Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About sdavids5670
08-29-2018
Stats
Member since
05-14-2008
196
Posts
25
Helpful
0
Solutions
02-24-2018
06:22 PM
@Georg Pauwen wrote:
Hello,
if it is a GRE tunnel, MTU could be a reason. Post the configuration of the router...
I'll start with this (see below) and if you think I need to post more config let me know. If this were a fragmentation issue wouldn't the drops show up under the tunnel interface instead of the physical interface? I should also add that I do see flow drops in the default class for several of the spokes (per-tunnel QoS) but the drops do not add up to the drops I see on the physical interface (phys > flow drops).
policy-map QOS-OUT-INET description Child policy to the SHAPING-POLICY-xMbps class EF-PRI priority police cir 1544000 conform-action transmit exceed-action drop class NETWORK-CONTROL bandwidth remaining percent 5 queue-limit 1500 packets class AF41-QUEUE bandwidth remaining percent 40 fair-queue queue-limit 1500 packets class AF31-QUEUE bandwidth remaining percent 34 fair-queue queue-limit 1500 packets class AF21-QUEUE bandwidth remaining percent 16 class SCAVENGER bandwidth remaining percent 1 fair-queue queue-limit 1500 packets class class-default bandwidth remaining percent 4 fair-queue queue-limit 1500 packets ! policy-map SHAPING-POLICY-20Mbps description Shaping for Broadband-based Tunnel at 20 Mbps class class-default shape average 20000000 service-policy QOS-OUT-INET policy-map SHAPING-POLICY-5Mbps description Shaping for Broadband-based Tunnel at 5 Mbps class class-default shape average 5000000 service-policy QOS-OUT-INET policy-map SHAPING-POLICY-10Mbps description Shaping for Broadband-based Tunnel at 10 Mbps class class-default shape average 10000000 service-policy QOS-OUT-INET policy-map SHAPING-POLICY-15Mbps description Shaping for Broadband-based Tunnel at 15 Mbps class class-default shape average 15000000 service-policy QOS-OUT-INET ! interface Tunnel999 description Internet-based transport INET-BRANCH bandwidth 1000000 ip address 192.168.1.2 255.255.255.0 no ip redirects ip mtu 1400 ip flow monitor NETFLOW input ip flow monitor NETFLOW output ip nhrp authentication REDACTED ip nhrp map multicast dynamic ip nhrp map group Group-20Mbps service-policy output SHAPING-POLICY-20Mbps ip nhrp map group Group-5Mbps service-policy output SHAPING-POLICY-5Mbps ip nhrp map group Group-10Mbps service-policy output SHAPING-POLICY-10Mbps ip nhrp map group Group-15Mbps service-policy output SHAPING-POLICY-15Mbps ip nhrp network-id 999 ip nhrp holdtime 600 ip tcp adjust-mss 1360 load-interval 30 tunnel source GigabitEthernet0/0/2 tunnel mode gre multipoint tunnel key 999000 tunnel vrf BLUE ! interface GigabitEthernet0/0/2 description REDACTED vrf forwarding BLUE ip address 172.31.1.169 255.255.255.252 load-interval 30 negotiation auto end
... View more
02-24-2018
09:17 AM
The topology is like this (sorry this is the best I could do in draw.io):
The router in the middle is a GRE head end router. Traffic coming into Gi0/0/0 and Gi0/0/1 is native IP and traffic going out Gi0/0/2 is GRE-encapsulated traffic (not encrypted at this point). There is NO QoS configuration on Gi0/0/2. For some reason Gi0/0/2 is seeing a relatively high output drop rate (approx 1/2 of 1 percent). Interface Gi0/0/2 is in a front-door VRF and the GRE traffic supports only about 45 spokes at this time. The total traffic rate never gets very high and even a single output drop seems like it would be too high for the flows that are using this interface. The hold-queue is set to default (40 packets). Is it possible that this is the result of microbursts (seems unlikely)? When I issue "show interface gi0/0/2 summary" I never see anything other than a 0 in the OHQ (pkts in output hold queue).
... View more
Labels:
03-30-2017
04:26 AM
06-21-2016
02:49 PM
I ran into an interesting issue today and thought it'd be nice to share since we didn't have much luck finding an answer on The Google. Here's the gist of the issue. We have ZBFW features enabled on a 4331. We have only two zones; INSIDE and INTERNET. This router also has a combo FXS/FXO module. Well, a user complained that a machine attached to the FXS port wasn't working. An analog phone was attached and a test call revealed that there was one-way audio (the caller could hear us but we couldn't hear the caller - audio from the attached phone, via the FXS port, wasn't working). Upon further testing, we learned that the FXO port was having a one-way audio issue, too. In a nutshell, if the traffic was received over analog and then converted into IP traffic and transmitted on an INSIDE interface it was dumped. It turns out that there's a simple fix for this issue.
interface Service-EngineX/Y/Z zone-member security YOUR_ZONE_NAME_HERE
... View more
Labels:
03-20-2015
07:59 AM
I think I might have an answer to my own question. There's no cef switching or process switching going on because the traffic is forwarded at layer 2 (fa0/45 is an access port and fa0/1 is a trunk port). Does EPC only work on packets that are routed?
... View more
03-19-2015
08:38 AM
I'm having a "Falling Down" moment with EPC. Here's my config and CLI output (see below). As you can see, traffic is ingress on Fa0/45 ('show interface' counters are incrementing). I'm allegedly capturing packets ingress on Fa0/45. However, the packet counter is not incrementing on my buffer associated with the Fa0/45 capture. I'm pretty confident that this is CEF-switched traffic. What am I doing wrong? This is driving me nuts. The only EPC I've been able to get working on this switch has been a process-switched capture. What I'm trying to do is capture traffic traversing the switch from a workstation (connected on Fa0/45) to a router (connected on Fa0/1) in that one direction (WKSTN -> Fa0/45 -> Fa0/1 -> Router). The EPC I created on the router is working BTW. Is this a case of EPC not working as advertised on the switch? switch#show monitor cap point all Status Information for Capture Point c_fa0/45 IPv4 CEF Switch Path: IPv4 CEF , Capture Buffer: b_fa0/45 Status : Active Configuration: monitor capture point ip cef c_fa0/45 FastEthernet0/45 in Status Information for Capture Point c_fa0/1 IPv4 CEF Switch Path: IPv4 CEF , Capture Buffer: b_fa0/1 Status : Active Configuration: monitor capture point ip cef c_fa0/1 FastEthernet0/1 out switch#show monitor capture buffer all parameters Capture buffer b_fa0/1 (linear buffer) Buffer Size : 1048576 bytes, Max Element Size : 68 bytes, Packets : 0 Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0 Associated Capture Points: Name : c_fa0/1, Status : Active Configuration: monitor capture buffer b_fa0/1 monitor capture point associate c_fa0/1 b_fa0/1 Capture buffer b_fa0/45 (linear buffer) Buffer Size : 1048576 bytes, Max Element Size : 68 bytes, Packets : 0 Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0 Associated Capture Points: Name : c_fa0/45, Status : Active Configuration: monitor capture buffer b_fa0/45 monitor capture point associate c_fa0/45 b_fa0/45 switch#show interfaces fa0/45 | inc packets input 58656 packets input, 45047808 bytes, 0 no buffer switch#show interfaces fa0/45 | inc packets input 58671 packets input, 45059328 bytes, 0 no buffer switch#show interfaces fa0/45 | inc packets input 58687 packets input, 45071616 bytes, 0 no buffer
... View more
Labels:
11-10-2014
02:14 PM
In the "Cisco Prime Infrastructure 2.0 User Guide" it states: Prime Infrastructure logs all emergency, alert, and critical messages generated by all devices that are managed by Prime Infrastructure. Prime Infrastructure also logs all SNMP messages and syslogs it receives. To view syslogs, choose Operate > Alarms & Events, then click the Syslogs tab. Syslog Pre-defined Filters Prime Infrastructure uses the following syslog filters: • Severity 0 and 1 • Severity 2 • Environmental Monitor • Memory Allocation Failure • Catalyst Integrated Security Features • Cisco IOS Firewall Denial of Service Can this be changed or is this Pre-defined filter something I have to live with? If it can be changed, where? The user guide doesn't get into it (at least not that I could find). Thanks
... View more
Labels:
11-07-2014
03:01 PM
I've got a little bit more information for you on this. If you were to login to a switch, enter enable mode and type "copy running-config startup-config" and press ENTER you'd see this: Destination filename [startup-config]? You'd then read the documentation and think to yourself "Self, I better use the following syntax in my CLI template" #INTERACTIVE copy running-config startup-config<IQ>Destination filename [startup-config]?<R>startup-config #ENDS_INTERACTIVE But in Cisco's world, I guess that just doesn't make any sense at all. Why use the actual interactive question when you can simply just use the first word (even though all of their examples show multi-word interactive questions). The correct syntax would then be: #INTERACTIVE copy running-config startup-config<IQ>Destination<R>startup-config #ENDS_INTERACTIVE #START_SARCASM Duh! It's so obvious. Why in the world would one ever think anything other than that you would simply take the first word in the interactive question and just leave it at that. I feel so stupid #ENDS_SARCASM
... View more
11-07-2014
02:28 PM
You might have already figured this out but the reason your "copy running-config startup-config" thing didn't work is because that command requires interaction whereas "write mem" does not. In order for your "copy running-config startup-config" to work, you'd have to include: #MODE_ENABLE #INTERACTIVE copy running-config startup-config<IQ>Destination filename [startup-config]?<R>startup-config #ENDS_INTERACTIVE #MODE_END_ENABLE Or something to that effect.
... View more
08-28-2014
07:09 AM
We have a router that has interfaces in multiple VRFs. One interface sits on an interface that is routed on the Internet. Other interface sits on a VRF that is in a private address space and is used for WAN connectivity. The strange behavior that I'm seeing is related to icmp messages coming off the router. It appears that scanners hitting the Internet-facing interface cause the router to generate icmp messages (type 3) that are source using the IP address of the WAN-facing interface and they are routed across the WAN, into our data center and dropped by our firewall due to anti-spoofing rules. Is this normal behavior? Doesn't seem normal to me. Is this behavior something that can be changed via configuration?
... View more
Labels:
Created by
sdavids5670
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
05-13-2014
09:09 AM
05-13-2014
09:09 AM
The colleague who implemented the change claimed that the APs rebooted.
... View more
05-13-2014
08:50 AM
Marvin, This is where everything goes off the rails for me when it comes to understanding Prime Infrastruction, Prime LMS and everything that you're talking about. Refer to this link: http://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/prime-lan-management-solution/data_sheet_c78-697479.html How should I interpret this?: "Cisco Prime Infrastructure 1.1 bundles campus switch, branch, core routing, and wireless LAN management into a single, easy-to-order solution that enables businesses and enterprises unparalleled operational efficiencies and investment protection. The bundle consists of: ● Cisco Prime LAN Management Solution , which delivers simplified management of Cisco ® Borderless Networks and reduces operations costs by aligning network management functionality the way network operators do their jobs ● Cisco Prime Network Control System , which provides complete wireless LAN management with converged user and access management, and integrated lifecycle management of branch routers For more information about Cisco Prime Infrastructure, please visit http://www.cisco.com/go/primeinfrastructure ." Am I wrong to assume that the first bullet point, which states "Cisco Prime LAN Management Solution" is referring to Prime LMS 4.2? Thanks, Steven
... View more
Created by
sdavids5670
in Other Wireless - Mobility Subjects
in Other Wireless - Mobility Subjects
05-09-2014
01:31 PM
05-09-2014
01:31 PM
"In FlexConnect, you can specify the SSID to vlan mapping, but this is strictly for FlexConnect" Are you stating that regardless of what I have under "VLAN Mappings", it will not change the behavior that AP AND clients get their IP from the native VLAN when using FlexConnect mode? We presently have VLAN Mappings defined (see attached - page 5 of 9 in wlc-config.pdf)
... View more
05-09-2014
10:16 AM
My colleague made a change to the wireless environment and I'm trying to understand why we observed the unexpected behavior I will now describe. Prior to the change, the port configuration for all of our HQ-based WAPs was this: interface Gix/0/z switchport trunk native vlan 198 switchport trunk allowed vlan 198 switchport mode trunk Vlan198 is the Vlan for the staff SSID. The WAPs got their IP address from the same network as the staff wireless users. Everything worked fine. My colleague wanted the WAPs to get their IP address from a different network (the same network that the WLCs use for the management interface). He changed the configuration of the switch ports for HQ-based WAPs to this: interface Gix/0/z switchport trunk native vlan 105 switchport trunk allowed vlan 105,198 switchport mode trunk After making this change, wireless users (staff SSID) were getting their IP address from the 105 VLAN. I'm having trouble explaining this. Regardless of how the trunk port is configured on the switch, shouldn't the tunneled traffic enter the WLC tagged with vlan 198 if its coming from the staff SSID? I don't know much at all about wireless so even though I can look through the management UI most of what I'm looking at is just guess work. Please tell me if there are configuration elements from the management UI that you want to see and I'll post it to this thread. Regards, Steven
... View more
02-24-2018
@Georg Pauwen wrote: Hello, if it is a GRE tunnel, MTU could be a
reason. Post the configuration of ...
02-24-2018
The topology is like this (sorry this is the best I could do in
draw.io): The router in the middle i...
Created by
sdavids5670
in Routing
06-21-2016
06-21-2016
I ran into an interesting issue today and thought it'd be nice to share
since we didn't have much lu...
03-20-2015
I think I might have an answer to my own question. There's no cef
switching or process switching goi...
Created by
sdavids5670
in Switching
03-19-2015
03-19-2015
I'm having a "Falling Down" moment with EPC. Here's my config and CLI
output (see below). As you can...
11-10-2014
In the "Cisco Prime Infrastructure 2.0 User Guide" it states:Prime
Infrastructure logs all emergency...
11-07-2014
I've got a little bit more information for you on this. If you were to
login to a switch, enter enab...
11-07-2014
You might have already figured this out but the reason your "copy
running-config startup-config" thi...
Created by
sdavids5670
in Routing
08-28-2014
08-28-2014
We have a router that has interfaces in multiple VRFs. One interface
sits on an interface that is ro...
Created by
sdavids5670
in Other Wireless - Mobility Subjects
05-13-2014
05-13-2014
The colleague who implemented the change claimed that the APs rebooted.
05-13-2014
Marvin,This is where everything goes off the rails for me when it comes
to understanding Prime Infra...
05-09-2014
"In FlexConnect, you can specify the SSID to vlan mapping, but this is
strictly for FlexConnect" Are...
Public Statistics
| Date Registered | 05-14-2008 06:40 AM |
| Date Last Visited | 08-29-2018 12:01 AM |
| Total Messages Posted | 196 |
| Total Helpful Votes Received | 25 |
Helpful Votes From
Awards
Community Spotlight Award
Doc/Video December 2012
