Cisco ISR 4321 Router

[salomidhogela]

Hi

I am currently experiencing issues on the ISR 4321 Version 17.3.5 whereby the tunnel hangs and I need to reset it for packets to start transmitting.I have experiencing this issue on two devices already.

Regards,

Salom

[Richard Burts]

Other than the model of the router and the version of code we have no detail information to work with. Are there any log messages generated when this happens? If so please post the log messages. Otherwise I would ask that you post the configuration of the router.

[balaji.bandi]

i agree with Ric here, you need also give further information in additional :

1. what is the other side device, is this cisco or any other vendor ?

2. Do you have control on another end? have you tried reset the tunnel other side instead of Router 4K here ?

3. how is you config looks like both the end.

4. is this issue from day 1 ? or did you see it recently or is this a new setup?

5. what kind of throughput license you have, and what throughput router handling.

[salomidhogela]

1. Cisco device

2. Yes, tunnel can reset from either end resolve the issue

3. I do not understand your question here.

4. It happened on device after a restart, on another device it happen two consecutive days(no device restart). I have replaced the 2900 with ISR4000, I still have one 2900 in the environment but I do not experience the same issue.

5. The current throughput level is 50000 kbps

[balaji.bandi]

 I have replaced 2900 with ISR4000  - is this issue after replacing the router, and with 2900 work fine ?

3. I do not understand your question here.  - Post the tunnel config both the sides

[salomidhogela]

Yes the issue is happening after router replacement.

#Configs

description connectivity_to_***
ip address x.x.x.x x.x.x.x
ip mtu 9000
ip nat outside
ip route-cache same-interface
ip tcp adjust-mss 1448
crypto map Max_map
crypto ipsec df-bit clear
crypto ipsec fragmentation after-encryption
!

[MHM Cisco World]

ip mtu 9000!!!

sure the tunnel is flapping.

[salomidhogela]

The weird thing is that, I had the same configs on my old 2900 and after replacing it with ISR4321 I am now experiencing this issue. Could it be a bug maybe on the IOS?

[balaji.bandi]

Try remove MTU and see (what interface is this ?) gig ?

[salomidhogela]

It's a loopback interface, I will remove the MTU and test. On the outside interface I using the default MTU, and TCP MSS 1448.

[salomidhogela]

There are actually no logs for that specific peer. It happens this way that I am unable to send files size larger than 4kb and after resetting the tunnel it start transmitting. This only affect one tunnel, the other ones are fine.

Salom

[MHM Cisco World]

 ping check the large MTU you can pass through the tunnel 

<hint use ping with sweep>

after check the MTU after it the ping is failed, config the correct MTU in tunnel interface.
also correct TCP MSS in tunnel.

[salomidhogela]

I can send 1400 mtu size without df set and I have configured TCP MSS of 1448.

[MHM Cisco World]

First df must set for mtu check,

Second always tcp mss lower than mtu

[Elliot Dierksen]

The TCP MSS is without the headers. If you can ping with 1400 byte ICMP packets, try setting TCP MSS to 1360.