Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

GETVPN slow

Hi all,

I’m checking a weird problem in my network. I hope someone can help me with it.

I’ve configured GETVPN solution recently. Since we have changed to this solution people have detected some applications work slowly. Lines are working fine, there is no problem of jitter, icmp, lost of packets and the time response with the main site is working properly as well. We have tried to change the MTU to avoid fragmentation issues but the problem persist after the change. When we change the traffic to other line without GETVPN solution the applications work fine so I think GETVPN could be the cause of the problem. Connection is made through MPLS network. I paste the config used on the main site and on the branch site.

Topology:

GM1-> Cisco 1941

GM2 -> ASR1002

GM1 ---> GETVPN (MPLS Network) <--- GM2

GM1 - Site with problems.

crypto keyring GDOI

pre-shared-key address x.x.x.x key passwordkey

pre-shared-key address x.x.x.x key passwordkey

pre-shared-key address x.x.x.x key passwordkey

pre-shared-key address x.x.x.x key passwordkey

!

crypto isakmp policy 10

encr 3des

authentication pre-share

!

!

crypto gdoi group GETVPN

identity number 101

server address ipv4 y.y.y.y

server address ipv4 y.y.y.y

server address ipv4 y.y.y.y

server address ipv4 y.y.y.y

client registration interface LoopbackX

!

!

crypto map GETVPN_MAP 10 gdoi

set group GETVPN

WAN:

interface GigabitEthernet0/0

ip address X.X.X.X 255.255.255.252

load-interval 30

duplex auto

speed auto

crypto map GETVPN

ROUTERGM1#sh int giga 0/0 | i MTU

MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,

LAN:

interface GigabitEthernet0/1

ip address x.x.x.x 255.255.255.0

ip tcp adjust-mss 1360

duplex auto

speed auto

GM2 - Office with aplication servers.

crypto keyring GDOI

pre-shared-key address x.x.x.x key passwordkey

pre-shared-key address x.x.x.x key passwordkey

pre-shared-key address x.x.x.x key passwordkey

pre-shared-key address x.x.x.x key passwordkey

!

crypto isakmp policy 10

encr 3des

authentication pre-share

!

!

crypto gdoi group GETVPN

identity number 101

server address ipv4 y.y.y.y

server address ipv4 y.y.y.y

server address ipv4 y.y.y.y

server address ipv4 y.y.y.y

client registration interface LoopbackX

!

!

crypto map GETVPN_MAP 10 gdoi

set group GETVPN

WAN:

interface GigabitEthernet0/0/1

ip address X.X.X.X 255.255.255.252

load-interval 30

duplex auto

speed auto

crypto map GETVPN

ROUTERGM2#sh int giga 0/0/0 | i MTU

MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,

LAN:

interface GigabitEthernet0/0/0

ip address x.x.x.x 255.255.255.0

ip tcp adjust-mss 1360

duplex auto

speed auto

Key Server - ACL used:

   access-list deny eigrp any any

   access-list deny pim any any

   access-list deny udp any port = 500 any port = 500

   access-list deny udp any any port = 848

   access-list deny udp any port = 848 any

   access-list deny tcp any port = 443 any

   access-list deny tcp any any port = 443

   access-list deny tcp any any port = 179

   access-list deny tcp any port = 179 any

   access-list deny esp any any

   access-list deny tcp any any port = 49

   access-list deny tcp any port = 49 any

   access-list deny ospf any any

   access-list deny pim any 224.0.0.0 0.0.0.255

   access-list deny udp any any port = 123

   access-list deny udp any any port = 1645

   access-list deny udp any any port = 1646

   access-list deny udp any any port = 1812

   access-list deny udp any any port = 1813

   access-list deny tcp any any port = 22

   access-list deny tcp any port = 22 any

   access-list permit ip any any

Any clue about this problem?

Thanks

1 REPLY
Cisco Employee

GETVPN slow

Where did you change MTU exactly? What are the applications facing slowness using. What are the sniffer traces showing?

I think the problems still needs a better definition, if you see what I mean.

That being said, fragmentation related problem IS the most likely cause (rule of thumb) in which case lower the MSS on LAN-facing interfaces and not the MTU.

That takes care of fragmentation in TCP world, doesn't touch much for UDP. But as I said it's all about knowing exactly WHAT the problem is.

137
Views
0
Helpful
1
Replies
CreatePlease to create content