Hi Everyone, Recently one of my colleagues added a vlan on the physical links on WS-CBS301 (catalyst switch used in blades) and forgot to add it in the port-channel. The result was that all downstream ports turned into error disabled due to misconfiguration. (we have also enabled link state tracking on the upstream interface). Since this is a production system, I cannot do any tests, but I would like your opinion if anyone has experienced like this before. And what is the right way? add a vlan first to physical links and then to port channel or vice versa? thanks, george ... View more

Hi all, I have the following problem. I have a router that sees a remote network through two paths that have equal cost. However one path is under unitlized and the other is over half used. Is there there anything else I can do to better utilize the two lines apart from changing routing to per packet instead of per flow? thanks, george ... View more

Hi People, I have on the inside an ACE that looks like this: permit A.A.A.A any eq http On the outside permit ip any any log if I do right click show log and get to the real time log viewer I see hits for traffic Internet IP port 80 to A.A.A.A (random port) Since there is dynamic nat for A.A.A.A the only logical explanation is that this is return traffic. My question is why do I have hits on the outside ACE? ... View more

Hi all, I did a "ft switchover all" on the primary unit in order to reboot it afterwards, and I get the above message. Group ID 2 does not switch over. All contexts in the primary are active and in the secondary standby_hot before I attempt the switchover -------------------------------------------------------------------- ACE4710Primary/Admin# sh ft group brief FT Group ID: 1  My State:FSM_FT_STATE_ACTIVE    Peer State:FSM_FT_STATE_STANDBY_ HOT                 Context Name: Admin     Context Id: 0   Running Cfg Sync Status: Successful FT Group ID: 2  My State:FSM_FT_STATE_ACTIVE    Peer State:FSM_FT_STATE_STANDBY_ HOT                 Context Name: VC_XXX       Context Id: 1   Running Cfg Sync Status: Successful FT Group ID: 3  My State:FSM_FT_STATE_ACTIVE    Peer State:FSM_FT_STATE_STANDBY_ HOT                 Context Name: VC_YYY      Context Id: 2   Running Cfg Sync Status: Successful FT Group ID: 4  My State:FSM_FT_STATE_ACTIVE    Peer State:FSM_FT_STATE_STANDBY_ HOT                 Context Name: VC_ZZZZ       Context Id: 3   Running Cfg Sync Status: Successful ---------------------------------------- after the switchover Group id 2 remains active on the primary unit Any ideas why a group does not switch? ... View more

Hi all, When I do show running-config on the primary ACE unit, it either takes several minutes, or forever. Generating configuration.... (and stays there) Show startup returns immediately. show running-config on the secondary unit (hot standby) returns immediately Any ideas? thanks, george ... View more

Hello, We have about 200 spokes (2811 routers), each one connected to two hubs(7206VXR with NPE-G2) via a separate DMVPN. DMVPN is over MPLS cloud provided by the local operator. On the hubs we get very frequently these type of messages .Feb  9 16:00:10.402: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 200: Neighbor 10.X.X.X ( Tunnel3) is down: Interface Goodbye received .Feb  9 16:00:11.658: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 200: Neighbor 10.X.X.X ( Tunnel3) is up: new adjacency On the spoke Feb  9 13:36:48: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 200: Neighbor 10.X.X.X (Tunnel0) is down: holding time expired Feb  9 13:36:51: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 200: Neighbor 10.X.X.X (Tunnel0) is up: new adjacency I think the default eigrp hello and holding timers (5,15) are not suitable since these are wan links. Are there any recommended values? thanks George ... View more

Hi people, I have a leased line and a crypto map that encrypts all tcp and udp traffic However on the remote router I get the following error .Jan 11 12:49:42.628: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC p acket. (ip) vrf/dest_addr= /B.B.B.B, src_addr= A.A.A.A, prot= 17 where B.B.B.B is the netflow server on remote LAN and A.A.A.A is the LAN (fast0/0) of the 2811 router which is one of the crypto end points my crypto access-list on both routers is         Extended IP access list acl_ipsec             access-list acl_ipsec deny eigrp any any             access-list acl_ipsec deny icmp any any             access-list acl_ipsec permit tcp any any             access-list acl_ipsec permit udp any any Any ideas why netflow packets do not get encrypted? ... View more