Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About blau grana
Stats
Member since
10-02-2012
635
Posts
501
Helpful
100
Solutions
02-05-2017
09:47 AM
Hi,
there are several good explanations out there.
f.e.: http://packetlife.net/blog/2013/jun/10/route-distinguishers-and-route-targets/
in general:
- route target: extended community pinned to prefixes during export operation, RT is used to select specific prefixes which should be imported to specified VRFs
- route distinguisher: does exactly what name implies, distinguish prefixes in SP backbone; if two customers uses same address space f.e. 10.0.0.0/24, unique RD will make them unique per each VRF
let us know if you have problem to understand something specific.
... View more
01-17-2017
11:42 AM
Hi,
documentation is always your friend :)
http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r6-1/routing/configuration/guide/b-routing-cg-asr9k-61x/b-routing-cg-asr9k-61x_chapter_01011.html#con_1228824
"If a prefix match specification has no mask length, then the default mask length is 32 for IPv4 and 128 for IPv6."
XR will allow you to configure lot of combinations but per documentation it will always match same prefix
RP/0/0/CPU0:ios#sh run | begin prefix Building configuration... prefix-set ABC 1111:2222:3333:4444:5555:6666:7777:8888/128, 1111:2222:3333:4444:5555:6666:7777:8888/128 end-set ! prefix-set TEST 1111:2222:3333:4444:5555:6666:7777:8888 end-set ! prefix-set TEST-1 1111:2222:3333:4444:5555:6666:7777:8888/128 end-set ! prefix-set TEST-2 1111:2222:3333:4444:5555:6666:7777:8888, 1111:2222:3333:4444:5555:6666:7777:8888/128 end-set ! end
... View more
01-16-2017
09:34 AM
Hi Sam,
It's hard to help without configs and topology (you don't have to use real IPs)
Here is simple exmaple how you can configure HSRP to track uplink interface or track ip sla object to influnece which gateway will be active.
https://mellowd.co.uk/ccie/?p=827
... View more
01-15-2017
03:19 PM
cost is 65535 because VL is down not the other way around.
You made a mistake in your configuration, this should be a fix:
R5 router ospf 1 no area 1 virtual-link 7.7.7.7 area 1 virtual-link 6.6.6.6 R6 router ospf 1 area 1 virtual-link 5.5.5.5 R7 router ospf 1 no area 1 virtual-link 5.5.5.5
- R7 has no connection to area 1, it;s internal router to area 2
- VL needs to be established between ABR routers:
-- R5 is ABR between area 0 and area 1
-- R6 is ABR between area 1 and area 2
- you need to establish VL between R5 an R6 to connect area 2 to area 0
... View more
01-15-2017
03:06 PM
Hi,
RD does not decide which vrf prefixes will be imported.
RD is used to convert IPv4 prefix into VPNv4 prefix(if we are talking about IPv4). This is very useful if different customers use same IP ranges but thanks to RD prefixes will still be unique inside MPLS cloud.
RTs are extended communities and these decide which prefixes will be imported into respective VRFs.
It doesn't really matter if you have same or different RD/RT if you know what you are doing. You need to make sure that RT exported in one site will be imported in other site and vice versa to be able to ping from one site to another via MPLS cloud.
... View more
01-15-2017
02:55 PM
This is job for BGP, if it's possible to run it on your devices/via MPLS cloud.
... View more
01-15-2017
02:45 PM
Hi,
You don't need multiple route-maps for this scenario, just use different sequence number for different policy you want to implement.
route-map XYZ deny seq 10 match ip address prefix-list DEFAULT ! route-map XYZ permit seq 20 set ip next-hop unchanged
... View more
01-09-2017
02:09 PM
Hi,
I think simple ACL should do the job. Do you have specific requirements which traffic you want to permit/deny?
Example of allowing telnet/www return traffic traffic
Switch(config)# access-list 101 permit tcp 10.0.0.0 0.0.255.255 10.0.4.0 0.0.3.255 eq telnet established Switch(config)# access-list 101 permit tcp 10.0.0.0 0.0.255.255 10.0.4.0 0.0.3.255 eq www established Switch(config)# interface vlan 4 Switch(config-if)# ip access-group 101 out
For non-tcp traffic you have to specify all traffic flows which you want to permit/deny.
... View more
01-09-2017
01:45 PM
Hi,
Generally there's no need to use different ASN. But it really depends on your use case and it's hard to be specific without more details.
... View more
01-09-2017
01:41 PM
Hi Aleksandar,
Very useful command, thank you!
It turned out I had to specify community-set and use it inside route-policy instead of directly writing community.
RP/0/0/CPU0:PE1(config)#commit show-error % Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. !! SEMANTIC ERRORS: This configuration was rejected by !! the system due to semantic errors. The individual !! errors with each failed configuration command can be !! found below. router bgp 64500 neighbor 192.168.11.2 address-family ipv4 unicast route-policy EBGP_IN(64501, 200, 64500:20) in !!% Could not find entry in list: Policy [EBGP_IN] uses community set [64500:20]. [64500:20] must be defined before [EBGP_IN] can be attached. ! ! ! end . . . RP/0/0/CPU0:PE1(config)#sh conf community-set COMM-AS64501 64500:20, 64500:64501 end-set ! router bgp 64500 neighbor 192.168.11.2 address-family ipv4 unicast no route-policy EBGP_IN(64501, 200, 64500:20) in route-policy EBGP_IN(64501, 200, COMM-AS64501) in ! ! ! end RP/0/0/CPU0:PE1(config)#commit RP/0/0/CPU0:PE1(config)#
... View more
01-08-2017
07:27 AM
Hi Amr,
I don't see route-maps applied on LAN interfaces:
interface FastEthernet0/0.2 ip policy route-map LO interface FastEthernet0/0.4 ip policy route-map CHEM
By the way you can create one route-map and apply it on both LAN interfaces, different ACLs will do the trick.
Also I'm not sure if your NAT config is OK:
ip nat inside source route-map LO interface Ethernet0/1 overload ip nat inside source route-map CHEM interface Ethernet0/2 overload
Instead of route-maps I would use ACLs which you already created.
More importantly:
why are you NATing LO subnet to Eth0/1 and then sent via Dialer interface?
why are you NATing CHEM subnet to Eth0/2 and then sent it via Eth0/1?
It seems to me NAT config should look like this:
ip nat inside source list ACL-LO interface Dialer1 overload ip nat inside source list ACL-CHEM interface Ethernet0/1 overload
Do you have any requirements for failure in case on of the uplinks will go down?
... View more
01-08-2017
03:33 AM
http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/mpls/200523-Configuration-and-Verification-of-Layer.html
... View more
01-08-2017
03:31 AM
Hi,
depends on your scenario this could be another solution:
route-policy sample-originate
if rib-has-route in (10.0.0.0/8 ge 8 le 32) then
pass
endif
end-policy
router bgp 2
neighbor 10.0.0.1
remote-as 3
address-family ipv4 unicast
default-originate policy sample-originate
http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r6-0/routing/configuration/guide/b_routing_cg60xasr9k/b_routing_cg60xasr9k_chapter_01010.html#con_1117195
... View more
01-08-2017
02:47 AM
Hi,
How do you know that outside users can't reach 192.168.100.3:443? I mean maybe that can reach it but return traffic is dropped.
Which router is used to reach internet by users in 192.168.100.0/24? R1 or R2?
I would check routing tables if everything looks OK there.
Also do you have ip nat inside on R1's VPN tunnel interface toward R2?
can you upload configs of both routers?
... View more
01-08-2017
02:33 AM
Hi Michal,
No, it's not necessary to "clear" in/out BGP neighbor in your case.
As Paul wrote, bgp scanner will pick up your change in next run.
Actually you don't have to "clear" BGP neighbor in any case if you are willing to wait for bgp scanner to do the same tasks. "clear" BGP will just speed up the process.
... View more
02-05-2017
Hi, there are several good explanations out there. f.e.:
http://packetlife.net/blog/2013/jun/10/rout...
01-17-2017
Hi, documentation is always your friend :)
http://www.cisco.com/c/en/us/td/docs/routers/asr9000/soft...
01-16-2017
Hi Sam, It's hard to help without configs and topology (you don't have
to use real IPs) Here is simp...
01-15-2017
cost is 65535 because VL is down not the other way around. You made a
mistake in your configuration,...
01-15-2017
Hi, RD does not decide which vrf prefixes will be imported. RD is used
to convert IPv4 prefix into V...
01-15-2017
Hi, You don't need multiple route-maps for this scenario, just use
different sequence number for dif...
01-09-2017
Hi, I think simple ACL should do the job. Do you have specific
requirements which traffic you want t...
01-09-2017
Hi, Generally there's no need to use different ASN. But it really
depends on your use case and it's ...
01-09-2017
Hi Aleksandar, Very useful command, thank you! It turned out I had to
specify community-set and use ...
01-08-2017
Hi Amr, I don't see route-maps applied on LAN interfaces: interface
FastEthernet0/0.2 ip policy rout...
01-08-2017
http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/mpls/200523-Configurati...
01-08-2017
Hi, depends on your scenario this could be another solution:
route-policy sample-originate if rib-ha...
01-08-2017
Hi, How do you know that outside users can't reach 192.168.100.3:443? I
mean maybe that can reach it...
Public Statistics
| Date Registered | 10-02-2012 06:03 AM |
| Date Last Visited | 08-18-2017 04:27 AM |
| Total Messages Posted | 635 |
| Total Helpful Votes Received | 501 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
