CiscoWorks DFM GRE tunnel interface

Unanswered Question
Sep 9th, 2009
User Badges:

I keep getting a high utilization warning in DFM for a GRE tunnel. How do you configure the threshold for a GRE tunnel or remove checking it's utilization?

Name Value

Event_Description HighUtilization

Component IF-<removed>/16 [Tu2] [] [GRE Tunnel to <removed>]

ComponentClass Interface

ComponentEventCode 1056


MaxSpeed 9000

CurrentUtilization 100.474075 %

InputPacketRate 3.6 PPS

TrafficRate 1130.3334 BYPS

UtilizationThreshold 80


OutputPacketRate 3.1208334 PPS

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Joe Clarke Wed, 09/09/2009 - 08:19
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

The problem here is that the utilization is above 100%. In cases of tunnel interfaces, this typically means the bandwidth set on the tunnel is lower than the actual bandwidth, and DFM is using the wrong value for ifSpeed when calculating utilization. Use the interface "bandwidth" command to set the correct ifSpeed on the interface, then rediscover the device in DFM.

David Niemann Thu, 09/10/2009 - 04:08
User Badges:

Are you saying that I need to have bandwidth configured on the WAN interface and the tunnel interface?

Here is what I currently have. The multilink is a 9Mbps consisting of 4 T1s.

interface Multilink1


ip address

ip route-cache flow

no cdp enable

ppp multilink

ppp multilink fragment disable

ppp multilink group 1


crypto ipsec df-bit clear

interface Tunnel2

description GRE Tunnel to

ip address

ip mtu 1420

ip tcp adjust-mss 1350

tunnel source Loopback1

tunnel destination

Joe Clarke Thu, 09/10/2009 - 07:49
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

If you're sure that the maximum bandwidth of the link is only 9 Mbps, then you may be seeing a bug in DFM in which bogus utilization values are shown (i.e. those over 100%). In order to determine if this is the problem, you should start a sniffer trace filtering on all SNMP traffic to this device, and let it run for at least 8 minutes.

Assuming the high utilization event is still active in DFM after these 8 minutes, then the data in the trace will show if the device is reporting a utilization over 100%, or if the problem is DFM. If it's DFM, then an upgrade to LMS 3.2 will fix this.

David Niemann Thu, 09/10/2009 - 08:45
User Badges:

Actually I misspoke. Four T1s would be 6Mbps. I am sure of the speed. I will try the packet capture you recommended. There is another bug that I have found that requires the upgrade to LMS3.2 so I'm betting this is related.

David Niemann Thu, 09/10/2009 - 09:11
User Badges:

Here are the sh ints for the multilink and the tunnel. I see the multilink showing up as approx 6Mbps and the tunnels shows up at 9Mbps. I ran the snmp capture and indeed see interface with index 16 (tunnel2) as reporting 9Mbps. Where is it getting the 9Mbps from? I don't have it specified on the tunnel2 interface.

Multilink1 is up, line protocol is up

Hardware is multilink group interface


Internet address is

MTU 1500 bytes, BW 6144 Kbit, DLY 100000 usec,

Tunnel2 is up, line protocol is up

Hardware is Tunnel

Description: GRE Tunnel to

Internet address is

MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,

Joe Clarke Thu, 09/10/2009 - 08:35
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Okay, I see. The device is reporting 9 Kbps instead of 9 Mbs. Add the following config under interface Tunnel2:

bandwidth 9000

Then rediscover the device in DFM. The speed of the interface should change.


This Discussion