10 permit ip 10.200.0.0 0.0.255.255 any log (9 matches) << matches coming from source ping tests
However, when a server connected to VLAN 44 (10.200.4.x/22) tries to get out, it fails without NAT ever trying to set up the translation and doesn't add log match to entry. I should say that these hosts can ping across subnets internally, reach the public VLAN gateway, and reach any other IP on the 6509 or directly connected subnets.
So I kept saying to myself, its almost as if the VLAN is just dropping the packet. So on the phone with Cisco TAC, after about 1 hour of verification on config (everything was correct), he modified the configuration from this:
ip address 10.200.4.2 255.255.252.0
ip nat inside
core1-22002(config)#ip access-l ex test
core1-22002(config-ext-nacl)#10 permit ip host 10.200.4.36 any log
core1-22002(config-ext-nacl)#20 permit ip any any
core1-22002(config)#int vlan 44
core1-22002(config-if)#ip access-g test in
and BOOM, it works
Extended IP access list test
10 permit ip host 10.200.4.36 any log (12 matches)
20 permit ip any any
Eventually we figure out ANY ACL permit statement that matches works, as long as the "log" command is entered on ACL AND ACL is applied directly to that VLAN interface!
The Cisco TAC tells me that the 'log' command forces process switching and basically means that CEF is not working in this case, so the only way packets can forward out of the interface to the outside world is to use process switching instead of fast switching/CEF. Obviously something is wrong here and no way am I putting our large amount of PPS prod network on something that has to touch the CPU/higher level resources every time we need to forward a packet.
Has anyone ever seen this? It seems like an IOS change may be in order, fix it, but wanted to run it by here first. Both 6509's (connected via 2x 10G port-channel) display the exact same behavior. TAC punted me to switching group from routing group and of course I'm still waiting to hear back. Thanks in advance - Jason
Re: CEF broken for packets going through 'ip nat inside' VLAN in
Good morning Jason,
Could you provide the service request number please?
When you say that these hosts can ping across subnets internally, can I correctly assume that interVLAN routing works fine? This would still be flow through, hardware switched traffic from the switch's perspective, so it looks like there are very specific flows that are not being correctly hardware switched.
To begin with, for a traffic flow that is failing, could I get the outputs of the following please:
1. show ip route and the show ip route output for any recursive routes.
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...