High IP Input CPU process .. Need Help

[interwebmedia]

Hello,

Our IP Input cpu processes show command, shows that we are using about 60% of its capacity which is apparently huge.

We had no major changes in our configuration, we followed some steps in the cisco documentation on troubleshooting it, but to no avail.

We have a Cisco WS-3550 48 Port EMI

We have about 400 vlans with their own subnets and some static routes going to different vlans (all that is part of our migration to one subnet per customer). As per our graphs, there are some slight changes in cpu usage at times but fairly stays steady at the amount stated above.

We are not sure where to check now, can you please provide any help?

Thanks

[lamav]

Hi:

If you've troubleshot the situation according to this document and you still haven't been able to pinpoint the problem, you may want to think of a code upgrade.

http://www.cisco.com/en/US/products/hw/routers/ps359/products_tech_note09186a00801c2af3.shtml

I've seen this before a few times on the 3550 and the problem has been a bug in the code. Oftentimes, bugs remain dormant until something triggers them.

You can use the Cisco IOS planner to plan an upgrade.

HTH

Victor

[interwebmedia]

Hello,

1) We have the latest IOS for that machine

2) We did not do ALL the steps as we are not even sure exactly what to look for. The steps mentionned for us since we have over 400 vlans, is very extensive to check every single details.

Anything you may recommend?

[ciscograyaw]

Can you show your config (just the base stuff and one VLAN - we don't need to see all 400 if they're configured the same).

One thing that we just tripped over fairly recently is if you are using RPF with an access list - that has to get handled in software as opposed to hardware. IE:

ip verify unicast source reachable-via rx

is in hardware,

ip verify unicast source reachable-via rx 100

(with 100 being an ACL) is in software.

That is just a very wild stab in the dark, however.

[interwebmedia]

Here is our configuration split in different sections separated by .. .. ..

I am sending a little bit of every section of our config file so you may help. I also replaced with "XXXX" every part I did not want to publish which should not affect the diagnosis anyways.

I have attached the configuration file.

Thanks

[interwebmedia]

Anything on this? Help would be greatly appreciated

Thanks

[interwebmedia]

I replied and provided the config as asked... can you please check and let me know asap?

Really appreciated

Thanks

[interwebmedia]

?? Please ... I need someone to help us on this

Thanks

[Sushil Kumar Katre]

hi,

Check if you have any IP route statement configured pointing to a specific IP address.

ip route 10.10.10.0 25.255.255.0 20.20.20.1

-> Sushil

[interwebmedia]

The only one I have routing to a specific IP is the one that goes out to my provider so:

ip route 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX

That is the only one, telling anything you do not know send to this location which is my provider.

Please let me know. Very appreciated

Thank You

[Sushil Kumar Katre]

Hi,

what I see from the configuration is lots of routes configured in the following fasion -

ip route X.X.X.X X.X.X.X vlan2

change these statements to

ip route X.X.X.X X.X.X.X vlan2 next-hop-ip

Observer the CPU utilization.

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800ef7b2.shtml

-> Sushil

[interwebmedia]

But what is next-hop-ip ?? We want those IP's to go to that vlan specified.. Can you explain what difference it with the next-hop-ip ??

Thanks

[Sushil Kumar Katre]

what's your topology lik. can you upload the network diagram.

[interwebmedia]

Well we are using a cisco ws 3550 48 port emi switch, that connects to about several cisco 2950 switches as uplinks and then connects to the servers from those 2950's.

The GIGE uplinks on the 3550 are connected to the provider.

Hope this helps

Thanks

[interwebmedia]

any help on this?

Thanks