Hi everyone,   I have a Nexus 6000 platform and trying to get an idea of why with HSRP configured with Global Unicast (in my case it is rather Local Unicast within fd00::/8 range ) gets assigned to the group Virtual IP as secondary and Link-Local auto generated one is being assigned as primary? Is this an expected behavior or there is some configuration I am missing? Thanks! interface Vlan2601    no shutdown   no ip redirects   ip address 10.160.63.251/19   ipv6 address fd01:0:101:2601:0:1:63:251/64   ipv6 nd managed-config-flag   ipv6 nd other-config-flag   ipv6 nd prefix default no-advertise   hsrp version 2   hsrp 2601     priority 255     ip 10.160.63.253   hsrp 2601 ipv6     priority 255     ip fd01:0:101:2601:0:1:63:253   ip dhcp relay address 10.162.204.1   ipv6 dhcp relay address fd01:0:101:2626:0:1:204:1    Vlan2601 - Group 2601 (HSRP-V2) (IPv6)   Local state is Active, priority 255 (Cfged 255)   Forwarding threshold(for vPC), lower: 1 upper: 255   Hellotime 3 sec, holdtime 10 sec   Next hello sent in 1.683000 sec(s)   Virtual IP address is fe80::5:73ff:fea0:a29 (Implicit)   Active router is local   Standby router is fe80::22a:6aff:fe87:74fc , priority 254 expires in 4.170000 sec(s)   Authentication text "cisco"   Virtual mac address is 0005.73a0.0a29 (Default MAC)   2 state changes, last state change 4d22h   IP redundancy name is hsrp-Vlan2601-2601-V6 (default)   Secondary VIP(s):                   fd01:0:101:2601::1:63:253 ... View more

Hi, I am trying to PoC MPLS multi path load sharing by using per-PE-per-VRF RDs in the network. I have a simple lab setup with AS65000 which consists of SITE1 PE1&PE2 routers (10.250.0.101 and 10.250.0.102), route reflector RR in the middle (10.250.0.55) and SITE2 PE1&PE2 routers (10.250.0.201 and 10.250.0.202). PE routers only do iBGP peering with centralized route reflector and passing route to 10.1.1.0/24 prefix (learned from single CE router) with 100:1 and 100:2 RDs for specific VRF. Route reflector gets routes with multiple RDs, makes copies of these routes in order to make local comparison to RD 55:55 configured, uses these routes and install multiple paths into its routing table (all PE routers and RR have "maximum-paths eibgp 4" configured): RR#sh ip bgp vpnv4 all BGP table version is 7, local router ID is 10.250.0.55 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete    Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 55:55 (default for vrf VRF-A) VRF Router ID 10.250.0.55 * i10.1.1.0/24      10.250.0.102             0    100      0 65001 i *>i                 10.250.0.101             0    100      0 65001 i Route Distinguisher: 100:1 *>i10.1.1.0/24      10.250.0.101             0    100      0 65001 i Route Distinguisher: 100:2 *>i10.1.1.0/24      10.250.0.102             0    100      0 65001 i RR#sh ip route vrf VRF-A <output omitted>      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks B       10.1.1.0/24 [200/0] via 10.250.0.102, 00:45:52                           [200/0] via 10.250.0.101, 00:46:22 BUT, for some reason RR doest reflects routes with multiple RDs down to SITE2 PE1&PE2 - its own clients: RR#sh ip bgp vpnv4 all neighbors 10.250.0.201 advertised-routes Total number of prefixes 0 RR#sh ip bgp vpnv4 all neighbors 10.250.0.202 advertised-routes Total number of prefixes 0 Here comes RR BGP configuration: router bgp 65000 no synchronization bgp router-id 10.250.0.55 bgp cluster-id 1.1.1.1 bgp log-neighbor-changes neighbor 10.250.0.101 remote-as 65000 neighbor 10.250.0.101 update-source Loopback0 neighbor 10.250.0.101 route-reflector-client neighbor 10.250.0.101 soft-reconfiguration inbound neighbor 10.250.0.102 remote-as 65000 neighbor 10.250.0.102 update-source Loopback0 neighbor 10.250.0.102 route-reflector-client neighbor 10.250.0.102 soft-reconfiguration inbound neighbor 10.250.0.201 remote-as 65000 neighbor 10.250.0.201 update-source Loopback0 neighbor 10.250.0.201 route-reflector-client neighbor 10.250.0.201 soft-reconfiguration inbound neighbor 10.250.0.202 remote-as 65000 neighbor 10.250.0.202 update-source Loopback0 neighbor 10.250.0.202 route-reflector-client neighbor 10.250.0.202 soft-reconfiguration inbound no auto-summary ! address-family vpnv4   neighbor 10.250.0.101 activate   neighbor 10.250.0.101 send-community both   neighbor 10.250.0.102 activate   neighbor 10.250.0.102 send-community both   neighbor 10.250.0.201 activate   neighbor 10.250.0.201 send-community both   neighbor 10.250.0.202 activate   neighbor 10.250.0.202 send-community both exit-address-family ! address-family ipv4 vrf VRF-A   maximum-paths eibgp 4   no synchronization   bgp router-id 10.250.0.55   network 10.255.1.1 mask 255.255.255.255 exit-address-family ! SITE1 PE1 configuration: router bgp 65000 no synchronization bgp router-id 10.250.0.101 bgp log-neighbor-changes neighbor 10.250.0.55 remote-as 65000 neighbor 10.250.0.55 update-source Loopback0 neighbor 10.250.0.55 soft-reconfiguration inbound no auto-summary ! address-family vpnv4   neighbor 10.250.0.55 activate   neighbor 10.250.0.55 send-community both exit-address-family ! address-family ipv4 vrf VRF-A   neighbor 10.1.101.2 remote-as 65001   neighbor 10.1.101.2 activate   neighbor 10.1.101.2 soft-reconfiguration inbound   maximum-paths eibgp 4   no synchronization   bgp router-id 10.250.0.101 exit-address-family ! SITE1 PE2 configuration is similar to SITE1 PE1. They both do eBGP peering with dualhomed CE router in AS65001 which announces 10.1.1.0/24 prefix into VRF-A table. My question is: clearly, the issue is that RR doesn't reflect any routes to its clients (SITE2 PE1&PE2) for 10.1.1.0/24 prefix with 100:1 and 100:2 RDs that dont match it's locally configured RD 55:55 for VRF-A, although they are present in its BGP/RIB tables and used for multipathing. Is this an expected behavior or some feature limitation for specific platform or IOS version? Currently, in this test lab setup I run IOS 12.4(24)T8 on all the devices. Please, let me know if any further details are needed to get an idea of why this well known and widely used feature is not working correctly in my case. Thanks a lot! Regards, Sergey ... View more

Hi everyone, I have an issue with PPTP tunnels behind a 7201 router which does NAT Overloading for inside LAN hosts via VRF. Users in LAN are unable to establish outgoing PPTP connections to some outside Internet servers. I had this network up and running with older Cisco3745 with c3745-adventerprisek9-mz.124-12.bin And  I didn't have such issues. No specific NAT configuration were exist,  just a ACL with NAT overload statement for outside interface. Now I have Cisco 7201 router with c7200p-advipservicesk9-mz.124-24.T3.bin IOS image. Currently NAT is running inside VRF instance. I found a bug case: • CSCec30921 Symptoms: Point-to-Point Tunneling Protocol (PPTP) Network Address Translation (NAT) may fail. Conditions: This symptom is observed on a Cisco router that has the VRF  aware NAT feature enabled when the inside interface is part of a Virtual  Private Network (VPN) routing and forwarding (VRF) instance and the  outside interface is a global interface. Workaround: Disable Cisco Express Forwarding (CEF). However, this may  not be a viable workaround because the Multiprotocol Label Switching  (MPLS) VPN requires CEF to be enabled. But I think it doesn't apply to my case as I have both "inside" and "outside" interfaces belong to VRF, not just "inside" as it is described above. I've been wondering if PPTP Passthrough feature is supported in this IOS version\platform\design. If  yes, I would like to know how to enable it, cause on 3745 I did't make  any specific tuning to NAT overloading to have PPTP work. I have to keep the VRF aware NAT design in my situation (due to some design limitations). So any suggestions are welcome. Thanks in advance. ... View more