Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About skrao_mandalapu
Stats
Member since
12-08-2009
26
Posts
0
Helpful
0
Solutions
12-09-2012
04:08 PM
Hi All, Can someone suggest free full length URLs for below IEEE standards: 802.3d 802.3w 802.3s 802.3ad Regards Siva Kondala Rao
... View more
Labels:
11-28-2012
09:01 PM
Hi All, I have setup is as below. L2 switch ingresss qinq connecting to customer ----------------------- L2 switches ------------------------- L3 switch with MPLS (xconnect ingress for customer circuit)------------ L3 switches with MPLS ----------------------------- L3 switch with MPLS (xconnect egress for customer circuit) ---------------- L2 switches --------------- L2 switch egress qinq connecting to customer edge switches are me-3400 and input policers configured to set COS value to 2. L3 switches are 7609 with 6704 1G card connecting to layer 2 switches and ES20 10G card connecting to MPLS core. I am giving 'mls qos trust cos' on 1G ports towards L2 and 'mls qos trust dscp' on 10G ports towards MPLS core. On xconnect interfaces I am attaching policy with 'set mpls experimental 2' I am trying to understand packet QoS life across this setup: At ingress PE I gave 'mls qos trust cos', so 7609 generates initial internal DSCP from COS (here cos=2), later going through policy-maps it will set EXP=2 in outer label when handing packet to next LSR. Next LSR handles packet with outer label EXP. My question is how PHP LSR handles this packet in egress when outer label got removed. Does it copy outer label EXP to inner label or it looks packet IP Precedence values? Next question, at egress PE in ingress (packet coming from MPLS core) packet has only inner label. How initial internal DSCP is generated for this packet?--------------------- based on the final internal DSCP packet COS value will be derived before handing packe to L2 switches connected to 6704 LAN ports. comments from qos experts are appreciated. Regards Siva Kondala Rao
... View more
- Tags:
- mpls_qos
Labels:
11-27-2012
10:25 PM
Hi All, I wanted to create PE to PE traffic engineered tunnels with guaranteed bandwidth using mpls experimental bits. On ingress PE i am mapping all traffic in to four classes Platinum (EXP 5) , Gold (EXP 4), Silver (EXP 3), Bronze (EXP 2). All core interfaces are 10Gbps and egress scheduling configured for platinum- 2.5Gbps, gold- 2.5Gbps, silver- 2.5Gbps, bronze- 2.5Gbps. Ingress to egress dynamic tunnel has to establish with guranteed bandwidth for platinum traffic 2.5Gbps. For four types of traffic I required 4 LSPs from ingress to egress. Can this requirement be done by diffser-te in cisco? If possible, please suggest helpful docs for configuration. Regards Siva Kondala Rao
... View more
Labels:
Created by
skrao_mandalapu
in Routing
in Routing
10-16-2012
07:29 AM
10-16-2012
07:29 AM
Hi Nick, I am able to ping tunnel source IP address. I gave " ip nhrp holdtime 5" I am seeing below messages at R1 side. R1#debug crypto ipsec sa Crypto IPSEC debugging is on R1# *Oct 16 14:58:48.691: IPSEC(validate_proposal_request): proposal part #1 *Oct 16 14:58:48.691: IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) INBOUND local= 172.16.1.1, remote= 172.16.1.2, local_proxy= 172.16.1.1/255.255.255.255/47/0 (type=1), remote_proxy= 172.16.1.2/255.255.255.255/47/0 (type=1), protocol= ESP, transform= NONE (Transport), lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0 *Oct 16 14:58:48.691: map_db_find_best did not find matching map *Oct 16 14:58:48.691: IPSEC(ipsec_process_proposal): proxy identities not supported *Oct 16 14:58:48.691: IPSEC(validate_proposal_request): proposal part #1 *Oct 16 14:58:48.691: IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) INBOUND local= 172.16.1.1, remote= 172.16.1.2, local_proxy= 172.16.1.1/255.255.255.255/47/0 (type=1), remote_proxy= 172.16.1.2/255.255.255.255/47/0 (type=1), protocol= ESP, transform= NONE (Transport), lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0 *Oct 16 14:58:48.695: map_db_find_best did not find matching map *Oct 16 14:58:48.695: IPSEC(ipsec_process_proposal): proxy identities not supported *Oct 16 14:58:48.695: IPSEC(ipsec_process_proposal): proxy identities not supported R1# R2 side: R2#debug crypto ipsec Crypto IPSEC debugging is on R2# *Oct 16 14:39:23.855: IPSEC(key_engine): request timer fired: count = 1, (identity) local= 172.16.1.2, remote= 172.16.1.1, local_proxy= 172.16.1.2/255.255.255.255/47/0 (type=1), remote_proxy= 172.16.1.1/255.255.255.255/47/0 (type=1) *Oct 16 14:39:23.855: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= 172.16.1.2, remote= 172.16.1.1, local_proxy= 172.16.1.2/255.255.255.255/47/0 (type=1), remote_proxy= 172.16.1.1/255.255.255.255/47/0 (type=1), protocol= ESP, transform= esp-aes esp-sha-hmac (Transport), lifedur= 120s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x2000 *Oct 16 14:39:23.855: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= 172.16.1.2, remote= 172.16.1.1, local_proxy= 172.16.1.2/255.255.255.255/47/0 (type=1), remote_proxy= 172.16.1.1/255.255.255.255/47/0 (type=1), protocol= ESP, transform= esp-3des esp-sha-hmac (Transport), lifedur= 120s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0 R2# ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ R1#sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 172.16.1.1 172.16.1.2 QM_IDLE 1002 ACTIVE IPv6 Crypto ISAKMP SA R1#sh crypto ipsec sa R1#sh crypto isakmp profile R1#sh crypto ipsec profile IPSEC profile cisco Security association lifetime: 4608000 kilobytes/120 seconds Responder-Only (Y/N): N PFS (Y/N): N Transform sets={ strong: { esp-3des esp-md5-hmac } , } R2#sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 172.16.1.1 172.16.1.2 QM_IDLE 1002 ACTIVE IPv6 Crypto ISAKMP SA R2#sh crypto ipsec sa interface: Tunnel0 Crypto map tag: Tunnel0-head-0, local addr 172.16.1.2 protected vrf: (none) local ident (addr/mask/prot/port): (172.16.1.2/255.255.255.255/47/0) remote ident (addr/mask/prot/port): (172.16.1.1/255.255.255.255/47/0) current_peer 172.16.1.1 port 500 PERMIT, flags={origin_is_acl,ipsec_sa_request_sent} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 2603, #recv errors 0 local crypto endpt.: 172.16.1.2, remote crypto endpt.: 172.16.1.1 path mtu 1500, ip mtu 1500, ip mtu idb Vlan1 current outbound spi: 0x0(0) PFS (Y/N): N, DH group: none inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas: R2# sh crypto isakmp profile R2#sh crypto ipsec profile IPSEC profile cisco Security association lifetime: 4608000 kilobytes/120 seconds Responder-Only (Y/N): N PFS (Y/N): N Transform sets={ strong: { esp-3des esp-md5-hmac } , } Regards Siva Kondala Rao
... View more
Created by
skrao_mandalapu
in Routing
in Routing
10-16-2012
04:31 AM
10-16-2012
04:31 AM
Hi, I am trying to check DMVPN on below back to back setup. IPSec is not coming up. R1 Fa1/0 [switch port] ----------------[switch port] Fa1/0 R2 hostname R1 ! interface Vlan1 ip address 172.16.1.1 255.255.255.252 ! interface lo0 ip address 1.1.1.1 255.255.255.255 ! ip route 0.0.0.0 0.0.0.0 172.16.1.2 ! interface Fa1/0 ! crypto isakmp policy 10 hash md5 authentication pre-share ! crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 ! crypto ipsec transform-set strong esp-3des esp-md5-hmac ! crypto ipsec profile cisco set security-association lifetime seconds 120 set transform-set strong ! interface Tunnel0 ip address 192.168.1.1 255.255.255.0 no ip redirects ip mtu 1440 ip nhrp authentication cisco123 ip nhrp map multicast dynamic ip nhrp network-id 1 tunnel source 172.16.1.1 tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile cisco ! router eigrp 90 network 1.1.1.1 0.0.0.0 network 192.168.1.0 no auto-summary ! +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ hostname R2 ! interface Vlan1 ip address 172.16.1.2 255.255.255.252 ! interface lo0 ip address 2.2.2.2 255.255.255.255 ! ip route 0.0.0.0 0.0.0.0 172.16.1.1 ! interface Fa1/0 ! crypto isakmp policy 10 hash md5 authentication pre-share ! crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 ! !crypto ipsec transform-set strong esp-3des esp-md5-hmac ! crypto ipsec profile cisco set security-association lifetime seconds 120 set transform-set strong ! interface Tunnel0 ip address 192.168.1.2 255.255.255.0 no ip redirects ip mtu 1440 ip nhrp authentication cisco123 ip nhrp map multicast dynamic ip nhrp map 192.168.1.1 172.16.1.1 ip nhrp map multicast 172.16.1.1 ip nhrp network-id 1 ip nhrp nhs 192.168.1.1 tunnel source 172.16.1.2 tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile cisco ! router eigrp 90 network 2.2.2.2 0.0.0.0 network 192.168.1.0 no auto-summary ! Regards Siva Kondala Rao
... View more
Labels:
07-02-2012
01:36 AM
Hi, I have below log message in switch. Jul 2 12:38:59.923 IST: %PM-4-ERR_DISABLE: invalid-policy error detected on Fa0/15, putting Fa0/15 in err-disable state Jul 2 12:38:59.939 IST: pm_start_recover: invalid operErrReason for Fa0/15 Jul 2 12:39:00.946 IST: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/15, changed state to down Jul 2 12:39:01.944 IST: %LINK-3-UPDOWN: Interface FastEthernet0/15, changed state to down ME-3400#sh policy-map int fa0/15 FastEthernet0/15 Service-policy input: Broadband_User Class-map: VOIP (match-all) 0 packets Match: access-group name VOIP police aggregate voip conform: 0 (packets) exceed: 0 (packets) NOTE: Policing statistics for a class configured with an aggregate policer are the same for all classes in the policy-map configured with the same aggregate policer Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any police aggregate data conform: 27796 (packets) exceed: 0 (packets) NOTE: Policing statistics for a class configured with an aggregate policer are the same for all classes in the policy-map configured with the same aggregate policer Service-policy output: uni-out Class-map: class-default (match-any) 283252 packets Match: any Traffic Shaping Average Rate Traffic Shaping CIR 11111120 (bps) Output Queue: Max queue-limit default threshold: 48 Tail Packets Drop: 426 What is the reason for this error? Regards Siva Kondala Rao
... View more
Labels:
06-15-2012
09:32 AM
Hi Smitesh, Can you explain further: what are user EXEC terminal attributes? and I don't understand network connection authorization. when we will use it (can you give one example)? Your patience is appreciated. Regards Siva Kondala Rao
... View more
06-15-2012
07:58 AM
Hi, What is the difference between below two commands, I am interested to know only bold portion. aaa authorization exec default group radius none aaa authorization network default group radius none Regards Siva Kondala Rao
... View more
Labels:
06-01-2012
10:02 AM
Hi, When tagging customer traffic with Vlan284 on metro ethernet switch assigning COS 0. When same packet is hitting PE router where xconnect is configured I am trusting COS value, there policing customer traffic and assigning MPLS EXP 0. Forgot to post class-map configuration, please see below. On egress port towards core, this customer traffic is treated by Bronze class. 7609A# sh class-map Bronze Class Map match-any Bronze (id 2) Match dscp default (0) cs1 (8) Match mpls experimental topmost 0 1 Match ip precedence 0 1 I wanted to retain same behavior through out core. If you see 7609B configuration, it is configured to trust COS value. But I am sending packet with MPLS EXP 0 value. When happens to MPLS EXP value after received it by 7609B ingress port? I didn't see option to trust MPLS EXP value. Regards Siva
... View more
05-30-2012
10:38 AM
Hi, Scenario like below (Vlan284)Gi2/5 7609A GE-WAN3/1--------------------------- Gi2/4 7609B 7609A# interface gi2/5 switchport switchport trunk encapsulation dot1q switchport mode trunk mls qos trust cos ! interface Vlan284 mtu 4474 bandwidth 2000 no ip address load-interval 30 xconnect 120.124.0.1 1005931 encapsulation mpls service-policy input TEST_284 ! Policy Map TEST_284 Class class-default police cir 2000000 bc 375000 conform-action set-mpls-exp-imposition-transmit 0 exceed-action drop ! interface GE-WAN3/1 ip address 120.124.16.113 255.255.255.252 mls qos trust dscp service-policy output GE-Out ! policy-map GE-Out class Platinum priority class Gold bandwidth remaining percent 33 random-detect random-detect exponential-weighting-constant 13 random-detect precedence 4 5833 6667 10 random-detect precedence 6 3333 5833 10 random-detect precedence 7 3333 5833 10 queue-limit 16384 packets class Silver bandwidth remaining percent 53 random-detect random-detect exponential-weighting-constant 13 random-detect precedence 2 4167 6667 10 random-detect precedence 3 6667 7500 10 queue-limit 16384 packets class Bronze bandwidth remaining percent 14 random-detect random-detect exponential-weighting-constant 13 random-detect precedence 0 3800 5000 10 random-detect precedence 1 2200 3800 10 queue-limit 16384 packets ! 7609B# interface GigabitEthernet2/4 ip address 120.124.16.114 255.255.255.252 mls qos trust cos ! ------------------------------------------------------------------------------------------------------------- If you clear see the above connectivity and configuration, customer Vlan 284 is hitting Gi2/5 interface on 7609A device. Here we are trusting COS value and putting mpls exp 0 while sending customer packet out via GE-WAN3/1. But 7609B Gi2/4 is configured to trust COS value. As there in no COS value on non trunk port, what QoS action applies on customer packet upon receipt at 7609B Gi2/4 interface? Regards Siva
... View more
Labels:
07-06-2011
07:54 AM
Thanks Riccardo, what about fragmentation in below scenario. Router A (9192 MTU) --------------(1500 MTU) Layer 2 switch (9192 MTU) --------------(9192 MTU) Router B Regards Siva Kondala Rao
... View more
07-04-2011
10:33 AM
Hi, I have layer 2 switch with 1500 interface MTU between routers having having 9000 MTU. Does this layer 2 switch fragment >1500 packets? Router A (9192 MTU) --------------(1500 MTU) Layer 2 switch (1500 MTU) -------------(9192 MTU) Router B Also another connectivity is like below: Router A (9192 MTU) --------------(9192 MTU) Layer 2 switch (1500 MTU) --------------(1500 MTU) Router B how the fragmentation between Routers A and B? Regards Siva Kondala Rao
... View more
Labels:
03-21-2011
06:08 AM
Hi, I am trying to understand below config. 3750#sh run int gi1/0/1 Building configuration... Current configuration : 457 bytes ! interface GigabitEthernet1/0/1 switchport trunk encapsulation dot1q switchport mode trunk load-interval 30 srr-queue bandwidth share 10 30 30 30 priority-queue out mls qos trust cos storm-control broadcast level bps 500k storm-control action trap hold-queue 2048 in hold-queue 2048 out ip dhcp snooping trust end My understanding is switch rate limits brodcast traffic at 500kb/s. But look at below cisco documentation. When a storm occurs and the action is to filter traffic, if the falling suppression level is not specified, the switch blocks all traffic until the traffic rate drops below the rising suppression level. If the falling suppression level is specified, the switch blocks traffic until the traffic rate drops below this level. Is there chance to block other traffic (unicast/multicast) during broadcast storm rate higher than 500kb/s. I am confused with term 'all traffic' from above cisco documentation lines. Also don't understand purpose of falling threshold. Regards Siva K
... View more
Labels:
03-02-2011
08:11 PM
Hi, I am trying to debug vrf bgp neighbor in cisco 7609 [12.2(33)SRD4]. I am unable to find vrf neighbor option. I could see command for all vrf neighbors. 'debug bgp vrf * all' and common command debug ip tcp transactions. Is there any other option for vrf neighbor alone debugging. Regards Siva K
... View more
Labels:
02-08-2011
09:18 AM
Hi, I have cisco switch model WS-C3750G-12S-D. It is in transparent mode. I am getting below error message when tried to create new vlan. Proposed configuration exceeds the limit of 1005 VLANs that can be supported on this platform. Reduce the number of VLANs proposed to be within this limit. After deleting few unnecessary vlans, it allowed me to create. 3750#sh vtp status VTP Version : running VTP1 (VTP2 capable) Configuration Revision : 0 Maximum VLANs supported locally : 1005 Number of existing VLANs : 959 VTP Operating Mode : Transparent VTP Domain Name : VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0xBC 0xA7 0xEC 0xDE 0x36 0x6C 0x61 0xB4 Configuration last modified by 97.193.17.172 at 0-0-00 00:00:00 I confused with terms 'maximum supported vlans' and 'maximum locally supported vlans'. If switch is supporting vlans 1-4094 means it should also allow to create locally. Otherwise how they will pass through the switch trunks without local creation. Regards Siva K
... View more
Labels:
12-09-2012
Hi All,Can someone suggest free full length URLs for below IEEE
standards:802.3d802.3w802.3s802.3adR...
11-28-2012
Hi All,I have setup is as below.L2 switch ingresss qinq connecting to
customer ---------------------...
11-27-2012
Hi All,I wanted to create PE to PE traffic engineered tunnels with
guaranteed bandwidth using mpls e...
10-16-2012
Hi Nick,I am able to ping tunnel source IP address. I gave " ip nhrp
holdtime 5"I am seeing below me...
10-16-2012
Hi,I am trying to check DMVPN on below back to back setup. IPSec is not
coming up.R1 Fa1/0 [switch p...
07-02-2012
Hi,I have below log message in switch.Jul 2 12:38:59.923 IST:
%PM-4-ERR_DISABLE: invalid-policy erro...
06-15-2012
Hi Smitesh,Can you explain further: what are user EXEC terminal
attributes? and I don't understand n...
06-15-2012
Hi,What is the difference between below two commands, I am interested to
know only bold portion.aaa ...
06-01-2012
Hi,When tagging customer traffic with Vlan284 on metro ethernet switch
assigning COS 0. When same pa...
05-30-2012
Hi,Scenario like below(Vlan284)Gi2/5 7609A
GE-WAN3/1--------------------------- Gi2/4 7609B 7609A#in...
07-06-2011
Thanks Riccardo, what about fragmentation in below scenario.Router A
(9192 MTU) --------------(1500 ...
07-04-2011
Hi,I have layer 2 switch with 1500 interface MTU between routers having
having 9000 MTU. Does this l...
03-21-2011
Hi,I am trying to understand below config.3750#sh run int
gi1/0/1Building configuration...Current co...
03-02-2011
Hi,I am trying to debug vrf bgp neighbor in cisco 7609 [12.2(33)SRD4]. I
am unable to find vrf neigh...
Public Statistics
| Date Registered | 12-08-2009 05:24 AM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 26 |
.jpg "Hall of Fame Master"){kind=icon}
