Some VPN packet is being dropped and particular counter increased and traffic slow.

[RohJaewoong]

Hello guys,

I have a issue about the IPsecVPN tunnel.  One side of IPsecVPN tunnel is slow for receiving traffic but opposite side is OK to receiving traffic.

flow_tunnel_activate                       2        0 info      flow      tunnel    Number of packets that triggerred tunnel activation

flow_tunnel_decap_err                  47373        0 drop      flow      tunnel    Packet dropped: tunnel decapsulation error

flow_tunnel_ipsec_replay_err           47372        0 drop      flow      tunnel    Packet dropped: header sequence number is a replay

flow_tunnel_ipsec_wrong_spi                1        0 drop      flow      tunnel    Packet dropped: IPsec SA for spi in packet not found

As you above that flow_tunnel_decap_err and flow_tunnel_ipsec_replay_err counter are being increased and I believe that dropped packet caused above counter that makes slow to tunneled traffic.

I also disabled the option the replay protection on IPsecVPN configuration as below. But flow_tunnel_ipsec_replay_err counter is being increased for now even if anti-replay option disabled.

              <tunnel-monitor>

                <enable>no</enable>

              </tunnel-monitor>

              <anti-replay>no</anti-replay>

              <copy-tos>no</copy-tos>

              <tunnel-interface>tunnel.1</tunnel-interface>

I cannot understand why above counter increasing and tunneled packet are being dropped. I read that similar case IPSec Tunnel is up but Packet is Getting Dropped with Wrong SPI Counter Increase but I cannot solve the my case.

Anybody knows about this issue? if yes, Please let me know and help.

Thanks.

Regards,

Roh

[ajbool]

Rather than just checking the config for the anti-replay status, can you check the live tunnel itself with the command,

show vpn flow name <tunnel name>

There is an "anti-replay check" field in the output of this command...

[pulukas]

Could you run through the phase 2 troubleshooting command outlined in the following document.

How to Troubleshoot VPN Connectivity Issues