IEOC - INE's Online Community

Clarification on "Urgent Priority" on TEHO route pattern

skareem — Sat, 18 May 2013 12:01:09 GMT

Hi All,

During a lab, I set Teho so that calls from my branch 2 NL site would route out of HQ if a 12065011XXX number was dialled (as set up in Deep Dives/ workbook 1).

The number dialled is 00012065011001 which matches a TP that globalises the number to +12065011001 which then matches a specific RP of \+1.206! which points to a RL-RG to HQ which is fine.

When I initially made my test calls, I'd get an annunciator message after the fifth digit which happened to be the 5. To fix this I UNTICKED Urgent Priority on the \+1.206! RP and the call completed ok - What I don't understand is, I though urgent priority SHOULD be ticked on the route pattern as the digits are passed en bloc...? Or should I only be using urgent priority on the translation pattern ??

Be grateful if somone could clear that up!

thanks
Samson

L2TPv3 xconnect without hitting end (very weird)

mustafa86 — Sat, 18 May 2013 12:27:12 GMT

Hello INE community,

I've face a very weird problem when I was working to configure Frame Relay and PPP interworking over L2TPv3.

I've done the configurations correctly but the L2TPv3 session did not come up.

I spent about 15 minutes trying to troubleshoot the problem, but I've found everything configured correctly.

By chance I've moved to the PE router (R1) of the PPP side, I've found out that I am still on the interface mode of the serial interface that have the xconnect command.
I've just hit end, then found out everything come up as seen below.

Did anyone face a similar issue?
Is this something well know?

I've related that to the vlan creation that needs to exit the VLAN mode for the VLANs to be actually created in the VLAN database.

R1(config-if)#xconnect 2.2.0.2 12 pw-class L2TPv3
R1(config-if-xconn)#
R1(config-if-xconn)#end
R1#
*May 18 13:32:39.291: %SYS-5-CONFIG_I: Configured from console by console
R1#
R1#p
*May 18 13:32:41.267: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to down
R1#ping
*May 18 13:32:43.787: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial2/0, changed state to up9.

Thank you very much for your cooperation.

6.30 OSPF NSSA Type-7 to Type-5 Translator Election

samiraa — Tue, 14 May 2013 18:49:44 GMT

my issue is there

see topology ine workbook vol 1

in sw3

SW3#show run | sec router
router ospf 1
router-id 150.1.9.9
log-adjacency-changes
auto-cost reference-bandwidth 30000
area 2 nssa
redistribute connected subnets
network 155.1.9.0 0.0.0.255 area 2
network 155.1.79.0 0.0.0.255 area 2

SW3#show run int loopback 0
Building configuration...

Current configuration : 113 bytes
!
interface Loopback0
ip address 9.9.9.9 255.255.255.255
ip ospf network point-to-point
ip ospf 1 area 2
end

R5# show ip route 9.9.9.9
Routing entry for 9.9.9.9/32
Known via "ospf 1", distance 110, metric 19734, type inter area
Last update from 155.1.0.3 on Serial0/0, 00:15:35 ago
Routing Descriptor Blocks:
* 155.1.0.3, from 150.1.3.3, 00:15:35 ago, via Serial0/0
Route metric is 19734, traffic share count is 1

R5#show ip ospf database summary 9.9.9.9

            OSPF Router with ID (150.1.5.5) (Process ID 1)

                Summary Net Link States (Area 0)

Routing Bit Set on this LSA
LS age: 1088
Options: (No TOS-capability, DC, Upward)
LS Type: Summary Links(Network)
Link State ID: 9.9.9.9 (summary Network Number)
Advertising Router: 150.1.3.3
LS Seq Number: 80000001
Checksum: 0x5AEF
Length: 28
Network Mask: /32
        TOS: 0 Metric: 304

LS age: 527 (DoNotAge)
Options: (No TOS-capability, DC, Upward)
LS Type: Summary Links(Network)
Link State ID: 9.9.9.9 (summary Network Number)
Advertising Router: 150.1.6.6
LS Seq Number: 80000001
Checksum: 0x3311
Length: 28
Network Mask: /32
        TOS: 0 Metric: 304

                Summary Net Link States (Area 3)

LS age: 1006
Options: (No TOS-capability, DC, Upward)
LS Type: Summary Links(Network)
Link State ID: 9.9.9.9 (summary Network Number)
Advertising Router: 150.1.5.5
LS Seq Number: 80000001
Checksum: 0xE92A
Length: 28
Network Mask: /32
        TOS: 0 Metric: 19734

that route 9.9.9.9 must be external and not summary

what is wrong with my config ??

expecting help

thanks .

LLQ - How it works

krzal — Sat, 11 May 2013 22:01:04 GMT

Hi. Could someone help me with below diagram?

Please look in diagram and confirm or correct algorithm and all descriptions.

https://picasaweb.google.com/115053713667430767124/QoS?authuser=0&feat=directlink

Note: Editable doc available through email

[mpls vpn eigrp pe-ce]

yoplin — Fri, 17 May 2013 21:06:22 GMT

hi, all:

if you have an mpls vpn setup, with 2 or more CEs using EIGRP you're only required to redistribute BGP into EIGRP without having to set a metric for the CE to receive the routing table. This because BGP carries EIGRP info in extended comminities.

I'm not sure if this is a GNS3 simulation thing, but it seems the only way to get this to work is to clear the vrf routing table in the PE for it to correctly send the routing info to the CE. Furthermore, this is something I saw on Brian's INE SP videos. The thing is, at leat in the simulation it NEVER works dinamically, you always have to clear the specific vrf routing table for it to work. So in the exam, if it behaves this way, why chance it and not set a specific metric and be done with it? Thoughts?

TIA,

UCCX integration

jojo — Sat, 18 May 2013 10:15:44 GMT

Hi Everyone,

Recently i integrated CUCM 8-6 with UCCX 5.3 version. And i added agents with Resource enabled Agent routing. I changed the name of one Agent in the CUCM and the new name was replicated in UCCX also.But when the agent try to login the CAD then they still facing the old user's name in CAD. I tried Dir SYNC and JTAPI SYNC in UCCX but still problem persists. Can anyone help to solve it.

L3Vpn vs L2VPN to ine racks what am i going to miss??

cciev2801 — Fri, 17 May 2013 17:23:18 GMT

hi,

if i use l3vpn connection to the rack rentals, and chain my phones to the router.

what am i going to miss, i means whats there in L2 VPN with 3550/3560 thats not avaiable in L3vpn with the switch?

i do not have a switch right now and do not want to buy, also kindly let me know what is it that i would not be able to without the switch.

Anyone actively preparing for CCDE?

quinton — Sat, 18 May 2013 09:30:27 GMT

I am surprised by how little activity there is on the CCDE section of this forum. I am booked for the August slot and interested to touch base with others preparing for the CCDE. Maybe a few group discussion sessions on WebEx?

Legacy FRTS and MQC when BECNs are received

krzal — Thu, 16 May 2013 19:25:00 GMT

Hi please look that both configs are ok.

- Adaptively shape down to 256Kbps if BECNs are received
---
map-class frame-relay DLCI_205
frame-relay cir 512000
frame-relay bc 25600
frame-relay be 0
frame-relay mincir 256000
frame-relay adaptive-shaping becn

policy-map SHAPE_DLCI_502
class class-default
shape peak 256000 12800 12800
shape adaptive 256000

Post:14 Hours To Go!, Now Renamed: I want my 14 Hours back ;-)

1000BaseT — Thu, 16 May 2013 22:33:12 GMT

Thanks for the notes of encouragement and good luck gestures; but unfortunately it was not my day in the lab. It was a good experience over all, I have a lot to take away and improve on (not all technical issues).

As much as I thought I was ready for the lab, I don’t think there is much that can prepare you for the lab except the lab itself. I am still processing the day, trying to figure out what when wrong and where my major mistakes were (this even before I get my score ;-) if that tells you anything).

Troubleshooting – was real tricky for 120 mins, especially when the majority of the paths between endpoints have 2 or 4 or 6 possible routes, I found that “isolating” the cause took a lot of my time, maybe I was over thinking but my thought process was, just because this path is not working doesn’t mean that THE fault so I would confirm the other paths before actioning what I found.

Configuration - Daunting amount of work to do in 6 hours!

MISTAKE #1, being too slow in basic tasks, in effort to avoid silly mistakes I was too slow with my Layer 2 and basic IGP configs.
MISTAKE #2, taking TOO much time to overcome an issue, I should have accepted the loss of points and moved on (once I should have moved on, once I REALLY needed to resolve the issue)
MISTAKE #3, failing to read/skim the entire exam up front for proper time allocation <--This was my killer

# 3 the was the killer - because of being on the slow side and working too long on a couple of issues I ran into, I was at about hour #4 of 6 when I made the assumption that I will never finish those last three sections (based on the size of the first two sections) (aka mentally gave up), so I might as well go back and troubleshoot that other issue one more time. I was able to resolve but it killed another 30-40 mins.

So the major failing / lesson is this; by not skimming the entire exam, I made the assumption that all sections were 6- 10 tasks (large tasks) in length, based on the duration it took me for the first two sections I would never finish so I reverted back to the make sure those tasks were solid because they were core (and for personal interest/challenge). However in actuality those last three sections combined were - lets just say, not a hugh percentage of the exam and would have been do about in 2 hour frame ( *IF* only I had read ahead and allocated time accordingly. Still don't think would have passed but I would have scored better.

All in all the tasks were reasonable and doable. I am still processing the day but I think my issues were 75% personal (speed, time management, and letting missed points and time constraints pressure me) and 25% not being technical strong enough where needed.

That’s what I say now….before the score come in J

Cheers,

CCIE SP Prep: is ATM still a relevant topic?

plucena24 — Fri, 17 May 2013 12:00:47 GMT

As I am studying and going through SP material, I find myself skipping over the ATM chapters on the books that I am reading. From a CCIE preparation point of view, do you think that this is ok?

Is ATM still a relevent topic for the CCIE exams (both the written and the lab)?

Thanks!

11.12 Using nbar for content-based filtering

ciprian_s — Tue, 17 Jan 2012 07:00:42 GMT

Hi guys,

Wouodn't it make sense to configure the service-policy INBOUND on fa0/0.146 Instead of outbound ... I'm thinking this since as the task says, the requests are coming from users in vl 146 (and not only) - so inbound ...

Please post your ways of interpreting this.

Thank you,

Ciprian.

7971GE will not boot at all

F.Andrea — Fri, 17 May 2013 09:51:32 GMT

Hello guys,

I've just started my Voice lab, but while upgrading the firmware on my 7971GE phone, I apparently messed up something.

Now the phone shows a dark blue screen with nothing on it and I can see that he downloads all the file it needes from the TFTP server, the only problem is that after few seconds it reboots and the procedure starts all over again. The phone never shows any Cisco logo and not a single word on the entire process.

My feeling is that something went wrong and corrupted the old firmware in the upgrade procedure maybe also because I've tryied to upgrade from a very old version (2005).

Not sure if matters but I can see with wireshark that every single packet that the phone sends out says "ethernet frame check sequence incorrect" and for example "0x00000000 should be 0x93F8234A". Maybe it's due to CRC offload I don't really know...

The factory default procedure (123456789*0#) hardly seems to matter cause the phone starts looking for the firware anyways.

Thanks for any advice!

Andrea

Naive question about portfast

egon dragon — Fri, 17 May 2013 10:13:21 GMT

I have a (very) naive question about Portfast

Shouldn't a portfast interface avoid sending STP BPDU ?

In my memory :

Access port + Classic STP : BPDU

Access port + Portfast STP : NO BPDU

I have a portfast port sending BPDU perfectly normally is it normal ?

Thanks

Regards

[XR] automatic redistribution from iBGP to eBGP (full lab 4)

yoplin — Fri, 17 May 2013 15:59:46 GMT

hi, all:

i'm in the middle of testing full lab 4 from INE and found something curious and i thought i'd ask. in this lab i have 3 ASBRs: R3 (ASN2000) and R5/XR1(ASN1000).

according to the instructions i'm supposed to have the following ebgp sessions:

R3<-->R5

R3<-->XR1

all loopbacks from both sides are supposed to be in the routing table for all devices.

now as afar as i know, the normal behavior for a bgp asbr is that whatever i learn on ibgp i send over to ebgp peers, no questions asked (and viceversa).

the thing is i'm seeing different behaviour in R5(IOS) and XR1(XR). R5 is doing this correctly:

R3#sib summ

[snip]

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

10.0.0.1 4 2000 84 81 17 0 0 01:04:56 2

10.0.35.5 4 1000 50 50 17 0 0 00:36:27 4

10.0.193.19 4 1000 14 16 17 0 0 00:09:23 3

R3#

while XR1 is not. XR1 does not redistribute iBGP automatically unless i exclicitly configure network statements (see above).XR1 (10.0.193.19) is only redistributing 3 loopback addresses instead of 4 because I did not add the network statement for the last loopback.

See config:

R5-IOS:

address-family ipv4

no synchronization

network 10.0.0.5 mask 255.255.255.255

neighbor 10.0.0.2 activate

neighbor 10.0.0.2 send-community both

XR1-IOSXR:

router bgp 1000

bgp router-id 10.0.0.19

address-family ipv4 unicast

network 10.0.0.5/32

network 10.0.0.19/32

network 10.0.0.20/32

allocate-label all

Again, AFAIN, bgp is supposed to do this automatically. is this a thing that's specific to XR? anyone?

While i'm at this, another weird thing is how the routing tables for bgp look in both devices. R5(IOS) marks igp-learned routes as rib-failure, but XR1(IOSXR) doesn't mark them as rib-failure. is this normal?

R5#sib

BGP table version is 19, local router ID is 10.0.0.5

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale, m multipath, b backup-path, x best-external

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 10.0.0.1/32 10.0.35.3 0 2000 i

r>i10.0.0.2/32 10.0.0.2 0 100 0 i

*> 10.0.0.3/32 10.0.35.3 0 0 2000 i

*> 10.0.0.4/32 10.0.35.3 0 2000 i

*> 10.0.0.5/32 0.0.0.0 0 32768 i

r>i10.0.0.19/32 10.0.0.19 0 100 0 i

r>i10.0.0.20/32 10.0.0.20 0 100 0 i

R5#

XR1 (IOSXR):

RP/0/0/CPU0:XR1#show bgp

Fri May 17 15:23:27.652 UTC

BGP router identifier 10.0.0.19, local AS number 1000

BGP generic scan interval 60 secs

BGP table state: Active

Table ID: 0xe0000000

BGP main routing table version 37

BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best

i - internal, r RIB-failure, S stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

* i10.0.0.1/32 10.0.0.5 0 100 0 2000 i

*> 10.0.193.3 0 2000 i

*>i10.0.0.2/32 10.0.0.2 0 100 0 i

* i10.0.0.3/32 10.0.0.5 0 100 0 2000 i

*> 10.0.193.3 0 0 2000 i

* i10.0.0.4/32 10.0.0.5 0 100 0 2000 i

*> 10.0.193.3 0 2000 i

*> 10.0.0.5/32 10.0.195.5 10 32768 i

* i 10.0.0.5 0 100 0 i

*> 10.0.0.19/32 0.0.0.0 0 32768 i

*> 10.0.0.20/32 10.19.20.20 10 32768 i

* i 10.0.0.20 0 100 0 i

Processed 7 prefixes, 12 paths

RP/0/0/CPU0:XR1#

thanks in advance!

Wireless Study

amit.thakkar — Sat, 11 May 2013 22:01:19 GMT

Hi,

Very upset with my results.

I attempted my CCIE Wireless in brussles however what i prepared and what i got in lab was so different.

I was working on fast lane and IPX WBs.

But nothing worked. The question in the lab is so differemt

Guys i m very upset and planning to go for second attempt.

I am ready to share the lab experience but only with like minded people.

If guys are only interested in knowing the lab then please do not ping me.

Guys who are serious and are planning to go for lab in 2-3 moths then we can work this out.

I dont want other candidates to get upset the way i m right now.

Like minded ppl lets join the gang and lets Bang this CCIE.

Rgds,
Amit Thakkar

Parts of voice lab for sale

jahudson — Wed, 15 May 2013 00:13:29 GMT

I have upgraded my lab and I'm looking at selling parts of my old lab that isn't going to be used anymore.

Maxed out 3725 with extras - I was using this as my PSTN for my CCIE Voice lab. It is a maxed out 3725 (256mb RAM/128 mb CF), has a NM-HDV-2T1-60, VWIC-2MFT-T1-DI, VWIC-2MFT-E1 and a NM-CUE 40GB running 7.06. $350 shipped

UC520-8U upgraded with software pack 8.6. I got it for use in my CCNP/CCIE lab but ran into it's limitations $325 shipped

HWIC-4ESW-POE - In perfect condition with the PoE daughter card.$120 shipped

AIM-CUE with 1GB CF- I believe that it is running a real old CUE software. I have to reinstall it and check but it works perfectly$100 shipped

Deepak Arora...Evil CCIE# RS/SEC Passed SPv3... CCIE DC ? Bring It Own :-)

Deepak Arora — Wed, 08 May 2013 02:54:42 GMT

Passed My SPv3 Lab today at Hong Kong. The day didn't start up well but still it's the end that matters. The reason behind choosing SP is part of logical approach towards CCDE. But got to get CCIE DC before that.

Thanks for Entire team of INE and Specially Brian McGahan (My Hero) for offering SP ATC and Blog Articles. Without your excellent VOD series I wouldn't have passed any of my three CCIEs as I am not fan of reading books cover to cover :-) (Prefer DOC CD & Technology Pages/Blogs).

INE SPv3 racks were excellent to test my own technology labs.

Will write a detailed story tomorrow once back home in India.

BTW SP just took 2 Months :-)

Calling and Called Party name

2ccievoice — Sat, 29 Jan 2011 10:53:07 GMT

Normal 0 false false false EN-US X-NONE AR-SA MicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:Arial; mso-bidi-theme-font:minor-bidi;}

I rent a rack form INE and I was trying to test calling name and called name appearance between the Campus IP phones and PSTN Phone.

But I faced some problems. At the end I found this command in INE PSTN router:

isdn gateway-max-interworking

after removing the previous command and add isdn outgoing display-ie, I can see the calling name in called party phone but I am not able to see the called name in the calling party phone. Below more details:

if I called to 911from IP phone, the screen shows:

IP Phone: to 911 No name for the calling party.
PSTN Phone: Form HQ Phone 1 2001

if I make call from PSTN to IP phone:
PSTN : to 177552001
IP Phone: from Emergency Services

Any help? Any hints?

Anything should be adjusted on PSTN Router?

My gateway is MGCP and l3 backhauled to CUCM

Summary-address not-advertise Filtering type5

fallegretti — Fri, 17 May 2013 16:50:05 GMT

Hi all,

summary address not-advertise command shoul only filter out the type 7 lsa, but I can see it filtering the type 5. Here is my set up

r2---Area0----r4------Area46------r6-----Connected

I am redistributing the connected from r6 into OSPF and I can see them coming in as E2

r4(config-router)#do sh ip route ospf | inc 66.
O E2 192.168.66.0/24 [110/20] via 192.168.46.6, 00:01:30, FastEthernet0/1.46
r4(config-router)#

I am now summrising on R6 with a /17

r6(config-router)#summary-address 192.168.0.0 255.255.128.0

r4(config-router)#do sh ip route ospf | inc 168.0
O E2 192.168.0.0/17 [110/20] via 192.168.46.6, 00:00:23, FastEthernet0/1.46

All good.

If I add the not-advertise keyword to r6 summary command, the summary is no longer there

r6(config-router)#summary-address 192.168.0.0 255.255.128.0 not-advertise

r4(config-router)#do sh ip route ospf | inc 168.0
r4(config-router)#

?????

Am I missing something or the command is not doing what it says on tin?

Fulvio

l3vpn what am I going to miss?

cciev2801 — Fri, 17 May 2013 03:39:28 GMT

hi,

if i use l3vpn connection to the rack rentals, and chain my phones to the router.

what am i going to miss, i means whats there in L2 VPN with 3550/3560 thats not avaiable in L3vpn with the switch?

i do not have a switch right now and do not want to buy, also kindly let me know what is it that i would not be able to without the switch.

Cisco IP Communicator Blank Screen

nathan0726 — Mon, 27 Aug 2012 18:45:17 GMT

We are running Cisco IP Communicator 7.0.6 on several PC's in the building. There is one PC in particular that works for every user account except for one, and it just started doing it. On this users account when the CIPC is opened it just sits on a black/blank screen and nothing happens. I can run it as an administrator and it works fine.

I've tried uninstalling/reinstalling to no avail. Tried editing the registry like one of Cisco's KB articles says to do, but no luck. Anyone have any suggestions other than reformatting?

Thanks!

Site-2-Site VPN can only ping one way

xisark1982 — Fri, 17 May 2013 10:30:18 GMT

Hello Everyone,

I'm having a problem with site-to-site vpn using PIX & FORTINET 60B, If I ping from network behind PIX say "ping 172.21.1.102", it is SUCCESFUL but when I ping from network behind FORTINET it is "Request Timed Out".

FORTINET VPN CONFIGS:

config vpn ipsec phase1
    edit "HOTEL_FW"
        set interface "wan1"
        set nattraversal disable
        set dhgrp 2
        set keylife 86400
        set proposal 3des-sha1
        set dpd disable
        set remote-gw 222.127.244.54
        set psksecret ENC xxxxxxxxxxxxxxxx
    next
end

config vpn ipsec phase2
    edit "HOTEL_FW_2"
        set keepalive enable
        set pfs disable
        set phase1name "HOTEL_FW"
        set proposal 3des-sha1
        set replay disable
        set dst-subnet 10.100.10.0 255.255.255.0
        set keylifeseconds 86400
        set src-subnet 172.21.1.0 255.255.255.0
    next
end

PIX501 config.

access-list NONAT permit ip 10.100.10.0 255.255.255.0 172.21.1.0 255.255.255.0
ip address outside 222.127.244.54 255.255.255.252
ip address inside 10.100.10.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 10.100.10.0 255.255.255.0 0 0
route outside 0.0.0.0 0.0.0.0 222.127.244.53 1
http server enable
http 10.100.10.2 255.255.255.255 inside
sysopt connection permit-ipsec
crypto ipsec transform-set MYSET esp-3des esp-sha-hmac
crypto map MYMAP 10 ipsec-isakmp
crypto map MYMAP 10 match address NONAT
crypto map MYMAP 10 set peer 121.97.122.253
crypto map MYMAP 10 set transform-set MYSET
crypto map MYMAP 10 set security-association lifetime seconds 86400 kilobytes 4608000
crypto map MYMAP interface outside
isakmp enable outside
isakmp key ******* address 121.97.122.253 netmask 255.255.255.255
isakmp identity address
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash sha
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400

I also tried this command on PIX:

PIX# debug packet outside src 172.21.1.102 netmask 255.255.255.255 dst 10.100.10.2 netmask 255.255.255.255 proto icmp

but nothings happen. I'm am new to site-site vpn, hope you can help me.. Thanks in advance..

2.4 Community Tagging

stielinc — Sat, 15 Dec 2012 00:37:35 GMT

I think the SG is mistaken in the way it has tagged the communities, or maybe I'm wrong?

Task states the following:

Prefixes tagged with community 100:542 should be advertised to BB1 with AS 100 prepended 3 times

Prefixes tagged with community 100:546 should be advertise to BB3 with AS 100 Prepended 3 times

Use this developed signaling to ensure AS 54 prefers BB1 to reach 150.1.33.33 and prefers BB3 to reach 150.1.133.133.

SG solves by the following:

tags prefix 150.1.33.33 with community 100:542

tags prefix 150.1.133.133 with community 100:546

Advertise to BB1 100:546 and prepends 100 3x

Advertises to BB3 100:542 and prepends 100 3x

I believe it should be solved as:

tags prefix 150.1.33.33 with community 100:546

tags prefix 150.1.133.133 with community 100:542

Advertise to BB1 100:542 and prepends 100 3x

Advertises to BB3 100:546 and prepends 100 3x

I think the SG solution achieves the goal of ensuring the right prefix is preferred over the correct link, but I think it missed the requirement that states which community must be advertise to which BB router and prepended.

Thoughts?

What is the benefit of LOOSE mode? (reachable-via ANY)

JoeM — Wed, 15 May 2013 20:29:52 GMT

Every time that I get to this subject (spoof protection), I want to apply the STRICT mode of this command (unless asymetric traffic is specifically mentioned).

ip verify unicast source reachable-via RX (strict-mode vs loose-mode ANY)

I am not yet convinced of the value/benefit of using the LOOSE mode for spoof protection.

In the examples that I have seen....

Our goal is usually to make sure that the internal IP's are not spoofed from outside the network/subnet.
....but when we use LOOSE mode (for asymetric reasons), IMO we have opened up the exact hole we are trying to close.

So that leaves me with the exact question every time. What is the value of using this command in LOOSE mode? In this mode, we have not closed the door to the spoofing of internal prefixes -- because the door is re-opened -- for the sake of asymmetric routing.

Maybe there is something that I am still missing, something extra this mode of the command does to still protect against spoofing.

Thanks in advance for clarification on this.