18

In most modern versions of IOS (since 12.2(8)T - thanks @ytti) BGP synchronization is disabled by default (and shown in the running config as such, ie no synchronization shows up in show run when you turn on BGP). As to which IOS version they decided to make it a "hidden default", I'm not entirely too sure, but you should be able to do: show running-config ...


15

From the configuration guide: Frames sizes that can be received by the switch CPU are limited to 1998 bytes, no matter what value was entered with the system mtu or system mtu jumbo commands. Although frames that are forwarded or routed are typically not received by the CPU, in some cases packets are sent to the CPU, such as traffic sent to control ...


13

That should work. Either that or use something like: R1(config)#ip access-list extended MATCH-ALL R1(config-ext-nacl)#permit ip any any R1(config-ext-nacl)#class-map type inspect match-any CM_MATCH-ALL R1(config-cmap)#match access-group name MATCH-ALL R1(config-cmap)#policy-map type inspect PM_IN->OUT R1(config-pmap)#class CM_MATCH-ALL R1(config-pmap-c)#...


13

Try this: show platform hardware interface ten1/1/31 statistics That should show you input bytes by CoS. The 4500 is a very different beast than the 3560/3750 for qos config and monitoring. Some other useful verification commands are: show platform hardware qos interface foo X/Y shows queue lengths and flow counts show interface foo X/Y counter detail ...


13

If your switch supports it (not all IOS versions do), the following command should fix this for you: no aaa accounting system guarantee-first Here is an article that goes into more depth: Would you mind waiting for 2-3 mins in a console? And a bit from Cisco's documentation: Establishing a Session with a Router if the AAA Server is Unreachable ...


13

Cisco IOS is the standard operating system from Cisco. It runs on 800/1800/1900/2800/2900/3800/3900/7600 routers. It also runs on Catalyst 2960/3560/3750/4500/6500. Some newer platforms such as Catalyst 3650 and 3850 run IOS XE which is IOS running as a daemon on a Linux kernel. Then you have NXOS which runs on the Nexus platform. IOS XR runs on the SP ...


12

Using a VRF is like using a seperate router. If you have the same WAN IP for both VRF's, then you have to configure it twice in both WAN interfaces. If you however only use one WAN interface, you'll have to divide this interface by trunking (using VLAN's) or subinterfaces. ex: interface FastEthernet0.5 encapsulation dot1Q 5 ip address 1.1.1.1 255.255.255....


12

You are running into one of the fun, new, restrictions of the ISR Generation 2. I assume you have the basic "security" licensing package installed as noted by this part of the message: securityk9 technology package license However the securityk9 package is Cisco's "unrestricted export" version of that license, and will artificially limit you. You need ...


12

(Examples performed on ISR 1921 G2) Before we get into the details, I would suggest that instead of backing up your key, you just pull the new key from the new router and update your scripts. You will need to get onto the router without SSH to load the config/enable SSH anyways. This can be done with a script and console cable... you can even pull the new ...


11

Backing up the host keys to replace them is more trouble than it's worth. If you don't want your scripts to barf on key changes (in *nix), run ssh like this... ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no username@hostname This tells the ssh client to use an empty Known Hosts file and do not force strict key checks. As mentioned in the ...


9

There is loss, you're just not seeing the impact. The display is only showing 155706 input errors out of 46982598919 packets in the previous three days and four hours. This is .0003% packet loss, which is why it's so difficult to see first hand during testing. If you're not seeing any operational impact, odds are that this can be safely ignored. Such a ...


9

Technically, you're doing PPPoEoA. The VC Mux part will have to be set on the modem, as that's the only thing that has access to the ATM layer. If you had a dsl interface in the router, you'd do: blue-gw#show run int atm0.1 Building configuration... Current configuration : 131 bytes ! interface ATM0.1 point-to-point bandwidth 6000 pvc dsl 8/35 ...


9

As far as I know data you want is not available on SNMP. 3750#sh mls qos interface FastEthernet0/1 statistics ... output queues dropped: queue: threshold1 threshold2 threshold3 ----------------------------------------- queue 0: 0 0 0 queue 1: 100989 0 0 queue 2: 0 0 ...


8

You can disregard the dedicated management interface and simply assign an IP address to the VLAN 500 interface on the switch and use this IP for management purpose, with appropriate access lists. FE0 is useful for out of band management. Nothing prevent you to perform in-band management without it.


7

I haven't tried it yet but there is a GitHub repo someone made for Cisco IOS Syntax Highlighting for Sublime Text 2.


7

I've attempted many time to setup DNS doctoring but I just cant get it work, I believe because our ISR doesnt have the capability to peform the commands I'm trying Your first problem is that you're using Cisco ASA commands on a Cisco router; you're also assuming this is a problem with your Cisco router. In reality, this is a DNS issue that can be solved ...


6

Taking a shot in the dark here because there are a lot of variables you didn't mention. Please update the question to include the specific technologies you are using, your currnet config, and the error you are getting. But if you are using for instance, DMVPN + EZVPN, you will probably have to use keyrings and multiple ISAKMP profiles. Since you point to ...


6

From the Cisco website: Universal images with the universalk9_npe" designation in the image name: The strong enforcement of encryption capabilities provided by Cisco Software Activation satisfies requirements for the export of encryption capabilities. However, some countries have import requirements that require that the platform does not support any ...


6

I tried searching in many ways but could find any http://www.cisco.com/go/fn Cisco Feature Navigator -> Research Software Select Software Type: "IOS" Select your desired Major Release, and Release. The "Platform" drop down will then include every platform that is designed to run that release. If you have a specific platform in mind, select "platform" ...


6

capability vrf-lite is missing under router ospf This article has a good explanation. Essentially, the command tells OSPF to ignore the DN bit and use the LSA in the SPF calculations. https://supportforums.cisco.com/discussion/12754196/where-configure-capability-vrf-lite-ce-or-pe


5

This is often a confusing topic for users new to SVIs as it does seem to work a bit counter intuitively. Most people have a tendency to look at the SVI as some sort of "gateway" and that traffic leaving the VLAN should be outbound and vice versa. However, it actually works in the opposite way because the SVI is a virtual router interface. It can help to ...


5

Bidirectional Forward Detection (BFD) has been deactivated on virtual and dialer interfaces on newer IOS and IOS-XE versions. On earlier releases like IOS-XE 3S, the Cisco IOS software incorrectly allowed configuration of BFD on virtual-template and dialer interfaces; however, BFD functionality on virtual-template and dialer interfaces is not ...


5

Is there any compatibility issues with the firmware version 15.0.2-SE11 between the following devices? There are no compatibility issues, as long as the software and basic model is identical. You can mix various types of switches and we use that feature a lot in our organization. I see on the Cisco site that for both types of switches they offer the ...


5

This happens when something downstream of the switch doesn't understand CDP and mishandles the traffic. So, something is connecting 2/0/5 to 4/0/6; chase the wiring and you'll find it. (someone has a dumb switch, or dumb VM leaking traffic)


4

If you use VRF's then it is possible to make a hub & spoke VRF using just one router without the need for MPLS. You need to use BGP but this doesnt need to peer with anyone, it is used simply to route between the VRF's. What you would do it something like... ip vrf GUEST rd 100:1 route-target export 100:100 route-target import 100:200 ip vrf CORP ...


4

They only support BVI1. This wasn't enforced either by bug or whatever in 12.X but in 15.X any extra BVI breaks management access. Worked with TAC on this issue over a week period. Can reproduce the issue on any of the APs with 15.X. So a simple no int BVI50 should fix the original config. Plus a reload after making the change. Made a couple edits now that ...


4

You're seeing CRC and framing errors and general input errors. If this happened while setting up the port this could be caused by people still fiddling with the fiber. If this happens during normal operation most of the time it indicates a low light level or some other error with the fiber(s) or optics. You can check the light levels with show interfaces ...


4

Testing that kind of features using GNS3 is simply waste of time. You're emulating at run-time complex software, and on top of that, you're adding complex features. There's no sense in 'trying' 7200 as 7200 are long EoS: http://www.cisco.com/c/en/us/products/collateral/routers/7200-series-routers/end_of_life_c51-681414.html Download CSR 1000v and test in ...


4

They have a pretty simple writeup over at Networklessons, but in-depth information on how it works are on Cisco's site. It can be as complicated and secure as you want it. Your 2 questions are one and the same. A barebones config would be like this: Create a group R1(config)#snmp-server group MYGROUP v3 priv Attach a user to a group R1(config)#snmp-...


4

Think of all the ports in the vlan as being one port, traffic between them never hit the vlan-L3 interface. Only traffic flowing between vlan's hit the vlan-32 ACL. Thus traffic from vlan-X to vlan-32-host will be seen as outbound by the vlan-32 ACL. And traffic from a host in vlan32, that hits the GW on it's way somewhere else will be inbound.


Only top voted, non community-wiki answers of a minimum length are eligible