Hi Netpros, We have been doing a POC with one of our healthcare customers who are using radiation imaging using DICOM/PACS standards. We are evaluating benefits of WAAS with respect to this specific application. Expectations from the customer are two-fold: a. Reduce the transfer time of images between application and endhost (radiation device) b. Optimize WAN bandwidth and perform consistently with varying network performance (latency and packet loss) Referring to this Cisco whitepaper on this topic: http://www-v6.cisco.com/c/dam/en/us/td/docs/solutions/Verticals/waasapnotes.pdf POC is conducted with various features turned on in WAAS - 1. TFO only 2. TFO with LZ and LZ 3. TFO with DRE-adaptive Observations are below: 1. TFO only - Could not see any benefit compared to without WAAS turn on 2. TFO and LZ - Could see benefits shown in WAAS CM (18% between original and optimized traffic). But there is no improvement on the transfer time. Also the peak bandwidth remains the same on the WAN 3. TFO, DRE adaptive and LZ - See huge benefits due caching - both on bandwidth savings and transfer time Since customer would not typically re-transmit the same images multiple times in a day, caching is not applicable to customer network. Below are the clarifications and recommendations that we seek after the POC: a. With compression enabled, this would also improve the transfer time of images. We are not seeing it though. Can this be related to compression and decompression time taken by vWAAS which is off-setting the end to end WAN latency (50ms). Or any settings to be enabled to see transfer time improvements? b. For TFO to be effective, do we have to increase the buffer size and window size? c. Any recommendations on the WAAS settings specific to DICOM image transfer? Thanks in advance, Arun ... View more

Hi All, I have a requirement. The devices are configured for centralized TACACS server for AAA. For all users,  authentication, authorization and accounting is done by Cisco ISE. But for one particular user, we would like to make use of local username and password created in devices to authentication and authorize (require priv 15 access) and not be sent to ISE TACACS. What is the procedure of doing it?  thanks in advance, Arun ... View more

Hi All,   Basis on the network diagram attached, I have an issue in achieving the requirement. Please refer the network diagram attachment for understanding. Connectivity between PE to CE is achieved. CE is connected in MSTP based Ethernet ring topology comprised of Three Cisco Catalyst switches. Ethernet ring is connected to two Core nodes - CN1 and CN2. PE is connected to CN3. Two Pseudo-wires are built between CN1 to CN3 and CN2 to CN3. CN1 to CN3 is Active PW and CN2 to CN3 is Standby PW. This is to protect against failure of CN1 router.  The solution works fine end to end when CN1 router fails. But the challenge is when there are multiple fiber cuts in Ethernet Ring. Suppose if Segment 1 and Segment 2 are down, then PW between CN1 to CN3 staill stays UP, but the traffic between PE to CE is dropped though the traffic has to fail-over on Standby PW between CN2 to CN3. I am looking for mechanism to bind "IP SLA" under pseudo-wire configuration in CN1 and CN2. So that in CN1 I can configure IP SLA to check the reachability of SW3, if it is unreachable, Active PW should go down. By this way when Segment 1 and Segment 2 fails, traffic between CE to PE and vice-versa is flowing through Standby PW between CN2 to CN3. Please suggest a solution to this problem.   thanks in advance, Arun     ... View more

Hi All, I am trying to configure CSC MPLS VPN on IOS-XR 4.3.4 on ASR 9K as PE. Currently the configuration is on NPE-G2 and NPE-G1 as PE routers.  LDP is configured between PE and CE for label exchange and OSPF is the protocol between PE and CE. When I try to configure LDP between ASR9K and CPE, I am not getting LDP as the option between PE and CE, I am not getting any option of specifying LDP  under the VRF. Even the IOS-XR MPLS config guide only talks about BGP based label exchange between PE and CE on IOS-XR. I would like to confirm, can LDP be configured under VRF in ASR9K as PE or BGP is the only option available? thanks in advance Arun ... View more

Hi, I think this issue is quite old but I could not get any conclusive explanation. Below is the configuration: C2800-R6-CPE1#sh policy-map parent-out   Policy Map parent-out     Class class-default       Average Rate Traffic Shaping       cir 128000 (bps)       service-policy child-out1 C2800-R6-CPE1#sh policy-map child-out1   Policy Map child-out1     Class EF       priority 50 (%) 1600     Class DATA1       bandwidth 20 (%)     Class DATA2       bandwidth 10 (%)     Class DATA3       bandwidth 10 (%) C2800-R6-CPE1# In the above configuration, parent policy has 128Kbps and Child has 4 Classes with Class EF is LLQ with priority of 50% bandwidth (burst size is default 1600bytes), class DATA1 with 20%, class DATA2 with 10% and class DATA3 with 10%. With the above configuration, I could not able to push beyond 16Kbps of traffic on class EF (LLQ). When the burst size is increased to 16000 bytes, I am able to push around 60Kbps. Wanted to understand this is the expected behavior of LLQ in Nested policy map or I am missing something. thanks in advance ... View more

Hi All, I am trying to establish L2TPv3 VLAN-to-VLAN based pseudowire between Cisco NPE-G2 and ASR 9001 routers but could not bring the pseudowire up and end to end reachability. Below are the configuration: ASR: RP/0/RSP0/CPU0:LAB-ASR1#sh run l2vpn Tue Sep 10 22:50:02.204 UTC l2vpn pw-class test   encapsulation l2tpv3    protocol l2tpv3 class test    ipv4 source 10.10.10.103    transport-mode vlan   ! ! xconnect group l2tpv3   p2p lab1-2    interface GigabitEthernet0/0/0/1.101    neighbor 10.20.0.3 pw-id 100     pw-class test    !   ! ! ! RP/0/RSP0/CPU0:LAB-ASR1#sh run l2tp Tue Sep 10 22:50:10.190 UTC l2tp-class test authentication password 7 095F470F00544541 ! RP/0/RSP0/CPU0:LAB-ASR1#sh run int gi 0/0/0/1.101 Tue Sep 10 22:50:18.071 UTC interface GigabitEthernet0/0/0/1.101 l2transport encapsulation dot1q 101 ! NPE-G2: l2tp-class test authentication password 7 071C284A57584B56 ! pseudowire-class test encapsulation l2tpv3 protocol l2tpv3 test ip local interface Loopback0 CE1-NPEG2#sh run int gi 0/3.101 Building configuration... Current configuration : 106 bytes ! interface GigabitEthernet0/3.101 encapsulation dot1Q 101 xconnect 10.10.10.103 100 pw-class test end CE1-NPEG2# Have anyone tried L2TPv3 between IOS and ASR 9001 and working? thanks in advance Arun ... View more

Hi All, We are planning to gather traffic matrix in our network. Our network comprises of Cisco devices (NPE-G1, NPE-G2, GSR, CRS, 7600, ISR-G1/2). Currently there is no traffic matrix calculation per service/COS that has been done in our network for capacity planning. We would like to start an exercise of gathering traffic matrix to account for POP to POP, PE to PE traffic for better visibility into our network. Have gone through a NANOG presentation which explains about traffic matrix calculation " http://www.nanog.org/meetings/nanog35/presentations/telkamp.pdf ". I tried doing MPLS traffic counters but that is not giving the correct value. BGP Policy Accounting is another option but I dont think it will work for MPLS VPN customers as majority of our traffic is through MPLS VPN. Our network do not have point to point TE tunnels built between POP to POP to gather this  information. I am exploring the option of "MPLS Aware Netflow" in "P" routers to gather this information. I would like to hear from others who have done such kind of traffic matrix in their network along with its pros and cons  in the interim which would help me in effectively working out? thanks in advance Arun ... View more

Hi All, We are planning to gather traffic matrix in our network. Our network comprises of Cisco devices (NPE-G1, NPE-G2, GSR, CRS, 7600, ISR-G1/2). Currently there is no traffic matrix calculation per service/COS that has been done in our network for capacity planning. We would like to start an exercise of gathering traffic matrix to account for POP to POP, PE to PE traffic for better visibility into our network. Have gone through a NANOG presentation which explains about traffic matrix calculation "http://www.nanog.org/meetings/nanog35/presentations/telkamp.pdf". I tried doing MPLS traffic counters but that is not giving the correct value. BGP Policy Accounting is another option but I dont think it will work for MPLS VPN customers as majority of our traffic is through MPLS VPN. Our network do not have point to point TE tunnels built between POP to POP to gather this  information. I am exploring the option of "MPLS Aware Netflow" in "P" routers to gather this information. I would like to hear from others who have done such kind of traffic matrix in their network along with its pros and cons  in the interim which would help me in effectively working out? thanks in advance Arun ... View more

Hi, We are in the process of building traffic matrix in our network to analyze and use for our forecasting the network growth. I am planning to make use of LDP traffic statistics counters to determine traffic flow between PE routers i.e. per LSP. Only LDP is used for LSP formation not RSVP-TE. I am making use of the CLI "show mpls forwarding-table <prefix>" which lists the "Bytes tag switched" but the counters are not increasing. C7206-NPE-G2#sh mpls for a.b.c.d Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop tag    tag or VC   or Tunnel Id      switched   interface 719    16697       a.b.c.d/32   0          Gi0/2      x.x.x.x I tried by doing a ping from the local router to the destination and traffic is flowing through the LSP. Even tried pining a L3 MPLS VPN customer connected between source and destination routers, but still the counters are not increasing. Platform and IOS version in use are: 7206 NPE-G2 and c7200p-spservicesk9-mz.124-15.T12.bin. I would like to know 1. whether use of "LDP traffic statistics" work for my requirement. 2. any known issues in IOS with the above command i.e. could this be related to software defect thanks in advance Arun ... View more

Hi All, I am facing a strange issue in one of our customer setup. I would like to know how the correct SA for outbound traffic is chosen? Setup: ASR is configured as IPSEC VPN concentrator aggregating around 1000+ spokes as "Dynamic Crypto" with RRI enabled and only two spokes are confiugred as "Static Crypto". One particular dynamic crypto includes LAN supernet of /8 and two Static crypto ACL entry includes a supernet prefix of  /16 and remaining spokes are configured with /24. The reason that has supernet LAN entry for this particular spokes is to have a simple configuration of ACL for 2 static crypto peers and to match less specific LAN for 1 dynamic crypto peer. With RRI, ASR installs LAN routes of spokes as /24 pointing towards the correct spoke. Only for the particular dynamic crypto peer, ASR installs supernet of /8 and two static crypto with /16. All of a sudden, certain spokes lose reachability with no traffic flowing throgh it and comes back  once we clear the SA for the particular spoke. Questions: ========= I would like to know the internal order of operations in processing IPSEC traffic in ASR router. Raised TAC with Cisco and got the below update: My assumption was the router selects the correct SA based on the routing table lookup. That is to send traffic to spoke, ASR has a routing entry for the LAN and chooses the correct remote peer IP. But came know from TAC that routing table lookup is only to decide on which interface the traffic should forward, and there is something else called "SA table" wherein the order of processing happens from top to bottom with matching remote LAN and not based on the longest routing table lookup. "SA table" is required to select the remote crypto peer IP and the way "SA table" gets populated is based on who intiates IPSEC session with more recent one being on the top. So in our scenario, if the crypto peers with supernet LAN (/8 or /16) initiate traffic after all the spokes are formed, then obviously the new SA of supernet LAN is on the top of SA table and all return traffic of spokes (/24 LAN's) will get matched wrongly on this SA and gets dropped. The workaround is to have a specific LAN (/24) as interesting traffic for the particular crypto peer IP. 1. Would like to confirm the above operations is normal and any document to corroborate this as I could not find any such. 2. Is there anyway to have SA for particular crypto peers to be on the bottom of SA table so that I can have shortest match LAN prefix (/8 or /16) on the bottom of SA table? 3. How to check the SA table in ASR router? thanks in advance Arun ... View more

Hi All, In our network there are around 4000 site routers connected to HO, DC and DR through IPSEC. For the ease of manageability and scalability, we are using "Digital Certificate" based device authentication. Currently "Verisign CA certificate" is hosted in centralized server and all Cisco routers are configured to enroll CA from the centralized server. We are planning to migrate the CA certificate from "Verisign" to "Odyssey". We are in the process of getting Odyssey Certificate and installing in server to test. But in the mean time would like to confirm. 1. Cisco IOS router compatibility with Odyssey CA will work? 2. Did anybody try and find any issues with Odyssey? Thanks in advance, Arun ... View more

Hi, I have a NPEG2 router running 12.4 (15) T12. There is a channelized E1 card (PA-MC-8TE1) inserted into the router. One port is configured for channelized time slots and remaining interfaces are configured for full line rate i.e. 2Mbps. While doing "sh snmp mib ifmib ifindex ser 2/6:0" for any interface under that particular PA card, I m getting the below "invalid ifindex" output. cisco#sh snmp mib ifmib ifindex ser2/6:0 Invalid ifIndex for Serial2/6:0 cisco#sh snmp mib ifmib ifindex | i 2/6 Serial2/6:0: Ifindex = 32 E1 2/6: Ifindex = 24 But while I do the "show snmp mib ifmib ifindex", I am getting list of all interfaces with indexes with the problematic PA card. But when I query using that ifindex (32 in this case), I am getting the same error "invalid ifindex". Could this be a known bug in the router? As far I have searched bug tool kit I could not find any bugs related to this. But there is another PA-MC-8TE1 in another slot which is working fine without any issues. Any help appreciated. thanks in advance Arun ... View more