cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1220
Views
0
Helpful
1
Replies
Highlighted
Cisco Employee

SXP Connection Design

Hi,

I am looking for a best practice guide for setting up SXP connections. I went through the basic ones that are available. I am looking for few suggestions on best setting up SXP tunnel between 9 C3650 switches. I observed that when SXP tunnels are setup in a mesh format with all the 9 switches, the CPU of the switch goes high. When its setup in a star format there is no issue with CPU. So, in this regard, is there a best practice guide to setup SXP connections, basically between switches? I do not have SXP between ISE and Switch.

Thanks

TJ

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Re: SXP Connection Design

Tiju,

If you cannot use inline tagging between the switches and need SXP, https://communities.cisco.com/docs/DOC-75763 may help, alternatively if you download Darrin Miller’s BRKSEC-3690 slides from CiscoLive you will find some more detail on SXP reflector designs and how to use SXP path length filters. They are important with SXP reflector designs (look around slide 100 in his most recent Orlando delivery).

A mesh approach should be avoided, SXP reflector will be much more effective, please note that the path length limits came in 3.6(5), 3.7(4) and 16.3 onwards.

If all of the users/devices are going to be authorized by ISE, you may find it simpler to send SXP from ISE directly to the switches, then the switches only need to be configured as SXP listeners.

Hope that helps,

Kevin

View solution in original post

1 REPLY 1
Highlighted
Cisco Employee

Re: SXP Connection Design

Tiju,

If you cannot use inline tagging between the switches and need SXP, https://communities.cisco.com/docs/DOC-75763 may help, alternatively if you download Darrin Miller’s BRKSEC-3690 slides from CiscoLive you will find some more detail on SXP reflector designs and how to use SXP path length filters. They are important with SXP reflector designs (look around slide 100 in his most recent Orlando delivery).

A mesh approach should be avoided, SXP reflector will be much more effective, please note that the path length limits came in 3.6(5), 3.7(4) and 16.3 onwards.

If all of the users/devices are going to be authorized by ISE, you may find it simpler to send SXP from ISE directly to the switches, then the switches only need to be configured as SXP listeners.

Hope that helps,

Kevin

View solution in original post