Infrastructure

ESI Multi-Homing and ARP Suppression Issue: Duplicate Packets & Flooding When ESI is not functioning correctly, you may observe duplicate packets destined for hosts behind the ESI. Remote switches might flood traffic toward the ESI switches instead of handling it efficiently. TCAM Carving for ARP Suppression To use the suppress-arp feature effectively and prevent unnecessary flooding, you must allocate sufficient TCAM resources on the switch hardware. 1 2 3 # Configure TCAM carving for ARP suppression hardware access-list tcam region racl 512 hardware access-list tcam region arp-ether 256 double-wide Warning: It was observed that enabling suppress-arp caused reachability and ARP resolution to break between hosts when attempting to use RFC 5549 (BGP Unnumbered / IPv6 underlay) between Spines and Leafs for IPv4 and EVPN. Note that an IPv6 underlay is generally not supported for Cisco Nexus 9300/9500v platforms in this context. ...

Overview This document outlines the security policies and dynamic routing configurations for the network gateway, including firewall rules via nftables and BGP peering via BIRD. How Zones are Defined and Connected In this architecture, zones (zone_blue, zone_green, zone_red, and wan) directly correspond to network interfaces (either physical NICs, VLAN tags, or bridge interfaces) on the Gateway Server. Chain Structure (nftables): The firewall strictly controls traffic flow by matching the input interface (iif) and output interface (oif). For example, iif zone_blue oif zone_green tcp dport 22 accept explicitly states: If a packet enters the server via the zone_blue interface and is destined to leave via the zone_green interface on TCP Port 22, allow it. ...

When running Cisco ASR1000 with ISG (Internet Services Gateway) or BNG (Broadband Network Gateway) functionality, bulk session state changes — particularly when many subscriber sessions drop and reconnect simultaneously — can cause session setup failures and CPU overload. Proper tuning of L2TP window sizing and call admission control prevents cascading failures. L2TP Congestion Avoidance When PPPoEoL2TP tunnels experience flaps (rapid up/down cycles), user sessions often fail to establish properly during the recovery phase. This is typically related to the L2TP window size (WS) parameter negotiated during tunnel setup. ...