for any upper layer traffic to verify reachability (eg TCP), not find any, move to PROBE, send NS every 1 second, recieve NA, and move from PROBE back to REACH. This is what we see in the debug ii. or it will move from STALE to DELAY, wait for (x time) for any upper layer traffic, find such upper layer traffic which shows reachability, and move straight back to REACH (ie no PROBE). we dont see the debug but is this a possible option ? Is the above correct ? of course in the debug we see (i) not (ii) for moving back to REACH although both are possible based on upper layer traffic ? Is moving from STALE direct to REACH a possible situation ? Is NUD this process above, ie moving from REACH to STALE every 30 sec and back to REACH based on traffic flowing, or is NUD something different ? thanks Mark

Mark Pace Balzan · ‎12-07-2015

spot on - thank you worked like a charm on 151-4.M10 I also added import domain-name ipv6 dhcp pool dnspool import dns-server import domain-name

Mark Pace Balzan · ‎11-21-2015

Hi, I have a router with G0/0 facing upstream, and getting DHCPv6 NA for G0/0 as well as DHCPv6-PD /56 which I use on G0/1 facing downstream, where I use SLAAC with a /64 from the PD for my laptop and other devices. INTERNET------[G0/0] ROUTER [G0/1]------LAPTOP SLAAC works fine with the PD prefix and I get connectivity as well as default gateway from the RA. The problem is here: From DHCPv6 I also get IPv6 DNS servers (can see that from sh ipv6 dhcp interface below), and I cant seem to figure out how to automatically send the v6 DNS server I learn from DHCP into RDNSS automatically/dynamically to my device via SLAAC The only way I can get v6 DNS to my laptop is by manually confiuring DHCPv6 server on the router and statically configuring the DNSv6 server in the pool and using the O-flag on G0/1. Thats hardly dynamic ! ROUTER#sh ipv6 dhcp interface Configuration parameters: IA PD: IA ID 0x00050001, T1 166424, T2 266278 Prefix: 2000:DB8:100::/56 preferred lifetime 332848, valid lifetime 937648 expires at Dec 01 2015 06:48 AM (932311 seconds) DNS server: 2000:DB8:200::6 Domain name: example.com Prefix name: prefix-pd int g0/1 ipv6 address prefix-pd ::1/64 ipv6 enable ipv6 nd other-config-flag ipv6 dhcp server dnspool Anyone have any ideas ? Im aware RDNSS was only in recent code. Should be able to run 15.x on my router thanks Mark

Mark Pace Balzan · ‎10-15-2015

Hi, this is a seemingly trivial question, but I'd just like to put it by everyone since sometimes we miss some detail in what initially looks obvious :) I have aaa setup with a tacacs server for authentication and accounting and all works great For the console I would like to setup such that Im always authenticated locally. What, if any, is the difference between the below two pieces of config to achieve this ? Of course in both cases i have a username and password configured in the global config #1 aaa authentication login notacacs local line con 0 login authentication notacacs #2 line con 0 login local thanks Mark

Mark Pace Balzan · ‎07-18-2015

Hi, on asr9k with 5.2.4 I see the behavior above with cdp, ie if enabled locally on the interface then it is consumed and peered with the attached device even if an untagged efp is configured what I also see and seems unexpected is that cdp enabled locally on the interface also overrides l2acl or ethernet filter dot1q. Is this expected behaviour ? It's getting a little bit confusing to me. Would appreciate any feedback thanks mark

Mark Pace Balzan · ‎07-07-2015

thanks Xander, Nicolas for your replies and clarifications so if tomahawk NPU does 250Mpps and 240Gbps in+out, and I want to keep linerate at small packet sizes, the math looks like 250Mpps x 64byte x 8bits = 128Gbps So I need to be looking at a TH card having 12-13 10GE ports per NPU, correct ? even if this is far from the 240Gbps per NPU.... Also I cant seem to find anything about the 4x100GE architecture, I only see the 8x100GE on the ciscolive pres cheers Mark

Mark Pace Balzan · ‎07-04-2015

Hi, Im trying to work out the performance data for the ASR9k and want to be sure im getting it right RSP440 does 220G in + 200G out worth of fabric per slot with typhoon and on a typhoon card per NPU we get 60G in + 60G out and 45Mpps in + 45Mpps out so for 24x10GE running on a box with single rsp440 we get 220 in, 220 out, which would make for 22 ports at line rate however since we loose 5G per FIA on this card, we effectively have 5x10GE per FIA, or total 20x10GE ports to keep line rate, which works out as 3x10GE for one NPU, and 2x10GE on the other NPU per FIA so if we have 45Mpps bidirectional per FIA, we get for 3x10GE group: 83 bytes at line rate for 2x10GE group: 55 bytes at line rate Is this correct ? im also assuming that on the 9912 where fabric is separate from the RP, if we have 4+1 fabric cards but we lose an RP we still have the full fabric bandwidth ie 400 in + 440 out per slot when running with one RP, right ? but if we want to maintain line rate even with small packet sizes, having fabric separate from RP doesnt help much right ? would be great if numbers can be shared for tomahawk line cards with RSP880/RP2 too, as i havent figured this one out

Mark Pace Balzan · ‎06-05-2015

Hi Aleksandar, so will there not be an EMR for the 5.2 train at all ? realistically, 5.3.3 will be deployable for production some time late next year. thanks Mark

Mark Pace Balzan · ‎06-04-2015

Hi Sam hoping you can help clarify. I got hold of 5.2.4 for asr9k and have done some lab tests with the intention of looking at deployment later on since this was the targetted emr release. i now see that in http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xr-software/product_bulletin_c25-478699.html it mentions 5.2.4 as SMR can an you kindly let me know if there will be a 5.2.5 as emr for asr9k, and also what the emr target is for crs ? thanks Mark

Mark Pace Balzan · ‎04-16-2015

Hi, Im working with asr9k running 4.3.4 and I performed various ipv6 lab tests. when I flooded the asr9k box with multiple ipv6 router advertisements, the box didn't quite survive. Ospfv3 adjacencies went down, I think as a consequence of neighbour discovery packets being dropped, as ospfv3 adjacencies didn't go down straight away. IPv4 remained running ok. Looks like LPTS didn't help either as it possibly doesn't differentiate between RAs and other Neighbour discovery packets ? Now in my case I don't need RAs at all, no SLAAC or DHCPv6 required, so it's looking silly that something not required on the box can cause so much harm. Hoping some of the experts here can show me if I'm missing something in terms of how to handle this thanks Mark

Mark Pace Balzan · ‎03-25-2015

Eddie, apologies for delay in getting back. upgrade from 4.3.4 to 5.1.3 went smoothly (ie no unexpected items), so thats great. It still took about 2-3 hours to do the entire upgrade including SMUs, not sure if that can be improved. The main concern here is the length of the maintenance window, especially if rollback is required for any reason. Im avoiding service packs for now for the same reason that many others are doing so, namely that it is not possible to install individual SMUs if required (with some exceptions, granted). separately, on 5.1.3 this popped up and cant find much except that router-id is no longer supported in terms of configured values. %IP-IP_ARM-6-RTRID_CFG_DEPRECATED So is there no deterministic way to have the box use a 'hard-wired' router id ? thanks Mark

Mark Pace Balzan · 02-02-2016

Hi Stephen, I think you need to use split horizon to have roots and leaves in separate split horizon...

Mark Pace Balzan · 02-02-2016

thanks for your feedback Aaron I was trying to build some logic around "accept prefix (1) if prefix ...

Mark Pace Balzan · 02-01-2016

Hi, thanks for the pointer to the release notes. was looking for them on cco Is there a documented u...

Mark Pace Balzan · 01-28-2016

Hi, i came across a situation which gets me to ask about a detail of RPL logic which is deceiving me...

Mark Pace Balzan · 12-07-2015

Hi, I need some feedback to verify if what Im seeing for IPv6 Neighbour Discovery state changes is c...

Mark Pace Balzan · 12-07-2015

spot on - thank you worked like a charm on 151-4.M10 I also added import domain-name ipv6 dhcp pool ...

Mark Pace Balzan · 11-21-2015

Hi, I have a router with G0/0 facing upstream, and getting DHCPv6 NA for G0/0 as well as DHCPv6-PD /...

Mark Pace Balzan · 10-15-2015

Hi, this is a seemingly trivial question, but I'd just like to put it by everyone since sometimes we...

Mark Pace Balzan · 07-18-2015

Hi,on asr9k with 5.2.4 I see the behavior above with cdp, ie if enabled locally on the interface the...

Mark Pace Balzan · 07-07-2015

thanks Xander, Nicolas for your replies and clarifications so if tomahawk NPU does 250Mpps and 240Gb...

Mark Pace Balzan · 07-04-2015

Hi, Im trying to work out the performance data for the ASR9k and want to be sure im getting it right...

Mark Pace Balzan · 06-05-2015

Hi Aleksandar, so will there not be an EMR for the 5.2 train at all ?realistically, 5.3.3 will be de...

Mark Pace Balzan · 06-04-2015

Hi Sam hoping you can help clarify. I got hold of 5.2.4 for asr9k and have done some lab tests with ...

Mark Pace Balzan · 04-16-2015

Hi, Im working with asr9k running 4.3.4 and I performed various ipv6 lab tests. when I flooded the a...

Mark Pace Balzan · 03-25-2015

Eddie,apologies for delay in getting back. upgrade from 4.3.4 to 5.1.3 went smoothly (ie no unexpect...

Date Registered	‎02-18-2005 11:18 PM
Date Last Visited	‎05-03-2019 01:00 AM
Total Messages Posted	97
Total Helpful Votes Received	20

Hi Stephen,

thanks for your feedback

Hi,

The 'AND' Logic in RPL ?

IPv6 ND and NUD

spot on - thank you

How to insert DNS received from DHCPv6 ...

login local vs aaa login local

Hi,on asr9k with 5.2.4 I see

thanks Xander, Nicolas for

typhoon and tomahawk line cards pps per...

Hi Aleksandar, so will there

Hi Sam hoping you can help

IPv6 RAs cause issues on asr9k

Eddie,apologies for delay in