Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

IP Inspect on a 2611 Router

IP inspect has been running on a clients router for around 1-1/2 years. Around 2 months ago, they started having what they throught were DNS problems. I eventually got involved, and tracked it down to their 2611 Internet router. As soon as I turn off IP inspect, everything works as normal. The interesting problem is that this appears to only affect DNS responses, as I can still telnet, ftp, web browse, etc., if I know the IP address.

The router was initially running 12.0(7), and since then I've tried 12.1(?)GD, and 12.2(13b). They all do exactly the same thing. The router config was not changed, as I have the original config - I configured the router and date when I save them. Additionally, I pulled the old router out and put in another 2600, and they have had no problems.

It appears that DNS responses are dropped when a threshold is reached for the number of inspection sessions. UDP timeouts are set for 15 seconds, tcp and other protocol timeouts are set for 3600. The router has 16 MB flash and 48 MB DRAM, and when this is happening there is 23 MB or so DRAM left. I initially thought it might be memory related; however, I feel that something in additional to DNS responses would be impacted if that was the case.

TIA - Allyn


Re: IP Inspect on a 2611 Router

May be the network conditions have changed now. Try to change your udp and dns-timeout values and see how it behaves.

I understand the default udp timeout is 30 secs. You can change this to the default value and also the dns-timeout value to its default of 5 seconds.

CreatePlease to create content