Troubleshooting

ESI Multi-Homing and ARP Suppression Issue: Duplicate Packets & Flooding When ESI is not functioning correctly, you may observe duplicate packets destined for hosts behind the ESI. Remote switches might flood traffic toward the ESI switches instead of handling it efficiently. TCAM Carving for ARP Suppression To use the suppress-arp feature effectively and prevent unnecessary flooding, you must allocate sufficient TCAM resources on the switch hardware. 1 2 3 # Configure TCAM carving for ARP suppression hardware access-list tcam region racl 512 hardware access-list tcam region arp-ether 256 double-wide Warning: It was observed that enabling suppress-arp caused reachability and ARP resolution to break between hosts when attempting to use RFC 5549 (BGP Unnumbered / IPv6 underlay) between Spines and Leafs for IPv4 and EVPN. Note that an IPv6 underlay is generally not supported for Cisco Nexus 9300/9500v platforms in this context. ...

In an EVPN/VXLAN fabric, the MAC address table is part of the control plane: when a MAC is learned or removed, the switch generates a BGP EVPN update so the rest of the fabric stays in sync. That tight coupling is exactly what makes EVPN work — but it also means that ordinary MAC aging on a quiet host can turn into a stream of BGP churn. This post is about a problem we chased down to the interaction between ARP timeout and MAC address-table timeout, and why the common assumption about “any packet refreshes the timer” is wrong. ...

⚠️ Modernization Notice These notes were written in 2018–2019. IPv6 CPE and OS support, DHCPv6 implementations, and ISP best practices have evolved significantly since then. Treat this as a record of real testing and the architectural decisions behind it, and validate against current RFCs, CPE datasheets, and OS release notes before deploying in production. Overview This post brings together two pieces of work I did on IPv6 for PPP broadband. The first is a set of notes and lab tests on running a single dual-stack PPP session per subscriber and assigning IPv6 prefixes to the CPE from a Cisco IOS XE BNG. The second is a design sketch for assigning static IPv6 prefixes per customer from a RADIUS/AAA backend. They belong together: the lab work shows how Cisco ISG/IOS XE actually behaves when prefixes arrive over RADIUS, and the design sketch is the natural next step once you decide that static, per-customer prefixes are what you want. ...

L2VPN pseudowire (PW) behavior differs between vendor platforms and device models, particularly around how VLAN tags are handled. Understanding the differences between VC type 4 (VLAN-based) and VC type 5 (Ethernet port-based) pseudowires, and the interoperability gotchas between EVC-based and non-EVC platforms, is critical when building multi-vendor L2VPN networks. L2VPN Packet Structure The basic structure of a packet traversing an L2VPN pseudowire is: Tunnel header + VC label + Control Word + L2 PDU Control Word The control word is a 4-byte field inserted between the VC label and the L2 payload. In Cisco IOS/IOS XR, the control word is enabled by default. ...

When troubleshooting MTU and ICMP reachability across vendor platforms, understanding how each calculates the ping packet size is critical. Cisco, Juniper, and PC operating systems all interpret the ping size parameter differently, leading to different on-wire packet lengths. Cisco In Cisco, the ping size parameter specifies the total packet size including the IP header (20 bytes) and ICMP header (8 bytes). The data payload is what remains. The encapsulation headers added by the egress interface will be included on top of this size. Importantly, the MTU command under an interface specifies the L2 payload size — the maximum data + IP + ICMP that the interface will forward. So if you set MTU 1500 on an Ethernet interface, the on-wire frame size will be 1500 + 14 bytes (Ethernet header) = 1514 bytes. For VLAN-tagged frames, add another 4 bytes (802.1Q tag). ...