Ok, here is my scenario, I have traffic coming from a firewall destined for the PC. The firewall, router and PC are all on the same /27 subnet, the switch is just L2. If my firewall has a static host route for the PC pointing to the Router, the traffic fails to reach the PC. I understand that I don't need this static route as the PC is on the firewall's connected subnet, but for other reasons I can't go into here, I had the route there. What would prevent the router from receiving the traffic and forwarding it back out the interface it was received on and sending it to the PC? Even though the route is unneeded I am curious    Static Route on firewall: PC ---> Router Firewall ---- Switch----Router                        |                        |                     PC ... View more

I have been attempting upgrade on a pair of Nexus 5010s in a vPC configuration. I want to go from n5000-uk9.5.0.3.N1.1c to n5000-uk9.5.2.1.N1.4 as that is the minimum recommended version. I have 4 FEXs that are dual homed to the N5ks and 4 old CatOS switches that are port channeled / vPC as well. Since I have switches running spanning tree downstream I can’t do ISSU, so I did a disruptive upgrade. I followed the procedure here under the “Upgrading A Dual-Homed FEX Access Layer“ procedures: http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/upgrade/503_N1_1/n5k_upgrade_downgrade_503.html#wp641001 On the primary N5k I entered: install all kickstart bootflash:n5000-uk9-kickstart.5.2.1.N1.4.bin system bootflash:n5000-uk9.5.2.1.N1.4.bin The primary NK5 reloaded and came back up with the new code, everything good so far. I set the boot parameters on the secondary switch: boot kickstart bootflash:n5000-uk9-kickstart.5.2.1.N1.4.bin boot system bootflash:n5000-uk9.5.2.1.N1.4.bin copy run start I reloaded the FEXs and waited until they came online running the new version of code on the Primary N5K. My continuous pings were all responding. I reloaded the secondary switch to complete the upgrade. When I did this I immediately began losing continuous pings I had going to nodes connected to the FEXs and my management interfaces on the CatOS switches behind the N5Ks. Some of them dropped completely, some of them were intermittent, no response for 5 pings, respond for 3 ping etc. After the secondary N5k came back up, the issue remained. I verified both N5Ks were running the same new code, I did a config comparison and it looked fine, I did observere that the new code added a “vlan configuration [vlans]” that is not in the old software and it reorded some of the port channel config. FEXs were all online on both switches, running new code, the vPC was up, peer link up, peer keep alive up, vPC roles were correct, all the port channels were up, all the interfaces were up, logs didn’t give any indication of problems, spanning tree (MST) looked ok, I rebooted both switches again one at a time, I cleared the mac address tables, ... nothing seemed wrong, nothing fixed the problem. It doesn't appear to be a problem with the FEXs, as my CatOS switches are directly conencted to the N5ks and they are experiencing the same problem. I continued to have the same intermittent/complete connectivity loss. I have attempted this upgrade twice with the same result, and both times I had to revert back to the original code to get everything working normally. When I reverted back to the old code everything started working! Any ideas for locating and resolving this problem? ... View more

I am working on setting up a “Dual DMVPN Cloud Topology—Spoke-to-Spoke Deployment Model”. Using the references below. http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/DMVPNbk.pdf Page 26 http://www.cisco.com/en/US/tech/tk583/tk372/technologies_white_paper09186a008018983e.shtml#dualhubs Dual Hub - Dual DMVPN Layout The dual hub with dual DMVPN layout is slightly more difficult to set up, but it does give you better control of the routing across the DMVPN. The idea is to have a two separate DMVPN "clouds". Each hub (two in this case) is connected to one DMVPN subnet ("cloud") and the spokes are connected to both DMVPN subnets ("clouds"). Since the spoke routers are routing neighbors with both hub routers over the two GRE tunnel interfaces, you can use interface configuration differences (such as bandwidth, cost and delay) to modify the dynamic routing protocol metrics to prefer one hub over the other hub when they are both up. Note: The above issue is usually only relevant if the hub routers are co-located. When they are not co-located, normal dynamic routing will likely end up preferring the correct hub router, even if the destination network can be reached via either hub router. See my topology diagram below, I am running ospf and my hubs are not co-located: The problem I have is hub 1 depends on a spoke in order to communicate with hub 2. A possible solution to the problem would be to modify the DMVPN as shown below. I could make hub 2 another spoke on tunnel1. This would allow the hubs to communicate directly without having to depend on a spoke. If the ospf cost on tunnel 2 is increased on both Hub2 and the spokes, then tunnel 2 would only be used as backup in the event that hub1 is down. See diagram below. I am not sure if this is the best way to do it as did not find any specific Cisco design recommendations for dual cloud dual non-co-located hubs. As I understand things, it seems Cisco recommends the dual cloud design for co-located dual hubs. In this scenario it seems that having a single DMVPN cloud with the spokes having nhrp statements pointing to both hubs makes more sense. Any thoughts? A similar question with no answer is posted here. https://supportforums.cisco.com/message/1002120#1002120 ... View more

I have a Cisco 3120x-s blade switch stack that has been filling its logs with high transciever  temperature Rx and Tx warnings. However when I enter the "show interface tranceiver detail" command, the outputs for the temperature, Rx and Tx are in the normal ranges that match all my other switches. It appears the reason I am getting the errors is the threshold settings on one particular X-2 10g transceiver are way off, which is generating the alarms. The threshold settings are different from my other tranceivers in the switch stack and all the other thresholds on my other 3120 switch stacks. Why are the thresholds incorrect? Is there a way to configure them back to what they are supposed to be? Thanks. ... View more

I had a condition where I was getting thousands of alarms on my ACS 5.2.0.26.6 VM. I have over 5000 AAA health and 5000 system status alarms. Is there any way to clear all alarms. When I delete multiple pages of 100 alarms each, the total count doesn't even decrease! The alarm was no health updates received for the last hour. I restarted the box the the alerts stopped.. ... View more