CiscoWorks DFM GRE tunnel interface

David Niemann · ‎09-09-2009

I keep getting a high utilization warning in DFM for a GRE tunnel. How do you configure the threshold for a GRE tunnel or remove checking it's utilization?

Name Value

Event_Description HighUtilization

Component IF-<removed>/16 [Tu2] [192.168.100.17] [GRE Tunnel to <removed>]

ComponentClass Interface

ComponentEventCode 1056

Type TUNNEL

MaxSpeed 9000

CurrentUtilization 100.474075 %

InputPacketRate 3.6 PPS

TrafficRate 1130.3334 BYPS

UtilizationThreshold 80

DuplexMode FULLDUPLEX

OutputPacketRate 3.1208334 PPS

Joe Clarke · ‎09-09-2009

The problem here is that the utilization is above 100%. In cases of tunnel interfaces, this typically means the bandwidth set on the tunnel is lower than the actual bandwidth, and DFM is using the wrong value for ifSpeed when calculating utilization. Use the interface "bandwidth" command to set the correct ifSpeed on the interface, then rediscover the device in DFM.

David Niemann · ‎09-10-2009

Are you saying that I need to have bandwidth configured on the WAN interface and the tunnel interface?

Here is what I currently have. The multilink is a 9Mbps consisting of 4 T1s.

interface Multilink1

description

ip address 255.255.255.252

ip route-cache flow

no cdp enable

ppp multilink

ppp multilink fragment disable

ppp multilink group 1

crypto map INBOUND_CUSTOMERS

crypto ipsec df-bit clear

interface Tunnel2

description GRE Tunnel to

ip address 255.255.255.252

ip mtu 1420

ip tcp adjust-mss 1350

tunnel source Loopback1

tunnel destination

Joe Clarke · ‎09-10-2009

If you're sure that the maximum bandwidth of the link is only 9 Mbps, then you may be seeing a bug in DFM in which bogus utilization values are shown (i.e. those over 100%). In order to determine if this is the problem, you should start a sniffer trace filtering on all SNMP traffic to this device, and let it run for at least 8 minutes.

Assuming the high utilization event is still active in DFM after these 8 minutes, then the data in the trace will show if the device is reporting a utilization over 100%, or if the problem is DFM. If it's DFM, then an upgrade to LMS 3.2 will fix this.

David Niemann · ‎09-10-2009

Actually I misspoke. Four T1s would be 6Mbps. I am sure of the speed. I will try the packet capture you recommended. There is another bug that I have found that requires the upgrade to LMS3.2 so I'm betting this is related.

David Niemann · ‎09-10-2009

Here are the sh ints for the multilink and the tunnel. I see the multilink showing up as approx 6Mbps and the tunnels shows up at 9Mbps. I ran the snmp capture and indeed see interface with index 16 (tunnel2) as reporting 9Mbps. Where is it getting the 9Mbps from? I don't have it specified on the tunnel2 interface.

Multilink1 is up, line protocol is up

Hardware is multilink group interface

Description:

Internet address is

MTU 1500 bytes, BW 6144 Kbit, DLY 100000 usec,

Tunnel2 is up, line protocol is up

Hardware is Tunnel

Description: GRE Tunnel to

Internet address is

MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,

Joe Clarke · ‎09-10-2009

Okay, I see. The device is reporting 9 Kbps instead of 9 Mbs. Add the following config under interface Tunnel2:

bandwidth 9000

Then rediscover the device in DFM. The speed of the interface should change.