Cheers - Much appreciated.
> Date: Thu, 22 Jan 2015 22:42:56 +0200 > From: [email protected] > To: [email protected] > Subject: Re: [c-nsp] storm-control broadcast level (4948) > > On (2015-01-23 06:44 +1100), CiscoNSP List wrote: > > Hey, > > > Looking for some "real world" experience on what values to implement for > > storm-control on 4948's (Customer facing Ints, and > > switch(Customer/Carrier/Our own) facing Ints)...I realise every network has > > unique traffic patterns, so recommended values would vary > > dramatically....Ours is a service provider network, ports connect to > > customer switches/routers/firewalls/carriers, and we sell a mix of vrf+inet > > tails. > > Storm-control lends itself well to data based decisions. You can turn it on > with ridiculous limits and gather observed pps rates, then add some margin and > implement. > If you don't have time to do this, set edge ports to 100pps and core-ports to > 2kpps. > > I often see these in the field with something like 80% and I wonder, what was > the rationale. WS-X6704-10GE can implement 0.34% as lowest rate, and it's too > high rate for the control-plane to handle. > > > Also, any other Int templates you use to improve/mitigate customer > > "miss-configurations" would be greatly appreciated. > > If service provided through port is L3, allow IPv4, ARP and IPV6 ethertypes > and drop rest. Remove DTP. Run port-fast default, bpdu-filter on portfast and > bpudguard (on L3 ports only, not towards say PE, which may transport L2). > Consider limiting amount of MAC addresses through port via port-security. > > -- > ++ytti > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
