SHARIFUL's TECH BLOG

For a long time I missed one feature in Cisco IOS-XE routers while working with multiple Vrfs. If somehow I could have a logical/virtual point-to-point links connecting two Vrfs. The feature I am talking about exactly same as Fortigate firewalls offer - vdom-links; which connects two vdoms using a virtual p-to-p links. It looks like Cisco has already implemented such feature which is called - VASI (VRF-Aware Software Infrastructure ). With VASI-interfaces we can connect two vrfs (including global vrf); using a logical p-to-p link. One side of a VASI-link will called - vasileft (belongs to a vrf) and another side will be called vasiright (belongs to another vrf). If we assign an IP address to those left/right interfaces; we have connected the two Vrfs. After that we can easily implement route leaking between the vrfs using static routing, dynamic routing protocols (ospf, bgp) etc. Enough theory; lets start configuring our topology which looks like below - 01 - Network Topology Our topol...

I was trying to connect a firewall cluster (Active-Passive) with a Cisco IOS-XE based router. Then faced a problem - I cannot connect two different firewalls in a cluster to the router; because the router's interfaces operates in layer-3 mode. The interfaces in the router does not support layer-2 switching. Before going further - let's have a look on your topology -  01 - Network Topology If we look at the topology above - we can see the problem - if it was not a router; just a layer-3 switch; we can configure like below in the layer-3 switch - interface gi1   channel-group 1 mode active ! interface gi2   channel-group 1 mode active ! int port-channel 1   switchport   switchport mode trunk ! But the problem is - there is no "switchport" command to enable layer-2 vlan processing in a Cisco router. Also we have a firewall cluster - it is not possible to support the cluster when a failover happens from the router's perspective. Cisco IOS-XE routers solves this prob...

With IOS-XE based network devices, Cisco introduced a new way to run the operating system which is called "install mode" . The old/legacy way to load the operating system is still there which is now called "bundle mode" . The recommended way to run the OS in IOS-XE based devices is install mode.  With the new "install mode" all the operating system files are already extracted as "pkg" files and they are loaded into the device's memory using a provisioning file named "packages.conf" . As OS files are already extracted and directly loaded into the memory; this mode has faster boot time and consumes less RAM  than bundle mode (legacy) and is the recommended method. Cisco has long list of documentation; how to use "install mode" in the network devices. In today's post I will show how to use install mode during firmware update where the network administrator has full control. Let's introduce our topology -  Topology ...