Cisco

ESI Multi-Homing and ARP Suppression Issue: Duplicate Packets & Flooding When ESI is not functioning correctly, you may observe duplicate packets destined for hosts behind the ESI. Remote switches might flood traffic toward the ESI switches instead of handling it efficiently. TCAM Carving for ARP Suppression To use the suppress-arp feature effectively and prevent unnecessary flooding, you must allocate sufficient TCAM resources on the switch hardware. 1 2 3 # Configure TCAM carving for ARP suppression hardware access-list tcam region racl 512 hardware access-list tcam region arp-ether 256 double-wide Warning: It was observed that enabling suppress-arp caused reachability and ARP resolution to break between hosts when attempting to use RFC 5549 (BGP Unnumbered / IPv6 underlay) between Spines and Leafs for IPv4 and EVPN. Note that an IPv6 underlay is generally not supported for Cisco Nexus 9300/9500v platforms in this context. ...

⚠️ Modernization Notice These notes were written in 2018–2019. IPv6 CPE and OS support, DHCPv6 implementations, and ISP best practices have evolved significantly since then. Treat this as a record of real testing and the architectural decisions behind it, and validate against current RFCs, CPE datasheets, and OS release notes before deploying in production. Overview This post brings together two pieces of work I did on IPv6 for PPP broadband. The first is a set of notes and lab tests on running a single dual-stack PPP session per subscriber and assigning IPv6 prefixes to the CPE from a Cisco IOS XE BNG. The second is a design sketch for assigning static IPv6 prefixes per customer from a RADIUS/AAA backend. They belong together: the lab work shows how Cisco ISG/IOS XE actually behaves when prefixes arrive over RADIUS, and the design sketch is the natural next step once you decide that static, per-customer prefixes are what you want. ...

When troubleshooting MTU and ICMP reachability across vendor platforms, understanding how each calculates the ping packet size is critical. Cisco, Juniper, and PC operating systems all interpret the ping size parameter differently, leading to different on-wire packet lengths. Cisco In Cisco, the ping size parameter specifies the total packet size including the IP header (20 bytes) and ICMP header (8 bytes). The data payload is what remains. The encapsulation headers added by the egress interface will be included on top of this size. Importantly, the MTU command under an interface specifies the L2 payload size — the maximum data + IP + ICMP that the interface will forward. So if you set MTU 1500 on an Ethernet interface, the on-wire frame size will be 1500 + 14 bytes (Ethernet header) = 1514 bytes. For VLAN-tagged frames, add another 4 bytes (802.1Q tag). ...

⚠️ Modernization Notice This post is based on notes I took in 2018 against Cisco IOS XE / ISG on the ASR 1000. The VRF placement rules and the MPLS-VPN restriction described here reflect the behavior I observed at the time. Treat the specifics as a record of what I tested, and validate against the current IOS XE ISG configuration guides before deploying. Background On the ASR 1000, ISG (Intelligent Services Gateway) handles subscriber web logon — the “captive portal” experience where an unauthenticated subscriber’s HTTP traffic is intercepted and redirected to a login or service-selection portal. Two ISG features work together to make this happen: ...

When running Cisco ASR1000 with ISG (Internet Services Gateway) or BNG (Broadband Network Gateway) functionality, bulk session state changes — particularly when many subscriber sessions drop and reconnect simultaneously — can cause session setup failures and CPU overload. Proper tuning of L2TP window sizing and call admission control prevents cascading failures. L2TP Congestion Avoidance When PPPoEoL2TP tunnels experience flaps (rapid up/down cycles), user sessions often fail to establish properly during the recovery phase. This is typically related to the L2TP window size (WS) parameter negotiated during tunnel setup. ...