Cisco WAN :: 7200 - BGP Multi Ingress / Egress QoS
Nov 4, 2012
I have a question that so far I haven't been able to find a suitable answer for. This is focused from an ISP perspective. So suppose I have the following scenario:
I have a BGP transit area. On each edge of the my network I have a e BGP connection to the same client for redundancy. This client has his own ASN, iBGP and prefixes. I'm receiving the same NLRI from the client through both sides. Let's assume he's advertzing the prefix 10.10.0.0/16 through both ends. I'm receiving it with no problems and I'm passing it along to the next providers with whom I also have multiple ingress and egress points.
Something like this:
PROVIDER A PROVIDER A
| |
eBGP eBGP
| |
CLIENT A (ASN65100) --- eBGP --- MYROUTERA(ASN65200) ----- iBGP --- MYROUTERB(ASN65200) --- eBGP --- CLIENT A(ASN65100)
| |
eBGP eBGP
| |
PROVIDER B PROVIDER B
Let's say my client pays for a 10Mb. Both links are configured to 10Mb so that each can handle the load in case the other one fails and both are always active. So my question is:
How can I shaped or police the client's traffic across multiple points of entry on different routers so that it won't go beyond the 10Mb. The same scenario applies on how can I limit traffic coming from the providers A, and B destined to the client's prefix: 10.10.0.0/16.
I don't mean using MED, local-pref, weight. Sure I can funnel all the traffic through one single point, but consider that I'm also trying to move away from basic routing and more into PfR, which mean that I have more granular control of the flows. Perhaps there is a PfR service-policy or something that can work.
For this scenario I'm using 7200 as my routers. If there is a solution that assumes any other model don't hesitate to post it. TLDR; How can I police or shape across multi interfaces on different routers?
View 2 Replies
ADVERTISEMENT
Apr 14, 2011
I have a 2811 Router with two fast ethernet wic cards installed. I need traffic to go out one interface, but it's received back through another. Both interfaces have public IP's and the same subnet, and are connected directly to satellite modems. One can receive data / the other only send.
View 3 Replies
View Related
Aug 17, 2011
when using egress netflow (v9) and output marking.
The topologie : Server <-----> R1 1>-----<1 R2 2>----<2 R3
R2 is a 7200 with c7200p-adventerprisek9-mz.124-15.T11.bin What I'm doing :- R2 forwards ping packets from Server to R3. When they arrive on R2, icmp packets are marked with CS3
- I change the DSCP to CS4 on R2 before forwarding packet to R3. I'm using for that an output service-policy on the R2-2 interface like this : interface ATM2/0.36 point-to-point
ip address 192.168.1.1 255.255.255.252
ip flow ingress
ip flow egress
[Code]....
View 3 Replies
View Related
Dec 15, 2010
We have network consisting of approx. 8 7200's running LNS/MPLS/BGP and we provide predominantly private networks to clients(Majority of client networks are a mix of Ethernet tails and DSL).We have received a request from one client to support multicast - Having never implemented multicast, have a few questions:
1. Is is supported/possible to provide multicast within a vrf on 7200's?(From initial investigations, it appears to be)
2. Is it possible to only enable mutilcast in a vrf(i.e. not globally)?
3. Any recommended guides/best pratices?(Googling has revealed nothing really that is similiar to what we want to do)4. What are the potential ramifications?(Resource overhead, Security implications, anything else?)
View 1 Replies
View Related
Oct 28, 2012
I'm currently configuring per port policing on a 3560 and want to limit inbound traffic to 750mbit:
mls qos
access-list 1 permit any
class SET_IF
match access-group 1
policy-map SET_QOS
class SET_IF
[code].....
When I test the setup with iperf I always get different results when I change the nummber of parallel connections.Isn't there a way to limit the throughput regardless of the number of conns (INGRESS!) like with srr-queue bandwith limit?
View 2 Replies
View Related
Nov 29, 2011
As above, I got a problem with C3750e, ios c3750e-universalk9-mz.122-58.SE1.bin, when send AF41 traffic passing through it. My topolygy is as following
WAN link <----------> G0/0/2.100 - ASR1002 - G0/0/5 <---------> G1/0/1 - C3750e - G1/0/3 <--------> G0/0/1 - ASR1004
On this C3750e, I turned on mls qos, trust dscp on both G1/0/1 and G1/0/3 and no else is configured. ASR1002 G0/0/2.100, i applied the CB shaping fror AF41 traffic.
C3750e#sh mls qos
QoS is enabled
QoS ip packet dscp rewrite is enabled
C3750e#sh mls qos int g1/0/3
GigabitEthernet1/0/3
trust state: trust dscp
[code]....
Then, from ASR1004, i send ICMP traffic with TOS set to AF41 (136) and i found out that
1. The traffic is dropped on c3750e
sh mls qos int g1/0/3 statistics
GigabitEthernet1/0/3 (All statistics are in packets)
30 - 34 : 63 63 48 86 1534
2. The traffic never get hit into AF41 class in ASR1002 ? Why C3750e dropped this AF41 traffic? and what can I do to fix it?
View 1 Replies
View Related
Jun 22, 2012
I have couple C2960G and C3750. Is there any way to filter (on ingress port) type of traffic? I would like to allow IP only, and discard (i.e.) IPX, or other garbage, that any device can produce.I have tried to find something about this, but only thing I have found is feature : protocol filter, which doesn't seems to be working on my hardware.
View 6 Replies
View Related
Jun 2, 2012
why ip flow egress is not functioning on 7600?When I do "sho ip cach flow", I can see only inbound flows.
View 5 Replies
View Related
Sep 8, 2011
In regards to QoS profiles on the WLC. I have applied a profile to a newly created WLAN and set the Per User Bandwidth to 512k and it seems to be kicking in on the ingress only, this is supposed to work ingress AND egress or is it just designed to work one way? I have a 4402-25 with Cisco 3500 AP's and am running the 7.0.98 code. If it is designed to work one way only is there a different way to apply it ingress and egress simultaneously off the WLC?
View 3 Replies
View Related
Mar 16, 2012
i have a question regarding egress queuing on cat6500 modules. e.g. WS-X 6704 has 1p7q4t is egress-modell. my goal is to limit the priority queue to 15% of the available bandwidth. i can put weights on the wrr-queues and limit their ressources: "wrr-queue bandwidth 50 20 15 0 0 0 0." but this isn´t possible for the priority-queue. only available command is "priority-queue queue-limit 15" but this only restricts the buffer to 15%.
at the end of the day i want to prevent that the wrr-queues don´t have remaining bandwidth when the priority-queue is saturated.
is there an easy way to restrict the bandwidth of the priority queue or do i have to implement additionally some kind of policing?
View 5 Replies
View Related
Dec 6, 2011
I have a 7204VXR Router, with Neflow. The collection for all interfaces is ok, but one interface (Gigabitethernet 1/0), is not showing the egress traffic in the pictures. The configuration has "ip route-cache flow", ip flow egress, and ip flow ingress set. But, is not showing the egress traffic.
View 4 Replies
View Related
Feb 15, 2012
Problem: My traffic coming inbound appears to be marked but is not marked when egressing.
Setup:
Ingress from encoder G3/9->> Egress G8/1Default DSCP/COS map table (DSCP 24 is COS3)
Cos-dscp map:
cos: 0 1 2 3 4 5 6 7
------------------------------------
dscp: 0 8 16 24 32 40 48 56
1. Any reason COS 3 is not marked outbound on this traffic? I'm determining this by doing a wireshark off of interface g8/1. The traffic appears to be marked on the ingress correctly but does not maintain its mark on the egress. I can confirm this with equipment on other Ethernet links in produciton as well as my test port listed in the config below with wireshark.
FYI: Unfortunately with my cards in the 6509 I cannot port mirror and see outbound multicast (determined through a TAC case). Because the STB does not understand tagged traffic I setup the native vlan for it to function. To see the multicast with tags I temporarily remove the native command and do the wireshark to see the multicast. It still shows a COS setting of 0. I will try to attach a capture of a multicast packet.
interface GigabitEthernet3/9 description Mulicast Encoder
switchport
switchport access vlan 962
switchport mode access
logging event link-status
load-interval 30
View 2 Replies
View Related
Jul 22, 2012
having a bit of trouble setting up our 5510. None of us have ever played with a firewall before. We've got most of the basics covered. I was able to get to the outside world to do a software update to the box, but my laptop that sits in the inside can't see the outside. We only have the default access rules in place at the moment. Our old ISA firewall rules don't really translate all that well to this new box.
View 2 Replies
View Related
Jan 17, 2012
I have a customer who requires to identify and police traffic on egress on a 3560 trunk link. I cannot use ingress classifications because we do not know what route the traffic will take yet. The egress interface connects to multipoint wireless equipment with 4 different bandwidth point to point links. So the ingress traffic may be routed via any one of 4 point to point wireless links connected to the single egress interface. Am I correct in assuming we cannot mark on the egress direction then put the traffic in a SRR shaped egress queue based on the marking ? So we would only have the option to egress queue based on markings applied or trusted on the inbound direction ? I had thought of some kind of policy map/aggregate policer configuration based on the exit VLAN but it seems we can only apply this type of config inbound. From reading the 3560 configuration guides it seems the 3560 cannot deploy the kind of requirements this customer needs. Perhaps they should have deployed some kind of Metro switch ?
View 1 Replies
View Related
Mar 9, 2011
I have ASA 5510 with 8.3 version and using multi context. I created a new context ABC and tryed to add routes in the context for the ABC networks it would not work. There was an error in the log stating, “failed to locate egress interface”. I changed the metric on the static routes from 1 to 2 and it started working. Is it normal in a multi context?
View 4 Replies
View Related
Apr 9, 2013
I have ASA 5505, in routed mode, basic license.I run a web server in DMZ. I can reach Internet from DMZ. Also, the trafic from outside can reach the web server. However, if the web site is requested from within the DMZ, the request will fail, and the firewall log contains the following message:
Failed to locate egress interface for TCP from DMZ50: 30.30.30.10/49213 to 170.70.30.114/80
I don't have DNS, so the request must go to Internet, even the web site is hosted on the server in DMZ.
Here is sample of my config file:
interface Vlan1
nameif inside
security-level 100
ip address 162.160.1.3 255.255.255.0
!
interface Vlan2
[code]....
What can be the reason for requests, originated in DMZ, to fail, and how could it be fixed?
View 1 Replies
View Related
Dec 18, 2011
I have an issue where I'm seeing output discards on pretty much all my ports configured for QoS. The switches are cisco WS-C3750V2-48PS running 12.2(50)SE1. There are four switches stacked using stack cables. The QoS implemeted was auto-qos with no modifications to the standard config. All ports are in queue-set 1. The phones connected are Cisco 7942's. Already did the standard check for speed duplex mismatch, crc's, runts, giants, etc...No discards before the QoS was applied. No bug ID's I could find regarding these switches and this IOS version. The one thing noticed is that 99% of all the drops are from queue's 2 and 4 or 1 and 3 doing the below command.
**I've limited the cut and paste as to not clutter the discussion until someone requests something else**
show platform port-asic stats drop
Port 18 TxQueue Drop Statistics
Queue 0
Weight 0 Frames 0
Weight 1 Frames 0
[Code]....
View 5 Replies
View Related
Jun 9, 2013
I'm trying to configure a egress netflow in a 6500 (VSS) with VS-S720-10G supervisor. I foud some old posts and understood that netflow wasn't supported on 6500 but i found a new document and it seems that netflow is supported in Supervisor Engine 2T:[URL] Does the netflow still not supported in VS-S720-10G? It's weird because the command is supported:
#sh run int vlan 4
Building configuration...
Current configuration : 353 bytes
!
interface Vlan4
ip address X.X.X.X 255.255.0.0
[cod]....
View 1 Replies
View Related
Nov 27, 2011
We have a pair of 6509 working in a VSS configuration (IOS 12.2(33)SX5). The 6509s connect to a pair of ASAs (7.2 code) running in an Active/Standby setup. These ASAs in turn connect to routers going to remote sites. I have configured Netflow on the following VLANS,
VLAN 10 - Servers Vlan
VLAN 9 - Transit/ASA VLAN (connects ASAs to 6509s). All traffic originating from any VLAN on the 6509 crosses this VLAN in order to reach remote sites and vice versa
I configured the netflow source VLAN 11 although I am not collecing any netflow from it.Although I have been getting lots of Netflow info, I noticed that netflow for traffic originating from any user VLAN on the 6509s going to any remote site via TRANSIT/ASA VLAN(9) does not get reported, I even tested with 4 GB traffic but no result. Only reverse traffic (i.e. from remote site to user VLAN) is reported as it traverses the Transit VLAN (9).
I read somewhere that egress netflow is not supported in 6500, but isnt traffic originating from a user vlan to a remote site via the transit VLAN (9) considered ingress with respect to the transit VLAN (9)? I would like to know whether bidirectional Netflow is supported on 6500 VLANS. I have mimimum control on routers beyond the ASAs, and since these ASAs run 7.2 code netflow is not supported, and Monitoring this Transit Vlan gives me extremely useful info.
I do get netflow biderectional traffic from the Server Vlan 10, but I think it is correlated by the netflow collector from vlans 9 and 10. [code]
View 9 Replies
View Related
Nov 3, 2012
I want to use chanelized POS PA in 7200 router. I want to know can I use chanelized PA for both chanelized and non-chanelized OC3/STM1? Does the both chanelized and non-chanelized feature is supported on chanelized module or I have to use other module?
View 1 Replies
View Related
Feb 24, 2012
I ran across this today on a 7200 that when all the vty lines are filled, and dont release, you enter clear line vty x and it is supposed to release the line. Well in some versions it doesn't work.
Here is the work around I found. clear tcp line vty x
View 3 Replies
View Related
Apr 16, 2012
I want to monitor my 7200's CPU packets per second rate.Any command i can run to show this?Or any MIB so I can poll this? 7200 NPE-G1 can handle 1mpps. And i want to verify the actual rate.
View 1 Replies
View Related
May 20, 2013
I want to know a number of maximum tcp connection at same time on interface of my 7200 router, how I'll do that?
View 3 Replies
View Related
Dec 11, 2012
I am having issues with frequent bgp flaps on the Cisco 7200 series router from past 1 week. I have raised a ticket with ISP but couldn't get any resolution from them as the flap is for about 2min.When ever we see BGP flap, we are not able to ping the remote end IP, Also at that point we drops on the interface connected to ISP.
View 1 Replies
View Related
Sep 27, 2011
I was recently given a Cisco 7200 VXR and told to erase the stored configurations in it. how to do erasing of Cisco 7200 stored config else I might have to delete them line by line.
View 4 Replies
View Related
Mar 23, 2013
I am planning to provide a redudnt link to our customer. The setup as below:
One link over wireless while the other link over wired link, I want to make sure that I should maintain the same public IP addresses for the customer therefore, I am looking for L2 failover for my customer.
If the wireless down the customer should migrated to wired and vis versa. I have 7200 CISCO Router as Core.
View 3 Replies
View Related
Mar 7, 2011
I am trying to configure a dynamic failover with IP SLA on a Cisco 7200 using 12.2(33) IOS. I would like to have something similar as the following configuration:
ip sla monitor 1type echo protocol ipIcmpEcho x.x.x.xfrequency 3ip sla monitor schedule 1 life forever start-time now!!track 10 rtr 1 reachability
access-list 101 permit icmp any host X.X.X.X echo!route-map LOCAL_POL permit 10 match ip address 101 set ip next-hop Y.Y.Y.Y set interface Null0!ip local policy route-map LOCAL_POL
!
ip route XX.XX.XX.XX 255.255.255.0 YY.YY.YY.YY track 10ip route XX.XX.XX.XX 255.255.255.0 ZZ..ZZ.ZZ.ZZ 254
My questions are the following
Question 1: What is the equivalent of ip sla monitor in 12.3 for dynamic failover with IPsla Should I used
ip sla ethernet-monitor 1 type echo domain name ?
or
ip sla 1 path echo X.X.X.X or ethernet mpid echo domain name or icmp-echo time out 1000 frequency 3 threhsold 2
I do not know if I have to used ethernet-monitor or ip sla. What is the domain name and the mpid associated to the ethernet-monitor ip sla.In the case where I have to used ip sla 1, shoud I used a path-echo, ethernet mpdi or icmp-echo for dynamic failover
Question 2: In 12.3, what is the equivalent to ip sla monitor schedule 1 life forever start-time now.I have found thec command ip sla schedule 1 start now but it does not seems that we could configure the duration.
Question 3: Should I also enable ip sla responder
View 2 Replies
View Related
Apr 19, 2012
I have a 7200 router with a 12.2.(46a) IOS and I am trying to activate Netflow on a subinterface. From the documentation of Cisco, I should be able to do it since the ios 12.2.(14)S but the command is unavailable.
[URL]
I have tried also to enter the command in the subinterface directly but it doesn't recognize it.
View 2 Replies
View Related
May 20, 2013
We have a Cisco 7204 G1 running c7200-advipservicesk9-mz.122-33.SRE7.bin and we're having a lot of difficulties getting a VTI working to a Cisco 2921 with adv. security. I've ruled out that the 2921 is at fault by successfully establishing a VTI to another 2921 and a 7200 running a different IOS release.
We see the tunnel come up, but when I sent a ping from the 2921 to the 7204 there isn't a reply. When I look at the results on the 7204 from a 'sh crypto engine connection active', I see the decrypt counters increase, but I don't see the Encrypt counters increase as it's trying to reply to the ping. I'm not sure if this is because there is an issue with the encryption or whether there might be a more fundamental issue with the router not replying to the pings.
I've tried the following IOS releases (c7200-advipservicesk9-mz.122-33.SRE7 & c7200-advipservicesk9-mz.122-33.SRE6) and they all behave the same way - this makes me think it might be a config issue rather than and IOS bug which is what I first thought. c7200-advipservicesk9-mz.122-33.SRE7.bin.
sh crypto engine connections active
Crypto Engine Connections
ID Interface Type Algorithm Encrypt Decrypt IP Address
1 Tu10 IPsec 3DES+SHA 0 31 10.5.5.1
2 Tu10 IPsec 3DES+SHA 19 0 10.5.5.1
1001 Tu10 IKE SHA+3DES 0 0 10.5.5.1
Here is a copy of my config on the 7204 - the other end (Cisco 2921) is configured in the same way.
crypto isakmp policy 1
encr 3des
authentication pre-share
[code].....
View 16 Replies
View Related
Apr 10, 2012
I have two 7204VXR with NPE-G2 and 1Gb of ram. One router has 2 eBGP peers and the other has 3. The routers receive all internet routes from the 5 peers and send 2 internal routes. There is an iBGP peering between both routers. On all peers I have a route-map to send only our routes.
All was working fine since a couple of months when I suddenly saw an increase of memory on one of the router (router B), 1 hour later the memory was 100% and router crash and reboot. The other router (router A) with the same hardware capacity, same ram and same amount of routes was working good. After router B restart, I shut all eBGP peering on it, keeping only iBGP with router A, ram used was the same as router A (about 50% used) but CPU was about 30% used by process Router BGP whereas router A which has active traffic and active eBGP is only 20% and bgp process i almost 0%. Restarting peers one by one on router B cause the same issue, increase of memory then crash, even with only one peer.
What I suspected :
- A peer on router B but I can't isolate one because the problem appears with each taken one by one
- Not enough memory, but router A has the same number of routes and don't have any problem
- IOS version ? same on both 12.4.(15)T1
- Why process router BGP use 30% on router B when all eBGP peers are shut except iBGP and no traffic pass.
- A routing loop but I only send internal routes to peers and only have one iBGP session with no sync nor redistribution with an IGP
Of course I can't run any debu ip bgp on routers as the number of routes is very large (300K).
View 1 Replies
View Related
Feb 9, 2011
OSPF-4-ERRRCV: Received invalid packet: Bad LLS Checksum with one of our tunnels
View 1 Replies
View Related
Nov 30, 2012
My router is running with BGP (One eBGP and One IBGP session). I have filterdown the BGP roting table by using prefix-List and default route to upstream router.But still found the CPU process is high (80%/80% with 60MB traffic).
Sh Proc CPU
-------------------
CPU utilization for five seconds: 88%/88%; one minute: 87%; five minutes: 87%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
[Code].....
View 5 Replies
View Related
Aug 28, 2012
I am having a weird issue with my Cisco 7200 router. From the router i am able to ping and reach out to the internet but from the client i am able to reach out to the internet but unable to ping I am not sure where is the issue but when i traceroute to it my packets are dropped at my routers interface. All my pings from the client time out. I checked the Access list to make sure ICMP is not blocked. Following is my running conf
ip audit notify log
ip audit po max-events 100
ip ssh break-string ~
ipv6 unicast-routing
no ftp-server write-enable
[code]....
View 2 Replies
View Related
