06-04-2009 05:31 AM - edited 03-04-2019 04:59 AM
Hope someone can help!
We have Verizon FIOS 20/20Mbps service at our facility connected to a 1812 router.
We seem to be having a performce issue. Some websites display slowly. Can someone have a look and see what is wrong with my config?
ip tcp selective-ack
ip tcp window-size 1045440
ip tcp synwait-time 10
ip tcp path-mtu-discovery
no ip bootp server
ip domain name salterhealthcare.com
ip name-server 192.168.1.1
ip ssh time-out 60
ip ssh authentication-retries 2
ip inspect alert-off
ip inspect one-minute high 1100
ip inspect one-minute low 950
interface FastEthernet0
description Internet$ES_WAN$$FW_OUTSIDE$$ETH-WAN$
ip address x.x.x.x 255.255.255.0
ip access-group 101 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip inspect DEFAULT100 in
ip inspect DEFAULT100 out
ip virtual-reassembly
ip route-cache flow
speed 100
full-duplex
crypto map SDM_CMAP_1
Verizon suggest that I run their optimizer on all 100 of my workstation/laptops. Is this really neccessary?
Really need help on this one, thanks!
06-04-2009 07:16 AM
Hello Bob
Are all the internet sites having issues ? Did you do "speed tests" with arbitary servers on the internet to notice the performance (download and upload speeds) ? How many PC's are you trying to serve here ? There is nothing major with the config sent which could affect the performance.. not sure if optimizer is needed here..
Raj
06-04-2009 07:23 AM
Some more then others. I have used both speakeasy.net/speedtest and verison's speed test, both seem pretty good, but some web pages can sometimes take a minute to display, especially from one of our ASP's.
We have about 50 PC's here. Bandwidth usage is nominal around 500k on average.
06-04-2009 07:27 AM
Bob..
Did you try accessing these sites from home or from any other internet connection (comcast, etc) ? what sites are these ? http/https only, or some kinda java based applicaiton sites ? do a "show log" on the router and see if you get any deny messages locally or from the IPS ? lastly you can run a sniffer and see exactly what is happening on the network, to confirm on the issue !
Raj
06-04-2009 07:48 AM
All the websites I have problems with, I have tried from home, which I have a 3Mbps DSL line, and they work great. Here I have a 20/20Mbps FIOS and it seems slower than DSL at times.
As for the router log, I have granted the laptops that are having the most problems, entire access to internet, no blocks.
I just think it's some kind of packet loss, etc on the WAN side of the router.
06-04-2009 07:20 AM
Please provide your entire config.
06-04-2009 07:41 AM
06-04-2009 08:10 AM
Hello Bob
If it works from your home, it surely seems a local issue.. Is the traffic to the sites having issues going through the IPSEC tunnel to some other location for exit, or going locally on the circuit provisioned on your router ? Just to isolate the issue, can u try:
1) removing the IPS statements from the outbound interface (ip inspect commands), and see if it solves the issue ?
2) check acl 101 and see if it blocks any communication with the sites involved ? just try removing it to isolate the issue.
3) try to run a sniffer to see the exact nature of this issue !
4) can you give us a show interface output to see if there are any errors on the link ?
5) Is the issue only with certain PCs on your LAN, or on all PCs ?
Raj
06-04-2009 08:21 AM
If I remove the inspect statment from outside int will it disrupt network?
what is the command I should run on the interface to see output?
Sorry, but I'm not familiar with using a sniffer.
Yes, all PC's, workstations and laptops.
06-04-2009 09:57 AM
I dont think it will disrupt the network.. In any case you can do it after hours, and run some testings.. You can login to the router and given a "show interface serx/x" to find status about the WAN interface.
Raj
06-04-2009 10:06 AM
I removed all inspections except for tcp and udp.
Here is the output...
rtr-win#show inter fast0
FastEthernet0 is up, line protocol is up
Hardware is PQ3_TSEC, address is 001a.2fe3.ff1e (bia 001a.2fe3.ff1e)
Description: Internet$ES_WAN$$FW_OUTSIDE$$ETH-WAN$
Internet address is x.x.x.x/24
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, 100BaseTX/FX
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:01, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 451
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 759000 bits/sec, 95 packets/sec
5 minute output rate 297000 bits/sec, 72 packets/sec
9301173 packets input, 2058587644 bytes
Received 1484 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog
0 input packets with dribble condition detected
8280686 packets output, 3747420086 bytes, 0 underruns
0 output errors, 0 collisions, 3 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
06-04-2009 08:23 AM
If I remove the inspect statment from outside int will it disrupt network?
what is the command I should run on the interface to see output?
Sorry, but I'm not familiar with using a sniffer.
Yes, all PC's, workstations and laptops.
06-04-2009 10:06 AM
Could you post your cpu process history and interface stats?
06-04-2009 10:10 AM
Got to tell you, seems quicker already now that I have removed the inspections.
rtr-win#show inter fast0 stats
FastEthernet0
Switching path Pkts In Chars In Pkts Out Chars Out
Processor 611893 153518672 3681948 1410979892
Route cache 8708853 1920921216 4612785 2339656510
Total 9320746 2074439888 8294733 3750636402
rtr-win#
rtr-win#show cpu per
PQ3 Performance Monitor Counters
================================
PMGC0 =0x00000000
PMLCA0=0x00000000, PMLCB0=0x00000000, PMC0= 0x00001F16:78BE621B
PMLCA1=0x00000000, PMLCB1=0x00000000, PMC1= 0x00000000:00000000
PMLCA2=0x00000000, PMLCB2=0x00000000, PMC2= 0x00000000:00000000
PMLCA3=0x00000000, PMLCB3=0x00000000, PMC3= 0x00000000:00000000
PMLCA4=0x00000000, PMLCB4=0x00000000, PMC4= 0x00000000:00000000
PMLCA5=0x00000000, PMLCB5=0x00000000, PMC5= 0x00000000:00000000
PMLCA6=0x00000000, PMLCB6=0x00000000, PMC6= 0x00000000:00000000
PMLCA7=0x00000000, PMLCB7=0x00000000, PMC7= 0x00000000:00000000
PMLCA8=0x00000000, PMLCB8=0x00000000, PMC8= 0x00000000:00000000
E500 Performance Monitor Counters
=================================
PMGC0 =0x00000000
PMLCA0=0x00000000,PMLCB0=0x00000000, PMC0= 0x00000000:00000000
PMLCA1=0x00000000,PMLCB1=0x00000000, PMC1= 0x00000000:00000000
PMLCA2=0x00000000,PMLCB2=0x00000000, PMC2= 0x00000000:00000000
PMLCA3=0x00000000,PMLCB3=0x00000000, PMC3= 0x00000000:00000000
rtr-win#
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: