Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About rtjensen4
Stats
Member since
08-17-2007
413
Posts
92
Helpful
15
Solutions
10-03-2016
06:41 AM
Hi All! Hoping some experts can assist me here.
I have a new MPLS network going in and we're implementing DMVPN over it. we run BGP with the PE to learn all the /30 WAN routes from the MPLS network. EIGRP across the DMVPN
We're using Front-door VRF and rsa signatures over ikev2 for the DMVPN config. This is a dual-hub setup. I have a total of 28 branches connecting back to the hubs via the MPLS
Hubs are both 3945E running 15.4(1). Spokes are all 2911 running 15.2(4)M3 OR 15.5(3)M7
Config is pretty straight forward, however, there's a catch. Everything will be working fine then a branch will just drop. The EIGRP peerings will drop and not re-establish. The branch router sees the EIGRP neighbor of the hub, however the peerings never fully come up, the RTO reaches 5000 and after 80 seconds, the peering is torn down and re-initialized. I see this by doing 'show ip eigrp nei'. The only way to clear the condition is to shut / no shut the tunnel interface. After doing so, the peerings will re-establish and remain stable. The BGP peerings stay established, the NHRP mappings seem to be stable on both the hubs and spokes. There is no predictable way to reproduce it (that I see), seems to be fairly random. The routers aren't over taxed, CPU usage is fine as is memory usage. The config seems good, as the branches come back online after the tunnel bounce.
Right now, we're in implementation so the old WAN connections are still available when the tunnel starts to flake out, so its not causing any issues, but my first round of disconnects are coming in the next few days, so I need to figure out what's going on.
Here's the spoke config:
crypto ikev2 profile IPVPN_ikev2_profile match fvrf IPVPN match identity remote address 0.0.0.0 authentication remote rsa-sig authentication local rsa-sig pki trustpoint GrowND dpd 10 2 periodic (Have tried with/without this on the spokes)
crypto ipsec transform-set IPVPN_ipsec_transform esp-aes 256 esp-sha-hmac mode transport
crypto ipsec profile IPVPN_ipsec_profile set transform-set IPVPN_ipsec_transform set ikev2-profile IPVPN_ikev2_profile
interface Tunnel97 bandwidth 10000 ip address 192.168.97.3 255.255.255.128 no ip redirects ip mtu 1400 ip flow monitor flow-1 input ip flow monitor flow-1 output ip nhrp authentication <xxxx> ip nhrp group IPVPN-10MBPS ip nhrp network-id 97 ip nhrp holdtime 600 ip nhrp nhs 192.168.97.1 nbma 100.65.x.x multicast ip nhrp nhs 192.168.97.2 nbma 100.65.x.y multicast ip nhrp shortcut ip tcp adjust-mss 1360 if-state nhrp qos pre-classify tunnel source GigabitEthernet0/2 tunnel mode gre multipoint tunnel key 197 tunnel path-mtu-discovery tunnel vrf IPVPN tunnel protection ipsec profile IPVPN_ipsec_profile end
interface GigabitEthernet0/2 ip vrf forwarding IPVPN ip address 100.65.x.a 255.255.255.252 ip flow monitor flow-1 input load-interval 30 duplex full speed 100 service-policy output IPVPN-10mbps
HUB:
crypto ikev2 profile IPVPN_ikev2_profile match fvrf IPVPN match identity remote address 0.0.0.0 authentication remote rsa-sig authentication local rsa-sig pki trustpoint GrowND
crypto ipsec transform-set IPVPN_ipsec_transform esp-aes 256 esp-sha-hmac mode transport
crypto ipsec profile IPVPN_ipsec_profile set transform-set IPVPN_ipsec_transform set ikev2-profile IPVPN_ikev2_profile
interface Tunnel97 bandwidth 200000 ip address 192.168.97.1 255.255.255.128 no ip redirects ip mtu 1400 no ip next-hop-self eigrp 10 no ip split-horizon eigrp 10 ip flow monitor flow-1 input ip flow monitor flow-1 output ip pim nbma-mode ip pim sparse-mode ip nhrp authentication <xxxx> ip nhrp map multicast dynamic ip nhrp map group IPVPN-10MBPS service-policy output IPVPN-10mbps ip nhrp map group IPVPN-CCM service-policy output IPVPN-CCM ip nhrp network-id 97 ip nhrp holdtime 600 ip nhrp redirect ip tcp adjust-mss 1360 delay 2 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 197 tunnel path-mtu-discovery tunnel vrf IPVPN tunnel protection ipsec profile IPVPN_ipsec_profile
interface GigabitEthernet0/0 ip vrf forwarding IPVPN ip address 100.65.x.y 255.255.255.252 media-type sfp
On the hub, while peerings are flapping, the NHRP entries show as UP and they aren't flapping as the EIGRP peerings are, so it would appear that the NHRP / DMVPN part is stable.
Any ideas what could be causing this behavior? What sort of debugs (and where) would be useful? I have a TAC case open but its moving nowhere fast... Tech has 'missed' two scheduled appointments.
... View more
Labels:
05-24-2016
08:00 AM
I got it to work!
Thank you very much Joe for all your help. I ended up using this:
cli_write $cli(fd) "copy flash:$ACLFile running-config" cli_read_pattern $cli(fd) "Destination filename" cli_write $cli(fd) "\n" if [catch {cli_read $cli(fd) } result] { error $result $errorInfo } else { set cmd_output $result }
I understand what the catch part is for, but I don't really know how it works, or if I even need it. I just know I tested it and it works like a champ.
... View more
05-23-2016
06:11 PM
VID-RTR#copy tftp://192.168.101.179/VID-ACL.txt flash: Destination filename [VID-ACL.txt]? Accessing tftp://192.168.101.179/VID-ACL.txt... Loading VID-ACL.txt from 192.168.101.179 (via Tunnel10): ! [OK - 10903 bytes]
10903 bytes copied in 1.540 secs (7080 bytes/sec)
VID-RTR#
... View more
05-23-2016
03:01 PM
Oh excellent, now we're getting somewhere!
I tried using cli_write and cli_read_pattern as you suggested, it worked, it pulled in the file, however... right after I download the file, I do this:
set fin [cli_exec $cli(fd) "verify /md5 flash:$ACLFile"] regexp -all -nocase { = ([a-f0-9]{32})} $fin matched md5
I run an MD5 check on the file and set the output to $fin variable, then run regexp on that output and save the computed hash to the $md5 variable.
When I use cli_write and cli_read_pattern, the output that's in the $fin variable is always the output from the TFTP transfer, not from the md5 validation.
INPUT: ^^ Accessing tftp://192.168.101.179/VID-ACL.txt... Loading VID-ACL.txt from 192.168.101.179 (via Tunnel10): ! [OK - 10903 bytes]
10903 bytes copied in 1.352 secs (8064 bytes/sec) --More-- --More-- VID-RTR#^^
and it should be the output from the MD5 check.
If I set file prompt quiet, everything works like a champ. I think the cli_write method is a better solution, I don't know how to get it to work properly.
I'm including the entire script up to where I am now for reference.
Thanks so much for your help so far!
... View more
05-18-2016
02:31 PM
Hi Joe,
Thanks for your response, sorry I didn't reply earlier.
I've modified the script and have all of it working except for two parts.
The part to transfer the file via TFTP to flash: and to copy run start.
Here's what I have now:
cli_exec $cli(fd) "copy tftp://192.168.101.179/$ACLFile flash:"
I run the script and it just times out due to MAXRUN, which I have set at 120 sec. Watching the TFTP server I do not see any activity from the router. Here's the logs I get:
Process Forced Exit- MAXRUN timer expired. while executing "return -code error "error reading the channel: $result"" (procedure "cli_exec" line 5) invoked from within "cli_exec $cli(fd) "copy tftp://192.168.101.179/$ACLFile flash:"" invoked from within "$slave eval $Contents" (procedure "eval_script" line 7) invoked from within "eval_script slave $scriptname" invoked from within "if {$security_level == 1} { #untrusted script interp create -safe slave interp share {} stdin slave interp share {} stdout slave ..." (file "tmpsys:/lib/tcl/base.tcl" line 50) Tcl policy execute failed: Process Forced Exit- MAXRUN timer expired.
Any ideas oh great one? :P
... View more
Created by
rtjensen4
in Network Management
in Network Management
04-26-2016
01:59 PM
04-26-2016
01:59 PM
Hello!
I'm fumbling my way through TCLtrying to fulfill a need.
I had an EEM script that would daily pull in a file via TFTP and apply the contents of that file. Idea is to update various ACLs daily in an automated fashion. This worked fine except that each day it created a config version, meaing my out of band managers and my LMS would pull in a new copy of the config daily even when things didnt actually change, but the the ACL file was update. Not the most effective use of resources.
I created a TCL script that does the following. Takes an argument passed in, uses it to create a file path and downloads a file to flash.
It MD5s the file and compares it to the MD5 of the previous day's downloaded file. If the MD5s are equal, does nothing and quits. If they're different, the commands in the file are applied and it's deleted from flash.
The script works fine when run from tclsh:
VID-RTR# tcltest.tcl VID-ACL.txt VID-ACL.txt
VID-RTR# 23507465: Apr 26 16:55:12.669: Downloaded ACL file signature is the same as the previous. No changes made. Removing source file
I try to register the script and most of the commands aren't working. Most specifically, the exec commands. I've managed to get the scheduling part of it worked out for testing, I used this:
::cisco::eem::event_register_none
From what i've read, it has to do with the script being untrusted and running in Safe-TCL mode. I am asking for some help. How can I convert this script into a script that will run via cron daily and acheive the same results?
set ACLFile "" set oldmd5 ""
if { $::argc > 0 } {d set ACLFile $argv } else { puts "No ACL Filename Passed, exiting" break }
puts $argv
exec "enable" exec "copy tftp://192.168.101.179/$ACLFile flash:"
if {[file exists "flash:$ACLFile"]} {
} else { puts "File not downloaded, abort!" break }
if {![file exists "flash:md5old.txt"]} { set sysout [open "syslog:" "w"] puts $sysout {File not found, settting variable = 0} close $sysout set oldmd5 "0" } else { set fIN [open "flash:md5old.txt" "r"] set oldmd52 [read $fIN] set oldmd5 [string trim $oldmd52] close $fIN }
set fo [open "flash:md5old.txt" "w"] set input [exec "verify /md5 flash:$ACLFile"] regexp -all -nocase { = ([a-f0-9]{32})} $input matched md5 #puts "NewMD5: ^$md5^" puts $fo $md5 close $fo
if {[string equal $oldmd5 $md5]} { set sysout [open "syslog:" "w"] puts $sysout {Downloaded ACL file signature is the same as the previous. No changes made. Removing source file} close $sysout exec "delete flash:$ACLFile" } else { set sysout [open "syslog:" "w"] puts $sysout {Updates to ACL file found. Applying config and removing source file...} exec "copy flash:$ACLFile running-config" exec "copy run start" close $sysout exec "delete flash:$ACLFile" }
... View more
Labels:
10-28-2015
02:47 PM
Hi All!
We use 802.1x to secure our LAN and all of our Cisco IP Phones authenticate via EAP-TLS back to our ACS server. The phones are using the MIC to authenticate. I have a few phones where the MIC has expired. What are my options? I really dont want to enter a PW on each one, and I dont want to put each MAC address into ACS.
We have about 450-500 7941s out in the stores right now, so if a few of them are starting to expire, i'm sure it will happen to more in the not too distant future.
I was looking at CAPF, but I dont know if LSC is the way to go... or is it? Can we have CAPF push a LSC to the phones and the phones use that to authenticate?
Thanks.
... View more
Labels:
05-08-2015
08:34 AM
If the switches are stacked, make sure your console cable is connected to the switch that is the stack master. If you're connected to a member switch, it will be very slow. Move the console cable to the master switch and you should be fine.
... View more
10-03-2014
08:54 AM
Thanks for the insight Mark. Right now my ISP is static routing to my internet router. I think for now i'll just use static routes in this environment and go from there.
... View more
09-30-2014
01:25 PM
Hello! I've gotten 2 /56 block of IPv6 addresses from our ISP. We're in the process of rolling out a new website and along with that I'm pushing that we create our IPv6 presence at the same time. My Question is in regards to Routing vs NAT-ing... in my "Internet" environment, the space between my ISP routers and my firewalls, I have configured one of my 256 /64 networks 2001:XXXX:YY:100::1/64. That would mean My firewall could be 2001:XXXX:YY:100::B/64. My web servers sit in a DMZ off my firewall. Should I: A. Provision a random IPv6 subnet in the DMZ and use the firewall to NAT to an IP in the 2001:XXXX:YY:100::/64 range. I thought one of the points of IPv6 was to do away with NAT. B. Provision 2001:XXXX:YY:101::/64 network in DMZ and ROUTE to the DMZ server. I am thinking this is the solution, but what Protocol to use? Im guessing I advertise my /56 via BGP to ISP, and use what? OSPFv3 between internet routers and firewalls? Use Static Routes? Is there anything that's considered 'best practice' for this type of situation? To Route or to NAT?
... View more
Labels:
08-20-2014
08:09 AM
I've verified the interface isn't showing any errors. Here's the outputs from the switch port where the server is. This particular one I'm not hard-setting the speed/duplex on either side, I'm using it as a test to determine if we can fix the issue. Here's show interface and show controllers for the port. MBO-SW#sh int gi1/0/40 GigabitEthernet1/0/40 is up, line protocol is up (connected) Hardware is Gigabit Ethernet, address is 10bd.18f8.cca8 (bia 10bd.18f8.cca8) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:02:26, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 2000 bits/sec, 3 packets/sec 42930725 packets input, 17169447873 bytes, 0 no buffer Received 902207 broadcasts (565191 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 565191 multicast, 0 pause input 0 input packets with dribble condition detected 105822728 packets output, 50063153917 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out MBO-SW# MBO-SW#show control MBO-SW#show controllers e MBO-SW#show controllers ethernet-controller ? FastEthernet FastEthernet IEEE 802.3 GigabitEthernet GigabitEthernet IEEE 802.3z down-when-looped show state related to down-when-looped detection phy show PHY registers port-asic Show Port-ASIC info stack show stack ports information | Output modifiers <cr> MBO-SW#show controllers ethernet-controller gi1/0/40 Transmit GigabitEthernet1/0/40 Receive 2818528255 Bytes 4284551153 Bytes 52575681 Unicast frames 42028542 Unicast frames 38095282 Multicast frames 565192 Multicast frames 15151917 Broadcast frames 337016 Broadcast frames 0 Too old frames 4177828967 Unicast bytes 0 Deferred frames 67458170 Multicast bytes 0 MTU exceeded frames 39264016 Broadcast bytes 0 1 collision frames 0 Alignment errors 0 2 collision frames 0 FCS errors 0 3 collision frames 0 Oversize frames 0 4 collision frames 0 Undersize frames 0 5 collision frames 0 Collision fragments 0 6 collision frames 0 7 collision frames 18613376 Minimum size frames 0 8 collision frames 7899108 65 to 127 byte frames 0 9 collision frames 4221021 128 to 255 byte frames 0 10 collision frames 2308750 256 to 511 byte frames 0 11 collision frames 728974 512 to 1023 byte frames 0 12 collision frames 9159521 1024 to 1518 byte frames 0 13 collision frames 0 Overrun frames 0 14 collision frames 0 Pause frames 0 15 collision frames 0 Excessive collisions 0 Symbol error frames 0 Late collisions 0 Invalid frames, too large 0 VLAN discard frames 0 Valid frames, too large 0 Excess defer frames 0 Invalid frames, too small 14359543 64 byte frames 0 Valid frames, too small 49259877 127 byte frames 8472563 255 byte frames 0 Too old frames 3308463 511 byte frames 0 Valid oversize frames 465850 1023 byte frames 0 System FCS error frames 29956584 1518 byte frames 0 RxPortFifoFull drop frame 0 Too large frames 0 Good (1 coll) frames 0 Good (>1 coll) frames
... View more
08-19-2014
02:58 PM
Have a strange issue. I have 23 branches, all have a pair of 2960S switches running c2960s-universalk9-mz.122-55.SE5.bin Each branch has a Dell server with a Broadcom NetXtreme Gigabit chipset. When the server is set to auto/auto and switch set to auto/auto, switchport negotiates to gig/full. When we do this, throughput between hosts on the same switch and the server is a measly 300-500KBps As soon as I hard-set the server to 100/full (not the switch side yet), the switchport comes up as 100/half. Throughput jumps up to 3-5 MBps When I hard-set the switch side to 100/full to match the sever, I get FULL throughput between the server and clients on the same switch. We've tried updating to latest drivers for the network card, but no dice. This is happening at EVERY branch, so i doubt its related to cabling. Any Ideas?
... View more
Labels:
03-14-2014
07:21 AM
Hi Vasilii, This is applied to my Gig0/1 interface which faces my WAN. Your question about tunnels got me to thinking... and I think I have an explanation. The WAN interface has GETVPN configured on it and I use qos pre-classify... I wonder if, since I'm marking it leaving the router, it's not marking it because of the encapsulation for the GETVPN. I wonder if I move the marking operation to my inbound LAN interfaces if it would work properly. interface GigabitEthernet0/1 bandwidth 10000 ip address 192.168.xx.xx 255.255.255.128 ip access-group filter-terminal-servers in no ip redirects ip mtu 1400 ip authentication mode eigrp 10 md5 ip authentication key-chain eigrp 10 EIGRP-Keychain ip pim sparse-mode load-interval 30 duplex full speed 10 rj45-auto-detect-polarity disable crypto map GETVPN_MAP service-policy output branch-qos ! ! # sh policy-map int GigabitEthernet0/1 Service-policy output: branch-qos-nlan queue stats for all priority classes: Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 85269289/49093027324 Class-map: VoIP-Control (match-all) 5549066 packets, 840279084 bytes 30 second offered rate 1000 bps, drop rate 0000 bps Match: dscp cs3 (24) af31 (26) Match: ip precedence 3 Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 5550572/840330288 bandwidth 16 kbps QoS Set dscp af31 Packets marked 761587 Class-map: VoIP-Voice (match-all) 38213392 packets, 11231807424 bytes 30 second offered rate 191000 bps, drop rate 0000 bps Match: dscp ef (46) Match: ip precedence 5 Priority: 30% (3000 kbps), burst bytes 75000, b/w exceed drops: 0 QoS Set dscp ef Packets marked 0 Class-map: DVR (match-all) 14402775 packets, 18167642266 bytes 30 second offered rate 438000 bps, drop rate 0000 bps Match: access-group 100 Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/975550/0 (pkts output/bytes output) 13427225/16818507062 shape (average) cir 2000000, bc 8000, be 8000 target shape rate 2000000 Exp-weight-constant: 9 (1/512) Mean queue depth: 0 packets class Transmitted Random drop Tail drop Minimum Maximum Mark pkts/bytes pkts/bytes pkts/bytes thresh thresh prob 0 12946754/16145248972 639870/886311060 330658/455732476 20 40 1/10 1 480861/673699902 1915/2701562 3107/4390106 22 40 1/10 2 0/0 0/0 0/0 24 40 1/10 3 0/0 0/0 0/0 26 40 1/10 4 0/0 0/0 0/0 28 40 1/10 5 0/0 0/0 0/0 30 40 1/10 6 0/0 0/0 0/0 32 40 1/10 7 0/0 0/0 0/0 34 40 1/10 QoS Set dscp cs1 Packets marked 75 Class-map: Symitar (match-all) 0 packets, 0 bytes 30 second offered rate 0000 bps, drop rate 0000 bps Match: access-group name Symitar Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth 64 kbps QoS Set dscp af21 Packets marked 0 Class-map: U-Genius (match-all) 47055898 packets, 37861219900 bytes 30 second offered rate 546000 bps, drop rate 0000 bps Match: access-group name ITM-Video Priority: 1544 kbps, burst bytes 38600, b/w exceed drops: 0 QoS Set dscp af32 Packets marked 0 Class-map: Video-Conf (match-any) 0 packets, 0 bytes 30 second offered rate 0000 bps, drop rate 0000 bps Match: dscp af41 (34) 0 packets, 0 bytes 30 second rate 0 bps Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops) 0/0/0 (pkts output/bytes output) 0/0 bandwidth 1500 kbps QoS Set dscp af41 Packets marked 0 Class-map: class-default (match-any) 1492012019 packets, 1499044830575 bytes 30 second offered rate 500000 bps, drop rate 0000 bps Match: any Queueing queue limit 64 packets (queue depth/total drops/no-buffer drops/flowdrops) 0/0/0/0 (pkts output/bytes output) 1493902053/1499029048228 Fair-queue: per-flow queue limit 16 packets
... View more
10-03-2016
Hi All! Hoping some experts can assist me here. I have a new MPLS
network going in and we're impleme...
05-24-2016
I got it to work! Thank you very much Joe for all your help. I ended up
using this: cli_write $cli(f...
05-23-2016
VID-RTR#copy tftp://192.168.101.179/VID-ACL.txt flash:Destination
filename [VID-ACL.txt]? Accessing
...
05-23-2016
Oh excellent, now we're getting somewhere! I tried using cli_write and
cli_read_pattern as you sugge...
05-18-2016
Hi Joe, Thanks for your response, sorry I didn't reply earlier. I've
modified the script and have al...
04-26-2016
Hello! I'm fumbling my way through TCLtrying to fulfill a need. I had an
EEM script that would daily...
Created by
rtjensen4
in TelePresence and Video Infrastructure
01-20-2016
01-20-2016
Thanks for the insight into how it works. I've removed the auto-dialed
participants that were associ...
Created by
rtjensen4
in TelePresence and Video Infrastructure
01-20-2016
01-20-2016
Hi All, I'm having some strange behavior... My bridge is a MCU 5320,
licensed for 7 Full HD ports (1...
10-28-2015
Hi All! We use 802.1x to secure our LAN and all of our Cisco IP Phones
authenticate via EAP-TLS back...
05-08-2015
If the switches are stacked, make sure your console cable is connected
to the switch that is the sta...
10-03-2014
Thanks for the insight Mark.Right now my ISP is static routing to my
internet router. I think for no...
09-30-2014
Hello!I've gotten 2 /56 block of IPv6 addresses from our ISP. We're in
the process of rolling out a ...
08-20-2014
I've verified the interface isn't showing any errors. Here's the outputs
from the switch port where ...
Public Statistics
| Date Registered | 08-17-2007 05:43 AM |
| Date Last Visited | 09-12-2019 05:47 AM |
| Total Messages Posted | 413 |
| Total Helpful Votes Received | 92 |
.jpg "Hall of Fame Master"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 10 |
