Cisco VPN :: Srp527 VPN Tunnel Dropping Packets Intermittently
Dec 12, 2012
We have a Cisco ASA and recently purchased a cisco small business srp527 router. It is connected to our ADSL2 connection and is working fine. I have configured the device with an ipsec tunnel using an ike profile and the tunnel is created successfully with packets traversing the tunnel. However packets are being dropped intermittently, with no cause. The link is currently not being utilised, there is no load on the network however when I ping Google and any address subject to the rules of the tunnel i notice that a single packet is dropped every now and then.
View 0 Replies
ADVERTISEMENT
Apr 3, 2011
Recently been taking my Laptop installed with Win7 Pro to a Friends and was sharing his Wireless connection from Belkin ADSL2+ wireless router and notice that every now and again the wireless connection would drop out and the only way to regain a connection to the reset the router. My friends network has two laptops on it connected wirelessly with Windows XP home edition SP3, and a Desktop PC with XP also on connected to router Via Ethernet, also a Windows Home Server and XBOX 360 also connected by Ethernet, My friend since updated his laptop to Windows 7 Home Premium and is using the Wireless connection which now finds intermittent loss of connection which can only be restored by Resetting the Router. why a Router should lose connection just by connecting a Win7 laptop wirelessly or is there more to it than that.
View 3 Replies
View Related
Nov 18, 2012
The old 615 has been working very well for some years now, but the last couple of days we have had to turn it off and on again to get internet. It has happened 3 times in the last 24 hours. The globe light on the router remains green, and the notification icon on windows 7 doesn't show any problems yet we cant connect to the web. I've been looking on the forum and trying to understand some of the solutions and checklists already posted, but they don't make a whole load of sense to me unfortunately.
The firmware on the router is 2.27. The only change I have made to the system is that my wife's lan card seems to have died a death last week, and her computer is now connected by wireless. My computer is now the only one connected to the router by a lan cable.
There is something I don't understand. Under setup / network there is a dhcp reservations section. Pretty much every device seems to have a reserved IP address, and some of the devices that are reserved we no longer own. My son does gaming and wants a constant IP address, and my computer might need a permanent IP (don't know - just guessing here). Should all the other computers be allowed to sort themselves an IP every time they log on? Most of the devices have expires never, and some of the devices have the blue link that I can click for revoke and reserve with a time by them.
Am I barking up the wrong tree here and this lot has nothing to do with the dropping connection? What do the revoke / reserve and times mean? What happens when the lease runs out? Will the connection drop on that computer and it will have to try and connect itself again, or does it start a new lease every time it logs on to the router?
View 1 Replies
View Related
Jun 28, 2011
I have a desktop computer and a laptop computer both running Windows 7 Home Premium. The desktop is connected to the router directly and the laptop is connected to the wireless network. When I restart both computers, I can see and access the other computer through the home network without problems. But after a while, sometimes just a few minutes, I can only see the other computer but cannot access it. Sometimes, I cannot even see the other computer. If I do a "ipconfig /release" and a "ipconfig /renew", it may sometimes correct the problem for a while.
I have looked at many related discussions on the web and none of the suggestions work for me.I have the firewalls disabled on both computers, as well as the ipv6 and IP service. I have also disabled the Bonjour service.I have turned a number of services, such as computer browser, server, workstation and many others to automatic as people suggested.
View 4 Replies
View Related
Feb 13, 2013
VPN tunnel between ASA 5520 ver 8.0(4) and a remote Juniper firewall keep tearing down during Phase 1 rekeying. After the rekeying process fails, manually pinging one of the remote hosts that are proteced behind the Juniper firewall,initates the tunnel renegoation and rebuilds the tunnel successfully.
When the tunnel is down, sh crypto isakmp sa shows no active SA for the remote peer. That indicates the PHASE 1 negotation had indeed failed.When the tunnel is working, sh crypto isakmp sa indicates an IKE role of Responder - always.Clearly that also means Phase 1 negotation works only one way, i.e. negotation initated by the remote Juniper unit only.
Interestingly, the Syslog server logged the following SNMP trap messages at the time rekeying Phase1.Note, Line#2 and #7 and wrapped to the next line for easy of reading.
Line#1: IP = Remote-Peer-IP-#, Starting phase 1 rekey
Line#2: IP = Remote-Peer-IP-#, IKE Initiator: Rekeying Phase 1, Intf outside,
IKE Peer Remote-Peer-IP-# local Proxy Address N/A, remote Proxy Address N/A, Crypto map (N/A)
Line#3: IP = Remote-Peer-IP-#, constructing ISAKMP SA payload
[code]...
As I understand from the above syslog trap, the Responder ( the ASA unit this time) started Phase 1 rekey (Line #1). It prepare a message to be sent to IKE Initiator, that it is about to start rekeying Phase 1 (Line #2). Down on the next line, it indicated that the local Proxy, remote Proxy and Crypto map as N/A ( not avaiable).Why would the ASA unit send N/A message as shown in Line#2, is that normal?
View 3 Replies
View Related
Feb 15, 2013
I've been having some issues with my DIR-825, it's been intermittently dropping internet connection. This is across multiple OS (Win 7, Ps3 OS, iOS, etc.
View 14 Replies
View Related
Feb 22, 2013
FSD 7632-4 Router.Have this 2006 router which has started dropping the connection and/or slowing it down intermittently. Before I replace it, would like to update the firmware. Have downloaded the update but cannot log-in on the setup utility page as I cannot remeber my password (apparently it is not set to blank!).
View 1 Replies
View Related
Feb 7, 2013
I have a Netgear DG834G v3 ADSL router which I have had since early-2007.
When I work from home I connect to office networks on a Win7 machine via a Rackspace-provided VPN using Cisco System VPN Client 5. It works well, except for one issue that is costing me time every working day.
I get intermittently disconnected from the VPN, without any warning or apparent reason.
Since I bought the router 5-6 years ago I have had no need to update firmware, so other than ISP configuration I have had no need to change the router at all and I can say it's worked well for me.
What would be the reason for my VPN connection dropping? Is this an ISP issue (my ISP is Carphone Warehouse/TalkTalk) that I have to take up with them or is it more likely a hardware problem with my router or a VPN configuration issue?
My instincts are to not look into VPN config at the moment as I know a colleague who uses the same VPN through a different router and ISP can stay connected for hours, even overnight.
View 1 Replies
View Related
Dec 13, 2012
I have a NAT setup. Some of my udp packets are dropping. How to find more about the NAT to find whether it missed anything or not. the router is 3945e. [code]
View 3 Replies
View Related
Aug 1, 2012
I have ASA 5510 with 8.4 connected to ISG 1000, when traffic is passing the VPN tunnel is working fine, when the traffic stops, ASA will drop the packet but the VPN tunnel on ISG still up .When new traffic started from ISG side, it will drop, as the tunnel is not up on ASA side.
View 2 Replies
View Related
Apr 30, 2013
I am having an issue where the ASA is dropping packets on the vlan interfaces. I have it as a dedicated router/firewall for a 100mb connection .
Vlan1 is the internal networkVlan2 is the network to cable modem
Eth 0/1 is connected to a 2960G switch with hard coded 100mb Full Duplex at each end, this is the inside interface. Eth 0/0 is the connection to the cable modem, this is the outside interface, set at auto at both ends.
Im getting on the vlans eg. 51253 packets dropped however network traffic isnt impacted and everything runs fine, as well as 46532 switch ingress policy drops.
Example;
ciscoasa# sh int vlan1Interface Vlan1 "inside", is up, line protocol is up Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec MAC address 70ca.9b36.ab80, MTU 1500 IP address 10.x.x.x, subnet mask 255.255.255.0 Traffic Statistics for "inside": 43250588
[Code]......
View 1 Replies
View Related
May 29, 2012
We have a cisco 800 series router between the internal network and the WAN. the problem is we are unable to receive some of our mail due to dropped packets by our router. the conversation between the two servers stops at the point were our server responds with the command 250 2.1.5 user@mydomain.com | 354 Start mail input; end with . i was able to trace the packet, using Packet Export, on the internal interface but not on the external interface. Also i have noticed that the external interface has about 160,000 unknown protocol drops while the internal interface has 0.
Is there anyway to find out way the external interface is dropping the packets.
View 4 Replies
View Related
Apr 10, 2012
We have a customer who we sent to Cisco to replace some aging Dell switches. They purchased 5 SG300-52’s for 2 different networks. Their production LAN has 2 “live” switches and 1 spare. The 2nd, a development LAN has 1 switch and 1 spare. Their primary production SG300-52 has GE1-8 VLAN’d off as VLAN2 for public IPs. The untrusted (WAN) interfaces of 2 x ASA-5510’s, 1 x ASA-5505, and 2 x RV082 v2’s are connected to GE2-6. GE1 is the uplink to the co-location center’s Cisco switches. GE7 & 8 are spare ports. Each SG and device port is hard coded for 100/Full.
One of the ASA-5510’s and the ASA-5505 maintain a site-to-site VPN (the development LAN used to be in a different facility hence the VPN). Recently the developers have stated the performance is horrible. I noticed ping traffic loss from PCs on the dev side to servers on the production side in the order of 20-30%. I assumed it was a VPN issue so I opened a ticket with Enterprise TAC (all the ASAs and the SGs have either SmartNet or extended support contracts). TAC determined the problem happened even if you ping from inside the ASA to the untrusted side of the other ASA thus eliminating the VPN as the culprit.
The 2nd ASA-5510 has the AIP module and was not even live until this weekend. Turning it up and giving it a basic config returned the same results. #ping x.x.x.x repeat 100 will drop 20-40 packets. I have no security enabled on the SGs and even tried using the spare SG300-52 this weekend in place of their primary with the same result. I’m to the point of returning one of the Dell switches to production, but this cannot be a good sign. I’m also a bit frustrated that I’ve yet to figure out how to get Cisco Enterprise to speak with Cisco Small Business on this. The customer has over $10k invested in Cisco equipment and Cisco isn’t jumping in to figure this out.
The latest rep wants a packet capture from the SG300’s VLAN2 but there are no PCs there to do this with and the manual doesn’t even talk about doing this. How we can do this as well as get the 2 divisions working together to fix this? BTW, the RV082’s exhibit the SAME exact problem. I can ping from ANY device on VLAN2 to any other device and drop packets. Copying a simple 1MB file over the VPN can take minutes where it should take 1 second. I can reproduce this for 24/7.
View 8 Replies
View Related
Feb 28, 2012
We have a setup with a MS-TMG - ASA (8.2.4(4) in routing mode) - (internal) Router - FWSM - Router - Exchange with NLB. We have now the problem that IMAPS is not really working through this setup. It works from internal (without ASA and TMG inbetween), but not reliably through the internet. There is a rule on the ASA which permits the ports from the TMG to the Exchange NLB address.We opened a case with Microsoft and they told us that not all tcp-syn packets are received by the Exchange server which were sent by the TMG.Thus I sniffed on the ASA with a packet capture and indeed, a lot of syn packets were on the interface to the TMG, but not anymore on the interface to the internal router.This ASA also filters all other internet<->company traffic, so there's a lot of stuff running.
Maybe it's dropped in the ASP, or is the capture maybe not valid?Here the show asp drop:
ASA01-Internet# sh asp drop
Frame drop: Invalid TCP Length (invalid-tcp-hdr-length) 1 Reverse-path verify failed (rpf-violated) 319 Flow is denied by configured rule (acl-drop) 477077 First TCP packet not SYN (tcp-not-syn) 10212 TCP data send after FIN (tcp-data-past-fin) 41 TCP failed 3 way handshake (tcp-3whs-failed) 824 TCP RST/FIN out of order (tcp-rstfin-ooo) 1419 TCP SEQ in SYN/SYNACK invalid (tcp-seq-syn-diff) 6 TCP SYNACK on established conn (tcp-synack-ooo) 1 TCP packet SEQ past window (tcp-seq-past-win) 821 TCP invalid ACK
[code]....
View 9 Replies
View Related
Feb 14, 2013
It appears we might have an issue with our RV082 (v4.2.1.02) dropping packets during the teardown of many TCP conversations. I have attached two packet captures of what I believe is the same conversation. One is from outside the router (Wireshark using an Ethernet Tap) and the other is from the client inside the router (SLES11SP2 running TCPDump). These are both very small captures 9 packets and 18 packets and I'm hoping it will identify the problem.
It appears that the RV082 is prematurely closing the natted port used to communicate with the host outside the network. The host sends a FIN, ACK packet, to which the client responds with an ACK, However, when the client then sends his FIN,ACK sequence, it never makes it outside the router. The client sends a total of 9 FIN,ACKs trying to contact the outside server, but none of those appear to make it through the router.
Is the router slamming the door prematurely? (I've been fighting with this problem for 3 weeks now!)
Inside Capture:
----------------------
No. Time Source Destination Protocol Length Info
1 2013-02-13 19:32:37.827942 192.168.1.45 38.113.116.214 TCP 76 35975 > http [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=635644783 TSecr=0 WS=128
[Code].....
View 19 Replies
View Related
Dec 15, 2011
I seem to be having an issue where certain very packets are being dropped/lost by my office router. The reproducible situation is, when I attempt a DNS zone transfer from my linux bind DNS server (A.A.A.A) to any server on my network behind NAT (Y.Y.Y.Y) the first packet (Seq 1) of the response is lost. The client making the query asks for first packet (Seq 1) to be resent, and the DNS server attempts to resend it repeatedly, but those are lost too.
View 10 Replies
View Related
Dec 26, 2012
We have a customer who uses about 20 x c2960's switches for access layer and 2 x c3560e for distribution layer. C2960's uses C2960-LANLITEK9-M , Version 12.2(58)SE1. Everything was working fine. Now we got information, that sometimes there are problems with connectivity. Customer tries to reach internet.
SW11#sh int fa0/18
FastEthernet0/18 is up, line protocol is up (connected)
Hardware is Fast Ethernet, address is e8ba.806a.4412 (bia e8ba.806a.4412)
[Code].....
View 7 Replies
View Related
Aug 6, 2012
I am trying to find a solution using modular QOS when there is congestion in circuit we drop packets with WRED which are marked with a DSCP value of say AF21. I can drop those traffic completely in case of congestion. I was thinking to allocate 100% bandiwth to rest of the traffic.
View 1 Replies
View Related
Aug 21, 2012
I have a Cisco 871 router that used to have Access list based security. now I am trying the ZBFW for the first time. I thought I had a pretty good program until I found all my traffic was getting dropped. This is my first stab at ZBFWs and I am a bit confused esp with the default class part.
The router is for my house and thus also has to have priority for gaming. I will add the gaming and voice QOS once I get it working,
Guest VLAN has access to 2 IP's in Data for printing. Cisco871#sh run
Building configuration...
Current configuration : 8005 bytes
!
version 12.4
no service pad
[Code].....
View 1 Replies
View Related
Mar 27, 2012
I bought a DIR-655 a less than a year ago on amazon, and it was working great up until about 4 weeks ago. Ive noticed that it has been dropping alot of packets while I am gaming on my computer. I would run about 95-98 ping usually and now it jitters every 5-10 mins or so from 95-98 to up to 500. It is really troublesome during games and I dont know what to do. Ive tried disabling QoS and still nothing. I run on wireless G and N with auto 20/40 mhz. Standard WPA(personal) and it was running absolutely great until now. I know its the wireless because I have hardwired it into my laptop, both from the router and just the modem itself with no problems whatsoever. I dont know what to do about it.
View 3 Replies
View Related
May 23, 2011
I am attempting to FTP to a remote site through a IPSEC tunnel.When I am transfering large files the ASA5540 is showing syslog errors stating "connection timeout". What I think is happening is after about 1 hour the firewall is closing the connection control port for the FTP session and neither end is notified so eventually the transfer is stopped.What do I need to modify in the FW to accommodate these larger files?
View 1 Replies
View Related
Jul 26, 2012
I have a ACE module A2(3.5) installed, I am having a connectivity problem between two servers in my network. I have captured some traffic on different points in my network and from capture it seems like the problem is with this ACE module or somehow it is closing the connection.
View 6 Replies
View Related
Mar 17, 2011
I have 2 ASA 5510 firewalls at 2 different sites. Both running on version 8.0.4. Users are using an Instant Messaging type of application provided by a local telco here which is able to send and receive SMS using SIP (from the packet capture that I've done).
When users use the IM in site A, they are able to send and receive text messages via the IM from behind the firewall. However, when the users are in site B, users are able to send out text messages but not able to receive them.
I noticed that when I remove "inspect sip" from site-B's global policy map, users from site-B can successfully receive text messages. I have confirmed that it is the firewall that drops the packets as I have captured the inside and outside interfaces of site-B's ASA and I can see the incoming sip "request: MESSAGE" packet on the outside interface but I do not see the packet exiting the inside interface.
I have cross check both firewall configurations, and I do not see anything suspicious commands relating to sip that might cause this issue. Is there any command to troubleshoot why the sip inspection is dropping the sip packets on site-B?
View 15 Replies
View Related
Jul 24, 2012
My E3000 has about 60% packet loss if the channel selected is anything other than 1. I can't enable 5GHz or even 40mhz 2.4GHz channels without dropping 60% packets.
View 9 Replies
View Related
Mar 21, 2013
I have a setup where a spoke (cisco 1841) is sending a multicast feed to a hub (cisco 2951) via a DMVPN tunnel on the Internet. The feed arrives on interface fa0/0 of the cisco 1841 and is forwarded to the tunnel interface. It is about 160,000 kbit/s and 18 pps. This always looks the same:
cisco2951-1-hub#sh run int tu10
!
interface Tunnel10
description DMVPN TUNNEL
[Code]...
View 5 Replies
View Related
Jan 9, 2013
I recently installed DHCP snooping on a 3750v2 switch (Version 12.2(55)SE4) and configured the uplink(Po2) as a trusted port. The problem is that clients cannot receive an IP address. When I disable DHCP snooping it is working properly. DHCP snooping is configured correctly but I don't have an idea how to resolve it. [code]I tested the solution on the same kind of hardware switch and firmware and it worked out fine. What is causing the clients not to receive an IP address from the DHCP server?
View 10 Replies
View Related
May 9, 2013
We have a remote site that is using 3750X switches as layer 2 switches back to our home site. The uplink port is showing dropped packets but the utilization on the link is never about 10%. We have a 100Mb circuit to this site. Our speed tests and iperf tests are not showing any issues that we can see. However the port is still droping packets. It is not dropping at a high rate but they are dropping.
switch#sh platform port-asic stats drop gi1/1/4
Interface Gi1/1/4 TxQueue Drop Statistics Queue 0 Weight 0 Frames 0 Weight 1 Frames 0 Weight 2 Frames 0 Queue 1 Weight 0 Frames 52876 Weight 1 Frames 2 Weight 2 Frames 0 Queue 2 Weight 0 Frames 0 Weight 1 Frames 0 Weight 2 Frames 0 Queue 3 Weight 0 Frames 0 Weight 1 Frames 0 Weight 2 Frames 1330874 Queue 4 Weight 0 Frames 0 Weight 1 Frames 0 Weight 2 Frames 0 Queue 5 Weight 0 Frames 0 Weight 1 Frames 0 Weight 2 Frames 0 Queue 6 Weight 0 Frames 0 Weight 1 Frames 0 Weight 2 Frames 0 Queue 7 Weight 0 Frames 0 Weight 1 Frames 0 Weight 2 Frames 0switch#
Is there a way to capture these dropped packets to see what they are? We do have VOIP phones at the site and are using Qos.
View 5 Replies
View Related
Dec 29, 2010
We are testing a new 1Gbps WAN circuit between 2 sites. We have cisco 3750 and 4507 on each end. Every time we run extended ping sweep ranging from 36 to 18024 bytes the packets are being dropped randomly once the size goes above 1500 bytes. Our ISP claims Demark to Demark test are clean and they don't want to acknowledge the problem, they blame our switches. To prove the problem is not on our end we've put different switches at each end, still facing the same issue. Ping success rate is around 98 to 99 percent.
View 11 Replies
View Related
Oct 13, 2011
I am trying to use my WRT120n as access device for an IP Centrex service using SIP protocol. My SIP phone is located right behind the router.My problem is sometimes the router is dropping incoming calls because signalling packets are fragmented at IP level. So I cannot receive those calls.Is there a way to enable the router to accept these packets?
View 9 Replies
View Related
Nov 20, 2011
In fact i receive traffic on a one client per vlan basis (traffic is PPPoE), i receive all this traffic on a router, collecting all these vlan on a bridge where the pppoe packets are treated.When I use a transeiver to convert operator fiber arrival to my router copper media interface, i have no problem....
When I use dot1q-tunnel to make the same on my 3750, packets seems to be corrupted.I get PPPoE timeouts and packet loss, not regulary, totally stochastic...
I made dozen of tests and different settings, without success I first thougt of MTU issues. [code] I made tests with system MTU and/or system jumbo MTU above 1500, without success.I didn't found any known caveats on 3750 running Version 12.2(25r)SEE4 related to dot1q-tunnel.
View 7 Replies
View Related
Jan 7, 2013
We have approx. 40 branch offices that connect to our core IOS Firewall (2951) over ipsec VPN Tunnel. One particular site has been facing issues over the past few days. This site will sporadically drop it's VPN Tunnel and reestablish after a few seconds. If I run debug crypto ipsec and crypto isakmp on the site that is dropping, it is constantly going through the DPD process. If I run these same commands on another site, they seem to run DPD at all.
Here is some of the output I am seeing on the site that is failing.
Jan 8 11:18:38.873 AST: %FW-6-DROP_PKT: Dropping tcp session 111.222.3.106:50083 96.16.47.144:80 due to Stray Segment with ip ident 54856 tcpflags 0x5004 seq.no 2154004347 ack 0
Jan 8 11:18:46.061 AST: ISAKMP (4028): received packet from 111.222.255.106 dport 500 sport 500 Global (I) QM_IDLE
Jan 8 11:18:46.061 AST: ISAKMP: set new node -1497488895 to QM_IDLE
Jan 8 11:18:46.061 AST: ISAKMP:(4028): processing HASH payload. message ID = 2797478401
Jan 8 11:18:46.061 AST: ISAKMP:(4028): processing SA payload. message ID = 2797478401
[code]....
View 2 Replies
View Related
Jul 3, 2011
I have a ASA 5505 VPN Concentrator using ADSM 5.2 connecting to a BEFSX41 router. Its a pretty simple set up that has been working for years. However, over the past several weeks the VPN tunnel is consistently dropping every day or two, however both side are able to ping the internet at all times. My current work around is to manually log into the BEFSX41 router and re-connect the VPN tunnel, which simply connects immediately. The tunnel will stay up for about a day or two until it reliably drops the tunnel connection. Every time the tunnel drops I get an alert with an error message: [code] After doing searches about what this error means, all I can find is that its supposed to mean there is a problem with the encryption keys. I have checked the keys many times over and everything is the same. I find it odd that nothing has changed in almost 2 years.
I have 10 other VPN connections that are always up at never have any problems. I have the same make/model router connected to other offices with no problems. I have swapped the router twice, and each time I get the same symptoms.
View 1 Replies
View Related
May 15, 2013
I have our main site using a Cisco 5510 running 8.4.2 code and a remote site using a Cisco 5505 running 8.4.2 code. The main site has a T1 and the remote site is using a DSL connection. About every other day I have to reset the connection at the remote site. The process that I have found that works is to remove the nat statement, clear the cry ips sa and then add back the nat statement. The connection usually comes back up and a few minutes. I am trying to see what is causing this to drop.
View 5 Replies
View Related
