CSR1000v eVPN AF

Similar Questions

• Recommendation for size VM for CSR1000V in Azure

  Hello!

  Is there a size recommendation VM of CSR1000V in Azure?
  I see the size A2, D1, D2 recommendation (all series) when creating. Are any show for VM size comparison?

  For the moment unfortunately do not have a picture of performance as you're referring.  The reason is, we are still working on the performance of CSR on Azure, as well as working with Azure to smooth out the deployment process.

  So once the deployment process is finalized, and we have a release or two for best performance, we will make this data available.  My advice for now would be to only use the CSR for up to 50 Mbps of throughput on Azure.  This should increase considerably after our work of Setup is finished.

  Also please be aware that it is currently very difficult and potentially impossible to successfully launch a CSR VM to Azure.  The Microsoft team has identified a number of bugs in the cloud platform Azure that cause this problem, and they should be fixed soon.  It is also the reason why there is no still displayed for CSR on Azure deployment guide.

  Thank you!

  James

• PPPoE works do not on a bridge-CSR1000V

  Hello fans of Cisco.

  I have a problem with a validation on a CSR1000V config in my lab.

  I have implemented a full PPPoE configuration server forward (bba, vpdn, virtual model...) with a bba group named PPP with L2TP.

  When I turn the server on my local interface, my customer (an old 1841 with a client pppoe-pool-numbering code) in the same local network to connect without a problem:

   interface GigabitEthernet1 no ip address pppoe enable group PPP

  But when I pass my PPPoE server to a bridge domain, it seems that the process server to no longer receive the packets 'PADI ':

   bridge-domain 12 ! interface GigabitEthernet1 no ip address service instance 1 ethernet encapsulation untagged bridge-domain 12 ! interface BDI12 no ip address pppoe enable group PPP

  When the client sends packets PADI, the number of entries in the article IG1 increments but the number of entries in BDI12 don't. And 'debug pppoe packets' does not display any package on the side of the CSR.

  I already tried to set an IP address on BDI12, and I can ping it without problem in my test client, so the connectivity seems ok.

  For more information, I need to move my PPPoE server to a BDI interface, because the final idea is to receive requests from partners NNI on pseudowires remote, not on-site:

   l2 vfi ppp-test manual vpn id 12 bridge-domain 12 neighbor 1.1.1.2 1234 encapsulation mpls

  This part is ready (ping works with static IP) but the same problem with PPPoE packets.

  Anyone has an idea why the PPPoE does not work on the BDI interface?

  Thanks for your help!

  Best regards

  Guillaume

  Guillaume,

  I'm sorry to disappoint you, but it seems that the combination of Ethernet and PPPoE service instances is not supported. Documentation for ASR - 1 K that goes the same principially IOS - XE stated explicitly:

  http://www.Cisco.com/c/en/us/TD/docs/routers/asr1000/configuration/guide/chassis/asrswcfg/BDI.html#pgfId-1054861

  Unfortunately, I do not have enough experience with these features to provide a work around - aside, of course, dedicating an additional port on the unit perform the aggregation of bridge-area and have a PPPoE server to access connected to this additional port.

  Best regards
  Peter

• CSR1000v - Extra return in telnet line/transport

  I'm running a weird question with a few CSR1000v routers circula 5.1 ESXi.  I created 10 virtual machines and of these 10 cases, I have 1 router which seems if insert an extra line (or a carriage return) in the CLI whenever I hit him "enter."  This question followed between SecureCRT and PuTTY.  I am also unable to use the "tab" key, upward or down arrows for the history and the '?' does not exit until I hit "enter".  Some examples follow:

  Router >
  Router > en
  en
  Router #.
  Router #.

  Arrow:

  Router #^ [[has

  Arrow:

  Router #^ [[B

  Tab key:

  Router > ^ I

  I am using the 'serial console platform' configuration and telnet to my ESXi server with port number address, IE: 172.100.100.2:2003 for Router3.  If I telnet between my routers (R1 telnets to an IP address on the interface of the CSR), the issue does not follow.  However, now that I have create my VM 11th and 12th, I see the extra line in the sessions during the series of console output.

  Anyone ever encountered this before?

  Good news!  Mark as resolved for others to find.  Kevin

• Mac OS El Capitan cannot share a VPN connection that is type of IKEv2

  I have a few VPN connections, I share via Wi - Fi on my mobile device. Here's what I do:

  I have a Macbook Pro with Ethernet port, I have some work VPN connections (some type of IPSec, some IKEv2). First I plug the cable to the Ethernet port, then I start a VPN (settings-> network-> Connect) connection, finally, I share the VPN (settings-> sharing-> Internet sharing) via Wi - Fi connection so that my mobile device can connect and use the VPN connection.

  This work really well for me with IPSec VPN connections. But today, I tried to switch to an IKEv2 VPN connection, the VPN works well, but I can't share it on a mobile device via Wi - Fi, because I couldn't see the connection in the list "share your connection from" (Preferences-> sharing-> Internet sharing system)

  Are there any technical problem that IKEv2 cannot be shared? Or is there that all parameters must be made so that all VPN connections must appear in the list to share?

  evpn https://support.purevpn.com/IKEv2-Configuration-Guide-for-OS-x-El-Capitan-by-pur

• [ncs 5500 in the SP core]

  Hi all:

  Let's say you have a SP BGP-free core network with services like: the Internet residential and business, mpls vpn in all flavors, multicast voice and video, etc. What would be the reasons not to use a NCS5500 on other platforms like asr9k/crsX/ncs6k, which are classic/preferred kernel type routers?

  I know that this could be considered a too open question, so some specific balls could be enough to reply. I am aware that this could be a matter of opinion too, but prices in the ncs5500 makes this platform a very tempting option.

  Thank you very much!
  c.

  Hi Carlos,

  several parameters will be used to decide if you want / can use the NCS 5500 in your heart:

  -the density of ports: If you need ports of 1 G, only the NCS 5501 can serve today but not the 8 slots NCS 5508 chassis (a line with possibility of 1 card G is in the roadmap if)

  -l' scale: If you need very large route tables (more), you should consider ASR9000

  -If you need technology inherited from multicast now, it is not covered in the course of the feature set (PIM - SSM only today, ASM protocols are in the roadmap)

  -If you plan ZTP/ZPL FROM, you must target NCS 6000

  -If you wait L3VPN features (such as a PE) today and features the EVPN, you need the ASR9000. It will come soon, but even later on the 5500.

  Overall, the NCS 5500 can address today most of the basic MPLS requirements. In addition, it supports the Segment routing and MPLS - TE (RSVP), fairly large routing tables (once again, 2.7 M prefixes is huge and enough for 99% of the use cases) + all the news to come with IOS XR (telemetry streaming, 3rd party applications in containers, Zero Touch Provisioning with iPXE and scripts, M2M, automation...).

  Kind regards

  N.

• CSR 1000v for Vmware Esxi, cannot ping / output

  Hello

  I just installed file eggs a 1000V CSR in my personal laboratory in an ESXi.

  I followed this link:

  http://www.fryguy.NET/2013/12/27/Cisco-csr1000v-for-Home-Labs/

  I have a 1 Giga interface in the vlan by default with the VMXNET3 adapter type as suggested.

  Whenever I turn on the CSR I have configure the interface and I unshut it. Negotiation is automatic (I tried to link hard but without success).

  Problem is that since my pc I can not ping the CSR giga1 interface and vice versa. But on both sides, I see the arp of the interface.

  I tried to change the type of adapter on vmware (VMXNET2 or E1000) but without any help...

  If I turn on a debian or Windows VM on the same network card on the same vlan I can ping or reach it.

  I tried to debug the ip packets, but nothing shows up some questions.

  Config is a default one... there no ACL, not security features, nothing... just an ip address on the giga1 and the no command closed.

  What is there?

  Thanks in advance

  Hello

  Can say you that it was really the problem.

  I have ESXi 5.5.0 3116895 and I installed CRS1000V 3.17 and it works perfectly

  Good bye

• nxos 6 or 7 trains to N9K

  Team,

  Could indicate you please on why to go for a train nxos 7 instead of 6 trains for the N9300s? Since FP, OTV and VDC are missing for N9K what are the main differences in the features?

  Thank you

  Hello

  It will depend on what you want to do with the Nexus 9000. If you use the N9K in an environment relatively small scale with may be of the vPC for layer 2 and a route to an aggregation layer, NX - OS 6.2 is probably favorable at this point because it has greater maturity and field exposure.

  If you want a switching platform that can provide an equivalent to FabricPath, i.e., layer 2 adjacency between switches of leaves, then when you use the Nexus 9000 VXLAN is probably going to be the Protocol of choice. VXLAN support and scalability, one of the biggest additions to version 7.0 of NX - OS is the use of layer 2 Ethernet VPN (EVPN) using multi protocol BGP as control plan. More you get support technique Anycast gateway for optimization optimized routing ARP, etc..

  If you are interested in this area, then take a reading of the white paper VXLAN network with EVPN MP - BGP control plan that goes into the details.

  Concerning

• RestAPI and automated deployment Support

  Hello

  We are currently migrating a CSR 1000v to AWS customer but have problems to automate the deployment. I've found a few contradictory documents who first asserted that the RestAPI was not available on the CSR1000v FRIEND but felt that he was in fact checking FRIEND once it has been initialized and running. I wasn't however able to use the restapi without first logging in and create a user since CSR is started and initially using a key and user ec2. I expect to help answering the following questions:

  - A user can be specified before initiating CSR 1000v for the first time, so that the RestAPI are accessible to first start without connection manually create this ssh user and if so, how?

  -J' saw that there were documents with an example on how reach HA using the EEM to make a change of route. One of the documents said he was using a machine virtual linux helper to run these route changes, the other document made it seem as if the EEM applet actually did change of route schedule without access to a virtual machine for assistance. Are there tools available on CSR in TCL form or any other aws which would allow CSR to send messages SNS to aws api or other API call natively without the use of a virtual machine in linux support?  

  -CSR 1000v for openstack document shows the ability to offer some changes to running configuration before the first start using the

  FVO - env.xml and or iosxe_config.txt. If all properties can be specified to be applied to the running-config to startup the instance of CSR and how it specifies these properties?

  Thanks for any help in this matter. We found the CSR to satisfy our needs, just to adapt to CSR in our deployment strategies.

  Some very good questions and answers should certainly be added to our future guides and documents. In the meantime, I'll try to help out with as much detail here as I can... It is in fact a way to pre-configure the CSR on AWS when first starting. AWS includes a feature called "UserData", which is a text field that can be supplied in an instance during the deployment. Machines virtual Linux can use this blob of text to allow a user to execute a script during the first boot, or in the case of CSR, allow us to use it to inject the IOS CLI commands when you first start. The UserData field can be specified using the AWS, provision of tools, including the portal, API, CLI, CloudFormation, etc.  The only real trick to this, is adding at the beginning of each line CLI with a numeric index.  Here is an example of a block of text, you could provide as UserData for the boot of CSR with a name of user and password configured pre:

  iOS-config-0001 = username privilege 15 password test123 test123

  If you need to add other commands, you can just increase the number of "ios-config-xxxx" at the beginning of each line.  AWS has a size of 16 KB for the string UserData, so be aware of this limitation.

  You could also go further and use CloudFormation to provision the CSR as well as any additional infrastructure, and the UserData field can be supplies in this scenario as well. I've attached a file to this message, which contains an example of a CloudFormation model.  You'll notice it includes the same piece of UserData to start the name of user and password for access to the API, and it also opens the default API port in the AWS security group.

  OK to the next question...

  For high availability functionality, we need is no longer the use of a helper VM.  The script that initiates the call to API AWS has been integrated in the CSR itself, so the EEM can call directly.  The following link will guide you in the correct steps for EEM using without the assistance of VM:

  http://www.Cisco.com/c/en/us/TD/docs/solutions/Hybrid_Cloud/Intercloud/CSR/AWS/CSRAWS/CSRAWS_4.html

  I hope this helps get you started with a few new options of commissioning. :)

• Cisco IOS CA

  Team,

  I use software Cisco IOS XE, Version 03.15.00.S - Standard Support version Cisco IOS software, software of CSR1000V (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.5 (2) S, (fc3) SOFTWARE VERSION to support my Cisco IOS CA.

  In short, I am trying to support a FlexVPN - client VPN Win7 according to document tac 115907 id

  In this document, he says that OpenSSL CA is used but a Cisco IOS CA can also be used. In tests I am at a point where my certificates do not match the example:

  The example document TAC:

  X509v3 extensions:
  X509v3 Key use: F0000000
  Digital signature

  Non-repudiation
  Encryption key

  Data encryption

  My version of laboratory:

  X509v3 extensions:
  X509v3 Key use: A0000000
  Digital signature
  Encryption key

  How can question - I get these replacement using the IOS Cisco CA extensions?

  Chris

  Chris,

  (Shameless Plug) take a look at IOS CA config I used:

  http://www.Cisco.com/c/en/us/support/docs/security/flexvpn/115014-flexvp...

  M.

• double flexvpn's ISP, how?

  Hello!

  I'm totally newbie with FlexVPN (and never used DMVPN also), so I want to ask a general question.

  We need to connect to FlexVPN hub, but we have two (well, really 3) providers of Internet services and we do not have our own address space, so we use the addresses of the pools of the IPSs.

  I need to use an ISP as primary and the other as backup, with automatic switching.

  BTW, we have that with ASA and the railway and it works pretty well.

  Back to FlexVPN: as I see source Tunnel must be an external interface, so I need to change the config to move to another ISP, i.e. it is not solvable by track.

  Could you tell me recommended provided automatic switching for two or more ISP configuration?

  BTW, we plan to use CSR1000v...

  Thank you!

  Hello

  Here you need to create two interfaces tunnel pointing two different tunnel say isps1 tunnel 1 and isp2 on the tunnels2 sources... After this thr routing protocol / ip sla monitoring will do the rest as usual.

  http://www.virtadept.com/?p=184

  Concerning

  Knockaert

• UCS and L2 multicast issues

  Hello

  I have 2 data centers connected through a tissue of spine / sheet using BGP EVPN. In a domain controller, I UCS and other legacy Dell ESX servers connected to catalyst switches. These are shared resources via a VPC local 9 k leafs to interconnect with the fabric. Some of VLANS have L2 multicast running. All the VLANS relevant are bridged through the fabric and presented to UCS/ESXi. When virtual machines have been vmotioned overall everything has worked well except the multicast broke. I created a policy of multicast in UCS and activated the interrogator with an IP address in one of VLAN relevant from the cisco documentation what UCS will not pass traffic unless there is a mrouter/interrogator. Then, I joined politics to the Vlan relevant under the section of LAN. However still does not. I don't see any questioning on the directly connected switches information upstream is. Should applicant IGMP allowed on switches?

  Thank you!

  https://supportforums.Cisco.com/document/12725606/setting-multicast-with...

  https://supportforums.Cisco.com/discussion/12111706/UCS-and-multicast

• IKEv2 AnyConnect and pool allocation via RADIUS

  I set up a CSR1000V (03.09.00a. S.153 - 2.) for AnyConnect with IKEv2. I store the user name and the IKEv2 permission policy on the RADIUS server. The customers are placed in their own iVRFs through the broadcast on the NAS RADIUS attributes.

  for example, in FreeRadius (2.1.12), what follows is defined (home is the 'group') as [email protected] / * / format.

  Home-password in clear text: = "cisco".

  Cisco-AVPair += "ip:interface - config = vrf forwarding CUST-A."

  Cisco-AVPair += "ip:interface - config = ip unnumbered loopback100."

  Box-pool = "CUST-A-POOL '.

  [email protected] / * /               Password in clear text: = 'test123 '.

  The user and group permission information are then merged and cloned on the virtual model:

  Crypto ikev2 name-mangler EXCERPT-GROUP

  EAP suffix delimiter @.

  !

  Ikev2 crypto FlexVPN-IKEv2-profile-1 profile

  fvrf IPSEC-FVRF game

  match the key - remote identity FlexAnyConnect id

  identity local dn

  authentication eap remote query-identity

  authentication local rsa - sig

  PKI trustpoint cacert.org

  DPD 60 2 on request

  AAA authentication eap List1-AuthC-FlexVPN

  AAA authorization eap group list mangler-name-FlexVPN-AuthZ-list-1 EXCERPT-GROUP

  AAA authorization eap user set caching

  virtual-model 1

  !

  type of interface virtual-Template1 tunnel

  no ip address

  ipv4 ipsec tunnel mode

  VRF tunnel IPSEC-FVRF

  Profile of tunnel FlexVPN-IPsec-profile-1 ipsec protection

  However, it appears that the attribute RADIUS specifying that the pool is ignored; I can see the attribute RADIUS (IETF 88) broadcast on the NAS in the RADIUS debugs:

  * 21:36:39.384 August 16 TSB: RADIUS: box-IP-pool [88] 13 'CUST-A-POOL'

  However, cryptography debugs say an IP cannot be attributed:

  * 21:36:39.435 August 16 TSB: IKEv2: cannot allocate an IP addr

  Contents of payload:

  AUTH NOTIFY (INTERNAL_ADDRESS_FAILURE)

  If the framed pool is removed and a box-IP-Address instead of the user, the address set is assigned. The CUST-A-POOL is set locally on the NAS server. Is that all that I'm missing? Any debugs more detailed can be generated?

  See you soon,.

  Matt

  Matt,

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId= CSCty98153

  Send:

  ipsec:addr-pool or ipsec:ipv6-addr-pool

  M.