pbfus9

Hi all,

Two NX-OS 9000v leafs in vPC via Fabric Peering (virtual peer-link over VXLAN), downstream IOS switch dual-homed via one LACP port-channel. Every ~90s the downstream port-channel err-disables (channel-misconfig (STP)), recovers, repeats.

vPC health, consistency-parameters, LACP mode, STP bridge-id, MTU, CoPP — all clean.

debug lacp all on the leaf shows why: partner LACPDUs arrive every ~1s but get dropped before reaching the interface's state machine, resolved against the wrong if_index

if_index = 0x1a000400 (real one is 0x1a000800)

port_enabled=0

Receive pkt failed

90s later → LACP long-timeout → LACP_ST_SUSPENDED_FOR_MISCONFIGURATION → err-disable dow

Hi all,

I'm running a lab (EVE-NG) with an EVPN-VXLAN fabric built on Nexus 9000v switches (NX-OS), interconnected to an MPLS L3VPN provider network (IOS-XE routers) and I've hit what looks like a platform limitation. I'd like to confirm whether this is expected before I redesign.

Setup:

• Fabric: MP-iBGP L2VPN EVPN with Spine RRs, symmetric IRB, per-tenant VRFs with L3VNI. All working fine.
• Border PE (Nexus 9000v): MP-eBGP VPNv4 session towards the provider ASBRs (Inter-AS Option B style handoff).

What works on the Border PE:

• VPNv4 routes are received and retained (retain route-target all)
• RT import into the tenant VRF works after aligning RTs: the route shows up in the VRF RIB,

Ho 27 anni, laurea magistrale in ingegneria, lavoro come network engineer in una città medio-piccola del centro Italia (Toscana).

Attualmente ho una RAL di circa 30k, lavoro interessante, ottimo ambiente, colleghi con cui mi trovo bene e un buon equilibrio vita-lavoro. Convivo con la mia ragazza da diversi anni e nel complesso sono soddisfatto della mia situazione.

Ho però ricevuto un'offerta per un progetto internazionale molto importante, con una RAL di circa 50K. Il problema è che dovrei trasferirmi a Roma e sarei in trasferta all'estero 1/4 del tempo. Azienda gigante.

Da un lato vedo una grande opportunità di crescita professionale ed economica. Dall'altro so di essere una persona mol

Hi all,

I have a local Proxmox homelab with an OPNsense VM acting as firewall/router and a Kali VM behind it on an internal bridge. The WAN side of OPNsense is connected to another bridge mapped to the physical NIC. OPNsense is configured to NAT from my lab network to my home network.

I’m thinking about adding a WireGuard tunnel from OPNsense to a VPS (probably Aruba Cloud) and forcing all Kali traffic through it, mainly to avoid exposing my home IP during labs and authorized pentesting activities.

Does this setup make sense from an OPSEC perspective? Anything important I should pay attention to regarding leaks, routing, DNS, IPv6, or isolation between VMs?

Is this setup valid? I’m novi

Hi everyone,

I’ve been studying OSPFv3 and I’m struggling to understand the purpose of the Type 8 (Link) LSA. I know that this LSA has link-local scope and is not flooded beyond the local link.

Its purpose is to inform neighbors about:

• the router’s link-local address
• the list of IPv6 global prefixes configured on that link

I’ve read that this is important because, unlike OSPFv2 for IPv4, routers on the same link in OSPFv3 may have different global prefixes assigned to the same interface.

However, I don’t fully understand why IPv6 global prefixes are included in the Type 8 LSA. Type 9 (Intra-Area-Prefix LSAs) are used to associate IPv6 prefixes with nodes in the topology, so w

Hi all,

I'm following the ENARSI course on INE and I'm attending the course "Implementing Loop Prevention Mechanisms". During one of the lessons, the instructor (Keith) made the following example:

https://preview.redd.it/h9bfm3bqedvg1.png?width=664&format=png&auto=webp&s=cc69b831a5d0e102194c8c32f89d251812cfb0d3

There is something strange that I'm having difficult to understand in Keith's reasoning.

Keith said: "A router in Area 1 knows that to reach 3.3.0.0/16 it has to forward traffic to the ASBR in blu. The ASBR in blue knows that to reach the destination network has to send the traffic to the router in the RIP domain which is actually redistributing from RIP to OSPF.  This is not the

Hi all,

I'd like to know if there is a way to configure the Route Server (IXP) feature on Cisco IOS-XR. I've been looking online for solutions (see the link below), however, it seems to be an open problem.

https://community.cisco.com/t5/cisco-software-discussions/support-of-route-server-deployment-in-ios-xr/td-p/4931311

Thanks a lot,

Hi all,

I’m trying to reproduce a realistic Internet-scale routing environment inside a lab (EVE-NG), with access to the Internet.

The goal is to obtain a full Internet routing table (FIRT) and load it into the lab router for testing purposes. Is there any reliable way to retrieve or reconstruct the full routing table in this scenario? For example, via public data sources, APIs, or other mechanisms that can be automated and used in a lab setup.

Any ideas or pointers would be appreciated.

Thanks a lot

Hi all,

I've been studying GLBP for a while and I've a question about GLBP design. I know that in GLBP the maximum number of AVF is 4 (included the AVG since the AVG is always an AVF).

The GLBP MAC address format is 0007.b400.XXYY where:

• XX is the GLBP Group Number
• YY is the AVF number.

However, in my opinion, using two hex characters (YY) is a waste. Two bits would be enough, so at most four bits (a single decimal digit) would suffice, leaving more space for the number of GLBP groups. I would redesign it like this:

0007.b400.XXXY where:

• XXX is the GLBP Group Number

• Y is the AVF number.

I know that if Cisco designed it this way there must be a reason. This is absolutel

Hi all,

I'm trying to understand the difference between a meet-me-room (MMR) and an Internet Exchange Point (IXP).

From what I understand, a meet-me-room is a physical space in a data center where carriers and customers connect their fibers, while an IXP is a switching platform where networks peer with each other using BGP. The IXP gives you a sort of LAN where BGP peering can happen.

What I'm still confused about is how they relate in practice. Is the MMR usually located inside the IXP? And when two networks connect through the MMR, is that typically for private peering or transit rather than public peering through the IXP?

Could someone explain the relationship between MMRs, IXPs, and

Hi all,

I am testing BGP Prefix Origin Validation (RPKI) on Cisco IOS-XE.

R2 is configured with an RPKI cache server, and origin validation is working correctly. When I check the BGP table, I can see that a specific prefix (1.0.0.0/24) is marked as: RPKI State invalid.

However, despite being marked as invalid, the route is still selected as: "valid, external, best" and is being installed and used by BGP.

There is no alternative path for this prefix.

My questions are:

1. Is it normal behavior in IOS-XE for an RPKI Invalid route to still be selected as best if it is the only available path?
2. Does IOS-XE require an explicit route-map policy to drop invalid routes? I've tried to match

Hi all,

I am testing BGP Prefix Origin Validation (RPKI) on Cisco IOS-XE.

R2 is configured with an RPKI cache server, and origin validation is working correctly. When I check the BGP table, I can see that a specific prefix (1.0.0.0/24) is marked as: RPKI State invalid.

However, despite being marked as invalid, the route is still selected as: "valid, external, best" and is being installed and used by BGP.

There is no alternative path for this prefix.

My questions are:

1. Is it normal behavior in IOS-XE for an RPKI Invalid route to still be selected as best if it is the only available path?
2. Does IOS-XE require an explicit route-map policy to drop invalid routes? I've tried to match

Hi all,

From what I've understood about BGP it follows that:

A router does not necessarily need to have the prefix installed in the Global RIB in order to advertise it via BGP. It is sufficient for the prefix to be present as the best path in the BGP table (logical Loc-RIB) and to pass the outbound policies.

Exception: if the prefix is originated using network or redistribute, it must first be present in the RIB in order to be inserted into the BGP table.

Do you agree with me?

Is there a specific command on Cisco to show the Local-RIB or I should use the "show ip bgp" and then look at entries with ">"?

Thanks

Hey everyone,

I’ve just published a new lab on GitHub focused on HSRP failover behavior and the role of dynamic routing.

The lab is built in EVE-NG and walks through a simple scenario with two distribution switches running HSRP across two VLANs. Under normal conditions everything works fine, but when one SVI goes down, HSRP correctly fails over, yet traffic still breaks due to routing asymmetry.

I then introduce OSPF between the switches and show how it resolves the issue. The lab also includes a small example of HSRP object tracking to improve failover behavior.

My goal isn’t to present myself as an expert, I’m still learning. I’m building these labs to deepen my understanding and to sh