Issue in Sub-interface traffic on cisco 7609-s router
Hello please support,
I configured sub-interfaces and it is working properly, but some time sub-interface show traffic more then physical interface .
Like
int gi 3/32 0.13 Mbps 12:00 PM
int gi 3/32.11 855 Mbps 12:00 PM
as per my knowledge physical interface have cumulative traffic of all sub-interfaces.
interface GigabitEthernet3/32
no ip address
interface GigabitEthernet3/32.10
encapsulation dot1Q 10
ip address 172.20.128.77 255.255.255.252
ip ospf network point-to-point
ip ospf bfd
bfd interval 50 min_rx 50 multiplier 5
no bfd echo
no cdp enable
interface GigabitEthernet3/32.11
description interlink MPLS
encapsulation dot1Q 11
ip address 172.20.129.73 255.255.255.252
ip ospf network point-to-point
mpls ip
mpls label protocol ldp
Regards,
Damodar Nagar
I have not that graph so I am just guessing that you are noticing the difference between policing and shaping. It seems to me you are applying these techniques on each platform on a different way. Try to shape/police in the same order or only to shape.
Hope to help
Alessio
Sent from Cisco Technical Support iPad App
Similar Messages
-
Strange issue - unable to establish PPP with Cisco 887 VAG router on one particular ADSL line
I have a strange problem that I’m struggling to get to the bottom of with my ISP and wondered if anyone could help.
We have a site with an older Cisco 877 ADSL router which was working happily until a few weeks ago when the connection dropped suddenly (out-of-hours at 2am if that’s of any significance – made me think most likely something carrier/ISP related?) When connectivity was lost, the router could sync with the BT exchange (we are in the UK) but could not establish PPP.
We logged fault with our ISP – after some to’ing and fro’ing, they passed it onto BT and their engineers visited site, they fixed “a line fault” (we don’t get much detail on what was actually fixed) but we still could not establish connectivity – same thing, solid CD light but no PPP.
So, we replaced the router with another 877 – same again, solid CD but no PPP. We replaced all the cables and microfilter etc but no difference.
We tried a different Cisco router (a newer Cisco 887VAG) which, as I understand, uses a different modem chipset but no matter – PPP could still not be established. We tested this router on another ADSL line with the same ISP and it worked without issue, using the same ADSL account details, it was able to establish connectivity. So we figured this must still be a BT/ISP issue.
Since then we’ve had BT out again twice but they say there is no fault. The ISP say there is no issue with them. But we still cannot establish ADSL connectivity on this line, despite having tried 3 different ADSL routers and despite the fact the routers work with the same account details on another ADSL line.
The 887VAG router we have currently connected has 3G backup so that is keeping us going in the meantime and also means I can login to the router remotely to check on the ADSL status.
But I’m struggling to pinpoint where the problem may lie. Strangely, if I turn on PPP negotiation and authentication debug then I’m not actually seeing any output from it at all?
Yet, the ATM interface is up and shows packets being sent and received:
ATM0 is up, line protocol is up
Hardware is MPC ATMSAR, address is bc16.6596.9b00 (bia bc16.6596.9b00)
MTU 1600 bytes, sub MTU 1600, BW 704 Kbit/sec, DLY 520 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ATM, loopback not set
Keepalive not supported
Encapsulation(s): AAL5
4 maximum active VCs, 1024 VCs per VP, 1 current VCCs
VC Auto Creation Disabled.
VC idle disconnect time: 300 seconds
Last input 00:00:28, output 00:00:07, output hang never
Last clearing of "show interface" counters 6d23h
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: Per VC Queueing
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
23886 packets input, 1676964 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
56469 packets output, 4418592 bytes, 0 underruns
0 output errors, 0 collisions, 6 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
Does anyone have any ideas on where the problem may be and what more I can do to troubleshoot and provide the relevant evidence to our ISP (assuming it is an ISP/BT issue though the fact the same router works ok with the exact same details etc would seem to indicate it must be their issue!)Hi Jody,
thanks for the suggestions. Here's what I see from the ppp debugs (but I'm not sure how to interpret?)
Jan 6 14:50:22.838: pppoe_send_padi:
contiguous pak, size 74
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 FF FF
FF FF FF FF BC 16 65 96 9B 00 88 63 11 09 00 00
00 10 01 01 00 00 01 03 00 08 0C 00 00 01 00 00
04 A3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 ...
Jan 6 14:50:22.878: PPPoE 0: I PADO R:0030.8810.000b L:bc16.6596.9b00 0/38 ATM0.1
contiguous pak, size 71
BC 16 65 96 9B 00 00 30 88 10 00 0B 88 63 11 07
00 00 00 33 01 03 00 08 0C 00 00 01 00 00 04 A3
01 02 00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73
2D 62 61 73 2D 42 32 32 36 45 34 37 30 39 45 30
31 34 5A 01 01 00 00
Jan 6 14:50:24.885: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:50:35.125: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:50:45.364: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:50:55.603: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:51:05.843: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:51:16.114: OUT PADR from PPPoE Session
contiguous pak, size 85
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 30
88 10 00 0B BC 16 65 96 9B 00 88 63 11 19 00 00
00 33 01 03 00 08 0C 00 00 01 00 00 04 A3 01 02
00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73 2D 62
61 73 2D 42 32 32 36 45 ...
Jan 6 14:51:26.353: [0]PPPoE 0: O PADT R:0000.0000.0000 L:0000.0000.0000 0/38 ATM0.1
contiguous pak, size 74
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 00 00
00 00 00 00 00 00 00 00 00 00 88 63 11 A7 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 ...
Jan 6 14:51:46.576: pppoe_send_padi:
contiguous pak, size 74
00 01 09 00 AA AA 03 00 80 C2 00 07 00 00 FF FF
FF FF FF FF BC 16 65 96 9B 00 88 63 11 09 00 00
00 10 01 01 00 00 01 03 00 08 0C 00 00 01 00 00
04 A3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 ...
Jan 6 14:51:46.608: PPPoE 0: I PADO R:0030.8810.000b L:bc16.6596.9b00 0/38 ATM0.1
contiguous pak, size 71
BC 16 65 96 9B 00 00 30 88 10 00 0B 88 63 11 07
00 00 00 33 01 03 00 08 0C 00 00 01 00 00 04 A3
01 02 00 1F 62 72 61 73 2D 72 65 64 37 2E 6C 73
2D 62 61 73 2D 42 32 32 36 45 34 37 30 39 45 30
31 34 5A 01 01 00 00
Provider wouldn't have bumped us from ADSL to VDSL - but here's the output of show controller vdsl 0:
Controller VDSL 0 is UP
Daemon Status: Up
XTU-R (DS) XTU-C (US)
Chip Vendor ID: 'BDCM' 'IFTN'
Chip Vendor Specific: 0x0000 0x71C8
Chip Vendor Country: 0xB500 0xB500
Modem Vendor ID: 'CSCO' ' '
Modem Vendor Specific: 0x4602 0x0000
Modem Vendor Country: 0xB500 0x0000
Serial Number Near: FCZ1111C08V C887VAG 15.2(4)M
Serial Number Far:
Modem Version Near: 15.2(4)M
Modem Version Far: 0x71c8
Modem Status: TC Sync (Showtime!)
DSL Config Mode: AUTO
Trained Mode: G.992.1 (ADSL) Annex A
TC Mode: ATM
Selftest Result: 0x00
DELT configuration: disabled
DELT state: not running
Trellis: ON ON
SRA: disabled disabled
SRA count: 0 0
Bit swap: enabled enabled
Bit swap count: 1 8
Line Attenuation: 54.5 dB 31.5 dB
Signal Attenuation: 54.5 dB 0.0 dB
Noise Margin: 6.7 dB 11.0 dB
Attainable Rate: 2132 kbits/s 888 kbits/s
Actual Power: 16.7 dBm 12.7 dBm
Total FECC: 546 0
Total ES: 6 0
Total SES: 0 0
Total LOSS: 0 0
Total UAS: 486 486
Total LPRS: 0 0
Total LOFS: 0 0
Total LOLS: 0 0
Full inits: 14
Failed full inits: 1
Short inits: 0
Failed short inits: 1
Firmware Source File Name (version)
VDSL user config flash:vdsl.bin-A2pv6C035d_d23j (10)
Modem FW Version: 110802_1752-4.02L.03.A2pv6C035d.d23j
Modem PHY Version: A2pv6C035d.d23j
Vendor Version:
DS Channel1 DS Channel0 US Channel1 US Channel0
Speed (kbps): 0 1664 0 704
SRA Previous Speed: 0 0 0 0
Previous Speed: 0 1600 0 736
Total Cells: 0 2786872 0 0
User Cells: 0 68 0 0
Reed-Solomon EC: 0 546 0 0
CRC Errors: 0 9 0 0
Header Errors: 0 10 0 0
Interleave (ms): 0.00 8.00 0.00 8.00
Actual INP: 0.00 1.12 0.00 1.28
Training Log : Stopped
Training Log Filename : flash:vdsllog.bin
And here's the output from the ATM and dialer interfaces:
interface ATM0
no ip address
ip flow ingress
no atm ilmi-keepalive
end
interface ATM0.1 point-to-point
ip flow ingress
pvc 0/38
pppoe-client dial-pool-number 2
end
interface Dialer2
description OUTSIDE
ip address negotiated
ip access-group firewall in
ip mtu 1492
ip flow ingress
ip nat outside
ip inspect DEFAULT100 out
ip virtual-reassembly in
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap callin
ppp chap hostname ###removed###
ppp chap password ###removed###
no cdp enable
crypto map dcvpn
end
As I say though, config-wise, everything should be correct - the same router works fine on another line (which should also confirm the authentication details are correct - at least in as far as it matches what the ISP have on their RADIUS)
Any further thoughts? -
Cisco Prime Monitor Sub Interfaces
We are currently running Cisco Prime 2.1 and trying to monitor sub interfaces on our Cisco 7606. We can see the sub interfaces by:
Operate | Device Work Center
Select Quick Filter (to find the 7606)
Select Interfaces
Select IP Interfaces
The sub interfaces that we wish to monitor are displayed (with the above steps). However, when we try to select the interface to monitor, the sub interfaces do not appear:
Home | Detail Dashboard
Select Interface
Select the interface pull-down | All | 7606
We do not see the sub interfaces, only 2 interfaces are displayed. We do not see the interface GigabitEthernet4/7 at all. What are we missing here?i couldn't find the appropriate MIB to monitor the call session
-
HSRP using sub-interfaces,
I'm planning a design that will need two 2950s to support 4 vlans. Non-local traffic will be routed out via one of two HSRP routers (one pair of vlans using router 1 as a primary, the other pair using router 2).
I've dug around the cisco documentation but can't find an answer to the following...
Does HSRP run ok over sub-interfaces?
For example, VLAN 1 default gateway will be HSRP (virtual) router's f0/0.1 x.x.x.x, VLAN 2 default gateway will be HSRP router's f0/0.2 x.x.x.x, etc.
Any ideas?Hi Dwatson,
YES, HSRP supports on sub-interfaces also & there wouldn't be any problems.YES the default gateway would be the HSRP standby ip address specified on the sub-interface for the vlans.
eg.
Router A
interface FastEthernet0/0.1
description ***ABC***
encapsulation dot1Q 1
ip address 172.16.1.2 255.255.0.0
standby 1 ip 172.16.1.1
standby 1 timers 5 15
standby 1 priority 108
standby 1 preempt
Router B
interface FastEthernet0/0.1
description ***ABC***
encapsulation dot1Q 1
ip address 172.16.1.3 255.255.0.0
standby 1 ip 172.16.1.1
standby 1 timers 5 15
standby 1 priority 109
standby 1 preempt
Note donot give any ip address on the fastethernet interface.
interface fasthethernet 0/0
no ip address
hope this helps.
rate this post if cleared -
We have created a Gigabitethernet sub-interface on a router, But when removing this with command :-
Router(config)#no int gig2/3.1
It is not removed and still showing in interface list with "deleted" status (i.e Gi2/3.1 deleted down).
Please share the process for permanently removing the sub-interface from list.
ThxnsTxns..Srry but last querry now.I have created a sub-interface Gig2/3.1 with configs.Router#sh run int Gig2/3.1
Building configuration...Current configuration : 186 bytes
interface GigabitEthernet2/3.1
description CONNECTED TO NetCore
encapsulation dot1Q 99
ip address 172.50.140.1 255.255.255.252
endBut
with this configs, The remote end IP of this interface (172.50.140.2)
was reachable but there are drops(approx 30 drops) on the same after
every 40-50 replies. one of my freind suggested me for configuring
below commands under sub-interface(but he seems to be confused about
the purpose of this commands).ip rip send version 1 2
ip rip receive version 1 2After
executing abne cmmds , now there is no drops. What these commds are
doing wht is the purpose of the command, after executing these why ping
/ reachability drops problems rectified. is this standard to configure
this commands under sub-interface...? pls***
Hi,
Those commands are useful to send and recieve RIP version to be sent or recive in interface with counter part neighbour.
To control which RIP version an interface sends, use one of the following commands in interface configuration mode:
ip rip send version 1 2 Configure an interface to send RIP Version 1 and Version 2 packets.
Similarly, to control how packets received from an interface are processed, use one of the following commands in interface configuration mode:
ip rip receive version 1 2 Configure an interface to accept either RIP Version 1 or 2 packets.
Hope to Help !!
If helpful do rate the useful post
Ganesh.H -
Configuring New Interface and NAT on Cisco 1900 Series Router.
Hello Cisco Team,
am asking for advise on how to how setup NAT rules and overload on my 2nd interface on my cisco 1900 series router,am not sure where am getting it wrong.
my router has 2 interface, interface one has IP address 10.5.5.5X and plugs into my ASA firwall and into my switch and works just fine.
i have just configured my second Interface with a new IP 172.16.0.X- i want to NAT my new IP address to our public IP address which is 41.77.X.X
my configuration so far are as follows.
GigabitEthernet0/0 172.16.0.X YES manual up up - Not working
GigabitEthernet0/1 10.5.5.X YES NVRAM up up- this works fine
GigabitEthernet0/0/0 41.77.X.X YES NVRAM up upHello Jon,
Thanks for your feedback, my router configuration are as follows.
interface GigabitEthernet0/0
description WL2504
ip address 172.16.0.2 255.255.254.0
duplex auto
speed auto
interface GigabitEthernet0/1
description WAN
ip address 10.55.55.2 255.255.255.252
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
interface GigabitEthernet0/0/0
description LINK TO CLT INTERNET
ip address 41.X.X.130 255.255.255.248
ip nat outside
ip virtual-reassembly in
duplex full
speed 100
media-type sfp
ip forward-protocol nd
no ip http server
no ip http secure-server
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip route 0.0.0.0 0.0.0.0 41.X.X.129
ip route 41.X.X.136 255.255.255.248 10.55.55.1
ip route 192.168.0.0 255.255.255.0 10.55.55.1
access-list 1 permit 10.55.55.0 0.0.0.255
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 1 permit 192.168.1.0 0.0.0.255
from the router interface interface GigabitEthernet0/0- I will connect it to my wireless Controller WL 2504 -
Include multiple sub-interfaces in Cisco ASA for VPN tunnel
I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces.
Say, In Cisco ASA 5550(in datacentre), I created multiple subinterfaces with VLAN ID as below:
Inside, int0/1 : 10.1.1.0/24
DMZ, int0/1.100: 10.1.100.0/24 (VLAN 100)
Production, int 0/1.101 : 10.1.101.0/24 (VLAN 101)
Management, int 0/1.102: 10.1.102.0/24 (VLAN 102)
And another Cisco ASA 5505 is only configured with 1 x inside interface Inside, int 0/1: 192.168.1.0/24
So far, I have only been able to provide outside access to one of the sub-interfaces as NAT rule on inside interface didn't work for VLANs. Hence had to issue Global NAT rule to be applied on Production subinterface so that production VLAN can have outside access. I have managed to establish VPN tunnel between two ASAs on Production sub-interface only, Source interface = Production subinterface
Additional settings:
Have ACL to allow all sub interfaces to access outsite ( lower security level)
NAT rules is configured on Production subinterface with Source NAT Type as Dynamic PAT; when this was configured with source interface as inside, PCs behind various VLAN coun't access internet.
I want to establish a site-to-site VPN tunnel with multiple sub-interfaces of Cisco ASA 5550 to Cisco ASA 5505. Would you please suggest what I am missing in my configuration? I need to be able to access multiple VLANs of datacentre from remote site.I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces.
Say, In Cisco ASA 5550(in datacentre), I created multiple subinterfaces with VLAN ID as below:
Inside, int0/1 : 10.1.1.0/24
DMZ, int0/1.100: 10.1.100.0/24 (VLAN 100)
Production, int 0/1.101 : 10.1.101.0/24 (VLAN 101)
Management, int 0/1.102: 10.1.102.0/24 (VLAN 102)
And another Cisco ASA 5505 is only configured with 1 x inside interface Inside, int 0/1: 192.168.1.0/24
So far, I have only been able to provide outside access to one of the sub-interfaces as NAT rule on inside interface didn't work for VLANs. Hence had to issue Global NAT rule to be applied on Production subinterface so that production VLAN can have outside access. I have managed to establish VPN tunnel between two ASAs on Production sub-interface only, Source interface = Production subinterface
Additional settings:
Have ACL to allow all sub interfaces to access outsite ( lower security level)
NAT rules is configured on Production subinterface with Source NAT Type as Dynamic PAT; when this was configured with source interface as inside, PCs behind various VLAN coun't access internet.
I want to establish a site-to-site VPN tunnel with multiple sub-interfaces of Cisco ASA 5550 to Cisco ASA 5505. Would you please suggest what I am missing in my configuration? I need to be able to access multiple VLANs of datacentre from remote site. -
Cisco 7609 router received higher traffic than upstream provider router is sending
Hi all,
I have a Cisco 7609 router that connects to our upstream provider router using 3rd party DWDM Fiber backhaul provider.
The upstream provider router is a Juniper router that had capped our port speed to 1.1Gbps, the backhaul provider didn't capped our port speed and the maximum speed is 2Gbps since it's a 2x1Gbps port channel interface.
I have noticed that our 7609 router able to receive traffic that exceeds 1.1Gbps, and the highest traffic able to received is 1.3Gbps and more.
I have crossed checked the MRTG graph provided by our upstream provider as well as our PRTG graph and indeed we are receiving higher bandwidth than our upstream provider is sending.
I'd like to know if anyone know how it is possible to receive traffic that is higher than what the neighbor router is sending?
RegardsHi at all,
We found a solution for this Problem !!
We always and always got this error:
%PQUICC-1-LOSTCARR: Unit 0, lost carrier. Transceiver problem?
The problem was the cable! The following pin-out is required:
1 ----- 1
2 ----- 2
3 ----- 6
4 ----- 5
5 ----- 4
6 ----- 3
7 ----- 7
8 ----- 8
We used this and the fault has disappeared!!
The only problem that still exists:
After the first connection the router must be rebooted because otherwise no more additional session is established.
Thanks for all answers.
Regards,
Mario -
Traffic Shaping on Sub-interfaces
Hi all,
On my network i am trying to give preference to certain traffic type A over another traffice type B over a VSAT link.
the VSAT link is about 64Kbps/64Kbps and this link is connected to a router subinterface.
I initially thought of CBWFQ to reserve bandwidth for the differenct traffic types but there are restrictions to using CBWFQ on Sub interfaces.
Hence I tot of the option of shaping the less preffered traffic to a less than half the bandwidth say 24K will be a good idea however i worry that the contents of the shaping queue will constitute both the preffered traffic and the less preffered traffic hence introducing more delay to the more preffered traffic. which is not required.
Any other better ways to achieve this?You can use hierarchical qos:
http://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a0080114326.shtml -
Hi,
I regularly use bridge domains to connect sub interfaces on different vlans using this sort of configuration:
interface GigabitEthernet0/0/0/5.21 l2transport
description CUSTOMER A WAN
encapsulation dot1q 21
rewrite ingress tag pop 1 symmetric
interface GigabitEthernet0/0/0/10.3122 l2transport
description CUSTOMER A CORE
encapsulation dot1q 3122
rewrite ingress tag pop 1 symmetric
l2vpn
bridge group WANLINKS
bridge-domain CUSTOMERA
interface GigabitEthernet0/0/0/5.21
interface GigabitEthernet0/0/0/10.3122
When I try to use the same method to bridge two sub interfaces on the same physical interface so as to create a L2 VPN no data flows:
interface GigabitEthernet0/0/0/5.21 l2transport
description CUSTOMER A WAN
encapsulation dot1q 21
rewrite ingress tag pop 1 symmetric
interface GigabitEthernet0/0/0/5.22 l2transport
description CUSTOMER A WAN2
encapsulation dot1q 22
rewrite ingress tag pop 1 symmetric
l2vpn
bridge group WANLINKS
bridge-domain CUSTOMERA
interface GigabitEthernet0/0/0/5.21
interface GigabitEthernet0/0/0/5.22
If I add a BVI interface to the bridge domain then the CE devices at the remote end of the WAN interface can both ping the BVI IP but they remain unable to ping each other.
Is this because tag rewrites are not happening since packets don't leave the physical interface?
How can I work around this and establish a L2 connection between the two subinterfaces?
Thank youa vlan is usually the equivalent of an l3 subnet, so linking 2 vlans together in the same bridge domain, likely needs to come with some sort of routing (eg a BVI interface).
If these 2 vlans are still in the same subnet, then there is still arp going on, from one host to the other that traverses the bD.
you will need to verify the state of the AC, the forwarding in the BD and see if something gets dropped somewhere and follow the generic packet troubleshooting guides (see support forums for that also).
that might give a hint to what the precise issue in your forwarding is.
regards
xander -
Can I rate-limit on the sub-interface in cisco asr 1013?
Hi,
I am looking for the command of rate-limit on a sub-interface in cisco asr 1013.
Cisco IOS Software, IOS-XE Software (X86_64_LINUX_IOSD-ADVENTERPRISEK9-M), Version 15.2(2)S, RELEASE SOFTWARE (fc1)
IOS XE Version: 03.06.00.S
Please let me know if it is possible in cisco asr 1013. If yes then what are the commands.
ZobairThe ASR no longer supports the rate-limit command, but it does support the same functionality in a QoS policy.
Please find a sample configuration -
ASR1004(config)#policy-map test
ASR1004(config-pmap)#class class-default
ASR1004(config-pmap-c)#shape average 10000
Applying for both ingress and egress : -
ASR1004(config)#int gig1/1/0
ASR1004(config-if)#service-policy output test
or
ASR1004(config-if)#service-policy input test -
Cisco Zone-based firewall issue/ not receiving return traffic
Hi,
I have created a Cisoc IOS Zone based firewall on my cisco 3945 router. I have an issue receiving any returning traffic. Here is a simplified version of my issue.
I have two zone pairs: Internal to Outside and Outside to Internal.
In the zone pair Out-to-Int I have a few rules allowing connections to specific servers on specific ports. The default class-map drops any non-matching packets.
In the zone pair Int-to-Out I have a rule saying internal PCs can access any destination on the internet over “any” service. When I put the action as “Inspect” I cannot connect to the internet. It’s as if my return traffic is not detected by the firewall and instead gets dropped by the default class map in the Out-to-Int pair.
To make it work I need to do two changes. I need to choose Allow instead of Inspect and I need to change the default class-map on the Out-to-Int pair to “allow” for unmatched traffic. But this is not good because I have a default allow on my out-to-int pair.
Am I misunderstanding something? Shouldn’t the inspect action on the Int-to-Out zone allow for return traffic no matter what rules I applied on the Out-to-Int pair? Thank you in advance for your help.Please share your config. Then we can see what's wrong there.
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni -
Cisco 7609 - optical gigabit interface
Hi all,
I have a strange problem with the optical gigabit interface of a Cisco
switch 7609. This is the problem:
I have two 7609 cisco switch (A and B) cross connect with a optical
fiber.
All port of both switches are configured as followed:
switchport
switchport mode acces
shutdown
no cdp enable
no ip address
end
With the same optical fiber cable i have connect two ports of the switches and I brough up the interface.
I got the following result if i run 'show ip interface brief' on the switches:
SW A - SW B
port 1 - port 1 --> link down protocol down
port 2 - port 1 --> link up protocol up
port 1 - port 2 --> link up protocol up
port 2 - port 2 --> link up protocol up
Why if i connect port 1 on both switches the link don't brought up?
Have anyone some idea for the possible cause of the problem?
Thank you
BR
\SergioTry:
http://www.cisco.com/en/US/products/ps6902/products_implementation_design_guide_chapter09186a008062f863.html -
Sub interface features only in cisco routers?
is sub interface feature available only in cisco routers? any body has any clue?
as far as I know, only router provides sub-interface.
Gilles. -
Routing Issue Accessing Inside Interface of ASA
Ok so I'm making this more complex than it needs to be and can't see the forest for the trees. I'm setting up an ASA 5510 with multiple contexts. I'm working with my main internal context for my internal traffic. I have created interfaces on this context as follows:
interface Ethernet0/0.1
description outside interface
nameif outside
security-level 0
ip address 1.1.1.2 255.255.255.252
interface Ethernet0/1.1
description inside interface for internal context
nameif inside
security-level 100
ip address 10.10.50.150 255.255.0.0
same-security-traffic permit intra-interface
route outside 0.0.0.0 0.0.0.0 1.1.1.1
NOTE: Also has ssh configuration but can't document that here.
My workstation has an IP 10.10.30.20 255.255.0.0 with a default gateway that points to my core switch (10.10.50.151).
When I try to access the inside interface of the ASA via ssh from my workstation I can't connect. I tried to ping the inside interface IP address of the ASA from my workstation and it doesn't reply. I can however ping anything on my internal network from the ASA through the inside interface. What am I missing on this?
Thanks.I figured out this issue but now have a new issue. The problem I had accessing the internal network from the ASA was due to the core switch I was being routed through. After looking at the core I saw that the default route was redirecting all traffic to the IP address of the inside interface on the production ASA. I have since pulled a spare switch and created an isolated network with a laptop and the inside interface on the new ASA. This worked great.
Now to my new problem. I am trying to access our ISPs external address from the ASA. The ISP has provided us with two vlans (100 and 101) on one connection and has given us two public IPs (one is the IP for the router on their end and the second is the IP I am supposed to use on my outside interface for vlan 100). I have created sub-interfaces on my outside interface and defined 0/0.1 as vlan 100 and 0/0.2 as vlan 101. VLAN 101 will go to our rack at our disaster recovery site so it will just be an extension of our existing network.
My network is as follows:
ISP (IP 2.2.2.1)
|
|
3560-CG switch (both ports -- to ISP and ASA outside interface are configured as trunk ports)
|
|
ASA (outside 2.2.2.2 vlan 100)
When I try to ping the 2.2.2.1 address from the ASA it doesn't work. If both my ASA outside port and the port to the ISP are both trunk ports shouldn't it route both VLANs (100 and 101) without any issue or am I missing something in my thinking?
Thanks.
Maybe you are looking for
-
IPod no longer mounting on Desktop or appearing in iTunes sidebar
After upgrading to iTunes 7 (7.0.2 installed), my iPod with Video will no longer mount on the desktop and does not appear in the iTunes sidebar. When I am recharging/updating the content of my iPod, I am unsure when to disconnect, as I am getting 'Do
-
Webi 4.0 Custom Sort for SSAS Hierarchy
Hi, I'm using SSAS cube as a source for my webi report .Some report need custom sorting for hierarchy object , we are not able to apply sorting correctly in webi. What do i need to do in order to apply the custom sorting for hierarchy object? Thanks
-
R/3 Date Conversion problem
How to convert the R/3 Date to Array.
-
ITunes not listing all groups in Contacts
I am trying to sync with my contacts in Outlook. I recently added a new group/folder, into which I moved all 'miscellaneous' contacts that weren't already grouped. Now I am trying to sync, and iTunes won't display the new folder. I have rebooted the
-
Hi All, I am able to create transaction variant for transaction code MM01, XD01 and XK01 successfully. But i am unable to create transaction variant for VA01. And also some times i am getting error message "SAP Object SCV1(short text of variant) cann