Hello!   I have several IOS-XR routers and have been monitoring them with SNMPv3 for quite some time. We have them configured with an OSPF underlay with LDP, and then use L3VPNs/VRFs for public internet interfaces. I am running into a problem using SNMP on an interface in one of our VRFs. I created a public loopback interface in the VRF with a public address. Currently, I have SNMP allowed from our management servers on the private loopback interfaces in the default table of the router, but in this case (a DDoS mitigation appliance), I need to be able to SNMP walk the router from a public address, which is in a VRF. The source and destination are in the same VRF. I am able to ping between the devices and BGP has an active session in the VRF, so connectivity is there, but I suspect the management plane is preventing SNMP traffic on the public lookback. I have tried simply adding the public IPv4 address under "allow snmp peer" beneath the public loopback in our inband config, but this does not work. I have also tried creating an OOB management VRF in our management plane using the VRF that the devices live in, which also does not allow traffic. In the inband plane, I always have to add the loopback interface, and the interfaces that the management traffic travels through to reach the loopback, but it is not possible (it seems) to configure the same interface in both the OOB plane and the inband plane. Is this a limitation of the management plane configuration or is there a piece that I am missing? Let me know if you need more details! Thanks in advance for your help! ... View more

Hello!   Apologies, as this will likely be a lengthy post. I work for a regional ISP with multiple upstream internet connections and multiple customers that BGP peer with our AS and share their prefixes to the internet through us. Currently, we have an as-path ACL that is applied to our internet providers' BGP sessions in the outbound direction. This way, we can prevent one upstream provider from using our AS as a transit AS to another of our upstream provider ASes. For example, if our AS is 100, our internet provider's AS is 300 and a customer's AS is 200 we would apply this ACL to our ISP with AS 300.   ip as-path access-list 1 permit ^$ (locally originated routes) ip as-path access-list 1 permit ^100_[0-9]*$ (I think this allows for advertisement of prefixes learned from our own AS via iBGP) ip as-path access-list 1 permit ^200(_200)*$ (allows for advertisement of customer with AS 200's prefixes and for them to use prepends if they choose)   I inherited this setup, but it seems mostly okay and has been working for us for quite some time in our current ASR1K border routers. The downside is that we have to edit this ACL every time a new customer wants to BGP peer with our AS, which has some impactful potential if a mistake is made.   So, we recently purchased some shiny new ASR9K devices to replace our ASR1Ks in this role. My plan is to eliminate our "border" network, which currently peers with an MPLS L3VPN (VRF INTERNET) as an eBGP peer. I'd like to create a new VRF with a new L3VPN named BORDER and leak a default route into our VRF INTERNET. This way, I can take a full routing table on border devices, but keep the full table from populating on less powerful devices without doing a ton of filtering on a neighbor by neighbor basis. I think I have most of the configuration figured out for this (I'd love to hear thoughts/suggestions though), but the RPL is confusing me a little. I'd like to come up with a route-policy that allows us to advertise prefixes learned from customer ASes but not from our upstream internet providers. I have an untested theory as-path ACL that I think would accomplish this below. it would be applied to our internet peer's BGP session in the out direction. Assume the same ASes as the earlier example:   ip as-path access-list 1 deny ^300_$ ip as-path access-list 1 permit ^$ ip as-path access-list 1 permit ^100_$ ip as-path access-list 1 permit ^[0-9]_$   Am I correct in my theory that this would allow all prefixes learned from all ASes would be advertised to this peer EXCEPT prefixes learned from AS300? If so, this would allow me to peer with customers with editing this ACL at the border every time.   Additionally, I understand that these ACLs, our route-maps, and their prefix-lists would have to be configured using RPL. I am aware of the if/then/else ability of RPL, which is awesome. However, I would need a way to deny prefixes learned from certain ASes (internet providers) first, which can be done with an AS-set and if/then statement, but after that, I would need a separate if/then statement to allow the prefixes and ASes that I do want to advertise. Could someone more experienced than I provide some insight into how this is typically done in an SP environment? I also understand that my current setup may be able to gain efficiency, so I would love to hear suggestions with regard to best practices in this area.   If you've made it this far, thank you so much for your time and help! ... View more

Hello! Is there an attachment for a GPS module for the ASR-1006 that will allow me to use it as a stratum 1 clock? I've found some info on the ASK9K, but nothing for the 1006. Any help or links would be appreciated! Thanks! ... View more