Thanks! I appreciate the input. Best, ~zK ... View more

Thank you!   This is very helpful.   Best, ~zK ... View more

Great! That's the answer I was looking for! Best, ~zK ... View more

Thanks for the input. This is helpful!   So, when create a an IKEv2 policy and IKEv2 proposal, where does each get referenced or associated? Let's take this the below config, for example:    Where in the config are the IKEv2 policies used/associated? The IKEv2 ipsec-proposal is referenced in or associated with the "crypto map MAP_0 1 set ikev2 ipsec-proposal AES AES192 AES25" but I don't see the IKEv2 policies referenced or associated anywhere else in this config! ! crypto ikev2 policy 1  encryption aes-256  integrity sha  group 5 2  prf sha  lifetime seconds 86400 ! crypto ikev2 policy 10  encryption aes-192  integrity sha  group 5 2  prf sha  lifetime seconds 86400 ! crypto ikev2 policy 20  encryption aes  integrity sha  group 5 2  prf sha  lifetime seconds 86400 ! ! crypto ipsec ikev2 ipsec-proposal AES256  protocol esp encryption aes-256  protocol esp integrity sha-1 md5 ! crypto ipsec ikev2 ipsec-proposal AES192  protocol esp encryption aes-192  protocol esp integrity sha-1 md5 ! crypto ipsec ikev2 ipsec-proposal AES  protocol esp encryption aes  protocol esp integrity sha-1 md5 ! ! crypto map MAP_0 1 match address ACL_abc crypto map MAP_0 1 set pfs crypto map MAP_0 1 set peer x.x.x.x crypto map MAP_0 1 set ikev2 ipsec-proposal AES AES192 AES256 ! ! crypto map MAP_0 interface outside ! ! group-policy HQ_To_Loc_01 internal group-policy HQ_To_Loc_01 attributes  vpn-tunnel-protocol ikev2  split-tunnel-all-dns disable ! ! tunnel-group x.x.x.x type ipsec-l2l tunnel-group x.x.x.x general-attributes  default-group-policy HQ_To_Loc_01 tunnel-group x.x.x.x ipsec-attributes  ikev2 remote-authentication pre-shared-key abcdefgxxxxxxxx  ikev2 local-authentication pre-shared-key  abcdefgxxxxxxxx !   Best, ~zK ... View more

I see. So, I'll only need to enable the "layer3 peer-router" feature if I intend to use the vPC Peer-Link to support L3 routing. However, in my case, since I am using a separate L3 physical link for that purpose, then I don't need to enable this feature.   Thanks much, Reza!   Best, ~sK   layer3 peer-router To enable support for layer 3 routing protocols over virtual port channels (vPCs), use the layer3 peer-router command. To disable support for layer 3 routing protocols, use the no form of this command. layer3 peer-router no layer3 peer-router ... View more

Hello,   Actually,  I've configured a separate L3 link between the two vPC switches in the vPC domain for routing and avoid using the vPC Peer-Link for routing.   I am not clear on when to enable Peer-Gateway and or Layer-3 peer-router if I am using a separate L3 link for routing between the two vPC switches with the domain. Can you please clarify?   Thanks in advance, ~zK ... View more

Hi Peter,   Apologies for the confusion. For consistency purposes; I streamlined the key chain name and pwd:  Key Chain Nake: EIGRP_KEY  Key Chain PWD: S@lEIGRP_33  Pwd Encryption: Default SW_A: NX9K SW_A# sh key chain EIGRP_KEY Key-Chain EIGRP_KEY   Key 1 -- text 7 "073c01406b203e37272d585f"     accept lifetime (always valid) [active]     send lifetime (always valid) [active] SW_B# SW_A# sh key chain EIGRP_KEY mo de Key-Chain EIGRP_KEY   Key 1 -- text 0 "S@lEIGRP_33"     accept lifetime (always valid) [active]     send lifetime (always valid) [active] SW_A# router eigrp edge_rtr   autonomous-system 1226   passive-interface default   address-family ipv4 unicast interface Ethernet1/5   ip address 10.51.250.46/30   ip router eigrp edge_rtr   ip authentication mode eigrp 1226 md5   ip authentication key-chain eigrp 1226 EIGRP_KEY   no ip passive-interface eigrp edge_rtr   no shutdown +_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+ SW_B: Cisco IOS Software, C3750 Software (C3750-IPSERVICESK9-M), Version 12.2(53)SE1, RELEASE SOFTWARE (fc2) SW_B#sh key chain EIGRP_KEY Key-chain EIGRP_KEY:     key 1 -- text "S@lEIGRP_33"         accept lifetime (always valid) - (always valid) [valid now]         send lifetime (always valid) - (always valid) [valid now] STG-ET04-BDF-MDF-SW# SW_B# SW_B#sh run | b router router eigrp edge_rtr  !  address-family ipv4 unicast autonomous-system 1226   !   af-interface GigabitEthernet1/0/45    authentication mode md5    authentication key-chain EIGRP_KEY   exit-af-interface   !   !   topology base   exit-af-topology   network 10.0.0.0   network 172.18.0.0  exit-address-family interface GigabitEthernet1/0/45  no switchport  ip address 10.51.250.45 255.255.255.252  ip pim sparse-dense-mode end +_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_   I'm still working on getting the pcap file sent once I have remove all sensitive data.   Thanks much!   Best, ~zK ... View more