I think 1 picture explains it way better/easier than a 1000 words could :) what I am after to see from vendors in future:   Please let me know if this already exists and I will back off :)                                               In some cases I have had the occasion that the "firewall  product" had an issue with its NAT or Firewall / filtering binary and halted those processes, as the routing process usually is a different, its unaware that the Firewall appliance or one of those two services is actually dropping traffic and is still attracting BGP routes for example. Hence the firewalls failed NAT/Filtering services has cause traffic "blackholes" as such..   Hence I am looking for a feature / design to account for this issue. Potentially raising this idea to Cisco developers if this is a reasonable thing to do.   Thanks Colin - www.flashcardguy.ch       ... View more

Hi guys, thanks for your replies. I am aware of BFD and I am using BFD where required, mainly on routed links between devices, and if required I use IPv4 BFD multihop. However I am trying to solve the following below, where as I am trying to have BGP end to end through my perimiter firewalls. This to ensure that the Border routers do not cause a black hole outbound, while ensuring the core only uses the path towards the Border router which is still available end to end.  I would like to have the "control plane" end to end rather than relying on static routes / IP SLA constructs, as the peer may respond to ICMPs but its routing engine is down and or its neigbor is down. Another thing I would like to cover is that I can ensure the firewall is only routing traffic while its ACL firewall engine and NAT address translation service is still operational. This is probably the biggest problem currently as I am not aware of any firewall vendor, which injects its ACL engine / NAT engines operational status somehow into the routing process. Meaning the firewall may still route traffic while its no longer firewalling, hence I could still attract and drop traffic. If someone has a solution to that, please share! However coming back to    BGP advertise-map /  exist-map / non-exist-maps. It seems hard coded within IOS, and unless some TAC guy shares some Ninja command, this will not change from a 60 second delay, no matter if you configure BGP advertisement-interval 0 or not. It did not work for me, as I had DEBUG IP BGP UPDATES running, and could see the update being advertise up to the border routers, but the border routes would wait until the CONDITION would be met, after approx 60 seconds, then widthdraw the /24 outbound to ISP A/B. However that is not fast enough for most customers today, with more and more services going to the cloud. ---> Below solution will not converge faster than 60 seconds !! (Please prove me wrong) ---------------------------- Which brings me to this, once again end to end BGP through firewalls. However in this instance the CORE devices inside generate the outside /24 prefix via "x.x.x.x/24 Null 0" routes. Those /24's are then picked up by the BGP and advertised outbound to the ISPs, ensuring there is not black hole in front or at the back of the firewalls. Also the received default routes are being learned from the ISPs and pushed down to the cores, end to end. This is probably my new solution, however this still needs to be labbed up and tested. -------------------------------------------------- A few guys may have noticed the MPLS component, and go, WHY the heck? Basically we operate two independant firewalls and one decided to partially die, now the idea is to not bind any services to the physical interfaces of the firewalls. Meaning we inject /32's into the MPLS "transit vrf". This results that we can utilize both border routers for failover having two independant Firewalls. And if a Firewall fails we can easily shutdown the injected loopbacks on the partially failing Firewall, and enable the same configured /32 on the opposite still working firewall, while the default route and advertisements for the /24s outbound still operate. We use MPLS/L3 VPNs to conserve public IP address space in regards to transit networks required between DC's, as we can span multiple DCs without loosing valuable IP addressing. Thats some of the background info in order to understand my end to end designs. Thanks for your replies, comments, and feedbacks! THX  Colin ... View more

Hi Ravi, i have a similar situation i would like to solve: router bgp XXXX timers bgp 1 3 bgp scan-time 5 neighbor X.X.X.1 advertise-map RMP-ISP-2-OUT exist-map RMP-EXIST-MAP-CORE-LOOPBACKS However the BGP scan timer lowered to 5 seconds does not seem to impact the conditional advertisment (CA) timer. Is there an undocumented Ninja-style TAC command which could help override standard IOS CA related timers? Thanks Colin ... View more

Hi  Sigurbjartur, Thanks for your answer.  It worked as expected. Quick question, what do you recommend when using BFD timers of lets say 300ms multiplier 3. I thought of using the following, adding dampening and carrier-delay 0 into the mix, in order to avoid flapping behavior. interface GigabitEthernet1/X dampening ip address 10.X.X.X 255.255.255.252 carrier-delay 0 bfd interval 300 min_rx 300 multiplier 3 THX Colin ... View more

Background of why i'm after this is to utilize VRF lite like configuration, while being able to have BFD on run on the sub-interfaces. BFD has been implemented a bit crunchy on Cat65's by the looks, not sure if BFD IPv4 multi-hop would work on Cat65, but I try to avoid that if I can. Probably helps understanding why i am asking it. Thanks Colin ... View more

Hi Warren,   I also noticed some weird outputs also on 4500X 03.05.02.E in regards to "show redundancy" or "show switch virtual" outputs, the formatting seems to be a little off.   On the 4500X platform I also had another weird issue that 10GE SFPs once plugged, unplugged they keep disapearing, for x amount of time, this sometimes can be 1-3 hours, in some other cases it even can take up to 12 hours until they magically re-appear, therefore plan your maintenance carefully when it comes to removing, and relocating 10GE SFPs.  1G SFPs did not seem to be affected. The 4500X's seem a bit of a problem platform to me, after having had 5 BugIDs raised within the last 8 month!     ... View more

Hi Jon, ok, sorry I did not give you all the background / details, so let me quickly brief you on what I intend to do and then where my question fits it again.   As is:   Step 1: Replacing the FWSM part, while keeping the ACE-30 still performing the load balancing. (Converting a couple lines of ACLs into F5 AFM language is "relatively" easy, will require F5's professional services, conversion tool, a couple of days work and should be done... sounds easy.. I will tell you later on how that went once done :) But that's what I consider the easier part.       Step 2: This is the part where we remove the ACE-30's.   Here I basically have de-associated the Server facing Vlan from the ACE-30 and pulled it back onto the Catalyst 6500 chassis, while extending it out of the Cat 6500 towards server switches as the rServer usually live on VM's or where ever.   The origninal question I had is, actually on Step 1, where I have the AFM part done, and I am bridging the shared vlan between the ACE-30 and then instead of pointing to the front to the FWSM, I intend to bridge it out of the chassis towards the F5 as shown below in this diagram:   Step 1  Detail:     Step 1 - view when completed:       STEP 2.1 Detail (replacing the ACE-30's on a per vlan case):   Disabling the ACE-30 on a per Vlan Basis, basically picking which Vlans we will do the ACE/LTM changes one at a time: Details steps: Step 2.1 :  De-Associate Vlan B from ACE-30 / Catalyst 6500 binding.       Step 2.2 : De-commission Vlan A, the Shared AFM / ACE or Client facing Vlan ID is no longer required. (Bascially we are pulling the Server facing towards the AFM part, as many trunks facing the server would have to be edited and its less of a pain to change the client or shared Vlan ID.)     Step 2.3:  View once migrated:     Finally "ta daaaaaa":     I am not too worried about the server facing Vlan ID's as I know it works already today. What I wanted to clarify is, If I could bridge out the shared / client facing Vlan ID out of the chassis, without getting into trouble. I believe you answered that part, and this should work: ---------------------------------------------------------------------------------------------------------------------------------------- Quoting your previous answer: To extend the front facing vlan out to the F5s is simply a matter of configuring the ports the F5 connects to on the 6500 to be in that vlan. That's the simple part. ------------------------------------------------------------------------------------------------------------------------------------------ So therefore I know someone did this already somewhere, which gives me a little more confidence that this actually could work and I can follow up on it. Please correct me if I am miss interpreting your answer.   PS: I am going though all this trouble as all "legacy" application/servers have hard-coded IP addressing within the applications/databases etc.. Changing IP addressing of VIP or rServers or pretty much anything is NOT an option... :)   Thanks Colin     ... View more

Search the bug tool for Login Block and 4500 platforms.. and you will find my case notes :)   We hit a bug... by configuring the following line 2x in a row:   login block-for 300 attempts 3 within 60   this replaces basically a "reload" command, if your running dual SUPs  :)     ... View more

hi asadhasan,   could fix your Catalyst 4500X-SFP16+ dhcp relay problem?   I faced something similar I believe, running 3.5.3 code:   Int vlan X ip dhcp-helper XXXXX   int vlan Z ip dhcp-helper ZZZZZ   now Voice phones on Vlan Z could not receive DHCP IPs where Vlan X and could therefore not register, clients in the data vlan could receive dhcp addresses. After Approx 1 hour 3 o clock in the morning I had to revert back, having the Cat 6500 performing the SVI termination again, rolling back on the Cat4500X as a pure L2 switch again..   can you remember what your issues where, if fixed? please share.   Thanks Colin ... View more

Another update,   It seems not only the 4500X platform is affected, its also 4510R+E's:   WS-C4510R+E WS-X45-SUP8-E IOS-XE (cat4500es8-UNIVERSALK9-M), Version 03.03.01.XO     4510R+E#sh redundancy /| i    | i state         Current Software state = ACTIVE        Uptime in current state = 2 hours, 39 minutes         Current Software state = STANDBY HOT        Uptime in current state = 6 minutes   4510R+E(config)#login block-for 300 attempts 3 within 60 Exception to IOS Thread: Frame pointer 8D104E28, PC = C9C0FF4 IOSD-EXT-SIGNAL: Aborted(6), Process = Exec -Traceback= 1#9492282023e5ef761bd83af205155966  c:C98A000+36FF4 c:C98A000+3C2B0 c:C98A000+3C3A8 :10000000+201B994 :10000000+31CA4E4 :10000000+2C1DC54 :10000000+2C246E0 :10000000+116A3F0 :10000000+2C37508 Fastpath Thread backtrace: -Traceback= 1#9492282023e5ef761bd83af205155966  c:C98A000+E29C0 c:C98A000+E29A0 iosd_unix:CD74000+1877C pthread:B3FE000+647C Auxiliary Thread backtrace: -Traceback= 1#9492282023e5ef761bd83af205155966  pthread:B3FE000+BBB4 pthread:B3FE000+BB94 c:C98A000+FA4E8 iosd_unix:CD74000+21270 pthread:B3FE000+647C Buffered messages: (last 8192 bytes only)     at least one now can directly "redundancy failover" from config mode.....      :)       ... View more