Hi  I have this primary configuration on the primary CSR Router in the HA mode in same AZ but I am not seeing failover  to secondary CSR I am seeing on the backup router that the API call was successful. 10   10     Actv success   Thu Jun 9 18:13:50 2016   syslog             applet: replace-route2 Will I see in the VPC the router table changing pointing to backup eni? Here are the configs Primary Router:- event manager environment RTB rtb-07e98563 event manager environment ENI eni-eeaf2794 event manager environment CIDR 0.0.0.0/0 event manager environment REGION us-west-2a/10.0.0.2 event manager applet replace-route2 event syslog pattern "\(Tunnel1\) is down: BFD peer down notified" action 1.0 publish-event sub-system 55 type 55 arg1 "$RTB" arg2 "$CIDR" arg3 "$ENI" arg4 "$REGION" Backup Router:- event manager environment RTB rtb-07e98563 event manager environment REGION us-west-2a/10.0.0.2 event manager environment ENI eni-d5e473af event manager environment CIDR 0.0.0.0/0 event manager applet replace-route2 event syslog pattern "\(Tunnel1\) is down: BFD peer down notified" action 1.0 publish-event sub-system 55 type 55 arg1 "$RTB" arg2 "$CIDR" arg3 "$ENI" arg4 "$REGION" ... View more

Hi, I am working to set up HA for Cisco CSR in a single AZ and I wanted to verify the configuration for the EEM applet which I did pasted is the sample configuration. Since the AWS CSR has two interface one public and one private where the instances resides. Do I need to put the public interface or private interface in the eem configuration below?is the region mentioned by me correct?Where will I find DNS  for a particular private subnet. event manager environment RTB rtb-07e98563 event manager environment REGION us-west-2a/10.0.1.2 event manager environment CIDR 10.0.1.137/32 event manager environment ENI eni-d5e473af event manager applet replace-route2 event syslog pattern "\(Tunnel1\) is down: BFD peer down notified" action 1.0 publish-event sub-system 55 type 55 arg1 "$RTB" arg2 "$CIDR" arg3 "$ENI" arg4 "$REGION" ... View more

I have a router with the following configuration and i am not seeing any NAT Translation can you please let me know where is the mistake. The inside interface is Gigabit Ethernet 2.  I am natting  107.154.50.39 to  10.0.1.142 interface Tunnel0 ip address 192.168.247.29 255.255.255.252 ip nat outside tunnel source 10.0.0.252 tunnel destination 107.154.40.168 ! ! interface GigabitEthernet2 ip address dhcp ip nat inside negotiation auto !           ip nat pool LAN-NAT 107.154.50.39 107.154.50.39 prefix-length 24 ip nat inside source route-map GRE-NAT pool LAN-NAT route-map GRE-NAT permit 10 match ip address office22 ip access-list extended office22 permit ip host 10.0.1.142 any ... View more

I have the following configuration  I have configured PBR on the LAN interface stating that any traffic with this source should go through the tunnel interface also I want that that source to be Natted. For example the internal host is 192.168.0.1 I want it to be NATTED to 202.12.12.12  and than 202.12.12.12 should be PBR through a Tunnel Interface on the WAN Interface. My question is what will take precedence is it the NAT or the Route Maps? Regards Anuj ... View more

Hi, I have a scenario where I have two routers running in HSRP mode I want to run GRE Tunnel from the same origin IP to the same destination IP in the cloud. Incase the primary router fails I have to use the backup router to use the same origin source ip to the destination IP How will I achieve this configuration any ideas? Thanks Anuj ... View more

I have two vrf lite instances and I want each vrf lite instance to have its own default route to the provider internet.Provider is providing two VLANs and each VLAN has access to Internet.When I remove the global default route I am not able to get out to Internet any advice will be appreciated. ip vrf Corp rd 64616:10 routetarget export 64616:10 routetarget import 64616:10 ! ip vrf Test rd 64615:10 routetarget export 64615:10 routetarget import 64615:10 ! interface Loopback10 ip vrf forwarding Corp no ip address ! interface GigabitEthernet0/0 description To  Production Network (150MB circuit) ip vrf forwarding Corp ip address 63.234.13.129 255.255.255.128 duplex auto speed auto ! interface GigabitEthernet0/1 description To  DMZ Network (150MB circuit) ip vrf forwarding Corp ip address 65.115.72.225 255.255.255.224 duplex auto speed auto ! interface GigabitEthernet0/2 description To  Test Network 50Mbps ip vrf forwarding Test ip address 65.115.72.193 255.255.255.224 duplex auto speed auto ! interface GigabitEthernet0/0/0 description To Provider no ip address negotiation auto ! interface GigabitEthernet0/0/0.50 description Production IP Block Provider VLAN 50 150Mbps encapsulation dot1Q 50 ip vrf forwarding Corp ip address 63.235.163.6 255.255.255.252 ! interface GigabitEthernet0/0/0.51 description Test IP Block Provider VLAN 51 50Mbps encapsulation dot1Q 51 ip vrf forwarding Test ip address 63.235.163.2 255.255.255.252 ! ip route 0.0.0.0 0.0.0.0 63.235.163.5 ip route vrf Test 0.0.0.0 0.0.0.0 63.235.163.1 ip route vrf Corp 0.0.0.0 0.0.0.0 63.235.163.5 ... View more

Are multiple instances BGP supported on ISRG2 Router IOS?? Is there a configuration template that can referred how multiple instance BGP can be configured with two different AS Number?? Thanks Anuj ... View more

My customer bought the following server UCS-C200M2-VCD2 and now since this EOS can some one recommend equivalent server? Thanks Anuj ... View more

My customer wants to by AIR1242AG with 2.4 GHZ antennaes which are not ceiling mounted How many 2.4 GHz antennas I can have on the  AIR1242AG?? Can I have a recommendation which antenna I should use which is not ceiling mounted?? Let me know incase you have further questions ... View more

What are the pros and cons of 2.5 Ghz and 5Ghz spectrum My customer wants 1240AG and the antenna for those are either 2.5 GHz or 5GHZ and wants to know which spectrum is better for him to use Regards Anuj ... View more

Please refer the link below for Amazon VPC look for Cisco IOS http://docs.amazonwebservices.com/AmazonVPC/latest/NetworkAdminGuide/ why the interesting traffic is not marked?? why the vrf for both the tunnel are the same do we even need the vrf?? how will customer access internet traffic ?? Thanks Anuj ... View more

Customer has a Cisco Router with fa0 to Internet and fa1 to the LAN;Customer builds up IPSEC +GRE Tunn el from the VRF to the Internet Is the statement for interesting traffic missing in the IPSEC Configuration How will customer access normal Internet since int fa1 to the LAN is part of the VRF for the reverse traffic from internet from the vrf i will leak the non interesting traffic to the global routing table . IPSec Tunnel #1 ! ------------------------------------------------------------------------- ! #1: Internet Key Exchange (IKE) Configuration ! ! A policy is established for the supported ISAKMP encryption, ! authentication, Diffie-Hellman, lifetime, and key parameters. ! ! Note that there are a global list of ISAKMP policies, each identified by ! sequence number. This policy is defined as #200, which may conflict with ! an existing policy using the same number. If so, we recommend changing ! the sequence number to avoid conflicts. ! crypto isakmp policy 200    encryption aes 128    authentication pre-share    group 2    lifetime 28800    hash sha exit ! The ISAKMP keyring stores the Pre Shared Key used to authenticate the ! tunnel endpoints. ! crypto keyring keyring-vpn-44a8938f-0    pre-shared-key address 72.21.209.225 key plain-text-password1 exit ! An ISAKMP profile is used to associate the keyring with the particular ! endpoint. ! crypto isakmp profile isakmp-vpn-44a8938f-0    match identity address 72.21.209.225    keyring keyring-vpn-44a8938f-0 exit ! #2: IPSec Configuration ! ! The IPSec transform set defines the encryption, authentication, and IPSec ! mode parameters. ! crypto ipsec transform-set ipsec-prop-vpn-44a8938f-0 esp-aes 128 esp-sha-hmac    mode tunnel exit ! The IPSec profile references the IPSec transform set and further defines ! the Diffie-Hellman group and security association lifetime. ! crypto ipsec profile ipsec-vpn-44a8938f-0    set pfs group2    set security-association lifetime seconds 3600    set transform-set ipsec-prop-vpn-44a8938f-0 exit ! Additional parameters of the IPSec configuration are set here. Note that ! these parameters are global and therefore impact other IPSec ! associations. ! This option instructs the router to clear the "Don't Fragment" ! bit from packets that carry this bit and yet must be fragmented, enabling ! them to be fragmented. ! crypto ipsec df-bit clear ! This option enables IPSec Dead Peer Detection, which causes periodic ! messages to be sent to ensure a Security Association remains operational. ! crypto isakmp keepalive 10 10 on-demand ! This configures the gateway's window for accepting out of order ! IPSec packets. A larger window can be helpful if too many packets ! are dropped due to reordering while in transit between gateways. ! crypto ipsec security-association replay window-size 128 ! This option instructs the router to fragment the unencrypted packets ! (prior to encryption). ! crypto ipsec fragmentation before-encryption ! #3: Tunnel Interface Configuration !  ! This configuration assumes the presence of an internal ! Virtual Routing and Forwarding (VRF) instance. For more details, see the ! associated diagram. Here, we assume the internal VRF is named "YOUR_VRF". ! ip vrf YOUR_VRF    rd 1:1 exit ! A tunnel interface is configured to be the logical interface associated  ! with the tunnel. All traffic routed to the tunnel interface will be ! encrypted and transmitted to the VPC. Similarly, traffic from the VPC ! will be logically received on this interface. ! ! The interface is a member of the internal routing instance (YOUR_VRF). ! Association with the IPSec security association is done through the ! "tunnel protection" command. ! ! This example shows the outside of the tunnel as interface FastEthernet0. ! ! This should be set to the interface that IP address YOUR_UPLINK_ADDRESS is ! associated with. ! ! This address is configured with the setup for your Customer Gateway. ! ! If the address changes, the Customer Gateway and VPN Connection must be ! recreated with AWS. ! interface Tunnel1    ip vrf forwarding YOUR_VRF    ip address 169.254.255.2 255.255.255.252    ip virtual-reassembly    tunnel source FastEthernet0    tunnel destination 72.21.209.225    tunnel mode ipsec ipv4    tunnel protection ipsec profile ipsec-vpn-44a8938f-0    ! This option causes the router to reduce the Maximum Segment Size of    ! TCP packets to prevent packet fragmentation.    ip tcp adjust-mss 1396    no shutdown exit ! #4: Border Gateway Protocol (BGP) Configuration !                                                                                     ! BGP is used within the tunnel to exchange prefixes between the ! VPN Gateway and your Customer Gateway. The VPN Gateway    ! will announce the prefix corresponding to your Cloud. !            ! Your Customer Gateway must announce a default route (0.0.0.0/0), ! which can be done with the 'network' statement and ! 'default-originate' statements. Only one prefix is ! accepted by the VPN Gateway.                                            ! ! The BGP timers are adjusted to provide more rapid detection of outages. ! ! The local BGP Autonomous System Number (ASN) (YOUR_BGP_ASN) is configured ! as part of your Customer Gateway. If the ASN must be changed, the ! Customer Gateway and VPN Connection will need to be recreated with AWS. !    router bgp YOUR_BGP_ASN    neighbor 169.254.255.1 remote-as 7224    neighbor 169.254.255.1 activate    neighbor 169.254.255.1 timers 10 30 30    address-family ipv4 unicast vrf YOUR_VRF       neighbor 169.254.255.1 remote-as 7224       neighbor 169.254.255.1 timers 10 30 30       neighbor 169.254.255.1 default-originate       neighbor 169.254.255.1 activate       neighbor 169.254.255.1 soft-reconfiguration inbound       network 0.0.0.0    exit exit ... View more