GRE + Packet forwarding strange issues

[amar_5664]

Hi experts,

Recently we have been testing gre+vrf deployment for our guest segment. Attached is high level topology.

Below is how its setup

-     Guest SSID terminated on Wism in our of our DCs 6509 switch

-     WISM provides IP address to clients in specific VLAN

-     Guest Network in vrf tunneled through the corporate network for segmentation and terminated to Cisco 29xx router in DMZ

-     Tunnels in same vrf as guest vlan vrf, communication between tunnel etc works fine

-     Guest can access and ping internet etc fine can see traffic both ways on external firewall

Issue:     Guest network is having issues accessing entire internet, strange behaviour is seen. Google/gmail/youtube/Google news and bing works fine but none of the other sites load, 29xx routers show packets forwarded in cache flow where as packets logged on firewall as well. initiating a search in google is working but when the content provider link clicked does not present the page. Layer 1/2/3/4 show no issue. IPS is exempting gst network from being scanned, checked logs no drops at that level as well. GRE keepalive through Cisco ASA which is the internal facing firewall does not work either, NAT is used to create tunnel and is up/up but when keepalive implemented tunnel goes up/down

Other issue when debug initiated on 6509 switch getting lot of below log, whereas when debug ip packet detail initiated on 29xx router does not log packet forwarding from guest network ip source but ip cache flow has source and dest as gst network and internet

pak 500A4908 consumed in input feature , packet consum

ed, MCI Check(55), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE

Would appreciate if someone could confirm if its not an IOS issue?

Thanks

[Richard Burts · Accepted solution]

The symptoms that you describe suggest that it might be a fragmentation issue. I suggest that you try this command and see if the symptoms improve

ip tcp adjust-mss 1360

1360 is a sort of conservative/safe starting point. If this does improve the situation you might experiment and see if larger values work as well.

HTH

Rick

[amar_5664]

2 things, 29xx wasnt fragmenting and as i enabled content-scan on to forward traffic to ScanSafe it was crashing. Upgraded the IOS and no issues since then. Thank you for your prompt response Richard.

[Richard Burts]

I am glad to know that you got the issues resolved. Thank you for posting back to the forum to update us about this issue and how you solved it. That could be beneficial to other readers of the forum. Also thank you for using the rating system to mark this question as answered.

HTH

Rick