L2 MTU don't need to match as long it is can support the L3 MTU. As long there is un-fragmented connectivity with the L3 MTU OSPF should be fine.    -Sebastian ... View more

This is correct/expected behavior, BGP runs a scanner process that checks for next-hop and best-routes.  As soon as a better route is received, RR will announce it further to RR-clients. This has nothing to do with the age of the route in RR routing table. RR will only announce the best BGP path to RR-clients.  Since R1 is provides RR a better route with lowest router ID, it marks it as the best path and then propagates it to other RR-clients.   Hope this all make sense now.    *** Please mark this post helpful if helped you with your query ***   - Sebastian ... View more

Hi @YUNG-CHENG CHANG    Your PBR configuration is correct and should work appropriately. The only think that I can think of is packets not getting to the right router. Can you make sure that you are using 10.99.99.10 as the gateway for the host in 10.99.99.0/28 subnet.   Also it would be helpful to apply below ACL on the interface and make sure that packets are indeed received on the right interface.    access-list 199 permit icmp host 10.99.99.1 192.168.56.0 0.0.0.255 log access-list 199 permit ip any any ! interface vlan 1 ip access-group 199 in If the hit count on the first entry is seen and you've verified in logs that the destination is correct. Then PBR should work fine.     *** Please mark this post helpful if it contributed to your query ***   -  Sebastian  ... View more

Hi @brad8419    The two public IP space that you have are too be used as following.    1.   21.21.21.146/30 is your subnet to be configured between your router and ISP 2. The other /29 subnet you have should be configured on your router for the purpose of NATting . This will not be configured on the provider facing interface.    In theory you can split the /29 in two /30 subnet and run each /20 subnet between R1-R2 and R1-R3. But that will be a total waste of your addressing space.     Another topology that you can assume is to use a switch with provider SVI with /30 subnet and then have another VLAN for the /29 IP and connect other devices that needs to have the public IP from /29. Although this is still waste of IP, but just another option.    If the option is to segregate different resources to different public IP, then NAT alone is capable enough to do it.   *** Please mark this post helpful if it contributed to your solution***   - Sebastian         *** ... View more

Hi @Ali Hazim    As other provided the document  hope they make sense. Just to add to what others posted, the range available for the sub-interface is the range that is based on the 32bit value, but the total number of interface that a platform can support is based on the maximum idb(s) supported.    *** Please mark this post helpful if it contributed to your issue ***   -  Sebastian ... View more

Hi @geburtige    To support NSF make sure there is an IP Service license and also the OSPF neighbor needs to be nsf aware.    From CCO The switch supports NSF-awareness and NSF-capability for the BGP, OSPF, and EIGRP protocols in IP Services license level and NSF-awareness for the EIGRP-stub in IP Base license level. Also you may find other useful information at    https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/ha_stack_manager/configuration_guide/b_hastck_3se_3850_cg/b_hastck_3se_3850_cg_chapter_011.html   ***** Please mark this post as helpful if it contributes to your solution ******   - Sebastian ... View more

Hi @dmfld2000    The police CIR is setup to use 3.14 Gbps. But counters shows that you are not exceeding the traffic rate. Also remember that you have burst bucket also configured giving some cushion there.     ****** Please mark the post as helpful *******   -  Sebastian ... View more

Hi @Andrew White    Yes the PID needs to be different as you're required to run two distinct process of OSPF. You should configure different RD value for each VRF. Route-distinguisher is what makes the overlapping route unique by appending a unique RD for that VRF.    I think in your case, its the OSPF Router ID that is causing the issue. Because both VRFs have the same highest IP (10.12.12.1). Try changing the manual router ID for each OSPF PID.    Also if this does not solve the issue.  Please share below output   - show ip ospf 1 interface  - show ip ospf 2 interface     ***** Please don't forget to mark post helpful ***** -  Sebastian   ... View more

Hi @Andrew White    The vrf aware OSPF config is pretty straight forward like below   router ospf 1 vrf Customer-A network 10.0.0.0 0.255.255.255 area 0 ----->> If you want to enable ospf on all 10.0.00/8 interfaces in that VRF router ospf 1 vrf Customer-B network 10.0.0.0 0.255.255.255 area 0     But you might want to keep in mind various differences that vrf aware OSPF presents to area 0 in a VRF context. There is another hierarchy of super-backbone area that gets added when OSPF is run with vrf context.   You should also use below command to relax the effects of the super-backbone area. "capability vrf lite"   ****** Please mark this post helpful if it contributed to your learning ******   - Sebastian   ... View more

Hi @billseymour    As per document, you should use the interface name with quotes. See here https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/12-2sx/dhcp-12-2sx-book/dhcp-prt-bsd-aa.html   Also debug the output for - debug ip dhcp server packet   Also share output for -show ip dhcp pool Rack03Switch01     - Sebastian Please mark this helpful.   ... View more

Use TCP MSS 1380 and also try to clear DF bit if your application is setting one. There are ECN and re-transmissions happening which leads me to think of the two. Also if you are able to open the telnet port but not able to access via http, I wonder if there is some application issue.    Is your web server accessible on the remote network itself via http.  ... View more