hello as everything in life,  it depends; you should leave it, your question is for CE, and the MPLS MTU applies on the MPLS cloud; assuming your CE is using 1500 on customer side and MPLS on ISP side, the ISP side interface should accommodate extra bytes for MPLS header without your change. Now, some devices support larger MTU like 9200, but if you want to go that way it's a change for the ISP, and then you should adjust your enterprise side accordingly to take advantage of the new MTU, which will be a non standard MTU on your side, but it works for some environments as data centers.   briefly, you don't have to change it.   https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/nx-os/mpls/configuration/guide/mpls_cg/mp_l2vpn_atom.html ... View more

I don't think so, as I know ASA doesn't include same commands as in routers, but you can find out using a collector. ... View more

hi, it should be available, I haven't seen it implemented, but netflow gathers information from packets and then exports from a routed interface, so it should work in transparent mode, config guide says so: Firewall Mode Guidelines Supported in routed and transparent firewall mode. https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/monitor_nsel.html ... View more

@daniel86 :   Is there a way to only accept connections from inside our network and if yes, how to do this? How can I change the password for the http user?     hi, that's why I recommend to learn CLI instead depending on graphic UI; you can set the connections control with a standard ACL using ip http access-class [ACL]; and your password is the one defined with username [user] password [password].   take a look into configuration guide for http server: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/https/configuration/15-mt/https-15-mt-book/nm-https-sc-ssl3.html ... View more

I'm guessing from your explanation, I need to see evidence. You mentioned you have several route-maps, perhaps your prefixes are hitting one and then setting same metrics, invalidating your previous metrics. you have to take a look into topology links at your switch to compare values. ... View more

as far as I can remember, ASR900 uses BDI instead SVI, I hope it helps. ... View more

not for this one, but there are may recordings from Cisco Live sessions available that you might enjoy:   https://ciscolive.cisco.com/on-demand-library   regards. ... View more

@Sonu Upadhyay   your router injecting the prefix from BGP shows external data because it's a locally originated topology link from redistribution, and the information says where the prefix came from (BGP's neighbor); then your EIGRP neighbor will receive the topology link coming from the EIGRP originating router, then you will see the EIGRP neighbor as source and not the BGP neighbor, because it's pure EIGRP information. ... View more

https://www.cisco.com/c/dam/global/fr_dz/assets/expoalgeria2011/pdfs/Services_Avances_Jean_Navarro.pdf   sorry, a typo. ... View more

@jonmo2578 remove the tunnel completely and try again, tunnel key must match both sides.   As @Richard Burts says, you can use IP address, but recommendation is to use interface, configuration guides even mention to use a loopback to increase availability.   Tunnel key it's the value to identify multiple tunnels when a single source is used and relates packets to every GRE process. ... View more

hello   T3 can't handle 150Mbps, you need a 4431 to support new throughput, and usually ISP will deliver using Giga Ethernet with FO. Check performance row for reference, where upgradeable, you have to buy a license for extra throughput: https://www.cisco.com/c/en/us/products/routers/4000-series-integrated-services-routers-isr/models-comparison.html ... View more

when redistributing on firewalls I guess you use default metrics, you can change the metric with something like:   router eigrp 1 redistribute static route-map STATIC      ip prefix-list DEFAULT permit 0.0.0.0/0 route-map STATIC  match ip address prefix DEFAULT  set metric 500000    In this way you'll have a worse metric prefix, both are learned over EIGRP and once the track 1 removes Fw1's, then Fw2's will be installed at Sw.   you can check with show ip eigrp topology 0.0.0.0/0 and you will see both prefixes from firewalls, and then you'll know what is the metric to increase.   you said you changed metrics, how? Another way is to set a filter per neighbor IP in the switch, this will reduce locally (only in the switch) the Administrative Distance for routes in the ACL.   ip access-list standard 15 permit 0.0.0.0   router eigrp 1 distance 80 10.x.x.x 0.0.0.0 15 ... View more