4500 High CPU issue due to MAC Address Flapping A MAC flap is caused when a switch receives packets from two different physical/logical interfaces with the same source MAC address. When flapping occurs it causes this table to be updated whenever a packet is sent/received. The more data flowing through the interface that is flapping the higher your CPU Utilization is going to be which can have serious potential negative side effects. Use below command to identify high CPU issue. Switch# show process cpu sorted CPU utilization for five seconds: 17%/0%; one minute: 16%; five minutes: 16% PID Runtime(ms)   Invoked     uSecs   5Sec   1Min   5Min TTY Process 60   29111481 13351616       2180 9.27% 8.06% 7.97%   0 Cat4k Mgmt LoPri 59   25067966 35373845       708 8.00% 8.10% 8.16%   0 Cat4k Mgmt HiPri 41     323666   430147       752 0.15% 0.14% 0.15%   0 IDB Work         131         36       200       180 0.07% 0.01% 0.00%   0 Exec             107       83017   4301245         19 0.07% 0.05% 0.07%   0 UDLD             192       5072   3186984         1 0.07% 0.00% 0.00%   0 PM Callback        6           0         1         0 0.00% 0.00% 0.00%   0 IPC ISSU Receive    5           0         1         0 0.00% 0.00% 0.00%   0 Retransmission o      340921     58127       5865 0.00% 0.11% 0.06%   0 Check heaps This output delineates two processes that use the CPU:  Cat4k Mgmt HiPri  and  Cat4k Mgmt LoPri ).   Other command :- show platform health cisco4500#show platform health                     %CPU   %CPU   RunTimeMax   Priority Average %CPU Total                    Target Actual Target Actual   Fg   Bg 5Sec Min Hour CPU VSI channel Slot-01   1.00   0.27     6     1 100 500   0   0   0 17:45 VSI channel Slot-04   1.00   0.05     6     0 100 500   0   0   0 5:40 VSI channel Local Ja   1.00   0.01     6     0 100 500   0   0   0 3:28 VSI channel Remote J   1.00   0.04     6     0 100 500   0   0   0 3:16 GalChassisVp-review   3.00   3.79     10   157 100 500   3   3   3 233:53 Lj-poll               1.00   0.01     2     0 100 500   0   0   0 1:29 StatValueMan Update   1.00   0.07     1     0 100 500   0   0   0 4:05 GalK5TatooineStatsMa   0.70   0.02     4    0 100 500   0   0   0 2:12 K5L3FlcMan Consisten   2.00   0.48     15     7 100 500   0   0   0 55:28 K5L3FlcMan NI Regs &   1.00   0.42     5     4 100 500   0   0   0 22:51 K5L3AdjStatsMan Revi   2.00   0.03     10     6 100 500  0   0   0 15:00 K5FlcHitMan review     2.00   0.01     5     2 100 500   0   0   0 20:41 K5PortMan Regular Re   2.00   0.15     15     11 100 500   0   0   0 21:35 K5PortMan Ondemand L   3.00   0.34     30     0 100 500   0   0   0 18:51 %CPU Totals         238.72 22.42   Each of the platform-specific processes has a target or expected CPU utilization. When that process is within range, the CPU executes the process in the high-priority context and the  show processes cpu command output displays that utilization under  Cat4k Mgmt HiPri   . If a process exceeds the target, it runs under the low-priority context and the  show processes cpu   command output counts that additional utilization under  Cat4k Mgmt LoPri . You can also use  Cat4k Mgmt LoPri   to run background and other low-priority processes (such as consistency check and reading interface counters). This mechanism allows the CPU to run high-priority processes when necessary. The remaining idle CPU cycles are used for the low-priority processes. Marginally exceeding the target CPU utilization (or a brief utilization spike) does not reflect a problem that requires investigation.   To resolve issue use below command to generate the logs on switch for mac address flapping issue. Generally does not show mac flap logs on switch. As to avoid too many logs in switch. cisco4500(config)#mac address-table notification mac-move. This command will generate logs as below . Cisco4500# show log Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled) ... *Oct  3 08:51:28.149: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (10.10.10.236) *Oct  3 09:43:46.437: %C4K_EBM-4-HOSTFLAPPING: Host 00:60:48:1B:01:15 in vlan 400 is moving from port Gi2/40 to port Gi2/30 *Oct  3 09:43:48.629: %C4K_EBM-4-HOSTFLAPPING: Host 00:60:48:1B:01:15 in vlan 400 is moving from port Gi2/30 to port Gi2/40 *Oct  3 09:43:48.717: %C4K_EBM-4-HOSTFLAPPING: Host 00:60:48:1B:01:15 in vlan 400 is moving from port Gi2/40 to port Gi2/30 *Oct  3 09:43:49.581: %C4K_EBM-4-HOSTFLAPPING: Host 00:60:48:1B:01:15 in vlan 400 is moving from port Gi2/30 to port Gi2/40   Logs shows that MAC address bouncing between two different physical ports.   1.Finally to disable one of the two interfaces or configure LACP as per requirement. It may also between two different ESXI/blade servers /firewall consisting same mac address connected on two different switches which are in common LAN segment. 2.Remove command after issue resolved.  3.cisco4500(config)#no mac address-table notification mac-move Related links:- http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/troubleshooting/cpu_util.html   http://www.cisco.com/c/en/us/support/docs/switches/catalyst-4000-series-switches/65591-cat4500-high-cpu.html ... View more

BGP load balancing    If you have two WAN link and running e-BGP with ISP (one using as backup). BGP multipath relax allows to use both link to be utilized to send the traffic outside your branch. Here's the topology:-   .   Configuration:-   "bgp bestpath as-path multipath-relax" is hidden command. Enter the command, it will accept.If press ? mark it will not show up this command Traffic got load balanced on both WAN link.       Other part of routers configuration find attached file.Hopefully, it is informative to you and utilize secondary link as active and get your branch traffic load balanced. :) ... View more

  IOS upgrade 7206 router   Follow the steps to upgrade IOS image of 7206 router:-   1 .Delete unwanted files:- Router#Dir  disk2: Router#Sh bootflash: Router#delete bootflash:IOS name Router#delete disk2:IOS name   Router#format bootflash: 2. Router#squeeze. If required. To remove deleted file.   3.To install IOS images. Router#copy tftp: disk2: c7200p-adventerprisek9-mz.152-4.M7.bin Router#verify /md5 disk2:c7200p-adventerprisek9-mz.152-4.M7.bin   O/P:- ............................................................................................... ....................................................... verify /md5 (bootflash:c7200p-kboot-mz.152-4.M7.bin) = 18b953e28eefed3cb0d7deea4374c922   (verify checksum value from cisco site).It should be same. https://software.cisco.com/download/type.html?mdfid=282188585&catid=268437899   https://software.cisco.com/download/release.html?mdfid=282188585&catid=268437899&softwareid=280805685&release=15.2.4S6&relind=AVAILABLE&rellifecycle=MD&reltype=latest Hold cursor on image it will show md5 checksum value.   4.To install boot loader file. Router#copy tftp: bootflash: c7200p-kboot-mz.152-4.M7.bin Router#verify /md5 disk2: c7200p-kboot-mz.152-4.M7.bin   5.To install FPD image:- Router#copy tftp: disk2: c7200p-fpd-pkg.152-4.M7.pkg Router#verify /md5 bootflash:c7200p-kboot-mz.152-4.M7.bin   Verify checksum value.   6.Set boot loader image. Router#Conf t boot bootldr bootflash:c7200p-kboot-mz.152-4.M7.bin     7.Remove old IOS boot sequence:- Router#No boot system disk2: c7200p-adventerprisek9-mz.124-15.T8.bin     Set new boot sequence:- Router#boot system disk2: c7200p-adventerprisek9-mz.152-4.M7.bin Router#boot system disk2: c7200p-adventerprisek9-mz.124-15.T8.bin   sh bootvar – Check boot variable before reload.   8.Reboot the router to run with new IOS installed in router. Router#reload   Check after reload:- sh version sh bootvar – Check boot variable after reload.     Note:- VSA and NPE-G2 should be detected after IOS and FPD image upgrade. FPD image upgrade not required if VSA card is not there.   Sh commands;- Sh version Sh inventory Sh diag sh hw-module all fpd show upgrade fpd package default   Router#sh diag Load for five secs: 0%/0%; one minute: 4%; five minutes: 9% Time source is NTP, *18:44:30.133 IST Sun Dec 7 2014   Slot 0:         VSA IPsec Card Port adapter         Port adapter is analyzed         Port adapter insertion time 00:04:27 ago         EEPROM contents at hardware discovery:         PCB Serial Number        : JAF1322ACKF         Hardware Revision        : 1.0         Part Number              : 73-10220-05         Board Revision           : B1         RMA Test History         : 00         RMA Number               : 0-0-0-0         RMA History              : 00         Deviation Number         : 0         Product (FRU) Number     : C7200-VSA         Version Identifier       : V01         Top Assy. Part Number    : 68-2578-05         CLEI Code                : CNUCAFNAAA         EEPROM format version 4         EEPROM contents (hex):           0x00: 04 FF C1 8B 4A 41 46 31 33 32 32 41 43 4B 46 40           0x10: 05 0D 41 01 00 82 49 27 EC 05 42 42 31 03 00 81           0x20: 00 00 00 00 04 00 88 00 00 00 00 CB 94 43 37 32           0x30: 30 30 2D 56 53 41 20 20 20 20 20 20 20 20 20 20           0x40: 20 89 56 30 31 20 D9 03 C1 40 CB 87 44 0A 12 05           0x50: C6 8A 43 4E 55 43 41 46 4E 41 41 41 FF FF FF FF           0x60: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF           0x70: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   Slot 1:         VAM2+ Encryption/Compression engine, Port adapter         Port adapter is analyzed         Port adapter insertion time 00:04:28 ago         EEPROM contents at hardware discovery:         Hardware Revision        : 1.0         PCB Serial Number        : JAB1203007T         Part Number              : 73-9571-06         Board Revision           : A0         RMA Test History         : 00         RMA Number               : 0-0-0-0         RMA History              : 00         Deviation Number         : 0         Product (FRU) Number     : SA-VAM2+         Version Identifier       : V02         Top Assy. Part Number    : 68-2288-06         CLEI Code                : CNDQASMGAA         EEPROM format version 4         EEPROM contents (hex):           0x00: 04 FF 40 04 B0 41 01 00 C1 8B 4A 41 42 31 32 30           0x10: 33 30 30 37 54 82 49 25 63 06 42 41 30 03 00 81           0x20: 00 00 00 00 04 00 88 00 00 00 00 CB 94 53 41 2D           0x30: 56 41 4D 32 2B 20 20 20 20 20 20 20 20 20 20 20           0x40: 20 89 56 30 32 20 87 44 08 F0 06 C6 8A 43 4E 44           0x50: 51 41 53 4D 47 41 41 FF FF FF FF FF FF FF FF FF           0x60: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF           0x70: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF     sh upgrade fpd package default Load for five secs: 0%/0%; one minute: 2%; five minutes: 7% Time source is NTP, *18:45:37.189 IST Sun Dec 7 2014     ************************************************************************* This IOS release requires the following default FPD Image Package for the automatic upgrade of FPD images: *************************************************************************   Version: 15.2(4)M7   Package Filename: c7200p-fpd-pkg.152-4.M7.pkg           List of card type supported in this package:                                           Minimal                  No. Card Type          HW Ver.                 ---- ------------------ -------                   1) VSA                  0.0                   2) Port-Adaptor         0.0                   3) Port-Adaptor         0.0                   4) Port-Adaptor         0.0                   5) Port-Adaptor         0.0                   6) NPE-G2               0.0                   7) C7201                0.0                 ---- ------------------ -------   If VSA card not detected check the physical LED status of slot0 . a) Check logs: sh logging (IOS incompatible issue logs then check proper all image name should be same). b) Remove card from slot by power down the router and re insert the card in slot0. Power on the router and check LED status. Table 1-6 VSA LED Color State Function No color Off Indicates that the VSA is disabled. Green On Indicates the VSA is powered up and enabled for operation. Amber On Indicates VSA is booting or has encountered errors. Yellow Powering Up Indicates that the VSA is powering up, but software initialization has not started yet.   c) Issue below command and reload the router. If issue still there. Enabling VSA card. Disable by prepending no commands. R (config)#crypto engine slot 0 VSA will NOT come up until system power-cycle or reload... R(config)#crypto engine accelerator 0 VSA will NOT come up until system power-cycle or reload... R(config)#wr R(config)#reload   Other O/P for information:-   router#copy tftp: disk2: Address or name of remote host []? 10.2.11.194 Source filename []? c7200p-fpd-pkg.152-4.M7.pkg Destination filename [c7200p-fpd-pkg.152-4.M7.pkg]? Accessing tftp://10.2.11.194/c7200p-fpd-pkg.152-4.M7.pkg... Loading c7200p-fpd-pkg.152-4.M7.pkg from 10.2.11.194 (via GigabitEthernet0/1): !!!!!!!!!!!!!! [OK - 3450880 bytes]   3450880 bytes copied in 6.272 secs (550204 bytes/sec)   router#sh hw-module all fpd Load for five secs: 0%/0%; one minute: 3%; five minutes: 8% Time source is NTP, *18:44:59.061 IST Sun Dec 7 2014     ==== ====================== ====== =============================================                              H/W   Field Programmable   Current   Min. Required Slot Card Type               Ver.  Device: "ID-Name"    Version      Version ==== ====================== ====== ================== =========== ==============  npe NPE-G2                  1.3   1-NPEG2 I/O FPGA       0.38        0.33 ---- ---------------------- ------ ------------------ ----------- --------------    0 VSA                     0.4   1-VSA                  0.23        0.23 ==== ====================== ====== =============================================     router#sh upgrade fpd package default Load for five secs: 0%/0%; one minute: 2%; five minutes: 7% Time source is NTP, *18:45:37.189 IST Sun Dec 7 2014     ************************************************************************* This IOS release requires the following default FPD Image Package for the automatic upgrade of FPD images: *************************************************************************   Version: 15.2(4)M7   Package Filename: c7200p-fpd-pkg.152-4.M7.pkg           List of card type supported in this package:                                           Minimal                  No. Card Type          HW Ver.                 ---- ------------------ -------                   1) VSA                  0.0                   2) Port-Adaptor         0.0                   3) Port-Adaptor         0.0                   4) Port-Adaptor         0.0                   5) Port-Adaptor         0.0                   6) NPE-G2               0.0                   7) C7201                0.   router#sh upgrade fpd progress Load for five secs: 0%/0%; one minute: 3%; five minutes: 7% Time source is NTP, *18:46:04.469 IST Sun Dec 7 2014     % There is no FPD image upgrade in progress.   router#sh hw-module all fpd   ==== ====================== ====== =============================================                              H/W   Field Programmable   Current   Min. Required Slot Card Type               Ver.  Device: "ID-Name"    Version      Version ==== ====================== ====== ================== =========== ==============  npe NPE-G2                  1.3   1-NPEG2 I/O FPGA       0.38        0.33 ---- ---------------------- ------ ------------------ ----------- --------------    0 VSA                     0.4   1-VSA                  0.19        0.18 ==== ====================== ====== =============================================   example;- Router# show hw-module all fpd ==== ====================== ====== =============================================                              H/W   Field Programmable   Current   Min. Required Slot Card Type               Ver.  Device: "ID-Name"    Version      Version ==== ====================== ====== ================== =========== ==============  npe NPE-G2                  1.5   1-NPEG2 I/O FPGA       0.18         0.20 * ---- ---------------------- ------ ------------------ ----------- --------------    0 VSA                     0.0   1-VSA                  0.10         0.10 ==== ====================== ====== =============================================  NOTES:        - FPD images that are required to be upgraded are indicated with a '*'          character in the "Minimal Required Version" field.        - The following FPD image package file is required for the upgrade:          "c7200-fpd-pkg.124-4.XD.pkg"     router#show upgrade fpd package default ************************************************************************* This IOS release requires the following default FPD Image Package for the automatic upgrade of FPD images: ************************************************************************* Version: 12.4(15)T8 Package Filename: c7200p-fpd-pkg.124-15.T8.pkg           List of card type supported in this package:                                           Minimal                  No. Card Type          HW Ver.                 ---- ------------------ -------                   1) VSA                  0.0                   2) Port-Adaptor         0.0                   3) Port-Adaptor         0.0                   4) Port-Adaptor         0.0                   5) Port-Adaptor         0.0                   6) NPE-G2               0.0                   7) C7201                0.0        Useful docs:- FPD:- http://www.cisco.com/c/en/us/td/docs/routers/7200/configuration/feature_guides/fpd.html   http://www.cisco.com/c/en/us/td/docs/routers/7200/configuration/feature_guides/fpd.html   VSA:- http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/vam_vsa/vsa/vsa/vsa_ov.html The Cisco 7200 series routers have three basic boot images that support different hardware options. The three images are the standard c7200-boot-mz boot image, the c7200-kboot-mz boot image, and the c7200-mboot-mz image. The c7200-kboot-mz image was released in October, 2000 and is larger than the standard c7200-boot-mz image because it supports newer hardware that is not supported in the c7200-boot-mz image.  ... View more

Cisco IP Service Level Agreement (SLA) feature - Cisco IOS IP SLAs allow paths to be changed based on network conditions such as jitter,latency, load and other factors. Over here used icmp parameter to check router reachability and also tracking router reachability.Configured static route. Traffic to moved from one ISP to another ISP incase of link failure and back to again primary after restoration of link.   With Cisco IOS Release 12.4(4)T, 12.2(33)SB, and 12.2(33)SXI, the ip sla command has replaced the previous ip sla monitor command. In addition, the icmp-echo command has replaced the type echo protocol ipIcmpEcho command. ip sla 1 icmp-echo x.x.x.x (destination address)   For detailed information refer: Link: http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/44sg/configuration/guide/swipsla.html   IP SLA Configuration:   Topology: Configuration:   Branch Config: R1#sh running-config Building configuration... Current configuration : 1683 bytes version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryptio   hostname R1 boot-start-marker boot-end-marker no aaa new-model memory-size iomem 5 ip cef no ip domain lookup   ip domain name lab.local   ip auth-proxy max-nodata-conns 3   ip admission max-nodata-conns 3   ip sla monitor 11   type echo protocol ipIcmpEcho 209.165.203.1   frequency 10   ip sla monitor schedule 11 life forever start-time now   ip sla monitor 22   type echo protocol ipIcmpEcho 209.165.204.1   frequency 10   ip sla monitor schedule 22 life forever start-time now   !   track 1 rtr 11 reachability   delay down 10 up 1   !   track 2 rtr 22 reachability   delay down 10 up 1   !   interface Loopback0   description R1 lan   ip address 192.168.1.1 255.255.255.0   !   interface Serial0/0   description R1-->ISP1   bandwidth 128   ip address 209.165.201.2 255.255.255.252   serial restart-delay 0   clock rate 128000   !   interface Serial0/1   description R1-->ISP2   bandwidth 128   ip address 209.165.202.130 255.255.255.252   serial restart-delay 0   clock rate 128000   !   interface Serial0/2   no ip address   shutdown   serial restart-delay 0   !   interface Serial0/3   no ip address   shutdown   serial restart-delay 0   !   no ip http server   no ip http secure-server   !   ip forward-protocol nd   ip route 0.0.0.0 0.0.0.0 209.165.201.1 2 track 1   ip route 0.0.0.0 0.0.0.0 209.165.202.129 3 track 2   ip route 0.0.0.0 0.0.0.0 209.165.201.1 5   !   control-plane   !   line con 0   exec-timeout 0 0   privilege level 15   logging synchronous   line aux 0   exec-timeout 0 0   privilege level 15   logging synchronous   line vty 0 4   login   !   end   R1#   ISP1 Config:       R2#sh running-config   Building configuration...       Current configuration : 1428 bytes   !   version 12.4   service timestamps debug datetime msec   service timestamps log datetime msec   no service password-encryption   !   hostname R2   !   boot-start-marker   boot-end-marker   !   !   no aaa new-model   memory-size iomem 5   !   !   ip cef   no ip domain lookup   ip domain name lab.local   !   !   ip auth-proxy max-nodata-conns 3   ip admission max-nodata-conns 3   !   Loopback0   description web server   ip address 209.165.200.254 255.255.255.255   !   interface Loopback1   description IPS1 DNS Server   ip address 209.165.203.1 255.255.255.255   !   interface Serial0/0   description ISP1-->R1   bandwidth 128   ip address 209.165.201.1 255.255.255.252   serial restart-delay 0   clock rate 128000   !   interface Serial0/1   bandwidth 128   ip address 209.165.200.225 255.255.255.252   serial restart-delay 0   clock rate 128000   !   interface Serial0/2   no ip address   shutdown   serial restart-delay 0   !   interface Serial0/3   no ip address   shutdown   serial restart-delay 0   !   router eigrp 1   network 209.165.200.224 0.0.0.3   network 209.165.201.0 0.0.0.3   network 209.165.203.0   no auto-summary   !   no ip http server   no ip http secure-server   !   ip forward-protocol nd   ip route 192.168.1.0 255.255.255.0 209.165.201.2   !   control-plane   !   line con 0   exec-timeout 0 0   privilege level 15   logging synchronous   line aux 0   exec-timeout 0 0   privilege level 15   logging synchronous   line vty 0 4   login   !   !   end   R2#       ISP2 Config:       R3#sh running-config   Building configuration...       Current configuration : 1459 bytes   !   version 12.4   service timestamps debug datetime msec   service timestamps log datetime msec   no service password-encryption   !   hostname R3   !   boot-start-marker   boot-end-marker   !   !   no aaa new-model   memory-size iomem 5   !   !   ip cef   no ip domain lookup   ip domain name lab.local   !   !   ip auth-proxy max-nodata-conns 3   ip admission max-nodata-conns 3   !   interface Loopback0   description Web Server   ip address 209.165.200.254 255.255.255.255   !   interface Loopback1   description ISP2 DNS Server   ip address 209.165.204.1 255.255.255.255   !   interface Serial0/0   description ISP2-->R1   bandwidth 128   ip address 209.165.202.129 255.255.255.252   serial restart-delay 0   clock rate 128000   !   interface Serial0/1   description ISP2-->ISP1   bandwidth 128   ip address 209.165.200.226 255.255.255.252   serial restart-delay 0   clock rate 128000   !   interface Serial0/2   no ip address   shutdown   serial restart-delay 0   !   interface Serial0/3   no ip address   shutdown   serial restart-delay 0   !   router eigrp 1   network 209.165.200.224 0.0.0.3   network 209.165.202.128 0.0.0.3   network 209.165.204.0   no auto-summary   !   no ip http server   no ip http secure-server   !   ip forward-protocol nd   ip route 192.168.1.0 255.255.255.0 209.165.202.130   !   control-plane   !   line con 0   exec-timeout 0 0   privilege level 15   logging synchronous   line aux 0   exec-timeout 0 0   privilege level 15   logging synchronous   line vty 0 4   login   !   !   end       R3#       Troubleshooting:   R1#sh interface description   Interface                     Status                 Protocol Description   Se0/0                          up             up       R1-->ISP1   Se0/1                          up             up       R1-->ISP2   Se0/2                          admin down      down   Se0/3                          admin down      down   Lo0                              up             up        R1 lan           R1#sh ip sla monitor configuration 11   IP SLA Monitor, Infrastructure Engine-II.   Entry number: 11   Owner:   Tag:   Type of operation to perform: echo   Target address: 209.165.203.1   Request size (ARR data portion): 28   Operation timeout (milliseconds): 5000   Type Of Service parameters: 0x0   Verify data: No   Operation frequency (seconds): 10   Next Scheduled Start Time: Start Time already passed   Group Scheduled : FALSE   Life (seconds): Forever   Entry Ageout (seconds): never   Recurring (Starting Everyday): FALSE   Status of entry (SNMP RowStatus): Active   Threshold (milliseconds): 5000   Number of statistic hours kept: 2   Number of statistic distribution buckets kept: 1   Statistic distribution interval (milliseconds): 20   Number of history Lives kept: 0   Number of history Buckets kept: 15   History Filter Type: None   Enhanced History:       R1#sh ip sla monitor configuration 22   IP SLA Monitor, Infrastructure Engine-II.   Entry number: 22   Owner:   Tag:   Type of operation to perform: echo   Target address: 209.165.204.1   Request size (ARR data portion): 28   Operation timeout (milliseconds): 5000   Type Of Service parameters: 0x0   Verify data: No   Operation frequency (seconds): 10   Next Scheduled Start Time: Start Time already passed   Group Scheduled : FALSE   Life (seconds): Forever   Entry Ageout (seconds): never   Recurring (Starting Everyday): FALSE   Status of entry (SNMP RowStatus): Active   Threshold (milliseconds): 5000   Number of statistic hours kept: 2   Number of statistic distribution buckets kept: 1   Statistic distribution interval (milliseconds): 20   Number of history Lives kept: 0   Number of history Buckets kept: 15   History Filter Type: None   Enhanced History:       R1#sh ip sla monitor statistics   Round trip time (RTT)   Index 11           Latest RTT: 95 ms   Latest operation start time: *00:26:53.151 UTC Fri Mar 1 2002   Latest operation return code: OK   Number of successes: 148   Number of failures: 13   Operation time to live: Forever       Round trip time (RTT)   Index 22           Latest RTT: 121 ms   Latest operation start time: *00:26:53.159 UTC Fri Mar 1 2002   Latest operation return code: OK   Number of successes: 147   Number of failures: 14   Operation time to live: Forever       R1#sh ip route   Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP          D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area          N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2          E1 - OSPF external type 1, E2 - OSPF external type 2          i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2          ia - IS-IS inter area, * - candidate default, U - per-user static route          o - ODR, P - periodic downloaded static route       Gateway of last resort is 209.165.201.1 to network 0.0.0.0            209.165.201.0/30 is subnetted, 1 subnets   C       209.165.201.0 is directly connected, Serial0/0        209.165.202.0/30 is subnetted, 1 subnets   C       209.165.202.128 is directly connected, Serial0/1   C    192.168.1.0/24 is directly connected, Loopback0   S*   0.0.0.0/0 [2/0] via 209.165.201.1       Testing SLA working:   Reachablity to ISP1 goes down   ISP1(config)#interface loopback 1   ISP1(config-if)#shutdown   ISP1(config-if)#   *Mar  1 00:49:32.983: %LINK-5-CHANGED: Interface Loopback1, changed state to administratively down   *Mar  1 00:49:33.983: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to down   ISP1(config-if)#^Z   ISP1#   *Mar  1 00:49:37.083: %SYS-5-CONFIG_I: Configured from console by console       R1#debug ip routing   IP routing debugging is on   R1#   *Mar  1 00:47:12.355: RT: NET-RED 0.0.0.0/0   R1#   *Mar  1 00:48:12.359: RT: NET-RED 0.0.0.0/0   R1#   *Mar  1 00:49:12.363: RT: NET-RED 0.0.0.0/0   R1#   *Mar  1 00:50:12.367: RT: NET-RED 0.0.0.0/0   R1#   *Mar  1 00:51:12.371: RT: NET-RED 0.0.0.0/0   R1#   *Mar  1 00:51:47.735: %TRACKING-5-STATE: 1 rtr 11 reachability Up->Down   *Mar  1 00:51:47.739: RT: del 0.0.0.0 via 209.165.201.1, static metric [2/0]   *Mar  1 00:51:47.743: RT: delete network route to 0.0.0.0   *Mar  1 00:51:47.743: RT: NET-RED 0.0.0.0/0   *Mar  1 00:51:47.747: RT: NET-RED 0.0.0.0/0   *Mar  1 00:51:47.751: RT: SET_LAST_RDB for 0.0.0.0/0     NEW rdb: via 209.165.202.129       *Mar  1 00:51:47.755: RT: add 0.0.0.0/0 via 209.165.202.129, static metric [3/0]   *Mar  1 00:51:47.755: RT: NET-RED 0.0.0.0/0   *Mar  1 00:51:47.759: RT: default path is now 0.0.0.0 via 209.165.202.129   *Mar  1 00:51:47.763: RT: new default network 0.0.0.0   *Mar  1 00:51:47.763: RT: NET-RED 0.0.0.0/0   R1#   R1#sh ip route   Gateway of last resort is 209.165.202.129 to network 0.0.0.0            209.165.201.0/30 is subnetted, 1 subnets   C       209.165.201.0 is directly connected, Serial0/0        209.165.202.0/30 is subnetted, 1 subnets   C       209.165.202.128 is directly connected, Serial0/1   C    192.168.1.0/24 is directly connected, Loopback0   S*   0.0.0.0/0 [3/0] via 209.165.202.129       R1#sh ip sla monitor statistics   Round trip time (RTT)   Index 11           Latest RTT: NoConnection/Busy/Timeout   Latest operation start time: *00:57:43.151 UTC Fri Mar 1 2002   Latest operation return code: No connection   Number of successes: 295   Number of failures: 51   Operation time to live: Forever       Round trip time (RTT)   Index 22           Latest RTT: 80 ms   Latest operation start time: *00:57:43.159 UTC Fri Mar 1 2002   Latest operation return code: OK   Number of successes: 332   Number of failures: 14   Operation time to live: Forever   Now it is going through secondary path:   R1#traceroute 209.165.200.254 source 192.168.1.1 Type escape sequence to abort.   Tracing the route to 209.165.200.254     1 209.165.202.129 36 msec *  36 msec   Now reachablity to ISP1 regains link status up:   ISP1(config)#interface loopback 1   ISP1(config-if)#no shutdown   ISP1(config-if)#   *Mar  1 01:00:38.799: %LINK-3-UPDOWN: Interface Loopback1, changed state to up   *Mar  1 01:00:39.799: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up R1#   *Mar  1 01:01:12.415: RT: NET-RED 0.0.0.0/0   R1#   *Mar  1 01:02:12.419: RT: NET-RED 0.0.0.0/0   R1#   *Mar  1 01:02:49.159: %TRACKING-5-STATE: 1 rtr 11 reachability Down->Up   *Mar  1 01:02:49.163: RT: closer admin distance for 0.0.0.0, flushing 1 routes   *Mar  1 01:02:49.167: RT: NET-RED 0.0.0.0/0   *Mar  1 01:02:49.167: RT: SET_LAST_RDB for 0.0.0.0/0     NEW rdb: via 209.165.201.1       *Mar  1 01:02:49.171: RT: add 0.0.0.0/0 via 209.165.201.1, static metric [2/0]   *Mar  1 01:02:49.175: RT: NET-RED 0.0.0.0/0   *Mar  1 01:02:49.179: RT: default path is now 0.0.0.0 via 209.165.201.1   *Mar  1 01:02:49.179: RT: new default network 0.0.0.0   *Mar  1 01:02:49.183: RT: NET-RED 0.0.0.0/0   R1#   *Mar  1 01:02:54.167: RT: NET-RED 0.0.0.0/0   Now it is going through primary path:   R1#traceroute 209.165.200.254 source 192.168.1.1 Type escape sequence to abort.   Tracing the route to 209.165.200.254   1 209.165.201.1 60 msec *  28 msec   Yes…..Successfully achieved the task: When primary goes down, branch can reach through secondary link to Web server. And when primary link gets restored, branch reaches web server through primary path. ... View more

Cisco IP Service Level Agreement (SLA) feature - Cisco IOS IP SLAs also allow paths to be changed based on network conditions such as delay, load, and other factors. Over here used icmp parameter to check router reachability and also tracking router reachability.Configured static route. Traffic to moved from one ISP to another ISP incase failure of link. ... View more