Hi    Can you please post your configurations?   Regards Bharat ... View more

Hi Have you thought/tired/tested of TE tunnels. Regards Bharat ... View more

Hi I think this is happening - 1. PE1 & PE2 receives the prefix (say 10/8) from CE1 & CE2. 2. PE1 marks the 10/8 with a RD (say 1:1) and with a lower MED (say 10) and advertises to RR. 3. P E2 marks the 10/8 with a RD (say 1:2) and with a higher MED (say 100) and advertises to RR. 4. Now RR has got two unique routes (because of unique RDs) for 10/8 and advertises PE1's route to PE2 & PE2's route to PE1.  And RR also advertises both routes to PE3. So far so good.  Now the interesting part. 5. Now when PE2 see a route for the same prefix from RR with a lower MED i.e. 10 (RD gone & IPv4 table lookup), it installs the learned route in the routing table and discards route learned from CE2 over eBGP.  This is because MED is considered before eBGP over iBGP in BGP path selection criteria.  PE2 considers the route learned from RR to be best and silently suppresses the advertisement of the prefix learned from CE2 towards RR. 6. RR now only receives one route from PE1 and withdraws previous advertisement (in step 4).   7. PE3 now gets only one route for the prefix towards PE1. Hope I explained it correctly. Now to achieve your goal, PE1 & PE2 must keep advertising routes to RR and RR surely will advertise them to PE3 as they are unique to RR (unique RD).  I am not sure about exact solution to this but I can try to test this in the lab. Regards Bharat ... View more

Hi  Request you to elaborate your question.  I am slightly confused that you want to prefer CPE1. RR is only going to advertise only VPNv4 routes. Once the VPNv4 traffic reaches PE1 & PE2 and get looked up in IPv4 routing table, it will prefer respective PEs.  At this level, if you want to influence all the traffic to be flown out of CPE1 then you need to run some protocol between PE1 & PE2 under VRF for CE1/CE2.   Regards Bharat ... View more

Hi JW Try to filter  172.16.1.0/24 using a export-map when CUST1 is exporting out of VRF towards MPLS backbone. Or use an export-map with ACL matching 172.16.0.0/24 and set a different RT (say 1:4) when CUST1 is exporting out of VRF towards MPLS backbone and then import 1:4 at vrf SP. Regards Bharat ... View more

Hi I am sure it will be supported.  Regarding throughput, there no limit to it.   However, I can share my experience.  We used 7609 with SUP720 (which is none the less a 6509) for a mobile core backbone with number of PBRs as we need to route traffic among multiple VLANs/devices and the performance was amazing. Regadrs Bharat ... View more

Hi Kashif As far as VPN is connected user1 & user2 will have access remote site.  You can stop user2 on IP layer.   You can surely apply restriction to user2 profile.  I am hopoing user1 is accessing some application at remote site.  The application must restrict user2 from accessing it (like it should prompt a username/password which user2 must not have).  Or even if User2 want to telnet/ssh any device in remote site, the device AAA mechanism should restric user2. Regards Bharat ... View more

I think the resolution of your problem seems to be in avoiding inter VLAN routing.  You can apply a PBR on Server VLAN and forward traffic sourced from server to default VLAN machine towards FW. ... View more

Hi David I can assume two scenarios: 1. If port settings mismatch:  Both the ports will fall in different port-channel group.  If Gig1/1 & Gig1/2 have a mismatch, then they will form two port channel say Po132 & Po132A (alternate aggregator).  Gig1/1 will be part of 132 and Gig1/2 will be part of 132A. 2. If port settings matches but doesn't match with port-channel settings:  Then both the ports will form a alternate aggregator and main port-channel will remain empty or down - this is happening in your case. You need to check the port-channel settings or capabilities and compare them with the physical port settings/capabilities. Just for hint, check flow control or storm-control settings.  Regards Bharat ... View more