Hi Sochi: Thank you very much for answer, and I apologize for my late answer. I have been 5 days without broadband access... I managed to build an EEM script, but the problem is that I can only generate an event "once". I need the router to generate a notification (trap, syslog, or both) EVERY time the condition is met (ie, as long as the IP SLA object times out, i want the router to generate an event. As far as I saw, there is no simple way to generate a continuous stream of events (once each time the IP SLA times out). Any hints will be appreciated! regards, Rogelio ... View more

Hello Hitesh: My name is Rogelio; I am a technician located in Argentina. I am experiencing quite the same problem mentioned in this thread. Actually, I just see the trap sent ONCE (more preciselly, when the IP SLA object starts and times out in reaching the objective). ¿Is this the expected behavior? I want the trap be sent (either SNMP or SYSLOG style) EVERY TIME the IP SLA object times out with the target. ¿ is it possible? The following is my basic configuration: ip sla 2 icmp-echo 141.167.85.153 threshold 1500 frequency 15 ip sla schedule 2 life forever start-time now ip sla reaction-configuration 2 react timeout threshold-type immediate action-type trapOnly logging trap debugging logging source-interface Loopback0 logging 141.167.121.222 snmp-server enable traps syslog snmp-server enable traps ipsla snmp-server host 141.167.121.222 mycommunity  syslog ipsla Your help will be greatly appreciated regards, rogelio ... View more

Thank you very much again. I will follow this advice. regards, Rogelio ... View more

Harold: I am thinking on a much better and simpler workaround. Let me know please your opinion: To the former default route, pointing to the former firewall cluster, I should add another default route, pointing to the parallel firewall. The router should install the new default route in the routing table. And balance the outgoing sessions on a (source,destination) basis with its corresponding FIB. I would not need any PBR whatsoever! I could also add some tracking capabilities to both default routes to guarantee some availability of the paths across the firewalls ¿Am I right? ... View more

Hello Harold: The customer is waiting for new (more powerful) Internet firewalls to replace the present ones, but the new ones will arrive in three months. He asked me to insert a 2nd firewall in parallel to the existing Internet firewalls, because the present firewall custer is running out of resources. He asked me to schedule traffic distribution among the present cluster and the temporary extra firewall, so I am thinking to PBR some of the (many internal segments in the company). I need my PBR routine to "know" that packets are driven to the Internet in order to make the proper redirection. This is a complex company with besides RFC1918 addresses, they also have lots of internal segments that happen to be public (and legal) IP addresses, so it is quite cumbsersome to get rid of the "next hop" concept and make a list of IP addresses for which i must not redirect. I also have to take care not to redirect packets to DMZs protected by the current firewall cluster. The following picture shows (more or less) the topology I have to take care of: ... View more

So I am screwed thank you very much for your helpful answer. I will have to work this around in some other way. Best regards, Rogelio ... View more