WCCP inside VRF

Hi Team,
I have one issue with WCCP redirection inside VRF. Here is my scenario:
PE router config (MPLS edge)
ip vrf aaa
rd 10:1
route-target both 10:1
int facing CE router
ip vrf forwarding aaa
ip address x.x.x.x x.x.x.x
mpls bgp forwarding
router bgp 10
<classic MP-BGP config>
address-family vpnv4 vrf aaa
  neighbor <CE router> remote-as 100
  neighbor <CE router> activate
  neighbor <CE router> send-label
CE router (using VRF lite)
ip vrf aaa
rd 100:1
route-target both 100:1
ip wccp vrf aaa 61
ip wccp vrf aaa 62
int facing PE router
ip vrf forwarding aaa
ip address c.c.c.c c.c.c.c
ip wccp vrf aaa 62 redirect in
ip bgp mpls forwarding
int facing WAAS
ip vrf forwarding aaa
ip address w.w.w.w w.w.w.w
int LAN
ip vrf forwarding aaa
ip address l.l.l.l l.l.l.l
ip wccp vrf aaa 61 redirect in
router bgp 100
address-family vpnv4 vrf aaa
neighbor <PE router> remote-as 10
neighbor <PE router> activate
neighbor <PE router> send-label
<classic network advertising>
WAE config is classis WCCP with hash assignment and negotiated GRE return method. CE router does not have any issues detecting WAE appliance.
Now the mentioned issue:
Traffic from LAN to PE is being redirected OK. No issues here. But return traffic from PE router is not redirected to WAE appliance despite the fact that WCCP "redirect in" command is configured under CE WAN interface. When I remove "neighbor <CE router> send-label" command under "
address-family vpnv4 vrf aaa" on PE router, CE router starts to redirect traffic from PE to WAE appliance (but I loose label information on CE). When I configure this command back, redirection stops.
So my question is why this command is causing CE router not to redirect traffic from PE to LAN on its WAN interface? I was not able to find any restrictions regarding VRF lite and WCCP. I am using 15.2(3)T1 IOS version.
Many thanks for any inputs.
Regards,
Stan

hi Stan,
I´m not really into VRF troubleshooting but you should check this info;
If a Cisco WAAS NME-WAE network module or Cisco WAE appliance is used at a branch location and the service provider cannot strip off the labels, WCCP can be used with a route-leaking option as long as there are no overlapping IP addresses. ( that sounds like your design)
look for  WCCP Deployment
http://www.cisco.com/en/US/prod/collateral/contnetw/ps5680/ps6870/white_paper_C11-560131.pdf
good luck!

Similar Messages

  • When will wccp be vrf aware on 6500

    wccp is vrf aware for many plataforms, when will wccp vrf aware on 6500 plataform? Someone knows the roadmap for this feature?

    Zach Seils wrote:VRF-aware WCCP will not be supported on the 6500 platform until the next-generation Supervisor (SUP-2T).
    Hi Zach, is this a limitation of the Sup 720 (as in, the hardware can't support it), or will a future IOS release be able to support VRF aware WCCP on the Sup 720?

  • Is wccp v2 VRF aware?

    Is there a version of IOS code available that has VRF support for WCCP.
    Thanks

    Eddie,
    yes, it is on our todo list.
    I would suggest you to contact you sales team to inform them you need this feature.
    They have the power to make things move faster sometimes :-)
    Gilles.

  • EoMPLS inside VRF possible?

    I'm trying to only mpls what I need to mpls and nothing else.
    Here's the idea:
    interface te1/1
    ip address x.x
    mtu 9000
    ...etc..
    interface te1/1.50
    encap dot1q 50
    ip address x.x.x.x
    mpls ip
    vrf forwarding VRF2
    ..etc..
    Mpls only running on te1/1.50 and not te1/1
    Te1/1.50 is in a VRF instance, running ldp inside of it which reduces the labels that the router assigns (because apparently there's no way to make mpls and ldp ONLY assign labels to what you want to run mpls with, unless there's some command to get rid of it from assigning labels to everything in the IGP)
    Anyways, I DO NOT want to run mpls on te1/1, or on the main routing instance on the router at all. I want it and the labels to stay inside a VRF so that only mpls traffic goes over te1/1.50 and absolutely no mpls traffic on te1/1 main interface.
    I want to use l2circuits (xconnect) inside of this.
    Using a Sup720, Is this possible?
    The reason for this is that when I enable MPLS on te1/1 , it encapsulates (routes that are sourced from routers behind the directly connected) and doesn't encapsulate routes sourced from the neighbor, even if I have no xconnects or anything set it seems to push labels onto things going to certain destinations in the IGP (with the label it assigned for that IP next hop).
    If there was a way to change that default behaviour where it doesn't encapsulate IP packets at all, unless I specifically run a xconnect, that would work.
    Very basic configuration, but it's driving me crazy, it's a mixture of juniper and cisco equipment.  I was thinking of running another ospf area on the ciscos and using another loopback and setting ldp to peer with that , but you can't have multiple loopbacks on junipers in the same routing instance.

    Let me rephrase what I want to do.
    I want to have the main interface pass IP traffic ONLY. (te1/1)
    and I want the subinterface to pass MPLS traffic ONLY. LDP will run on
    the subinterface.
    I've already tested this, and it works with l2 circuits, the problem is
    that without a VRF, the IGP will either
    route the loopback over te1/1 or te1/1.50 which means ALL traffic to
    that router can only go over one of these
    links at a time. I want to simulate having two independent links to
    another router, one for mpls, one for non mpls.
    My testing indicated that routing all traffic through te1/1 works with
    l2circuit to the junipers.
    Routing ALL traffic through te1/1.50 (IGP cost being lower) works.
    What I can't do is get it to send MPLS traffic only over .50 even if
    mpls/ldp is only enabled on .50 it doesn't seem
    to have any sense that it needs to use that path for the MPLS because
    the loopback of the adjacent router in the IGP
    has the best path out te1/1 and not te1/1.50. LDP obviously doesn't
    know that an interface is or isn't mpls able.
    If I had a cisco environment only, what I'd do is create another ospf
    area, only put the .50 interfaces in that ospf area
    create a loopback1 , use that as the router id for the other area..
    Basically have another set of loopbacks and another
    instance of OSPF just for the MPLS. But I cannot do this due to Juniper
    not supporting this type of configuration.
    So I want to create a VRF , and run an instance of ospf/ldp inside of
    it, and create l2 circuits but it doesn't seem to be
    working because mpls seems to be based on 'global' and not per vrf
    configuration for l2 circuit xconnect.
    I could be wrong but in my testing I couldn't get it to work. Could be
    the juniper end also. Getting Juniper to operate with Cisco is
    a pain in certain circumstances like this.
    I know about the conditional label advertisement to neighbors. I simply
    do not want the device to even assign labels unless I tell
    it to. I don't want to have to build an access list for everything I
    want to advertise to a neighbor, instead I want to build a list
    of what labels it will create and send and use. Right now it creates a
    label for every single adjacency in CEF and also looks like
    every /32 in the IGP if I am not mistaken.
    Paul

  • Filtering OSPF routes from MPBGP to BGP speaker in the same VRF

    I'm wondering if anyone has some ideas they an share on this.
    Assume the following:
    - CE1 is speaking *iBGP and OSPF to PE1 inside vrf foo
    - PE1 is mutually redistributing CE1's OSPF table with MPBGP
    - PE1 exchanges MPBGP routes with PE2.
    - PE2 is mutually redistributing CE2's OSPF table with MPBGP
    - CE2 is speaking *iBGP and OSPF to PE2 inside vrf foo
    So the problem is that the OSPF routes redistributed into MPBGP from via one CE are being announced to the other CE via the PE-CE BGP process.  Because those routes are already being received by the CE via the PE-CE OSPF process, they are showing up in the CE's BGP table as RIB failures.
    Is there any way to filter those out?  I've tried setting and matching tags and communities from within various redistribution points on the PE, but I can't seem to keep them out of the CE's BGP table.

    are you sure you are using iBGP on both sides and not eBGP?
    I'm asking because routes learnt by PE1 from CE via iBGP ( meaning same BGP AS number on CE1 and PE1 vrf foo) will not be propagated to CE2, because an iBGP route learned by a BGP speaker in not pushed to another iBGP speaker.
    So it means that a show ip bgp neighbor vrf foo advertised routes on PE2 shall  show that no routes from CE1 are being advertised to CE2.
    As mentionned earlier, changing BGP admin distance is an option. Let BGP have a better distance on your CEs and this should do the trick :
    router bgp xxx
    distance bgp 20 20 20
    Then after clearing bgp session, the rib failures are gone as OSPF is AD 110 and BGP is now AD 20 ( also remember that BGP does not annouces rib failure routes to other BGP peers)
    cheers

  • Reflexive ACLs in VRFs

    Are there caveats with outbound reflexive ACL inside VRFs?
    I'm working in a lab environment and notice the reflective ACLs work fine for inbound traffic, but fail for outbound.  For example, they will work when I ping the switch, but not when I do a ping from the switch.
    This is a 6503-E, SUP32, 12.2(33)SXH8b

    Hello everyone,
    just in case someone will face the same problem in the future:
    the solution is simple:
    - delete the superadmin-User
    - restart DTR
    - create superadmin and log on to the Developer Studio with the new user
    Then the ACLs can be maintained again.
    Best regards,
    Cornelia

  • WLC and WCCP

    Hi there
    we would like to redirect some WLANs on a WLC to a proxy server, but for this we would need WCCP. Because we have a Nexus 7000 in the core layer and I am not sure if Nexus supports WCCP in VRF, I wanted to ask if there is an easy way to redirect the traffic directly on the WLC (maybe with WCCP or something else)?
    Thanks a lot in advance and best regards
    Dominic

    The reality of the interfaces, is that they are not L3 interfaces.  They are still a L2 interface.  Dynamic interfaces require an IP address, so that the WLC knows when you do a L3 roam.
    For example, Building A has Data on vlan 15 10.15.1.x, Building B Data is vlan 15 10.115.1.x.  If you roam between the buildings, we need to know that you need to be L3 and anchor the traffic back to Building A's WLC, and not locally switch the traffic out of Building B's WLC.  If we dont' know this, you would have issues, until the device tried to re-IP itself for the new subnet.
    HTH,
    Steve
    Please remember to rate helpful posts or to mark the quesiton as answered so that it can be found later.

  • WAVE-694-K9 support vrf?

    dear all,
    heres my issue, my WAVE-694-K9 encounter an error / not optimizing the traffic. this because i used vrf in WCCP router to redirect traffic to same destination with 2 sub interface-- so i need vrf to distinguish, from source 'a' destined to subinterface 'a' and from source 'b' destined to subinterface 'b'. before i implement the vrf in WCCP Router, the traffic is optimized. so, in my thought that vrf isnt support WAVE-694-K9. is that true?
    or can i use the command " ip wccp vrf [vrf-name] " in router WCCP? so the WAVE-694-K9 know wccp redirect vrf.
    thanks for any advice.

    Hi,
    You need to dedicate one WAAS appliance per VRF.or WCCP can be used with a route-leaking option as long as there are no overlapping IP addresses
    Refer #
    http://www.cisco.com/en/US/prod/collateral/contnetw/ps5680/ps6870/white_paper_C11-560131.pdf
    Regards,
    Bala

  • Ipv6 dhcp inside AToM

    Hello everyone.
    I was experimenting with ipv6 dhcp using the following topology:
     7609s ----------mpls core--------  7609s -------SWITCH---------client PC
            \________vpws_________/
    Idea of this experiment is that on a first router I have configured ipv6 dhcp server for vrf CLIENT. dhcp server was enabled on a SVI inside vrf, which also serves as AC for vpws. So I was trying to emulate L2 connectivity between a client and a server. VPWS works, L2 connectivity exists, static dual stack was successfully tested. But a strange behavior is observed with ipv6 dhcp design both for managed and other  flags. Specifically RA messages are lost. In a router debug RA are sent to FF02::1 address but never reach a client (wireshark). Although other dhcp parameters like domain name, dns servers or ipv6 address (managed flag) are received without a problem. Client doesn't see a router.
    So are the messages sent to FF02::1 address transparently passed through vpws? 

    Hi Yusuf,
    You need to do a configure a few things on the router interface for DHCPv6 to be used instead of SLAAC.
    interface vlan10
    ipv6 address 2001:DB8:12FF:1::1/64
    ipv6 nd prefix 2001:DB8:12FF:1::/64 no-advertise <++++++ will prevent SLAAC from taking place
    ipv6 nd managed-config-flag <+++++ tells the workstation it should get its IPv6 address from DHCP
    ipv6 nd other-config-flag <++++++ tells the workstation to get other config (dns server, domain name, etc) from DHCP
    Regards

  • Nexus 6004 EIGRP Relationship between the two switches

    Hi All,
    I will try to explain this as best as I can. In our current TEST LAB we have a Pair of Cisco ASA5585x running in Active/Passive mode. We use a VRF transit to connect the 10 GB interface to a Pair of Cisco Nexus 6004 (L3) switches running vPC between them. Downstream we also have a pair of Cisco 9372 switches (L2) also running vPC between the two.
    As of right now we have EIGRP neighbor relationship formed between the two N6K's and the ASA.
    ASA
    ciscoasa# sh eigrp neighbors
    EIGRP-IPv4 neighbors for process 100
    H Address Interface Hold Uptime SRTT RTO Q Seq
    (sec) (ms) Cnt Num
    1 172.16.230.9 Te0/8.451 12 01:30:25 1 200 0 52
    0 172.16.230.10 Te0/8.451 12 01:30:25 1 200 0 48
    The ASA formed relationship with both N6K's
    SWITCH1
    Nexus6-1# sh ip eigrp neighbors vrf inside
    IP-EIGRP neighbors for process 100 VRF Inside
    H Address Interface Hold Uptime SRTT RTO Q Seq
    (sec) (ms) Cnt Num
    0 172.16.8.3 Vlan680 11 01:28:28 1 50 0 45
    1 172.16.230.10 Vlan451 13 01:28:28 1 50 0 46
    2 172.16.230.11 Vlan451 10 01:28:00 4 50 0 13
    Nexus6-1#
    SWITCH2
    Nexus6-2# sh ip eigrp neighbors vrf Inside
    IP-EIGRP neighbors for process 100 VRF Inside
    H Address Interface Hold Uptime SRTT RTO Q Seq
    (sec) (ms) Cnt Num
    2 172.16.8.2 Vlan680 14 01:30:11 23 138 0 48
    0 172.16.230.9 Vlan451 13 01:30:11 480 2880 0 50
    1 172.16.230.11 Vlan451 13 01:29:48 1598 5000 0 13
    Nexus6-2#
    Both Nexus Switches formed EIGRP neighbors using the vPC Peer-Link. There is enough documentation out there that strongly suggest not to use vPC Peer-Links for EIGRP anything.
    We do have additional interfaces available on the 6K's that we can use as a cross connect for EIGRP. What we are having trouble understanding how we can force EIGRP traffic over those ports?
    Here is a complete Switch config:
    Switch1
    Nexus6-1# sh run
    feature telnet
    cfs eth distribute
    feature eigrp
    feature interface-vlan
    feature lacp
    feature vpc
    feature lldp
    vlan 1
    vlan 451
    name P2P_VRF_SVI
    vlan 652
    name Management
    vlan 680
    name Inside
    vrf context Inside
    vrf context management
    ip route 0.0.0.0/0 172.16.52.1
    vrf context peer-keepalive
    vpc domain 99
    role priority 1
    peer-keepalive destination 10.200.50.2 source 10.200.50.1 vrf peer-keepalive
    delay restore 120
    interface Vlan1
    interface Vlan451
    description Inside p2p to ASA
    no shutdown
    vrf member Inside
    ip address 172.16.230.9/29
    ip router eigrp 100
    no ip passive-interface eigrp 100
    interface Vlan651
    interface Vlan680
    description Inside Network
    no shutdown
    vrf member Inside
    ip address 172.16.8.2/22
    ip router eigrp 100
    interface port-channel99
    switchport mode trunk
    spanning-tree port type network
    vpc peer-link
    interface port-channel102
    switchport mode trunk
    vpc 102
    interface Ethernet1/1
    description vPC Peer Link 1.1
    switchport mode trunk
    speed auto
    channel-group 99
    interface Ethernet1/6
    interface Ethernet1/7
    description vPC Peer Link 1.7 to Nexus 9372 PRI
    switchport mode trunk
    speed auto
    channel-group 102 mode active
    interface Ethernet1/8
    interface Ethernet1/9
    interface Ethernet2/1
    description vPC Peer Link 2.1
    switchport mode trunk
    speed auto
    channel-group 99
    interface Ethernet2/2
    interface Ethernet2/7
    description vPC Peer Link 2.1 to Nexus SEC
    switchport mode trunk
    speed auto
    channel-group 102 mode active
    interface Ethernet2/8
    interface Ethernet8/1
    description keep-alive peer-link to ALNSWI02
    no switchport
    vrf member peer-keepalive
    ip address 10.200.50.1/30
    interface Ethernet8/2
    description Uplink to ASA
    switchport mode trunk
    interface Ethernet8/3
    interface mgmt0
    vrf member management
    ip address 172.16.52.3/23
    line console
    line vty
    boot kickstart bootflash:/n6000-uk9-kickstart.7.0.1.N1.1.bin
    boot system bootflash:/n6000-uk9.7.0.1.N1.1.bin
    router eigrp 100
    passive-interface default
    default-information originate
    vrf Inside
    autonomous-system 100
    default-information originate
    poap transit
    Nexus6-1#
    Nexus6-1# sh ip eigrp neighbors vrf inside
    IP-EIGRP neighbors for process 100 VRF Inside
    H Address Interface Hold Uptime SRTT RTO Q Seq
    (sec) (ms) Cnt Num
    0 172.16.8.3 Vlan680 11 01:28:28 1 50 0 45
    1 172.16.230.10 Vlan451 13 01:28:28 1 50 0 46
    2 172.16.230.11 Vlan451 10 01:28:00 4 50 0 13
    Nexus6-1#
    Nexus6-1# sh ip eigrp topology vrf Inside
    IP-EIGRP Topology Table for AS(100)/ID(172.16.8.2) VRF Inside
    Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
    r - reply Status, s - sia Status
    P 172.16.8.0/22, 1 successors, FD is 2816
    via Connected, Vlan680
    P 172.16.230.8/29, 1 successors, FD is 2816
    via Connected, Vlan451
    Nexus6-1# sh vpc
    Legend:
    (*) - local vPC is down, forwarding via vPC peer-link
    vPC domain id : 99
    Peer status : peer adjacency formed ok
    vPC keep-alive status : peer is alive
    Configuration consistency status : success
    Per-vlan consistency status : success
    Type-2 consistency status : success
    vPC role : primary
    Number of vPCs configured : 1
    Peer Gateway : Disabled
    Dual-active excluded VLANs : -
    Graceful Consistency Check : Enabled
    Auto-recovery status : Disabled
    vPC Peer-link status
    id Port Status Active vlans
    1 Po99 up 1,451,652,680
    vPC status
    id Port Status Consistency Reason Active vlans
    102 Po102 up success success 1,451,652,6
    80
    Nexus6-1# sh spanning-tree
    VLAN0001
    Spanning tree enabled protocol rstp
    Root ID Priority 32769
    Address 1005.caf5.88ff
    Cost 2
    Port 4197 (port-channel102)
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
    Address 8c60.4f2d.2ffc
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Interface Role Sts Cost Prio.Nbr Type
    Po99 Desg FWD 1 128.4194 (vPC peer-link) Network P2p
    Po102 Root FWD 1 128.4197 (vPC) P2p
    Eth8/2 Desg FWD 2 128.1026 P2p
    Eth8/3 Desg FWD 2 128.1027 P2p
    VLAN0451
    Spanning tree enabled protocol rstp
    Root ID Priority 33219
    Address 8c60.4f2d.2ffc
    This bridge is the root
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Bridge ID Priority 33219 (priority 32768 sys-id-ext 451)
    Address 8c60.4f2d.2ffc
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Interface Role Sts Cost Prio.Nbr Type
    Po99 Desg FWD 1 128.4194 (vPC peer-link) Network P2p
    Po102 Desg FWD 1 128.4197 (vPC) P2p
    Eth8/2 Desg FWD 2 128.1026 P2p
    VLAN0652
    Spanning tree enabled protocol rstp
    Root ID Priority 33420
    Address 1005.caf5.88ff
    Cost 2
    Port 4197 (port-channel102)
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Bridge ID Priority 33420 (priority 32768 sys-id-ext 652)
    Address 8c60.4f2d.2ffc
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Interface Role Sts Cost Prio.Nbr Type
    Po99 Desg FWD 1 128.4194 (vPC peer-link) Network P2p
    Po102 Root FWD 1 128.4197 (vPC) P2p
    Eth8/2 Desg FWD 2 128.1026 P2p
    VLAN0680
    Spanning tree enabled protocol rstp
    Root ID Priority 33448
    Address 1005.caf5.88ff
    Cost 2
    Port 4197 (port-channel102)
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Bridge ID Priority 33448 (priority 32768 sys-id-ext 680)
    Address 8c60.4f2d.2ffc
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Interface Role Sts Cost Prio.Nbr Type
    Po99 Desg FWD 1 128.4194 (vPC peer-link) Network P2p
    Po102 Root FWD 1 128.4197 (vPC) P2p
    Eth8/2 Desg FWD 2 128.1026 P2p
    Nexus6-1#
    Switch2
    Nexus6-2# sh run
    !Command: show running-config
    !Time: Sat Feb 12 19:02:44 2011
    version 7.0(1)N1(1)
    hostname Nexus6-2
    feature telnet
    cfs eth distribute
    feature eigrp
    feature interface-vlan
    feature lacp
    feature vpc
    feature lldp
    vlan 1
    vlan 451
    name P2P_VRF_SVI
    vlan 652
    name Management
    vlan 680
    name Inside
    vrf context Inside
    vrf context P2P_Inside_VRF
    vrf context management
    ip route 0.0.0.0/0 172.16.52.1
    vrf context peer-keepalive
    vpc domain 99
    role priority 2
    peer-keepalive destination 10.200.50.1 source 10.200.50.2 vrf peer-keepalive
    delay restore 120
    interface Vlan1
    interface Vlan451
    description Inside p2p to ASA
    no shutdown
    vrf member Inside
    ip address 172.16.230.10/29
    ip router eigrp 100
    no ip passive-interface eigrp 100
    interface Vlan680
    description Inside Network
    no shutdown
    vrf member Inside
    ip address 172.16.8.3/22
    ip router eigrp 100
    interface port-channel99
    switchport mode trunk
    spanning-tree port type network
    vpc peer-link
    interface port-channel102
    switchport mode trunk
    vpc 102
    interface Ethernet1/1
    description vPC Peer Link 1.1
    switchport mode trunk
    speed auto
    channel-group 99
    interface Ethernet1/2
    interface Ethernet1/6
    interface Ethernet1/7
    description vPC Link 1.7 to Nexus 9372 SEC
    switchport mode trunk
    speed auto
    channel-group 102 mode active
    interface Ethernet1/8
    interface Ethernet1/12
    interface Ethernet2/1
    description vPC Peer Link 2.1
    switchport mode trunk
    speed auto
    channel-group 99
    interface Ethernet2/2
    interface Ethernet2/6
    interface Ethernet2/7
    description vPC Link 2.1 to Nexus PRI
    switchport mode trunk
    speed auto
    channel-group 102 mode active
    interface Ethernet2/8
    interface Ethernet2/12
    interface Ethernet8/1
    description keep-alive peer-link to ALNSWI01
    no switchport
    vrf member peer-keepalive
    ip address 10.200.50.2/30
    interface Ethernet8/2
    description Uplink to ASA
    switchport mode trunk
    switchport trunk allowed vlan 1,451,652,680
    interface Ethernet8/3
    interface Ethernet8/20
    interface mgmt0
    vrf member management
    ip address 172.16.52.4/23
    line console
    line vty
    boot kickstart bootflash:/n6000-uk9-kickstart.7.0.1.N1.1.bin
    boot system bootflash:/n6000-uk9.7.0.1.N1.1.bin
    router eigrp 100
    vrf Inside
    autonomous-system 100
    default-information originate
    poap transit
    logging logfile messages 6
    Nexus6-2#
    Nexus6-2#
    Nexus6-2# sh ip eigrp neighbors vrf Inside
    IP-EIGRP neighbors for process 100 VRF Inside
    H Address Interface Hold Uptime SRTT RTO Q Seq
    (sec) (ms) Cnt Num
    2 172.16.8.2 Vlan680 14 01:30:11 23 138 0 48
    0 172.16.230.9 Vlan451 13 01:30:11 480 2880 0 50
    1 172.16.230.11 Vlan451 13 01:29:48 1598 5000 0 13
    Nexus6-2#
    Nexus6-2# sh ip eigrp topology vrf Inside
    IP-EIGRP Topology Table for AS(100)/ID(172.16.8.3) VRF Inside
    Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
    r - reply Status, s - sia Status
    P 172.16.8.0/22, 1 successors, FD is 2816
    via Connected, Vlan680
    P 172.16.230.8/29, 1 successors, FD is 2816
    via Connected, Vlan451
    Nexus6-2#
    Nexus6-2#
    Nexus6-2# sh vpc
    Legend:
    (*) - local vPC is down, forwarding via vPC peer-link
    vPC domain id : 99
    Peer status : peer adjacency formed ok
    vPC keep-alive status : peer is alive
    Configuration consistency status : success
    Per-vlan consistency status : success
    Type-2 consistency status : success
    vPC role : secondary
    Number of vPCs configured : 1
    Peer Gateway : Disabled
    Dual-active excluded VLANs : -
    Graceful Consistency Check : Enabled
    Auto-recovery status : Disabled
    vPC Peer-link status
    id Port Status Active vlans
    1 Po99 up 1,451,652,680
    vPC status
    id Port Status Consistency Reason Active vlans
    102 Po102 up success success 1,451,652,6
    80
    Nexus6-2#
    Nexus6-2#
    Nexus6-2# sh spanning-tree
    VLAN0001
    Spanning tree enabled protocol rstp
    Root ID Priority 32769
    Address 1005.caf5.88ff
    Cost 3
    Port 4194 (port-channel99)
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Bridge ID Priority 32769 (priority 32768 sys-id-ext 1)
    Address 8c60.4f2d.777c
    Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
    Interface Role Sts Cost Prio.Nbr Type
    Po99 Root FWD 1 128.4194 (vPC peer-link) Network P2p
    Po102 Root FWD 1 128.4197 (vPC) P2p
    Eth8/2 Desg FWD 2 128.1026 P2p
    Eth8/3 Desg FWD 2 128.1027 P2p
    VLAN0451
    Spanning tree enabled protocol rstp
    Root ID Priority 33219
    Address 8c

    Jon,
    Are you ready for the mass confusion?
    when Looking at the ASA EIGRP neighbors output here is what I see.
    ASA# sh eigrp neighbors
    EIGRP-IPv4 neighbors for process 100
    H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                                (sec)         (ms)       Cnt Num
    3   172.16.230.1            Te0/8.450        13  16:45:14 1    200   0   64
    2   172.16.230.2            Te0/8.450        11  16:45:14 1    200   0   84
    1   172.16.230.10           Te0/8.451        11  16:45:20 1    200   0   178
    0   172.16.230.9            Te0/8.451        13  16:45:20 1    200   0   148
    For simplicity sake lets just concetrate on Interface TenGigabit0/8.451 which is the SVI on the Nexus switch that is VLAN451
    From the Nexus Switch 6004 that is directly connected to the ASA here is what I see
    SWI01# sh ip eigrp neighbors vrf Inside
    IP-EIGRP neighbors for process 100 VRF Inside
    H   Address                 Interface       Hold  Uptime  SRTT   RTO  Q  Seq
                                                (sec)         (ms)       Cnt Num
    0   172.16.8.3              Vlan680         10   17:04:30  54   324   0   177
    1   172.16.230.10           Vlan451         11   16:59:10  819  4914  0   178
    2   172.16.230.11           Vlan451         14   16:53:48  24   144   0   20
    The Inside VRF that is tied to both SVI's on the Switch vlans 451 and 680 is in EIGRP 100 on the switch
    SWI01# sh run int vlan 451
    interface Vlan451
      description Inside p2p to ASA
      no shutdown
      vrf member Inside
      ip address 172.16.230.9/29
      ip router eigrp 100
      no ip passive-interface eigrp 100
    SWI01# sh run int vlan 680
    interface Vlan680
      description Inside Network
      no shutdown
      vrf member Inside
      ip address 172.16.8.2/22
      ip router eigrp 100
      hsrp 1
        authentication text test
        preempt
        priority 250
        ip 172.16.8.1
    so you with me so far?
    If you are you have noticed that on the ASA neighbors the ASA sees 172.16.230.11 as a neighbor which is the Secondary Nexus SW. That is becauise they all share the same subnet.
    172.16.230.8/29
    Brakedown:
    PRI Nexus 6004 - 172.16.230.9
    SEC NEXUS 6004 - 172.16.230.10
    PRI ASA 5585x  - 172.16.230.11
    SEC ASA 5585x  - 172.16.230.12
    Because the ASA EIGRP network is a /29 it learns the Secondary Nexus via the Primary Nexus.
    I am not sure that the link we created between the two Nexus Switches is doing anything but consuming ports right now.
    SWI01# sh run int ethernet 8/9
    interface Ethernet8/9
      description EIGRP PORT to Secondary Nexus
      switchport mode trunk
      switchport trunk allowed vlan 450-451
    SWI02# sh run int ethernet 8/9
    interface Ethernet8/9
      description EIGRP PORT to Primary Nexus
      switchport mode trunk
      switchport trunk allowed vlan 450-451
    So the SVI's that go up to the ASA for inspection are 450 and 451. The network SVI's are 600 and 680 all of them live on the switch, and 680, and 600 are extended over the peer links down to the 9372's.
    I think that we are breaking the golden rule of vPC BUT.. I am not 100% sure. Some of the documents read that we should not be allowing network vlans over peer links, but then how do you extend the vlans down to the leaf switch?
    This is giving me nightmares at the moment…
    does this make sense? 

  • Redundant access from MPLS VPN to global routing table

    Several our customers have MPLS VPNs deployed over our infrastructure. Part of them requires access to Internet (global routing table in our case).
    As I'm not aware of any methods how to dynamicaly import/export routes between VRF/Global routing tables, at the moment there are static routes configured - one inside VRF pointing to global next hop, another one in global routing table, pointing to interface inside VRF.
    Task is to configure redundant access to Internet. By redundancy I mean using several exit points (primary and backup), what physically represents separate boxes.
    Here comes tricky part - both global static routes (on both boxes, meaning) are valid and reachable in all cases - no matter if specific prefix is reachable in VRF or not. What I'd like to achieve is that specific static route becomes valid only if specific prefix is reachable inside VRF. Yea, sounds like dynamic routing :), I know
    OK, hope U got the idea. Any solutions/recommendations ? Running all Internet routing inside VRF isn't an option, at least for now :(

    Hi Andris,
    I did not mean to have a VRF on the CE. The CE would have both PVCs in the global routing table - his ONLY routing table in fact. One PVC would be used to announce routes into the customer specific VPN (VRF configured on the PE). The other PVC would allow for internet access through the PE (global IP routing table on the PE).
    dot1q will be ok as well.
    This way the CE can be a normal BGP peer to the PE, i.e. there is no MPLS VPN involved here. This allows all options of customer-ISP connectivity.
    Example:
    PE config:
    interface Serial0/0
    encapsulation frame-relay
    interface Serial0/0.1 point-to-point
    description customer VPN access
    ip vrf customer
    ip address 10.1.1.1 255.255.255.252
    interface Serial0/0.2 point-to-point
    description customer Internet access
    ip address 192.168.1.1 255.255.255.252
    router rip
    address-family ipv4 vrf customer
    version 2
    network 10.0.0.0
    no auto-summary
    redistribute bgp 65000 metric 5
    router bgp 65000
    neighbor 192.168.1.2 remote-as 65001
    address-family ipv4 vrf customer
    redistribute rip
    CE config:
    interface Serial0/0
    encapsulation frame-relay
    interface Serial0.1 point-to-point
    description VPN access
    ip address 10.1.1.2 255.255.255.252
    interface Serial0.2 point-to-point
    description Internet access
    ip address 192.168.1.2 255.255.255.252
    router bgp 65001
    neighbor 192.168.1.1 remote-as 65000
    router rip
    version 2
    network 10.0.0.0
    no auto-summary
    Of course you can replace RIP with whatever is suitable for you. And don´t sue me when you do not apply required BGP filters for internet access... ;-)
    The other option ("mini internet") would be feasible as well. Just make sure your BGP filters are NEVER messed up and additionally apply a limit on the numbers of prefixes in your VRF mini-internet.
    Regards
    Martin

  • Disconnect VPN Client

    Hi,
    I have installed a VPN Server using Easy VPN Server.
    What is the command to show VPN Clients connecting to the VPN server?
    How do I disconnect a VPN Client connection?
    Cheers,
    peiwai

    Thanks!
    That's what you need to do:
    1. Session monitoring
    show crypto session summary
    R100#sh crypto session summary Group ezvpngrp has 1 connections   User (Logins)   cisco (1)Group ezvpngrp2 has 1 connections   User (Logins)   cisco2 (1)
    show crypto session and show cryption session detail will provide more details
    2. User administrative disconnect:
    R100#clear crypto session ?
      active    Clears HA-enabled crypto sessions in the active state
      fvrf      Front-door VRF
      ikev2     Clear ikev2 sessions
      isakmp    Clear crypto sessions belonging to the group
      ivrf      Inside VRF
      local     Clear crypto sessions for a local crypto endpoint
      remote    Clear crypto sessions for a remote IKE peer
      standby   Clears HA-enabled crypto sessions in the standby state
      username  Clear crypto sessions of a user
    clear crypto session username vpnuser would disconnect the user with the name vpnuser
    Let me know if this answer your question.
    Cheers,

  • Import/Exporting iVRF routes in IPsec iVRF/FVRF environment

    Hi,
    I am currently terminating a number of IPsec VPNs into customers' 'inside' VRFs (iVRFs) with the 'classic' crypto-map applied in a separate Front-Door VRF (FVRF) on an ASR1k. I now want to export a VPN route from one iVRF into another VRF using MP-BGP. This works as expected in as far as the VPN prefix makes it into the BGP table, but not into the RIB - it would appear that this may be by design and a route with a next-hop in the FVRF (i.e. the VPN RRI route) cannot be exported from the VRF and imported into another VRF. Is there any workaround for this; the only one solution which looks like it might work is to import/export these routes using another VRF and back-to-back VASI interfaces, using ordinary BGP to leak routes. Another possible solution is also to use sVTIs instead of classic crypto (thus avoiding the RRI route), but this doesn't address the need to support classic crypto.
    Cheers,
    Matt

    Hi,
    I am currently terminating a number of IPsec VPNs into customers' 'inside' VRFs (iVRFs) with the 'classic' crypto-map applied in a separate Front-Door VRF (FVRF) on an ASR1k. I now want to export a VPN route from one iVRF into another VRF using MP-BGP. This works as expected in as far as the VPN prefix makes it into the BGP table, but not into the RIB - it would appear that this may be by design and a route with a next-hop in the FVRF (i.e. the VPN RRI route) cannot be exported from the VRF and imported into another VRF. Is there any workaround for this; the only one solution which looks like it might work is to import/export these routes using another VRF and back-to-back VASI interfaces, using ordinary BGP to leak routes. Another possible solution is also to use sVTIs instead of classic crypto (thus avoiding the RRI route), but this doesn't address the need to support classic crypto.
    Cheers,
    Matt

  • Cisco ASR 9922 CGNAT VSM Module

    Hello,
    I want to deploy cg nat 44 on a newly purchased ASR 9922 with VSM module on it.
    Test Scenario is like this - 2 different inside one vrf (PRIVATE) and one global will be mappped to 
    one global outside.I have configured but Interface Service App is not coming up. Please see the configuration and recommend what to do . is there any feature for VSM module with 5.1.2 ?
    1.  sh install committed
    Node 0/3/CPU0 [LC] [SDR: Owner]
        Boot Device: mem:
        Boot Image: /disk0/asr9k-os-mbi-5.1.2/lc/0x3C0266/mbiasr9k-lc-x86e.vm
        Committed Packages: 
          disk0:asr9k-mini-px-5.1.2
          disk0:asr9k-services-infra-5.1.2
          disk0:asr9k-mcast-px-5.1.2
          disk0:asr9k-mpls-px-5.1.2
          disk0:asr9k-services-px-5.1.2
      Node 0/4/CPU0 [LC] [SDR: Owner]
        Boot Device: mem:
        Boot Image: /disk0/asr9k-os-mbi-5.1.2/lc/0x3C0266/mbiasr9k-lc-x86e.vm
        Committed Packages: 
          disk0:asr9k-mini-px-5.1.2
          disk0:asr9k-services-infra-5.1.2
          disk0:asr9k-mcast-px-5.1.2
          disk0:asr9k-mpls-px-5.1.2
          disk0:asr9k-services-px-5.1.2
    ==========================================
    RP/0/RP0/CPU0:PO561_CORE_1#sh run
    Wed Sep 24 08:24:33.373 UTC
    Building configuration...
    !! IOS XR Configuration 5.1.2
    !! Last configuration change at Wed Sep 24 08:24:10 2014 by admin
    vrf PRIVATE
     address-family ipv4 unicast
    virtual-service enable
    virtual-service btribcgn
     vnic interface TenGigE0/3/1/0
     vnic interface TenGigE0/3/1/1
     vnic interface TenGigE0/3/1/2
     vnic interface TenGigE0/3/1/3
     vnic interface TenGigE0/3/1/4
     vnic interface TenGigE0/3/1/5
     vnic interface TenGigE0/3/1/6
     vnic interface TenGigE0/3/1/7
     vnic interface TenGigE0/3/1/8
     vnic interface TenGigE0/3/1/9
     vnic interface TenGigE0/3/1/10
     vnic interface TenGigE0/3/1/11
     activate
    virtual-service btribcgnat
     vnic interface TenGigE0/4/1/0
     vnic interface TenGigE0/4/1/1
     vnic interface TenGigE0/4/1/2
     vnic interface TenGigE0/4/1/3
     vnic interface TenGigE0/4/1/4
     vnic interface TenGigE0/4/1/5
     vnic interface TenGigE0/4/1/6
     vnic interface TenGigE0/4/1/7
     vnic interface TenGigE0/4/1/8
     vnic interface TenGigE0/4/1/9
     vnic interface TenGigE0/4/1/10
     vnic interface TenGigE0/4/1/11
     activate
    redundancy
     iccp
      group 1
       mlacp node 1
       mlacp system mac 0000.0000.0001
       mlacp system priority 1
       mlacp connect timeout 0
       member
        neighbor 172.16.100.2
       backbone
        interface HundredGigE0/5/0/0
       isolation recovery-delay 100
      group 2
       mlacp node 2
       mlacp system mac 0000.0000.0002
       mlacp system priority 2
       mlacp connect timeout 0
       member
        neighbor 172.16.100.2
       backbone
        interface HundredGigE0/5/0/0
       isolation recovery-delay 100
    control-plane
     management-plane
      inband
       interface all
        allow Telnet
    ipv4 virtual address 172.16.3.1 255.255.255.0
    interface Bundle-Ether1
     lacp switchover suppress-flaps 100
     mlacp iccp-group 1
     mlacp switchover type revertive
     mlacp switchover recovery-delay 40
     bundle wait-while 0
    interface Bundle-Ether1.4
     ipv4 address 172.16.4.254 255.255.255.0
     encapsulation dot1q 4
    interface Bundle-Ether1.5
     ipv4 address 172.16.5.254 255.255.255.0
     encapsulation dot1q 5
    interface Bundle-Ether2
     lacp switchover suppress-flaps 100
     mlacp iccp-group 2
     mlacp switchover type revertive
     mlacp switchover recovery-delay 40
     bundle wait-while 0
    interface Bundle-Ether3
     description ****** LINK_TO_3750_1 *****
    interface Bundle-Ether3.50 l2transport
     encapsulation dot1q any
    interface Bundle-Ether11
     description ****** LINK_TO_PO65_AGG_1 *****
    interface Bundle-Ether11.1
     ipv4 address 172.16.1.5 255.255.255.252
     encapsulation dot1q 11
    interface Bundle-Ether11.50 l2transport
     encapsulation dot1q any
    interface Bundle-Ether12
     description ****** LINK_TO_PO65_AGG_2 *****
    interface Bundle-Ether12.1
     ipv4 address 172.16.1.9 255.255.255.252
     encapsulation dot1q 12
    interface Bundle-Ether12.50 l2transport
     encapsulation dot1q any
    interface Bundle-Ether13
     description ****** LINK_TO_PO65_AGG_3 *****
    interface Bundle-Ether13.1
     ipv4 address 172.16.1.13 255.255.255.252
     encapsulation dot1q 13
    interface Bundle-Ether13.2
     ipv4 address 11.1.1.1 255.255.255.0
     encapsulation dot1q 132
    interface Bundle-Ether13.3
     vrf PRIVATE
     ipv4 address 22.22.22.1 255.255.255.252
     encapsulation dot1q 133
    interface Loopback0
     ipv4 address 172.16.100.1 255.255.255.255
    interface MgmtEth0/RP0/CPU0/0
     ipv4 address 172.16.3.2 255.255.255.0
    interface MgmtEth0/RP0/CPU0/1
     shutdown
    interface MgmtEth0/RP1/CPU0/0
     ipv4 address 172.16.3.3 255.255.255.0
    interface MgmtEth0/RP1/CPU0/1
     shutdown
    i
    interface TenGigE0/3/1/0
    interface TenGigE0/3/1/1
    interface TenGigE0/3/1/2
    interface TenGigE0/3/1/3
    interface TenGigE0/3/1/4
    interface TenGigE0/3/1/5
    interface TenGigE0/3/1/6
    interface TenGigE0/3/1/7
    interface TenGigE0/3/1/8
    interface TenGigE0/3/1/9
    interface TenGigE0/3/1/10
    interface TenGigE0/3/1/11
    interface TenGigE0/4/1/0
    interface TenGigE0/4/1/1
    interface TenGigE0/4/1/2
    interface TenGigE0/4/1/3
    interface TenGigE0/4/1/4
    interface TenGigE0/4/1/5
    interface TenGigE0/4/1/6
    interface TenGigE0/4/1/7
    interface TenGigE0/4/1/8
    interface TenGigE0/4/1/9
    interface TenGigE0/4/1/10
    interface TenGigE0/4/1/11
    interface ServiceApp1
     vrf PRIVATE
     ipv4 address 12.12.12.1 255.255.255.252
     service cgn btribcgn service-type nat44
    interface ServiceApp2
    interface ServiceApp3
     ipv4 address 23.23.23.1 255.255.255.252
     service cgn btribcgn service-type nat44
    interface ServiceInfra1
     ipv4 address 1.1.1.1 255.255.255.252
     service-location 0/3/CPU0
    interface ServiceInfra2
     ipv4 address 2.2.2.1 255.255.255.252
     service-location 0/4/CPU0
    interface HundredGigE0/2/0/0
     shutdown
    interface HundredGigE0/2/0/1
     shutdown
    interface HundredGigE0/5/0/0
     description ***** LINK TO PO561_CORE_2 *****
     ipv4 address 172.16.1.1 255.255.255.252
    interface HundredGigE0/5/0/1
     shutdown
    router static
     address-family ipv4 unicast
      11.0.0.0/24 172.16.3.254
      214.16.64.0/24 ServiceApp3
     vrf PRIVATE
      address-family ipv4 unicast
       0.0.0.0/0 ServiceApp1
    service cgn btribcgn
     service-location preferred-active 0/3/CPU0
     service-type nat44 nat1
      inside-vrf PRIVATE
       map address-pool 214.16.64.0/24
    end
    RP/0/RP0/CPU0:PO561_CORE_1#     
    ======================
    Wed Sep 24 08:24:59.780 UTC
    ServiceApp1 is down, line protocol is down 
      Interface state transitions: 0
      Hardware is SEAPP SVI Interface
      Internet address is 12.12.12.1/30
      MTU 1514 bytes, BW 20480000 Kbit (Max: 20480000 Kbit)
         reliability Unknown, txload Unknown, rxload Unknown
      Encapsulation service_base,  loopback not set,
      Last input Unknown, output Unknown
      Last clearing of "show interface" counters Unknown
      Input/output data rate is disabled.
    =================
    ServiceInfra1 is up, line protocol is up 
      Interface state transitions: 5
      Hardware is SEINFRA SVI Interface
      Internet address is 1.1.1.1/30
      MTU 1514 bytes, BW 1024 Kbit (Max: 1024 Kbit)
         reliability 255/255, txload 0/255, rxload 0/255
      Encapsulation service_base,  loopback not set,
      Last input never, output 00:00:00
      Last clearing of "show interface" counters never
      5 minute input rate 0 bits/sec, 0 packets/sec
      5 minute output rate 3000 bits/sec, 0 packets/sec
         0 packets input, 0 bytes, 0 total input drops
         0 drops for unrecognized upper-level protocol
         Received 0 broadcast packets, 0 multicast packets
         788 packets output, 985000 bytes, 0 total output drops
         Output 0 broadcast packets, 0 multicast packets

    Hi Tural,
    yes, it's a VSM running a 5.2.0 (I've seen it running 5.1.1 too in the past).
    Config:
    vrf Inside
     address-family ipv4 unicast
    virtual-service enable
    virtual-service CGN
     vnic interface TenGigE0/3/1/0
     vnic interface TenGigE0/3/1/1
     vnic interface TenGigE0/3/1/2
     vnic interface TenGigE0/3/1/3
     vnic interface TenGigE0/3/1/4
     vnic interface TenGigE0/3/1/5
     vnic interface TenGigE0/3/1/6
     vnic interface TenGigE0/3/1/7
     vnic interface TenGigE0/3/1/8
     vnic interface TenGigE0/3/1/9
     vnic interface TenGigE0/3/1/10
     vnic interface TenGigE0/3/1/11
     activate
    hw-module service cgn location 0/3/CPU0
    interface TenGigE0/3/1/0
    interface TenGigE0/3/1/1
    interface TenGigE0/3/1/2
    interface TenGigE0/3/1/3
    interface TenGigE0/3/1/4
    interface TenGigE0/3/1/5
    interface TenGigE0/3/1/6
    interface TenGigE0/3/1/7
    interface TenGigE0/3/1/8
    interface TenGigE0/3/1/9
    interface TenGigE0/3/1/10
    interface TenGigE0/3/1/11
    interface ServiceApp11
     vrf Inside
     ipv4 address 1.1.1.1 255.255.255.252
     service cgn VSM service-type nat44
    interface ServiceApp12
     ipv4 address 1.1.2.1 255.255.255.252
     service cgn VSM service-type nat44
    interface ServiceInfra3
     ipv4 address 1.4.3.1 255.255.255.248
     service-location 0/3/CPU0
    service cgn VSM
     service-location preferred-active 0/3/CPU0
     service-type nat44 nat44-vsm
      inside-vrf Inside
       map address-pool 11.22.33.0/24
    end
    We can verify the state of the VM and the version of packages loaded (cgn 5.2.0 ova)
    RP/0/RSP0/CPU0:Inter#show virtual-service detail name CGN
    Wed Sep 24 22:35:32.456 UTC
    Virtual Service CGN Detail
    CGN:
      State                   : Activated
      Node name               : 0/3/CPU0
      Node status             : Install Mgr Ready, SDR Mgr Ready
      UUID                    : be9eec4e-3fca-56bf-ab08-dc31216825fc
      Package information
        Name                  : asr9k-vsm-cgv6-5.2.0.00.ova
        Path                  : /harddisk:/520/asr9k-vsm-cgv6-5.2.0.00.ova
        Application
          Name                : CGv6
          Installed version   : 1.0
          Description         : Carrier Grade NAT
        Signing
          Key type            : Unknown Package
          Method              : SHA1
        Licensing
          Name                : Not Available
          Version             : Not Available
      Activated profile name  : None
      Resource reservation
       Disk   : 10000MB
       Memory : 32768MB
       CPU    : 71 (system CPU %)
       VCPU   : 57
      Attached devices
      #             Type Name      Alias
      1              NIC net1      net1
      2              NIC net1      net1
      3              NIC net1      net1
      4              NIC net1      net1
      5              NIC net1      net1
      6              NIC net1      net1
      7              NIC net1      net1
      8              NIC net1      net1
      9              NIC net1      net1
      10             NIC net1      net1
      11             NIC net1      net1
      12             NIC net1      net1
      13    Serial/shell None      serial0
      14      Serial/aux None      serial1
      15             HDD hda       DD_10GB_UM_local
      16           CDROM hdc       ide0-1-0
      17        Watchdog None      None
     Network interfaces:
        Name
        TenGigE0/3/1/0
        TenGigE0/3/1/1
        TenGigE0/3/1/2
        TenGigE0/3/1/3
        TenGigE0/3/1/4
        TenGigE0/3/1/5
        TenGigE0/3/1/6
        TenGigE0/3/1/7
        TenGigE0/3/1/8
        TenGigE0/3/1/9
        TenGigE0/3/1/10
        TenGigE0/3/1/11
      Resource admission (without profile)
        Disk space            : 10000MB
        Memory                : 32768MB
        CPU                   : 100% system CPU
        VCPUs                 : 57 (sockets:3 cores:19 threads:1)
    RP/0/RSP0/CPU0:Inter#
    ServiceApp and ServiceInfra status:
    RP/0/RSP0/CPU0:Inter#sh int serviceapp11 brief
    Wed Sep 24 22:35:47.038 UTC
                   Intf       Intf        LineP              Encap  MTU        BW
                   Name       State       State               Type (byte)    (Kbps)
                   SA11          up          up       service_base  1514   20480000
    RP/0/RSP0/CPU0:Inter#sh int serviceapp12 brief
    Wed Sep 24 22:35:54.034 UTC
                   Intf       Intf        LineP              Encap  MTU        BW
                   Name       State       State               Type (byte)    (Kbps)
                   SA12          up          up       service_base  1514   20480000
    RP/0/RSP0/CPU0:Inter#sh int serviceinfra3 brief
    Wed Sep 24 22:36:02.501 UTC
                   Intf       Intf        LineP              Encap  MTU        BW
                   Name       State       State               Type (byte)    (Kbps)
                    SI3          up          up       service_base  1514       1024
    RP/0/RSP0/CPU0:Inter#
    Best regards,
    Nicolas.

  • STATIC-FORWARD IOS-XR

    Hi guys, 
    A want to know how can configure a NAT statics on the ASR9000, the ASR have de IOS-XR 4.3.4 and the configuration is the next:
    hw-module service cgn location 0/4/CPU0
    interface ServiceInfra 1
    ipv4 address 100.10.200.253 255.255.255.252
    service-location 0/4/CPU0
    interface Gigabitethernet 0/0/0/19
    description INSIDE
    vrf ivrf1
    ipv4 address 192.168.0.254 255.255.255.0
    interface ServiceApp1
    desciption INBOUND INSIDE TO ISM
    vrf ivrf1
    ipv4 address 100.10.200.1 255.255.255.252
    service cgn prueba service-type nat44
    interface ServiceApp2
    description OUTBOUND OUTSIDE
    ipv4 address 100.10.200.5 255.255.255.252
    service cgn prueba service-type nat44
    router static
    address-family ipv4 unicast
    191.20.20.0/24 ServiceApp2
    vrf ivrf1
    address-family ipv4 unicast
    0.0.0.0/0 ServiceApp1
    service cgn prueba
     service-location preferred-active 0/4/CPU0
     service-type nat44 nat1
      portlimit 65535
      alg ActiveFTP
      alg rtsp
      alg pptpAlg
      inside-vrf ivrf1
       map address-pool 191.20.20.0/24
      protocol udp
       session initial timeout 30
       session active timeout 120
      protocol tcp
       session initial timeout 120
       session active timeout 1800
      protocol icmp
       timeout 60
      refresh-direction Outbound
    The configuration above is working perfect and i can reach internet, now a need to migrate the next configuration of nat static to the ASR9000
    ip nat inside source static tcp 192.168.0.205 3299 191.20.20.205 3299 extendable
    Can help please..
    Would greatly appreciate if you could help me
    Thanks.
    Fredy Caceres

    Hi Fredy,
    Please see link below,
    https://supportforums.cisco.com/document/11939006/cgv6-ism-cgnnat44-deployment-guide#static-port-forwarding
    http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-3/cg_nat/command/reference/b_cgnat_cr43xasr9k/b_cgnat_cr42crs_chapter_01.html#wp2900083483
    Best Regards,
    Bheem

Maybe you are looking for

  • Disk Priority Problem with Raid

    I have MSI K8N Diamond (Bios version: 1.9) Here's my problem: I've got total 4 hard disks. Those are plugged to sata ports (not to silicon ones, 2 silicon ports are free) also i got no hdd on ide, just a dvd burner I've planned to create a raid0 arra

  • Itunes could not back up the iphone

    When I try to sync my Iphone i get an error "Itunes could not back up the iphone because it could not be saved to the computer" How do i fix this. I have the current software for the iphone and using itunes 9. I have 2 iphones that sync to this compu

  • Too much exclusive CPU time counted at swapcontext function

    Hi, I'm using Sun Studio Express March 2009 Build, especially Performance Analyzer, and I have observed some hardly understandable CPU times measured at swapcontext function of libc library. Here is my machine spec. Two-way Intel E5320 processors wit

  • Which ver of J2SE AE fixes both namespace length and XMB2FILEWITHCONVERSION

    We have implemented the SP09 J2SE adapter engine (SAPXICONS09_0-20001977.SCA) on most of our endpoints,  after having recently upgraded from SP06 J2SE (SAPXICONS06_2-20001977.SCA). SP06 J2SE (SAPXICONS06_2-20001977.SCA) throws an error when ever the

  • Logical dataguard SQL apply fails during import on primary database

    I have created logical dataguard using GRID, initially every things works fine. One time we had to do import of new data on primary database, that is where the problem started. log apply is lagging big time, and i got this error StatusRedo apply serv