Some VPN packet is being dropped and particular counter increased and traffic slow.

Retired Member — Sun, 13 Jul 2014 08:53:36 GMT

Hello guys,

I have a issue about the IPsecVPN tunnel. One side of IPsecVPN tunnel is slow for receiving traffic but opposite side is OK to receiving traffic.

flow_tunnel_activate 2 0 info flow tunnel Number of packets that triggerred tunnel activation

flow_tunnel_decap_err 47373 0 drop flow tunnel Packet dropped: tunnel decapsulation error

flow_tunnel_ipsec_replay_err 47372 0 drop flow tunnel Packet dropped: header sequence number is a replay

flow_tunnel_ipsec_wrong_spi 1 0 drop flow tunnel Packet dropped: IPsec SA for spi in packet not found

As you above that flow_tunnel_decap_err and flow_tunnel_ipsec_replay_err counter are being increased and I believe that dropped packet caused above counter that makes slow to tunneled traffic.

I also disabled the option the replay protection on IPsecVPN configuration as below. But flow_tunnel_ipsec_replay_err counter is being increased for now even if anti-replay option disabled.

<tunnel-monitor>

</tunnel-monitor>

<anti-replay>no</anti-replay>

<copy-tos>no</copy-tos>

<tunnel-interface>tunnel.1</tunnel-interface>

I cannot understand why above counter increasing and tunneled packet are being dropped. I read that similar case IPSec Tunnel is up but Packet is Getting Dropped with Wrong SPI Counter Increase but I cannot solve the my case.

Anybody knows about this issue? if yes, Please let me know and help.

Thanks.

Regards,

Roh

Re: Some VPN packet is being dropped and particular counter increased and traffic slow.

ajbool — Sun, 13 Jul 2014 10:48:46 GMT

Rather than just checking the config for the anti-replay status, can you check the live tunnel itself with the command,

show vpn flow name <tunnel name>

There is an "anti-replay check" field in the output of this command...

Re: Some VPN packet is being dropped and particular counter increased and traffic slow.

pulukas — Sun, 13 Jul 2014 14:02:21 GMT

Could you run through the phase 2 troubleshooting command outlined in the following document.

How to Troubleshoot VPN Connectivity Issues

topic Some VPN packet is being dropped and particular counter increased and traffic slow. in General Topics

Some VPN packet is being dropped and particular counter increased and traffic slow.

Re: Some VPN packet is being dropped and particular counter increased and traffic slow.

Re: Some VPN packet is being dropped and particular counter increased and traffic slow.