Can you tell us the direction you chose ?     Not sure how a 4500X was going to be involved with ISE in a end user facing role .. it seems not to be an appropriate desktop switch. ... View more

1) setup packet capture with rotating capture files and stop capture during an event and analyze ?      with Wireshark you can filter on "SYN"s to see connection attempts 2) does your firewall connect to any routers that can do "top talkers" ?, turn if on, you may have a small number of devices getting busy. 3) using Ciscocmd check on the xlates on a regular basis and see what is increasing - may have to use Excel and/or some command line sorting   these should help you see what is going on. ... View more

would you please provide a NXOS configuration for WCCP ?   ... View more

I use ciscocmd to get the "show int" output into FILE and then run  egrep -A 20 "is down," FILE | egrep "is down|Last input"  |  egrep -B 1 never | grep -v never | awk '{print "int " $1 "\v shut" }' > FILE.cmd   this products a file of    int GigabitEthernet1/1                        shut int GigabitEthernet1/2                        shut int GigabitEthernet1/7                        shut int GigabitEthernet1/12                         shut   and I can then push it back   ... View more

Or that the Ironports understood LACP ? or spanning tree. Single homed boxes are not really 201x level technology. ... View more

Did you ever find this out Erik ? ... View more

EA,   ITD -might- be a great solution, but the documentation is abysmal which renders it unusable. ... View more

I have around 500 VMs in UCS.  My east/west ( routed ) traffic is minimal.  My primary environment is Citrix centric. All systems of a common role are placed on the same vlan so its just L2.   We engineered sets of 4 x 10G connections because the 3 sets of FIs we have originally sat 10m from the core routers.  Way, way overkill in terms of bandwidth requirements but a 10G SR optic is close enough to a 1G so .. might as well. At 7am the 2 10G links from FI_A transmit and receive are 31Mbps each, the 4 link 32G san port channel is 460 Mbps.  30 minutes later this has dropped to 54Mb and 384 Mb. The 2 10G links from FI_B are under 30 Mbps total and the 4 link 32G FC port channel is 510 Mbps.  I could have run these off of 2148s connected to 5548s with L3 daughter cards and not bought Nexus 7KS or VSSs. ... View more

Keep an eye on your traffic levels.  I don't know if you don't have the fiber or the dollars - but you may find that the volume of your traffic is not 10G or close. ... View more

You did do a good job,  I am guessing that there are some route statements you did not include.   When you put the vlans on the ASA you can lose the ability to use the "plain" interface. interface GigabitEthernet0/0 nameif Internt security-level 100 ip address 10.0.20.2 255.255.255.0 ! change to  interface GigabitEthernet0/0.20 nameif Internt security-level 100 ip address 10.0.20.2 255.255.255.0 ! and  interface GigabitEthernet0/2 nameif Interlan_DMZ security-level 50 ip address 100.1.200.2 255.255.255.0 change to interface GigabitEthernet0/2.1 nameif Interlan_DMZ security-level 50 ip address 100.1.200.2 255.255.255.0 HP Switch  [ convert the untagged vlan 20 to tagged vlan 20 ] vlan 20 untagged B2 ip address 10.0.20.1 255.255.255.0 exit change to vlan 20 tagged B2 ip address 10.0.20.1 255.255.255.0 exit I prefer to not use vlan 1, using your other addressing it looks like vlan 200 might work on the ASA/3560 links and change 3560 vlan 1 to vlan 200. interface Vlan1 ip address 100.1.200.10 255.255.255.0 ! change to  interface Vlan200 ip address 100.1.200.10 255.255.255.0 ! and change the ASA to vlan 200 for the Interlan_DMZ ... View more