Hi, Yes, you can have VPN tunnel on both 877 up to utilize 2 DSL lines. You might need make the traffic symmetrical if there is any stateful device in between. HTH, Lei Tian ... View more

Hi, Assume you want the 2x877 be active/stanby, that is supported. On the LAN side, your L2/L3 and subinterface (if you have multiple VLAN) are on 877. You can config the FHRP (HSRP, VRRP) on 877. On the internet side, both 877 will have same vpn tunnel back to remote office, but only one is active. If you want both 877 be active, then you might need PBR to send the traffic based on the traffic type. On the LAN side, your L2/L3 is on 3560. PBR on the 3560 decides either send to 877_1 or 877_2 based on traffic type. On the internet side, different vpn tunnel back to remote office, both are active. On the remote office, PBR is configured to route traffic based on traffic type. HTH, Lei Tian ... View more

Hi, You can have HSRP between datacenters. You can have multiple HSRP speaker, one of them will be active. If you need HSRP be active in each datacenter, you can check HSRP localization. Basically, you need filter hsrp hello and some arp packets. HTH, Lei Tian ... View more

Hi, I know this is not what you are asking for, but can you do tunnel instead of VL? Both should be able to solve the problem, but VL has limitation on the area type, and the transit router will receive all the LSA. I like tunnel better, is easier to understand, and tshoot. Just build a tunnel between Cisco01 and Cisco12, put the tunnel in area 0. HTH, Lei Tian ... View more

6500 should process ACL in hardware. You need to check the reason that causes 6500 punt the packet to CPU. Check your TCAM utilization, and make sure there is no log keyword for the ACL. HTH, Lei Tian ... View more

Assume the bridge is layer 2, you will have 2 OSPF neighbors between global and VRF. To prefer the routes from OSPF via bridge, you can just Increase the OSPF cost for the interface of direct link. HTH, Lei Tian ... View more

Hi, The default behavior for nexus 7000 is trust DSCP. " The default behavior of the device is to preserve the DSCP value, or to trust DSCP" http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_2/nx-os/qos/configuration/guide/marking.html HTH, Lei Tian ... View more

Hi, You can have internet and vpn on same router, but is better to have separate router for that function. If you have budget, it would be ideal to have separate internet circuit for partner and normal internet traffic. The idea is to reduce the level of impact when there is any failure, and make it easy to troubleshoot. The config should be normal, based on the process order of operation, the router will process VPN traffic first if it matches the ACL for encryption. The unmatch packets will be routed/natted normally. Do you have more specific question regarding the config? HTH, Lei Tian ... View more

Hi, You want put all internal VLANs in global routing table, and routes from ISP in a VRF? It is possible. You need physical cables to connect interface in VRF to interface in global table. Dont't have a configure example, but it should look like the following. ip vrf UNTRUST rd 1:1 interface x/x description ISP1 ip vrf forward UNTRUST ip add x.x.x.x interface y/y description ISP2 ip vrf forward UNTRUST ip add x.x.x.x interface x/x description to inside 1 ip vrf forward UNTRUST ip add x.x.x.x interface x/x description to inside 2 ip vrf forward UNTRUST ip add x.x.x.x router bgp x address-family ipv4 vrf UNTRUST nei x.x.x.x remote-as # nei x.x.x.x remote-as # network x.x.x.x router ospf 1 vrf UNTRUST net x.x.x.x area 0 redistribute bgp x route-map BGP-TO-OSPF default-information orginate ---------------------------- in global table int x/x description to VRF UNTRUST ip add x.x.x.x int x/y description to VRF UNTRUST ip add x.x.x.x router ospf 1 passive-interface default no pass x/x no pass x/y network x.x.x.x area 0 You also need to make sure your sup32 has enough TCAM for the routes. HTH, Lei Tian ... View more

Hi Jack, You can create bridge domain on ASR, but not VLAN. Similar to what you bridge interfaces on other router platform. What are you trying to achieve? HTH, Lei Tian ... View more

Hi, You can block the multicast traffic on the data plane by using port or vlan ACL. HTH, Lei Tian ... View more

Hi, I dont have much experience with the new games. My experience for LAN game was playing age of empire and counter strike. My experience for network requirement of LAN game is low, typical campus design is good enough. For access layer switch, new model of 2960 or 3750, depends on the features that you need. The layer 2, layer 3 boundary is on distribution layer, if you have rack space, use 4500 modular chassis with sup7e or sup8. That switch can give you enough port counts for future growth. If you dont have the rack space, 4948M or 4500X is good option, but you may need consider add another layer for future growth. For internet connection, depends on the features and bandwidth requirement, you can consider ISR G2 or ASR1K. HTH, Lei Tian ... View more

Hi Andy, Cisco has announced end of life for SNAT couple years ago, so ASR 1k doesnt support this feature.  http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6640/end_of_life_notice_c51-611706.html In the newer IOS XE release, you can do inter-chassis redundancy NAT. It supports NAT with asymmetric routing and high availability. http://www.cisco.com/en/US/docs/ios-xml/ios/ipaddr_nat/configuration/xe-3s/asr1000/iadnat-stateful-int-chass.html#GUID-2843F42B-AF96-483A-A10D-7D41F6C977ED HTH, Lei Tian ... View more

Hi, My understanding is this platform has RP and SP, which calculates the CEF load balancing independently. To avoid polarization, the hardware cef uses universal ID in additional to the source and destination IP to calculate the CEF load balancing; I think the universal ID is not considered when calculating cef load balancing in software. HTH, Lei Tian ... View more