cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3601
Views
10
Helpful
8
Replies

Cisco 887VA adsl connection up but only certain websites reachable?

TRO Group
Level 1
Level 1

Hi Guys

I have a very very strange issue occuring here with two Cisco 887VA adsl routers and would really appreiciate your guy's help.

The aDSL circuit is up and connected and I can reach the internet, however not all sites on the internet are reachable. This is occurring on two seperate 887VA’s and the circuit has been tested with a netgear router and no issues occur.  The router has been tried on 5 different ADSL connections and the same problem occurs although more websites can be reached on a home broadband connection (ADSL2+ Annex A) as opposed to the problem being more severe on an ADSL2+ Annex M circuit.  The problem seems to affect websites that are full of adverts more than sites that have single domain landing pages. 

The sites that I cannot reach are pingable.

This happens on multiple machines behind the router.

The same config is used on an cisco 877-M router with no issues.

Any idea what might be causing this.

! Last configuration change at 14:52:30 UTC Wed Feb 13 2013

version 15.2

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Router

!

boot-start-marker

boot-end-marker

!

!

logging buffered 4096

!

no aaa new-model

memory-size iomem 10

!

!

no ip source-route

ip auth-proxy max-login-attempts 5

ip admission max-login-attempts 5

!

!

!

!

!

ip name-server 88.215.61.255

ip inspect log drop-pkt

ip cef

no ipv6 cef

!

parameter-map type inspect global

log dropped-packets enable

!

license udi pid CISCO887VA-K9 sn FCZ1645C347

!

!

!

!

!

!

!

controller VDSL 0

!

!

!

!

!

!

!

!

!

!

interface Ethernet0

no ip address

shutdown

!

interface ATM0

no ip address

no atm ilmi-keepalive

!

interface ATM0.1 point-to-point

mtu 1492

pvc 0/38

  encapsulation aal5mux ppp dialer

  dialer pool-member 1

!

!

interface FastEthernet0

no ip address

!

interface FastEthernet1

no ip address

!

interface FastEthernet2

no ip address

!

interface FastEthernet3

no ip address

!

interface Vlan1

ip address 10.12.0.250 255.255.0.0

ip nat inside

ip virtual-reassembly in

!

interface Dialer0

mtu 1492

ip address negotiated

ip nat outside

ip virtual-reassembly in

encapsulation ppp

dialer pool 1

dialer-group 1

ppp authentication chap callin

ppp chap hostname 01614348379@b2bdsl

ppp chap password 0 yGK9KscgaP

ppp ipcp dns request accept

ppp ipcp route default

ppp ipcp address accept

!

no ip forward-protocol nd

no ip http server

no ip http secure-server

!

ip dns server

ip nat inside source list 1 interface Dialer0 overload

ip route 0.0.0.0 0.0.0.0 Dialer0

!

access-list 1 permit any

!

!

!

line con 0

line aux 0

line vty 0 4

login

transport input all

!

!

end

8 Replies 8

Peter Paluch
Cisco Employee
Cisco Employee

Hello,

I see several tiny issues with your config - let's try to correct them and verify whether that improves the behavior.

  1. Your configuration is a PPP-over-ATM, or PPPoA type. I believe that in this case, no MTU changes are necessary. In fact, it may be exactly the manipulation with MTU that could be causing this trouble. Please remove the mtu 1492 both from interfaces ATM0.1 and Dialer0.
  2. From the Dialer0, remove these commands: ppp authentication chap callin and dialer-group 1. Both are unnecessary. The first command asks your router to request the ISP to authenticate to you if the ISP calls you. Obviously, that can never happen, as on DSL, there is no "call-in" or "call-out", hence this command is irrelevant. Do not worry, you will not deactivate your CHAP authentication towards the ISP. The second command defines a list of "interesting traffic" that causes your router to dial a number. Again, this was used with dialup solutions but this has no meaning on always-on technologies like DSL.
  3. Your ACL 1 is currently written as "permit any". Use of this ACL for NAT purposes is officially unsupported by Cisco. You should always write ACLs used for NAT to be specific about the internal addresses you want to translate. Please remove the ACL 1 and replace it with the following:

access-list 1 permit 10.12.0.0 0.0.255.255

In addition, if all these changes have no positive effect, try configuring your PC to use an external DNS server, such as 8.8.8.8. Perhaps there are some lags with DNS lookups caused by the DNS server you're currently using.

Please keep us informed!

Best regads,

Peter

Hi Paul

Many thanks for your response, i have implemented your recommendation however there is no change.

Regards

Jon

Sorry forgot to mention I have already tried the DNS trick as thought this might of been the case but there is no change.

A quick example

Yahoo.co.uk is one website i cannot reach, if i do a tracert i get a successful connection all the way to the IP the yahoo.co.uk resolves too.

but still the website will not appear in the browser.

Jon

Hello Jon,

Thank you for keeping me informed.

Hmmm... this is strange. There may be some MTU-related issues after all but it is surprising to me.

Let's try to modify the MSS of all TCP sessions that pass through this router. On the Dialer0 interface, please add the following command:

ip tcp adjust-mss 1400

It is set to quite a low conservative value. Then please give it a try again.

Thank you!

Best regards,

Peter

Sorry Peter just realised i called you Paul!

This has worked sir! Can i ask what this is actually doing?

Hello Jon,

Don't worry about my name - I've been renamed from Peter to Paul countless times (though I wonder why...)

Anyway, this is interesting that it made it work. As you probably know, when a TCP session is established, both parties negotiate the maximum size of a TCP segment that can be sent to a particular peer in this session. Usually, this size (abbreviated as MSS) is 1460 bytes, following the fact that with additional TCP header (20B) and IP header (20B), the total IP packet size is 1500 bytes - the usual size.

What the ip tcp adjust-mss command does is actually rewrite the MSS size advertised during TCP connection establishement to a lower value that is specified by this command. In essence, the router affects any TCP session passing through it in a way that it forces the end hosts to send smaller segments. The TCP endpoints do not really know this has happened - to them, it will simply seem that the other party has announced a smaller MSS.

The question is... why did this help in your case? It seems that this service is not purely PPPoA. Now, our goal is to find out the maximum MSS size we can use without problems. This value works but by allowing larger segments, we decrease the overhead.

We will do this by sending a series of pings of increasing size to a responding IP address, say, 8.8.8.8, in which we prohibit any fragmentation. Proceed according to the following transcript:

Router# ping

Protocol [ip]:

Target IP address: 8.8.8.8

Repeat count [5]: 1

Datagram size [100]:

Timeout in seconds [2]:

Extended commands [n]: y

Source address or interface:

Type of service [0]:

Set DF bit in IP header? [no]: yes

Validate reply data? [no]:

Data pattern [0xABCD]:

Loose, Strict, Record, Timestamp, Verbose[none]: v

Loose, Strict, Record, Timestamp, Verbose[V]:

Sweep range of sizes [n]: y

Sweep min size [36]: 1400

Sweep max size [18024]: 1500

Sweep interval [1]:

Type escape sequence to abort.

Sending 101, [1400..1500]-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:

Packet sent with the DF bit set

Request 0 timed out (size 1400)

Reply to request 1 (243 ms) (size 1401)

Reply to request 2 (159 ms) (size 1402)

Reply to request 3 (227 ms) (size 1403)

Reply to request 4 (461 ms) (size 1404)

Reply to request 5 (344 ms) (size 1405)

Reply to request 6 (235 ms) (size 1406)

Reply to request 7 (201 ms) (size 1407)

Reply to request 8 (67 ms) (size 1408)

Reply to request 9 (58 ms) (size 1409)

Reply to request 10 (51 ms) (size 1410)

Reply to request 11 (50 ms) (size 1411)

Reply to request 12 (50 ms) (size 1412)

Reply to request 13 (51 ms) (size 1413)

Reply to request 14 (67 ms) (size 1414)

Reply to request 15 (50 ms) (size 1415)

Reply to request 16 (50 ms) (size 1416)

Reply to request 17 (50 ms) (size 1417)

Reply to request 18 (51 ms) (size 1418)

Reply to request 19 (58 ms) (size 1419)

Reply to request 20 (51 ms) (size 1420)

Reply to request 21 (42 ms) (size 1421)

Reply to request 22 (51 ms) (size 1422)

Reply to request 23 (50 ms) (size 1423)

Reply to request 24 (50 ms) (size 1424)

Reply to request 25 (42 ms) (size 1425)

Reply to request 26 (84 ms) (size 1426)

Reply to request 27 (59 ms) (size 1427)

Reply to request 28 (50 ms) (size 1428)

Reply to request 29 (51 ms) (size 1429)

Reply to request 30 (50 ms) (size 1430)

Reply to request 31 (59 ms) (size 1431)

Reply to request 32 (50 ms) (size 1432)

Reply to request 33 (50 ms) (size 1433)

Reply to request 34 (59 ms) (size 1434)

Reply to request 35 (51 ms) (size 1435)

Reply to request 36 (50 ms) (size 1436)

Reply to request 37 (50 ms) (size 1437)

Reply to request 38 (59 ms) (size 1438)

Reply to request 39 (51 ms) (size 1439)

Reply to request 40 (58 ms) (size 1440)

Reply to request 41 (51 ms) (size 1441)

Reply to request 42 (58 ms) (size 1442)

Reply to request 43 (51 ms) (size 1443)

Reply to request 44 (50 ms) (size 1444)

Reply to request 45 (50 ms) (size 1445)

Reply to request 46 (59 ms) (size 1446)

Reply to request 47 (50 ms) (size 1447)

Reply to request 48 (51 ms) (size 1448)

Reply to request 49 (50 ms) (size 1449)

Reply to request 50 (59 ms) (size 1450)

Reply to request 51 (50 ms) (size 1451)

Reply to request 52 (50 ms) (size 1452)

Reply to request 53 (59 ms) (size 1453)

Reply to request 54 (50 ms) (size 1454)

Reply to request 55 (50 ms) (size 1455)

Reply to request 56 (50 ms) (size 1456)

Reply to request 57 (59 ms) (size 1457)

Reply to request 58 (50 ms) (size 1458)

Reply to request 59 (50 ms) (size 1459)

Reply to request 60 (59 ms) (size 1460)

Reply to request 61 (50 ms) (size 1461)

Reply to request 62 (51 ms) (size 1462)

Reply to request 63 (159 ms) (size 1463)

Reply to request 64 (50 ms) (size 1464)

Reply to request 65 (59 ms) (size 1465)

Reply to request 66 (50 ms) (size 1466)

Reply to request 67 (50 ms) (size 1467)

Reply to request 68 (59 ms) (size 1468)

Reply to request 69 (51 ms) (size 1469)

Reply to request 70 (50 ms) (size 1470)

Reply to request 71 (126 ms) (size 1471)

Reply to request 72 (58 ms) (size 1472)

Reply to request 73 (51 ms) (size 1473)

Reply to request 74 (50 ms) (size 1474)

Reply to request 75 (59 ms) (size 1475)

Reply to request 76 (59 ms) (size 1476)

Reply to request 77 (50 ms) (size 1477)

Reply to request 78 (50 ms) (size 1478)

Reply to request 79 (50 ms) (size 1479)

Reply to request 80 (50 ms) (size 1480)

Reply to request 81 (50 ms) (size 1481)

Reply to request 82 (50 ms) (size 1482)

Reply to request 83 (51 ms) (size 1483)

Reply to request 84 (50 ms) (size 1484)

Reply to request 85 (51 ms) (size 1485)

Reply to request 86 (50 ms) (size 1486)

Reply to request 87 (59 ms) (size 1487)

Reply to request 88 (50 ms) (size 1488)

Reply to request 89 (50 ms) (size 1489)

Reply to request 90 (51 ms) (size 1490)

Reply to request 91 (50 ms) (size 1491)

Reply to request 92 (51 ms) (size 1492)

Request 93 timed out (size 1493)

Request 94 timed out (size 1494)

Request 95 timed out (size 1495)

Request 96 timed out (size 1496)

Request 97 timed out (size 1497)

Request 98 timed out (size 1498)

Request 99 timed out (size 1499)

Request 100 timed out (size 1500)

Success rate is 91 percent (92/101), round-trip min/avg/max = 42/71/461 ms

Note that here, we start losing packets with the total packet size of 1493, with 1492 bytes being the last usable size. The corresponding TCP MSS would therefore be 40 bytes less, i.e. 1452. Following this experiment, the Dialer0 would be configured using two additional commands:

ip mtu 1492

ip tcp adjust-mss 1452

Would you mind performing a similar experiment? Before running it, though, remove any ip mtu or mtu commands from your Dialer0 interface.

Best regards,

Peter

Would that fact that i have no switch between the router and the connecting PC make a difference?

Hi Jon,

No, that should not make any difference.

Best regards,

Peter