Hot answers tagged

8

This configuration works on our other switches, but it doesn't work on this 4500. You're using the on-board Sup7 FastEthernet port, so this is your problem: aaa authentication login default group tacacs+ local ^^^^^^^^^^^^^ The Sup7 OOB port is in a VRF; therefore, you have to configure Tacacs+ in a VRF aaa new-model ! no ...


7

Each fills a different purpose and all three may be part of an overall solution. Lets start with the oldest concept first. Subnets are the IP worlds way of determining what devices are "assumed to be on-link". Devices within the same subnet will send unicast traffic directly to each other by default while devices in different subnets will send unicast ...


7

If no DHCP clients are connected directly to your distribution or core then you wouldn't need to configure DHCP snooping there. You would just configure your access layer switches to untrust every port except for your uplinks to the distribution switches.


7

With a bit of VRF-lite and VRF-aware-NAT and the help of the Cat-3850's routing capability, here's some config snippets that should work, or at least get you halfway there - all based on the diagram you showed. A few caveats: This example assumes that the Cat-3850 may act as L3 switch and that it can route at least between directly attached subnets/vlans. ...


6

Summary is this on the right track? Yes... very similar to the link in the comment... As you mentioned, you only need to do two things... Configure NAT overload on the global interface Put a static route in the VRF for the speed test server... Details Assume your speed test server is at 172.16.10.5... and you're trying to ping it from a CE switch in ...


6

You have two questions here. Can two networks with the same subnet be connected to the same router in different VRF? Yes, as long as the two domains (VRF A and VRF B) do not communicate with each other. Think of a VRF as a virtual router. What would happens if I set up BGP to exchange route between the two VRF? Things will not work, because ...


5

Documenting to help future googlers, since I could find no information about Mgmt-vrf online... I managed to find the solution while I was typing the question above. I remembered that the Sup7Es had IOS-XE 3.2.2 loaded when I pulled them out of the boxes; the other important fact was that 3.2.2 would not turn up the OOB interface on FastEthernet1 while I ...


5

VPNv4 is the "transport". Your VRF route-targets match on both devices. Long story short, RT is extcommunity that is sent over VPNv4 session in BGP update. If one of local import RTs matches received extcommunity, routes are being imported in VRF with this RT configured. Actually VPNv4 is quite complex and complete explanation is beyond the scope of this ...


4

This would be a good fit for a VDC but looking it up I dont see the ASR supports VDCs, unless Im missing something. VRFs are going to give you route table separation and should do the job quite well as long as you insure routes do not bleed between VRFs. Since this is a virtual ASR could you not stand up a second and have it dedicated to the second AS? ...


4

IP subnets and VLANs are not mutually exclusive -- you don't choose one or the other. It most cases, there is a one-to-one correspondence between VLANs and subnets. In your first example, assuming you're using IP, you are still going to have to assign IP subnets to the VLANs. So you would assign a separate IP subnet to VLAN 1 and 2. It is up to you ...


4

1) How many virtual router [routing instances] can be created on the QFX5100? The QFX5100 platform currently supports up to 512 virtual router routing instances. 2) How many VRF [routing instances] can be created on the MX480? There are a few variables you may want to consider, (both software and hardware) namely the number of routes, routing ...


4

There are few options for you to route the traffic between VRFs. Below are two of them: The first option is to use MP-BGP (Multiprotocol BGP) with RD (Route Distinguisher) and RTs (Route Targets). The second option is to use static routes and make use the global (default) routing table. I wrote a blog post about this option on my blog Netlabbuilder. There ...


4

Would I have to first leak my VRF routes into the GRT to do this? Yes, you need to leak the routes. But this is not enough. You also have to leak (at least some of) your GRT routes into the VRF for the return traffic. Also, you need to provide a data path for the actual traffic.


4

traceroute works by using probe packets with increasing TTL values. The hop where a packet's TTL times out is supposed to return an time exceeded ICMP message which is processed and displayed by traceroute. If a hop doesn't decrement the TTL you simply don't see it. Apparently, PE2_2 doesn't decrement TTL in that path - without the (sanitized) configuration ...


4

That is how MPLS works. The packet doesn't get routed at that point, it is label switched. Traceroute works by having the packet TTL expire and an ICMP message is sent back saying that the packet expired. Routers will decrement the TTL as they route the packet. MPLS doesn't route packets, it places labels on the packet and switches based on the labels. That ...


4

The solution seems to be to use rib-group. I always assumed rib-group and instance-import were interchangeable though, as the name suggests, rib-group works in the RIB whereas instance-import only works on the FIB. Syntax is significantly more complex but it's nice in such that you can apply rib-group to individual BGP peers which avoids the need to ...


3

Cisco routers have a feature called VRF aware IPSec. It is available in version 12.2(33) and later. Here’s a brief introduction. Other companies may have similar features.


3

TL;DR Be very careful with that idea, unless you know EXACTLY what you are doing. Longer: A) Adresses are in VRFs It will cause no harm if these sets of loopback interfaces are on PE routers (or multi-vrf CEs) AND are part of different VRFs each (since were' talking about MPLS-VPN, here). In other words: IF each customer (VRF) gets their own set of ...


2

Complexity is reason enough to use a simpler option if one is available. In this case, I'd recommend connecting each firewall to only one router and one Internet connection. GLBP would then be used for load balancing/fail-over. Tie GLBP to an IP SLA monitor for the Internet connection the router provides access to and you're finished.


2

IPv4 and IPv6 operate as 'ships in the night' as far as routing is concerned, so I see not benefit to separate VRFs with ipv4 in one and ipv6 in another. Also any dual stack hosts would need separate interfaces or separate tagged VLANs to operate dual stack. Now if you are concerned about RAM in the router VRF will not help that, for that concern route ...


2

Depending on the hardware you're talking about you should take different considerations. For instance Cisco provides a dedicated set of port/RAM and flash for OOB access on SUP2T, so you would be able to access to your device even when RP hangs. OTOH, in some Juniper boxes, the management port is attached directly to the RE and so you should easily hang ...


2

Since you have enabled OSPF on the connected interface, it will be an internal route for the networks behind the CE1. But all OSPF routes on the CE1 side will be external routes on the CE2 side, because they all are redistributed to/from mBGP. To make them internal, you need a sham link. Administrative distance doesn't really come into play here. AD ...


2

Have you checked the debug outputs for l2x, ppp, radius? One thing I see is that you should set ip unnumbered on your Virtual-Template. ip address negotiated means your end will try to get an address from the client, when you should be offering one to them (via the Framed-IP-Address and Framed-IP-Netmask attributes in the RADIUS Access-Accept) First create ...


2

it is depend you must verify the current CPU usage before any routing edit , if it is in suitable rang (not exceed 10%-15% ) then you can start to create VRF routes if you create all your routes in one router you will get one benefit and one drawback. benefit is that you can point to this router by only one route from your core layer , drawback is that you ...


2

Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's all they need.


2

VLAN's are said to isolate broadcast and failure domains. A single subnet is typically configured per VLAN and sets the IP (layer3) addressing. VRF separates route tables on the same device.


2

I'm not familiar enough with Dell routers to know if you can have address families in OSPF. But even if you can, OSPF is a poor choice, because it's difficult to filter advertisements--each VRF will learn the routes of the other VRFs through the common VRF. BGP would make more sense since it allows you to control what routes you advertise. But there are ...


2

Use the command neighbor x.x.x.x allowas in This tells the router not to discard prefixes with its own ASN in the path.


2

You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel) GRE tunnel key (id), so the ASR can differentiate between them. You can choose to use the same IPSEC profile (you'll need the 'shared' keyword on the end of ...


Only top voted, non community-wiki answers of a minimum length are eligible