The core of the question, is this possible?  I'm a beginner in the networking field, but I've found myself assisting with the configuration of EVPN across a service provider network. The rest of my team are somewhat new to EVPN in general, but do have a working config up inside the core parts of the network. Currently, we have EVPN working between NCS5501's and ASR9901's. With two ASR9901's acting as BGP "servers," if that's the right word. The 9901's act as route-reflectors as well and ensure that all the NCS5501's have the know the MAC addresses associated with whatever Bridge-Domains they are a member of. OSPF is used to glue all the nodes together. We are upgrading what was an old flat network into a purely layer 3 network. However the process isn't happening all at once and we need the new equipment to work with their old equipment while it's getting phased out. Hence the layer 2 network on top of the layer 3 network.   I'm trying to figure out how the ASR920s we have will fit into this environment. We originally wanted to use them as EVPN endpoints. But as I keep looking it up, I'm not sure if my understanding is just too low right now or if it just isn't possible on the ASR920. But it looks like it's not possible. Is this the case? The NCS5501 and ASR9901 are running IOS-XR obviously while the ASR920 runs IOS-XE. The syntax in the configuration is clearly different at the very least.   If anybody has done anything similar to this the help would be appreciated.   Thanks! ... View more

Hi Everybody,   How many of you have some experience with the Cisco My Notifications? Found in Menu>Support>Tools and Resources>My Notifications.   Recently we had a problem where some software went out of date on an ASA and it got power cycled remotely by an attacker. It's pretty likely you might have heard of this problem as there was a large flair up of attacks around December. The issue was patched in an earlier software release though. However, we didn't know this was out. You all know how it is, putting out fires all day it can be difficult to be proactive. Well the ASA going down was very inconvenient and we are trying to automate these sorts of things so we know when a patch is released. We subscribed for daily notifications a couple of days ago, but we haven't been getting any notifications. I'm not sure if we are supposed to be getting notifications only when there is something new or not. I figured it would notify us daily and it would say whether there is news or not.    The RSS feed feature interests me too, but it doesn't say how to bind it to your client, has anybody got experience with this as well?   Thanks in advance for the help! Chris ... View more

Hi All,   Our team is working on deploying some NCS5501's. We are brand new to IOS-XR and mostly it's been going pretty well, minus some smart call home bugs that are supposed to be fixed in 7.1.0...   However, one of our routers is running into this strange error that prevents any user database changes from being committed to storage. On any power cycle the user database is completely reformatted and we have to create a new user and password to get in. It does keep it's startup config just fine otherwise. It used to be working just fine, but this started when I tried to add a new user.   The error references a specific directory too, but it isn't present on the device as far as I can tell.    File error detected (disk/file may be corrupted): path /mnt/fuse/rdsfs/aaa/__lr__/__root%%, error: 'LOCALD' detected the 'fatal' condition 'The contents of a file or disk is corrupted'   Assuming they are referencing the base path, disk0:/, this path doesn't seem to exist. In the "priv exec" context, the directory rootfs:/mnt/ does exist, but can't be looked in. Inside of the "admin" context, it also exists, but only contains a directory called "plog". I'm not sure what that is.    Inside the IOS-XR SEM guide it mentions just making the directory inside of disk0:/. But I'd like to get some more context of what happened before I do something like that. On an NCS that does currently work just fine, the directory's look just the same as the non-working one.   I think that's everything I've checked, if anybody has seen and resolved this before, let me know how you did so!   Thanks! Chris ... View more

Hi Everybody!   I'm new to the field and new to my current place of work and that place of work is new to everything related to smart licensing, smart call-home, etc. Nobody here has touched IOS-XR until a month ago also. I am almost CCNA RS level knowledge wise. I have been tasked with getting the new NCS5501's we are installing to pull their smart licensing information. I've read the documentation on the NCS5501 relating to this process, but I'm clearly missing some dependencies...   Currently I have a test router configured with only the purpose of succeeding the SCH and pulling its smart license. I have a single port configured, the MgmtEth0/RP0/CPU0/0. It gets a DHCP address from our network and NATs out to the greater internet. The router is configured with a single ipv4 af static route to go to our default gateway.    I've configured the following: domain name-server 4.2.2.2 ! http client vrf default http client source-interface ipv4 MgmtEth0/RP0/CPU0/0 fpd auto-upgrade enable ntp server 74.6.168.73 server 107.155.79.108 server 129.128.12.20 server 174.94.155.224 ! call-home service active profile CiscoTAC-1 active anonymous-reporting-only reporting smart-call-home-data ! ! interface MgmtEth0/RP0/CPU0/0 ipv4 address dhcp   I've confirmed the following: NTP syncs successfully. I can reach tools.cisco.com with a ping as well as a port 80 and port 443 telnet.   Yet whenever SCH attempts to reach cisco it reports back with an SSL error. There must be a dependency I'm missing somewhere. Is there something I need to do CA wise? Do I need to define one? When you do commands like checking for CRLs or certificates it appears there are none in the router.   Specifically I get this: RP/0/RP0/CPU0:Nov 12 18:47:32.667 UTC: http_client[166]: %SECURITY-XR_SSL-3-CERT_VERIFY_ERR_2_PARAM : SSL certificate verify error: Error in fetching the issuer certificate/CRL 'Crypto Engine' detected the 'warning' condition 'Key data missing'   A "call-home trace all" gives me the repeating information. Seems to me to be saying, it reaches out, gets something back, writes it to a temp file, realizes it can't decrypt it, then throws it away. 4 Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 HTTP req data free Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 httpc_file_resp_read: read http reponse "/tmp/call_home_http_1626434436.resp" Nov 12 18:47:58.513 call_home/error 0/RP0/CPU0 t5414 httpc_file_resp_read: "/tmp/call_home_http_1626434436.resp" size is zero Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 httpc_file_del: remove file "/tmp/call_home_http_1626434436.resp" Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 httpc_file_del: remove file "/tmp/call_home_http_1626434436.post" Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 call_home_http_resp_data() status = 24 Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t5414 call_home_set_httpc_resp_status: is entered. tid (15), status (324), err_string () Nov 12 18:47:58.513 call_home/error 0/RP0/CPU0 t5414 call_home_http_resp_data(), httpc response error, Error during SSL communication Nov 12 18:47:58.513 call_home/trace 0/RP0/CPU0 t14985 call_home_remove_httpc_resp_node() is entered Nov 12 18:48:08.513 call_home/trace 0/RP0/CPU0 t14985 send_one_http_msg() is entered, url = https://tools.cisco.com/its/service/oddce/services/DDCEService Nov 12 18:48:08.513 call_home/trace 0/RP0/CPU0 t14985 call_home_httpc_post() url https://tools.cisco.com/its/service/oddce/services/DDCEService, sid 1, len 10466 Nov 12 18:48:10.615 call_home/trace 0/RP0/CPU0 t14985 call_home_httpc_post: HTTP send successfully Nov 12 18:48:10.615 call_home/trace 0/RP0/CPU0 t14985 call_home_wait_for_httpc_resp() is entered Nov 12 18:48:10.615 call_home/trace 0/RP0/CPU0 t14985 call_home_add_httpc_resp_node(): is entered Nov 12 18:48:11.479 call_home/trace 0/RP0/CPU0 t5414 call_home_http_resp_data(): Received response for (nil) tid 16 sid 1 status 24   When I google this error I get pretty much no information, I must be missing something so basic it's not even worth mentioning. I can't seem to figure it out though... I don't have any Security background which probably isn't helping me solve this problem. Only RS. Any help would be greatly appreciated. Thanks in advance! ... View more