[c-nsp] Recommendation - reconfiguring full-mesh VPN network

Hi, We've more or less taken over configuration and support of a customer network. It is made up of several microwave links, with 2800 series routers at the points in between. Lower layer EIGRP routing, with VPN tunnel on top to secure the actual content. Sites have dual VLANs for voice and data,

Re: [c-nsp] 3750 High Cpu IP Input

On Thu, 2009-04-23 at 19:09 -0400, Chris Lane wrote: sh platform tcam utilization CAM Utilization for ASIC# 0 MaxUsed ... Hm... nothing there (unless the other ASICs show dissimilar results). If the problem is punted traffic, maybe show ip cef switching

Re: [c-nsp] Problems with multiple VPDN hops

Hi Pshem, Thanks for your reply. Having the same NAS-IP-Address in both rules is not a typo. In the first rule, we are saying 'If the NAS IP Address is NOT equal to 213.130.147.56 then apply the following rule' In the second rule, we are saying 'If the NAS IP Address IS equal to 213.130.147.56

Re: [c-nsp] 3750 High Cpu IP Input

Chris Lane wrote: Having a high cpu with my 3750 not in stack. sh proc cpu | exclude 0.00 CPU utilization for five seconds: 68%/43%; one minute: 69%; five minutes: 70% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 16840336940 92166921437 15.49% 15.76% 15.97%

Re: [c-nsp] 3750 High Cpu IP Input

Your CPU is @ 70%, 25% of those spent in interrupt (CEF) packet switching (the difference between 68% and 43% in the five-second figures), yet the IP Input uses only 16%. There might be something else going on? Ivan http://www.ioshints.info/about http://blog.ioshints.info/ -Original

Re: [c-nsp] 3750 High Cpu IP Input

You can use show controller cpu to help see whats going to the cpu Make sure you have no ip redirects and no proxy arp on all the interfaces. How many routed interfaces do you have ? The output below for max is for 8 routed interfaces if you have more you should change to the desktop switching

Re: [c-nsp] pingalias with a variable

Not the most elegant solution event manager applet PING event cli pattern ping sync no skip yes action 1.0 cli command enable action 2.0 cli command $_cli_msg source loopback0 action 3.0 syslog msg $_cli_result ! If you have latest IOS, you can use puts instead of syslog for the output,

Re: [c-nsp] 3750 High Cpu IP Input

sh controllers cpu-interface ASICRxbiterr RxunderFwdctfix Txbuflos Rxbufloc Rxbufdrain - ASIC0 0 0 0 0 0 0 ASIC1 0 0 0 0

Re: [c-nsp] 3750 High Cpu IP Input

I just punted the device. Still same. Here is more info that i hope can help. sh proc cpu | exclude 0.0 CPU utilization for five seconds: 92%/66%; one minute: 90%; five minutes: 78% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 519075 27626328 1.59%

Re: [c-nsp] 3750 High Cpu IP Input

sh proc cpu | exclude 0.00 CPU utilization for five seconds: 88%/63%; one minute: 89%; five minutes: 89% PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process 46029 389 15498 1.11% 0.16% 0.12% 0 Check heaps 92883 5699505 0.15%

Re: [c-nsp] 3750 High Cpu IP Input

sh ip cef switching statistics feature IPv4 CEF input features: FeatureDropConsume Punt Punt2Host Gave route Total0 0 0 0 0 IPv4 CEF output features: FeatureDropConsume Punt

[c-nsp] Forcing all HSRP interfaces to failover

Hi everyone, Is there any good way to have IOS abdicate the active status on all of its HSRP interfaces? Of course I could change each of a few thousand SVIs, but I'd like a better way. The only thing I can come up with is to create an unnumbered loopback just to use as a tracking target.

Re: [c-nsp] 3750 High Cpu IP Input

how many routed interfaces do you have ( sh ip int brief with ip addresses ) ? if more than 8 change the sdm template to routing you can use sh platform ip unicast failed route to see if routes are failing to be programmed into tcam Brian From:

Re: [c-nsp] Forcing all HSRP interfaces to failover

Ross Vandegrift wrote: Hi everyone, Is there any good way to have IOS abdicate the active status on all of its HSRP interfaces? Of course I could change each of a few thousand SVIs, but I'd like a better way. The only thing I can come up with is to create an unnumbered loopback just to use as

Re: [c-nsp] 3750 High Cpu IP Input

1 routed interface.sh platform ip unicast failed route Total of 0 covering fib entries Thanks for reply.. I checked earlier regarding sdm. Its the same on all of my 3750's i have about 20 of them throughout the states, this is probably the quietest one in regards to bandwidth and services. On

[c-nsp] Looking for c7300-k91p-mz.122-28.SB1

Is anyone running this IOS or has a copy set aside?... ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/

Re: [c-nsp] 3750 High Cpu IP Input

Maybe try ip options drop for a while (you might drop legitimate traffic!) to see if that makes a difference. -- Tassos Chris Lane wrote on 24/04/2009 14:44: sh ip traffic IP statistics: Rcvd: 37788273 total, 24253 local destination 0 format errors, 0 checksum errors, 9771492 bad

Re: [c-nsp] Forcing all HSRP interfaces to failover

On Fri, 2009-04-24 at 07:04 -0400, Ross Vandegrift wrote: Is there any good way to have IOS abdicate the active status on all of its HSRP interfaces? Of course I could change each of a few thousand SVIs, but I'd like a better way. The only thing I can come up with is to create an unnumbered

Re: [c-nsp] 3750 High Cpu IP Input

sh ip traffic IP statistics: Rcvd: 37788273 total, 24253 local destination 0 format errors, 0 checksum errors, 9771492 bad hop count 0 unknown protocol, 27979860 not a gateway 0 security failures, 0 bad options, 7762670 with options Opts: 0 end, 0 nop, 0 basic

Re: [c-nsp] 3750 High Cpu IP Input

Richard Gallagher found that it was one of my customers sending mcast packets with a TTL 1. Tried adding ACL's to lower CPU but this didn't fix. We shutdown Vlan to verify and CPU came down 40% to adequate levels. I have a call into out customer notifying them to fix. Thanks to all for your

Re: [c-nsp] The dreaded microburst - definition and troubleshooting

On Fri, Apr 24, 2009 at 02:38:01PM +1000, Dale Shaw wrote: Hi all, Is there a universally agreed upon definition for a 'microburst'? None that I have ever seen because it's all relative. Is there a defined time measurement - i.e. 5ms, 10ms, 50ms, 100ms, 1000ms - during which a certain

Re: [c-nsp] 3750 High Cpu IP Input

Input queue was full of packets like this: Buffer information for RxQ3 buffer at 0x2E792F0 data_area 0x7BB2AB0, refcount 1, next 0x2E7E210, flags 0x200 linktype 7 (IP), enctype 1 (ARPA), encsize 14, rxtype 1 if_input 0x3ABBAE0 (Vlan217), if_output 0x0 (None) inputtime 00:00:00.000

Re: [c-nsp] 3750 High Cpu IP Input

These TTL=1 are causing the high CPU. Just out of curiousity, would adding ip multicast ttl-threshold 3 and/or no ip unreachable on the interface reduce cpu usage? Lee On 4/24/09, Richard Gallagher rgall...@cisco.com wrote: Input queue was full of packets like this: Buffer information for

Re: [c-nsp] 3750 High Cpu IP Input

nterface Vlan217 description CUSTOMER A ip address x.x.x.x.x ip access-group 178 in no ip redirects no ip unreachables no ip proxy-arp ip multicast ttl-threshold 3 shcpu CPU utilization for five seconds: 92%/51%; one minute: 92%; five minutes: 92% PID Runtime(ms) Invoked uSecs

Re: [c-nsp] The dreaded microburst - definition and troubleshooting

Hi Rodney, Thanks for the response. On Fri, Apr 24, 2009 at 11:31 PM, Rodney Dunn rod...@cisco.com wrote: On Fri, Apr 24, 2009 at 02:38:01PM +1000, Dale Shaw wrote: Does anyone have any tips for troubleshooting microbursts, particularly in relation to the c7200 platform exhibiting no buff

Re: [c-nsp] 3750 High Cpu IP Input

Just curious. What kind of PPS was this multicast traffic? Was the fact that it was multicast the big issue, or just the TTL itself? Chuck -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Chris Lane Sent: Friday, April

Re: [c-nsp] 3750 High Cpu IP Input

On Fri, Apr 24, 2009 at 10:01:08AM -0400, Lee wrote: These TTL=1 are causing the high CPU. Yes, those are not HW switched but punted to CPU in order to generate TTL_Exceeded ICMP message. Not sure if there's any knob to discard them silently. Just out of curiousity, would adding ip

Re: [c-nsp] 3750 High Cpu IP Input

Too bad the multicast ttl-thresold doesn't work. Does your access-list 178 block traffic to 224.0.0.252? Lee On 4/24/09, Chris Lane clane1...@gmail.com wrote: nterface Vlan217 description CUSTOMER A ip address x.x.x.x.x ip access-group 178 in no ip redirects no ip unreachables no

Re: [c-nsp] 3750 High Cpu IP Input

On 4/24/09, Marian Ďurkovič m...@bts.sk wrote: On Fri, Apr 24, 2009 at 10:01:08AM -0400, Lee wrote: These TTL=1 are causing the high CPU. Yes, those are not HW switched but punted to CPU in order to generate TTL_Exceeded ICMP message. Not sure if there's any knob to discard them silently.

Re: [c-nsp] 3750 High Cpu IP Input

Last I checked no ip unreachables breaks PMTUD which can be fine in your environment or cause other serious problems. Vijay Ramcharan -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Lee Sent: April 24, 2009 11:10

[c-nsp] 6500 SXD7b VRRP issue

I just searched bug toolkit and didn't see anything similar, but has anyone else had issues with VRRP freaking out with 6500s running s72033-pk9sv-mz.122-18.SXD7b.bin? Last night, we lost connectivity to one of our BGP providers. 10 seconds after the %BGP-5-ADJCHANGE: neighbor x.x.x.x

Re: [c-nsp] 3750 High Cpu IP Input

Maybe ip multicast boundary can help you. http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_46_se/configuration/guide/swmcast.html#wp1033764 -- Tassos Lee wrote on 24/04/2009 18:06: Too bad the multicast ttl-thresold doesn't work. Does your access-list 178 block

Re: [c-nsp] 3750 High Cpu IP Input

Thanks for the info Lee On 4/24/09, Richard Gallagher rgall...@cisco.com wrote: It does block these packets, but this does not effect the CPU, they are still punted, nothing can be done about this. There is no rate-limiter either on this platform, on the 6k we have: - mls rate-limit all

Re: [c-nsp] 3750 High Cpu IP Input

It does block these packets, but this does not effect the CPU, they are still punted, nothing can be done about this. There is no rate-limiter either on this platform, on the 6k we have: - mls rate-limit all ttl-failure value per milisec Best case is going to be stop the sources sending, not

Re: [c-nsp] The dreaded microburst - definition and troubleshooting

I know what you're feeling. I had a case open with TAC to diagnose why were getting input drops, and they wanted me to packet capture all the traffic going to the interface to see if I could identify what traffic was generating the microburstexcept the volume is 40 to 60 Mbps and the drops

[c-nsp] Problems with DHCP static bindings

We are using DHCP off the router, assigning static and dynamic addresses. The static configs work fine for Dell printers but not Xerox. Here is one that does not work, we have tried both hardware-address and client-identifier; with and without the host name: ip dhcp excluded-address 10.14.138.1

Re: [c-nsp] The dreaded microburst - definition and troubleshooting

The definition I generally use is this: [snip] A microburst is when packet drops occur when there is not sustained or noticeable congestion upon a link or device. Example: The 1 minute utilization of a link is 20% and packet drops are occurring. Microbursts happen in every packet based network

[c-nsp] Adding member to Multilink PPP during production

Hi all, We took down one of our 3 T1's in a PPP multilink group last night so that the LEC could replace a cable pair. Is it safe to add it back to the bundle during production hours? We've got mostly VoIP and Citrix traffic traversing that WAN link. Naturally it's the VoIP that I am mostly

[c-nsp] C7301 dropping OSPF

PROBLEM: 7301 dropping OSPF adjacencies. The log is showing the following messages: Apr 23 12:20:01 c7301 392: 000398: Apr 23 12:20:00.016 PDT: %OSPF-5-ADJCHG: Process 5794, Nbr x.x.x.x on GigabitEthernet0/0 from LOADING to FULL, Loading Done Apr 23 12:20:01 c7301 393: 000399: Apr 23

[c-nsp] Cisco 7606S PPP Multilink issues

I have a Cisco 7606S router with 8 port spa T1 card, running ios version: c7600rsp72043-adventerprisek9-mz.122-33.SRC1.bin Right now i have 2 T1's coming in on the same chassis and we are trying to use PPP Multilink. The far end equipment is a Cisco 7206 router with IOS version:

Re: [c-nsp] C7301 dropping OSPF

Bill Do you have multicast routing enabled on your network? If so what multicast addresses are you using? Can you do a show interface on the routed interfaces and post? Show ip ospf interface as well if you would. -Original Message- From: Bill Blackford bblackf...@nwresd.k12.or.us

Re: [c-nsp] The dreaded microburst - definition and troubleshooting

On Fri, Apr 24, 2009 at 11:47:34AM -0500, Frank Bulk wrote: I know what you're feeling. I had a case open with TAC to diagnose why were getting input drops, and they wanted me to packet capture all the traffic going to the interface to see if I could identify what traffic was generating the

Re: [c-nsp] C7301 dropping OSPF

Turn on log adjacency detail under OSPF and correlate it. Almost always a result of packet loss with the peers. Rodney On Fri, Apr 24, 2009 at 10:09:56AM -0700, Bill Blackford wrote: PROBLEM: 7301 dropping OSPF adjacencies. The log is showing the following messages: Apr 23 12:20:01 c7301

Re: [c-nsp] 3750 High Cpu IP Input

On 4/24/09, Ramcharan, Vijay A vijay.ramcha...@verizonbusiness.com wrote: Last I checked no ip unreachables breaks PMTUD which can be fine in your environment or cause other serious problems. Earlier QA in the thread: how many routed interfaces do you have ( sh ip int brief with ip addresses )

Re: [c-nsp] Problems with DHCP static bindings

I recall having this problem with Xerox printers. I believe I ended up having to set the address via the control panel on the device. This was with ISC DHCPD server. It's something weird with Xerox kit, not the server side. james edwards wrote: We are using DHCP off the router, assigning

Re: [c-nsp] Adding member to Multilink PPP during production

We do this all the time in carrier scenarios, carrying voip. I've never seen a problem with taking out members of ppp multilink groups at random, and re-adding them at random. It might cause a packet or two to drop when the link goes away unexpectedly. -Original Message- From:

Re: [c-nsp] number of VRFs on Cisco Cat/7600

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Sup720's support a Max of 1024 VRF's. See the datasheet: http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/product_data_sheet09186a0080159856.html David On Apr 23, 2009, at 10:20 AM, Adam Armstrong wrote: Marlon Duksa wrote: I

Re: [c-nsp] C7301 dropping OSPF

Have you ever seen it with overlapping multicast addressing? -Original Message- From: Rodney Dunn rod...@cisco.com Sent: Friday, April 24, 2009 1:36 PM To: Bill Blackford bblackf...@nwresd.k12.or.us Cc: cisco-nsp@puck.nether.net cisco-nsp@puck.nether.net Subject: Re: [c-nsp] C7301

[c-nsp] Using SUP V-10GE in WS-C4006

Hi! Did anybody know, can i use SUP V-10GE in WS-C4006 chassis? that link http://www.cisco.com/web/partners/downloads/765/tools/quickreference/catalyst4000supervisors.pdf say`s Any chassis except 4003, but if i try to boot i see WS-X4516-10GE supervisor not supported in WS-C4006 chassis. i try

[c-nsp] 3750 Stack Weird 'Failure'

I have a stack of 3750's with 4 members, and after an IOS upgarde to 12.2(50), the stack rebooted and one of the members just keeps rebooting, and the logs show the member keeps joining and then getting removed from the stack. I would say this is related to the new IOS, but the reason for the

[c-nsp] Using SNMP to determine BGP neighbor received route count

Is there an SNMP MIB that can be used to determine a BGP neighbor's received route count? Thanks in advance. -- Chris Phillips ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at

Re: [c-nsp] Using SNMP to determine BGP neighbor received route count

yes there is, You can find the information in the BGP4-MIB.my file which you can download using anonymous ftp to ftp.cisco.com. Chris Phillips wrote: Is there an SNMP MIB that can be used to determine a BGP neighbor's received route count? Thanks in advance. -- - Brian

Re: [c-nsp] number of VRFs on Cisco Cat/7600

I have heard it said that more than 512 VRFs is crazy. more than 1024 *INSANE*. adam. -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Sup720's support a Max of 1024 VRF's. See the datasheet:

Re: [c-nsp] 6500 SXD7b VRRP issue

On Fri, 24 Apr 2009, Kevin Loch wrote: all the interfaces on this router running VRRP started having their states change from backup to master to backup every few seconds. After about 40 seconds of this, it settled down and all the VRRP states went back to their original state. While this

[c-nsp] Cisco 7304/NSE-100 L2TP session problem

Hello, i am using a 7304 w/NSE-100 for DSL aggregation. Am running 12.2.33SB5 now (also tried 12.2.31 and 12.2.28). However i cant get things to work, L2TP tunnels are getting established but as soon as sessions are coming in they are getting closed. My config as follows: virtual-profile