Lets say there are two cores, 1 and 2, both with a port channel to two different switches, po10 and po20. There's a vrrp interface vlan on both c1 and 2. Shouldn't the switches on po10 and 20 be able to ping every ip on the interface vlan that is setup as a master / backup vrrp? Second part of this, There's an acl on the egress of each. With the ACLs on the interface vlan, the switches on po10 and 20 can ping the vrrp gateway, po11 cannot ping the interface ip on the master side, or the interface ip on the backup. whereas po20 switch can ping the vrrp gateway and the interface ip on the master side. IF i remove both ACLs, they can ping everything, all interface ips on both sides and the vrrp gateway. So i know the ACL on the egress is blocking it because it's hitting the deny ip any any statement for allowed hosts, i'm trying to figure out why it's acting this way and how to trace how the traffic actually flows between the switches to the nexus boxes. The second part of that question is, why can one switch ping the vrrp interface ip, but the other can't. Is this a bug i'm not aware of? I would assume if it was truly the ACL blocking, it would be blocking everything and not just a random ip. Anyone else seen anything odd like this? EDIT:, As far as the routing goes, i'm 100% sure the ACL is blocking things so i guess i'm wondering if anyone has any good links that explains how i can trace the traffic. EG would there be traffic that hits the backup vrrp that gets routed to the primary from an endpoint? I assumed both would do the routing but the way it feels to me is it could be going in the backup and out the master somehow. Been a long say so sorry if this seems rambling.
