CISCO 7206VXR (NPE-G2) sudden reboot

[Alard_626]

Hello!

I have CISCO 7206 router with NPE-G2 and 2 gig of memory.

There's a vpn and pppoe servers on this unit and it hold maximum of 250-300 simultaneous connections. Periodically (1-5 times/hour) router suddenly reboots with lots of messages in console:

IPFLOW: Warning: V5 overfill -Traceback= 0x14975E4z 0x1A133F4z 0x1A16CC0z 0x1A17754z 0x1A17870z 0x3337874z 0x28F80Cz 0x66A704z

*** System received a Software forced crash ***

signal= 0x17, code= 0x700, context= 0x61b5c60

  PC = 0x0066849c, SP = 0x086a814c, LR = 0x00668460

and sometimes with like this:

%SYS-3-CPUHOG: Task is running for (2004)msecs, more than (2000)msecs (20/13),process = RADIUS.

-Traceback= 0x1FE7CE0 0x56878BC 0x1FE822C 0x1FE82F4 0x1772F70 0x1773C34 0x1774134 0x1774ACC 0x1777C00 0x1774134 0x178ECC0 0x178F444 0x177E79C 0x177EF1C 0x26508D8

I googled about first "V5 overfill" but no luck, i analyzed crashifo's with cisco tool and it said - it is ios problem, but if i change ios - problem lives again, no matter which ios i use.

Can anyone help me to solve this? Im ready to give any info...

THank you.

[Collin Clark]

If it's a consistent crash your best bet is to open a TAC case. They probably know a stable IOS version or have engineering code for a temporary fix.

Hope it helps.

[Alard_626]

After long ivestigation my problem i've found that router crashes due to high CPU utilisation, which is likely caused by security issue (worms, viruses, etc.) I've applied ACL to interfaces, trying to deny most commonly used by worms ports, and it helps somewhat, but router still crashes, no so often, but still does. My ACL looks like this:

ip access-list extended Anti_worm

deny   tcp any any eq 137

deny   udp any any eq netbios-ns

deny   tcp any any eq 135

deny   udp any any eq 135

deny   tcp any any eq 138

deny   udp any any eq netbios-dgm

deny   tcp any any eq 139

deny   udp any any eq netbios-ss

deny   tcp any any eq 445

deny   udp any any eq 445

deny   tcp any any eq 593

deny   udp any any eq 593

deny   udp any any eq rip

deny   tcp any any eq 136

deny   udp any any eq 136

deny   tcp any any eq 555

deny   udp any any eq 555

deny   tcp any any eq 2000

deny   udp any any eq 2000

deny   tcp any any eq 2001

deny   udp any any eq 2001

deny   tcp any any eq 12345

deny   udp any any eq 12345

deny   tcp any any eq 12346

deny   udp any any eq 12346

deny   tcp any any eq 20034

deny   udp any any eq 20034

deny   tcp any any eq 27374

deny   udp any any eq 27374

deny   tcp any any eq 30100

deny   udp any any eq 30100

deny   tcp any any eq 30102

deny   udp any any eq 30102

deny   tcp any any eq 31337

deny   udp any any eq 31337

deny   tcp any any eq 31338

deny   udp any any eq 31338

deny   tcp any any eq 31785

deny   udp any any eq 31785

deny   tcp any any eq 31789

deny   udp any any eq 31789

deny   tcp any any eq 31791

deny   udp any any eq 31791

deny   tcp any any eq 54321

deny   udp any any eq 54321

deny   tcp any any eq 54320

deny   udp any any eq 54320

deny   tcp any any eq 65000

deny   udp any any eq 65000

deny   udp any any eq 80

deny   udp any any eq 8080

deny   udp any any eq 1326

deny   tcp any any eq 2222

deny   tcp any any eq 6669

deny   tcp any any eq 6711

deny   tcp any any eq 6712

deny   tcp any any eq 6776

deny   tcp any any eq 7000

deny   tcp any any eq 16660

deny   tcp any any eq 16959

deny   udp any any eq 27444

deny   tcp any any eq 27665

deny   udp any any eq 31335

deny   tcp any any eq 33270

deny   tcp any any eq 39168

permit ip any any

and here's a "sh ip access-lists Anti_worm" output:

Extended IP access list Anti_worm

    10 deny tcp any any eq 137

    20 deny udp any any eq netbios-ns (20610 matches)

    30 deny tcp any any eq 135

    40 deny udp any any eq 135

    50 deny tcp any any eq 138 (9 matches)

    60 deny udp any any eq netbios-dgm (1294 matches)

    70 deny tcp any any eq 139 (4 matches)

    80 deny udp any any eq netbios-ss

    90 deny tcp any any eq 445 (113000 matches)

    100 deny udp any any eq 445

    110 deny tcp any any eq 593

    120 deny udp any any eq 593

    130 deny udp any any eq rip (53 matches)

    140 deny tcp any any eq 136

    150 deny udp any any eq 136

    160 deny tcp any any eq 555 (3 matches)

    170 deny udp any any eq 555

    180 deny tcp any any eq 2000 (540 matches)

    190 deny udp any any eq 2000 (79 matches)

    200 deny tcp any any eq 2001 (495 matches)

    210 deny udp any any eq 2001 (11772 matches)

    220 deny tcp any any eq 12345 (138 matches)

    230 deny udp any any eq 12345 (144 matches)

    240 deny tcp any any eq 12346 (10 matches)

    250 deny udp any any eq 12346 (18 matches)

    260 deny tcp any any eq 20034 (20 matches)

    270 deny udp any any eq 20034 (5 matches)

    280 deny tcp any any eq 27374 (9 matches)

    290 deny udp any any eq 27374 (33 matches)

    300 deny tcp any any eq 30100 (10 matches)

    310 deny udp any any eq 30100 (18 matches)

    320 deny tcp any any eq 30102 (5 matches)

    330 deny udp any any eq 30102 (2 matches)

    340 deny tcp any any eq 31337 (24 matches)

    350 deny udp any any eq 31337 (25 matches)

    360 deny tcp any any eq 31338 (6 matches)

    370 deny udp any any eq 31338 (5 matches)

    380 deny tcp any any eq 31785 (5 matches)

    390 deny udp any any eq 31785 (3 matches)

    400 deny tcp any any eq 31789 (8 matches)

    410 deny udp any any eq 31789 (6 matches)

    420 deny tcp any any eq 31791 (31 matches)

    430 deny udp any any eq 31791 (12 matches)

    440 deny tcp any any eq 54321 (277 matches)

    450 deny udp any any eq 54321 (136 matches)

    460 deny tcp any any eq 54320 (73 matches)

    470 deny udp any any eq 54320 (29 matches)

    480 deny tcp any any eq 65000 (8 matches)

    490 deny udp any any eq 65000 (96 matches)

    500 deny udp any any eq 80 (772 matches)

    510 deny udp any any eq 8080 (205 matches)

    520 deny udp any any eq 1326 (55 matches)

    530 deny tcp any any eq 2222 (6267 matches)

    540 deny tcp any any eq 6669 (9 matches)

    550 deny tcp any any eq 6711 (9 matches)

    560 deny tcp any any eq 6712 (6 matches)

    570 deny tcp any any eq 6776 (3 matches)

    580 deny tcp any any eq 7000 (19 matches)

    590 deny tcp any any eq 16660 (28 matches)

    600 deny tcp any any eq 16959 (18 matches)

    610 deny udp any any eq 27444 (5 matches)

    620 deny tcp any any eq 27665 (8 matches)

    630 deny udp any any eq 31335 (4 matches)

    640 deny tcp any any eq 33270 (39 matches)

    650 deny tcp any any eq 39168 (42 matches)

    660 permit ip any any (74622188 matches)

So, maybe there are some more ports i need to close, or, maybe, some other things i've missed out?

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Assuming an ACL is the solution, perhaps you can shorten yours by using ACLs that only allow specific traffic to the router itself.

[Alard_626]

This ACL applies to Vitrual template interface (pptp, pppoe) and i suspect flood is going through netflow, but cannot determine which port exactly is generating this flood.

[Leo Laohoo]

You could also try to upgrade the IOS.

What bandwidth is the G2 processing?

[Alard_626]

Bandwidth does not reach 100 Mbit/s, also, i tried different IOSes, but no luck...