To Clear A PAssive EIGRP Route
We have a Cisco router which has learned an incorrect passive eigrp route; we would like to clear this route from the router but don't know how.
We'd like to avoid rebooting the router if possible.
Any info on this is appreciated.
Hello,
where from the route was injected into EIGRP? As long as the route is injected it will be announced to all EIGRP routers. "Passive" means just, that the route is learned and no queries are unanswered. This is the normal state of any route in EIGRP.
So to get rid of the route you should have a look at the router injecting it and reconfigure it to not advertise it.
Hope this helps! please rate all posts.
Regards, Martin
Similar Messages
-
Eigrp routes doesn't refresh when neighbor down
hi guys, need some tips for troubleshooting an ongoing issue, but can't do the changes anymore untill next call and yes the issue is still ongoing.
WAN1 <--------------------------------------------------------------------------------------------> WAN2
| |
metro ethernet ME-3600X-A <----> ME-3600X-B <-----> ME-3600X-C<----> c3560v2
I have 3 metro ethernet switches and a c3560v2 switch connected as above. The WAN1 redistributes all routes to ME-3600X-A's eigrp and WAN2 redistributes all routes to c3560v2 's eigrp and these two propagates all their eigrp routes to ME-3600X-B and ME-3600X-C which are in the same eigrp AS. And all link/connections are point-to-point.
Now, when the link between ME-3600X-B <----> ME-3600X-C is physically disconnected, the ME-3600X-C's eigrp still points the route(s) to the ME-3600X-B's p2p ip as its next-hop - which is down(neighborship between them goes down, but still the routes doesn't refresh/rebuild). However, switch c3560v2 has route to the same network learnt from WAN2.
Wonder why, need inputs please? Thanks.You shouldn't reference the CrystalReportViewer in the Page_Load handler, since there's issues with serialization of the report source:
http://devlibrary.businessobjects.com/BusinessObjectsXIR2SP2/
en/en/CrystalReports_dotNET_SDK/crsdk_net_doc/doc/
crsdk_net_doc/html/
crconsdkfundamentalspersistencepageloadeventhandler.htm
In fact, you should save the report source in session, and bind it to the viewer on post-back. Sample code can be found here:
http://resources.businessobjects.com/support/communitycs/
FilesAndUpdates/sample_applications_for_.NET_developers.pdf
Sincerely,
Ted Ueda -
EIGRP Routing across MPLS Cloud
I appologize if this has been covered but I dont see any exact hits...
We are working with our Service Provider to implement MPLS between our remote sites and main campus. We are currently using PtoP T1 in a hub and spoke model. We are running EIGRP in our entire environment.
We would like to continue to run EIGRP in our environment but the SP does not support this protocol through the cloud. I would prefer not to introduce any new routing protocols into our environment such as BGP. (I believe SP is running BGP).
I have read snippits that I can us e GRE tunnel between sites and send EIGRP routing updates via this tunnel.
Can anyone support this method or are there better alternatives? If I implement GRE, I will still need to configure static routes so GRE knows how to reach the remote sites. I also cannot find any literature on how to configure GRE tunnels and use them ONLY for routing updates. I would think sending all traffic via GRE would cause additional overhead.
I will also have a need to send Multicast traffic between sites. I have read that GRE is the way to do this. To me it seems GRE will serve dual purposes.. first to allowing Dynamic routing updates between sites and also to allow Multicast traffic.
I appreciate any comments or suggestions!Hello Phil,
using GRE tunnels to build an overlay would deny one of the greatest benefits of MPLS L3 VPN: the peer model where each CE talks only with local PE node.
unless you have a small number of sites this approach is not recommended.
What if a new site is added in the future? you would need to configure a tunnel GRE to the new site in each of the existing sites.
You could run a DMVPN ( that is to use mGRE) to solve this but it has some complexity.
You can run BGP without using mutual redistribution: BGP allows to advertise internal networks using the network command even if they are not directly connected to the CE router but learned via EIGRP.
So it is enough to redistribute only BGP into EIGRP by setting a default seed metric (it requires five values in EIGRP and it is necessary or redistribution will not occur)
router bgp 65001
neigh PE-address remote-as SP-AS-number
network 10.10.10.0 mask 255.255.255.0
network 10.10.20.0 mask 255.255.254.0
no auto-summary
! note:if auto-summary is disabled you need to provide the exact mask / prefix length
router eigrp 100
redistribute bgp 65001
default-metric 10000 1000 255 1 1500
! BW delay reliabilty load MTU
Hope to help
Giuseppe -
Hi,
Wondering any one has successfully set route tag for EIGRP routes?
What I am trying to achieve here is to set route tag for the summary routes of the connected interfaces and subnets of some other connected interfaces.
Let's say an ISR router R1 with IOS 15.1(4)M3 has three interfaces running with EIGRP.
Interface Gi0/0
ip add 172.16.0.1/24
summary-add 172.16.0.0/16
Interface Gi0/1
ip add 172.16.1.1/24
summary-add 172.16.0.0/16
Interface Gi0/2
ip add 192.168.2.1/24
I am having difficulty to set route tag for summary add 172.16.0.0/16 and 192.168.2.0/24 before they get advertised to another router.
Any idea please?
Thanks
CedarDuplicate posts.
Go here: https://supportforums.cisco.com/discussion/12256521/isr-router-eigrp-route-tag -
Overwrite dynamic (eigrp) route when external dials into router
Hi
I would like to find a way to overwrite a dynamic (eigrp) route with a routing entry pointing to a dialer interface, when someone has dialed into this dialer interface.
Does someone of you knows a way how this can be done?
Thanks in advance and kind regards
MarkThanks tor you reply.
Until now I have heard of reverse route injection only in conjunction with setting up vpn connections. And a quick search doesn't shows much. But I keep on searching.
Maybe I should tell something more about my setup. There are 2 routers (both 2612). On the LAN side the do hsrp. And on the WAN side each of them has 2 BRI interfaces connected to a multi-line-hunting-group for dialin and dialout. On the LAN I do eigrp and so overwrite a static route pointing to the dialer on the second router because of an administrativ distance of 200 at the static route.
When dialing out everything works fine. But when someone dials in to the second router (which is the hsrp standby one) the routing table of this router isn't changed/updated. I Bad expected something like a "directly connected" event puts a new entry in the routing table pointing to the now connected dialer Interface. But this does not happen.
What I'm looking for is a way how this can be done, so that these is a backward pointing route on the hsrp standby router for the dialed in sides.
Is there a way to do this?
Regards
Mark -
How would I stop eigrp routes being advertised so that it doesnt keep bringing up my isdn line, what do I put on the access list ?
access-list 100 deny eigrp any any
access-list 100 permit ip any any
!--- EIGRP routing packets are denied in the dialer-list.
!--- This prevents eigrp packets from keeping the link up.
!--- Adjust the interesting traffic depending on your traffic definitions.
dialer-list 1 protocol ip list 100
http://www.cisco.com/en/US/tech/tk713/tk237/technologies_configuration_example09186a00800a3b77.shtml -
Setting advertisement / split horizon direction in EIGRP routing
Hello all,
I am trying to work out if I am being a bit rubbish or if split horizon is my new worst enemy.
Below is a diagram of my (simplified) problem scenario using EIGRP.
The solution I am looking for is that Router R3 learns of the 10.0.0.0/8 network from both R1 and R2, then does not advertise it to either. Simple with split horizon enabled.
But when either R1 or R2 are rebooted, a decision somehow takes place, and may well determine that R3 should advertise 10/8 to the new (rebooted) neighbour, at which point split horizon prevents it from being advertised back again. This means the topology table on R3 doesn't contain this route for this neighbour and is slow to converge if the other neighbour is lost.
Is there a way to control in which direction routes are advertised first on a neighbour link? and then I can let split horizon do its thing
Or is there something I am not thinking of...
many thanks,
PaulThis is what i think would work.
Two assuptions i'm making -
1) R1 and R2 have full routes in terms of the remote branch subnets which from what we have talked about seems to be the case.
2) R1 will advertise the specific subnets it is primary for (see below) to R3 which then advertises them to R2 and R2 will do the same for it's primary subnets.
R1 is primary for 32 - 63 summary address 192.168.32.0 255.255.224.0
R2 is primary for 64 - 95 summary address 192.168.64.0 255.255.224.0
Each router is secondary for the other router's primary subnets.
on R1 configure a summary address for R2's subnets on the interface connecting to R3 -
ip summary-address eigrp <AS no> 192.168.64.0 255.255.224.0
on R2 do the same for R1's subnets -
ip summary-address eigrp <AS no> 192.168.32.0 255.255.224.0
So now -
R1 points to R3 and R3 points to R2 for 192.168.32.0/19
R2 points to R3 and R3 points to R1 for 192.168.64.0/19
Because you have used a summary address this suppresses the advertisement of the more specific routes within that summary range.
R1 will therefore advertises it's specific subnets for which it is primary to R3 and a summary address only for R2's subnets.
And R2 does the same ie. it advertises it's specific subnets and a summary for R1's.
R3 then obviously passes these summaries via EIGRP to R1 and R2.
R3's routing table will have specific branch routes pointing to the respective
primary router but only a summary route for the same subnets pointing to the secondary router.
Because a router will always pick the longest match it will use the more specific subnets unless there isn't a matching route.
Which means no need to use metrics to load balance traffic.
In addition the summary route is already in the routing table so no need for either R1 or R2 to send a query to R3 if one of their branch links fail.
I may well have overlooked something so let me know whether you think this will work for you or not.
Jon -
Hello all. Do I need a L3 expansion module to run eigrp on the Nexus 5548P? Thanks,
Yes you do
-
How do you Redistribution EIGRP into OSPF and maintain a distance of 250 for a static route?
Ok, I have scoured the forums long enough and have to post. The design is below. I moved a firewall to our new data center, which required adding some static routes for VPN connections and broadband backups. To minimize the amount of static routes I redistribute static into EIGRP with a route-map and prefix-list.
My problem is the next part of my network. When the data leaves my 56128's it hits an edge device connecting to our dark fiber. On this edge device I am running OSPF onto the dark fiber, then redistribute some EIGRP subnets into OSPF and again all is well.
Everything works up until the point the redistributed routes hit my RIB at my main data center where I am running IBGP. IBPG is run between our MPLS router and core for all our remote sites. When my backup route from the 56128's hits the cores, it supersedes the BGP route because the AD route O E2 [110/20] is lower than the BGP AD B [200/0]. Given the configuration below what can be done to remedy this? Oh when I redistribute I can only change the AD for the backup routes, all other routes should stay the same.
56128's where my static routes are:
ip route 192.168.101.0/24 192.168.30.77 name firewall 250
router eigrp 65100
redistribute static route-map Static-To-Eigrp
route-map Static-To-Eigrp permit 10
match ip address prefix-list Static2Eigrp
ip prefix-list Static2Eigrp seq 2 permit 192.168.101.0/24
Edge device:
router eigrp 65100
network 172.18.0.5 0.0.0.0
network 172.18.0.32 0.0.0.3
network 172.18.0.36 0.0.0.3
redistribute ospf 65100 metric 2000000 0 255 1 1500
redistribute static metric 200000 0 255 1 1500 route-map STATICS_INTO_EIGRP
passive-interface default
no passive-interface Port-channel11
no passive-interface Port-channel12
eigrp router-id 172.18.0.5
router ospf 65100
router-id 172.18.0.5
log-adjacency-changes
redistribute eigrp 65100 subnets route-map EIGRP_INTO_OSPF
passive-interface default
no passive-interface GigabitEthernet1/0/1
no passive-interface GigabitEthernet1/0/2
no passive-interface GigabitEthernet2/0/1
no passive-interface GigabitEthernet2/0/2
network 172.18.0.0 0.0.255.255 area 0
ip prefix-list EIGRP_INTO_OSPF seq 5 permit 172.18.0.0/16 le 32
ip prefix-list EIGRP_INTO_OSPF seq 10 permit 192.168.94.0/29 le 32
ip prefix-list EIGRP_INTO_OSPF seq 15 permit 192.168.26.32/29 le 32
ip prefix-list EIGRP_INTO_OSPF seq 20 permit 192.168.30.72/29 le 32
ip prefix-list EIGRP_INTO_OSPF seq 25 permit 192.168.20.128/25 le 32
ip prefix-list EIGRP_INTO_OSPF seq 26 permit 192.168.101.0/24 le 32 <- Backup Route for MPLS Remote Office
route-map EIGRP_INTO_OSPF permit 10
match ip address prefix-list EIGRP_INTO_OSPFSo in the case of a /24. If it were say broken up into /25's? From our remote sites we are using aggregate-address summary-only. Not sure how I would advertise a more specific route via BGP, sorry.
I didnt have this problem until I moved my firewalls. They plugged into the cores where IBGP was running and the static never kicked in unless the bgp route disappeared. I guess I could use my static redistribution for my VPN sites and use statics across the cores for the handful of backup links I have. -
Hi,
I have a question concerning EIGRP routing on a L3 switch behind a HSRP HA pair of routers which connect to a WAN.
HSRP is operating as should be and when R1 fails, or an interface thereon, R2 becomes the active. All good.
However there are now two default routes in the route table on the L3 switch. One is routing traffic to the R2 real IP which is expected but also there is the old default route to R1's real IP.
Using EEM we can overcome this but is there another simpler method to prevent this occurring?
Thanks
FF
If i understand correcty your LAN interfaces on the routers ie. the ones connecting to the L3 switch are running HSRP and you are also running EIGRP between the L3 switch and the routers.
If so you wouldn't usually have both solutions in use ie. you either -
1) use HSRP and point the default route on the L3 switch to the HSRP VIP
or
2) use EIGRP between the routers and the L3 switch. If a router or interface fails it should stop advertising the default route to the L3 switch.
However that sounds like it is not happening which suggests the default routes are not coming from the WAN.
So where are the default routes in EIGRP on the L3 switch coming from ?
Jon -
Advertise route as OSPF, but I see it as "EIGRP" ?
Sorry if this is a stupid question but I don't understand well why I am able to see route
D 152.1.1.4/30 on RouterD.
Basically the network 152.1.1.4/30 has been advertised via OSPF on RouterC interface. However, that was not advertised there as an EIGRP route...
How come I am able to see it on RouterD as EIGRP ?
Please find attached complete run config.
Please note I am doing one-way redistribution EIGRP->OSPF. Therefore in my view that doesn't justify the EIGRP route for 152.1.1.4/30 on RouterD.
RouterB so]===[s0 RouterC s01]===[s0 RouterD]
RouterB s0=152.1.1.5/30
RouterB S1=152.1.1.6/30
RouterD S0=152.1.2.2/24
From RouterD:
Gateway of last resort is not set
152.1.0.0/16 is variably subnetted, 3 subnets, 2 masks
C 152.1.3.0/24 is directly connected, Loopback0
C 152.1.2.0/24 is directly connected, Serial0/0
D 152.1.1.4/30 [90/2681856] via 152.1.2.1, 00:01:58, Serial0/0Just one correction here.
network 152.1.1.5 0.0.0.0 area 0 is CORRECT, if the interface IP is 152.1.1.5.
The main misunderstanding encountered is: the network statement and especially the wildcard mask determine the routing updates sent. Wrong.
The only purpose the network statement serves in OSPF is to identify the IP interfaces where to send hellos and include the networks with configured mask into routing updates (LSAs).
So f.e.
router ospf 10
network 0.0.0.0 0.0.0.0 area 0
has nothing to do with a default route. it just means: "Include any active IP interface into OSPF and send hellos." Still configured network/mask would be announced correctly.
Writing this I would even recommend instead of 0.0.0.0 0.0.0.0 to use
network 152.1.1.1 0.0.0.0 area 0
because you will not unintentionally enable OSPF on an interface, where it should not start (f.e. towards ISP).
Hope this helps! Please rate all posts.
Regards, Martin -
Hi all,
I'm trying to redistribute BGP to EIGRP and vice versa. I am succussfully redistributing EIGRP to BGP, but can't get EIGRP routes into BGP.
Here's my config. Any guidance or assistance would be very much appreciated.
router eigrp 100 network 10.18.72.0 0.0.0.255 redistribute static route-map DEFAULT_ROUTE redistribute bgp 65535 passive-interface default no passive-interface FastEthernet0/0!router bgp 65535 bgp router-id 172.18.2.1 bgp log-neighbor-changes redistribute eigrp 100 route-map EIGRP_REDISTRIBUTE neighbor 172.18.2.2 remote-as 65535 neighbor 172.18.2.2 password ciscobgp no auto-summaryip access-list extended EIGRP_ROUTES_TO_BGP permit ip any any!!ip prefix-list DEFAULT seq 5 permit 0.0.0.0/0!route-map EIGRP_REDISTRIBUTE permit 20 match ip address EIGRP_ROUTES_TO_BGP!route-map DEFAULT_ROUTE permit 10 match ip address prefix-list DEFAULT
Thanks in advance.
NeilAdd "bgp redistribute-internal" to your bgp process. By default, iBGP doesn't redistribute into an IGP. The reason for this is simply the amount of routes that a bgp router can receive could overload an igp very easily, so you would definitely want to filter routes out when doing this.
After you add this, clear your bgp neighbors and you should start seeing routes.
HTH,
John
*** Please rate all useful posts *** -
(High Ip input) on My router , I need to troubleshoot why CPU is high !!!!
=================
i have a cisco router 7200 NPEG2 processor , worked as LNS for PPPOVPDN circuits (Router for ADSL clients)
i have "high ip input on my processor" and there is alot of differnce on my router between operations done by cef and operations done by router cpu
as an example , lets make show cpu process sorted
CPU utilization for five seconds: 67%/54%; one minute: 67%; five minutes: 68%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
87 10837056 46891299 231 6.31% 6.04% 6.32% 0 IP Input
122 4081972 38214106 106 2.47% 2.36% 2.46% 0 L2X Data Daemon
270 467844 2089101 223 0.79% 0.78% 0.79% 0 PPP Events
275 1862224 2102444 885 0.71% 0.73% 0.71% 0 SNMP ENGINE
112 627104 93588 6700 0.39% 0.36% 0.37% 0 CEF: IPv4 proces
273 854004 4207368 202 0.31% 0.26% 0.24% 0 IP SNMP
52 453256 12321 36787 0.31% 0.31% 0.31% 0 Compute load avg
258 295540 701580 421 0.23% 0.17% 0.15% 0 RADIUS
142 45792 14107303 3 0.23% 0.21% 0.21% 0 HQF Shaper Backg
78 86532 166975 518 0.23% 0.17% 0.13% 0 ACCT Periodic Pr
260 483164 248673 1942 0.23% 0.19% 0.24% 0 L2TP mgmt daemon
272 63980 1073491 59 0.15% 0.16% 0.15% 0 IPHC Admin
77 111560 184597 604 0.15% 0.08% 0.06% 0 AAA ACCT Proc
261 330572 217566 1519 0.15% 0.12% 0.15% 0 L2TUN Applicatio
274 450584 2102164 214 0.15% 0.15% 0.15% 0 PDU DISPATCHER
16 152352 1081873 140 0.07% 0.08% 0.19% 0 EnvMon
279 229040 27298 8390 0.07% 0.10% 0.11% 0 VTEMPLATE Backgr
40 23704 53593 442 0.07% 0.03% 0.02% 0 Net Background
95 4512 55604 81 0.07% 0.00% 0.00% 0 PPP Hooks
109 6844 62029 110 0.07% 0.00% 0.00% 0 IP Background
269 21384 1931910 11 0.07% 0.06% 0.07% 0 PPP manager
271 116 60672 1 0.07% 0.00% 0.00% 0 Multilink PPP
23 98400 321 306542 0.00% 0.07% 0.03% 0 AAA high-capacit
=====================
as we see above , we have high "IP Input" about differnece in cpu =67-54=13 % , which is high value process in software .
i follwed the article here :
http://www.cisco.com/c/en/us/support/docs/routers/7500-series-routers/41160-highcpu-ip-input.html
i check and found that my router is fine ,
no arp calls.
no routing loops.
no flapping links.
i checked that my router has cef enabled and no enormous routing protocol updates
i found that i have big differnce between hardware & software process on the router which is 13 %
but when the traffic is more and more , the cpu reach reach 93 % and begin to have drops.
i just want to ask , how can i debug the operations that are done on the cpu processor of the router ???
i mean that if i know that traffic , i can estimate and know the problem that increasing my cpu !!!
another question :
how to debug the packest that has a ttl exceeded 50 or ttl exceeded 100 ?????
i dont wan tto make debug ip packed , because i have a huge traffic and it will let my router hanged due to large debug !!
===============
righ now i will post my router config and some verification:
drvirus#sh running-config
Building configuration...
Current configuration : 12291 bytes
upgrade fpd auto
version 12.4
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no service dhcp
hostname drvirus
boot-start-marker
boot system flash disk2:c7200p-adventerprisek9-mz.124-24.T7.bin
boot system flash disk2:c7200p-adventerprisek9-mz.124-24.T8.bin
boot-end-marker
logging message-counter syslog
aaa new-model
aaa group server radius radiusservers
server-private 10..f.f.f auth-port 1812 acct-port 1813 key 7 weifuhjkefkjdbhfjkasbfjka
aaa authentication login adminstaff local
aaa authentication login sdm_vpn_xauth_ml_1 group radius
aaa authentication login ahmad local
aaa authentication ppp vpdn group radiusservers local
aaa authentication ppp drvirus local
aaa authentication ppp vpdn1 local group radiusservers
aaa authentication ppp ddd none
aaa authentication ppp dddd none
aaa authentication ppp anyok none
aaa authorization network default group radius local
aaa authorization network vpdn group radiusservers local
aaa authorization network sdm_vpn_group_ml_1 local
aaa authorization network drvirus local
aaa authorization network vpdn1 local group radiusservers
aaa authorization network ddd none
aaa authorization network anyok none
aaa accounting delay-start
aaa accounting update newinfo periodic 10
aaa accounting network vpdn
action-type start-stop
broadcast
group radiusservers
aaa server radius dynamic-author
client xxxxxxxx
client 10.xxxxxx
client 10.xxxxxxxxx
server-key 7 dihcbsdjkbvcsdhmbvhsdbvsdhmbvsd
auth-type any
aaa session-id common
clock timezone GMT+3 3
no ip subnet-zero
no ip source-route
no ip gratuitous-arps
ip cef
no ip bootp server
ip domain name drvirus
ip name-server x.x.x.x.x
ip name-server 8.8.8.8
login block-for 180 attempts 3 within 60
login quiet-mode access-class telnet
login on-failure log
login on-success log
no ipv6 cef
ipv6 dhcp pool vvv
prefix-delegation pool version6
address prefix 3333::/64
dns-server 4444::1
multilink bundle-name authenticated
vpdn enable
vpdn logging
vpdn logging local
vpdn history failure table-size 50
vpdn-group eeeeeeeeeeee
accept-dialin
protocol l2tp
virtual-template 1
terminate-from hostname qqqqqq
local name rrrrrrr
lcp renegotiation on-mismatch
l2tp tunnel password 7ekfhjjeklfnlenfl
l2tp tunnel timeout no-session 60
ip mtu adjust
username drvirus@!34`!512&$8#$232!^@^FGsdGD privilege 0 password 7 000sdkjhvsdkjvnah94313085g2355091407458E32425D
interface Loopback1
ip address ttttttt 255.255.255.255
interface GigabitEthernet0/1
description ttttttt
ip address 10.60.60.2 255.255.255.0 secondary
ip address 10.200.200.200 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
load-interval 30
duplex auto
speed auto
media-type rj45
negotiation auto
interface GigabitEthernet0/1.4
encapsulation dot1Q 4
ip address ttttttttt 255.255.255.224
interface GigabitEthernet0/1.14
encapsulation dot1Q 14
ip address 192.168.50.3 255.255.255.0
interface FastEthernet0/2
no ip address
shutdown
duplex auto
speed auto
interface GigabitEthernet0/2
ip address 10.160.150.2 255.255.255.0
duplex auto
speed auto
media-type rj45
negotiation auto
interface GigabitEthernet0/3
description rrrrrrr
ip address xxxxxxx 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
load-interval 30
duplex full
speed 1000
media-type sfp
negotiation auto
interface Virtual-Template1
ip unnumbered Loopback1
ip tcp adjust-mss 1412
no logging event link-status
peer default ip address pool xxxxx xxxxxx
ppp mtu adaptive
ppp authentication pap vpdn1
ppp authorization vpdn1
ppp accounting vpdn
router eigrp 2
redistribute connected metric 1 2 1 2 1
passive-interface default
no passive-interface GigabitEthernet0/1
network 10.200.200.200 0.0.0.0
no auto-summary
eigrp router-id 2.2.2.2
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.200.200.2
ip route dddddddddd 255.255.255.0 fffffff
ip route ddddddddd 255.255.255.0 ffffff
no ip http server
no ip http secure-server
ip radius source-interface GigabitEthernet0/2
radius-server attribute nas-port format d
radius-server configure-nas
radius-server host ddddddddddd auth-port 1812 acct-port 1813 key 7 dddddddddd
radius-server retransmit 0
radius-server key 7 dddddddddddddddddd
radius-server vsa send cisco-nas-port
radius-server vsa send accounting
radius-server vsa send authentication
control-plane
drvirus#sh ip traffic
IP statistics:
Rcvd: 92454889 total, 5908020 local destination
0 format errors, 94 checksum errors, 3789577 bad hop count
0 unknown protocol, 23360 not a gateway
0 security failures, 0 bad options, 3730347 with options
Opts: 0 end, 0 nop, 0 basic security, 0 loose source route
0 timestamp, 0 extended security, 0 record route
0 stream ID, 0 strict source route, 3730347 alert, 0 cipso, 0 ump
0 other
Frags: 1409002 reassembled, 485 timeouts, 0 couldn't reassemble
4542214 fragmented, 9089659 fragments, 2659413 couldn't fragment
Bcast: 6024 received, 0 sent
Mcast: 56503 received, 31033 sent
Sent: 15839581 generated, 2407203241 forwarded
Drop: 23 encapsulation failed, 0 unresolved, 0 no adjacency
0 no route, 0 unicast RPF, 0 forced drop
0 options denied
Drop: 0 packets with source IP address zero
Drop: 0 packets with internal loop back IP address
0 physical broadcast
ICMP statistics:
Rcvd: 0 format errors, 0 checksum errors, 0 redirects, 4 unreachable
140579 echo, 33742 echo reply, 0 mask requests, 0 mask replies, 0 quench
0 parameter, 0 timestamp, 0 timestamp replies, 0 info request, 0 other
0 irdp solicitations, 0 irdp advertisements
0 time exceeded, 0 info replies
Sent: 0 redirects, 3530 unreachable, 33744 echo, 140579 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp, 0 timestamp replies
0 info reply, 46795 time exceeded, 0 parameter problem
0 irdp solicitations, 0 irdp advertisements
TCP statistics:
Rcvd: 19285 total, 0 checksum errors, 7 no port
Sent: 39402 total
BGP statistics:
Rcvd: 0 total, 0 opens, 0 notifications, 0 updates
0 keepalives, 0 route-refresh, 0 unrecognized
Sent: 0 total, 0 opens, 0 notifications, 0 updates
0 keepalives, 0 route-refresh
IP-EIGRP statistics:
Rcvd: 39154 total
Sent: 39275 total
PIMv2 statistics: Sent/Received
Total: 0/0, 0 checksum errors, 0 format errors
Registers: 0/0 (0 non-rp, 0 non-sm-group), Register Stops: 0/0, Hellos: 0/0
Join/Prunes: 0/0, Asserts: 0/0, grafts: 0/0
Bootstraps: 0/0, Candidate_RP_Advertisements: 0/0
Queue drops: 0
State-Refresh: 0/0
IGMP statistics: Sent/Received
Total: 0/0, Format errors: 0/0, Checksum errors: 0/0
Host Queries: 0/0, Host Reports: 0/0, Host Leaves: 0/0
DVMRP: 0/0, PIM: 0/0
Queue drops: 0
UDP statistics:
Rcvd: 5632168 total, 0 checksum errors, 9605 no port
Sent: 15536481 total, 0 forwarded broadcasts
OSPF statistics:
Rcvd: 0 total, 0 checksum errors
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks
Sent: 0 total
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks
ARP statistics:
Rcvd: 36012 requests, 25 replies, 0 reverse, 0 other
Sent: 3590 requests, 1883 replies (41 proxy), 0 reverse
Drop due to input queue full: 0
drvirus#sh interfaces switching
GigabitEthernet0/1 ffff
Throttle count 0
Drops RP 29334 SP 0
SPD Flushes Fast 183378 SSE 0
SPD Aggress Fast 0
SPD Priority Inputs 196591 Drops 0
Protocol IP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 50222652 1410586379 38933488 2377282438
Cache misses 0 - - -
Fast 2501299905 502401799 1732463443 1178236678
Auton/SSE 0 0 0 0
Protocol DEC MOP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 0 0 104 8008
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol ARP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 36178 2170680 3643 233084
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol CDP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 1039 385469 2067 772027
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol Other
Switching path Pkts In Chars In Pkts Out Chars Out
Process 2266 138297 6179 370740
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
NOTE: all counts are cumulative and reset only after a reload.
Interface FastEthernet0/2 is disabled
GigabitEthernet0/2
Throttle count 0
Drops RP 0 SP 0
SPD Flushes Fast 785 SSE 0
SPD Aggress Fast 0
SPD Priority Inputs 1900 Drops 0
Protocol IP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 382927 34296776 382540 106683985
Cache misses 0 - - -
Fast 198 31569 0 0
Auton/SSE 0 0 0 0
Protocol DEC MOP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 0 0 104 8008
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol ARP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 1900 114000 1813 108780
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol CDP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 1030 378010 1031 378377
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol Other
Switching path Pkts In Chars In Pkts Out Chars Out
Process 0 0 6180 370800
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
NOTE: all counts are cumulative and reset only after a reload.
GigabitEthernet0/3 drvirus
Throttle count 0
Drops RP 15 SP 0
SPD Flushes Fast 22435 SSE 0
SPD Aggress Fast 0
SPD Priority Inputs 194236 Drops 0
Protocol IP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 40507058 2970006619 56462488 1872816742
Cache misses 0 - - -
Fast 1758170357 386468928 2449949282 3706868609
Auton/SSE 0 0 0 0
Protocol DEC MOP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 0 0 105 8085
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol ARP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 5 300 7 420
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol CDP
Switching path Pkts In Chars In Pkts Out Chars Out
Process 0 0 1034 379478
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
Protocol Other
Switching path Pkts In Chars In Pkts Out Chars Out
Process 0 0 6180 370800
Cache misses 0 - - -
Fast 0 0 0 0
Auton/SSE 0 0 0 0
NOTE: all counts are cumulative and reset only after a reload.
drvirus#sh ip route summary
IP routing table name is Default-IP-Routing-Table(0)
IP routing table maximum-paths is 32
Route Source Networks Subnets Overhead Memory (bytes)
connected 1 1644 105280 250040
static 3 0 192 456
eigrp 2 0 0 0 0
internal 5 5860
Total 9 1644 105472 256356
Removing Queue Size 0
drvirus#sh ip route summary
IP routing table name is Default-IP-Routing-Table(0)
IP routing table maximum-paths is 32
Route Source Networks Subnets Overhead Memory (bytes)
connected 1 1645 105344 250192
static 3 0 192 456
eigrp 2 0 0 0 0
internal 5 5860
Total 9 1645 105536 256508
Removing Queue Size 0
drvirus#sh ip route summary
IP routing table name is Default-IP-Routing-Table(0)
IP routing table maximum-paths is 32
Route Source Networks Subnets Overhead Memory (bytes)
connected 1 1645 105344 250192
static 3 0 192 456
eigrp 2 0 0 0 0
internal 5 5860
Total 9 1645 105536 256508
Removing Queue Size 0
drvirus#sh ip route summary
IP routing table name is Default-IP-Routing-Table(0)
IP routing table maximum-paths is 32
Route Source Networks Subnets Overhead Memory (bytes)
connected 1 1645 105344 250192
static 3 0 192 456
eigrp 2 0 0 0 0
internal 5 5860
Total 9 1645 105536 256508
Removing Queue Size 0
drvirus#
ANy help ??????!!!!!can some one determin if :
122 9166144 120227216 76 3.30% 2.81% 2.42% 0 L2X Data Daemon
has a relation to my high cpu
her is agian my cpu process :
drvirus#sh processes cpu sorted
CPU utilization for five seconds: 69%/51%; one minute: 62%; five minutes: 59%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
87 22165548 147317354 150 7.60% 6.54% 5.74% 0 IP Input
16 682988 2637213 258 3.61% 0.70% 0.37% 0 EnvMon
122 9166144 120227216 76 3.30% 2.81% 2.42% 0 L2X Data Daemon
270 484700 4987094 97 0.76% 0.84% 0.86% 0 PPP Events
260 746640 483367 1544 0.30% 0.51% 0.51% 0 L2TP mgmt daemon
112 1082540 228491 4737 0.30% 0.31% 0.31% 0 CEF: IPv4 proces
190 596 755 789 0.30% 0.02% 0.00% 2 SSH Process
279 461184 78909 5844 0.30% 0.39% 0.45% 0 VTEMPLATE Backgr
52 954592 29823 32008 0.30% 0.31% 0.31% 0 Compute load avg
272 53744 2782461 19 0.23% 0.17% 0.16% 0 IPHC Admin
261 513524 428266 1199 0.23% 0.38% 0.37% 0 L2TUN Applicatio
142 31888 35627222 0 0.23% 0.19% 0.20% 0 HQF Shaper Backg
258 570384 1602872 355 0.15% 0.18% 0.17% 0 RADIUS
78 43280 392561 110 0.15% 0.10% 0.08% 0 ACCT Periodic Pr
281 52340 385568 135 0.07% 0.08% 0.09% 0 IP-EIGRP: PDM
40 37300 138153 269 0.07% 0.09% 0.10% 0 Net Background
77 145860 443602 328 0.07% 0.06% 0.07% 0 AAA ACCT Proc
110 31060 53876 576 0.07% 0.03% 0.02% 0 IP RIB Update
45 11868 52400 226 0.07% 0.01% 0.00% 0 IF-MGR control p
115 20164 103667 194 0.07% 0.02% 0.00% 0 PPP IPCP
102 181600 489310 371 0.07% 0.14% 0.15% 0 SSM connection m
143 3148 1461382 2 0.07% 0.01% 0.00% 0 RBSCP Background
80 19488 22128 880 0.07% 0.02% 0.00% 0 CDP Protocol
23 189412 10771 17585 0.00% 0.15% 0.04% 0 AAA high-capacit
22 0 1 0 0.00% 0.00% 0.00% 0 CEF MIB API
21 0 2 0 0.00% 0.00% 0.00% 0 ATM Idle Timer
20 376 153594 2 0.00% 0.00% 0.00% 0 ARP Background
24 0 2 0 0.00% 0.00% 0.00% 0 AAA_SERVER_DEADT
25 0 1 0 0.00% 0.00% 0.00% 0 Policy Manager
26 1376 26590 51 0.00% 0.00% 0.00% 0 DDR Timers
31 4 30 133 0.00% 0.00% 0.00% 0 EEM ED Syslog
27 0 5 0 0.00% 0.00% 0.00% 0 Entity MIB API
33 324 147392 2 0.00% 0.00% 0.00% 0 GraphIt
34 0 2 0 0.00% 0.00% 0.00% 0 Dialer event
28 0 2 0 0.00% 0.00% 0.00% 0 Serial Backgroun
36 0 2 0 0.00% 0.00% 0.00% 0 XML Proxy Client -
Good CCIE question: Can multiple site-2-site VPNs support dynamic routing protocols?
Hi All,
Was not sure if this should be posted in LAN routing, WAN routing or VPN forums: I have posted here as the VPN tunnels are the limiting factors...
I am trying to understand if it is possible to have dynamic routing between LANs when using site to site VPNs on three or more ASA55x5-x (9.0).
To best explain the question I have put together an example scenario:
Lets say we have three sites, which are all connected via a separate site-2-site IKEv2 VPNs, in a full mesh topology (6 x SAs).
Across the whole system there would be a 192.168.0.0/16 subnet which is divided up by VLSM across all sites.
The inside / outside interfaces of the ASA would be static IPs from a /30 subnet.
Routing on the outside interface is not of concern in this scenario.
The inside interface of the ASA connects directly to a router, which further uses VLSM to assign additional subnets.
VLSM is not cleanly summarised per site. (I know this flys against VLSM best practice, but makes the scenario clearer...)
New subnets are added and removed at each site on a frequent basis.
EIGRP will be running on each core router, and any stub routers at each site.
So this results in the following example topology, of which I have exaggerated the VLSM position:
(http://www.diagram.ly/?share=#OtprIYuOeKRb3HBV6Qy8CL8ZUE6Bkc2FPg2gKHnzVliaJBhuIG)
Now, using static route redistribution from the ASAs into EIGRP and making the ASAs to be an EIGRP neighbour, would be one way. This would mean an isolated EIGRP AS per site, but each site would only learn about a new remote subnet if the crypto map match ACL was altered. But the bit that I am confused over, is the potential to have new subnets added or removed which would require EIGRP routing processes on the relevant site X router to be altered as well as crypto map ACLs being altered at all sites. This doesn't seem a sensible approach...
The second method could be to have the 192.168.0.0/16 network defined in the crypto map on all tunnels and allow the ASAs routing table to chose which tunnel to send the traffic over. This would require multiple neighbours for the ASA, but for example in OSPF, it can only support one neighbour over a S2S VPN when manually defined (point-to-point). The only way round this I can see is to share our internal routing tables with the IP cloud, but this then discloses information that would be otherwise protected by the IPSEC tunnel...
Is there a better method to propagate the routing information dynamically around the example scenario above?
Is there a way to have dynamic crypto maps based on router information?
P.S. Diagram above produced via http://www.diagram.ly/Hi Guys,
Thanks for your responses! I am learning here, hence the post.
David: I had looked in to the potential for GRE tunnels, but the side-effects could out weight the benifits. The link provided shows how to pass IKEv1 and ISAKMP traffic through the ASA. In my example (maybe not too clear?) the IPSEC traffic would be terminated on the ASA and not the core router behind.
Marcin: Was looking at OSPF, but is that not limited to one neighbour, due to the "ospf network point-to-point non-broadcast" command in the example (needed to force the unicast over the IPSEC tunnel)? Have had a look in the ASA CLI 9.0 config guide and it is still limited to one neighbour per interface when in point-to-point:
ospf network point-to-point non-broadcastSpecifies the interface as a point-to-point, non-broadcast network.When you designate an interface as point-to-point and non-broadcast, you must manually define the OSPF neighbor; dynamic neighbor discovery is not possible. See the "Defining Static OSPFv2 Neighbors" section for more information. Additionally, you can only define one OSPF neighbor on that interface.
Otherwise I would agree it would be happy days...
Any other ideas (maybe around iBGPs like OSPF) which do not envolve GRE tunnels or terminating the IPSEC on the core router please?
Kindest Regards,
James. -
Multiple Autonomous Systems using EIGRP Named Mode
I have an EIGRP network that has multiple AS numbers. Lets says they are AS 200 and 201. AS 200 exists only in the default VRF and AS 201 exists in both the default VRF and well as a dedicated server VRF. I need to configure both AS numbers to run concurrently on our core 6500 switch.
With the older way to configure EIGRP I would just create 2 EIGRP intstances as follows:
router eigrp 200
router eigrp 201
With named mode, would I create 1 or 2 named instances for EIGRP? And would every address family need a separate router-id or can both AS nubmers in the default VRF share a router ID?
example: 1 name mode instance
router eigrp named1
address-family ipv4 unicast autonomous-system 200
af-interface default
passive-interface
exit-af-interface
network 10.10.0.0 0.0.255.255
eigrp router-id 10.1.1.1
address-family ipv4 unicast autonomous-system 201
af-interface default
passive-interface
exit-af-interface
network 10.20.0.0 0.0.255.255
eigrp router-id 10.1.1.1
address-family ipv4 unicast vrf server autonomous-system 201
af-interface default
passive-interface
exit-af-interface
network 10.30.0.0 0.0.255.255
eigrp router-id 10.3.1.1
Example 2: 2 named mode instances
router eigrp named1
address-family ipv4 unicast autonomous-system 200
af-interface default
passive-interface
exit-af-interface
network 10.10.0.0 0.0.255.255
eigrp router-id 10.1.1.1
router eigrp named2
address-family ipv4 unicast autonomous-system 201
af-interface default
passive-interface
exit-af-interface
network 10.20.0.0 0.0.255.255
eigrp router-id 10.1.1.1
address-family ipv4 unicast vrf server autonomous-system 201
af-interface default
passive-interface
exit-af-interface
network 10.30.0.0 0.0.255.255
eigrp router-id 10.3.1.1
Any Thoughts? Any help would be appreciated.
BenHi Ben,
Personally, I do not see a significant difference between the two options you have, i.e. having multiple per-VRF EIGRP processes under a single router eigrp instance-name, as opposed to having a separate instance for each VRF. Recall that even in classic numbered configuration mode, you can have multiple per-VRF processes configured under a single numbered EIGRP instance so there is really no specific difference here.
That being said, I think that you would like the second option better, that is, having a separate EIGRP name mode section for each VRF. In fact, I have found it confusing in the numbered mode to have several VRFs grouped under a single numbered instance whose autonomous system number did not even relate in any way to the autonomous system number in the per-VRF processes.
Regarding the uniqueness of Router IDs - that's a good question. In EIGRP, the Router ID is used to prevent a router from processing information originated by itself, possibly causing a routing loop. I have always found this explanation somewhat strange, as EIGRP has different mechanisms for loop prevention, and I could never come up with an example where this mechanism would actually be useful. In any case, in newer EIGRP implementations, the RID is attached to each internal and external route as it is advertised throughout the EIGRP domain. This has two important consequences:
By looking at the show ip eigrp topology X.X.X.X/M.M.M.M output, you can always find out which router originates that particular network
If a router receives an update about a network marked with its own RID, it will ignore the update.
If your network and your VRFs are intended to remain perfectly isolated at all times, i.e. no routes from a VRF will ever be advertised across the network so that they leak from one VRF to another, or between a global routing table and a VRF, then a single router can use the same RID in all its EIGRP processes, both in global table and in a VRF. However, if there is an intended possibility of a route existing in one VRF to be advertised over a series of routers and being intentionally received by the same router in a different VRF then using the same RID in multiple EIGRP processes on that router would prevent it from accepting the update. In such case, you would need to use unique RID per each VRF process.
I hope this helps - please feel welcome to ask further!
Best regards,
Peter
Maybe you are looking for
-
Hi all, I am parsing an XML file passed in at the cmd line and using this method to return a boolean if depending if the validation was ok....I have successfully validated against the particular file that I am passing in against a valid XSD and it wo
-
Powerbook Doesn't Accept a Blank DVD-R
I just want to burn a movie I made and when I put in the DVD-R it waits about 30 seconds then it ejects it. I've burnt CD's and DVD's before so I know it works. Any help? Thanks
-
How do I fix CS6 Installation errors DW050, DW063, DF024 & DF037?
When I installed Photoshop CS6, I got 14 errors numbers in subject line. Does anyone know what these are and how to resolve them? Also, should I have uninstalled CS5 before installing CS6? Is it okay to uninstall CS5 now? Thank you to anyone who can
-
My i-phone just went dead. When I plug it to recharge the batery, the only thing that it shows is a sign of a broken apple. What happened? What should I do?!!!
-
Audio error when using Narration in Premiere Elements 9
I am trying to help someone using Premiere Elements 9 (v. 9.0.1, up to date). The details of the computer are: Dell N5010 laptop, 64 bit, Win 7 Home Premium SP 1, Intel i5 2.67 Ghz processor, 6 GB RAM. The user has created a video from both a Sony c