ACI IPN MTU ping drop packet

[Steev112]

Hi,

I want to establish the multipod between the two sites, in the IPN in DC is N7K using VDC and in DR N9K, when i configured the jambo frame on N7K-IPN-VDC and on N9K-IPN but hen i try to ping from N9k or N7K point to point IP address i have drop as show below:

ping 10.10.1.13 df-bit packet-size 9000 source-interface ethernet 1/3
PING 10.10.1.13 (10.10.1.13): 9000 data bytes
9008 bytes from 10.10.1.13: icmp_seq=0 ttl=254 time=1.793 ms
9008 bytes from 10.10.1.13: icmp_seq=1 ttl=254 time=1.326 ms
Request 2 timed out
9008 bytes from 10.10.1.13: icmp_seq=3 ttl=254 time=1.805 ms
9008 bytes from 10.10.1.13: icmp_seq=4 ttl=254 time=1.562 ms

--- 10.10.1.13 ping statistics ---
5 packets transmitted, 4 packets received, 20.00% packet loss
round-trip min/avg/max = 1.326/1.621/1.805 ms

the configuration on N7K and N9K:

N7k
system jumbomtu 9150

interface Ethernet 2/5.4
mtu 9150
encapsulation dot1q 4
vrf member fabric-mpod
ip address 10.10.1.13/30

N9K

system jumbomtu 9150
!
policy-map type network-qos jumbo
class type network-qos class-default
mtu 9150

system qos
service-policy type network-qos jumbo

interface Ethernet 1/3
mtu 9150
vrf member fabric-mpod
ip address 10.10.1.14/30

anyone has the same issue.

Thanks

[richmond]

It’s most likely control plane policing dropping some of the ping traffic.

[Steev112]

Hi Rich, 

thanks for your update, could you please guide me how to change the default value and what is the suitable value, below the output:

class-map copp-system-p-class-monitoring (match-any)
match access-group name copp-system-p-acl-icmp
match access-group name copp-system-p-acl-icmp6
match access-group name copp-system-p-acl-mpls-oam
match access-group name copp-system-p-acl-traceroute
match access-group name copp-system-p-acl-http-response
match access-group name copp-system-p-acl-smtp-response
match access-group name copp-system-p-acl-http6-response
match access-group name copp-system-p-acl-smtp6-response
match access-group name copp-system-p-acl-rise-nam-response
match access-group name copp-system-p-acl-rise6-nam-response
match protocol mpls
set cos 1
police cir 130 kbps bc 1000 ms
conform action: transmit
violate action: drop
module 1:
conformed 370931008 bytes,
5-min offered rate 56 bytes/sec
peak rate 718 bytes/sec at Thu Jul 05 03:59:06 2018
violated 712728 bytes,
5-min violate rate 0 bytes/sec
peak rate 2119 bytes/sec at Thu Jul 05 03:59:06 2018
module 2:
conformed 5868 bytes,
5-min offered rate 0 bytes/sec
peak rate 6 bytes/sec at Sat Jul 14 05:00:27 2018
violated 0 bytes,
5-min violate rate 0 bytes/sec
peak rate 0 bytes/sec
module 5:
conformed 43988265 bytes,
5-min offered rate 2 bytes/sec
peak rate 775 bytes/sec at Thu Jul 05 03:59:06 2018
violated 769524 bytes,
5-min violate rate 0 bytes/sec
peak rate 2565 bytes/sec at Thu Jul 05 03:59:06 2018

 what is the correct value?

Thanks

[richmond]

You don’t have to adjust it. In normal operation you won’t be having 9000byte flood pings hitting the CPU. 

There is no ”correct” value. It depends on the network and what is normal. 

[Steev112]

But for IPN must ping without any drop so it should has a correct value.

[richmond]

The requirement is that the IPN needs to pass the packets without fragmentation being necessary. Sending pings between switches is just one way to verify this is happening. The fact that some pings drop due to CoPP will have no impact on IPN performance*.

*Unless CoPP is doing things like dropping adjancencies etc.

[Steev112]

Thanks Rich for your update that mean if i don't modify the copp configuration there is no impact.

Thanks again