Hi, I am having some issues after a core migration with multicast.  The core that we migrated to supports a maximum of 8k multicast routes and we are currently exceeding that amount due to traffic from UPNP (239.255.255.250) coming from our wireless clients.  There is an SVI on the 9k for these wireless clients and I have tried appling different types of ACL's to this wireless vlan, but I still see these clients from this vlan show up after applying the acl and clearing the multicast routes. Is there a way that I can create a route map to deny this multicast route from showing up in the routing table? ... View more

When I arrived onsite the behavior we saw was user connectivity issues that was spread across multiple switches. I asked staff about the last known changes and they mentioned a vendor has likely pulled power to the UPS and caused an entire switch outage.    I initially thought there was some unsaved config that was lost and started to compare the config of working ports vs non-working ports. Nothing was really seen here that was out of the ordinary.      We found instances where a user would not get connectivity on port 18 of a given switch but could be moved to port 19 of a switch and work fine with the same config on both ports.  During this time it was noticed the Spanning tree root on some vlans was on the .2 switch and the other half of the vlans was on .1.  All of STP roots should be in the same location as the L3 vlan gateways. We corrected this but we did not see a change in behavior.   From here, I wanted to confirm that the user PC settings or hardware was not having issues, so I isolated the user to a “dumb hub” and gave that user a static IP address to rule the user hardware out.  This test was successful and we rules out the user hardware.    I plugged the user back into the switch and created a local L3 vlan on the switch that the user was connected to.  This new L3 vlan was reachable from other points in the network but you could not ping the user from this local vlan on the same switch (ping attempted from switch with source cmd).     After this, we provisioned a spare switch that the customer had onsite and started to migrate the non-working users to this switch.  Every user that was moved to the new switch connected immediately and their network issues ceased at this point.  ISE was initially thought to be a culprit but at this point I do not believe this to be the case.  From here, I will add the ISE config to the unused ports on the Temp switch that was added Friday and have IT staff test those ports with the ISE config.  I suspect this will work fine and we may be looking at a hardware failure but I would like to confirm that users on the Temp switch continue to have a good experience after ISE config is added as the current state of port config on the temp switch lacks ISE configuration.    Has anyone ever seen a switch fail and act like this?  I have a reluctance to say it is a switch failure because this behavior was seen on 3 different switches. However, I keep leaning back on that given that every user that was moved to the new switch worked fine.  ... View more

Hi, I am working on trying to remove some unneeded complexity for our current network setup and looking for some advice/prior examples and experiences to help persuade some others to avoid this topology.  We currently have a core ring of 6 routers, but only 2 of them have an internet exit.  My thought is that the routers without internet exit points should really just be designated as a distribution type switch as these really just aggregate traffic from multiple sites downstream.   I feel that the non-internet connected core devices really just add unnecessary extra hops to arrive to their destination given that there is not really a hierarchical traffic flow model once it hits the core.  Can anyone share their experiences with a Core Ring running EIGRP that caused them to move away from this design. I am using Cisco's SAFE documentation (link below) to back up my reasoning in moving toward a new core design, but having a few "real world" stories to add on top would really help sell the solution.  http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/SAFE_RG/SAFE_rg/chap3.html ... View more

Hi All, I ran into an issue with PBR feature parity while migrating functionality from a 6500 to a Nexus 9396PX running ver. 7.0(3)I2(2b).  In the PBR route-map on the 6500, It was using the "set ip default next-hop" command to override the default route and redirect my interesting traffic to its appropriate next hop. The 9396 seems to only support the "set ip next-hop" which from my understanding means that it does not care if there is already a longest prefix match in the routing table, it simply overwrites the next hop no matter what.  This causes east west traffic to break on my network since it sends that traffic up to my firewall and then back into the network resulting in asymmetric routing that the 9k drops. Is there an alternate solution besides PBR that would be better to send my interesting traffic to the preferred gateway? I have been reading about ITD but I am unsure if it would offer the solution I am trying to obtain. ... View more

So because of the way active directory handles Group Policy I have been tasked with finding out why this is failing over the WAN.  Basically I know why, but don't know how to correct it.  I am trying to increase the MTU over an ipsec tunnel to 2048 to allow Microsoft Slowlink detection to occur.  http://support.microsoft.com/kb/227260 .  Basically, it sends 2 icmp packets.  One at a normal size and one at a size of 2048. In my case this is trying to occur over an ipsec tunnel and failing due to the MTU being at 1440.  I have seen a few articles about increasing it to 1500, but is there a way to increase the MTU to allow the 2048 sized icmp packets? ... View more

Hi, Yesterday I tried to install c2960-lanbasek9.mz.12.55.SE4.bin onto my router.  When I changed the boot commands, I did not leave the 2nd option in there and the old firmware has an .ex3 extension.  After trying to boot to this new image, we receive a looping error message that continues to reboot and go through the same process. Basically the error is  "ERROR: firmware not supported by hardware" I have power cycled it a few times but durning bootup, I never see the ################################## which would allow me to BREAK sequence and get into rommon.  The device simply waits about 30-40 seconds after boot and goes right back to the looping reboot sequence and the error message.  Is there any hyper term or putty settings to change on this? ... View more

Hi I am a little unfamiliar with troubleshooting proxy arp type issues but I suspect I may be running into one and wanted to see if the community could help with some validation. We have a switch in our network that is sitting behind an ASA 5510 firewall running 8.2.  We monitor the switch via its loopback address and we continue to have intermittent problems with unreachability to this device.  Upon the last incident, we found that the ASA's arp table is being updated with a foreign mac address for the switch that is connected. We can still ping another vlan interface on the switch, just not the lo0 which was overwritten with the weird mac address (0007.eb3d.5ec0  cisco from what I can tell).  Once we ping the vlan interface on the switch, the loopback goes back to being reachable and the arp table is updated with the correct address. It appears tht the issue returns after power outages but not 100% certain on that front yet.  Any ideas on how to track down this mystical issue or help remedy it?  I thought one way would be to just add a static arp entry in the firewall for the correct addresses, but would like to address the source of the issue if at all possible. ... View more