9

I got response from Cisco Tech support and there are a few things not correctly described in the manual. First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up to 2048 bit key). Second, only the key part of SSH public key must be 'de'coded w/ base64 en/decoding program. SSH Key Generation ssh-keygen -b 1024 -t rsa -f ...


9

Have you tried walking the MIB/OIDs in question from a management station? After having spent a lot of time w/firmware QA, I've noticed things like show commands are likely to not display correct info, even when the OIDs are poll-able. I recommend using and knowing Net-SNMP tools and utils as debug before trying to poll the information in cacti, observium, ...


7

For the ASR 1K, Advanced Enterprise Services is needed to support "legacy protocols" (IBM, IPX, etc.), but for IP protocols, including IPv6 and BGP, Advanced IP Services should be adequate. See the following links for more information. Cisco IOS Packaging Customer Q&A Ordering ASR 1000 Software ASR 1000 router Q&A


6

capability vrf-lite is missing under router ospf This article has a good explanation. Essentially, the command tells OSPF to ignore the DN bit and use the LSA in the SPF calculations. https://supportforums.cisco.com/discussion/12754196/where-configure-capability-vrf-lite-ce-or-pe


4

The mib 1.3.6.1.4.1.9.9.91 works on ASR1001s at least. Running the following from my monitoring box: snmpwalk -v2c -c <community-string> <asr1001-name> 1.3.6.1.4.1.9.9.91 Gives an output of: CISCO-ENTITY-SENSOR-MIB::entSensorType.4 = INTEGER: amperes(5) CISCO-ENTITY-SENSOR-MIB::entSensorType.5 = INTEGER: voltsAC(3) CISCO-ENTITY-SENSOR-MIB::...


4

As pointed out in the comments while the drop count looks high, when compared to the total traffic it is actually quite low. The output drop rate is 2.4e-5 or 0.0024% so if the drops occur at regular intervals your test stream would experience a missed packet approximately every 41.7k packets sent. Even multicast should have no trouble recovering from a drop ...


3

The above requirement worked for me using the below command on ASR9k logmsg [your message]


3

You configured the SSH server to be active in the default vrf: ssh server vrf default So changing the vrf should help: ssh server vrf mgmt If that doesn't help, please consider adding more information to your question like debugging results and log messages. "Doesn't seem as straight forward" doesn't explain the exact problem you're running into very ...


3

You need the following: Plug an ethernet cable from the cisco 3750 into the ASR's MGMT ETHERNET port Ensure the ASR MGMT ETHERNET cables are in mgmt_vlan on the 3750 Ensure the mgmt_vlan with 10.0.0.0 is in the Cisco 3750's global routing table Put an IP address on the MGMT ETHERNET GigabitEthernet0 port of the ASR's RP After you've checked those things, ...


3

There is no actual factory reset like there is on a consumer-grade router. You must perform a password recovery, then you can erase the startup configuration and reload. See the detailed instruction in the link above to get into enable mode, then you can: erase startup-config After that: reload Do not save the running configuration when prompted.


3

Check out the Feature Navigator on Cisco's site. I've found this to be the only way sometimes to compare which feature is available in each image/license level. Choose the feature(s) you're looking for from the list at the left, then click continue. After that you'll be able to drill down into the IOS-XE platform -> ASR1001. You should be able to tell ...


3

Problem solved: Somewhere along the troubleshooting path the SFP was removed and reinserted without rebooting the router. We tried a reboot today and the interface came up successfully. I don't know if this is a documented behavior or not, but it makes sense - try a reboot if all else fails.


3

The issue is right here in your database output: Options: (No TOS-capability, DC, Downward) At the point of redistribution the Down bit is being set as a loop prevention mechanism. By itself this wouldn't necessarily be a bad thing but you're also clearing the domain tags that are otherwise being set at the point of redistribution. This mechanism is ...


3

Yes those dropped packets would factor into available throughput, and this is because ACLs are processed by the ESP [Embedded Services Processor] which measures bandwidth. All those packets are being processed by the ESP. Anything beyond the licensed throughput during that point in time will not be processed. This includes both good and malicious traffic. ...


2

You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel) GRE tunnel key (id), so the ASR can differentiate between them. You can choose to use the same IPSEC profile (you'll need the 'shared' keyword on the end of ...


2

Solution: Talked to Cisco TAC support and they found rommon (Firmware Version) has bug, and they upgrade following two component R1#upgrade rom-monitor filename bootflash:asr1000-rommon-155-3r.S1.pkg R0 R1#upgrade rom-monitor filename bootflash:asr1000-rommon-155-3r.S1.pkg F0


2

i find a success method to policy a traffic of Specify ip's or else on CISCO ASR 903 IOS XE 3.18S for example i have ip's 74.0.0.0/8 for some serivce (Like google) 1-subnet a full range from 1.0.0.0/8 to 255.0.0.0/8 and Cust your ip('s) you want enter link description here 2-now you have two range 1.0.0.0/8 2.0.0.0/7 4.0.0.0/6 8.0.0.0/5 16.0....


2

I'm trying to decode what you're doing, but I think I'm reading something like the following- You're using VXLAN-EVPN on the N9K's and the ASR9K's. The Nexus boxes are acting as standard VTEP's providing L2/L3 services while the ASR's are basically border leaves. The 3750's are pure L2 devices that pick up trunks from the upstream 9K's and break out ...


2

You have a typo in your route: 0.0.0.0/8 10.7.0.1 should be 0.0.0.0/0 10.7.0.1


1

Yeah, to hide Cisco router itself from traceroute output, create extended ACL that denies time-exceeded ICMP requests. (config)# ip access-list extended 111 (config-ext-nacl)# deny icmp any host <IP_OF_ROUTER> time-exceeded log (config-ext-nacl)# permit any any (config-ext-nacl)# exit (config)# interface <NAME> (config-if)# ip access-group 111 ...


1

you can create an ACL in order to deny icmp time-exceeded (deny icmp any any time-exceeded), and apply it on the interfaces. EDIT : to understand why you should block time-exceeded you can enjoy reading this very detailed post http://www.slashroot.in/how-does-traceroute-work-and-examples-using-traceroute-command


1

You can set the config register, then reset to boot up with the image on the device, ignoring the startup-config: rommon 1 > confreg 0x2142 rommon 2 > reset Once you have it booted up, you can load any image for which you have purchased a license from Cisco.


1

The send command is used to send messages between users logged into the same router. send - To send messages to one or all terminal lines, use the send EXEC command. send {line-number | * | aux number | console number | tty number | vty number} Syntax Description Defaults No messages are sent. Command Modes EXEC ...


1

You have a problem with this command: ip route 192.198.3.64 255.255.255.252 GigabitEthernet0/3 That interface has no IP configuration: interface GigabitEthernet0/3 mtu 1500 no ip address negotiation auto cdp enable ! The FastEthernet0/0 interface already has the IP addressing for the 192.198.3.0/24 network that encompasses the 192.198.3.64/30 network ...


1

Configuring Bidirectional Forwarding Detection on the Cisco ASR 9000 Series Router Restrictions for Configuring BFD The following restrictions apply to BFD: If you are using BFD with uRPF on a particular interface, then you need to use the echo disable command to disable echo mode on that interface; otherwise, echo packets are rejected. You can disable echo ...


1

if BFD Session Not Coming Up, may you follow the next steps to overcome this issue: Was the session created by the application? Use the "show bfd all session" command to see if the session has been created. If the session is not visible using the bfd show command, check that the adjacency for which the BFD session is being created exists in the application....


1

You can search Cisco for this type of information. For instance, the Cisco document, High Availability Overview, has a table: Hardware Redundancy Overview on the Cisco ASR 1000 Series Routers Some models of the Cisco ASR 1000 Series Routers offer hardware redundancy within the same Cisco ASR 1000 Series Router through the following methods: ...


1

A reboot should not be the right answer, especially with that kind of network equipment. Next time you should try: conf t int tengig0/0/0 shut do show log no shut


1

Transceiver Rx optical power = -3.9 dBm, looks to be within acceptable parameters. "show int te0/0/0 transceiver detail" will confirm if DOM is supported on the chassis. Transceiver is a SFP+ so it supports DOM. Are you doing a long haul back to XO's location or did XO bring in something a Cisco ONS 15454 on premise to drop off a local 10g interface to you? ...


1

Looks like it was an issue with nc, works fine with telnet :/


Only top voted, non community-wiki answers of a minimum length are eligible