Unknown PINGs Sourced From Nexus7710

[Michael Mertens]

So I see constant ICMP Echo/PINGs being sourced from a Nexus7710 with a destination of two of our ISE Policy nodes, being denied/dropped by our PAN firewall. I suspect these are PINGs someone initiated months ago, and are continuing even after their session ended. I don't see any type of SLA configured, and I'm the only user with a session into the the 7710. "Show ip ping source-interface" does not list anything. "Show ip traffic", under "ICMP software Processed Traffic Statistics" oes not indicate echo request count incrementing....

Does anyone know of a way to show whether IP ICMP process is running on the NX-OS? I'm running 7.0(3). Or does anyone have any ideas why these PINGs would be sourced from the Nexus to the ISE nodes? I don't see any other of our switches doing this....

Thanks!

Mike

[akdhingr]

Hello,

How are you tracing that the pings are being sourced from N7ks. Are you taking any captures and checking SIP and SMAC of the pings ?

I would suggest take ethanalyzer with decode-internal on N7ks to see if it is really being sourced from N7ks or if the traffic is just being software switched. 

BR,

Ak