ASR - IPSEC, GRE, channel group, and MTU Questions

I have an ASR1004 and am trying to load-balance a 1.5G data rate over two 1-Gig ports using IPSEC ports, but I have a few questions.
1. Can GRE support a 9K mtu
2. Can you run IPSEC on a channel-group
3. Can the ASR load-balance per- S&D on a channel-group?
I currently have two separate tunnels, one on each outbound gig link with OSPF running. However, I can't get a 7000 mtu w/ the DF bit set through to the distant end. I am guessing this is because of the GRE interface.
So is it possible to run IPSEC on a channel-group and have this load balance per S&D? I need to use the BW of both ports.
Thanks for the help!

The ASR1004 router we can only send packets with a maximum MTU size of 1438 Bytes over the encrypted tunnel.

Similar Messages

887 ipsec+gre+ospf models and licenses

I'm choosing router for brunch office among this models - 887VA-SEC-K9 or 887VA-K9. I want this router to can IPSEC site-to-site, GRE-tunnels and OSPF. I read the datasheet but I haven't understood several things about this model so I can't choose a right model. The datasheet says that default software is Advanced Security Feature Set for all 887 routers which supports IPSEC and GRE. Then I don't understand what are differences between 887VA-SEC-K9 or 887VA-K9? What does the word "SEC" mean? The second things aren't understood - I want the router to support OSPF. The Advanced IP Services can do it but there is two options too - SL-880-AIS and L-SL-800-SEC-K9. What are differences between them?
What should I choose to implement IPSEC-GRE-OSPF among this models and licenses?

The ASR1004 router we can only send packets with a maximum MTU size of 1438 Bytes over the encrypted tunnel.

Smart playlists, grouping, and podcasts question

Hi I listed to a lot of podcasts, and have them grouped using "Grouping" feature like Home, Money, Health, etc. I then have a smart playlists that have the following settings:
Podcast is yes, playcount is 0, and grouping is 'Home' (or money or whatever)
The problem I am having is when new podcasts are downloaded, they DO NOT inherit the grouping setting for that podcast!
So every day, I have to go to each podcast, and reset the grouping to Home (or whatever it is) -
How I permanently set the grouping for each episode to have the correct grouping?
Thanks in advance,
Ndimitru

Oh, you got it!!! I'd never noticed "Playlist" as a parameter in the smart playlists! Suddenly all kinds of possibilities open up! It did work the way you suggested but I decided to take a different tack. I created a 4-5 star "rock" playlist and a 4-5 star "alternative" playlist and then created a third smart playlist that includes the first two playlists! Now I can just continue creating smart playlists that include only songs I rate 4-5 stars in all of my 51 genres and create composite playlists to my heart's content! OK, I wouldn't do that. Once I get over 25 genres, it'd be easier to go back to the subtraction method. ; )
Thanks for your help Diane! You're brilliant!
Peter
Message was edited by: petemay

Channel-group command

Could someone point me to a link about information about this command besides its options and such. If you dont know of a link but know the command, some of the questions I'm having include:
(1) what are the benefits of this command and why would you use this configuration?
(2) What platforms will this work for?
(3) If using between two switches and lets say you have four fiber links between the two, can you put three of the links into a channel-group and leave the other link out of the channel-group?
(4) Do the interfaces in the channel-group have to be in the same slot (same switching module) to be in a channel-group?
(5) Again, if you have two switches connected by four fiber links and you put each side of interfaces in a channel-group, do both sides have to be the same channel-group number?
(6) Neglecting that it is a hardware or line problem, what might be the reason for some of the interfaces in a channel-group to come up while others dont assuming that all the interfaces are configured exactly the same?

(1) what are the benefits of this command and why would you use this configuration?
>> channel-group x mode is an interface configuration to group identical interfaces in a combined logical interface, think of it as small pipes being combined to create a bigger pipe so that you can have more flows.
(2) What platforms will this work for?
>> channel-group is specific to catalyst running IOS like 2950, 2955, 2960, 2970, 3550, 3560, 3750, cat4000 with sup II+ or above, cat6000 with sups running Native IOS. For catalyst running it will be "port channel" command.
(3) If using between two switches and lets say you have four fiber links between the two, can you put three of the links into a channel-group and leave the other link out of the channel-group?
>> yes, by virtue of channel it will have a lower cost than the single interface therefore STP will block the single interface because it has a higher path cost to the root (STP can be discuss in a separate discussion).
(4) Do the interfaces in the channel-group have to be in the same slot (same switching module) to be in a channel-group?
>> No it does not have to be but they have to be identical. You cannot channel two ports where one is 100 MB and the other is a gig port.
(5) Again, if you have two switches connected by four fiber links and you put each side of interfaces in a channel-group, do both sides have to be the same channel-group number?
>> NO, channel group have local significance. If on switch A port 1 and 2 are in channel-group 1 and port 1 and 2 are connecting to port 3 and 4 of switch B. In switch B port 3 and 4 can be in channel-group 2 or 3 or 1 if you want to keep them the same for administrative sanity.
(6) Neglecting that it is a hardware or line problem, what might be the reason for some of the interfaces in a channel-group to come up while others dont assuming that all the interfaces are configured exactly the same?
>> cabling not right, interfaces in the same channel group are not alike, problem with the other end, or bug but this seldom is the case.
Please rate helpful posts.

Data plugin to append to channels in different channel groups

Hello
I try to import particel counter data from a text file which is organized in a difficult way:
Data come in blocks with each block taken at one time. Each block consists of a table of tab-separated data. e.g.
(start of Block 1)
04.06.2013 - 16:34:13 - 10s/10 -   m
N analysed: 1521 P Sum(dCn): 5444,470 P/cm³
N total: 1521 P Sum(dCm): 1,7536 mg/m³
X [µm] 0,148647 0,159737 0,171655 0,184462 0,198224 0,213013 0,228905 0,245984 0,264336 0,284057
dN [P] 0 0 0 6.155.882 29.521.097 101.420.330 83.226.951 85.545.715 159.120.955 158.057.455
dN/N [-] 0 0 0 0,004048 0,019414 0,066696 0,054732 0,056256 0,104641 0,103941
dN/N/dX [1/µm] 0 0 0 0,305126 1.361.669 4.353.255 3.324.322 3.179.709 5.503.848 5.087.496
dCn [P/cm³] 0 0 0 22.040.393 105.696.730 363.123.274 297.984.071 306.286.127 569.713.408 565.905.674
dCn/Cn [-] 0 0 0 0,004048 0,019414 0,066696 0,054732 0,056256 0,104641 0,103941
dCn/Cn/dX [1/µm] 0 0 0 0,305126 1.361.669 4.353.255 3.324.322 3.179.709 5.503.848 5.087.496
(start of Block 2)
04.06.2013 - 16:34:23 - 10s/10 -   m
N analysed: 1071 P Sum(dCn): 3833,350 P/cm³
N total: 1071 P Sum(dCm): 0,3581 mg/m³
X [µm] 0,148647 0,159737 0,171655 0,184462 0,198224 0,213013 0,228905 0,245984 0,264336 0,284057
dN [P] 0 0 0 6.981.271 18.451.972 25.599.194 70.809.673 88.966.677 122.491.615 83.363.748
dN/N [-] 0 0 0 0,006521 0,017234 0,02391 0,066137 0,083096 0,114408 0,077862
dN/N/dX [1/µm] 0 0 0 0,491474 1.208.812 1.560.603 4.017.064 4.696.707 6.017.589 3.811.039
dCn [P/cm³] 0 0 0 24.995.600 66.065.063 91.654.830 253.525.502 318.534.467 438.566.469 298.473.857
dCn/Cn [-] 0 0 0 0,006521 0,017234 0,02391 0,066137 0,083096 0,114408 0,077862
dCn/Cn/dX [1/µm] 0 0 0 0,491474 1.208.812 1.560.603 4.017.064 4.696.707 6.017.589 3.811.039
(start of Block 3)
04.06.2013 - 16:34:33 - 9s/9 -   m
N analysed: 1277 P Sum(dCn): 5080,103 P/cm³
N total: 1277 P Sum(dCm): 2,2456 mg/m³
X [µm] 0,148647 0,159737 0,171655 0,184462 0,198224 0,213013 0,228905 0,245984 0,264336 0,284057
dN [P] 0 0 6.983.139 13.137.502 30.294.664 52.503.076 114.177.807 82.937.875 112.476.377 117.880.295
dN/N [-] 0 0 0,005468 0,010288 0,023724 0,041115 0,089412 0,064948 0,08808 0,092311
dN/N/dX [1/µm] 0 0 0,442925 0,77543 1.663.971 2.683.579 5.430.769 3.670.984 4.632.772 4.518.256
dCn [P/cm³] 0 0 27.780.321 52.263.604 120.518.214 208.867.707 454.222.092 329.943.409 447.453.461 468.951.325
dCn/Cn [-] 0 0 0,005468 0,010288 0,023724 0,041115 0,089412 0,064948 0,08808 0,092311
dCn/Cn/dX [1/µm] 0 0 0,442925 0,77543 1.663.971 2.683.579 5.430.769 3.670.984 4.632.772 4.518.256
(This is of course only an excerpt. There may be more blocks and there will be more size channels and more channel groups...)
Now, I want to store the dN values in one channel group, the dN/N in the next group etc. There should be 10 channels, one for each size class, and the data from the various blocks as sequential values in these channels. (I hope I wa able to explain this in a comprehensoble way...)
I can generate the groups and the respective channels:
set oChn = ochngrp.Channels(2) 'Der Kanal mit den mittleren Dm wird für die Kanalnamen der Gruppen weiterverwendet
for i = 1 to 25
sMyLine = file.getnextline
aChnData = split(sMyLine,vbTab,-1,vbTextCompare)           'Read one line and parse it into an array
if not Root.ChannelGroups.Exists(aChnData(0)) then          'test if a group named like array(0) exists
    Set oChnGrp = Root.ChannelGroups.Add(aChnData(0)) ' and create one if necessary.
    for j = 1 to oChn.Size
      call oChnGrp.Channels.Add("" & oChn(j),eR64)                'add empty channels
    next
end if
next
How would I read the data?
With a lot of nested i,j-for..next loops, I could read a line via
for j = 1 to root.channelgroups.count
         aValue = split(file.getnextline)
         for i = 1 to 10
                root.channelgroups(j).values(i) = aValue(i)
         next
next
' then jump to timestamp of next data block with some skiplines, read timestamp and reiterate
or I could try to read all values for one channel group and use skiplines, e.g.
for i = 1 to root.channelgroups.count
   while file.position <> file.size
         aValue(j) = split(file.getnextline)
         file.skiplines(as many as are between the blocks)
   wend
' now I have a 2dim array aValue to transfer into data channels.But how?
file.position = 1
next
Could file.GetStringBlock be of any help?
Has anybody tackled a similar file structure and could give me a clue or some code sniplet?
Thank you...
Michael

Hi Michael,
I would just go line by line in the data file and send the array channel values (one value at a time) to the Channel.Values() property of the matching channel name. It's not going to be fast any way you do it in VBScript.
Brad Turpin
DIAdem Product Support Engineer
National Instruments

Error -2500 while writing new channel groups / channels to tdm-file

I'm creating a tdm-file using the express vis provided by LabView. Everything goes fine in opening the file and setting the file parameters.
When i'm using the write data-express vi to create a new channel group and setting it's parameters i receive an "error -2500" accompanied with the call chain of the vi.
I'm setting the parameters by using a terminal on the express vi and by using the value setting in the express vi configuration. Any ideas what might cause this error?

I solved it. I made the error to begine some of the properties names with a number, eg. 1s for 1 sigma. I renamed them to sigma_1s and it works.

Why don't channel-group numbers match on a VSS port-channel link?

Hi All,
I have two 6509's that are VSS'd together via four 10gig links on each side. The configuration was done before I started this job, but in reviewing the configs I see that the 10gbps VSS heartbeat links are port-channeled together on each side, but one side is channel-group 2, while the other end of the bundle is channel-group 1.
I thought that channel-group numbers needed to match on both ends of the port-channel for it to form correctly?
I'm guessing that this has to happen because the switches are virtually one, so you can't put all 8 links into the same channel-group number or there would be nothing to connect to on the other side. Therefore, the "switch virtual link #" command is the real code that tells the switch where the other end of the link is, regardless of channel-group number, correct?

Dean,
The channel-group number does not have to be the same on each end. The four ports on switch A have to be in the same channel-group, and the four ports on switch B have to be in the same channel-group, but there's no communication across that line about what the channel-group is called. It's just a name. From a design standpoint it is nice to have them the same on both sides, but it's not always simple to allow for that in the design of a network.
-Jameson

Properties (group and channel) added are not a numeric data type.

I am using a dataplugin to add both group and channel custom properties. The properties are both text and numeric, doubles and integers.
When I create a query in Navigator, I select the custom property using the dropdown, but the operator dropdown only has "=" or "<>". The property displayed in the Data Portal is a float number. I was having this problem when I was adding custom properties using a script. I then tried "Navigatorettings/My DataFinder/Reset/Reset Index", then repopulated my Search Area, using the dataplugin on my raw data files. At this point, all my properties only have the "=" or "<>" operator choices in the query.
So it appears that my properties are numeric in the Data Portal, but string in the Navigator Query.
In advance, thanks
Solved!
Go to Solution.

Hi Bill,
could it be the properties you are talking about are already "optimized" for query?
In case yes, did you do the optimization by script like
Dim oMyDataFinderSettings
Set oMyDataFinderSettings = Navigator.ConnectDataFinder("My DataFinder").GetSettings()
Call oMyDataFinderSettings.OptimizeCustomProperty(eSearchChannel, "Author_age")
And did you do this, before DataFinder has indexed some of your files?
In case yes, DataFinder has to make a guess the datatype of the property without example - so always "string" is chosen.
(If DataFinder has already indexed some(or better all) files containing the property, DataFinder will "optimze" the property in the datatype which occurs most for this property.)
In case you know the datatype of the property you are about to "optimze", you can provide this information to DataFinder
Call oMyDataFinderSettings.OptimizeCustomProperty(eSearchChannel, "myText", DataTypeString)
Call oMyDataFinderSettings.OptimizeCustomProperty(eSearchChannel, "myInt", DataTypeInt32)
Call oMyDataFinderSettings.OptimizeCustomProperty(eSearchChannel, "myFloat", DataTypeFloat64)
Call oMyDataFinderSettings.OptimizeCustomProperty(eSearchChannel, "myDate", DataTypeDate)
Stefan

GRE IPSec between Cisco 2811 and FortiGate 110C

Hello,
Does anybody know if it is possible to configure GRE IPSec tunnel between Cisco 2811 router and FortiGate 110C firewall? I know that FortiGate supports IPSec and GRE tunnels, but maybe somebody succeeded in establishing an IPSec GRE between those routers? Could you also give a link to the appropriate documentation if it is possible?

Hi,
You can configure the GRE tunnel on the 2811.
I'm aware that you can configure sort of a GRE tunnel on the Fortinet as well, but I have not seen a GRE tunnel between a Cisco and other vendor.
I've only seen GRE tunnels between Cisco devices (however I have not tried it to assure you that it will not work :-()
Federico.

Easy Question How to create Basic Groups and add respective Users

Please help. I need to know how to create a basic group and later add users to the group. The group name would be callled Hardware and I will add johnsmith and janedoe to the group. Should I concern myself with the group id for whatever reason? I think the command is somthing like groupadd. Do I do somthing like:
# groupadd Hardware
# useradd -G Hardware johnsmith
# useradd -G Hardware janedoe
I'm using Solaris 10 if that helps.
A million thanks I very New2Solaris,
Johnny Mac

Ok here is what I found on the net:
change a user's group information change a user's primary group membership:
usermod -g Hardware johnsmith
usermod -g Hardware janedoe
I forgot to mention that these are existing accounts (sorry)
In order to change user's supplemental group membership:
usermod -G Hardware johnsmith
usermod -G Hardware janedoe
is the supplemental group simply adding them to another group and not changing there primary group, which by default I think is staff. I would like to keep them in staff and add them to another group, in this case Hardware.
Anyones thougths?

[Solved] Questions about /etc/group and /etc/gshadow

This morning, package filesystem was upgraded to 2015.02-1 and pacnew files were created for /etc/group and /etc/gshadow. I ran diff against my current files, and the differences seem very minor, to me. I need some guidance to understand whether I should implement the pacnew changes.
The only significant difference I see in the group file is that in my original version, my username is added to the wheel group. This seems correct, to me.
For gshadow, there is the same difference for wheel. However, there are several entries where my original entry contains an exclamation point, but the new version does not. For example:
< proc:!::
> proc:::
If I run man /etc/gshadow, it does not give me what I understand as a man page, and gives me what appears to be a listing of the stuff in my /etc/gshadow file, instead. Which does not help me.
So, like I say, I need some guidance on dealing with these pacnew files.
Tim
PS - I now see that "man gshadow" gives me an actual man page. Sorry. I am currently studying it.
Last edited by ratcheer (2015-02-24 21:37:52)

After the update to filesystem 2015.02-1 some voices in /etc/gshadow were changed (in the pacnew file) from
systemd-journal-gateway:!::
systemd-timesync:!::
systemd-network:!::
systemd-bus-proxy:!::
systemd-resolve:!::
to
systemd-journal-gateway:::
systemd-timesync:::
systemd-network:::
systemd-bus-proxy:::
systemd-resolve:::
What's the change? Before they had a locked password (the ! sign) and now they haven't?

Building a template - groups and formulas

CR2008
I'm trying to build a template to standardize some reports. I can get the header and the formatting fine: however, when I created a formula for Page M of N, the formula disappeared, and the field was replaced with one of the header fields. Does this just not ever work, or am I missing something?
The documentation says "If an existing report is used as a template, these report objects will be applied to the new report: Fields, Groups, Summary fields". However, when I tried to save a grouping and apply it to an existing report, nothing happened - only the formatting came across.
Thanks for any and all help!
Edit: I added a TemplateField to my template and grouped on it, and applied it -- didn't work. However, when I then added grouping to the report, and re-applied the template, the new groups picked up the formatting from last time. When I added more groups than there were in the template, the newest groups were formatted the same as the last group I had specified. The Custom Group Name, which I had specified to be TemplateField2, (the same as the second grouping) still wasn't picked up, though. When I only specified a single TemplateField in the detail line, the Template Expert split the detail section into seven stacked detail sections, so that won't be much use.
So, the other question remains: am I completely out of luck with formulas? And functions, for that matter? Thanks again!
Edit again: I tried adding a Summary field to the template. While combining a text field and a summary field didn't work, dropping them next to each other did. Also, it only worked for the same summary: when I accidentally did a Sum instead of a DistinctCount, as the template was expecting, the formatting was ignored.
Edited by: Garrett Fitzgerald on May 7, 2009 3:03 PM
Edited by: Garrett Fitzgerald on May 7, 2009 3:34 PM

Hello Rashmi,
I'm not sure if I understood your question, but it seems you have to put your key figures in columns, together with time, if, for example, you want to show information like this:
.........................................................                                                                           06.2008      07.2008 ...
..........................................................                                                 kf1 kf2....      kf1 kf2
Org->Channel->customer->product
Please let me know if is this you are looking for.
Best regards,
Sue

Channel-Group on 5508 Controller

Ok .. I have an odd question regarding creating channel groups to connect 5508 controllers to my network.
Today I have a single 5508 Controller and it is attached to the network using two interfaces configured as a channel group. I am in the process of adding a second controller to be an HA for the existing controller. Here is my question. Do I simply add the interfaces of the new controller to the existing channel group or do I need to create a unique channel group for the new secondary controller? I am thinking that the channel groups are basically a point to point type connection and are basically connection specific right?
Brent

Assuming you aren't doing VSS. I keep the channel numbers the same on both side.
See below:
A-SIDE
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SD) -
200 Po200(SU) - Gi7/9(P) Gi7/10(P)
201 Po201(SU) - Gi7/11(P) Gi7/12(P)
250 Po250(SU) - Gi3/15(P) Gi3/16(P)
6500-A#
B-SIDE
Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SD) -
200 Po200(SU) - Gi7/9(P) Gi7/10(P)
201 Po201(SU) - Gi7/11(P) Gi7/12(P)
250 Po250(SU) - Gi3/15(P) Gi3/16(P)
6500-B#

Windows Replication RPC Problems with IPSec GRE Tunnel

We have been having significant issue in troubleshooting random RPC errors with our directory controllers (MS AD 2008R2) and our distributed file shares. Both services will randomly stop working, throwing RPC errors as the resulting cause. We have been all over both Cisco and Microsoft forums in trying to troubleshoot this problem. I'm trying to the Cisco forums first to see if anyone has any network layer thoughts as to best practices or ways to configure the tunnel.
Our network is simple: two small branch offices connected to each other with two Cisco 2901 ISRs. An IPSec GRE tunnel exists between both offices. Interoffice bandwidth is approximately 10mbps. Pings between offices work, remote desktop works most of the time, file transfers work, and DNS lookups work across both locations. We really don't have a complicated environment, I'd think it wouldn't be too hard to set up. But this just seems to be escaping me. I can't think of anything at the network layer that would be causing problems but I was curious whether anyone else out there with knowledge of small office VPNs might be able to render some thoughts on the matter.
Please let me know if there is anything further people need to see. My next step is MS forums but I wanted to eliminate layer 3 first.
Tunnel Config:
crypto map outside_crypto 10 ipsec-isakmp
set peer x.x.x.x
set transform-set ESP-AES-SHA
match address 102
crypto ipsec df-bit clear
interface Tunnel0
bandwidth 10240
ip address x.x.x.x x.x.x.x
no ip redirects
ip mtu 1420
ip virtual-reassembly in
zone-member security in-zone
ip tcp adjust-mss 1375
tunnel source GigabitEthernet0/0
tunnel destination x.x.x.x
crypto ipsec df-bit clear
end

Hi,
Based on the third-party article below, you can setup VPN connection between Windows VPN client and Cisco firewall:
Step By Step Guide To Setup Windows 7/Vista VPN Client to Remote Access Cisco ASA5500 Firewall
What is the Windows server 2008 R2 for, a RADIUS server? If yes, maybe the links below would be helpful to you:
RADIUS: Configuring Client VPN with Windows 2008 Network Policy Server (NPS) RADIUS Authentication
Configuring RADIUS Server on Windows 2008 R2 for Cisco Device Logins
RADIUS authentication for Cisco switches using w2k8R2 NPS
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Best regards,
Susie

IDSM placement and redundancy question

Hi, Does the IDSM-2 support any sort of redundancy protocol?
I can't see anything in the config guide.
If I wanted to place a redundant pair on the outside of a pair of firewalls, how would I manage the redundancy of them.
My other question is, is it better to place the IDSM on the outside of external facing firewalls or on the inside?
Many Thanks, Dom

These are two IDSM-2s connected to slot four and give of the same chassis. We are running FWSM >> MSFC OUTSIDE setup. All InterVLAN traffic is evaluated first by the IDSM than by the FWSM. Users default gateway is the FWSM.
Here you go:
intrusion-detection module 4 management-port access-vlan 100
intrusion-detection module 5 management-port access-vlan 100
intrusion-detection module 4 data-port 1 channel-group 5
intrusion-detection module 4 data-port 2 channel-group 6
intrusion-detection module 5 data-port 1 channel-group 5
intrusion-detection module 5 data-port 2 channel-group 6
intrusion-detection port-channel 5 trunk allowed-vlan 200-204,208
intrusion-detection port-channel 5 trunk allowed-vlan 708
intrusion-detection port-channel 5 autostate include
intrusion-detection port-channel 5 portfast enable
intrusion-detection port-channel 6 trunk allowed-vlan 260,280,400,401
intrusion-detection port-channel 6 trunk allowed-vlan 111-114
intrusion-detection port-channel 6 autostate include
intrusion-detection port-channel 6 portfast enable
Regards
Farrukh

ASR - IPSEC, GRE, channel group, and MTU Questions

Similar Messages

Maybe you are looking for