Hello nochannel2013, no problems. I have preferred to provide information about the stack cable.   The idea with three stacks is to have stack1 ====== stack2 ======= stack3   here with === I mean multichassis etherchannel like stack1 member 1 provides 1 link and connects to stack2 member1, stack1 member 2 provides second link to stack 2 member 2. The same between stack2 and stack3.   Finally stack1 connects to ISR4321 with one link and stack3 to ISR 4321 second link (or other router)   Hope to help Giuseppe   ... View more

Hello Yasmeen, for a Cisco multilayer switch to support IPv6 routing you need ipv6 unicast-routing ipv6 cef + configuration under interface (routed interface or more likely SVI interface) interface vlan 10 ipv6 address 2001:AAAA::/64 eui-64   However, these commands may be supported or not depending on the SDM template of the switch You can check this with show sdm prefer   If your current SDM template does not support IPv6 you need to change it and to reload the switch.   Later I will add how to make the switch to advertise DHVPv6 prefixes in router advertisements.   Ipv6 router advertisements are enabled by default the following command re-enable them no ipv6 nd ra supress   Edit: You may need the DHCPv6 relay agent feature   Configuring the DHCPv6 Relay Agent SUMMARY STEPS 1.    enable 2.    configure terminal 3.    interface type number 4.    ipv6 enable 5.    ipv6 dhcp relay destination ipv6-address [ interface-type interface-number ] 6.    end   see https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/xe-16/dhcp-xe-16-book/ip6-dhcp-rel-agent-xe.html   This should be configured on all L3 IPv6 interfaces not directly connected to the linux box acting as DHCPv6 server.   Hope to help Giuseppe   ... View more

Hello Yasmeen, I am happy that you have been able to fix the NAT configuration of your lab. Have you used a standard ACL with NAT or a route-map and an extended ACL? Just to track.   Best Regards Giuseppe   ... View more

Hello Julien, the new vPC would be used only if a whole vPC towards the N5k fails. This means a double link failure or the the whole N5k device pair to fail.   Be aware that on N3k you should avoid to use commands like spanning-tree loop guard default.   I would recommend the use of Bridge assurance that makes STP BPDUs exchange bidirectional like a keepalive (even from ports in Alternate or Backup state)   Hope to help Giuseppe     ... View more

Hello Damka, a) in Cisco devices you cannot redistribute a default static route into OSPF   under ospf process use router ospf 10 default-information originate   The command above checks the IP routing table and generate an LSA type 5 for network 0.0.0.0/0 if a default route is present in the IP routing table ( a static default route , a BGP route and so on)   B) in Cisco OSPF redistribution requires the subnets keyword to perform correct redistribution otherwise OSPF will summarize to major network ( Class A, Class B, Class C) so you need the following router ospf 10 redistribute static subnets   Note: even if using a route-map to select what static route should be redistributed into OSPF you still need to provide the subnets parameter. This is OSPF specific. so alternate command is redistribute static subnets route-map STATIC-INTO-OSPF   ip prefix-list SELECTED 10.0.0.0/8 ge 16 le 24   route-map STATIC-INTO-OSPF permit 10 match address prefix SELECTED   edit: c) OSPF requires that the static route next-hop is advertised with an internal OSPF route. OSPF checks the static route next-hop. It does not allow injection of a static route if the next-hop is part of another external route. it does not allow for recursion between external routes. This can happen when using both redistribute connected subnets redistribute static subnets   To avoid this: under router ospf 10 use network statement for IP subnet of the static route IP next-hop   router ospf 10 ! example: change according to your needs network 10.10.10.0 0.0.0.255 area 0   You can eventually use a passive interface.     Hope to help Giuseppe   ... View more

Hello, Juniper implementation for routing engine protection is different it applies a firewall filter to interface lo0.0 in master routing instance., if I remember correctly.     Hope to help Giuseppe   ... View more

Hello Nabil,  a reload will be necessary to activate the new license, but in full isolation of standby chassis it shouldn't be a great issue you just need ten minutes more in your planned maintenance time window.   Hope to help Giuseppe   ... View more

Hello Nabil, to avoid a dual active conflict you should also disable on the access layer switches side all physical ports to the standby chassis before disabling the VSS links.   This is to perform a safer procedure.   Hope to help Giuseppe   ... View more

Hello nochannel2013, for building a stack it is better to use the appropriate stack cables see StackWise-480: The Cisco Catalyst 9300 Series supports the industry’s highest back-panel stacking bandwidth solution (480 Gbps) with StackWise-480. Up to 8 Switches can be configured in a Stackwise-480 with the special connector at the back of the switch using dedicated stack cables.   https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9300-series-switches/data_sheet-c78-738977.html   I don't know if using copper ports is allowed to build the stack, but they would become a bottleneck for performance as 480 Gbps of the stack cables is much more then 8 X 1 GE using a bundle.   Connecting to the ISR 4321 is a different matter and you can use copper (up to 100 meters far) or fiber also depending on what you have installed on the ISR 4321.   Edit: First of all you can build redundant links between stacks using multi chassi etherchannel. If you have two stacks one link of  first stack will go the ISR 4321 and one line of second stack will go to another port of the ISR 4321 (if it is only  one router otherwise to second ISR router) if you have three stacks you first interconnect the three of them with multichassis etherchannel and then connect first stack and third stack to router(s) interfaces.   Hope to help Giuseppe   ... View more

Hello mpalmer22, your dialer1 interface has a private IP address as noted before by John >> Dialer1 10.107.179.179 IPCP UP      ! this is part of 10.0.0.0/8 in RFC 1918 Telstra is performing a successive NAT inside its network.   This is usual practice for big mobile providers. They have so many customers they cannot allocate public IPv4 addresses directly to end users. I agree with the previous analysis made by John: you have not complete control because traffic is Natted two times: by your router and by the provider inside his network.   Hope to help Giuseppe ... View more

Hello Nabil, from your show version I see you are using Right to use license on active supervisor >> License Information for 'WS-X45-SUP7-E' License Level: entservices Type: Permanent Right-To-Use Next reboot license Level: entservices   The following document provides information about how to install right to use licenses. Note that according to documentation you will need a reboot to make the new license effective.   https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-7-0E/wireless/configuration-guide/b_37e_4500sup8e_cg/configuring_right_to_use_licenses.pdf   So your procedure can be VSS switchover, install right to use license on new active , reboot it.   note: you have Sup 7E not sup8E. An additional check may be needed here.   Edit: I have found the following thread about Sup 7E but they are using another type of license the classic license file .lic. https://community.cisco.com/t5/switching/4510-dual-sup-7e-ip-base-license-issue/td-p/1784286 First document above should apply to your case. About traditional licenses the datasheet mentions the SKU orderable item see https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-4500-series-switches/data_sheet_c78-612364.html   L-C4500E-IP-ES  IP BASE to Enterprise Services upgrade license (electronically delivered) You need at least IP base to build a VSS so I assume you have IP base level on standby peer.   Hope to help Giuseppe   ... View more

Hello txu, to verify if the router is able to resolve a host in the internet you can simply use from the router shell:   ping ftp.gnu.org   About your NAT translations the last line : >> udp   172.24.62.135:1064     192.168.2.11:21803     129.176.199.5:53       129.176.199.5:53 This actually is a DNS request as the destination UDP port is 53. So I would say your router NAT is correctly allowing and translating DNS requests.   To be noted the inside global address is actually a private address too. I mean 172.24.62.135 is not a public address. If you haven't changed it manually to mask your real public address, there can be another device before going to the public internet.   Hope to help Giuseppe   ... View more