I have an odd situation, there is static route on my Nexus 7700 that routes anything for specific Class A subnet /24 to a F5 LTM Load Balancer external VRRP interface 10.x.153.15 and as you can see further below command outputs the old host 10.x.135.70 is working fine which is using an AM Adjacency route using nexus FIB table with a 250 cost and the new server 10.x.135.71 that is not working is using a standard static route cost of 1, I guess using the nexus RIB table. At the moment we can route to .70 fine which is using the AM Route but not .71 which is using the Static Route. No new routes have been added, I'm using the /24 route to the F5 LB 10.x.135.15 already on the switch.   I've performed a debug on the Load balancer and I can see the F5 Interface 10.x.153.15 (external interface) quite rightly asking 10.x.135.13 (Nexus Switch Vlan interface) for an ARP,  no reply because the Nexus switch is not resolving the ARP of 10.x.135.71 I can ping the host fine from the switch. The Server .71 is configured correctly  DG & Subnet    F5    3661  23.056618 0.000228 137 F5Networ_15:76:07 → Broadcast       ARP OUT s1/tmm0 : Who has 10.x.135.71? Tell 10.x.135.13   How do I make the new server 10.x.135.71 part of the AM routing table and shouldn't the FIB automatically find and assign the new server ARP to it's table?  I even contacted F5 they went through issue and said this is a Cisco Switch issue!   Switch A# sh ip route 10.x.135.70 IP Route Table for VRF "default" '*' denotes best ucast next-hop '**' denotes best mcast next-hop '[x/y]' denotes [preference/metric] '%<string>' in via output denotes VRF <string> 10.x.135.70/32, ubest/mbest: 1/0, attached *via 10.x.135.70, Vlan137, [250/0], 5d11h, am Switch A # Switch A# sh ip route 10.x.135.71 IP Route Table for VRF "default" '*' denotes best ucast next-hop '**' denotes best mcast next-hop '[x/y]' denotes [preference/metric] '%<string>' in via output denotes VRF <string> 10.x.135.0/25, ubest/mbest: 1/0 *via 10.x.153.15, [1/0], 51w3d, static Switch A#   Switch A# sh ip arp 10.x.135.70 Flags: * - Adjacencies learnt on non-active FHRP router + - Adjacencies synced via CFSoE # - Adjacencies Throttled for Glean D - Static Adjacencies attached to down interface IP ARP Table Total number of entries: 1 Address Age MAC Address Interface 10.x.135.70 00:06:51 x.x.817c Vlanx Switch A# sh ip arp 10.x.135.71 Flags: * - Adjacencies learnt on non-active FHRP router + - Adjacencies synced via CFSoE # - Adjacencies Throttled for Glean D - Static Adjacencies attached to down interface IP ARP Table Total number of entries: 0 Address Age MAC Address Interface Switch A# ... View more

I also had to apply the same work around to ISE v2.4 patch 10   ... View more

Hi all,   As output below, hosts that want to subscribe multicast from a publisher and are not able to for a particular group 239.181.4.147, all  the other groups in subnet 239.181.4.x work apart from 239.181.4.147, why is Po400 not included in the Port list as below? All hosts sit on the same vlan and on the same switch which is a Layer 2 switch attached to switch SW2-VDC10.   Po400 is a special Po that sends multicast across buildings so that multicast doesn't traverse our OTV network for these streams to work. Po31 is a Po that connects to L2 switch SW2-VDC10# show ip igmp snooping groups | i 239.181.4. 901 239.181.4.10 v2 D Po31 Po400 901 239.181.4.15 v2 D Po400 Po31 901 239.181.4.129 v2 D Po400 Po31 901 239.181.4.130 v2 D Po400 Po31 901 239.181.4.147 v2 D Po31 901 239.181.4.148 v2 D Po400 901 239.181.4.219 v2 D Po400 Po31 901 239.181.4.220 v2 D Po400 Po31 901 239.181.4.221 v2 D Po400 Po31     show ip igmp snooping vlan 901 IGMP Snooping information for vlan 901 IGMP snooping enabled Lookup mode: IP Optimised Multicast Flood (OMF) enabled IGMP querier present, address: 10.x.x.3, version: 2, i/f Po400 Switch-querier disabled IGMPv3 Explicit tracking enabled IGMPv2 Fast leave disabled IGMPv1/v2 Report suppression enabled IGMPv3 Report suppression disabled Link Local Groups suppression enabled Router port detection using PIM Hellos, IGMP Queries Number of router-ports: 2 Number of groups: 205 VLAN vPC function disabled Active ports: Po31 Po400   sh ip igmp groups 239.181.4.147 IGMP Connected Group Membership for VRF "default" - matching Group "239.181.4.147" Type: S - Static, D - Dynamic, L - Local, T - SSM Translated Group Address Type Interface Uptime Expires Last Reporter 239.181.4.147 D Vlan901 21:03:17 00:03:32 10.x.x.24 ... View more

Hi all,   I have 1 Nexus 3548 switch in each Data Centre spanned across to each other. One switch is Layer 3 the other is Layer 2 for vlan 899.   Switch A (Layer 3 for vlan 899) doesn't seem to be processing IGMP membership reports requests from hosts on Switch B (layer 2 vlan 899). The port-channel across sites is Po1 configured on both switches, mrouter port for vlan 899 is Po1 on both switches. However "sh ip mroute" on Switch A doesn't show these 2 particular hosts on Switch B. IGMP snooping is enabled.   If I span traffic to a Wireshark box for both hosts on Switch B I can see IGMP traffic every 15 seconds leaving (v2 IGMP Member reports), however if I span Po1 on Switch B or Port 1 on Switch A I do not see these host requests. I see plenty of other multicast packets going across Po1 on both switches working fine, it's just this one particular IGMP group I cannot see.   The fact I cannot see the hosts IGMP queries on Switch B Po1 suggests to me to me that Switch B's Control Plane is doing something weird with these packets and not processing them. My 1st thought was to turn off IGMP snooping for this particular group but not ideal. This problem appeared after I upgraded the code on Switch A (L3 for vlan 899) to 7.0(3)I7(6)....... Switch B (L2 for vlan899) is running 6.0(2)A8(4a)...I excluded Switch B from the upgrade when I discovered the problem Monday after application teams showed me.   Switch B   # show ip igmp snooping mrouter vlan 899 Type: S - Static, D - Dynamic, V - vPC Peer Link I - Internal, F - Fabricpath core port C - Co-learned, U - User Configured P - learnt by Peer Vlan Router-port Type Uptime Expires 899 Po1 D 1w3d 00:04:58   # show ip igmp snooping vlan 899 IGMP Snooping information for vlan 899 IGMP snooping enabled Lookup mode: IP Optimised Multicast Flood (OMF) disabled IGMP querier present, address: 10.210.89.2, version: 2, i/f Po1 Switch-querier disabled IGMP Explicit tracking enabled IGMPv2 Fast leave disabled IGMPv1/v2 Report suppression enabled IGMPv3 Report suppression disabled Link Local Groups suppression enabled Router port detection using PIM Hellos, IGMP Queries Number of router-ports: 1 Number of groups: 61 VLAN vPC function disabled Active ports: Po1 Po3 Eth1/8 Eth1/15 Eth1/24 Eth1/28 Eth1/29 Eth1/40 Eth1/44 Eth1/45   Switch A   # sh ip igmp snooping vlan 899 Global IGMP Snooping Information: IGMP Snooping enabled Optimised Multicast Flood (OMF) enabled IGMPv1/v2 Report Suppression enabled IGMPv3 Report Suppression disabled Link Local Groups Suppression enabled IGMP Snooping information for vlan 899 IGMP snooping enabled Lookup mode: IP Optimised Multicast Flood (OMF) enabled IGMP querier present, address: 10.210.89.2, version: 2, i/f Vlan899 Querier interval: 125 secs Querier last member query interval: 1 secs Querier robustness: 2 Switch-querier disabled IGMPv3 Explicit tracking enabled IGMPv2 Fast leave disabled IGMPv1/v2 Report suppression enabled IGMPv3 Report suppression disabled Link Local Groups suppression enabled Router port detection using PIM Hellos, IGMP Queries Number of router-ports: 1 Number of groups: 73 VLAN vPC function disabled Active ports: Po1 Po3 Eth1/8 Eth1/15 Eth1/24 Eth1/28 Eth1/29 Eth1/40 Eth1/44 Eth1/45 Report Flooding: Disabled Interfaces for Report Flooding: n/a Use Group Address for Proxy Leaves: no   # sh ip igmp snooping mrouter vlan 899 Type: S - Static, D - Dynamic, V - vPC Peer Link I - Internal, F - Fabricpath core port C - Co-learned, U - User Configured P - learnt by Peer Vlan Router-port Type Uptime Expires 899 Vlan899 ID 1w3d 00:03:49     ... View more

I finally have BYOD working on ISE 2.4.x with 8.5.x running on my WLC's. Working fine for a week, then I asked a few users in my building to test sitting near the outer ring close to our building windows (my 4G signal is very intermittent in the center of my floor where I sit). Of the 3 users I tested the following error appears after clicking Cisco Network Assistant for Android: “"Unable to detect Server. Please ensure your network access device is configured to redirect enroll.cisco.com to ISE” Came across a few forums referring to DNS named WLC ACL entries nothing seemed a definite solution to me. So I asked the 3 users to turn off 4G on there devices (all Android) suddenly Cisco Network Assistant starts working, users complete onboarding successfully, job complete.   Having a look at packet captures from my Anchor WLC I can clearly see the issue, each user was sending out a request to our BYOD DNS Servers (google Servers 8.8.8.8) over DNS-TLS port 853, the difference was all of these users were sending out SYN packets unlike working Android devices who are completing 3 way handshakes!   With DNS-TLS obviously I can't see packet information to decode   Asking users to turn 4G off on their devices for onboarding is not an easy task. Has anyone else had this issue with Android or iOS?   I have opened a TAC..............no reply as yet.     ... View more

WLC 5508   ISE - When using single SSID for BYOD from iPhone versions 12.x and onwards you need to apply config network web-auth captive-bypass enable on all your WLC's in order for the iPhone browser to be supported so supresses. That's a problem for me as Guest users with iPhones are no longer presented a login page.   Does anyone know if config network web-auth captive-bypass enable is supported on a per SSID basis? This would solve my issue!   Someone mentioned to me from WLC 8.4.x this option should be seen in the GUI not sure where or cmd line because @moment this command is a global command meaning all SSID's are enabled once the command is applied.   Thanks. ... View more