I went through the database to see if this is a known bug and found that there are several similar issues but all of them have no root cause because the symptom couldn't be reproduced, but the following workarounds were applicable. 1-      Remove the ACL , reconfigure it and apply it again. 2-      Create another ACL with another number apply it. 3-      Reload (didn't work all the time). Regards, Amit ... View more

Here are some questions that would decide what technology can be used & how simply this can be done. Do you want the vlans to propagate over the internet to the branch office? Do you a secure communitcation over the internet? Do you need to pass multicast over the internet to branch site? MPLS? Have you thought of building a VPN tunnel b/w the edge devices of both sides? This way the traffic going b/w the sites is secure over the internet. You could build a GRE tunnel to the branch site & could run routing protocols over GRE so that the two sites can exchange routes. Regards, Amit ... View more

The above two processes normally show this much utilization, so this looks normal. I will also see if the output drops increase when flapping happens again. ... View more

438 input errors, 78 CRC, 0 frame, 11518 overrun, 0 ignored Let's watch out for this counter, I would like to make sure that this counter isn't incrementing. Also, do you see any drops in the input queue on this interface? I see high CPU util as well, that could very well be a cause on why adjacencies would flap or it may be happening due to the flap itself. So, CPU could be the culprit or victim. To find out what it is, I would like to see what processes in the o/p of "show proc cpu sorted" are eating up maximum resources, if its "ip input" then CPU is the victim. Regards, Amit ... View more

I believe that the two devices that can't talk are in vlan 1. Where are the devices connected (are they directly connected on the router HWIC or are they connected on a downstream switch)? What are the IP addresses of both machines? Let's create an ACL for debugging & see what's happening. I have assumed 192.168.1.x & .y as the client machines. ip access-list ex 191 permit ip host 192.168.1.x host 192.168.1.y permit ip host 192.168.1.y host 192.168.1.x enable debugging debug ip packet 191 ping from 192.168.1.x to 192.168.1.y Plz share the debug results. Regards, Amit ... View more

Please share "show int gi8/48" ... View more

Please share the "sho run" from the router. ... View more

Hi, Could you please share the following o/p from this router? show run sho int gi8/48 show  proc cpu hist show ip eigrp traffic Since PIM is also flapping, I would assume that there is multicast packets being dropped. To isolate it & rule out if multicast is the what's being dropped, can you try "neighbor" command in EIGRP with one of its neighbor & see if it works well with unicast? I would also look for drops on gi8/48... Regards, Amit ... View more

You also might want to refer above link: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080093f31.shtml ... View more

Yogesh, you need port redirection in this case. In the following sample config, 192.168.10.1 is server 0 & 192.168.10.2 is server 1. ip nat inside source static udp 192.168.10.1 4569 x.x.x.x 4669 ip nat inside source static udp 192.168.10.2 4569 x.x.x.x 4769 Regards, Amit ... View more

Dmitry, Yes, I have seen it in production. I believe that HWIC & NM-16ESW still work with ISR G2 series (not with all models though). Take a look at the modules supported on ISR G2 on the following link: http://www.cisco.com/en/US/products/ps10536/products_relevant_interfaces_and_modules.html#notes Regards, Amit ... View more

Some Design options: ->Assunimg ASA1 is your new ASA 1) The best possible manner in which they can setup is the failover scenario, so that if one of the ASA goes down beacuse of any reason, the new ASA takes over & routes/NAT etc. Both the ASA will be in the same vlan on Gig Switch. Here are some of key points that you need to be aware of for failover: 1.1 You would need another IP address (outside address -public) for the new ASA. Will your ISP provide two IP from the modem? I guess not. Have you been provided with a pool of public IP? If not, this would not work. 1.2 Hardware of both ASA should be exactly identical. For more details, take a look at the following link for failover: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml 2) Do the devices behind new ASA need internet access? If they don't & the idea is just to deploy the new ASA & create a altogether diff network, then you can configure a vlan on the Gig Switch, & connect you new ASA to the port in the new vlan on the switch. But that brings me to the question on what does it achieve? 3) If you want the devices behind new ASA to access the internet, there is one way. Connect the two ASA together, may be DMZ & route the traffic to internet from new ASA to old ASA. Regards, Amit ... View more

Sandip, Yes, you could go for HWIC-1FE or HWIC-2FE. What really matters is what you are trying to do & how much it cost you to achieve the same. HWIC-4ESW is the 4-port single-wide 10/100BaseT Ethernet switch HWIC. The 4ESW is a L2 switch and is cost effective. HWIC-4ESW has the capability to setup VLAN as well as SVI which is logically L3 but they are not the routed ports. This module has limited QOS support. HWIC-1FE is 1-port Fast Ethernet HWIC. The HWIC-1FE is a true L3 interface and is expensive.  It has feature parity with an onboard FE interface except for OAM support, which is delayed. Whereas, HWIC-1FE has the same characteristics as Onboard FE ports. Regards, Amit ... View more

Dipesh, Even if the LAN lite doesn't support Auto QOS, we could configure it manually & yes, we can use the default COS-DSCP mapppings. What you need to make sure is that this DSCP value doesn't get reset anywhere in the path till it reaches the point where action (policing/shaping) is to be taken. QOS is end to end. So, yes, you would need to either trust the QOS setting on the uplinks or what you could do is following: Trust the DSCP/COS on Access. Match the DSCP/COS on the distribution, core ....remark the traffic to the same value when it leaves the distribution/core. Regards, Amit ... View more