Hi, Just testing route leaking between GRT+VRF using import+export ipv4 unicast - From a PE, I am able to ping prefixes in the VRF and in GRT, but prefixes learned from another PE(Also doing route leaking) are unreachable (Prefixes that are part of the VRF (i.e not leaked prefixes) I can reach from eaither PE). EG. Ping VRF prefix from PE01 -> PE02: #ping vrf TEST_PEERING 111.222.66.253 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 111.222.66.253, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms Ping GRT prefix (Loopback of PE02) from PE01 -> PE02 fails: #ping vrf TEST_PEERING 111.222.76.130 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 111.222.76.130, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) Ping GRT prefix (Loopback of local PE) success: #ping vrf TEST_PEERING 111.222.76.201 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 111.222.76.201, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms   *Note - We do use RR's - I dont know if this is causing the issue, or if its potentially the RIB failure(In BGP) of the PE Loopback due to OSPF carrying those addresses)   # Check route info of vrf prefix from PE01 -> PE02 sh ip route vrf TEST_PEERING 111.222.66.252 Routing Table: TEST_PEERING Routing entry for 111.222.66.252/30 Known via "bgp XXXX", distance 200, metric 0, type internal Last update from 111.222.76.130 10:55:07 ago Routing Descriptor Blocks: * 111.222.76.130 (default), from 111.222.76.204, 10:55:07 ago Route metric is 0, traffic share count is 1 AS Hops 0 MPLS label: 75 MPLS Flags: MPLS Required, NSF   #sh ip bgp vpnv4 vrf TEST_PEERING 111.222.66.252 BGP routing table entry for 111.222.76.201:4000:111.222.66.252/30, version 3841875 BGP Bestpath: compare-routerid Paths: (1 available, best #1, table TEST_PEERING) Additional-path-install Not advertised to any peer Refresh Epoch 81 Local, imported path from 111.222.76.130:4000:111.222.66.252/30 (global) 111.222.76.130 (metric 5) (via default) from 111.222.76.204 (111.222.76.204) Origin incomplete, metric 0, localpref 100, valid, internal, best Community: XXXX:4000 Extended Community: RT:XXXX:4000 Originator: 111.222.76.130, Cluster list: 0.0.0.2 mpls labels in/out nolabel/75 rx pathid: 0, tx pathid: 0x0   GRT prefix on Local PE: #sh ip bgp vpnv4 vrf TEST_PEERING 111.222.76.201 BGP routing table entry for 111.222.76.201:4000:111.222.76.201/32, version 3775105 BGP Bestpath: compare-routerid Paths: (1 available, best #1, table TEST_PEERING) Additional-path-install Not advertised to any peer Refresh Epoch 1 Local, imported path from 111.222.76.201/32 (global) 0.0.0.0 (via default) from 0.0.0.0 (111.222.76.201) Origin incomplete, metric 0, localpref 100, weight 32768, valid, external, no-import, no-import, best Community: XXXX:1000 XXXX:1301 XXXX:14000 rx pathid: 0, tx pathid: 0x0   #sh ip route vrf TEST_PEERING 111.222.76.130 Routing Table: TEST_PEERING Routing entry for 111.222.76.130/32 Known via "bgp XXXX", distance 200, metric 0, type internal Last update from 111.222.76.130 11:02:45 ago Routing Descriptor Blocks: * 111.222.76.130 (default), from 111.222.76.204, 11:02:45 ago Route metric is 0, traffic share count is 1 AS Hops 0 MPLS label: none MPLS Flags: NSF   #sh ip bgp 111.222.76.130 BGP routing table entry for 111.222.76.130/32, version 27830848 BGP Bestpath: compare-routerid Paths: (4 available, best #2, table default, RIB-failure(17)) Additional-path-install Not advertised to any peer Refresh Epoch 5 Local, (received & used) 111.222.76.130 (metric 5) from 111.222.76.205 (111.222.76.205) Origin incomplete, metric 0, localpref 100, valid, internal, af-export(1) Community: XXXX:1000 XXXX:1301 XXXX:15000 Originator: 111.222.76.130, Cluster list: 0.0.0.2 rx pathid: 0, tx pathid: 0 Refresh Epoch 4 Local, (received & used) 111.222.76.130 (metric 5) from 111.222.76.204 (111.222.76.204) Origin incomplete, metric 0, localpref 100, valid, internal, af-export(1), best Community: XXXX:1000 XXXX:1301 XXXX:15000 Originator: 111.222.76.130, Cluster list: 0.0.0.2 rx pathid: 0, tx pathid: 0x0 Refresh Epoch 4 Local, (received & used) 111.222.76.130 (metric 5) from 111.222.76.212 (111.222.76.212) Origin incomplete, metric 0, localpref 100, valid, internal, af-export(1) Community: XXXX:1000 XXXX:1301 XXXX:15000 Originator: 111.222.76.130, Cluster list: 0.0.0.1 rx pathid: 0, tx pathid: 0 Refresh Epoch 2 Local, (received & used) 111.222.76.130 (metric 5) from 111.222.76.213 (111.222.76.213) Origin incomplete, metric 0, localpref 100, valid, internal, af-export(1) Community: XXXX:1000 XXXX:1301 XXXX:15000 Originator: 111.222.76.130, Cluster list: 0.0.0.1 rx pathid: 0, tx pathid: 0   ## Is the "no-import" the cause(And caused by RIB failure?) #sh ip bgp vpnv4 vrf TEST_PEERING 111.222.76.130 BGP routing table entry for 111.222.76.201:4000:111.222.76.130/32, version 3843463 BGP Bestpath: compare-routerid Paths: (4 available, best #2, table TEST_PEERING) Additional-path-install Not advertised to any peer Refresh Epoch 5 Local, (received & used), imported path from 111.222.76.130/32 (global) 111.222.76.130 (metric 5) (via default) from 111.222.76.205 (111.222.76.205) Origin incomplete, metric 0, localpref 100, valid, internal, no-import, no-import Community: XXXX:1000 XXXX:1301 XXXX:15000 Originator: 111.222.76.130, Cluster list: 0.0.0.2 rx pathid: 0, tx pathid: 0 Refresh Epoch 4 Local, (received & used), imported path from 111.222.76.130/32 (global) 111.222.76.130 (metric 5) (via default) from 111.222.76.204 (111.222.76.204) Origin incomplete, metric 0, localpref 100, valid, internal, no-import, no-import, best Community: XXXX:1000 XXXX:1301 XXXX:15000 Originator: 111.222.76.130, Cluster list: 0.0.0.2 rx pathid: 0, tx pathid: 0x0 Refresh Epoch 2 Local, (received & used), imported path from 111.222.76.130/32 (global) 111.222.76.130 (metric 5) (via default) from 111.222.76.213 (111.222.76.213) Origin incomplete, metric 0, localpref 100, valid, internal, no-import, no-import Community: XXXX:1000 XXXX:1301 XXXX:15000 Originator: 111.222.76.130, Cluster list: 0.0.0.1 rx pathid: 0, tx pathid: 0 Refresh Epoch 4 Local, (received & used), imported path from 111.222.76.130/32 (global) 111.222.76.130 (metric 5) (via default) from 111.222.76.212 (111.222.76.212) Origin incomplete, metric 0, localpref 100, valid, internal, no-import, no-import Community: XXXX:1000 XXXX:1301 XXXX:15000 Originator: 111.222.76.130, Cluster list: 0.0.0.1 rx pathid: 0, tx pathid: 0   VRF config: vrf definition TEST_PEERING rd 111.222.76.201:4000 ! address-family ipv4 import ipv4 unicast 10000 map RP_TEST_PREFIXES_GRT export ipv4 unicast 10000 map RP_TEST_PEERING_PARTNERS_PREFIXES_VRF route-target export XXXX:4000 route-target import XXXX:4000 maximum routes 25000 80 reinstall 90 exit-address-family router bgp XXXX ! address-family ipv4 vrf TEST_PEERING redistribute connected route-map RP_TAG_PEERING_PARTNERS_PREFIXES_VRF redistribute static route-map RP_TAG_PEERING_PARTNERS_PREFIXES_VRF neighbor PEERING_B_PEERING_NDC_B1_LOCA peer-group neighbor PEERING_B_PEERING_NDC_B1_LOCA remote-as YYYYY neighbor PEERING_B_PEERING_NDC_B1_LOCA description eBGP to PEERING_B for PEERING 11515 (YYYYY) neighbor PEERING_B_PEERING_NDC_B1_LOCA ttl-security hops 254 neighbor PEERING_B_PEERING_NDC_B1_LOCA update-source GigabitEthernet0/1/0.35 neighbor PEERING_B_PEERING_NDC_B1_LOCA route-map RP_PEERING_B_PEERING_LOCA_NDC_IN in neighbor PEERING_B_PEERING_NDC_B1_LOCA route-map RP_PEERING_B_PEERING_LOCA_NDC_OUT out neighbor 333.44.70.1 peer-group PEERING_B_PEERING_NDC_B1_LOCA neighbor 333.44.70.1 activate neighbor 333.44.70.2 peer-group PEERING_B_PEERING_NDC_B1_LOCA neighbor 333.44.70.2 activate exit-address-family   #sh run | section route-map RP_TEST_PREFIXES_GRT route-map RP_TEST_PREFIXES_GRT permit 10 match community CL_GRT_TEST_PREFIXES #sh run | section route-map RP_TEST_PEERING_PARTNERS_PREFIXES_VRF route-map RP_TEST_PEERING_PARTNERS_PREFIXES_VRF permit 10 match community CL_TEST_PEERING_PARTNERS_PREFIXES_VRF #sh run | include CL_GRT_TEST_PREFIXES ip community-list standard CL_GRT_TEST_PREFIXES permit XXXX:1301 #sh run | include CL_TEST_PEERING_PARTNERS_PREFIXES_VRF ip community-list standard CL_TEST_PEERING_PARTNERS_PREFIXES_VRF permit XXXX:4000 #sh run | section route-map RP_TAG_PEERING_PARTNERS_PREFIXES_VRF route-map RP_TAG_PEERING_PARTNERS_PREFIXES_VRF permit 10 set community XXXX:4000     Thanks in advance for any assistance.         ... View more

Hi,   Have an unusual problem with prefix redistribution using route-map and PL   The supernet prefix for some reason is not being tagged with communities, and so, isnt being redistributed to our RR's - Smaller prefixes within the supernet are being tagged correctly (And redist. to our RRs)   The PL in question is this:   ip prefix-list PL_GvvvvvM_RANGES seq 5 permit 2xx.xxx.xx.0/20 le 32   route-map is:   route-map GccccM_RANGES permit 10 match ip address prefix-list PL_GvvvvvM_RANGES set community xxx:xxx xxx:xxx xxx:xxx   And redist statemements under IPv4: redistribute connected route-map GccccM_RANGES redistribute static route-map GccccM_RANGES   All static routes to next-hops appear to work (Smaller profixes, Im unable to try the supernet as there are active routes contained in the supernet, and also asdsigned to Interfaces) static route to Null0 for the supernet, I get no community tags (Route is visible in BGP though as soon as it is null routed...just no communities) Ive tried adding a larger prefix in the PL (/19 with le 32) - I matches the prefixes, but again, the supernet doesnt get tagges, but smaller prefixes do.   I thought it may have something to do with the supernet being null routed, but I tried null routing a /23 within the supernet, and it was successfully matched, and community tages applied,   A little stumped as to what is causing this - Thanks ... View more

Hi Everyone, We have an AGG port(Standard trunk port) to a carrier on a 4500X - Port has multiple customer vlans for p-t-p eth services. A service they have released will allow us to connect to azure/office 365 via QinQ(Carrier doing QinQ, not us) - i.e. We agree to an outer vlan tag with the carrier, and they create QinQ tunnel to azure/office 365...then multiple inner vlan tags are agreed to between us/azure for various services over this QinQ tunnel. My question is this: With our current setup (i.e. 4500X, standard dot1q trunk), we would just tag the outer vlan for the carrier to use for the QinQ tunnel to azure...this is fine, but for us to be able to "access" the inner vlans, Im hoping we can trunk this outer vlan to an ME3600, and then pop each inner vlan, and use them as needed.....Is this possible? ie will the "inner" tags be maintained going through the 4500X, and if so, if someone could point me in the direction of ME3600 docco that details how to pop the individual inner vlans, it would be greatly appreciated. Eg....Ive tried the following, but Im not 100% if this would be the "correct" way to accomplish our goal (i.e. access the inner tag on the ME3600, and bring it up in a vlan int) A test service was created by carrier, and MS (I cant be 100% certain that the Carrier/MS/Azure section is correct/complete.....they tell me it is :P) Vlans are: 940 (outer) 941 (Inner) Both vlans have been created on the ME, and only vlan 940 on the 4500X that connects to carrier: ME3600 conf interface GigabitEthernet0/24   <- Connects to 4500X service instance 940 ethernet   description description Inner_outer_tag_test_Outer_940_Inner_941   encapsulation dot1q 940 second-dot1q 941   rewrite ingress tag pop 2 symmetric   bridge-domain 941 interface Vlan941  description INNER_OUTER_TAG_TEST  mtu 9100  ip address xxx.xxx.xxx.xxx 255.255.255.252  no ip proxy-arp Im unable to ping remote end, nor am I seeing any dynamic Macs for bridge domain 941 - Is there any additional commands I can run to "see" if we are indeed receiving the Outer and Inner Tags on the ME?  The only MAC I am learning on the 4500X is from the ME3600 #sh mac address-table dynamic vlan 940 Unicast Entries  vlan     mac address     type        protocols               port ---------+---------------+--------+---------------------+-------------------------  940      3462.882a.4640   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1/3    Thanks in advance.     ... View more

Hi,   Earlier this morning, both our C170's stopped accepting incoming connections on 25...Incoming mail has a public listener (port 25), interface is correct (data 2 / External)...any suggestions/ideas what could have caused both to stop accepting connections at the same time?   Thanks ... View more

Hi,   We have a number of eBGP sessions with upstreams (receiving full tables+defaults) on 2 "edge" routers - Our number of PE routers has grown beyond 10, so we have introduced 2 x RR's in one DC, and established vpnv4+vpnv6 peering with them from all our other PE's(So all VRF prefixes are now "learnt/redistributed" via RR's than via the original full mesh). How best do we redistribute the full eBGP tables to the RR's, so we can then re-redistribute to  other PE's as needed (i.e. we may have a new customer at a POP with a PE, that only has default routes(+VPNv4+VPNv6) prefixes + IGP(Backbone link IP's and Router Loop IPs), and they would like to peer with us(Global table), but would like us to advertise the full table to them - I assume via forming iBGP ipv4 peering from RR's to "eBGP" routers, and also iBGP ipv4 neighbourships with all other PE's)...we would then also use the iBGP neighbourships to advertise customer global routes as well?   Is that the "standard/best practice" method?    Any guidance/suggestions are greatly appreciated.   Cheers.     ... View more

Hi Guys, Im learning 2 default routes from upstream providers via eBGP (plus full tables) on one PE, and I want to leak the default route (Plus other prefixes, based on community tags) to a VRF.....just after some guidance on how best to achieve this? route-map/acl/set communit tag? something like: ip access-list standard UPSTREAM_A_GRT_DEFAULT_ROUTE  permit 0.0.0.0 route-map RP_INTRODUCE_DEF_ROUTE_OF_GRT permit 10  match ip address UPSTREAM_A_GRT_DEFAULT_ROUTE  set community 123456:1301 Then create a new route map that matches 123456:1310, and add it under the new vrf as an import map? Cheers ... View more