Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Junaid Shah
Stats
Member since
03-22-2013
56
Posts
29
Helpful
3
Solutions
09-13-2019
06:45 AM
Hi, I have a DMVPN router and i am learning lot of routes from hub but i am blocking some routes sending it to downstream switch which is an L3 switch and there is an EIGRP running between the DMVPN spoke router and the layer 3 core switch. Now there is a requirement to allow some host or /32 routes. So i am blocking 192.168.0.0/16 le 32 but the requirement says that i have to allow 192.168.0.20/32 and let the other routes remain blocked. Below is the current config ip prefix-list SuppressDC-DCLinkOriginatedRoutes seq 110 permit 10.188.0.0/16 le 32 ip prefix-list SuppressDC-DCLinkOriginatedRoutes seq 115 permit 172.29.0.0/16 le 32 ip prefix-list SuppressDC-DCLinkOriginatedRoutes seq 120 permit 192.168.0.0/16 le 32 ip prefix-list SuppressDC-DCLinkOriginatedRoutes seq 145 permit 172.25.128.0/20 ip prefix-list SuppressDC-DCLinkOriginatedRoutes seq 150 permit 172.22.0.0/21 ip prefix-list SuppressDC-DCLinkOriginatedRoutes seq 160 permit 172.23.0.0/16 ip prefix-list SuppressDC-DCLinkOriginatedRoutes seq 170 permit 172.24.0.0/16 route-map IgnoreRoutes deny 12 match ip address prefix-list SuppressDC-DCLinkOriginatedRoutes ! route-map IgnoreRoutes permit 20 I am thinking to add a below entry in prefix list ip prefix-list SuppressDC-DCLinkOriginatedRoutes seq 122 deny 192.168.0.20/32 so wanted to check with you guys if this will work or if there is a better way of doing it. Thanks in advance and i want to keep it simple
... View more
Labels:
12-03-2018
06:19 AM
Hello, Quick and basic question. We will be setting up an ebgp neighborship with one of our vendors. We will be advertising 10.0.0.0/8 and some other class B networks to vendor through this neighborship. Vendor will be advertising 10.169.0.0/20 to us. My question is since that our route advertisement also covers what vendor is advertising , will that cause any issues in routing like a loop or something and if we have to filter that out from advertisement then what are our options like prefix-list with route-maps etc or is there any other way of doing this. Thanks in advance
... View more
Labels:
11-11-2017
01:22 PM
Share the output of " Show DMVPN" from both spoke routers and do you see their status as UP after running that command.
You can try clear dmvpn session peer <Ip address> and see if that helps. Thanks
... View more
11-10-2017
12:38 PM
Hi,
I am responding to an old thread but i came across similar issue and spent couple of days to resolve it so i am updating this thread as it may help someone.
The difference was that my tunnel was not part of VRF. The problem was that line protocol on tunnel interface was down. Phase 1 and Phase 2 were successful. Ipsec encaps and decaps were happening. We ran a debug on tunnel interface and noticed below logs, when we will shut and no shut the tunnel, it will briefly come up and then go down.
So removing keepalives from tunnel interface resolved the issue. We were using 4331 and 2921 routers for setting up tunnels. Thanks
Nov 10 19:02:46.166: FIBtunnel: Tu101: stacking IP 0.0.0.0 to Default:x.x.x.x,route-via: FALSE Nov 10 19:02:54.239: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel101, changed state to down Nov 10 19:02:54.246: FIBtunnel: Tu101: unstacking 0.0.0.0 Nov 10 19:03:02.039: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel101, changed state to up Nov 10 19:03:02.040: FIBtunnel: Tu101: stacking IP 0.0.0.0 to Default:x.x.x.x,route-via: FALSE Nov 10 19:03:04.244: Tunnel101: Tunnel linestate change - current up,evaluated down - keepalive down Nov 10 19:03:04.245: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel101, changed state to down Nov 10 19:03:04.246: Tunnel101: Current Interface MTU: 9976, New Interface MTU: 9950 Nov 10 19:03:04.246: Tunnel101: Current Transport MTU: 1476, New Transport MTU: 1450 Nov 10 19:03:04.251: Tunnel101: GRE/IP (PS) to decaps x.x.x.x->x.x.x.x (tbl=0,"default" len=24 ttl=248) Nov 10 19:03:04.251: FIBtunnel: Tu101: unstacking 0.0.0.0 Nov 10 19:03:04.261: Tunnel101: GRE/IP (PS) to decaps x.x.x.x->x.x.x.x (tbl=0,"default" len=24 ttl=248) Nov 10 19:03:14.246: Tunnel101: Tunnel linestate change - current down,evaluated up Nov 10 19:03:14.247: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel101, changed state to up Nov 10 19:03:14.248: FIBtunnel: Tu101: stacking IP 0.0.0.0 to Default:x.x.x.x,route-via: FALSE Nov 10 19:03:44.247: Tunnel101: Tunnel linestate change - current up,evaluated down - keepalive down Nov 10 19:03:44.247: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel101, changed state to down Nov 10 19:03:44.253: FIBtunnel: Tu101: unstacking 0.0.0.0
... View more
11-07-2017
06:45 AM
we need to block access to some of our end user equipment(modems) when they are late on their payment. -redirect internet traffic of these modems to webpage that let them know invoice is due. restrictions should done by mac address. switch is 3750x
... View more
Labels:
11-06-2017
07:38 AM
I dont think that access switches will require a reload.I have done in this past and they came up fine, just double check them. Thanks
... View more
10-10-2017
03:19 AM
Hi everyone,
I am reaching out to get your opinion on my below config, What i want to achieve is that a spoke having two vrf and two tunnels pointing to two different hubs, two eigrp instances with different AS numbers. Spoke will have two differnet ISP connections, two different LAN interfaces. I want to seggregate traffic. I am using ASR 1000x series router for this purpose. So below is the config and some key points.
DMVPN config is fine as tunnels are already up and working but on different spoke routers and i want to move them to one router so only focus here is VRF config
I have free interfaces on ASR 1000 so i am not going to create trunk and sub interfaces
I can create two VRF's to seperate traffic from each other or I can create one VRF and that will isolate traffic anyway from another ISP and dynamic routing etc ?
I am not adding any VRF config on the hub side and that should be ok ?
ISP interfaces are also not added to VRF and that should be ok ?
Added tunnel interfaces to VRF but not sure about using the command “tunnel vrf “ on the tunnel.
ip vrf RED
ip vrf BLUE
interface GigabitEthernet0/0/1
ip vrf forwarding RED
ip address 10.225.254.8 255.255.255.240
interface GigabitEthernet0/0/2
ip vrf forwarding BLUE
ip address 172.23.0.68 255.255.255.240
ip route vrf RED 0.0.0.0 0.0.0.0 x.x.x.x
ip route vrf BLUE 0.0.0.0 0.0.0.0 x.x.x.x
router eigrp 120
distribute-list prefix LocalRangesToAdvertiseOverDMVPN out Tunnel1
distribute-list route-map IgnoreABCRoutesOriginallyFromXYZ out GigabitEthernet0/0/2
network 172.18.1.0 0.0.0.255
network 172.18.2.0 0.0.0.255
network 172.23.0.64 0.0.0.15
address-family ipv4 vrf BLUE
router eigrp testabc
address-family ipv4 unicast autonomous-system 220
address-family ipv4 vrf RED
af-interface default
passive-interface
exit-af-interface
af-interface Tunnel1
no passive-interface
exit-af-interface
af-interface GigabitEthernet0/0/0
no passive-interface
exit-af-interface
topology base
distribute-list LocalRangesToAdvertiseOverDMVPN out Tunnel2
redistribute static
offset-list MakeThesePreferableThroughSQLTunnel out 10000 Tunnel2
exit-af-topology
network 10.24.136.0 0.0.0.255
eigrp router-id x.x.x.x
exit-address-family
interface Tunnel1
description Data Tunnel
ip vrf forwarding BLUE
bandwidth 1000
ip address x.x.x.x 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication xxxxxxx
ip nhrp map multicast x.x.x.x
ip nhrp map x.x.x.x x.x.x.x
ip nhrp network-id 83
ip nhrp nhs x.x.x.x
ip tcp adjust-mss 1360
delay 500
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 83
tunnel protection ipsec profile CoverTunnels
end
interface Tunnel2
description User tunnel
ip vrf forwarding red
bandwidth 600000
ip address 10.24.137.10 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication xxxxx
ip nhrp network-id 85
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp redirect
ip tcp adjust-mss 1360
keepalive 10 3
tunnel source GigabitEthernet0/0/0
tunnel mode gre multipoint
tunnel key 85
tunnel protection ipsec profile CoverTunnels
hold-queue 4096 in
hold-queue 4096 out
end
... View more
Labels:
10-10-2017
02:16 AM
Hi everyone,
I am reaching out to get your opinion on my below config, What i want to achieve is that a spoke having two vrf and two tunnels pointing to two different hubs, two eigrp instances with different AS numbers. Spoke will have two differnet ISP connections, two different LAN interfaces. I want to seggregate traffic. I am using ASR 1000x series router for this purpose. So below is the config and some key points.
DMVPN config is fine as tunnels are already up and working but on different spoke routers and i want to move them to one router so only focus here is VRF config
I have free interfaces on ASR 1000 so i am not going to create trunk and sub interfaces
I can create two VRF's to seperate traffic from each other or I can create one VRF and that will isolate traffic anyway from another ISP and dynamic routing etc ?
I am not adding any VRF config on the hub side and that should be ok ?
ISP interfaces are also not added to VRF and that should be ok ?
Added tunnel interfaces to VRF but not sure about using the command “tunnel vrf “ on the tunnel.
ip vrf RED
ip vrf BLUE
interface GigabitEthernet0/0/1
ip vrf forwarding RED
ip address 10.225.254.8 255.255.255.240
interface GigabitEthernet0/0/2
ip vrf forwarding BLUE
ip address 172.23.0.68 255.255.255.240
ip route vrf RED 0.0.0.0 0.0.0.0 x.x.x.x
ip route vrf BLUE 0.0.0.0 0.0.0.0 x.x.x.x
router eigrp 120
distribute-list prefix LocalRangesToAdvertiseOverDMVPN out Tunnel1
distribute-list route-map IgnoreABCRoutesOriginallyFromXYZ out GigabitEthernet0/0/2
network 172.18.1.0 0.0.0.255
network 172.18.2.0 0.0.0.255
network 172.23.0.64 0.0.0.15
address-family ipv4 vrf BLUE
router eigrp testabc
address-family ipv4 unicast autonomous-system 220
address-family ipv4 vrf RED
af-interface default
passive-interface
exit-af-interface
af-interface Tunnel1
no passive-interface
exit-af-interface
af-interface GigabitEthernet0/0/0
no passive-interface
exit-af-interface
topology base
distribute-list LocalRangesToAdvertiseOverDMVPN out Tunnel2
redistribute static
offset-list MakeThesePreferableThroughSQLTunnel out 10000 Tunnel2
exit-af-topology
network 10.24.136.0 0.0.0.255
eigrp router-id x.x.x.x
exit-address-family
interface Tunnel1
description Data Tunnel
ip vrf forwarding BLUE
bandwidth 1000
ip address x.x.x.x 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication xxxxxxx
ip nhrp map multicast x.x.x.x
ip nhrp map x.x.x.x x.x.x.x
ip nhrp network-id 83
ip nhrp nhs x.x.x.x
ip tcp adjust-mss 1360
delay 500
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 83
tunnel protection ipsec profile CoverTunnels
end
interface Tunnel2
description User tunnel
ip vrf forwarding red
bandwidth 600000
ip address 10.24.137.10 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication xxxxx
ip nhrp network-id 85
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp redirect
ip tcp adjust-mss 1360
keepalive 10 3
tunnel source GigabitEthernet0/0/0
tunnel mode gre multipoint
tunnel key 85
tunnel protection ipsec profile CoverTunnels
hold-queue 4096 in
hold-queue 4096 out
end
... View more
Labels:
04-26-2017
01:43 AM
Hi,
We have two hubs and two spokes at each site, two hubs are for redundancy
spoke 1 has tunnel 1 and spoke 2 has tunnel 2 and both are connected to both hubs. tunnel 1 has internal apps traffic hosted in hq and tunnel 2 takes branch office ip phones traffic to call manager in hq and phones get registered to call manager through that tunnel. we use offset lists to prefer traffic over one tunnel vs other
real problem is branch side, spokes talk to each other via tunnel 1 and tunnel 2 so site A will talk to Site B via tunnel 1 directly and tunnel 2 will talk to tunnel 2. problem is when tunnel 1 goes down on any side due to an ISP issue so lets say if tunnel 1 is down at site A now site A can talk to site B using tunnel 2 but it goes to hq and then site B and this causes high latency, any chance we can fix that in DMVPN so that tunnel 1 at any spoke side can talk directly to tunnel 2 on another spoke side without going through hub.
If we cannot acvhieve that in DMVPN, is there any other solution to overcome this problem. Thanks
... View more
Labels:
04-26-2017
01:42 AM
Hi,
We have two hubs and two spokes at each site, two hubs are for redundancy
spoke 1 has tunnel 1 and spoke 2 has tunnel 2 and both are connected to both hubs. tunnel 1 has internal apps traffic hosted in hq and tunnel 2 takes branch office ip phones traffic to call manager in hq and phones get registered to call manager through that tunnel. we use offset lists to prefer traffic over one tunnel vs other
real problem is branch side, spokes talk to each other via tunnel 1 and tunnel 2 so site A will talk to Site B via tunnel 1 directly and tunnel 2 will talk to tunnel 2. problem is when tunnel 1 goes down on any side due to an ISP issue so lets say if tunnel 1 is down at site A now site A can talk to site B using tunnel 2 but it goes to hq and then site B and this causes high latency, any chance we can fix that in DMVPN so that tunnel 1 at any spoke side can talk directly to tunnel 2 on another spoke side without going through hub.
If we cannot acvhieve that in DMVPN, is there any other solution to overcome this problem. Thanks
... View more
Labels:
09-13-2019
Hi, I have a DMVPN router and i am learning lot of routes from hub but i
am blocking some routes sen...
12-28-2018
Hello, we have a local username configured on cisco nexus 5k switch with
level 5 password but we do ...
12-03-2018
Hello,Quick and basic question. We will be setting up an ebgp
neighborship with one of our vendors. ...
11-11-2017
Share the output of " Show DMVPN" from both spoke routers and do you see
their status as UP after ru...
11-10-2017
Hi, I am responding to an old thread but i came across similar issue and
spent couple of days to res...
11-07-2017
we need to block access to some of our end user equipment(modems) when
they are late on their paymen...
11-06-2017
I dont think that access switches will require a reload.I have done in
this past and they came up fi...
10-10-2017
Hi everyone, I am reaching out to get your opinion on my below config,
What i want to achieve is tha...
10-10-2017
Hi everyone, I am reaching out to get your opinion on my below config,
What i want to achieve is tha...
Public Statistics
| Date Registered | 03-22-2013 09:13 AM |
| Date Last Visited | 09-19-2019 03:01 AM |
| Total Messages Posted | 56 |
| Total Helpful Votes Received | 29 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 10 | |
| 5 | |
| 4 | |
| 4 |
.jpg "VIP Advisor"){kind=icon}
.jpg "Hall of Fame Community Legend"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 5 |
