Re: [c-nsp] Fabric buffer-reserve high: what does it actually do?

2012-08-29 Thread Tóth András
Hi Dale, Only an internal one. This command was not officially documented in the past, that's why no external documentation mentions this change. Best regards, Andras On Tue, Aug 28, 2012 at 8:04 PM, Dale W. Carder dwcar...@wisc.edu wrote: Hi Andras, Do you have a link to documentation/ddts

Re: [c-nsp] WAN PHY and OTN(G.709) modes

2012-08-29 Thread Saku Ytti
On (2012-08-29 09:33 +0100), Phil Mayers wrote: That's an interesting idea. Are those counters well-exposed on kit that supports WAN PHY? Platform dependant. If framer is on optic, then almost certainly you'll have no way to capitalize on WAN PHY. If framer is on linecard, they might not be

[c-nsp] Sup720 SVI ACL deny punted? (no logging)

2012-08-29 Thread Peter Rathlev
Good morning all, I'm stumped researching a slightly overloaded Supervisor 720 on one of our aggregation devices. I've discovered that an access-list applied to a SVI means denied packets are punted to the CPU. There's no log statement. The packets have no IP options, TTL=64, DSCP=0x28 and frame

Re: [c-nsp] Sup720 SVI ACL deny punted? (no logging)

2012-08-29 Thread Peter Rathlev
On Wed, 2012-08-29 at 11:17 +0200, Peter Rathlev wrote: I'm stumped researching a slightly overloaded Supervisor 720 on one of our aggregation devices. ... Forgot to mention platform: WS-SUP720-3B revision 5.2 running 12.2(33)SXI1 Advanced IP Services. Traffic arrives tagged on a WS-X6724-SFP.

Re: [c-nsp] WAN PHY and OTN(G.709) modes

2012-08-29 Thread Mikael Abrahamsson
On Wed, 29 Aug 2012, Saku Ytti wrote: But you can get similar functionality and more from EOAM regardless of framing. Does EOAM detect errors on a link with very little traffic? Anyhow, on for instance ASR9k we get this: Configuration Mode: WAN Mode SECTION LOF = 13, LOS = 7, BIP(B1) =

Re: [c-nsp] WAN PHY and OTN(G.709) modes

2012-08-29 Thread Saku Ytti
On (2012-08-29 12:16 +0200), Mikael Abrahamsson wrote: Does EOAM detect errors on a link with very little traffic? EOAM are sent periodically regardless of traffic levels. So it'll detect erroring regardless of traffic levels. However, it'll take longer to detect it, the smaller it is. While in

Re: [c-nsp] remove PAT command from FWSM configure

2012-08-29 Thread Peter Rathlev
On Wed, 2012-08-29 at 16:42 +0800, zhangyongshun wrote: 于 2012/8/26 23:43, Peter Rathlev 写道: nat (inside) 18 0.0.0.0 0.0.0.0 if this commmand match any real inside network traffic? That would depend on the definition of any real inside network traffic. The NAT statements matches all

Re: [c-nsp] Sup720 SVI ACL deny punted? (no logging)

2012-08-29 Thread Brian Turnbow
A couple of ideas 1 to generate an ip unreachable ? try disabling them on the SVI 2 I remember something about acl and netflow (punts to create flows) but it was sup-2. I'm not sure if it still applies to sup-720 Brian -Original Message- From: cisco-nsp-boun...@puck.nether.net

Re: [c-nsp] Sup720 SVI ACL deny punted? (no logging)

2012-08-29 Thread Jared Mauch
What are your mls rate limiters set for, including the no-route one? Jared Mauch On Aug 29, 2012, at 5:17 AM, Peter Rathlev pe...@rathlev.dk wrote: Good morning all, I'm stumped researching a slightly overloaded Supervisor 720 on one of our aggregation devices. I've discovered that an

Re: [c-nsp] Sup720 SVI ACL deny punted? (no logging)

2012-08-29 Thread Peter Rathlev
On Wed, 2012-08-29 at 11:09 +, Brian Turnbow wrote: 1 to generate an ip unreachable ? try disabling them on the SVI Ahh, interesting idea. We have an ACL drop rate-limiter in place: mls rate-limit unicast ip icmp unreachable acl-drop 200 10 When replacing this with ... acl-drop 0 the

Re: [c-nsp] Sup720 SVI ACL deny punted? (no logging)

2012-08-29 Thread Peter Rathlev
On Wed, 2012-08-29 at 15:22 +0100, Phil Mayers wrote: On 29/08/12 14:35, Peter Rathlev wrote: If we know that the punting is limited to 200 pps it shouldn't matter too much. I've tried simply removing the ACL to see if the CPU overload disappears. But why would 200 pps even start making it

Re: [c-nsp] PBR within MPLS VPN

2012-08-29 Thread Jeff Bacon
This was actually useful, but only to the extent that I've determined that no you really can't do that - show tcam int confirmed that using set ip vrf X next-hop recursive Y is software-punted, and the combinations that do create a hdw forward entry send packets into some random black hole. I