GRE over IPSEC on 3745 with VPN module CPU

ahmad82pkn · ‎06-20-2012

Hi, i just configured GRE over IPSEC on my Cisco 3745 router with VPN module installed.

As soon i hit 25Mbps traffic, my CPU is touching 80%.

What maximum Traffic 3745 with GRE over IPSEC it can support?

Also show process CPU sorted dont show any evidence of which process eating it up.

any help?

sh processes cpu sorted

CPU utilization for five seconds: 75%/75%; one minute: 77%; five minutes: 78%

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

218 2016 1285 1568 0.24% 0.02% 0.00% 164 SSH Process

2 30956 12522290 2 0.00% 0.00% 0.00% 0 Load Meter

3 0 1 0 0.00% 0.00% 0.00% 0 chkpt message ha

1 96 2288 41 0.00% 0.00% 0.00% 0 Chunk Manager

5 38559212 6392206 6032 0.00% 0.05% 0.05% 0 Check heaps

6 6696 5076 1319 0.00% 0.00% 0.00% 0 Pool Manager

4 0 1 0 0.00% 0.00% 0.00% 0 EDDRI_MAIN

7 0 2 0 0.00% 0.00% 0.00% 0 Timers

9 0 1 0 0.00% 0.00% 0.00% 0 IPC Zone Manager

10 1808 62610957 0 0.00% 0.00% 0.00% 0 IPC Periodic Tim

11 1576 62610958 0 0.00% 0.00% 0.00% 0 IPC Deferred Por

12 0 1 0 0.00% 0.00% 0.00% 0 IPC Seat Manager

13 0 1 0 0.00% 0.00% 0.00% 0 IPC BackPressure

8 24 1043525 0 0.00% 0.00% 0.00% 0 IPC Dynamic Cach

14 0 1 0 0.00% 0.00% 0.00% 0 OIR Handler

16 136 2087049 0 0.00% 0.00% 0.00% 0 Environmental mo

17 2520264 37121473 67 0.00% 0.01% 0.00% 0 ARP Input

18 0 2 0 0.00% 0.00% 0.00% 0 ATM Idle Timer

19 0 6 0 0.00% 0.00% 0.00% 0 AAA high-capacit

20 0 1097 0 0.00% 0.00% 0.00% 0 AAA_SERVER_DEADT

21 0 1 0 0.00% 0.00% 0.00% 0 Policy Manager

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

22 0 11 0 0.00% 0.00% 0.00% 0 DDR Timers

23 4 4 1000 0.00% 0.00% 0.00% 0 Entity MIB API

24 36 201285 0 0.00% 0.00% 0.00% 0 EEM ED Syslog

25 1932 18722990 0 0.00% 0.00% 0.00% 0 HC Counter Timer

26 0 159 0 0.00% 0.00% 0.00% 0 Serial Backgroun

27 0 1 0 0.00% 0.00% 0.00% 0 RO Notify Timers

15 0 1 0 0.00% 0.00% 0.00% 0 Crash writer

28 0 2 0 0.00% 0.00% 0.00% 0 SMART

30 0 2 0 0.00% 0.00% 0.00% 0 Dialer event

31 0 1 0 0.00% 0.00% 0.00% 0 SERIAL A'detect

32 0 2 0 0.00% 0.00% 0.00% 0 XML Proxy Client

33 0 2 0 0.00% 0.00% 0.00% 0 cpf_process_msg_

34 0 1 0 0.00% 0.00% 0.00% 0 Inode Table Dest

35 0 1 0 0.00% 0.00% 0.00% 0 Critical Bkgnd

36 4712 27457713 0 0.00% 0.00% 0.00% 0 Net Background

37 0 3 0 0.00% 0.00% 0.00% 0 IDB Work

38 92 402500 0 0.00% 0.00% 0.00% 0 Logger

39 2816 62610960 0 0.00% 0.00% 0.00% 0 TTY Background

40 22856 62611837 0 0.00% 0.00% 0.00% 0 Per-Second Jobs

41 28 521762 0 0.00% 0.00% 0.00% 0 DHCPD Timer

42 0 1 0 0.00% 0.00% 0.00% 0 IKE HA Mgr

43 0 1 0 0.00% 0.00% 0.00% 0 IPSEC HA Mgr

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

44 7036 75 93813 0.00% 0.00% 0.00% 0 rf task

45 189312 6148524 30 0.00% 0.00% 0.00% 0 Net Input

46 2040 12522449 0 0.00% 0.00% 0.00% 0 Compute load avg

47 15223572 1048915 14513 0.00% 0.02% 0.00% 0 Per-minute Jobs

48 0 1 0 0.00% 0.00% 0.00% 0 AggMgr Process

49 0 1 0 0.00% 0.00% 0.00% 0 dev_device_inser

50 4 1 4000 0.00% 0.00% 0.00% 0 dev_device_remov

51 364 10435227 0 0.00% 0.00% 0.00% 0 mxt5100

52 0 1 0 0.00% 0.00% 0.00% 0 sal_dpc_process

53 0 1 0 0.00% 0.00% 0.00% 0 ARL Table Manage

54 0 2 0 0.00% 0.00% 0.00% 0 ESWILPPM

29 2340 62611444 0 0.00% 0.00% 0.00% 0 GraphIt

56 18264 250445728 0 0.00% 0.00% 0.00% 0 Netclock Backgro

57 0 2 0 0.00% 0.00% 0.00% 0 SM Monitor

55 0 2 0 0.00% 0.00% 0.00% 0 Eswilp Storm Con

59 0 1 0 0.00% 0.00% 0.00% 0 DSPFARM DSP READ

60 0 2 0 0.00% 0.00% 0.00% 0 FLEX DNLD MAIN

61 0 1 0 0.00% 0.00% 0.00% 0 HDV background

62 0 1 0 0.00% 0.00% 0.00% 0 RF_INTERDEV_DELA

63 0 1 0 0.00% 0.00% 0.00% 0 RF_INTERDEV_SCTP

64 1148 62610956 0 0.00% 0.00% 0.00% 0 Ether-Switch RBC

65 0 1 0 0.00% 0.00% 0.00% 0 AAL2CPS TIMER_CU

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

66 0 1 0 0.00% 0.00% 0.00% 0 IGMP Snooping Pr

67 0 1 0 0.00% 0.00% 0.00% 0 IGMP Snooping Re

68 52 2087049 0 0.00% 0.00% 0.00% 0 Call Management

69 0 1 0 0.00% 0.00% 0.00% 0 RF_INTERDEV_SCTP

70 0 1 0 0.00% 0.00% 0.00% 0 cpf_process_tpQ

71 4084 214754 19 0.00% 0.00% 0.00% 0 CRYPTO IKMP IPC

72 3040 62611445 0 0.00% 0.00% 0.00% 0 Crypto Device Up

73 0 2 0 0.00% 0.00% 0.00% 0 Multi-ISA Event

74 0 1 0 0.00% 0.00% 0.00% 0 Multi-ISA Cleanu

75 5456 62611445 0 0.00% 0.00% 0.00% 0 Kontrol Common H

76 0 2 0 0.00% 0.00% 0.00% 0 Dot11 auth Dot1x

77 0 1 0 0.00% 0.00% 0.00% 0 Dot11 Mac Auth

78 0 2 0 0.00% 0.00% 0.00% 0 dot1x

79 0 2 0 0.00% 0.00% 0.00% 0 DTP Protocol

80 1328 62610957 0 0.00% 0.00% 0.00% 0 PI MATM Aging Pr

81 56 6261141 0 0.00% 0.00% 0.00% 0 EtherChnl

82 0 2 0 0.00% 0.00% 0.00% 0 AAA Dictionary R

83 56 2326 24 0.00% 0.00% 0.00% 0 AAA Server

84 324 5668 57 0.00% 0.00% 0.00% 0 AAA ACCT Proc

85 0 1 0 0.00% 0.00% 0.00% 0 ACCT Periodic Pr

86 236244 10173374 23 0.00% 0.00% 0.00% 0 CDP Protocol

87 6879316 31063693 221 0.00% 0.03% 0.01% 0 IP Input

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

88 0 1 0 0.00% 0.00% 0.00% 0 ICMP event handl

89 0 28 0 0.00% 0.00% 0.00% 0 TurboACL

90 0 2 0 0.00% 0.00% 0.00% 0 TurboACL chunk

91 28 104160 0 0.00% 0.00% 0.00% 0 MOP Protocols

92 0 3 0 0.00% 0.00% 0.00% 0 PPP Hooks

94 0 1 0 0.00% 0.00% 0.00% 0 SSS Manager

95 160 8348189 0 0.00% 0.00% 0.00% 0 SSS Test Client

96 0 1 0 0.00% 0.00% 0.00% 0 SSS Feature Mana

97 16944 244575921 0 0.00% 0.00% 0.00% 0 SSS Feature Time

98 0 1 0 0.00% 0.00% 0.00% 0 VPDN call manage

99 0 1 0 0.00% 0.00% 0.00% 0 L2X Socket proce

100 0 1 0 0.00% 0.00% 0.00% 0 L2X SSS manager

101 116 1666 69 0.00% 0.00% 0.00% 0 L2TP mgmt daemon

102 0 1 0 0.00% 0.00% 0.00% 0 X.25 Encaps Mana

103 0 2 0 0.00% 0.00% 0.00% 0 EAPoUDP Process

104 0 2 0 0.00% 0.00% 0.00% 0 IP Host Track Pr

105 0 1 0 0.00% 0.00% 0.00% 0 IPv6 RIB Redistr

106 0 2 0 0.00% 0.00% 0.00% 0 KRB5 AAA

107 0 1 0 0.00% 0.00% 0.00% 0 IP Traceroute

108 1836 2028528 0 0.00% 0.00% 0.00% 0 IP Background

109 524 1044350 0 0.00% 0.00% 0.00% 0 IP RIB Update

58 0 2 0 0.00% 0.00% 0.00% 0 VNM DSPRM MAIN

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

111 0 2 0 0.00% 0.00% 0.00% 0 PPP IPCP

112 0 1 0 0.00% 0.00% 0.00% 0 Asy FS Helper

113 16732 99999726 0 0.00% 0.03% 0.02% 0 CEF process

114 2416 62611124 0 0.00% 0.00% 0.00% 0 Socket Timers

115 12260 2244604 5 0.00% 0.00% 0.00% 0 TCP Timer

110 0 2 0 0.00% 0.00% 0.00% 0 PPP IP Route

117 0 1 0 0.00% 0.00% 0.00% 0 COPS

118 0 2 0 0.00% 0.00% 0.00% 0 L2MM

119 0 1 0 0.00% 0.00% 0.00% 0 MRD

120 0 1 0 0.00% 0.00% 0.00% 0 IGMPSN

121 0 2 0 0.00% 0.00% 0.00% 0 RLM groups Proce

122 0 2 0 0.00% 0.00% 0.00% 0 DDP

123 0 5 0 0.00% 0.00% 0.00% 0 SNMP Timers

124 0 2 0 0.00% 0.00% 0.00% 0 SCTP Main Proces

125 0 1 0 0.00% 0.00% 0.00% 0 IUA Main Process

126 2908 62611039 0 0.00% 0.00% 0.00% 0 RUDPV1 Main Proc

127 0 1 0 0.00% 0.00% 0.00% 0 bsm_timers

128 1196 62610957 0 0.00% 0.00% 0.00% 0 bsm_xmt_proc

129 0 1 0 0.00% 0.00% 0.00% 0 CES Client SVC R

130 21616 125222248 0 0.00% 0.01% 0.00% 0 DHCPD Receive

131 0 2 0 0.00% 0.00% 0.00% 0 Dialer Forwarder

132 8 1043524 0 0.00% 0.00% 0.00% 0 IP Cache Ager

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

133 992 1043591 0 0.00% 0.00% 0.00% 0 Adj Manager

134 0 2 0 0.00% 0.00% 0.00% 0 ATM OAM Input

135 0 2 0 0.00% 0.00% 0.00% 0 ATM OAM TIMER

136 0 208707 0 0.00% 0.00% 0.00% 0 HTTP CORE

137 8 101 79 0.00% 0.00% 0.00% 0 RARP Input

138 0 1 0 0.00% 0.00% 0.00% 0 PAD InCall

139 0 2 0 0.00% 0.00% 0.00% 0 X.25 Background

140 0 2 0 0.00% 0.00% 0.00% 0 PPP Bind

141 0 2 0 0.00% 0.00% 0.00% 0 PPP SSS

142 35292 626064005 0 0.00% 0.03% 0.02% 0 RBSCP Background

143 0 1 0 0.00% 0.00% 0.00% 0 Inspect Timer

144 24 1043530 0 0.00% 0.00% 0.00% 0 DHCPD Database

145 4 208705 0 0.00% 0.00% 0.00% 0 Authentication P

146 0 1 0 0.00% 0.00% 0.00% 0 Auth-proxy AAA B

147 0 1 0 0.00% 0.00% 0.00% 0 CHKPT EXAMPLE

148 0 1 0 0.00% 0.00% 0.00% 0 CHKPT DevTest

149 0 1 0 0.00% 0.00% 0.00% 0 IPS Timer

150 0 2 0 0.00% 0.00% 0.00% 0 SDEE Management

151 0 1 0 0.00% 0.00% 0.00% 0 IPv6 Inspect Tim

152 0 2 0 0.00% 0.00% 0.00% 0 URL filter proc

153 0 3 0 0.00% 0.00% 0.00% 0 Crypto HW Proc

154 96 2 48000 0.00% 0.00% 0.00% 0 CCVPM_HDSPRM

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

155 1712 23172218 0 0.00% 0.00% 0.00% 0 FLEX DSPRM MAIN

156 680 23172216 0 0.00% 0.00% 0.00% 0 FLEX DSP KEEPALI

157 136 2504459 0 0.00% 0.00% 0.00% 0 CRM_CALL_UPDATE_

158 0 4 0 0.00% 0.00% 0.00% 0 HDA DSPRM MAIN

159 4 2 2000 0.00% 0.00% 0.00% 0 ENABLE AAA

160 0 1 0 0.00% 0.00% 0.00% 0 EM Background Pr

161 0 1 0 0.00% 0.00% 0.00% 0 Key chain liveke

162 0 2 0 0.00% 0.00% 0.00% 0 LINE AAA

163 16 2324 6 0.00% 0.00% 0.00% 0 LOCAL AAA

164 3480 23282 149 0.00% 0.00% 0.00% 0 TPLUS

165 0 2 0 0.00% 0.00% 0.00% 0 VSP_MGR

166 0 1 0 0.00% 0.00% 0.00% 0 encrypt proc

167 0 3 0 0.00% 0.00% 0.00% 0 Crypto WUI

168 88 655 134 0.00% 0.00% 0.00% 0 Crypto Support

169 0 1 0 0.00% 0.00% 0.00% 0 CCVPM_HTSP

170 0 2 0 0.00% 0.00% 0.00% 0 VPM_MWI_BACKGROU

171 0 1 0 0.00% 0.00% 0.00% 0 CCVPM_R2

172 0 69569 0 0.00% 0.00% 0.00% 0 FB/KS Log HouseK

173 0 2 0 0.00% 0.00% 0.00% 0 EPHONE MWI BG Pr

174 0 1 0 0.00% 0.00% 0.00% 0 CCSWVOICE

175 0 855 0 0.00% 0.00% 0.00% 0 TACACS+

176 0 1 0 0.00% 0.00% 0.00% 0 http client proc

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

177 2032 1282 1585 0.00% 0.00% 0.00% 163 SSH Process

178 0 1 0 0.00% 0.00% 0.00% 0 QOS_MODULE_MAIN

179 0 1 0 0.00% 0.00% 0.00% 0 RPMS_PROC_MAIN

180 0 1 0 0.00% 0.00% 0.00% 0 VoIP AAA

181 96 14827 6 0.00% 0.00% 0.00% 0 crypto engine pr

182 52 4 13000 0.00% 0.00% 0.00% 0 Crypto CA

183 0 1 0 0.00% 0.00% 0.00% 0 Crypto PKI-CRL

184 0 1 0 0.00% 0.00% 0.00% 0 Crypto SSL

185 8 122 65 0.00% 0.00% 0.00% 0 Crypto ACL

186 0 1 0 0.00% 0.00% 0.00% 0 CRYPTO QoS proce

187 0 1 0 0.00% 0.00% 0.00% 0 Crypto INT

188 325012 1633357 198 0.00% 0.00% 0.00% 0 Crypto IKMP

189 1516 3146089 0 0.00% 0.00% 0.00% 0 IPSEC key engine

190 0 1 0 0.00% 0.00% 0.00% 0 IPSEC manual key

191 24 132 181 0.00% 0.00% 0.00% 0 Crypto PAS Proc

192 724 11408 63 0.00% 0.00% 0.00% 0 Crypto Delete Ma

193 12120 923513 13 0.00% 0.00% 0.00% 0 Key Proc

194 0 1 0 0.00% 0.00% 0.00% 0 PM Callback

195 0 1 0 0.00% 0.00% 0.00% 0 DATA Transfer Pr

196 0 1 0 0.00% 0.00% 0.00% 0 DATA Collector

197 48 1823 26 0.00% 0.00% 0.00% 0 AAA SEND STOP EV

198 0 3 0 0.00% 0.00% 0.00% 0 EEM ED CLI

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

199 0 2 0 0.00% 0.00% 0.00% 0 EEM ED Counter

200 0 2 0 0.00% 0.00% 0.00% 0 EEM ED Interface

201 0 3 0 0.00% 0.00% 0.00% 0 EEM ED IOSWD

202 0 2 0 0.00% 0.00% 0.00% 0 EEM ED Memory-th

203 0 2 0 0.00% 0.00% 0.00% 0 EEM ED None

204 0 2 0 0.00% 0.00% 0.00% 0 EM ED OIR

205 0 2 0 0.00% 0.00% 0.00% 0 EEM ED SNMP

206 72 1043554 0 0.00% 0.00% 0.00% 0 EEM ED Timer

207 732 12971642 0 0.00% 0.00% 0.00% 0 EEM Server

208 88 6261141 0 0.00% 0.00% 0.00% 0 RMON Recycle Pro

209 0 2 0 0.00% 0.00% 0.00% 0 RMON Deferred Se

210 0 1 0 0.00% 0.00% 0.00% 0 Syslog Traps

211 1956 62610662 0 0.00% 0.00% 0.00% 0 trunk conditioni

212 0 1 0 0.00% 0.00% 0.00% 0 trunk conditioni

213 12 2 6000 0.00% 0.00% 0.00% 0 VLAN Manager

214 53256 129005717 0 0.00% 0.00% 0.00% 0 BGP Router

215 0 2 0 0.00% 0.00% 0.00% 0 EEM Policy Direc

216 316 201251 1 0.00% 0.00% 0.00% 0 Syslog

217 0 1 0 0.00% 0.00% 0.00% 0 VPDN Scal

116 848 3875 218 0.00% 0.00% 0.00% 0 TCP Protocols

219 11096 52171 212 0.00% 0.00% 0.00% 0 SSH Event handle

220 2363852 24666111 95 0.00% 0.00% 0.00% 0 IP SNMP

PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process

221 807748 12500348 64 0.00% 0.00% 0.00% 0 PDU DISPATCHER

222 10009408 12503189 800 0.00% 0.00% 0.00% 0 SNMP ENGINE

223 0 1 0 0.00% 0.00% 0.00% 0 SNMP ConfCopyPro

224 0 1 0 0.00% 0.00% 0.00% 0 SNMP Traps

226 4 12 333 0.00% 0.00% 0.00% 0 TCP Listener

227 103816 2171659 47 0.00% 0.00% 0.00% 0 CEF Scanner

228 4592 62611531 0 0.00% 0.00% 0.00% 0 NTP

229 0 12 0 0.00% 0.00% 0.00% 0 AAA Accounting

230 64484 2222345 29 0.00% 0.00% 0.00% 0 BGP I/O

231 8409128 4174574 2014 0.00% 0.00% 0.00% 0 BGP Scanner

Joseph W. Doherty · ‎06-20-2012

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Could your router be fragmenting packets?

25 Mbps, if duplex, isn't inconsequential for a 3745.

ahmad82pkn · ‎06-21-2012

Thank you for the direction.

here is output of ip traffic, fragmentation is happening, but do you think its enough to cause CPU hitting 80%?

show ip traffic

IP statistics:

Rcvd: 1941687783 total, 43794667 local destination

0 format errors, 0 checksum errors, 2414 bad hop count

463 unknown protocol, 0 not a gateway

0 security failures, 0 bad options, 0 with options

Opts: 0 end, 0 nop, 0 basic security, 0 loose source route

0 timestamp, 0 extended security, 0 record route

0 stream ID, 0 strict source route, 0 alert, 0 cipso, 0 ump

0 other

Frags: 512 reassembled, 0 timeouts, 6 couldn't reassemble

47116 fragmented, 94932 fragments, 0 couldn't fragment

Joseph W. Doherty · ‎06-21-2012

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

here is output of ip traffic, fragmentation is happening, but do you think its enough to cause CPU hitting 80%?

Can't say, but recently had an issue with high CPU on 2821 with VTI VPN; decreasing fragmentation cut CPU usage by a little more than half.