Gotcha. I was suggesting a look at the ARP table because that's the only way to correlate a device's MAC and IP addresses. Maybe you're not able to find the management port's MAC address either.   Let's try to find the MAC first. Go to Switching > Switches, then select the switch name where the UCS mgmt port is connected. That should give you a list of clients like this:   Look for the specific switch port. If the switch is able to learn anything from traffic that the UCS mgmt port has sent, it will display the MAC and IP addresses. (If you don't see those columns listed, click on the wrench icon in top right and check the boxes next to MAC address and IP address.) It's possible that you won't find an IP address listed there for the UCS. That's because the box hasn't sent any ARP replies that identify its MAC address with an IP address. Maybe it doesn't have a static IP address configured already, or maybe the box is just sitting idle and quiet, not transmitting. This is the point where you can dump the ARP table of the upstream MX or switch that's acting as a router on the UCS's VLAN and hopefully find the IP address listed there. Try to do a packet capture on the switch port. Go to Network-wide > Packet capture, then select the switch and port where the UCS mgmt port is connected. You can kick off the capture with no filter at all; the capture will have any traffic to/from the UCS, as well as any broadcast traffic too. That might be a ton of packets to sift through. If you know the MAC address, then use filter ether host xx:xx:xx:xx:xx:xx (where xx's are the hex digits). That'll capture only packets to/from that MAC. Here's another idea - go to the switch port's settings and change the VLAN number to something that isn't used anywhere else in your network. That will isolate the UCS mgmt port onto its own VLAN, then you can capture on the switch port without a filter and you won't get any broadcast traffic from other machines. You might have to let the capture run for a long time if the server is idle and quiet. Let me know what happens! ... View more

Hey Paul, Does the cloud provider have any IPsec logs from their end that they could share with you? Dave H   ... View more

Out of curiosity, what IP address is/was the MX using for itself in the 20.20.20.0 subnet? Could it have been using 20.20.20.1, the same address as the HP core SVI? Perhaps the HP hardware swap just forced a readdressing that no longer conflicts? Dave H ... View more

Hi, MatthewG3! That's a great question. I don't know of a way to clear the MAC address table from the dashboard. There might be a way via an API call, but will have to research that. Otherwise, the MAC address table is built to learn new entries dynamically, as ethernet frames arrive on switch ports. Existing entries get refreshed the same way. However, learned entries will automatically age out if no further frames are received for a fixed amount of time. That tends to keep the table up-to-date and tidy, with no manual intervention required. On Catalyst switches, MAC table entries age out after 300 seconds (5 minutes). On MS switches, the age out timer can vary depending on the chipsets used in the specific model. I hope this helps! ... View more

Well done everyone and congrats to the winners. Some great stories there! ... View more