About aglej

We've got a Cisco 7301 routers that forms OSPF adjacencies with an HA pair of 5020 firewalls.  Recently I swapped this router out with a different router with the same IPs but different configs to test a new WAN connection.  OSPF forms up just fine with the new router.  After testing concluded and swapping back to the old router OSPF freaks out.  The adjacencies get stuck in EXSTART.  Cisco also says that this is an MTU mismatch condition, not true in my case. Failing the firewalls over did not clear this up, tried twice.  Rebooting them did the trick.  After the reboot and a failover the adjacency was just fine. Aug 11 00:15:14: %OSPF-5-ADJCHG: Process 200, Nbr 10.16.0.12 on GigabitEthernet0/0.200 from EXSTART to DOWN, Neighbor Down: Too many retransmissions Aug 11 00:16:04: %OSPF-5-ADJCHG: Process 200, Nbr 10.16.1.20 on GigabitEthernet0/0.200 from DOWN to DOWN, Neighbor Down: Ignore timer expired Aug 11 00:17:14: %OSPF-5-ADJCHG: Process 200, Nbr 10.16.0.12 on GigabitEthernet0/0.200 from EXSTART to DOWN, Neighbor Down: Too many retransmissions Wondering if anyone else has seen this type of issue, or at least has any suggestions on how to get the adjacency to form without having to reboot. ... View more

This is an obscure problem. I've got visitors from another company on our network trying to VPN back to their office with Cisco's VPN client to a Cisco ASA appliance.  They are unable to connect, randomly.  Most of the time, at least one can connect, but never all 5 of them. All my users (including these visitors) are NAT'd to the same IP address.  So all these clients appear to their VPN concentrator as the same IP. I'm wondering if this might be a NAT issues between Palo Alto and Cisco.  Might be way off the mark here but any insight would be helpful. ... View more

We've got an HA pair of 5050s.  They both have a job to download and install dynamic updates at 12:00 AM. I've seen occasions where one of the boxes will download but not install the update.  They are also set to push a version of the update to the HA peer. I"m wondering if having them check at the same time and try to push to each other is not ideal. I'm guessing I should consider stopping the HA sync of dynamic updates, or only have one box check for updates and make that one push the update over to the other. Anyone doing similar things? ... View more