Distribute list in Nexus 7K to allow only default route
Hi All,
We are about to migrate our core routers into two Nexus 7Ks with four VDCs each.
I was planning to permit only the default route (0.0.0.0) into the building aggregation switch (Cisco 6509). I planned to use distribute-list as I have done it in IOS and I could allow it through any specific interface I want.
Well, how do I do that in Nexus 7K? I don't see any distrubute list option. I can use prefix list, but then how do I specify the particular interface?
Many thanks in advance.
Mondal
CCIE #29034
Well, I found my own answer!
Here is the command that goes on the Interface. I kept typing IP eigrp and hence did not get any option! Thanks for looking. You do offset-list the same way.
ip distribute-list eigrp Test1 route-map EigrpTest in
Similar Messages
-
Nexus: multiple ip distribute-list eigrp statements allowed ?
Hi,
I need to clarify if Nexus 7K (NX-Os 6.1(3) ) supports multiple "ip distribute-list eigrp" statements in interface configuration.
Currently, there is already one statement to only allow default GW (0.0.0.0) routing information be sent.
I need to allow a few more specific routes to be shared with the facing device.
Can i have several distribute-list statements on the same interface ?
Or it it mandatory to handle this at the ip prefix-list level with multiple allow/deny rules.
I'm in a situation where i want to ammend the configuration without modifying existing objects or have to removed those who turned unused.
According to Cisco general EIGRP documentation, multiple seems to be accepted.
However, GNS3 simulator with a 7200VXR show that the new statement replaces the former one !
Moreover, Nexus logic is often different and i didn't capture any clear statement for this in Nexus specific documentation.
Needless to says that I have no test plateforme and no possibility to test that for the moment.
If someone can confirm it's supported, i would appreciate.
ThxHi,
I don't have a setup where I can try to see if this actually has the effect you're after, but you can certainly apply more than one distribute-list to an interface.
N7K-2(config-if)# ip distribute-list eigrp DIST_LIST route-map FRED outN7K-2(config-if)# ip distribute-list eigrp DIST_LIST1 route-map FRED1 outN7K-2(config-if)# ip distribute-list eigrp DIST_LIST2 route-map FRED2 outN7K-2(config-if)# sh run int eth3/1!Command: show running-config interface Ethernet3/1!Time: Mon Feb 3 23:04:01 2014 version 5.2(1)interface Ethernet3/1 ip address 1.1.1.1/24 ip distribute-list eigrp DIST_LIST route-map FRED out ip distribute-list eigrp DIST_LIST1 route-map FRED1 out ip distribute-list eigrp DIST_LIST2 route-map FRED2 out no shutdown N7K-2(config-if)#
Regards -
I want to configure Firefox to only accept cookies from a specific list of websites, but my "Allow Exceptions" list is deleted when Firefox closes. (Firefox 5.0)
@dmcritchie:
''How do you expect to keep cookies for certain sites, if you wipe out all of your cookies when the session ends or you clear the same history through the Tools menu''
If you mean from session-to-session, I don't expect it to keep cookies. That's the whole point. Every time Firefox is opened, I want it to write a new cookie, and keep that cookie until it closes and no longer than that. (Perhaps I should clarify: I don't mean session in the networking sense but rather in the period of time when one starts using Firefox until Firefox closes.) The behavior I want is for it to be able to write cookies when open, but only for specific sites, and then forget about them on close.
I should also mention that your responses are worthless to me because you don't explain anything. For instance, the quote above is ''not'' obvious from your reply of "Make sure you are not clearing cookies". You need to explain this; what is obvious in a reading for you is not obvious for everyone.
Furthermore, how is "Site Preferences" related to "everything on the right-side"? (Not to mention that it's unclear what you mean by "right-side.") -
Distribute List Nexus 7000 / OSPF
I was trying to limit the routes that our ospf should learn, same on 6500 as "distribute-list".
It´s on a VRF.
on http://docwiki.cisco.com/wiki/Cisco_NX-OS/IOS_OSPF_Comparison it says that it isn´t possible.
Any ideas? Is it true? Should I use just redistribute list?
Thanks########UPDATE########
Since version 6.x Cisco added a feature called table-map.
It works like distributed lists and did what I needed. We are using it already. Info at link above:
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/6_x/nx-os/unicast/configuration/guide/l3_cli_nxos/l3_ospf.html#pgfId-1361896
Maybe it helps.
So to make configuration...
1) I need to make a prefix-list
ip prefix-list Filter_List_in seq 10 permit 10.20.30.40/32
ip prefix-list Filter_List_in seq 20 permit 10.30.20.26/32
ip prefix-list Filter_List_in seq 30 permit 10.40.30.20/32
2) Make a route map and use prefix-list.
route-map Permit_in permit 10
match ip address prefix-list Filter_List_in
3) And apply on ospf (show run).
router ospf 10
vrf VRFOSPF
router-id 10.0.0.21
network 10.20.208.21/32 area 0.0.0.0
redistribute static route-map RM_static
area 0.0.0.0 authentication message-digest
area 0.0.0.0 filter-list route-map Permit_in in
log-adjacency-changesrouter ospf 10
And clear neighbors. (IPs were changed)
When I use the show ip ospf policy... filter in... => no match
route-map Permit_in permit 10
match ip address prefix-list Filter_List_in C: 0 M: 0
Total accept count for policy: 0
Total reject count for policy: 0
I couldn´t figure why it isnt working.
I also tried to apply the filter list going to (config t --> vrf context VRFOSPF --> router ospf 10 --> and apply the filter list).
Any Ideas?
Edited:
"To filter prefixes advertised in type 3 link-state advertisements (LSAs) between Open Shortest Path First (OSPF) areas of an Area Border Router (ABR),"
"The NX-OS does support inter-area Type-3 LSA/route filtering using the filter-list command configured under the OSPF routing instance."
We will create a ABR on nexus to apply filter-list
Thanks for help. -
Hello,
I have a ArrayList.
ArrayList as = new ArrayList();Now i want to allow only string to be added in this arraylist how can i achieve this? Don't want to use generic.
Please guide.Ankur Raiyani wrote:
i have been asked to do not use generic.
In given example where you have seen generics. It is clearly said if you don't want to use generics then use instanceof keyword.
I want such a way that List only allows me to add String if i add other object then it should throw an error.Exactly , i've gave an idea how to use instanceof and allow only string objects in arraylist.
If not clear, please go through the below program:
import java.util.*;
import java.lang.*;
class ArrayListForOnlyString
public static void main(String st[])
List stringArrayList = new ArrayList(){
public ArrayList ar = new ArrayList();
public boolean add(Object ob) throws UnsupportedOperationException
if(ob instanceof String)
ar.add(ob);
return true;
else
throw new UnsupportedOperationException("Only String Object are accepted");
public void add(int index, Object ob)
if(ob instanceof String)
ar.add(index,ob);
else
throw new UnsupportedOperationException("Only String Object are accepted");
public Object[] toArray()
return ar.toArray();
public String toString()
return ar.toString();
try
stringArrayList.add(new String("10"));
stringArrayList.add(1,new String("10"));
// Uncomment the below line and run, it 'll give error , as you are trying to add Integer Object to array list.
//stringArrayList.add(new Integer("10"));
System.out.println("The objects of arrayList are : "+stringArrayList);
}catch(Exception e)
e.printStackTrace();
}Edited by: 833545 on Aug 31, 2011 3:53 PM -
How to allow only part of users in AD login sharepoint?
We have a SP2013 farm using windows authentication. On the AD there are 10,000 user accounts and we have no edit permission on AD. (Hence, I cannot setup any group there) As the Sharepoint admin I only have a list of 1,000 users allowed to access. There
is no existing group setup to indicate these 1,000 users.
My question is, how can I allow these 1,000 user login Sharepoint while blocking the other 9,000?
My concern is these 9,000 users will get their My Site self-created when he browse the My Site web application. Another concern is when they access some page without authorization, they will get a form allow them asking for access. The site owner may grant
access to them by mistake which I need to avoid.
Thanks.Hello Mark,
Regarding the second part of your question. You can uncheck the option 'Allow requests for Access', it is described how in the following thread:
http://social.msdn.microsoft.com/Forums/sharepoint/en-US/d1e948cf-6289-48f9-9f25-81b57b292c40/how-to-hide-request-access
- Dennis | Netherlands | Blog |
Twitter -
iOS obviously allows only 10 Apps to be Chosen in The "Open in" function. How can I control which Apps ( if more than 10 are installed) can be selected?
I think that is influenced by the order in which the apps are installed on the iPad (I believe that it's the most recent 10 ?) - but as I haven't got more than 10 apps that support any document/file type I can't check.
If you want to able to edit the list, then you could try leaving feedback for Apple : http://www.apple.com/feedback/ipad.html -
EIGRP and Distribute-list commands
I am reviewing one of our WAN routers, on an infrastructure I have recently inherated, and noted an EIGRP configuration which doesn't make much sense to me. I'm wondering if I misunderstand the intent. The WAN router has the following EIGRP configuration:
router eigrp 102
variance 4
redistribute connected
redistribute static
network 10.0.0.0
network 172.1.0.0
network 172.20.0.0
network 172.22.0.0
network 172.24.0.0
network 172.25.0.0
network 172.27.0.0
network 172.30.0.0
network 192.9.200.0
network 192.9.201.0
network 192.168.0.0
network 192.168.2.0
maximum-paths 2
default-metric 64 200 255 1 1500
distribute-list 20 out Serial3/0.41
distribute-list 20 out Serial3/0.76
distribute-list 20 out Serial3/0.100
distribute-list 20 out Serial3/0.104
distribute-list 20 out Serial3/0.106
distribute-list 20 out Serial3/0.107
distribute-list 20 out Serial3/0.111
distribute-list 20 out Serial3/0.112
distribute-list 20 out Serial3/0.113
distribute-list 20 out Serial3/0.117
distribute-list 20 out Serial3/0.118
distribute-list 20 out Serial3/0.131
distribute-list 20 out Serial3/0.170
distribute-list 20 out Serial3/0.175
distribute-list 20 out Serial3/0.186
distribute-list 20 out Serial3/0.190
distribute-list 20 out Serial3/0.191
distribute-list 20 out Serial3/0.198
distribute-list 20 out Serial3/0.199
distribute-list 20 out Serial3/0.205
distribute-list 20 out Serial3/0.210
distribute-list 20 out Serial3/0.226
distribute-list 20 out Serial3/0.251
distribute-list 20 out Serial3/0.621
distribute-list 20 out Serial3/0.629
distribute-list 20 out Serial3/0.637
distribute-list 20 out Serial3/0.647
distribute-list 20 out Serial3/0.658
distribute-list 20 out Serial3/0.663
distribute-list 20 out Serial3/0.677
distribute-list 20 out Serial3/0.696
distribute-list 20 out Serial3/0.700
distribute-list 20 out Serial3/0.719
distribute-list 20 out Serial3/0.733
distribute-list 20 out Serial3/0.762
distribute-list 20 out Serial3/0.763
distribute-list 20 out Serial3/0.771
distribute-list 20 out Serial3/0.772
distribute-list 20 out Serial3/0.776
distribute-list 20 out Serial3/0.783
distribute-list 20 out Serial3/0.801
distribute-list 20 out Serial3/0.803
distribute-list 20 out Serial3/0.810
distribute-list 20 out Serial3/0.822
distribute-list 20 out Serial3/0.830
distribute-list 20 out Serial3/0.832
distribute-list 20 out Serial3/0.853
distribute-list 20 out Serial3/0.855
distribute-list 20 out Serial3/0.880
distribute-list 20 out Serial3/0.915
distribute-list 20 out Serial3/0.1000
no auto-summary
eigrp log-neighbor-changes
However, access list 20 is constructed as follows:
access-list 20 permit 0.0.0.0
access-list 20 deny any
If you have a distribute-list statement within EIGRP but the ACL permits 0.0.0.0, does that make any incoming/outgoing updates passive in any way? The remote routers connected to the WAN have no passive/no passive configuration parameters. Only the core WAN routers do.
Please advise.Marking a remote stub does not, today, restrict what routes are advertised to the stub router, they just limit the queries to the stub routers. So, you'd still need the hub side distribute list to block the routes out to the stubs. A distribute list doesn't block queries, by the way, it just limits knowledge of routing information, which impacts how far a query will go.... You should definitely make the remotes stubs to reduce the query range, in other words, even with this distribute list configured.
At any rate, there is a feature planned for the future to make it where you could turn on an option at the stub router to make the hub router automatically filter everything but the default out.
HTH....
Russ -
Explanation about gateway in distribute-list?
Hi All
I have a question. Anyone can give me an explanation about distribute-list? What is meaning of "gateway" ? Thank you
ip prefix-list max24 seq 5 permit 0.0.0.0/0 ge 8 le 24
ip prefix-list allowlist seq5 permit 192.168.1.1/32
router rip
network 172.18.0.0
distribute-list prefix max24 gateway allowlist in
gateway prefix-list-name
(Optional) Name of the prefix list to be applied to the gateway of the prefix being updated.prefix-list is used generally when you want to control the routes(prefixes) that is being sent or received to neighbors in routing protocols like RIP,EIGRP,BGP, it can also be .for route tagging etc.
In prefix list for example
a.b.c.d/x ge y le z
x bits should always match in prefix while the subnets should be <= than (le) z and >=(ge) y
10.1.0.0/16 le 24 ge 16 will have 10.1.0.0/18 but no 10.1.1.127/25.
Distribute-list to used to suppress the routes either in inbound or outbound direction. Say from other end of eigrp neighbor router you are receiving x,y,z routes, but you want only x in your RIB. So you can deny route y and z. Similarly your router is advertising routes to its neighbor and you want to hide some routes from them, you can do so with help of distribute-list.
Gateway keyword is used to specify the neighbor from/to you are denying/sending routes. In simple term you have two RIP neighbors you want to send route only to one particular neighbor but not other one. -
Hi all,
is there any way to allowe only PPPoE comunication on ethernet port on 2960X or 2960S catalyst switches?
Thanx
BR
DavidHi Reza,
I think David's question focused on something else: can you configure an access port on a switch so that the only frame it accepts is a PPPoE frame?
In my opinion, that should be possible - the easiest way of doing that would simply be to configure a port-ACL (PACL) that drops all IP traffic whatsoever. PPPoE-encapsulated packets are not treated as IP packets by the switch, so IP PACL will not apply. So simply doing something like this should do the trick:
ip access-list standard NoIP deny any!interface FastEthernet0/1 ip access-group NoIP in
If we wanted to be very precise, we could also create a MAC ACL to further narrow down the non-IP traffic allowed through a port. PPPoE uses EtherType values 0x8863 and 0x8864. The MAC ACL would need to be carefully specified, though, to allow other Layer2 control and management plane traffic (STP, DTP, VTP, CDP, LLDP, PAgP/LACP, UDLD, LOOP...), so it could be more difficult to create properly.
I even believe that creating a VACL would be possible although the VACLs are not officially supported on 2960 Catalysts yet (still, with a very recent IOS, they can be created and used just fine).
Best regards,
Peter -
When viewing pick lists from different web sites my iPad 2 (safari) selects the first choice on the list and loads it without allowing me to pick my option; is there a way to change this default?
With your playhead over the clip in the timeline and that V track's 'track selector' as the only one active...hit the 'f' key.
This will load the original clip into the viewer at the matching point of the frame in the timeline.
K -
List View in ios8 on iPhone only shows 1 year
List view in ios8 on iPhone only shows 1 year. Earlier events are there, and you can see them in other views, but not in List View. Any ideas?
OK, I solved it. Here is the solution if you have precisely the problem I had.
1. On the iOS device: delete the iCloud account.
2. Go to the Apple ID website and make sure the ONLY email there is the me.com email and that it is set as primary. If you Mac.com email is listed as a secondary email THIS will cause the problem. So delete the Mac.com email.
3. Log back in to iCloud on the iOS device.
Only you wanted to use the Mac.com address and not the me.com one, you could follow the above instructions just swapping me and Mac. -
How can I see shared pc with firewall set to allow only essential services?
How can I see shared pc with firewall set to allow only essential services?
So far if I set it as above then shared does not show up? I have to set the firewall to set access to specific applications and services to get access to my windows based hard drive.
Cheers
Mike ROk I solved it myself. Not an ideal solution as I have to connect it manually each time but it will do... Unless anyone has a way to have it auto connect when I start the mac.
Cheers
Mike R -
i am trying to purchase many songs at one time. i have added all songs to wish list , now to purchase it will only let me do one at a time please advise how i can purchase more than one at a time
There used to be a 'buy all' button on the wish list screen but for some reason that has been removed from the current version of iTunes so you will need to buy each item individually. You can try leaving feedback for Apple and maybe it'll be added back in a future update : http://www.apple.com/feedback/itunesapp.html
-
So my I phone 4s volume has decided to pack allowing only my phone to make sounds when I have an incoming call, I can also here fine using facetime and receiving calls. YouTube, soundcloud, any of I players will no longer play sound. I've restored the phone using iTunes on my laptop and checked all the volumes are turned up and the button at the left hand Side of the phone is in the correct position.
Try inserting and re-inserting your headphones 7 or 8 times. Also try cleaning out the headphone jack in case of debris that might be interfering with the connection/disconnection.
Maybe you are looking for
-
BlueTooth driver installation bluescreen "VIDEO_DXGKRNL_FATAL_ERROR" on Windows 8.1 ENT
Dears, My new Lenovo ThinkPad E440 turns into a blue screen with the error code: VIDEO_DXGKRNL_FATAL_ERROR when im trying to install the bluetooth driver using Lenovo System Update Program or using the downloaded package "Realtek RTL8723BE Bluetooth
-
ITunes on iPad after iOS 6 upgrade
Has anyone had a problem connecting to iTunes after upgrading to iOS 6 on iPad?
-
Bluetooth - any hope for file transfer in near future???
Hi, Presently iPhone 4 does not allow bluetooth file transfer to other mobile devices and even my PC. I am not interested in illegal music/video transfer but genuinely transferring my data files between pc and other mobile devices and use it like a m
-
Generation of SAP BASIS 7.10 USERDETAILS failed
Hello to all, i hope anybody can help me. I have installed a new MI 7.10 and patched it to Lvl. 7 (ABAP and BASIS). Then i tried to do all the necessary steps for administration as they are described in http://help.sap.com/saphelp_nwmobile71/helpdata
-
You want an iPhone 4S? be prepared to jump through some loops
After making people wait for a new iphone for a year and half, Apple has made a half a*s job of it and come up with an updated version of the iphone 4, Their customer services have also gone down the pants. I have been to the apple shop 3 times in th