Hey, Have an odd problem with a 65K (SXH2a) where a particular VRF appears to be "broken" (not passing IP traffic) despite it being deleted and recreated, all other (and new) VRFs work fine, I suspect it is down to the internal VLAN it is getting assigned (it keeps getting the same int-vlan each time)
Looking at the CEF adj counters from the aggregate labelled traffic as it comes in (and gets recirculated) I can see traffic passing through the adjacency and into the internal vlan (so it is not dropping the aggregate label traffic) I decided to do an ELAM capture at this point and found the following differences (note, in both cases, the destination IP on this box I'm pinging is a loopback) Working VRF: < SEQ_NUM [5] = 0x17 < CCC [3] = b100 [L3_RW] Broken VRF: > SEQ_NUM [5] = 0x9 > CCC [3] = b101 [L2_POLICE] Working VRF: < DEST_INDEX [19] = 0x380 < VLAN [12] = 1022 < RBH [3] = b110 < RDT [1] = 0 Broken VRF: > DEST_INDEX [19] = 0x7E00 > VLAN [12] = 1184 (this is the broken int-vlan) > RBH [3] = b101 > RDT [1] = 1 Working VRF: < L2 [1] = 1 Broken VRF: > L2 [1] = 0 Not quite sure what to make of that, there is a valid cef receive adjacency for the loopbacks in the VRF so it should punt from internal VLAN to CPU (but the counters on the loopback of the broken VRF are 0/0 so obviously not) My current theory is based on reading the contents of CSCsm84073 which suggest that under some circumstances there is a default deny acl in place on the int-vlan and it is not programmed with a permit acl on creation, however I can't directly verify this because I can't use the "show tcam int" command since the internal vlan doesn't have a real named port, despite appearing as an SWIDB :( If anybody has seen this before and could comment I would be most appreciative before taking this to TAC. Regards, ------------------------------------------------ David Freedman Group Network Engineering Claranet Limited http://www.clara.net _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
