Hello I'm trying to build a VPN relay between two Instances in AWS, using a 3rd instance running a pair of CSR routers, to overcome the limitation that I cant build a VPC GW from two instances within a region to the same VPN Device.   For that, I am planning to use sub-interfaces on one of the CSR port and define them under different VRFs. However, for some reason the VPN doesnt seem to come up. Has anyone been able to deploy VPN using VRF (or VRF Lite) and sub-interfaces using the AWS model? High level deployment model is below. Please let me know if you have any more questions or suggestions   Thank you ... View more

Hi, We have a pair of ASA 5585-X in HA, running 8.4(6). Off late there have been a lot of concerns with file transfers getting terminated randomly with the log below: %ASA-6-302014: Teardown TCP connection 103431437 for outside:x.x.x.x/1025 to inside:y.y.y.y/50022 duration 1:19:34 bytes 395734649 Flow closed by inspection This is perfectly reproducible and is NOT related to the similar bug: CSCtg17779 as we notice that the session is being killed abruptly, and not a regular FIN/ACK etc. When we tried from another pair of ASA 5525-X running 9.0 code, we could not reproduce the issue. Has anyone else seen this behaviour before? On the TCP packet captures on my firewall, I clearly see a RST packet form the remote IP to my local IP, however when I saw the captures from the remote FW, there is no packet showing a RST being sent from their IP. Any thoguhts/suggestions/comments would be appreciated... Thanks! ... View more

Hello, I'm having a weird issue with vPC on N5K (5548P), running 5.0(3)N1(1) - Today I noticed that the N5K infrastructure had crashed. While looking into it, the problem was with vPC. What happened was that the switch noticed a loop, and brought down the vPC peer-link. vPC domain id                 : 420 Peer status                     : peer link is down                               vPC keep-alive status       : peer is alive             So the Port channel holding the vPC peer-link was down, whereas the individual members in the link were up. I tried rebuilding the port-channel, rebuilding the vPC peer-link etc, but no luck. Each N5K was showing that it was to ROOT for ALL the VLANS (though originally each N5K was the root for one set of VLANS). I had to shutdown the second N5K to have the environment up and running. Looking at the time when everything happened, the logs are of the form: 06:55:37   %STP-2-VPC_PEER_LINK_INCONSIST_BLOCK: vPC peer-link detected BPDU receive timeout blocking Po2 VLAN: 2,5,101,105,109. 06:55:48   %STP-2-VPC_PEER_LINK_INCONSIST_BLOCK: vPC peer-link detected Bridge Assurance Inconsistency blocking Po2 VLAN: 1-2,4-5,101,103,105,107,109. 06:55:54   %STP-2-BRIDGE_ASSURANCE_BLOCK: Bridge Assurance blocking port Po2 VLAN: 1-2,4-5,101,103,105,107,109. 06:56:22   %ETH_PORT_CHANNEL-5-PORT_DOWN: port-channel2: Ethernet2/14 is down 06:56:22   %ETH_PORT_CHANNEL-5-FOP_CHANGED: port-channel2: first operational port changed from Ethernet2/14 to Ethernet2/16 06:56:22   %ETHPORT-5-IF_DOWN_INITIALIZING: Interface Ethernet2/14 is down (Initializing) 06:56:32   %ETH_PORT_CHANNEL-4-PORT_INDIVIDUAL: port Ethernet2/14 is operationally individual 06:56:32   %ETHPORT-5-IF_UP: Interface Ethernet2/14 is up in mode trunk 06:56:33   %ETH_PORT_CHANNEL-5-PORT_DOWN: port-channel2: Ethernet2/16 is down 06:56:33   %ETH_PORT_CHANNEL-5-FOP_CHANGED: port-channel2: first operational port changed from Ethernet2/16 to Ethernet2/13 06:56:33   %ETHPORT-5-IF_DOWN_INITIALIZING: Interface Ethernet2/16 is down (Initializing) 06:56:33   %ETH_PORT_CHANNEL-5-PORT_DOWN: port-channel2: Ethernet2/15 is down 06:56:33   %ETHPORT-5-IF_DOWN_INITIALIZING: Interface Ethernet2/15 is down (Initializing) 06:56:36   %VPC-2-VPC_SUSP_ALL_VPC: Peer-link going down, suspending all vPCs on secondary So basically, after this, all the links from the vPC unbundled. Has anyone come across this issue before? Any thoughts would be highly appreciated. Thanks. ... View more

Hello, I have a dual homed ISP Setup: R1---> ISP1 R2----> ISP2 NO iBGP between them. The Firewall behind R1 & R2 is setup for failover (Active/Standby). So R1 and R2 have HSRP on their LAN Interfaces - one HSRP Group fro Each ISP. I have a PUBLIC IP Block, say 4.5.6.0/24, which is being advertized over BOTH R1 & R2, but R1 being a preferred route when both links are active (using AS-Prepend for that IP Block, on R2). Idea is, when R1-ISP1 link Fails, the IP block 4.5.6.0/24 msut be reachable over R2-ISP2 Link (link with a longer AS-Path). But, when R1-ISP1 link fails, the route for 4.5.6.0/24 does NOT reconverge- The Upstream ISPs (confirmed via a looking glass site)- are still sending traffic over to ISP1, and it dies at R1-ISP1 Link. Any other emthods how this can be acheived? Thanks! ... View more

Hello, We're desinging a Network, for which I need some expert advise on. We need to build two tunnels from a Remote ASA, to a Hub ASA, and a VPN Concentrator (for redundancy). Basically, we're thinking of doing an L2L VPN between the two ASAs and a Remote-Access VPN between the ASA and the VPN Concentrator. I have the following questions: - I'm not sure if this is a feasilbe design to begin with, to have the same ASA create a Dynamic Tunnel (Remot Access) to a VPN Concentrator, and a regular L2L Tunnel to an ASA. - If the above setup can be configured, Is there a way the Client ASA can hold the Remote Access Tunnel (to the VPN Conc.) down as long as the L2L Tunnel to the Hub ASA is up and running? This is something which is still in the 'concept' phase, so any advice in this regard would be highly appreciated. Thanks in advance! KG ... View more

Hello, We're desinging a Network, for which I need some expert advise on. We need to build two tunnels from a Remote ASA, to a Hub ASA, and a VPN Concentrator (for redundancy). Basically, we're thinking of doing an L2L VPN between the two ASAs and a Remote-Access VPN between the ASA and the VPN Concentrator. I have the following questions: - I'm not sure if this is a feasilbe design to being with, to have the same ASA create a Dynamic Tunnel (Remot Access) to a VPN Concentrator, and a regular L2L Tunnel to an ASA. - If the above setup can be configured, Is there a way the Client ASA can hold the Remote Access Tunnel (to the VPN Conc.) down as long as the L2L Tunnel to the Hub ASA is up and running? This is something which is still in the 'concept' phase, so any advice in this regard would be highly appreciated. Also please let me know if you have any other questions to further explain my scenario. Thanks in advance! KG ... View more