Hello dbrown,
have a look at the following SW bug that looks like your case
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCva70427
https://community.cisco.com/t5/cisco-bug-discussions/cscva70427-cat4500x-16-vss-high-cpu-with-16k-arp-entries-gt/td-p/3840803
According to the following document the filters should be as much specific as possible
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dns/configuration/xe-16-12/dns-xe-16-12-book/service-discovery-gateway.html
You say you have ten buildings and each of them with one data Vlan one wireless Vlan and one VOIP vlan.
>> There are wired printers and Apple TVs throughout the campus and I need wired and wireless macOS and iOS devices to be able to use functions like AirPrint and AirPlay
in the above document see at the summary steps:
SUMMARY STEPS
- enable
- configure terminal
- service-routing mdns-sd
- service-policy service-policy-name {IN | OUT }
- cache-memory-max cache-config-percentage
- service-policy-query service-list-name query-period
- designated-gateway enable [ ttl duration]
- service-policy-proximity service-list-name [ limit number-of-services]
- service-type-enumeration period period-value
- source-interface type number
- rate-limit in maximum-rate-limit
- exit
I think step 5 cache-memory-max and step 11 rate-limit can be helpful in limiting resources used by this feature.
With your current configuration there is likely too much usage of resources.
I don't know if in your version is supported but examples in the above document apply filters to the L3 interfaces either input or output but not globally.
service-policy Permit_Bonjour IN
service-policy Permit_Bonjour OUT
and the fact that you have match any statements in Permit_Bonjour service list can cause excessive load on the switch.
Hope to help
Giuseppe
