Hi, We've recently replaced a 7200NPE-G2 with 7600-RSP720. We had around 1Gbps GRE tunnels terminated on the previous box with 85% CPU utilization comming from around 30 tunnel interfaces. Also running OSPF and some route-maps. Everyting was doing good. For scaling our connectivity scenario we decided to replace it with a newer and more powerful platform and 7600-RSP720 was our final choice. After replacing the old 7200 with the new 7600 we surprisingly noticed high cpu utilization (95%) which all came from interrupts and not any specific process. I tried to use some mls configuration commands but there was no success. For the test scenario we've been using GE ports on the RSP720 and not any other line card interfaces. I double checked the Cisco 7600 IOS guide document, I'm using commands which is supported by PFC3/DFC3 for hardware switching, which is "tunnel source", "tunnel destination" and "tunnel more gre". the only strange paragraph which i suspect is related to this problem is but it's never been detailed anywhere for the correct implementation, i tried different ip addresses for source tunnels but no difference "Each hardware-assisted tunnel must have a unique source. Hardware-assisted tunnels cannot share a source even if the destinations are different. Use secondary addresses on loopback interfaces or create multiple loopback interfaces. Failure to use unique source addresses may result in control plane failures during software path congestion." checking "show ip cef not-cef-switched": IPv4 CEF Packets passed on to next switching layer Slot  No_adj No_encap Unsupp'ted Redirect  Receive  Options   Access     Frag RP         0       0     3919465        0   195682        0   331065        0 5/0        0       0           0        0        0        0        0        0 1/0        0       0           0        0        0        0        0        0 also "show ip cef switching statistics"        Reason                          Drop       Punt  Punt2Host RP LES Packet destined for us             0     136317      59304 RP LES Encapsulation resource             0    1944707          0 RP LES No adjacency                       8          0          0 RP LES TTL expired                        0          0    1643028 RP LES Fragmentation failed           78770          0          0 RP LES Features                    12836183          0     330963 RP LES Neighbor resolution req            5          2          0 RP LES Total                       12914966    2081026    2033295 All    Total                       12914966    2081026    2033295 Configuration: interface Tunnel51 description xxxxxxx bandwidth 1024 ip unnumbered GigabitEthernet5/2.19 ip mtu 1476 ip flow ingress ip policy route-map redirect ip ospf cost 100 ip ospf 1 area 1 keepalive 3 3 cdp enable tunnel source  yy.yy.yy.yy tunnel destination xx.xx.xx.xx ! mls flow ip interface-full mls rp ip route-map mls ip multicast flow-stat-timer 9 no mls acl tcam share-global mls cef error action reset ------------------------------------------------------ I also tried the configuration without route-map but still the same. Anyone had such experince with this problem before? Thanks in advance Ali ... View more

Hi all, Recently I configured a 6500 with SUP-720 for transparent web caching with IP Spoofing. The configuration was quite simple. The idea behind IP Spoof enabled cache is to redirect both send and receive traffic to web cache and the box will spoof the source ip of the original user requesting the page. you have to do the following tasks: 1- Set 2 WCCP general configuration one with "ip wccp web-cache" and the other with "ip wccp 95" 2- On the VLAN/L3 Port facing the Internet you have to set "ip wccp web-cache redirect out" to redirect outbound connections to web cache. 3- On the VLAN/L3 Port facing cache interface you have to set "ip wccp redirect exclude in" to exclude web cache traffic itself. 4- On the VLAN/L3 Port facing users you have to set "ip wccp 95 redirect out" to redirect incoming traffic (web responses to cache). Everything works just fine during the test using redirect-list to limit the scope of the change to the test PC but as soon as i remove the redirect-list to redirect all users traffic to the web cache the 6500 with the golden sup720 explode with %100 cpu usage and the box starts to drop traffic! I've done so many tests with different modular / non modular IOS of different versions but no success. As i searched the command reference for the 12.2 IOS I've noticed that using WCCP requires full and interface-full mls flow configuration I've done it as well but again no success. Generally something like 250mbps traffic passes this 6500 but I've tested even with 100mbps and still IP INPUT process (or ios-base process in modular IOS) eat up all the CPU. Another point that may help is that using WCCP without IP spoof (just "ip wccp web-cache" command) only takes %15 of CPU handling 150mbps traffic. Other configuration regarding cache is that it's using version 2, GRE for Assignment Method and Layer 2 for Forwarding Method and no WCCP password is in place. There is an "accelerated" keyword for wccp but it seems it works only with WCCP version 1. I've seen some comments regarding high CPU utilization on 6500 but all of them state that it's been fixed before 12.2(18)SXD4 (http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/8.x/configuration/guide/msfc_ios.html). i've tested the following IOS: s72033-adventerprisek9_wan-mz.122-33.SXH.bin s72033-adventerprisek9_wan-vz.122-33.SXH.bin s72033-advipservicesk9_wan-mz.122-18.SXF12.bin which are the latest available. Does any one has any idea??? ... View more