I have a Cisco 887VA router that has a working VDSL configuration. It syncs with an attainable rate of 48932 kbits/s and 13432 kbits/s. Speed tests max out around 38Mbits and I can get download speeds of 4.5MB/s but the CPU utilisation hits the roof. I'm trying to work through the process to determine exactly what is causing the high CPU utilisation. I'm guessing its related to a combination of NAT and/or the zone based firewall but would like to know exactly how I can find out what is causing this so I can look at my options to improve the performance. I would have thought the hardware could be able to cope with full VDSL speed even with NAT enabled. Unless my configuration is wrong somewhere.
I have run a "show process cpu sort" and get the following results:
=============================
sh proc cpu sort
CPU utilization for five seconds: 96%/87%; one minute: 79%; five minutes: 32%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
283 405388 4774710 84 6.79% 0.55% 0.21% 0 Per-Second Jobs
92 71743328 23856936 3007 0.79% 1.38% 1.49% 0 COLLECT STAT COU
5 6339528 739749 8569 0.71% 0.17% 0.12% 0 Check heaps
98 1087752 611431395 1 0.15% 0.41% 0.26% 0 Ethernet Msec Ti
2 88512 954882 92 0.07% 0.23% 0.07% 0 Load Meter
116 6286520 7952493 790 0.07% 0.15% 0.12% 0 IP Input
251 19372 764109 25 0.07% 0.00% 0.00% 0 PPPoE Background
295 118140 148952256 0 0.07% 0.05% 0.05% 0 PPP Events
9 16 905 17 0.00% 0.00% 0.00% 0 WATCH_AFS
=============================
Now I understand that the reason why no process is showing with high CPU utilisation is because the usage is due to interrupt CPU utilisation. I have followed the guide for troubleshooting high CPU utilisation due to interrupts and got as far as looking at the "show cef not-cef-switched" after confirming that "ip cef" was enabled and active on the interfaces.
=============================
sh cef not-cef-switched
% Command accepted but obsolete, see 'show (ip|ipv6) cef switching statistics [feature]'
IPv4 CEF Packets passed on to next switching layer
Slot No_adj No_encap Unsupp'ted Redirect Receive Options Access Frag
RP 0 0 5211 0 293 0 0 0
=============================
sh ip cef switching statistics feature
IPv4 CEF input features:
Feature Drop Consume Punt Punt2Host Gave route
Dialer i/f overr 0 373876 1693 0 0
NAT Outside 0 0 0 1583 0
Total 0 373876 1693 1583 0
IPv4 CEF output features:
Feature Drop Consume Punt Punt2Host New i/f
Post-routing NAT 0 0 0 1760 0
Firewall (firewa 2 0 0 14 0
Total 2 0 0 1774 0
IPv4 CEF post-encap features:
Feature Drop Consume Punt Punt2Host New i/f
Total 0 0 0 0 0
IPv4 CEF for us features:
Feature Drop Consume Punt Punt2Host New i/f
CCE Firewall 115 0 0 0 0
Total 115 0 0 0 0
IPv4 CEF punt features:
Feature Drop Consume Punt Punt2Host New i/f
Total 0 0 0 0 0
IPv4 CEF local features:
Feature Drop Consume Punt Punt2Host Gave route
Total 0 0 0 0 0
=============================================
Now from this information I don't know whether this is a problem or how big of a problem. I have looked at some stats from a "show ip nat stat" command but there aren't that many translations happening when the CPU is so high and the CEF translated packets looks much higher than the CEF punted packets.
=============================================
sh ip nat stat
Total active translations: 85 (0 static, 85 dynamic; 85 extended)
Peak translations: 91, occurred 00:12:08 ago
Outside interfaces:
Dialer1, Virtual-Access3
Inside interfaces:
Vlan5
Hits: 1483141 Misses: 0
CEF Translated packets: 1477467, CEF Punted packets: 5212
Expired translations: 576
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface Dialer1 refcount 85
Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0
=============================================
Are there some other commands that I can run to get a better picture of the problem? I don't really want to have to resort to researching whether I can run the router in some bridge mode so NAT can be performed on my firewall that is 1 step behind the router. I only have 1 public IP address.
Can someone please provide some help or direction in how I can get to the bottom of this? Configuration is attached.
