MPLS VRF AND LAN ISSUE

[ldomingues]

Hello everybody

I have a funny inssue using MPLS VPN (VRF) with Lan (ethernet) in both side of my VRF. look the scene:

CustomerMachines--->Fa0/0.1(Pe1)---MPLS CORE---(Pe2)Fa0/0.2---> CustomerServer

Just one machine each time of lan in Pe1 can ping the server in Pe2, I dont get simultaneous traffic, for example:

If machine 1 in Pe1 is pinging Server in Pe2, just this machine send traffic, if machine2 try to ping I get time out, if I stop machine 1 pinging server, so machine 2 start ping.

Very starnge.. Any idea

[jarvar832004]

Kinda looks like a LAN issue. But does the same happen when u try to ping the wan (default gateway) ip too ?

[ldomingues]

All the machines ping the GW in Pe1

[ktd]

Hi,

I have a few questions:

1) is the routing OK on each PE/CE

2) Do you have same using Serial Interfaces?

3) Are you using Ethernet connection in the core? If yes, have you increased the MTU size to 1526 bytes on the core links?

4) Do you have CE router or are the servers connected direclty?

regards,

swen

[swaroop.potdar]

Similar behavior is observed when DDOS mitigation solutions have been deployed for Datacenters with strict thresholds.

Also verify with your other end is there any type of DDOS mitigation or ICMP ratelimiting implemented on towards the CE which connects to the server.

Definately nothing related to MPLS as such.

HTH-Cheers,

Swaroop

[ldomingues]

swaroop.potdar

I have no rate limiting to ICMP and no DDOS protection.

[ldomingues]

1 - yes, in fact I dont have CE, all the machines is direct connected in PE1 in sub interface Fast, and in the another side of VRF I have the server which is diretced connnected to the Pe2 in fast too. but the routing is OK.

2 - If I use Serial ou even I put a CE with 2 Fast Interface link this : MAchines-->Fa(CE)Fa-->Pe1---MPLS CORE-->Pe2-->server

It works fine, seems link Fast Issue (arp, something like that).

3 - I already use mtu 1530

4 - the server is direct connected to the PE2

[ldomingues]

Does Anybody still have some idea?

[attrgautam]

Iam sure some kind of logs of the ICMP packets would help to see if the server is receiving the echo request and what is the return ICMP error messages on both of the PEs ? It is not an issue with MPLS as pointed earlier.

A wild idea will be there is some kind of NAT based restriction (D-NAT) and you have run out of IP pools :).