topic Re: packet drops on traffic going through IPsec tunnel. in General Topics

packet drops on traffic going through IPsec tunnel.

pradip1069 — Wed, 13 Jun 2018 16:03:22 GMT

Hi,

We are getting packet drops on traffic going through IPsec tunnel.We have checked ISP link but there is no drops on ISP link even no load on it. Tunnel is aslo up but getting intermittent drops on traffic goint on IPsec tunnel.
We have checked both end firewall but no sucesses.

Kindly help.ule

Thnaks & Regard
Pradeep Chaugule

Re: packet drops on traffic going through IPsec tunnel.

BPry — Wed, 13 Jun 2018 18:17:49 GMT

@pradip1069

Run the command 'show vpn flow name <value>' and post the output.

May also want to verify global counters with the porper filters on both ends to see if there are any errors or discards. 'show counter global filter severity drop aspect tunnel category flow'

Re: packet drops on traffic going through IPsec tunnel.

hfregoso — Thu, 14 Jun 2018 01:11:39 GMT

Have you tried to perfom a connectivity test from public to public IP (no encrytion)? Is it running fine?

Palo Alto has automatic MTU adjustment, what about your rmeote VPN device?

Can you run show global counters for erros and drops? That will give you evidence about the type of drops in the firewall and possible cause.

Re: packet drops on traffic going through IPsec tunnel.

pradip1069 — Thu, 14 Jun 2018 09:23:51 GMT

Hi,

Thanks for reply , Please find the below "show vpn flow name <value>" and 'show counter global filter severity drop aspect tunnel category flow' command output.

Re: packet drops on traffic going through IPsec tunnel.

BPry — Thu, 14 Jun 2018 13:21:15 GMT

@pradip1069,

The only thing that really sticks out on any of that too my eyes is that fact that you have 9 replay packets. How exactly have you identified that you are dropping the packets on the tunnel? Have you taken a PCAP on both ends to verify that the end device in question isn't dropping the traffic?

Re: packet drops on traffic going through IPsec tunnel.

hfregoso — Thu, 14 Jun 2018 13:30:08 GMT

I agree.

Could you please ellaborate more about how did you identify the packet loss?

Re: packet drops on traffic going through IPsec tunnel.

pradip1069 — Mon, 18 Jun 2018 06:22:07 GMT

Hi,

We have checking connectivity by pinging remote server IP which is located in UK southampton (Head Office), which is connected through tunnl. However we have rectify the problem , the problem is in remote firewall, its not stable, having a performance issue. Remote engineer will trying to resolve issue by shifting tunnle to another firewall.

Thanks for your support.

Regards,

Pradeep