SR520 Locks up with Domain traffic

Unanswered Question
Dec 30th, 2009

Hello everyone, we are having an issue with a SR520 that I though I'd run by everyone.

We have a SR520 setup with a site to site VPN to an ASA5505. The SR520 has 10 computers behind it and the ASA has 15 computers behind it, including the domain controller. Everything has been running smooth without issue, traffic passing in both directions, etc. However, we recently installed a Windows Domain controller (SBS 2008) at the main (asa) site and would like to start joining computers at the remote (sr520) site to the domain. What we found out is that the domain traffic locks up the SR520. So, if none of the computers are joined to the domain, it runs fine, traffic can flow in both directions. We join a computer to the domain & after a couple hours we can't access the main site from the remote site. We can access the remote site from the main site. Also, the computers at the remote site can't access the internet, although we can ping the outside interface of the SR (from a remote host), and even ssh to the SR through the VPN which runs across the internet service. We reboot the SR520 and everything works fine, for a couple of hours.

I reviewed the access-lists and the traffic seems to be qualifying for the correct lists. I even tried to clear the acl counters, but no luck.

My best theory, at this point, is that the domain traffic exceeds some limit and the SR gets confused and can't route the traffic anymore.

At any rate, I had a few questions in regards to this:

1. Any ideas?

2. Could this be a problem with the domain traffic exceeding some compacity on the SR520? If so, how would I measure that?

3. Does anyone have any experience with a scenario like this? Specifically, with running a SR520 at a remote site with domain-joined computers?

4. Are there any specific debug commands that we can use to troubleshoot this?

I can upload the configs also, but I wanted to get the discussion going. We are trying to get the smartnet cleared up, so I can open a case with the TAC, but until then I just have to do my best.



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


This Discussion