The SOLUTION to this issue is: Reload the 2.1.71 firmware AGAIN! This unit had FW 1.1.65 and 2.1.71.  I believe that the two versions were corrupting the system.  Now that both firmware banks have the same software, the RIP tables are working as expected. I do wish I could test this more, but I'm trying to 'test' equipment in a live network.    If someone still has access to the 1.1.x firmwares and a spare box....feel free to try it. ... View more

Here's the important parts of the config.  I've hacked out a LOT of VoIP settings that should have no bearing on the basic routing. ! ! no ipv6 cef no ip source-route ip cef ! ! ! ! interface Loopback1 ip address 192.168.20.1 255.255.255.255 ! interface GigabitEthernet0/0 no ip address duplex auto speed auto ! interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 172.16.1.245 255.255.255.240 secondary ip address 192.168.21.254 255.255.255.0 ! interface GigabitEthernet0/0.100 encapsulation dot1Q 100 ip address 10.0.21.254 255.255.255.0 ! ! router eigrp 1001 default-metric 10000 100 255 1 1500 network 0.0.0.0 network 10.0.0.0 network 172.16.1.240 0.0.0.15 network 192.168.20.0 network 192.168.21.0 redistribute static passive-interface GigabitEthernet0/0.100 ! router rip version 2 redistribute static route-map NODFGW redistribute eigrp 1001 metric 2 passive-interface GigabitEthernet0/0.20 passive-interface GigabitEthernet0/0.100 passive-interface ISM0/0 network 192.168.21.0 neighbor 192.168.21.10 no auto-summary ! ip forward-protocol nd ! ! ip route 0.0.0.0 0.0.0.0 192.168.21.10 ! logging esm config access-list 13 deny   0.0.0.0 access-list 13 permit any ! ! ! ! route-map NODFGW permit 100 match ip address 13 ! ! control-plane ! Yes, I have the workaround, which I was using from the start.  Since the RIP updates are OneWay, and to only ONE other router...it's the quietest solution.  This bug ony reared up after I found a RIP bug in the firewall, and turned ON the multicast updates to see the RIP updates. WHY me?  I find TWO RIP bugs in TWO different Cisco boxes at the same time? ... View more

Jas, In process of getting this officially reported.  It was just very frustrating last night, and I've spent too much time on this project. Do DO appreciate your help and assistance. ... View more

Well, I took some time this evening to do a factory reset and I was VERY disappointed that all THREE of my backup configs would NOT restore....due to a checksum error!!!!!!!  I did not edit nor open the files. So an hour and a half wasted plugging in data by hand and rebuilding the configuration from scratch. BEWARE!!!!!!!!!!!!!!!!!!!!   Backups are a WASTE of time with the 2.1.71 firmware. I would really like to take a BFH to this box, and get an ASA.  It's a shame to have the name "Cisco" on it.    The RIP bug is still present.  Routes do NOT age, so they stay in the table until a reboot. ... View more

It's a live network, and I don't want routes dropping out and folks getting upset with me. sho ip route ----------------- Gateway of last resort is 192.168.21.10 to network 0.0.0.0 S*    0.0.0.0/0 [1/0] via 192.168.21.10        10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks C        10.0.21.0/24 is directly connected, GigabitEthernet0/0.100 S        10.0.21.253/32 is directly connected, ISM0/0 L        10.0.21.254/32 is directly connected, GigabitEthernet0/0.100 D EX     10.0.22.0/24             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 D EX     10.0.23.0/24             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 D EX     10.0.24.0/24             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20        172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks C        172.16.1.240/28 is directly connected, GigabitEthernet0/0.20 L        172.16.1.245/32 is directly connected, GigabitEthernet0/0.20 D EX     172.16.2.48/28             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 D EX     172.16.2.112/28             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 D EX     172.16.2.192/28             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20        192.168.20.0/32 is subnetted, 4 subnets C        192.168.20.1 is directly connected, Loopback1 D EX     192.168.20.2             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 D EX     192.168.20.3             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 D EX     192.168.20.4             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20        192.168.21.0/24 is variably subnetted, 2 subnets, 2 masks C        192.168.21.0/24 is directly connected, GigabitEthernet0/0.20 L        192.168.21.254/32 is directly connected, GigabitEthernet0/0.20 D EX  192.168.22.0/24             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 D EX  192.168.23.0/24             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 D EX  192.168.24.0/24             [170/2585856] via 192.168.21.1, 2d18h, GigabitEthernet0/0.20 sho ip rip database ---------------------------- 10.0.0.0/8    auto-summary 10.0.21.0/24    directly connected, GigabitEthernet0/0.100 10.0.22.0/24    redistributed      [2] via 192.168.21.1, 10.0.23.0/24    redistributed      [2] via 192.168.21.1, 10.0.24.0/24    redistributed      [2] via 192.168.21.1, 172.16.0.0/16    auto-summary 172.16.1.240/28    directly connected, GigabitEthernet0/0.20 172.16.2.48/28    redistributed      [2] via 192.168.21.1, 172.16.2.112/28    redistributed      [2] via 192.168.21.1, 172.16.2.192/28    redistributed      [2] via 192.168.21.1, 192.168.20.0/24    auto-summary 192.168.20.1/32    redistributed      [2] via 0.0.0.0, 192.168.20.2/32    redistributed      [2] via 192.168.21.1, 192.168.20.3/32    redistributed      [2] via 192.168.21.1, 192.168.20.4/32    redistributed      [2] via 192.168.21.1, 192.168.21.0/24    auto-summary 192.168.21.0/24    directly connected, GigabitEthernet0/0.20 192.168.22.0/24    auto-summary 192.168.22.0/24    redistributed      [2] via 192.168.21.1, 192.168.23.0/24    auto-summary 192.168.23.0/24    redistributed      [2] via 192.168.21.1, 192.168.24.0/24    auto-summary 192.168.24.0/24    redistributed      [2] via 192.168.21.1, ---------------- deb ip rip ----------------- (this series just repeats every 30 sec) Mar  8 12:49:00.644 EST: RIP: sending v2 update to 224.0.0.9 via GigabitEthernet0/0.20 (192.168.21.254) Mar  8 12:49:00.644 EST: RIP: build update entries Mar  8 12:49:00.644 EST:        10.0.21.0/24 via 0.0.0.0, metric 2, tag 0 Mar  8 12:49:00.644 EST:        10.0.21.253/32 via 0.0.0.0, metric 1, tag 0 Mar  8 12:49:00.644 EST:        192.168.20.1/32 via 0.0.0.0, metric 2, tag 0 Mar  8 12:49:00.644 EST: RIP: sending v2 update to 192.168.21.10 via GigabitEthernet0/0.20 (192.168.21.254) Mar  8 12:49:00.644 EST: RIP: build update entries Mar  8 12:49:00.644 EST:        10.0.21.0/24 via 0.0.0.0, metric 2, tag 0 Mar  8 12:49:00.644 EST:        10.0.21.253/32 via 0.0.0.0, metric 1, tag 0 Mar  8 12:49:00.644 EST:        10.0.22.0/24 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        10.0.23.0/24 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        10.0.24.0/24 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        172.16.2.48/28 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        172.16.2.112/28 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        172.16.2.192/28 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        192.168.20.1/32 via 0.0.0.0, metric 2, tag 0 Mar  8 12:49:00.644 EST:        192.168.20.2/32 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        192.168.20.3/32 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        192.168.20.4/32 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        192.168.22.0/24 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        192.168.23.0/24 via 192.168.21.1, metric 2, tag 0 Mar  8 12:49:00.644 EST:        192.168.24.0/24 via 192.168.21.1, metric 2, tag 0 ... View more

There are only two routers running RIP, one because it doesn't do eigrp. Because of that, I would prefer to just run the unicast rip, to the neighbor.  It's a one-way transaction,  the 2901 feeds the other rip router/firewall a list of all of our internal networks. I stumbled over this issue because I'm having RIP problems with the receiving router.  Look around for other posts by me to see what it is.  I turned on the multicast (by removing passive-interface g0/0.20) to see the rip traffic without port mirroring...and here I am. The 2901 interface has two vlans:  20 and 100.  It carries three subnets:  192.168.x.0/24 & 172.16.x.x/28 on vlan 20 and 10.0.x.0/24 on vlan 100 (voip).   The internal network has a number of other similar subnets in the same arrangment.  I'm just trying to funnel all of these subnets into the firewall, so it knows our internal nets exist and can route our Inet traffic properly back  into our internal network. The 2901 also has a static 0.0.0.0 0.0.0.0 route to the firewall, but that will change in the future.  I'm using the route-map to make sure that I don't send that static route back to the firewall. ... View more

Sorry Jas,  I wasn't clear enough. The SA520 WAN port is connected to our broadband provider.  It is a static address.  No bearing on this issue. SA520 LAN Port 1 is connected to SW1 Port1 Cisco 2901 G0/0 is also connected to SW1 Port 2 MPLS Router F0/0 is connected to SW1 Port 3. MPLS feeds EIGRP routes to 2901. 2901 redis the EIGRP routes to the SA520 via RIP. All outbound Inet traffic passes through SA520 NAT'ed. If MPLS link goes down, the routes on the far side of the MPLS fall off the EIGRP.  Then it should fall off of the SA520, too.  They don't. ... View more

Jas, Take a generic 100M switch and plug both into the SWITCH.  My 2901 and SA520 are hanging off the switch. Our MPLS router is also connected to that switch, but it only talks to the 2901....then the 2901 passes that infomration to the SA520.  The SA520 doesn't know or care about the other (MPLS) router. I know, it's not the best arrangement, but what I'm doing with it now was not in the original design. ... View more

Jas, The incoming RIP traffic is from a 2901 voice router, and on my unit, it's still displaying routes with both metrics like so: 10.0.1.0       192.168.0.1    255.255.255.0   UG    2      0        0 bdg1 10.0.1.0       192.168.0.1    255.255.255.0   UG    16     0        0 bdg1 192.168.20.0    192.168.0.1    255.255.255.0   UG    2      0        0 bdg1 192.168.20.0    192.168.0.1    255.255.255.0   UG    16     0        0 bdg1 the code on the 2901 is: router rip version 2 redistribute eigrp 1001 default-metric 1 no auto-summary The 2901 is feeding a number of other subnets to the SA520 via EIGRP redistribution.  The EIGRP sends routes of other internal networks via MPLS.  If our MPLS Links go down, the EIGRP updates stop, and I'm trying to setup VPN tunnels. I tried to change the default-metric to different numbers, and it works, but it keeps adding MORE routes to the SA520's table with different metrics.  If I set the default-metric as 2 I get a table full of routes at metric 3, set at 4, I get another set with metrics of 5.  The SA520 keeps all of the old routes with metrics of 2 and 4.  This table will grow every time I change the metric.  NONE of the entries seem to age out, and I left it overnight with the bad entries there....and they're still there in the morning.  They don't go away. My gut says that something isn't syncing properly, and I need more time to test with, but that means taking our business network off-line, after hours.  To make sure that I'm not doing something wrong, I did setup a mock GNS3 setup with a couple of 2961 routers and configuring the RIP setup very similar.  It works, but it's emulating a REAL Cisco Router, not a SA520. ... View more

To followup on a few posed questions... I need to 'split the subnets' because I must feed the streams into another box that will NOT accept two subnets on the same VLAN.  Each subnet must have a seperate VLAN.  The sad part is that it IS a Cisco box. Eugen, The bridged setup is just the first thing that crossed my mind.  I tried placing the IP addresses on the individual sub-interfaces, but I would get IOS errors doing that.   I had to work with the single IP address/subnets, and adding more would just mess up the rest of the network.  All of my searching on the Net for some other solution would turn up information on routing stuff like LAT or IPX.  On a Cisco, there's always more than one way to do something.  It's just a matter of 'sharing' it with the rest of the community.  This is my quick & dirty solution.  As I learn more, I can refine it!  I hope it helps someone else out. ... View more

I wanted to do this WITHOUT a switch module.  After a few hours of tweaking...here is the relavant part of the config: ! bridge irb ! ! ! interface FastEthernet0/0 no ip address no ip route-cache cef no ip route-cache duplex auto speed auto ! interface FastEthernet0/0.10 encapsulation dot1Q 10 ip unnumbered BVI1 no ip route-cache bridge-group 1 ! interface FastEthernet0/1 no ip address no ip route-cache cef no ip route-cache duplex auto speed auto ! interface FastEthernet0/1.10 encapsulation dot1Q 10 ip unnumbered BVI1 no ip route-cache bridge-group 1 ! interface FastEthernet0/1.20 encapsulation dot1Q 20 ip unnumbered BVI1 no ip route-cache bridge-group 1 ! interface BVI1 ip address 10.0.0.254 255.255.255.0 secondary ip address 192.168.0.254 255.255.255.0 ! ! ! no ip http server no ip http secure-server ! ! ! ! control-plane ! bridge 1 protocol ieee bridge 1 route ip ! ! This 'seems' to work, but I'm open to any sugestions to clean it up, and perhaps, add some filtering!  I've read that this will put a processing strain on the router, too.  It's a real PITA to support legacy networks! -- Larry ... View more

Stuart, I'm using entservicesk9-12.4(13b).  It shows the vlans  on the command 'show vlan-switch,' but It will not allow a Vlan nn  interface.  There is NO ESW module.  The router only has two FE ports.  I thought that you could only define vlan interfaces on systems with a switch module. Sounds like I may be looking for an update? ... View more