Hello Giuseppe, thanks for the reply. But unfortunately am afraid didnt understood. Each CD and sw in that LAN segment has its own IP address. Also if the router id was equal I would expect to see something similar to: *Mar 1 00:07:33.747: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.1 2/3 (BGP identifier wrong) 4 bytes 01010101 rc# FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 002D 0104 0001 00B4 0101 0101 1002 0601 0400 0100 0102 0280 0002 0202 00 Any other suggestion is appreciated. ... View more

They all connect to another L2 switch yes. But they CD-A and CD-B have a L3 connection between them. So there should be no L2 loop to block via SPT. Also, Ive seen a debug ip pac det in the switch and apparently it only rejects the connection. After the first FYN TO 179 it replies with a ACK, RST. 16:08:35.118 BRST: IP: s=10.21.4.229 (GigabitEthernet3/5), d=10.21.4.226, len 40, rcvd 2 Jan 26 16:08:35.118 BRST: TCP src=179, dst=11158, seq=0, ack=965412976, win=0 ACK RST Jan 26 16:08:35.118 BRST: IP: s=10.21.4.229 (GigabitEthernet3/5), d=10.21.4.226, len 40, stop process pak for forus packet Jan 26 16:08:35.118 BRST: TCP src=179, dst=11158, seq=0, ack=965412976, win=0 ACK Im still waiting to get a more info on this problem, as Im helping a friend. But thanks for all your help. I was just wondering if someone have seen something similar. When you have to shutdown 1 bgp peer to get the other established. ... View more

3 switches connected on the same VLAN/subnet are trying to establish BGP session. So, imagine a CD-A 1.1.1.2/24 and CD-B 1.1.1.3/24 trying to peer with SW1 IP 1.1.1.1/24 cd-a neighbor 1.1.1.1 remote-as 1 cd-b neighbor 1.1.1.1 remote-as 1 sw1 neighbor 1.1.1.2 remote-as 2 neighbor 1.1.1.3 remote-as 2 If I shutdown cd-a, then b establish BGP, if I shut cd-b then cd-a establishes it. Those are directly connected , so no point in using the update-source. help! ... View more

Depends on the version. http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/inspect.html#wp1224614 Regards, Vlad ... View more

I did some research and yes its possible. You need to define 2 static policy nat. example: real ip on DMZ 20.20.20.20 nat ip on inside 192.168.100.20 Make sure you configure the correct order: static (DMZ,inside) 192.168.100.20 access-list acl_policy1 static (DMZ,inside) 20.20.20.20 access-list acl_policy2 access-list acl_policy1 extended permit ip host 20.20.20.20 any access-list acl_policy2 extended permit ip host 20.20.20.20 any Telnet from a client on the inside network to the DMZ server using both IPs natted and real. client#192.168.100.20 80 Trying 192.168.100.20, 80 ... Open get HTTP/1.1 400 Bad Request Date: Mon, 01 Mar 1993 03:41:13 GMT Server: cisco-IOS Accept-Ranges: none 400 Bad Request [Connection to 192.168.100.20 closed by foreign host] client#20.20.20.20 80 Trying 20.20.20.20, 80 ... Open get \HTTP/1.1 400 Bad Request Date: Mon, 01 Mar 1993 03:41:21 GMT Server: cisco-IOS Accept-Ranges: none 400 Bad Request [Connection to 20.20.20.20 closed by foreign host] client# ... View more

And do you know why? There's one book that shows the NAT order of operation as being first check NAT exemption, then static NAT. Let us know. ... View more

Hello Are you doing multicast sparse-mode using auto RP? there should be no multicat traffic to your router if no host joins the multicast groups. Regards, Vlad ... View more

Hello Sorry but you lost me. We need to know the exact topology/configuration to be able to help you troubleshooting the real problem then. Let us know. ... View more

Hello Matt, Do you know if the tunnels are up all time? Sometime due to a recursive routing the tunnels may go down. You would see something like: .Sep 16 11:46:00.218 EDT: %TUN-5-RECURDOWN: Tunnel1 temporarily disabled due to recursive routing Try a debug ip routing, debup ip eigrp, debug int tunnel in both routers. And let us know if you see something interesting. Regards, Vlad ... View more

Hello Vaniello, I believe the best way would be filtering the groups you dont want to join. If you control the RP maybe you should use: ip pim accept-rp {rp-address | auto-rp} [access-list] Or simply dont allow any host to join the groups you dont want to receive traffic: ip igmp access-group To restrict hosts (receivers) on a subnet to joining only multicast groups that are permitted by a standard IP access list or to restrict hosts (receivers) on a subnet to membership to only the (S,G) channels that are permitted by an extended IP access list, use the ip igmp access-group command in interface configuration mode. ip igmp access-group access-list Let me know if this helps. Vlad ... View more

Hello my friend Ronaldo, This message indicates that the EARL Layer 2 ASIC detected a nonfatal condition in the bank 0 address 0xE564 of the forwarding table. Regards, Vlad ... View more