Hi All, I hope you all are doing great. I am facing a problem with MACsec technology, below are the details of my setup: 1- I am using ASR 9010 on one side and ASR9910 on the other side. 2- I am using "A99-12x100GE-CM" and "A9K-8X100GE-L-SE" Line Cards. 3- I am using IOS-XR 6.1.3 on both sides. 4- The HundredGigE interfaces are part of a Bundle-Ether. Below is the configuration I am using on both side: macsec-policy Encrypt conf-offset CONF-OFFSET-30 security-policy should-secure window-size 64 cipher-suite GCM-AES-XPN-256 include-icv-indicator policy-exception lacp-in-clear key-server-priority 10          ! key chain Encrypt  macsec   key 1234abcd5678    key-string password 1543595F507F7D73706267714752405459070B0B0701585440470B0B030604020C5A0955530D01534B5756085F535976141F5B4A5142445C54557878707D65627A cryptographic-algorithm aes-256-cmac    lifetime 10:41:00 may 30 2017 infinite ! interface HundredGigE0/5/0/5  macsec psk-keychain Encrypt policy Encrypt ! I am facing the following problems: 1- I was unable to bring the MACsec session Up. 2- When I removed the configuration from the interface it started to drop packets and I am no longer able to use it, the following counter started to increase " drops for unrecognized upper-level protocol ". Even if I remove all the configuration from the interface and assign it a point-to-point IP address I was not able to Ping the other side. Finally, I have reloaded the Line Cards, and even reloaded the Router and still, the problem persisted. Thank you so much in advance for your kind help and support. Kind regards, Ahmed Muhi ... View more

Hello All, Is the A9K-8X100GE-CM Line Card Supported on RSP440 or RSP880? I could not find anything about it online, below are the Data Sheet for RSP440 and RSP880 and there is no mention of the A9K-8X100GE-CM Line Card. http://www.cisco.com/c/en/us/products/collateral/routers/asr-9000-series-aggregation-services-routers/datasheet-c78-674143.html. http://www.cisco.com/c/en/us/products/collateral/routers/asr-9000-series-aggregation-services-routers/datasheet-c78-733763.html Also I was not able to find the data sheet for A9K-8X100GE-CM, the only thing I found was this: http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r5-3/sysman/configuration/guide/b-sysman-cg-53xasr9k/b-sysman-cg-53xasr9k_chapter_0110.html Thank you so much for your kind help and support. Kind regards, Ahmed Muhi ... View more

Hello All, This is a follow-up discussion to a previous one that I have opened previously, I have an NCS5002 acting as a Satellite, and two ASRs 9006/9910 acting as Hosts using IOS-XR 6.1.2, in an Active/Standby nV Satellite scenario. below are the configs I am using: ASR9910 RP/0/RSP0/CPU0: A99k -Lab#sho run nv Fri Feb 17 07:11:13.199 UTC nv satellite 100 type ncs5002 redundancy host-priority 10 ! serial-number FOC1946R0D2 ! ! RP/0/RSP0/CPU0:A99k-Lab#sho run redundancy Fri Feb 17 07:11:16.826 UTC redundancy iccp group 1 member neighbor 10.0.0.2 ! backbone interface TenGigE0/4/0/35 ! ! ! ! RP/0/RSP0/CPU0:A99k-Lab# ASR9006 RP/0/RSP0/CPU0: ASR9006 -Lab#sho run nv Sat Feb 18 14:05:27.961 UTC nv satellite 100 type ncs5002 redundancy host-priority 20 ! serial-number FOC1946R0D2 ! ! RP/0/RSP0/CPU0:ASR9006-Lab#sho run redundancy Sat Feb 18 14:05:30.338 UTC redundancy iccp group 1 member neighbor 10.0.0.1 ! backbone interface TenGigE0/1/0/29 ! ! ! ! RP/0/RSP0/CPU0:ASR9006-Lab# Now my problem is when I shutdown the ICL between the Active Host "the ASR 9910" and the Satellite, the Standby Host "the ASR 9006" would take over immediately and becomes the Active Host, which is great, still when I no shut the ICL link between the "Old Active Host with the better/Numerically-Lower host priority 10 compared to 20 on the Standby Host" the link goes to this: RP/0/RSP0/CPU0: A99k -Lab#sho int desc | i TO-NCS Fri Feb 17 07:23:28.285 UTC Te0/4/0/0 up down TO-NCS5002-Lab RP/0/RSP0/CPU0:A99k-Lab# and the A99K would not take over even after the delayed switchback timer would expire " Five minutes according to this document I waited ten minutes". Also please check the below output: RP/0/RSP0/CPU0: A99k -Lab#sho nv satellite status Fri Feb 17 07:27:38.063 UTC Satellite 100 ------------- Status: Discovery Stalled; Conflict: no Identification received yet Type: ncs5002 Displayed device name: Sat100 IPv4 address: 10.0.100.1 (auto, VRF: **nVSatellite) Serial Number: FOC1946R0D2 Received candidate fabric ports: nVFabric-TenGigE0/0/78-79 (permanent) nVFabric-HundredGigE0/1/0-3 (permanent) Configured satellite fabric links: TenGigE0/4/0/0 -------------- Status: Discovery Stalled; Conflict: no Identification received yet Remote ports: TenGigE0/0/0-77,79 Rejected remote ports: TenGigE0/0/78 RP/0/RSP0/CPU0:A99k-Lab# RP/0/RSP0/CPU0: A99k -Lab#sho nv satellite redundancy Fri Feb 17 07:27:56.636 UTC Satellite 100: Local Priority : 0x80480a0000ff0000 Satellite not reachable Delaying switchback Configured priority: 10 Remote Priority : 0x0000140000010001 Configured priority: 20 Number of hops: 1 RP/0/RSP0/CPU0:A99k-Lab# RP/0/RSP0/CPU0: ASR9006 -Lab#sho nv satellite status Sat Feb 18 14:21:52.159 UTC Satellite 100 ------------- Status: Connected (Stable) Redundancy: Active (Group: 1) Type: ncs5002 Displayed device name: Sat100 MAC address: c472.95a7.a325 IPv4 address: 10.0.100.1 (auto, VRF: **nVSatellite) Serial Number: FOC1946R0D2 Remote version: Compatible (latest version) IOFPGA: 0.16 MB_MIFPGA: 0.16 DB_MIFPGA: 0.16 BIOS: 1.08 XR: 6.1.2 (Latest) Received candidate fabric ports: nVFabric-TenGigE0/0/78-79 (permanent) nVFabric-HundredGigE0/1/0-3 (permanent) Configured satellite fabric links: TenGigE0/1/0/0 -------------- Status: Satellite Ready Remote ports: TenGigE0/0/0-78 Rejected remote ports: TenGigE0/0/79 RP/0/RSP0/CPU0:ASR9006-Lab# RP/0/RSP0/CPU0: ASR9006 -Lab#sho nv satellite redundancy Sat Feb 18 14:22:13.781 UTC Satellite 100: Local Priority : 0x0000140000010001 Configured priority: 20 Number of hops: 1 Remote Priority : 0x80480a0000ff0000 Satellite not reachable Delaying switchback Configured priority: 10 RP/0/RSP0/CPU0:ASR9006-Lab# The funny thing though is that when I shutdown the ICL link between the ASR9006 "the Active Host with the worse priority" and the Satellite, the ASR9910 would take over immediately. I have played over with the above scenario, shutting down, the ICL link between the Active Host and the Satellite, and each time the Standby Host would always take over no matter what the priority was, still preemption would not work. Thank you so much for your time and kind support. Kind regards, Ahmed Muhi ... View more

Hello All, I have the following scenario, I have an ASR9006 and ASR9910 acting as Hosts, and an NCS5002 acting as Satellite, all devices are running IOS-XR 6.1.2, below is the config I am using and some of the show commands for your kind reference, the problem is the standby Host not taking over when the Active Host fails, I am simulating the failure by physically unplugging the port between the Active Host and the Satellite "the NCS5002"  from the Satellite side. NCS5002 ----------------------------------------------------------------- set sdac system-mode satellite ----------------------------------------------------------------- I am using interfaces Te0/0/0/78 and interface Te0/0/0/79 , I have no configuration on these interfaces aside from the description. ASR9006 ----------------------------------------------------------------- RP/0/RSP0/CPU0:A99k-Lab#sho run int lo10 Wed Feb 15 01:52:56.433 UTC interface Loopback10 ipv4 address 10.0.0.1 255.255.255.255 ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:A99k-Lab#sho run int Te0/4/0/35 Wed Feb 15 01:53:39.352 UTC interface TenGigE0/4/0/35 description ICCP-TO-ASR9006-Lab ipv4 address 4.0.0.1 255.255.255.0 ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:A99k-Lab#sho run router static Wed Feb 15 01:53:04.361 UTC router static address-family ipv4 unicast 10.0.0.2/32 4.0.0.2 ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:A99k-Lab#sho run redundancy Wed Feb 15 01:54:56.957 UTC redundancy iccp group 1 member neighbor 10.0.0.2 ! backbone interface TenGigE0/4/0/35 ! ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:A99k-Lab#sho run nv Wed Feb 15 01:54:52.142 UTC nv satellite 100 type ncs5002 redundancy host-priority 10 ! serial-number FOC1946R0D2 ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:A99k-Lab#sho run interface tenGigE 0/4/0/0 Wed Feb 15 01:55:07.271 UTC interface TenGigE0/4/0/0 description TO-NCS5002-Lab nv satellite-fabric-link satellite 100 redundancy iccp -group 1 ! remote-ports TenGigE 0/0/0-79 ! ! ----------------------------------------------------------------- ASR9910 ----------------------------------------------------------------- RP/0/RSP0/CPU0:ASR9006-Lab#sho run int lo10 Thu Feb 16 08:51:45.669 UTC interface Loopback10 ipv4 address 10.0.0.2 255.255.255.255 ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:ASR9006-Lab#sho run int Te0/1/0/29 Thu Feb 16 08:51:40.249 UTC interface TenGigE0/1/0/29 description ICCP-TO-A99K ipv4 address 4.0.0.2 255.255.255.0 ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:ASR9006-Lab#sho run router static Thu Feb 16 08:52:07.422 UTC router static address-family ipv4 unicast 10.0.0.1/32 4.0.0.1 ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:ASR9006-Lab#sho run redundancy Thu Feb 16 08:52:27.752 UTC redundancy iccp group 1 member neighbor 10.0.0.1 ! backbone interface TenGigE0/1/0/29 ! ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:ASR9006-Lab#sho run nv Thu Feb 16 08:52:40.690 UTC nv satellite 100 type ncs5002 redundancy host-priority 20 ! serial-number FOC1946R0D2 ! ----------------------------------------------------------------- RP/0/RSP0/CPU0:ASR9006-Lab#sho run interface TenGigE 0/1/0/0 Thu Feb 16 08:53:09.081 UTC interface TenGigE0/1/0/0 description TO_NCS5002_Lab nv satellite-fabric-link satellite 100 redundancy iccp -group 1 ! remote-ports TenGigE 0/0/0-79 ! ----------------------------------------------------------------- As for the verification, please find it below,  This is on the A99K the Active Host ----------------------------------------------------------------- RP/0/RSP0/CPU0:A99k-Lab#sho nv satellite status Wed Feb 15 02:01:50.810 UTC Satellite 100 ------------- Status: Connected (Stable) Redundancy: Active (Group: 1) Type: ncs5002 Displayed device name: Sat100 MAC address: c472.95a7.a325 IPv4 address: 10.0.100.1 (auto, VRF: **nVSatellite) Serial Number: FOC1946R0D2 Remote version: Compatible (latest version) IOFPGA: 0.16 MB_MIFPGA: 0.16 DB_MIFPGA: 0.16 BIOS: 1.08 XR: 6.1.2 (Latest) Received candidate fabric ports: nVFabric-TenGigE0/0/78-79 (permanent) nVFabric-HundredGigE0/1/0-3 (permanent) Configured satellite fabric links: TenGigE0/4/0/0 -------------- Status: Satellite Ready Remote ports: TenGigE0/0/0-77,79 Rejected remote ports: TenGigE0/0/78 RP/0/RSP0/CPU0:A99k-Lab# ----------------------------------------------------------------- RP/0/RSP0/CPU0:A99k-Lab#sho iccp group 1 Wed Feb 15 02:03:05.049 UTC Redundancy Group 1 member ip :10.0.0.2 (ASR9006-Lab), up (connected) monitor: route-watch (up) backbone interface Te0/4/0/35: up enabled applications: SatelliteORBIT isolation recovery delay timer: 180 s, not running RP/0/RSP0/CPU0:A99k-Lab# ----------------------------------------------------------------- On the Standby Host the ASR9006, ----------------------------------------------------------------- RP/0/RSP0/CPU0:ASR9006-Lab#sho nv satellite status Thu Feb 16 08:58:19.861 UTC Satellite 100 ------------- Status: Discovery Stalled; Conflict: no Identification received yet Type: ncs5002 IPv4 address: 10.0.100.1 (auto, VRF: **nVSatellite) Serial Number: FOC1946R0D2 Configured satellite fabric links: TenGigE0/1/0/0 -------------- Status: Discovery Stalled; Conflict: no Identification received yet Remote ports: TenGigE0/0/0-79 RP/0/RSP0/CPU0:ASR9006-Lab# RP/0/RSP0/CPU0:ASR9006-Lab# RP/0/RSP0/CPU0:ASR9006-Lab# RP/0/RSP0/CPU0:ASR9006-Lab#sho iccp group 1 Thu Feb 16 08:58:32.091 UTC Redundancy Group 1 member ip :10.0.0.1 (A99k-Lab), up (connected) monitor: route-watch (up) backbone interface Te0/1/0/29: up enabled applications: SatelliteORBIT isolation recovery delay timer: 180 s, not running RP/0/RSP0/CPU0:ASR9006-Lab# ----------------------------------------------------------------- Thank you so much for your help in advance. ... View more