11-03-2013 02:11 PM - edited 03-11-2019 07:59 PM
Hello experts,
Iam running some tests for ext vendor connectivity and when connecting my test 3560G g0/1 (access port) to ASA5505 (9.x) Eth0/5 (or any port), noticed increase in "switch ingress policy drops" (via show in eth0/5 o/p). Checked in the forums and it appears that its an issue asked multiple times. So after issuing 'no keepalive' on 3560G port (per Cisco docs), the drops stopped totally. Wanted to check whether it is recomended to use 'no keepalive' directly connected segment (ASA Eth0/5 -> Gi0/1). Gi0/5 access port and is in vlan x. Names, hard of duplex/speed etc.. none worked to resolve the drops.
Thanks in advance
MS
Solved! Go to Solution.
11-04-2013 12:53 PM
Please read the next link, at the bottom it explains keepalives and what they do for the switch, for further detail please contact swiching queue:
https://learningnetwork.cisco.com/thread/35077
11-03-2013 02:25 PM
Field
Description
switch ingress policy drops
This drop is usually seen when a port is not configured correctly. This drop is incremented when a packet cannot be successfully forwarded within switch ports as a result of the default or user configured switch port settings. The following configurations are the likely reasons for this drop:
•The nameif command was not configured on the VLAN interface.
Note For interfaces in the same VLAN, even if the nameif command was not configured, switching within the VLAN is successful, and this counter does not increment.
•The VLAN is shut down.
•An access port received an 802.1Q-tagged packet.
•A trunk port received a tag that is not allowed or an untagged packet.
•The security appliance is connected to another Cisco device that has Ethernet keepalives. For example, Cisco IOS software uses Ethernet loopback packets to ensure interface health. This packet is not intended to be received by any other device; the health is ensured just by being able to send the packet. These types of packets are dropped at the switch port, and the counter increments.
•The VLAN only has one physical interface, but the DEST of the packet does not match the MAC address of the VLAN, and it is not the broadcast address.
switch egress policy drops
Not currently in use.
11-03-2013 02:26 PM
Let me know if you have a doubt
11-03-2013 08:34 PM
Hi Jumora,
Thank you for your reply. But I came across this information already on cisco website and then I issued 'no keepalives. My question- is it recomended to disable keepalives? What is the negative impact?
Thx
MS
11-04-2013 12:53 PM
Please read the next link, at the bottom it explains keepalives and what they do for the switch, for further detail please contact swiching queue:
https://learningnetwork.cisco.com/thread/35077
11-06-2013 09:23 AM
Hi Jumora,
I came across this discussin as well during my search, but the strange thing is- when I move ASA connection to prod switch (4507), no drops observed. No need to make any changes to switch port. All works fine. Thank you for your time.
Thx
MS
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: