Hi all, I have an issue with our BGP setup where outbound MED value seems to be ignored somehow. To describe the setup; - we have 2 sites, each with ASA firewalls's connected to our provider's routers and to our internal routers. - We want to advertise our public subnet (/24) on both sites and specific /32 addresses, from the /24 range, on specific sites configured with MED. We want to have conditional advertisements depending on the availability of internal networks. And we want to filter which specific routes are advertised towards our provider. So we've configured this setup: 1. Add Null routes so BGP can advertise the routes (we use NAT on our ASA) route Null0 1.2.3.0 255.255.255.0 1 --> This is our /24 subnet route Null0 1.2.3.25 255.255.255.255 1 --> This is a /32 address 2. Create a prefix-list and route-map for the advertised route (150 is for site 1, 50 is for site 2) prefix-list CUST-PUBLIC-ADVERTISE_PL seq 5 permit 1.2.3.25/32 route-map CUST-PUBLIC-ADVERTISE_RM permit 10  match ip address prefix-list CUST-PUBLIC-ADVERTISE_PL   set metric 150 ! route-map CUST-PUBLIC-ADVERTISE_RM deny 20 3. Create a prefix-list and route-map for the route to be checked on availability prefix-list CUST-PRIVATE-CHECK_PL seq 5 permit 10.0.0.0/24 route-map CUST-PRIVATE-CHECK_RM permit 10  match ip address prefix-list CUST-PRIVATE-CHECK_PL route-map CUST-PRIVATE-CHECK_RM deny 20 4. Create a prefix-list and route-map to include the static routes for the /32 and /24 prefix-list STATIC-BGP_PL seq 1 permit 1.2.3.0/24 ge 25 prefix-list STATIC-BGP_PL seq 6 permit 1.2.3.0/24 route-map STATIC-BGP_RM permit 10  match ip address prefix-list STATIC-BGP_PL ! route-map STATIC-BGP_RM deny 20 5. Create a prefix-list and route-map which filters the advertised networks to our provider prefix-list 24-SUB-ALL_PL seq 5 permit 1.2.3.0/24 route-map Provider-OUT_RM permit 10  match ip address prefix-list CUST-PUBLIC-ADVERTISE_PL 24-SUB-ALL_PL ! route-map Provider-OUT_RM deny 20 6. Combine everything in the BGP configuration router bgp 111111  bgp log-neighbor-changes   bgp graceful-restart  bgp router-id 10.10.10.10   address-family ipv4 unicast    neighbor 10.10.10.11 remote-as 2222    neighbor 10.10.10.11 activate    neighbor 10.10.10.11 advertise-map CUST-PUBLIC-ADVERTISE_RM exist-map CUST-PRIVATE-CHECK_RM    neighbor 10.10.10.11 route-map Provider-OUT_RM out    redistribute static route-map STATIC-BGP_RM   no auto-summary   no synchronization  exit-address-family Is this the right way to do it ? Because it looks like something is wrong. When we activate this configuration it looks like the MED is ignored. Now i am unsure about if the advertise-map combined with the route-map will work and in what order they will be applied. We need the advertise-map to conditionally advertise /32's and set a MED. We need the route-map to filter the advertised networks to the provider. It looks like the route-map Provider-OUT_RM with prefixes overrules the conditional advertisement route-map CUST-PUBLIC-ADVERTISE_RM Can anybody clarify this ? ps All IP/AS/Naming is replaced for security purposes ... View more

Hi,  Can anyone point me to a document explaining how to configure SSL certificates for management and API calls on the ASR 1001-x ? We have an internal Microsoft CA and want to sign the certificates with that CA. I can't find on how to generate a certificate on the ASR, export the CSR and import it again. And for the API interface neither. Thanks Sebas ... View more

Hi,  We are currently in the progress of setting up an Cisco ACI environment. As this is quite new technology we came to the conclusion some objects have to be renamed. However, a rename feature is not availiable in ACI. So it is about deleting and recreation of XML objects. This results in the issue of possible disconnect to the fabric from our management stations because objects are used in the Fabric but also in the Tenants. For example VPC's or AEP's. We've made static bindings to VPC's on our EPG's. So when we would recreate a VPC we would then have to search for all EPG's using this VPC and then delete / recreate the configuration. This is quite a risky hassle ... What would be a nice way to rename objects used in both Fabric as Tenant configuration ? Best regards,  Sebas ... View more

Hi,  I am trying to setup privilege levels so privilege level 5 can only view and configure switchports.  however, on my switch i can not use the option "all" to have all sub commands set to the same level. Now i have this configuration :  privilege configure level 5 interface privilege interface level 5 description privilege interface level 5 switchport port-security privilege interface level 5 switchport port-security mac-address sticky privilege exec level 5 configure terminal privilege exec level 5 configure privilege exec level 5 show interface privilege exec level 5 show run privilege exec level 5 show logg But the privilege level 5 user can not set sticky mac adresses with the command :  switchport port-security mac-address sticky xxxx.xxxx.xxxx vlan voice If i could use the all command i would only need "switchport", but now i have to write the full command, and even in the case of the above, it doesn't work as the mac adress is a value and not a command itself. This configuration is tested on a 3560 with IOS 122-55.SE5. Is the "all" command only available in later versions ? Or how do i solve this issue ? tnx,  Sebastian       ... View more