I have two issues with BGP route leaking on NX-OS running 7.x code. This is the first time I've tried to do any serious route leaking. I'm leaking routes between VRFs on R1, and on R1 I see the subnet in the BGP table for the destination VRF.  However I see it still has a next-hop of the origin of the route, which is in the source VRF, advertised to R1. Right now my import and export route-maps only permit or deny the subnets. Do I need to apply a set parameter to change the IP next-hop to an address in the destination VRF? Otherwise, it seems like other routers receiving that route will see a next-hop they know nothing about and cannot reach. I made a quick attempt at doing that and it didn't seem to solve the problem, so I'm not sure if that's a rat hole that won't help. Which brings me to the second issue. Right now, I see the route in the BGP table on R1, but on R1's peer (R2) I do not see the leaked route in the BGP table in the destination VRF. I looked at advertised routes for that VRF on R1, and he's not advertising it to R2. I originally thought it might be an issue with sync but it turns out sync is disabled by default in NX-OS, so there must be something else at work. Any thoughts on what I need to do differently to get that route to propagate? Is it possible it's because of the next-hop issue above, and if I fix that, it will fix propagation? Thanks for any suggestions. I have a deadline coming up so this is somewhat time critical.  John ... View more

I'm trying to get clear on the syntax for doing ISSU on a 4500-X VSS pair. All the examples I see in the documentation seem to be about a 4500 multi-slot chassis, and I'm trying to understand the "command conversion" from a multi-slot chassis to two separate chassis. I'm interpreting that the "active" and "standby" supervisor engines referenced in the documentation refer to chassis-1 and chassis-2 of the 4500-Xs that make up the VSS pair.  Prep shown in http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1-2/XE_340/configuration/guide/config/issu_XE.html shows slot 5 as active and slot 6 as standby. Again, I'm thinking that would correspond to chassis-1 and chassis-2 for 4500-X.  It looks like when you do the "issu loadversion" command loads the new image on chassis-2, and essentially gets that image ready to take over. Then you do the "issu runversion" command listing only the standby chassis as parameters, which apparently switches state of the standby unit (chassis-2?) to active. At this point, is chassis-2 now running on the new version and handling traffic?  Finally, the "issu commitversion" command is run, and this is where I really get lost. This command uses the standby chassis as its parameter, but is that the original standby chassis (chassis-2), or is that what was originally the active chassis (chassis-1)? It seems like this step might be essentially bringing up the original chassis-1 to get them both on the same version of code, and that seems to be what the CLI output in is showing, except that at this point, the roles are reversed and slot 6 is active with slot 5 being standby.  Or am I making too much out of understanding which is active and which is standby at any given point in the process? Just use "bootflash:" and "slavebootflash:" and follow the instructions? Thanks for any input.    ... View more

First time working with BGP on the ASA, and I don't know if there are any unusual characteristics on the ASA versus in IOS. I have a main internet gateway with two border routers to different ISPs on the outside of an ASA FO pair, and a disaster recovery site that also has a single ISP connection with an ASA (FO pair) and a border router. Planning on running iBGP among the border routers and the ASAs to choose a path, and to redistribute default routes into our IGP. In IOS, I would peer iBGP using loopback addresses, but loopbacks are not supported on the ASA. So I'll have to peer directly to interfaces on the ASA, which means the iBGP connections will be on different interfaces for the same AS. Mainly, I just want to make sure this will not cause any issues. I don't see anything in documentation that indicates it would, but I'd like to make sure. Thanks for any information or suggestions.     ... View more

Customer has a Nexus 7000 and they're using PBR to force certain kinds of traffic (voice/video) out a different gateway. Will the N7k force multicast traffic out the same path? Right now their multicast traffic seems to be taking the default route out the other gateway. Planning on changing their architecture to use VRFs but that's going to be several months away. ... View more

Pulling my hair out a bit trying to figure this out. I feel like I'm OK going from the EHWIC to the WAN side, but can't seem to figure out what to do going to the phone to assign voice traffic to LLQ. There's no "priority" command available as on most actual switches, and IOS won't let me assign a service-policy outbound on the interface. Using command-line help I don't see any commands that even look like they'll get me going in the right direction. Anyone have any suggestions about how to do this, or where to look? I'm not finding any documentation that addresses these specific interfaces. Thanks for any suggestions. - John ... View more