Slow Connection

I have the following network configuration:

LAN: 192.168.1.x/24

192.168.1.250 SonicWALL Public IP Address (connected via DSL) | | | Public IP Address (connected via DSL) SonicWALL 192.168.45.250 192.168.45.x/24 | | | 192.168.45.1 (fastEthernet 0/0) Cisco 1841 T1 Router 192.168.60.2 (serial line [csu/dsu]) | | 192.168.60.1 Cisco 1841 T1 Router 10.10.20.1 10.10.20/24

There is a VPN tunnel between the 2 SonicWALL devices, and there is also a VPN tunnel between the two Cisco devices.

From a computer at 192.168.1.40, I can ping everyone no problem. However, I'm having some issues pinging the 10.10.20.0/24 subnet from the

192.168.1.0/24 subnet. It appears to be too slow. This is what I am experiencing:

If I ping anyone on the 192.168.45.0/24 subnet from the 192.168.1.0/24 subnet, everything works fine and the pings appear to be coming back in about 20-40 milliseconds.

If I ping the 10.10.20.0/24 subnet from the 192.168.1.0/24 subnet, the pings will reply except that they take about 400 milliseconds to come back. Furthermore, when I initially start to ping the 10.10.20.0/24 subnet, the first couple of pings are lost. I'm assuming this is because the Cisco routers need to setup a VPN tunnel between them, but I have keepalives set, and I'm not sure when the tunnel doesn't stay up all of the time.

I'm going to paste the configurations of both routers below, but can anybody think of a way to speed up the T1 line between the 2 cisco routers? I don't want to lose any packets when I initially try to ping the 10.10.20.0/24 subnet from the 192.168.1.0/24 subnet, and I would like to have ICMP packets reply from the 10.10.20.0/24 subnet to the 192.168.1.0/24 subnet around the

40-60 millisecond time frame.

Anybody got any ideas?

Thanks.

-- John

Router A 192.168.60.2:

Building configuration...

Current configuration : 3850 bytes ! ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname RouterA ! boot-start-marker boot-end-marker ! logging buffered 51200 warnings enable secret 5 xxx ! no aaa new-model clock summer-time EST recurring ip cef ! ! ip domain name yourdomain.com ! password encryption aes ! ! ! ip telnet source-interface FastEthernet0/0 ! ! crypto isakmp policy 1 encr aes 256 authentication pre-share group 5 crypto isakmp key 6 xxx address 192.168.60.1 crypto isakmp keepalive 60 3 periodic ! ! crypto ipsec transform-set L2LTransform esp-aes 256 ! crypto map L2LMap 1 ipsec-isakmp set peer 192.168.60.1 set security-association level per-host set security-association lifetime seconds 86400 set security-association idle-time 86400 set transform-set L2LTransform set pfs group5 match address L2LAccess ! ! ! interface FastEthernet0/0 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0$ ip address 192.168.45.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface Serial0/0/0 ip address 192.168.60.2 255.255.255.0 ip access-group 101 in ip access-group 102 out encapsulation ppp service-module t1 timeslots 1-24 crypto map L2LMap ! ip route 0.0.0.0 0.0.0.0 Serial0/0/0 ip route 192.168.1.0 255.255.255.0 192.168.45.250 ip route 192.168.5.0 255.255.255.0 192.168.45.250 ip route 192.168.40.0 255.255.255.0 192.168.45.250 ! ip http server ip http access-class 23 ip http authentication local no ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ip access-list extended L2LAccess permit ip 192.168.45.0 0.0.0.255 10.10.20.0 0.0.0.255 permit ip 192.168.5.0 0.0.0.255 10.10.20.0 0.0.0.255 permit ip 192.168.40.0 0.0.0.255 10.10.20.0 0.0.0.255 permit ip 192.168.1.0 0.0.0.255 10.10.20.0 0.0.0.255 ! access-list 101 permit udp host 192.168.60.1 eq isakmp host 192.168.60.2 eq isakmp access-list 101 permit esp host 192.168.60.1 host 192.168.60.2 access-list 101 permit icmp host 192.168.45.1 host 10.10.20.1 access-list 101 permit udp host 192.168.60.1 host 192.168.60.2 eq ntp access-list 101 deny ip any any log access-list 102 permit icmp host 10.10.20.1 host 192.168.45.1 access-list 102 permit udp host 192.168.60.2 eq isakmp host 192.168.60.1 eq isakmp access-list 102 permit esp host 192.168.60.2 host 192.168.60.1 access-list 102 permit udp host 192.168.60.2 eq ntp host 192.168.60.1 access-list 102 deny ip any any log ! ! control-plane ! banner login ^C

----------------------------------------------------------------------- Cisco Router and Security Device Manager (SDM) is installed on this device. This feature requires the one-time use of the username "cisco" with the password "cisco". The default username and password have a privilege level of 15.

Please change these publicly known initial credentials using SDM or the IOS CLI. Here are the Cisco IOS commands.

username privilege 15 secret 0 no username cisco

Replace and with the username and password you want to use.

For more information about SDM please follow the instructions in the QUICK START GUIDE for your router or go to

formatting link
^C ! line con 0 exec-timeout 0 0 login local line aux 0 line vty 0 4 access-class 23 in privilege level 15 login local transport input telnet line vty 5 15 access-class 23 in privilege level 15 login local transport input telnet ! scheduler allocate 20000 1000 ntp master end

------------------------------------------------

------------------------------------------------

------------------------------------------------

------------------------------------------------ Router B 192.168.60.1: Building configuration...

Current configuration : 3770 bytes ! ! No configuration change since last restart ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname RouterB ! boot-start-marker boot-end-marker ! logging buffered 51200 warnings enable secret 5 xxx ! no aaa new-model ip cef ! ip domain name yourdomain.com ! password encryption aes ! ! ip tftp source-interface FastEthernet0/0 ! ! crypto isakmp policy 1 encr aes 256 authentication pre-share group 5 crypto isakmp key 6 xxx address 192.168.60.2 crypto isakmp keepalive 60 3 periodic ! ! crypto ipsec transform-set L2LTransform esp-aes 256 ! crypto map L2LMap 1 ipsec-isakmp

set peer 192.168.60.2 set security-association level per-host set security-association lifetime seconds 86400 set security-association idle-time 86400 set transform-set L2LTransform set pfs group5 match address L2LAccess ! ! ! interface FastEthernet0/0 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0$$ES_LAN$ ip address 10.10.20.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface Serial0/0/0

ip address 192.168.60.1 255.255.255.0 ip access-group 101 in ip access-group 102 out encapsulation ppp service-module t1 timeslots 1-24 crypto map L2LMap ! ip route 0.0.0.0 0.0.0.0 Serial0/0/0 ! ip http server ip http access-class 23 ip http authentication local no ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ip access-list extended L2LAccess permit ip 10.10.20.0 0.0.0.255 192.168.1.0 0.0.0.255 permit ip 10.10.20.0 0.0.0.255 192.168.45.0 0.0.0.255 permit ip 10.10.20.0 0.0.0.255 192.168.5.0 0.0.0.255 permit ip 10.10.20.0 0.0.0.255 192.168.40.0 0.0.0.255 ! access-list 101 remark access list for serial access-list 101 permit udp host 192.168.60.2 eq isakmp host 192.168.60.1 eq isakmp access-list 101 permit esp host 192.168.60.2 host 192.168.60.1 access-list 101 permit icmp host 10.10.20.1 host 192.168.45.1 access-list 101 permit udp host 192.168.60.2 eq ntp host 192.168.60.1 access-list 101 deny ip any any log access-list 102 permit udp host 192.168.60.1 eq isakmp host 192.168.60.2 eq isakmp access-list 102 permit esp host 192.168.60.1 host 192.168.60.2 access-list 102 permit icmp host 192.168.45.1 host 10.10.20.1 access-list 102 permit udp host 192.168.60.1 host 192.168.60.2 eq ntp access-list 102 deny ip any any log access-list 102 remark access list for serial ! ! control-plane ! banner login ^C

----------------------------------------------------------------------- Cisco Router and Security Device Manager (SDM) is installed on this device. This feature requires the one-time use of the username "cisco" with the password "cisco". The default username and password have a privilege level of 15.

Please change these publicly known initial credentials using SDM or the IOS CLI. Here are the Cisco IOS commands.

username privilege 15 secret 0 no username cisco

Replace and with the username and password you want to use.

For more information about SDM please follow the instructions in the QUICK START GUIDE for your router or go to

formatting link
^C ! line con 0 exec-timeout 0 0 login local line aux 0 line vty 0 4 access-class 23 in privilege level 15 login local transport input telnet line vty 5 15 access-class 23 in privilege level 15 login local transport input telnet ! scheduler allocate 20000 1000 ntp clock-period 17179792 ntp server 192.168.60.2 end

Reply to
John
Loading thread data ...
  1. is the t1 circuit running error free ? post show interface Serial0/0/0 from both Cisco routers

  1. what is the ping time from cisco to Cisco without crypto - ie.e telnet to 192.168.60.2 and use extended ping to ping 192.168.60.1 specifing the source ip address of 192.168.60.2 so ICMP traffic is not encrypted

  2. what is the crypto engine ? post output of show crypto engine brief and show crypto engine config
Reply to
Merv

Thanks Merv,

I was initially having problems with the T1 circuit, and apparently I wasn't successful in resetting the counters. Below is the output from all of the appropriate commands, I'll post this again in a day so that we can really see how many errors are on the line. I don't know why I couldn't reset the counters correctly.

RouterA#show int RouterA#show interfaces ser RouterA#show interfaces serial 0/0/0

Serial0/0/0 is up, line protocol is up Hardware is GT96K with integrated T1 CSU/DSU Internet address is 192.168.60.2/24 MTU 1500 bytes, BW 1536 Kbit, DLY 20000 usec, reliability 255/255, txload 2/255, rxload 32/255 Encapsulation PPP, LCP Open Open: IPCP, CDPCP, loopback not set Keepalive set (10 sec) Last input 00:00:34, output 00:00:00, output hang never Last clearing of "show interface" counters 1w5d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 587 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/2/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 1152 kilobits/sec 5 minute input rate 195000 bits/sec, 15 packets/sec 5 minute output rate 15000 bits/sec, 15 packets/sec 23559760 packets input, 1976230037 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 950 giants, 0 throttles 2137594 input errors, 2137587 CRC, 910829 frame, 514382 overrun, 0 ignored, 1609455 abort 13121353 packets output, 1495974250 bytes, 0 underruns 0 output errors, 0 collisions, 3077 interface resets 0 output buffer failures, 0 output buffers swapped out 2264 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

RouterA#show cryp RouterA#show crypto engi RouterA#show crypto engine bri RouterA#show crypto engine brief crypto engine name: Virtual Private Network (VPN) Module crypto engine type: hardware State: Enabled Location: onboard 0 Product Name: Onboard-VPN HW Version: 1.0 Compression: Yes DES: Yes 3 DES: Yes AES CBC: Yes (128,192,256) AES CNTR: No Maximum buffer length: 4096 Maximum DH index: 0150 Maximum SA index: 0150 Maximum Flow index: 0300 Maximum RSA key size: 0000

crypto engine name: Cisco VPN Software Implementation crypto engine type: software serial number: crypto engine state: installed crypto engine in slot: N/A

RouterA#show cryp RouterA#show crypto en RouterA#show crypto engine conf RouterA#show crypto engine configuration

crypto engine name: Virtual Private Network (VPN) Module crypto engine type: hardware State: Enabled Location: onboard 0 Product Name: Onboard-VPN HW Version: 1.0 Compression: Yes DES: Yes 3 DES: Yes AES CBC: Yes (128,192,256) AES CNTR: No Maximum buffer length: 4096 Maximum DH index: 0150 Maximum SA index: 0150 Maximum Flow index: 0300 Maximum RSA key size: 0000

crypto lib version: 19.0.0

crypto engine in slot: 0 platform: VPN hardware accelerator

Crypto Adjacency Counts: Lock Count: 12900514 Unlock Count: 12900514 crypto lib version: 19.0.0

RouterA#

RouterB#show int RouterB#show interfaces ser RouterB#show interfaces serial 0/0/0 Serial0/0/0 is up, line protocol is up Hardware is GT96K with integrated T1 CSU/DSU Internet address is 192.168.60.1/24 MTU 1500 bytes, BW 1536 Kbit, DLY 20000 usec, reliability 255/255, txload 23/255, rxload 1/255 Encapsulation PPP, LCP Open Open: IPCP, CDPCP, loopback not set Keepalive set (10 sec) Last input 00:00:07, output 00:00:00, output hang never Last clearing of "show interface" counters 2w4d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 381 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/3/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 1152 kilobits/sec 5 minute input rate 2000 bits/sec, 3 packets/sec 5 minute output rate 144000 bits/sec, 2 packets/sec 13117561 packets input, 1495469746 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 9 giants, 0 throttles 115808429 input errors, 115808418 CRC, 386659 frame, 220707 overrun, 0 ignored, 115584936 abort 23573970 packets output, 1978976121 bytes, 0 underruns 0 output errors, 0 collisions, 4280 interface resets 0 output buffer failures, 0 output buffers swapped out 2281 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

RouterB#show cryp RouterB#show crypto engi RouterB#show crypto engine bri RouterB#show crypto engine brief crypto engine name: Virtual Private Network (VPN) Module crypto engine type: hardware State: Enabled Location: onboard 0 Product Name: Onboard-VPN HW Version: 1.0 Compression: Yes DES: Yes 3 DES: Yes AES CBC: Yes (128,192,256) AES CNTR: No Maximum buffer length: 4096 Maximum DH index: 0150 Maximum SA index: 0150 Maximum Flow index: 0300 Maximum RSA key size: 0000

crypto engine name: Cisco VPN Software Implementation crypto engine type: software serial number: crypto engine state: installed crypto engine in slot: N/A

RouterB#show cryp RouterB#show crypto en RouterB#show crypto engine conf RouterB#show crypto engine configuration

crypto engine name: Virtual Private Network (VPN) Module crypto engine type: hardware State: Enabled Location: onboard 0 Product Name: Onboard-VPN HW Version: 1.0 Compression: Yes DES: Yes 3 DES: Yes AES CBC: Yes (128,192,256) AES CNTR: No Maximum buffer length: 4096 Maximum DH index: 0150 Maximum SA index: 0150 Maximum Flow index: 0300 Maximum RSA key size: 0000

crypto lib version: 19.0.0

crypto engine in slot: 0 platform: VPN hardware accelerator Crypto Adjacency Counts: Lock Count: 23341238 Unlock Count: 23341223 crypto lib version: 19.0.0

RouterB#exit

RouterA#ping Protocol [ip]: Target IP address: 192.168.60.1 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: 192.168.60.2 Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.60.1, timeout is 2 seconds: Packet sent with a source address of 192.168.60.2 ..... Success rate is 0 percent (0/5) RouterA#ping 10.10.20.1

Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.20.1, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) RouterA#ping Protocol [ip]: Target IP address: 10.10.20.1 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: 192.168.45.1 Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.20.1, timeout is 2 seconds: Packet sent with a source address of 192.168.45.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms RouterA#exit

Reply to
John
  1. You have a built-in hardware cypto engine - this is a good thing :-))

  1. The command to use to clear the interface counters is "clear counters"

  2. Between the two show interface serial commands that you posted, the T1 flapped 17 times (interface transitions) - you need to get the T1 circuit running clean.

  1. the latecy over the T1 ifrom the pings you posted s in a range that I would expect to see.

So at this point, I would assume that the cause of your issue is a defective T1 circuit.

Reply to
Merv

Hey Merv. Thanks again for the info. I'm still a little confused though. This is the output from the serial lines today:

show int RouterA#show interfaces ser RouterA#show interfaces serial 0/0/0 Serial0/0/0 is up, line protocol is up Hardware is GT96K with integrated T1 CSU/DSU Internet address is 192.168.60.2/24 MTU 1500 bytes, BW 1536 Kbit, DLY 20000 usec, reliability 255/255, txload 1/255, rxload 29/255 Encapsulation PPP, LCP Open Open: IPCP, CDPCP, loopback not set Keepalive set (10 sec) Last input 00:00:34, output 00:00:00, output hang never Last clearing of "show interface" counters 1w6d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 726 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/2/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 1152 kilobits/sec 5 minute input rate 178000 bits/sec, 15 packets/sec 5 minute output rate 6000 bits/sec, 6 packets/sec 25017491 packets input, 3652156425 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 1053 giants, 0 throttles 2191716 input errors, 2191709 CRC, 933353 frame, 527363 overrun, 0 ignored, 1650453 abort 13982439 packets output, 1596948999 bytes, 0 underruns 0 output errors, 0 collisions, 3164 interface resets 0 output buffer failures, 0 output buffers swapped out 2436 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

RouterA#telnet 10.10.20.1

RouterB#show int RouterB#show interfaces ser RouterB#show interfaces serial 0/0/0 Serial0/0/0 is up, line protocol is up Hardware is GT96K with integrated T1 CSU/DSU Internet address is 192.168.60.1/24 MTU 1500 bytes, BW 1536 Kbit, DLY 20000 usec, reliability 255/255, txload 30/255, rxload 1/255 Encapsulation PPP, LCP Open Open: IPCP, CDPCP, loopback not set Keepalive set (10 sec) Last input 00:00:13, output 00:00:00, output hang never Last clearing of "show interface" counters 2w4d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 406 Queueing strategy: weighted fair Output queue: 0/1000/64/0 (size/max total/threshold/drops) Conversations 0/3/256 (active/max active/max total) Reserved Conversations 0/0 (allocated/max allocated) Available Bandwidth 1152 kilobits/sec 5 minute input rate 10000 bits/sec, 10 packets/sec 5 minute output rate 185000 bits/sec, 17 packets/sec 13978648 packets input, 1596442234 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 9 giants, 0 throttles 115849580 input errors, 115849569 CRC, 404498 frame, 231001 overrun, 0 ignored, 115615807 abort 25032556 packets output, 3655981289 bytes, 0 underruns 0 output errors, 0 collisions, 4369 interface resets 0 output buffer failures, 0 output buffers swapped out 2453 carrier transitions DCD=up DSR=up DTR=up RTS=up CTS=up

It looks like the line hasn't flapped since our last output. I've reset the counters (thank you, I must have put in clear counters at the configuration prompt), and I'll post again in a couple of days with new output.

However, if this is a bad T1 circuit, should I just call the telco and have them inspect the line? What would they do as far as tweaking goes? Is there anything I can configure on the cisco routers?

Thanks again.

-- John

Reply to
John

It does not looks like the clear counters command took

Reply to
Merv

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.