Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About perrymcgrew
Stats
Member since
05-15-2009
91
Posts
0
Helpful
1
Solution
05-02-2018
05:50 PM
Thanks for the replies. QoS configuration is definitely a dark science!
My MPLS subscribed network bandwidth is 900Mbs. I have many termite sites at various bandwidths feeding into our MPLS cloud.
We use GRE tunnels anchored to loopbacks through the MPLS to our corporate data center and our D/R site. The D/R site routes are weighted to be less preferred.
I talked to TAC and he *thinks* the policy needs to be applied to GRE rather than the physical Gig I/F... but not sure :-/. Also believes the pre-classify is needed to ensure priority markings are placed in to GRE header before its encrypted.
The “last mile” to this site is provided by Spectrum fiber. It is a 50Mbs link and our network monitor has confirmed the site reaches it. I was told the network honors QoS / priority, but I will address that after I have a policy applied that consensus here agrees is correct. I am looking for help getting correct policy so voice is protected when the users at the site bury the link with their large file copies etc.
... View more
- Tags:
- Gre qos
05-02-2018
05:49 PM
Thanks for the replies. QoS configuration is definitely a dark science!
My MPLS subscribed network bandwidth is 900Mbs. I have many termite sites at various bandwidths feeding into our MPLS cloud.
We use GRE tunnels anchored to loopbacks through the MPLS to our corporate data center and our D/R site. The D/R site routes are weighted to be less preferred.
I talked to TAC and he *thinks* the policy needs to be applied to GRE rather than the physical Gig I/F... but not sure :-/. Also believes the pre-classify is needed to ensure priority markings are placed in to GRE header before its encrypted.
The “last mile” to this site is provided by Spectrum fiber. It is a 50Mbs link and our network monitor has confirmed the site reaches it. I was told the network honors QoS / priority, but I will address that after I have a policy applied that consensus here agrees is correct. I am looking for help getting correct policy so voice is protected when the users at the site bury the link with their large file copies etc.
... View more
05-01-2018
12:40 PM
Trying to wrap my head around proper config to ensure VoIP service when link becomes saturated.
My WAN sites connect using GRE tunnels anchored to Loopbacks thru MPLS cloud. In this example, I have a site whose bandwidth is 50 Mbs.
The site has 2 3560G switches running 12.2(44)SE5 (soon to be replaced by 3650). Phones are mix of SIP and SCCP.
Access ports are all defined like this:
!
interface GigabitEthernet0/xx switchport mode access switchport voice vlan xxx mls qos trust device cisco-phone mls qos trust cos spanning-tree portfast
Trunk Port between 3560G switch and ISR4331 router is:
!
interface GigabitEthernet0/xx description TRUNK to ISR4331 Gi0/0/0 switchport trunk encapsulation dot1q switchport mode trunk mls qos trust dscp
3560G-SW#show mls qos int g0/xx stati GigabitEthernet0/xx (All statistics are in packets)
dscp: incoming -------------------------------
0 - 4 : 1733946501 5779 7584 52 25 5 - 9 : 307 53202 0 1565 58 10 - 14 : 11073809 0 2 0 0 15 - 19 : 0 3642 1 10124907 459 20 - 24 : 2516 152 599 0 185297 25 - 29 : 3502 933215 0 31912 25 30 - 34 : 199705 411 564458 14 129597 35 - 39 : 62 9 19 107504 1 40 - 44 : 31739470 44 243 30 65 45 - 49 : 0 57647809 0 23805805 762 50 - 54 : 105 0 0 0 30 55 - 59 : 0 196 0 0 0 60 - 64 : 0 0 0 0 dscp: outgoing -------------------------------
0 - 4 : 3134147655 0 0 0 0 5 - 9 : 0 0 0 0 0 10 - 14 : 0 0 0 0 0 15 - 19 : 0 0 0 0 0 20 - 24 : 0 0 0 0 54024192 25 - 29 : 0 0 0 0 0 30 - 34 : 0 0 0 0 0 35 - 39 : 0 0 0 0 0 40 - 44 : 0 0 0 0 0 45 - 49 : 0 373600851 0 1348947 0 50 - 54 : 0 0 0 0 0 55 - 59 : 0 0 0 0 0 60 - 64 : 0 0 0 0 cos: incoming -------------------------------
0 - 4 : 1883503606 0 0 0 0 5 - 7 : 0 0 0 cos: outgoing -------------------------------
0 - 4 : 3145237140 0 0 54025057 0 5 - 7 : 373600886 1348947 1196 output queues enqueued: queue: threshold1 threshold2 threshold3 ----------------------------------------------- queue 0: 362683164 0 10917361 queue 1: 3034809757 18936560 48678759 queue 2: 52080131 0 0 queue 3: 8763406 134 96439164
output queues dropped: queue: threshold1 threshold2 threshold3 ----------------------------------------------- queue 0: 0 0 0 queue 1: 0 0 0 queue 2: 0 0 0 queue 3: 0 0 0
Policer: Inprofile: 0 OutofProfile: 0
The site router is a 4331 running IOS XE 16.06.03
All traffic has to go thru GRE to reach data center and internet at Corp HQ. The remote site GREs all terminate on a 4451X in the data center.
I get occasional complaints from this site that "phones drop". When I look at the Network Monitor I often see the bandwidth at or very near the 50 Mbs. NetFlow v9 IDs a couple of bandwidth hogs -- usually copying a huge 12 gig file to a network drive etc.!
So I started looking into what I could do and realize that I should probably setup some sort of class & policy Maps on the 4331 to preserve bandwidth. I think that the policy-map needs to go on the GRE TU rather than the physical Gig interface that is the service provider connection -- since all the traffic goes through the GRE. I am looking for suggestions / comments on the following:
class-map match-any VOICE match ip dscp 46 class-map match-any SIGNALLING match ip dscp af31 ! policy-map VOICE-POLICY class VOICE
!!! Maximum bandwidth VOICE class can use !!! priority percent 10 class SIGNALLING
!!! Minimum bandwidth SIGNALLING can use of remaining !!!! bandwidth remaining percent 5
!
policy-map SHAPER class class-default
!!! LINK BANDWIDTH INTO MPLS !!! shape average 50m service-policy VOICE-POLICY
!!! APPLY POLICY OUTBOUND ON GRE !!!
Interface tunnel0 service-policy output SHAPER
!!! PLACES QOS MARKINGS IN GRE HEADER !!! qos pre-classify
TIA - Perry
... View more
- Tags:
- gre
- policy-map
- qos
- voip
Labels:
04-25-2018
11:57 AM
after getting really deep in the vrf / bgp leaking, went back to the ACL on the SVI. May not be the most efficient method, but is sure easier to implement.
Thx to everyone who offered comments....
... View more
03-14-2018
06:11 AM
I was led to believe this was best way to accomplish the goal - not create hugely complicated ACLs on the 4500X. I also was looking at VACLs as well. But I may need to revisit this as it seems that the VRF is not going to work...and time is growing short.
... View more
03-14-2018
04:57 AM
Thanks. This has gotten me a little farther. The Firewall interface is a VLAN SVI (VLAN 90) but the commands you listed on the Fastethernet worked. The test PC on the "trcu" subnet can now reach the internet.... However, it can also access the other internal corporate VLANs defined in the 4500X. The goal of this setup is to completely isolate the trcu (VLAN 30) and telemed (VLAN 32) from the rest of the corporate VLANs - only allow them to talk to each other and the Internet which was the purpose of trying this VRF and BGP setup. The firewall has static routes for all the corporate subnets that point back to its VLAN SVI (192.168.90.254) to enable the return traffic from the internet / DMZ. So pinging my PC from the test PC - the default route in the VRF is sending pings of other corporate VLANs to the Firewall's LAN interface (192.168.90.253) who then routes it back to the 4500X and is able to reach any of the corporate networks. interface Vlan90 description Firewall Routed Segment ip vrf select source ip vrf receive trcu ip address 192.168.90.254 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip route 0.0.0.0 0.0.0.0 192.168.90.253 name Default_Route_to_Firewall ip route 10.30.0.0 255.255.255.0 Vlan30 name TRCU ip route vrf trcu 0.0.0.0 0.0.0.0 192.168.90.253 global name Default_Route_to_Firewall 4500X#sh ip route vrf trcu Routing Table: trcu Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + - replicated route, % - next hop override Gateway of last resort is 192.168.90.253 to network 0.0.0.0 S* 0.0.0.0/0 [1/0] via 192.168.90.253 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks C 10.30.0.0/24 is directly connected, Vlan30 L 10.30.0.254/32 is directly connected, Vlan30 B 10.30.2.0/24 is directly connected (telemed), 4d16h, Vlan32 L 10.30.2.254/32 is directly connected, Vlan32 192.168.90.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.90.0/24 is directly connected, Vlan90 L 192.168.90.254/32 is directly connected, Vlan90 So right now, there is no difference than if I set the trcu / telemed VLANs up normally and added them into the OSPF routing used for the corporate VLANs....maybe there is a better way than VRF / BGP?
... View more
03-13-2018
01:19 PM
I have not tested routing between the 2 VRFs. The "trcu" VRF is most critical as the subnet needs to be shared between wired and wireless clients that are connected thru 5508 WLC. Wireless clients are not pulling IPs from DHCP, but I'll tackle that later.....
I have a wired PC connected to switchport in VLAN 30. It pulls 10.30.0.1 from the DHCP and I see the google DNS 8.8.8.8 and 4.4.4.4 assigned to the client along with the gateway 10.30.0.254 (IP addr of VLAN 30 SVI). But I can not access anything on the internet. Traceroute from the PC "dies" on the VLAN SVI 10.30.0.254.
On the 4500X, I can ping the PC....
4500X#ping vrf trcu 10.30.0.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.30.0.1, timeout is 2 seconds: !!!!!
On the Firewall devices, I have static routes that point 10.30.0.0/24 to the SVI of the VLAN that has the Firewall LAN interfaces. I can NOT ping the SVI of the VRF from the firewall.
This is my Global default gateway on the 4500X:
ip route 0.0.0.0 0.0.0.0 192.168.90.253
From what I've read, this is supposed to inject the global default route into the VRF:
ip route vrf trcu 0.0.0.0 0.0.0.0 192.168.90.253 global
The .253 IP is the Firewall's interface.....
... View more
03-13-2018
10:06 AM
Hi,
I have 4500X-32 in VSS running 3.6.0E that serves as the core LAN L3 Switch. I am trying to create 2 subnets that are isolated from the rest of the VLANs -- they only need to talk to each other and get out to the Internet through the 4500X's default route through the Firewall.
I have read this post and I believe I am close...
https://supportforums.cisco.com/t5/lan-switching-and-routing/route-leaking-vrf-to-global/m-p/3062753
I just can't seem to get it to work completely. Traceroutes on the client die on the VRF's VLAN SVI. The firewall has Static routes to send the return traffic of the VRF subnets to the SVI of its VLAN.
I am testing on the "trcu" VRF...
! ip vrf telemed rd 100:32 route-target export 100:32 route-target import 100:30 ! ip vrf trcu rd 100:30 route-target export 100:30 route-target import 100:32
!
ip dhcp pool WLAN_TRCU vrf trcu network 10.30.0.0 255.255.255.0 dns-server 8.8.8.8 4.4.4.4 default-router 10.30.0.254 ! ip dhcp pool WLAN_telemed vrf telemed network 10.30.2.0 255.255.255.0 dns-server 8.8.8.8 4.4.4.4 default-router 10.30.2.254 !
! interface Vlan30 description TRCU Subnet ip vrf forwarding trcu ip address 10.30.0.254 255.255.255.0 ! interface Vlan32 description telemed WLAN Subnet ip vrf forwarding telemed ip address 10.30.2.254 255.255.255.0 ! router bgp 100 bgp log-neighbor-changes no bgp default ipv4-unicast ! address-family ipv4 vrf telemed redistribute connected exit-address-family ! address-family ipv4 vrf trcu redistribute connected exit-address-family ! ip forward-protocol nd no ip http server ip http authentication local ip http secure-server ! ip route 0.0.0.0 0.0.0.0 192.168.90.253 name Default_Route_to_Firewall ip route vrf trcu 0.0.0.0 0.0.0.0 192.168.90.253 global name Default_Route_to_Firewall
ip route vrf telemed 0.0.0.0 0.0.0.0 192.168.90.253 global name Default_Route_to_Firewall
4500X# sh bgp vrf trcu BGP table version is 5, local router ID is 192.168.254.254 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 100:30 (default for vrf trcu) *> 10.30.0.0/24 0.0.0.0 0 32768 ? *> 10.30.2.0/24 0.0.0.0 0 32768 ?
4500X#sh ip route vrf trcu
Routing Table: trcu Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + - replicated route, % - next hop override
Gateway of last resort is 192.168.90.253 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 192.168.90.253 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks C 10.30.0.0/24 is directly connected, Vlan30 L 10.30.0.254/32 is directly connected, Vlan30 B 10.30.2.0/24 is directly connected (telemed), 3d21h, Vlan32 L 10.30.2.254/32 is directly connected, Vlan32
What is missing????
TIA - Perry
... View more
Labels:
Created by
perrymcgrew
in Network Access Control
in Network Access Control
04-11-2017
06:18 AM
04-11-2017
06:18 AM
I have set up login authentication using AAA and NPS / AD. Fallback is local username and PW. I am trying to see if there is a way differentiate access across the devices.
I want to allow our VAR support team access to the Voice Gateways as they often perform debugging and setup configs to our Cisco Call Manager. But I do not want them to have access into our internal edge switches as they have no need to be in those devices.
The problem is that RADIUS grants authenticated users in the specific OU level 15 access. So this would mean that their ID would be able to access any of our Cisco devices. If I change the Level to 7 or 1, it means I would have to customize the commands on the routers to be accessible at that privilege level... or I would have to tell them the device's "enable" password.
My other option would be to create a unique enable password on just the Routers.
We don't have or plans to bring in ISE or TACAS so I was just looking to see if anyone has an option that I am not considering.
TIA Perry
... View more
Labels:
06-01-2016
09:43 AM
Hi Nico,
Our EXP-E cert is issued from DigiCert. The root is already in the trusted CA store on EXP-E and states its valid.
O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
Matches Issuer
Regards,
Perry
... View more
05-31-2016
07:05 AM
Still no go. Reset the Network on the phone in my office. It registered fine inside the network. Took it home. Spun and bounced between Not Registered and Registered a couple of times (seen this before too) before settling on Not Registered.
Reset the Network settings while phone on my home network -- no change.
... View more
I have the 7841 back in my
in Other Collaboration Subjects
05-27-2016
11:30 AM
05-27-2016
11:30 AM
I have the 7841 back in my office. I have already reset the Network Settings this morning (per that article) and will be taking it back home to test.
... View more
No. The TFTP server / CUCM
in Other Collaboration Subjects
05-27-2016
10:41 AM
05-27-2016
10:41 AM
No. The TFTP server / CUCM Pub/Sub nodes are not accessible directly from Internet. I have gone over Expressway config docs and then was using this link as a guideline:
https://ciscocollab.wordpress.com/2015/05/26/collab-edge-mra-for-78008800dx-series-endpoints/
... View more
08-28-2015
07:39 AM
I am running CUC 11 and this "bug" is still there. I have PCs running Windows 10 (RTM) and Win 7. WE have many corporate apps that use Java -- and require current versions (Java v8). It is a big PITA to have to uninstall Java versions to install Java v7 Update 75 which is the supported version for CUC 11.0. On both my PCs I tried Chrome, Firefox and IE w/o success -- still got the "Failed to Record Name" when I tried to save a greeting. I saw in a Cisco blog a different workaround... change Media Master to PLAY through Phone, I entered my extension. You open the Wav file and it rang my phone. I picked up the phone and let the recording play to completion. Back in Media Master, I hit SAVE and it worked -- no pop-up error window etc. I did NOT back level my Java.... I am not a Java programmer, but it seems that this Java issue is long standing problem that bridges across multiple Unity Connection versions. Does not seem that odd that Cisco would tie a major application to a programming environment that is frequently issuing updates which would "break" a feature needed to modify the Cisco app. Does not appear that Cisco development is in a hurry to convert off of Java
... View more
Created by
perrymcgrew
in Collaboration Applications
06-11-2018
06-11-2018
Yes. TAC has a v12 build that fixes that bug. I presume it will be in
the next update … they did not...
Created by
perrymcgrew
in Collaboration Applications
05-29-2018
05-29-2018
Its a confirmed bug - CSCvg46005. I got a friendly beta build 12.0.1
Build 1 which has the fix and s...
Created by
perrymcgrew
in Collaboration Applications
05-17-2018
05-17-2018
Thanks. But I don't want to disable as we have different remote sites
and I use Jabber to reflect wh...
Created by
perrymcgrew
in Collaboration Applications
05-16-2018
05-16-2018
This really more of an annoyance.... but every time I launch Jabber at
work, I get the New Location ...
05-02-2018
Thanks for the replies. QoS configuration is definitely a dark science!
My MPLS subscribed network b...
05-02-2018
Thanks for the replies. QoS configuration is definitely a dark science!
My MPLS subscribed network b...
05-01-2018
Trying to wrap my head around proper config to ensure VoIP service when
link becomes saturated. My W...
Created by
perrymcgrew
in Collaboration Applications
04-25-2018
04-25-2018
"networkalerts" note caused me to investigate our SCCM. I installed J4W
v12 outside of SCCM. But SCC...
04-25-2018
after getting really deep in the vrf / bgp leaking, went back to the ACL
on the SVI. May not be the ...
Created by
perrymcgrew
in Collaboration Applications
04-10-2018
04-10-2018
We are trying out Jabber version 12 here in the IT Dept. We are on CUCM
11.5(1)SU4. Jabber v12 Clien...
03-14-2018
I was led to believe this was best way to accomplish the goal - not
create hugely complicated ACLs o...
03-14-2018
Thanks. This has gotten me a little farther. The Firewall interface is a
VLAN SVI (VLAN 90) but the ...
03-13-2018
I have not tested routing between the 2 VRFs. The "trcu" VRF is most
critical as the subnet needs to...
03-13-2018
Hi, I have 4500X-32 in VSS running 3.6.0E that serves as the core LAN L3
Switch. I am trying to crea...
Created by
perrymcgrew
in Network Access Control
04-11-2017
04-11-2017
I have set up login authentication using AAA and NPS / AD. Fallback is
local username and PW. I am t...
Public Statistics
| Date Registered | 05-15-2009 05:27 PM |
| Date Last Visited | 04-08-2020 12:57 AM |
| Total Messages Posted | 91 |
.jpg "VIP Expert"){kind=icon}
