I have been looking for a recommended upgraded path all morning when going from 3.3 to 3.6 and haven't been able to find anything.  I have a 3850 stack that is on 3.3.5SE today and I need to take it to 3.6.8E.  Can anyone offer any advise on taking the code straight to 3.6.8E or should I perform some intermediary upgrades first?   ... View more

I was hoping to get some assistance on some strange behavior that I'm seeing. I put the config and show commands at the bottom.  The policy map appears to be matching traffic for transmit, exceed, and violate but it appears to be allowing everything and not dropping the exceed or violate traffic.  Google is usually my friend but in this case I have had little luck and tried many things, mostly specific to the 4500E and not the X.   ip access-list extended match_acl deny ip host 1.1.1.1 192.168.0.0 0.0.255.255 deny ip host 1.1.1.1 172.16.0.0 0.15.255.255 deny ip host 1.1.1.1 10.0.0.0 0.255.255.255 permit ip host 1.1.1.1 any class-map match-any match_acl match access-group name match_acl policy-map Police_Traffic class match_acl police cir 150000000 conform-action transmit exceed-action drop violate-action drop class class-default interface Port-channel77 switchport switchport trunk allowed vlan 2,3,4 switchport mode trunk load-interval 30 service-policy output Police_Traffic Port-channel77 Service-policy output: Police_Traffic Class-map: match_acl (match-any) 1939890225 packets Match: access-group name match_acl 1370047716 packets police: cir 150000000 bps, bc 4687500 bytes, be 4687500 bytes conformed 2565706880607 bytes; actions: transmit exceeded 34762228045 bytes; actions: drop violated 231329471116 bytes; actions: drop conformed 97597000 bps, exceeded 2000 bps, violated 16214000 bps Class-map: class-default (match-any) 24366816045 packets Match: any ... View more

I am stepping through some base hardening on an ISR4451-X and I would like to use Control Plan Protection, however, when I issue the commands the host subinterface is all I get.  There is no cef-exception or transit subinterface.  Additionally, when I do try to apply a policy map to the host subint I don't even get the option to do so.  It is looking for a management interface assignment.  The specs said the hardware support CPPr but are there caveats to when this would even apply?   ROUTER(config)#control-plane host ? <cr> ROUTER(config)#control-plane host ROUTER(config-cp-host)#? Control Plane host configuration commands: exit Exit from control-plane host configuration mode management-interface Configure interface for receiving network management traffic no Negate or set default values of a command   Thank you, Dave ... View more

Short of writing a script from scratch I was hoping to identify an application or program that can help me perform an IP audit of a supernet by looking at the bgp table of a router with full internal routes. In an MPLS network of 20+ PE routers I would like to be able to quickly identify the components subnets of a given supernet and the PE router that it is being originated from. I can look at the output from show ip bgp and get that information but it is not easily sorted.  Essentially what I want is a key value pair.   Destination Subnet:Originating PE  and be able to run that against a supernet.  So if I want to break down 192.168.0.0/16 into its component networks and their destinations I would get output that might look like this. 192.168.1.0/24:172.16.1.5 192.168.2.0/24:172.16.1.5 192.168.100.0/30:172.17.1.1 192.168.100.4/30:172.17.2.1 192.168.200.0/25:172.16.1.5 192.158.200.128/25:172.16.1.10 Before I go spending hours crafting some home grown hack, does anyone know a less time intensive way to get that information?   ... View more

I am migrating some legacy ace customers and am having trouble with a single line of config.  I have found this line in multiple configuration guides on the internet but there is nothing ever said about it.  Going through the cli reference it seems like all that is going to do is add a header called I_AM and insert the string "SSL_INIT".  Is that right?  Is this a common value used by web servers or was this the result of someone coping configuration off the internet without fully understanding what it was they were adding?   Any help would be appreciated.  This is the only header rewrite config that I have yet to figure out.   Thanks! ... View more

We have an issue with a MItel phone system and using DHCP relay on our Cisco WAN routers.  We are using a Windows DHCP server to populate option 125 that the phone uses to get configuration information.   Our old setup uses a Cisco 2811 on 12.4 code and it passes the information fine between the Windows DHCP server at our main location and the remote office LAN by using the ip-helper commands.  The 2901 on the other hand is messing with the reply from the DHCP server.  Debug presents us with this little nugget.  DHCPD: Invalid option 125 information. Dropping DHCP message The 2901 is running 15.1 code.  Does anyone have any idea why the 2901 would be messing with the DHCP messages?  It appears to forward the DHCPDiscover just fine but when the server replies the router thinks it needs to insert itself in there and mess with the reply messages.  Thus the phones do not work. I'm at a bit of a loss.  I found a couple posts on google but they were in German and Google Translate failed to make enough sense of the posts for me to extract any useful information. Thank you in advance! ... View more

I've been reviewing software revisions for the Cisco ASA 5500 family.  We have a few clients running 8.2 and the jump to 8.3 will require significant effort to make sure everything translates properly.  There are no features in 8.3 that these clients require so it seems in their, and our, best interest to let them ride the 8.2 software until an upgrade is necessary to continue receiving security patches.  I have looked for EOL notifications but have not found anything for 8.2.  I have also placed an inquiry with our SE at Cisco, but I thought I would ask if anyone knows anything about how much time 8.2 has before we could expect to see an EOL notification. ... View more