Hi,

I ve sent the attch.

I will give the over view of the incident. The 2821 Router sits inbetween the WAN MPLS cloud and the data center. The packets from global sites pass through the 2821 to access the applications hosted in data center. Over the past two days this Router took hits at the same time and it repeated today again for about 8 mins whcih resulted in global sites' inaccessibility of applications.

Hi, now that I remember you asked this question already yesterday.

Your router is not crashing. The network interruptions are due either to MPLS malfunctioning (more likely), or some transient condition in the router itself (much less likely).

You should also explain what it means that router is "taking hits" and how you did realized it does.

We realized this when the applications were not accesible and I had logged in to the Router prior to the incident and later got disconnected.Also I dont think it could be an issue on MPLS as this Router is running static routes and does not come in MPLS cloud.

The monitoring tool server which sits in data center throwed alert for all the global site devices which are next to the WAN Router

Hi,

Actually from your description it seems to me that these are the exact symptoms of a network interruption in the MPLS cloud.

Having static routes does not guarantee uninterrupted communication with the remote sites.

You also need to clarify what exactly are "global site devices next to the WAN router". A diagram would help in that. It must include all and any router in the scenario, as well the exact type of circuit linking them.

I don't have a n/w dia for the moment.

Global site devices are the routers spread across different regions for different sites which all form the MPLS cloud.

The packet flow is like this,

site1<->site 1 MPLS router<->MPLS cloud<->MPLS head end router<->the problematic WAN router<->FW<->applications in data center.

Ok, now suppose that the circuit or something else between and goes down, the monitoring applications would correctly report all remote sites down.

Depending on the IP address used to poll the "problematic" router router, it could also report it down as well, while in fact it has no issue. This would happen if using the "MPLS facing" address to connect/poll, and the MPLS router is reloaded or crashing.

Another great source of information about network health is logs, especially when collected both locally and to a central site, with a common time synchronization.

Do not just assume that you have a problematic router because your remotes become unreachable. If this is the first network you administer, it will take a while for you to understand what the "weak points" actually are.

What do you think would be the fix for this?

Report trouble to the MPLS provider.

Up to this point, it has not been proved that anything is wrong with the 2821 router.