High delay when traffic passes through the tunnel

Hello,
i have a dmvpn topology, .
When i try to ping the real ip on the hub's outside interface from the spoke, the delay is approximately 100ms, but when i ping the tunnel ip address the delay becomes 4000ms.
Your help is really appreciated

Can you post the configuration?
Did you set the MTU of the tunnel interface correctly?
Also check the switching (CEF/Process Switching) configuration.
Regards
Farrukh

Similar Messages

Only some of the traffic passing through inline vlan pair

Here is my network setup
   firewall<---- >(g1/2)Coreswitch 6500 with IDSM(TG9/1)<-----> (TG9/1) Distrib switch with FWSM---------Accessswitch
configuration in core switch
interface GigabitEthernet1/2.11
description **** ****
encapsulation dot1Q 211
ip vrf forwarding VRF11
ip address 10.2.11.73 255.255.255.248
ip ospf network point-to-point
standby 1 ip 10.2.11.75
standby 1 priority 110
standby 1 preempt
interface GigabitEthernet1/2.37
description **** ****
encapsulation dot1Q 237
ip vrf forwarding VRF37
ip address 10.2.37.73 255.255.255.248
ip ospf network point-to-point
standby 1 ip 10.2.37.75
standby 1 priority 110
standby 1 preempt
interface TenGigabitEthernet9/1.11
description ****   ****
encapsulation dot1Q 311
ip vrf forwarding VRF11
ip address 10.2.11.2 255.255.255.252
ip ospf network point-to-point
interface TenGigabitEthernet9/1.12
description ****   ****
encapsulation dot1Q 312
ip vrf forwarding VRF12
ip address 10.2.12.2 255.255.255.252
ip ospf network point-to-point
configuration in Distribution switch:
interface TenGigabitEthernet9/1.11
description **** ****
encapsulation dot1Q 311
ip vrf forwarding VRF11
ip address 10.2.11.1 255.255.255.252
no ip route-cache
ip ospf network point-to-point
interface TenGigabitEthernet9/1.37
description ********
encapsulation dot1Q 337
ip vrf forwarding VRF37
ip address 10.2.37.1 255.255.255.252
no ip route-cache
ip ospf network point-to-point
i have seggregated n/w like this. i am using inline vlan pair , to pass all the traffic through the IDSM module ,
i am using the monitoring port gi0/8
config in core switch
intrusion-detection module 8 data-port 2 trunk allowed-vlan 211-260,311-360
IDSM
physical-interfaces GigabitEthernet0/8
subinterface-type inline-vlan-pair
subinterface 11
description
vlan1 211
vlan2 311
exit
subinterface 37
description
vlan1 237
vlan2 337
exit
Problem i am facing is , some of the vlan-pair traffic passing through the IDSM some of the traffic are not passing , here i have given the statistics
MAC statistics from interface GigabitEthernet0/8
   Statistics From Subinterface 11
      Statistics From Vlan 211
         Total Packets Received On This Vlan = 0
         Total Bytes Received On This Vlan = 0
         Total Packets Transmitted On This Vlan = 0
         Total Bytes Transmitted On This Vlan = 0
      Statistics From Vlan 311
         Total Packets Received On This Vlan = 0
         Total Bytes Received On This Vlan = 0
         Total Packets Transmitted On This Vlan = 0
         Total Bytes Transmitted On This Vlan = 0
Statistics From Subinterface 37
      Statistics From Vlan 237
         Total Packets Received On This Vlan = 3189658726
         Total Bytes Received On This Vlan = 64165872092928
         Total Packets Transmitted On This Vlan = 3549575166
         Total Bytes Transmitted On This Vlan = 64165872092928
      Statistics From Vlan 337
         Total Packets Received On This Vlan = 3549575166
         Total Bytes Received On This Vlan = 64165872092928
         Total Packets Transmitted On This Vlan = 3189658726
         Total Bytes Transmitted On This Vlan = 64165872092928
   Statistics From Subinterface 38
      Statistics From Vlan 238
         Total Packets Received On This Vlan = 2215151150
         Total Bytes Received On This Vlan = 64165872092928
         Total Packets Transmitted On This Vlan = 126546964
         Total Bytes Transmitted On This Vlan = 64165866995200
      Statistics From Vlan 338
         Total Packets Received On This Vlan = 126546964
         Total Bytes Received On This Vlan = 64165866995200
         Total Packets Transmitted On This Vlan = 2215151150
         Total Bytes Transmitted On This Vlan = 64165872092928
Give me idea experts , so that i can resolve this issue.
Help me thanks in advance

I believe the issue is because of the config below:
interface GigabitEthernet1/2.11
description **** ****
encapsulation dot1Q 211
ip vrf forwarding VRF11
ip address 10.2.11.73 255.255.255.248
ip ospf network point-to-point
standby 1 ip 10.2.11.75
standby 1 priority 110
standby 1 preempt
encapsulation dot1Q 311
ip vrf forwarding VRF11
ip address 10.2.11.2 255.255.255.252
ip ospf network point-to-point
interface TenGigabitEthernet9/1.12
description ****   ****
encapsulation dot1Q 312
ip vrf forwarding VRF12
ip address 10.2.12.2 255.255.255.252
ip ospf network point-to-point
As you can see we have 2 ip subnets in the VRF 11 .73 & .2 in vlan 211 & 311 respectively.
The switch is doing intervlan routing directly without having to go through the IDSM for VRF 11.
What we need to remember is IDSM does not do routing, and it can only bridge vlans.
Hence we have to force to packet to go through the IDSM.
Here is what we do when we use IDSM to see traffic going between vlans.:
Normally, with vlans, and IDSM inline mode, we have one IP subnet and 2 Vlans.
IDSM2 in inline mode necessitates an additional artificial Vlan on the SAME subnet as the Vlan you wish to sense.
A layer 3 switch interface needs to be configured within this additional artificial Vlan.
In a nutshell, we need to create 2 Vlans that share one same ip subnet and put SVI on only one of the Vlans.
In your case you will need one ip between vlans 211 & 311 in VRF 11 to force the data to go through the IDSM.
I can understand if this is a bit tricky to understand.
Please go through my design document for IDSM inline mode, which explains the basic concepts and packet walk in detail.
It will explain why we need the above and how arp makes the mac-address table populate correct entries, (with one ip subnet for 2 vlans) so that traffic goes through the IDSM.
https://supportforums.cisco.com/docs/DOC-12206
- Sid

Does user traffic pass through Controller and Aironet 1030?

Hi All,
I want to beat out some questions that I cannot find exactly guideline in Cisco. I intend to implement 2 Airespace 2000 controller and some 1010s and one 1030 to my main office and branch office. At present, there is a 512kbps WAN link between this two office. So I don't want to let the traffic within the branch office to pass through the WAN link. Therefore, I intend to use the solution that 1 controller stay in main office to serve the 1010s in main office and 1 controller stay in remote office to serve the 1010s in remote office. But the remote site only needs 1 AP, thus I would like to use one 1030 to stay in branch office and 2 controller stay in main office to perform controller's redundancy. I would like to know Does the clients' traffic pass through the link between 1030 and controller as the same as 1010? I does very confuse whether 1030 has this feature because I found some blur instruction of 1030 in Cisco.
Further, if I place one of the controller in remote office, how can I control the APs in remote office to choose the local controller instead of the controller in main office using Layer 3 discovery method? Does any know? Thanks!
Jason,
best regards,

Hi Jason,
Hopefully this info will clear this up for you;
Q. Can I install an access point (AP) at a remote office and install a Cisco WLC at my headquarters? Does the Lightweight AP Protocol (LWAPP) work over a WAN?
A. Yes, you can have the WLCs across the WAN from the APs. LWAPP works over a WAN. Use Remote Edge AP (REAP) mode. REAP allows the control of an AP by a remote controller that is connected via a WAN link. Traffic is bridged onto the LAN link locally, which avoids the need to unnecessarily send local traffic over the WAN link. This is precisely one of the greatest advantages of having WLCs in your wireless network.
Note: Not all lightweight APs support REAP. For example, the 1030 AP supports REAP, but the 1010 and 1020 AP do not support REAP. Before you plan to implement REAP, check to determine if the APs support it. Cisco IOS Software APs that have been converted to LWAPP do not support REAP.
Q. I want to set up the Cisco 1030 Lightweight Access Point (AP) with a Cisco WLC in Remote Edge AP (REAP) mode. In this mode, is all wireless traffic tunneled back to the WLC? Additionally, if the AP cannot contact the WLC, what happens to the wireless clients?
A. The 1030 AP tunnels all WLC traffic (control and management traffic) to the WLC via Lightweight AP Protocol (LWAPP). All data traffic stays local to the AP. The 1030 REAP can only reside on a single subnet because it cannot perform IEEE 802.1Q VLAN tagging. As such, traffic on each service set identifier (SSID) terminates on the same subnet on the wired network. So, while wireless traffic may be segmented over the air between SSIDs, user traffic is not separated on the wired side. Access to local network resources is maintained throughout WAN outages.
At times of WAN link outage, all WLANs except the first is decommissioned. Therefore, use WLAN 1 as the primary WLAN and plan security policies accordingly. Cisco recommends that you use a local authentication/encryption method, such as the Wi-Fi Protected Access (WPA) Pre-Shared Key (WPA-PSK), on this first WLAN.
Note: Wired Equivalent Privacy (WEP) suffices, but this method is not recommended because of known security vulnerabilities.
If you use WPA-PSK (or WEP), properly configured users are still able to gain access to local network resources even when the WAN link is down.
From this doc;
http://www.cisco.com/en/US/products/ps6366/products_qanda_item09186a008064a991.shtml
Hope this helps!
Rob
Please remember to rate helpful posts.....

Black box able to log traffic passing through...

Hi
I'm looking for a box able to sniff the tcp/ip traffic (source ip address, destination ip address and ports) passing from it's ingress interface to the egress interface and viceversa (useful the bypass option if this box fails) without any change of the traffic passing through, just logging it and sending this log to a syslog server.
We need it as solution to be compliant with the new police law against computer criminals where is written that all the internet traffic has to be logged (we offer sometimes transparent internet access to our customers where we do not put any kind of equipment as firewall, proxy or something else, only the router providing the internet access).
Do you know if Cisco provide something like that ? Other vendors ?
Any other idea how to be compliant with this request ?
Thanks
Pls advise
Ric

Cisco Intrusion Prevention System Sensor can be used to log ip traffic. You can manually configure the sensor to capture all IP traffic associated with a host you specify by IP address. You can specify how long you want the IP traffic to be logged, how many packets you want logged, and how many bytes you want logged. The sensor stops logging IP traffic at the first parameter you specify.You can also have the sensor log IP packets every time a particular signature is fired. You can specify how long you want the sensor to log IP traffic and how many packets and bytes you want logged

Skype calls pass through the PBX

Hi Skype Team,
Good day! Hope to get your immediate response. A supporting document would do for now if you are busy and could not answer immediately. Thank you.
Is the set-up below possible?
Skype to Skype calls pass through an Avaya PBX.
Skype user calls another Skype user and that call passes through the PBX.
Thank you very much,
Jamie Ong

The erase all content and settings option does exactly that - it erases everything on the iPhone except for iOS and included apps, and there would be no passcode prompt since it would have been erased.
If you have a connect to iTunes prompt, you must do as provided.
And if you are getting there is no SIM installed or the existing SIM is not compatible, this means the iPhone was hacked to be unlocked.
Sounds like you restored the iPhone with iTunes instead and when doing so with a hacked iPhone, it re-locks the iPhone to the carrier the iPhone was sold as carrier locked with when new. The original iPhone was sold as carrier locked only.
Or when doing the erase all content and settings option, it also erased the hack used to unlock the iPhone.
There is no way to get past this now except for having a SIM card inserted from the carrier the iPhone is carrier locked with.

I made an album in iPhoto and when it plays through the "slideshow", heads are cut off in some of the pictures. How do I fix this?

I made an album in iPhoto and when it plays through the "slideshow", heads are cut off in some of the pictures. How do I fix this?

When running a slideshow from an album it will not run properly if the photos are sorted manually. Sort them by any of the other options, title, date, rating, etc. and it will play correctly.
Send a report of the problem to Apple via http://www.apple.com/feedback/iphoto.html.
If you must sort them manually create the slideshow in the slideshow mode in iPhoto, not from an album.
OT

Does ODBC encrypts data while passing through the network?

Does ODBC encrypts data while passing through the network?

ODBC uses the underlying Oracle networking components to transmit data. By default, these components do not encrypt data, although they can be made to do so-- see the "SSL Encryption" thread from a few days ago.
Justin

When I go through the 'import favorites' from Internet Explorer, everything seems to progress correctly. However, when I click on Bokkmarks, there is no option in the menu for accessing the imported items form EI. Is there a fix for this?

When I go through the 'import favorites' from Internet Explorer, everything seems to progress correctly. However, when I click on Bokkmarks, there is no option in the menu for accessing the imported items form EI. Why would this option be missing and is there a fix for this?

Hello Nigel.
Are you sure the Bookmarks you important are nowhere to be found? They should be stored in your bookmark manager, somewhere. To access the bookmark manager, go into ''Bookmarks > Organize Bookmarks...''. Try searching there.
You can change their place from there too.

HT1420 I purchased a song from iTunes however it will not play. I get a message telling me I need to authorize my PC, when I go through the steps as directed I get a message saying this PC is already authorized however the song still will not play. Any

I purchased a song from iTunes however it will not play. I get a message telling me I need to authorize my PC, when I go through the steps as directed I get a message saying this PC is already authorized however the song still will not play. Any help?

If your country's iTunes Store allows you to redownload purchased tracks, I'd delete your current copies of the dodgy tracks and try redownloading fresh copies. For instructions, see the following document:
Downloading past purchases from the App Store, iBookstore, and iTunes Store
Otherwise, I'd report the problem to the iTunes Store.
Log in to the Store. Click on "Account" in your Quick Links. When you're in your Account information screen, go down to Purchase History and click "See all".
Find the items that are not playing properly. If you can't see "Report a Problem" next to the items, click the "Report a problem" button. Now click the "Report a Problem" links next to the items.

Commas not correctly processed when values are passed through the URL!!!!!!

I think this is a bug. Any information about this will be greatly appreciated. Here's the scenario:
There's a single page with 2 regions. The first region contains a simple SQL report. The second region is and HTML region that contains text and date form elements. The SQL report has a column link "Edit" that when pressed it populates form elements in the HTML region. The population of the form elements is done by passing the column values of the select row as variables along the URL. The problem is that commas within column value text are processed as delimiters in the URL. From my understanding and documentation, variables and their values are supposed to look like this:
f?p=6000:6004:&APP_SESSION.::NO:6003:MY_ITEM1,MY_ITEM2,MY_ITEM3:1234,,5678
where MY_ITEM1 will be set to 1234, MY_ITEM2 will be set to null and MY_ITEM3 will be set to 5678 (The URL was copied directly from the Apex 3.0 documentation without modification).
However if the first value is text (lets say "some,thing") that contains a comma, then MY_ITEM1 will be set to the text preceding the comma in the first value (some), the MY_ITEM2 will be set to the text that comes after the comma in the first value (thing) NOT null and MY_ITEM3 will be set to null NOT 5678. Clearly, one would think that the comma in the first value should be escaped given that commas are used as delimiters of values in this URL scheme.
The URL looks like this:
f?p=6000:6004:&APP_SESSION.::NO:6003:MY_ITEM1,MY_ITEM2,MY_ITEM3:some%2Cthing%2C%2C5678
However the URL should look like this:
f?p=6000:6004:&APP_SESSION.::NO:6003:MY_ITEM1,MY_ITEM2,MY_ITEM3:some%2Cthing,,5678
where MY_ITEM1 is set to "some,thing", MY_ITEM2 is null and MY_ITEM3 is set to 5678
What does all this mean? This means that the escaped commas (%2C) are used as delimiters for the values. Additionally, any information that is passed that contains a comma will have it's comma escaped as well AND still considered as delimiters for values in the URL. Not to mention it's inconsistent with the official documentation.

Never mind... problem solved.
In the Apex docs says that you can embed commas if used within backslashes like: \123,45\.
So in order to pass text that has a comma through the URL, one must force Apex to code the URL like this (assuming that the text is coming from a report):
f?p=6000:6004:&APP_SESSION.::NO:6003:MY_ITEM1,MY_ITEM2,MY_ITEM3:\#A_COLUMN#\,,5678
Sorry... no bug. :)

TUNNEL UP BUT NO TRAFFIC PASSING THROUGH

Hello, we have a customer that has been working with us like 1 month with no problem. We did a connection between a fortigate firewall and a Cisco 2811. Now the tunnel is up but no traffic is going and coming through it. I did remake the whole configuration for this costumer: Key, cryptomap and access-list. The tunnel comes up but again, no traffic is coming or going.
Any hints ?
Thanks.

Hi,
Below is an excellent document on Most Common L2L and Remote Access IPSec VPN Troubleshooting Solutions.
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml
If this doc does not help, do post your configuration along with the Src and Dest IP Addresses that you are trying to ping across the tunnel.
Regards,
Arul
*Pls rate if it helps*

All the traffic go through IPsec tunnel(site to site ) ,but something seems not working correctly

Hi, all,
I have seen a good post in google.com about how to make all the client's traffic though IPsec tunnel then out to the Internet from the Main site,now I attach this configuration and application for discussion, and what the problem is that I am still confused with the configuration on Main site , I hope anyone who can tell me more detail and how to accomplish it. Any answer will be appreciated , thank you !
Quote :
Question ? :
Mine is a very simple configuration. I have 2 sites linked via an IPsec tunnel. Dallas is my Main HQ R1 and Austin R2 is my remote office. I want all traffic from Austin to route thru the tunnel up to Dallas, then out to the Internet.
Dallas (Main) Lan Net is: 10.10.200.0/24
Austin (Remote) LAN Net is: 10.20.2.0/24
The Dallas (Main) site has a VPN config of:
Local Net: 0.0.0.0/0
Remote Net: 10.20.2.0/24
The Austin (Remote) site has a VPN config of:
10.20.2.0/24
Remote Net: 0.0.0.0/0
The tunnel gets established just fine. From the Austin LAN clients, I can ping the router at the main site (10.10.200.1). This is how I know the tunnel is created, but I cannot ping anything beyond the router from the Austin LAN, e.g. 8.8.8.8.
I'm sure it's something simple I failed to configure. Anyone have any pointers or hints?
Answer:
Thanks to Jimp from the other thread, I was able to see why it was not working. To fix, I had to change the Outbound NAT on the main side to Manual. Then I created a new Outbound NAT rule that included the subnet from the Austin network (10.20.2.0). Basically, I just created a copy of the default rule and changed the Source network.
Once I made this change, Voila! Traffic from the remote side started heading out to the Internet. Now all traffic flows thru the Main site. It makes perfect sense why I needed to make this change, it just took a slap in the head from Jimp to point me in the right direction.
My question ?
The answer said "To fix, I had to change the Outbound NAT on the main side to Manual. Then I created a new Outbound NAT rule that included the subnet from the Austin network (10.20.2.0). Basically, I just created a copy of the default rule and changed the Source network." what this mean and
how to do it , could anybody give me the specific configuration ? thanks a lot.

Thank you for Jouni's reply, following is the configuration on Cisco 2800 router ,no firewall enable, :
crypto isakmp policy 100
encr aes 256
authentication pre-share
group 2
crypto isakmp key x.x.x address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 60
crypto ipsec transform-set IPsectrans esp-3des esp-md5-hmac
crypto dynamic-map IPsecdyn 100
set transform-set IPsectrans
match address 102
crypto map IPsecmap 100 ipsec-isakmp dynamic IPsecdyn
interface Loopback1
ip address 10.10.200.1 255.255.255.0
interface FastEthernet0/0
ip address 113.113.1.1 255.255.255.128
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map IPsecmap
interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
ip route 0.0.0.0 0.0.0.0 113.113.1.2
ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/0 overload
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 102 permit ip any 10.20.2.0 0.0.0.255

AAA Authentication for Traffic Passing through ASA

I am setting up AAA authentication for traffic that will pass through my ASA. I am having difficulty enabling 'aaa authentication secure-http-client'. Without secure communications enabled access functions as expected. When I enable access, I get prompted for a username/password. The username/password is entered. Authentication passes (show uauth). The requested page (http://www.cisco.com) switches to https://x.x.x.x (a resolved IP address for the site). Eventually (5 seconds), I am asked to accept or deny a certificated. Interestingly, the certificate is for the ASA and not the requested site (http://www.cisco.com).
Am I missing something?
firewall# show run aaa
aaa authentication http console TACACS+ LOCAL
aaa authentication telnet console TACACS+ LOCAL
aaa authentication serial console TACACS+ LOCAL
aaa authentication ssh console TACACS+ LOCAL
aaa authentication enable console TACACS+ LOCAL
aaa authentication match guestnetwork_access guestnetwork RADIUS
aaa authentication secure-http-client
firewall# show access-li guestnetwork_access
access-list guestnetwork_access; 2 elements
access-list guestnetwork_access line 1 extended deny udp 10.255.255.0 255.255.255.0 any eq domain (hitcnt=33)
access-list guestnetwork_access line 2 extended permit ip 10.255.255.0 255.255.255.0 any (hitcnt=412)
firewall# show run aaa-s
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host 192.168.250.14
key xxxxx
firewall# show run http
http server enable

your definition for the aaa-server is different to the aaa authentication server-group
try
aaa authentication http console RADIUS LOCAL
aaa authentication telnet console RADIUS LOCAL

Acrobat Pro 9.0 freezes when viewing/scrolling through the table of contents of a document

I am hoping someone can help me or has experienced the same problem I'm about to describe. I belong to the technical publications group of a fairly large company and I review a lot of PDF documents. I just installed Acrobat 9.0.0 (via CS4 Design Standard) and I've noticed on larger documents where there's a full page or several pages worth of Table of Contents, Acrobat 9.0.0 seems to freeze up when I begin scrolling through the TOC. For example, if I want to use the Text Edit tools or use a sticky note, when I press on an icon, Acrobat will freeze for a good 10 seconds, then will allow you to press the icon. It tends to freeze each time I want to make my next edit or even pressing the up/down arrow buttons to go to the next page. Once I get through the TOC pages, Acrobat seems to function normally--no freezes.
Has anyone experienced this? Would appreciate any kind of advice on how to fix--perhaps there's a patch or update?
I didn't experience any of this using Acrobat 8.0--I never had any real problems with Acrobat until 9.0.0.

Your issue may not be related to a difference between v8 and 9.
I have not had this problem on my computers, but a coworker had this issue. For many documents that others were able to open and scroll through without issue, his computer was freezing and unfreezing. IT determined his graphics capabilities were not able to keep up with the requirements of working with larger documents and gave his computer a RAM upgrade and a new graphics card. Particularly during scrolling, higher demands are made on the computer to graphically render and re-render page content. Documents giving him problems before became a non-issue.
A new graphics card is obviously a $$$ solution, but you might want to check to see if your RAM meets the minimum requirements and check to see if there are any program updates (Help > Check for Updates).
I have had an issue of pdfs freezing, but not specifically in the table of contents areas. If your document has pages with images that have an unusually high number of layers, it may affect the ability to work effectively in the document.

Does IPv6 traffic "pass-through" or "drop" by cisco waas?

Since cisco waas is not yet supported IPv6, if i am running IPv4 and IPv6 dual stack mode on the same circuit, does IPv6 traffic get dropped by the waas or does waas put IPv6 traffic in "pass-through" mode and let it goes? I am thinking, waas will treat IPv6 as non-IP traffic and will let it goes. Am i right?

Hi Joe and Kanwai,
One note though - if your running WCCP as the redirection mode, you won't get the IPv6 traffic redirected, as WCCP does NOT support IPv6. Hence you won't see IPv6 traffic at all on the WAAS device.
Best Regards
Finn Poulsen

High delay when traffic passes through the tunnel

Similar Messages

Maybe you are looking for