Some VPN packet is being dropped and particular counter increased and traffic slow.

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Some VPN packet is being dropped and particular counter increased and traffic slow.

L3 Networker

Hello guys,

I have a issue about the IPsecVPN tunnel.  One side of IPsecVPN tunnel is slow for receiving traffic but opposite side is OK to receiving traffic.

flow_tunnel_activate                       2        0 info      flow      tunnel    Number of packets that triggerred tunnel activation

flow_tunnel_decap_err                  47373        0 drop      flow      tunnel    Packet dropped: tunnel decapsulation error

flow_tunnel_ipsec_replay_err           47372        0 drop      flow      tunnel    Packet dropped: header sequence number is a replay

flow_tunnel_ipsec_wrong_spi                1        0 drop      flow      tunnel    Packet dropped: IPsec SA for spi in packet not found

As you above that flow_tunnel_decap_err and flow_tunnel_ipsec_replay_err counter are being increased and I believe that dropped packet caused above counter that makes slow to tunneled traffic.

I also disabled the option the replay protection on IPsecVPN configuration as below. But flow_tunnel_ipsec_replay_err counter is being increased for now even if anti-replay option disabled.







I cannot understand why above counter increasing and tunneled packet are being dropped. I read that similar case IPSec Tunnel is up but Packet is Getting Dropped with Wrong SPI Counter Increase but I cannot solve the my case.

Anybody knows about this issue? if yes, Please let me know and help.





L3 Networker

Rather than just checking the config for the anti-replay status, can you check the live tunnel itself with the command,

show vpn flow name <tunnel name>

There is an "anti-replay check" field in the output of this command...

L7 Applicator

Could you run through the phase 2 troubleshooting command outlined in the following document.

How to Troubleshoot VPN Connectivity Issues

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!