Unable to access particular website from ISR4331 Router

[manish.sharma@cjpl.in]

Hello Expers

i am facing a weird problem, whereby i am not open only one site                                       . However, all other sites are working fine. we have not set any rule for blocking of any website. Any help would be greatly appreciated.  I have already checked and IP Cef is already enabled in the router and IP classless command was also not very helpful. i have also tried IP TCP adjust-mss on LAN and WAN interface but of no use

Following is my running configuration..

Router#sh run
Router#sh running-config
Building configuration...

Current configuration : 13870 bytes
!
! Last configuration change at 05:02:12 UTC Thu Feb 13 2020 by admin
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
!
aaa new-model
!
!
aaa authentication login users local
aaa authorization network groups local
!
!
!
!
!
!
aaa session-id common
!
ip name-server 202.56.215.55
!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
!
!
!
!
!
multilink bundle-name authenticated
!
flow exporter NFAexporter
destination 10.0.0.175
source GigabitEthernet0/0/0
transport udp 9996
template data timeout 60
!
!
flow monitor NFAmonitor
exporter NFAexporter
cache timeout active 60
record netflow-original
!
!
!
!
crypto pki trustpoint TP-self-signed-2481076969
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2481076969
revocation-check none
rsakeypair TP-self-signed-2481076969
!
!
crypto pki certificate chain TP-self-signed-2481076969
certificate self-signed 01
30820330 30820218 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32343831 30373639 3639301E 170D3139 31323330 30353237
34335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 34383130
37363936 39308201 22300D06 092A8648 86F70D01 01010500 0382010F 00308201
0A028201 01009A89 0A4A0319 15C60346 B3C2928B F4A90263 C0F3AC40 92BF5316
AE0E75DA BBD8E650 7BCF8FDA 4899CE83 2E21BEDA 7550C2F1 5873414A 4DC82504
B532AD66 EB46A849 0AA7DDAC 832E3555 E3497396 85AAE6BD EA4D1FB8 1B82672E
5CC8034C 4A5E23C5 1A1076E4 95DE776B 777B305E 74416143 537775AE 1E000304
E9E3852D 59CCCB52 FDFF476D E2C07B82 4B7B4405 69EB8E7A 310FC414 696D4041
B5009281 E8EE0060 79F891C6 296EFA52 C3C2D80C 2F89C614 BE24B550 1A4EEF77
853D6E8E F2F61D90 D8B73616 21E898E3 DD0916B9 5298AAAB F2F7E45C E0533A1C
CC3C2980 A617B13F C13520FF D06CF624 0EC21F80 E0BAB156 A6063D45 348B3CC2
9E193651 C21B0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF
301F0603 551D2304 18301680 141CC29B 5CDAFBE2 9EB30536 83105C67 5E0CE810
CB301D06 03551D0E 04160414 1CC29B5C DAFBE29E B3053683 105C675E 0CE810CB
300D0609 2A864886 F70D0101 05050003 82010100 16C227BC C3A7E697 7FD2E95F
07EC4786 6ED9EFD9 FABBF58C 83EF6288 10C1BDEA B9F98185 6AA766D7 F1E19C06
8AF7BCA6 5672E708 1A473A28 9E9170E2 61353AF6 63999120 D482EF66 755A49CF
B91DF3D8 06FE9CE6 28FF3713 5150E0E3 6CB37FD5 356F2A5A 32C790C5 C2D1428D
9813C681 866103C4 27F1124D D7FF231C F93A8838 CDD79D30 F1594A3C 70F91C97
FD75603E 7C357F35 DDA559D8 E34CEDC2 2DFA85FD DF353D0D 5754224C 3AC9371C
D0427925 DE83EAB9 FF24996B 3748BCA9 8C507C79 475C6266 716148FC C9BEC656
01D86294 DBCF16DD 9D8E93D6 60B6650A 727E6D3F 1A8B3935 733BEC43 B2449AAC
AB6271B0 4037B0B6 F247499F 28225FD1 0696F29E
quit
!
!
license udi pid ISR4331/K9 sn XX
license boot level securityk9
diagnostic bootup level minimal
spanning-tree extend system-id
!
!
!
!
redundancy
mode none
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 5
encr 3des
authentication pre-share
group 2
crypto isakmp key XX address XX.XX.XX.XX no-xauth
crypto isakmp key XX address XX.XX.XX.XX no-xauth
crypto isakmp key XX address XX.XX.XX.XX no-xauth
crypto isakmp key XX address XX.XX.XX.XX no-xauth
crypto isakmp key XX address XX.XX.XX.XX no-xauth
!
crypto isakmp client configuration group internal
key cisco
pool VPNPOOL
acl 150
!
!
crypto ipsec transform-set XX esp-aes esp-md5-hmac
mode tunnel
crypto ipsec transform-set XX esp-aes esp-md5-hmac
mode tunnel
!
!
!
crypto dynamic-map d-map 1
set transform-set XX
reverse-route
!
!
crypto map IPSEC-SITE-TO-SITE-VPN client authentication list users
crypto map IPSEC-SITE-TO-SITE-VPN isakmp authorization list groups
crypto map IPSEC-SITE-TO-SITE-VPN client configuration address respond
crypto map IPSEC-SITE-TO-SITE-VPN 10 ipsec-isakmp
description x
set peer XX
set transform-set XX
match address 100
crypto map IPSEC-SITE-TO-SITE-VPN 11 ipsec-isakmp
description XX
set peer XX
set transform-set XX
match address 103
crypto map IPSEC-SITE-TO-SITE-VPN 13 ipsec-isakmp
description XX
set peer XX
set transform-set XX
match address 104
crypto map IPSEC-SITE-TO-SITE-VPN 14 ipsec-isakmp
description XX
set peer XX
set transform-set XX
match address 105
crypto map IPSEC-SITE-TO-SITE-VPN 15 ipsec-isakmp dynamic d-map
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
ip flow monitor NFAmonitor input
ip address 10.0.0.1 255.255.255.0
ip nat inside
negotiation auto
!
interface GigabitEthernet0/0/1
ip flow monitor NFAmonitor input
ip address XX.XX.XX.XX 255.255.255.0
ip nat outside
negotiation auto
crypto map IPSEC-SITE-TO-SITE-VPN
!
interface GigabitEthernet0/0/2
ip flow monitor NFAmonitor input
no ip address
shutdown
negotiation auto
!
interface Serial0/1/0
ip flow monitor NFAmonitor input
no ip address
shutdown
!
interface Service-Engine0/4/0
ip flow monitor NFAmonitor input
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
ip local pool VPNPOOL 192.168.9.1 192.168.9.100
ip nat inside source static tcp 10.0.0.10 82 XX.xx.xx.xx 82 extendable
ip nat inside source static tcp 10.0.0.6 3000 XX.xx.xx.xx 3000 extendable
ip nat inside source static tcp 10.0.0.9 4048 XX.xx.xx.xx 4048 extendable
ip nat inside source static tcp 10.0.0.16 22 XX.xx.xx.xx 8023 extendable
ip nat inside source static tcp 10.0.0.9 22 XX.xx.xx.xx 8042 extendable
ip nat inside source static tcp 10.0.0.13 22 XX.xx.xx.xx 8044 extendable
ip nat inside source static tcp 10.0.0.27 8069 XX.xx.xx.xx 8069 route-map NAT-POLICY extendable
ip nat inside source static tcp 10.0.0.13 8069 XX.xx.xx.xx 8079 extendable
ip nat inside source static tcp 10.0.0.16 8085 XX.xx.xx.xx 8085 extendable
ip nat inside source static tcp 10.0.0.28 8080 XX.xx.xx.xx 8090 extendable
ip nat inside source static tcp 10.0.0.119 8091 XX.xx.xx.xx 8091 extendable
ip nat inside source static tcp 10.0.0.2 80 XX.xx.xx.xx 8100 extendable
ip nat inside source static tcp 10.0.0.9 9005 XX.xx.xx.xx 9005 extendable
ip nat inside source static tcp 10.0.0.6 5432 XX.xx.xx.xx 55432 extendable
ip nat inside source list 199 interface GigabitEthernet0/0/1 overload
no ip classless
ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip tftp source-interface GigabitEthernet0/0/1
ip route 0.0.0.0 0.0.0.0 XX.XX.XX.XX
!
!

access-list 100 permit ip 10.0.0.0 0.0.255.255 192.168.1.0 0.0.0.255
access-list 103 permit ip 10.0.0.0 0.0.255.255 192.168.2.0 0.0.0.255
access-list 104 permit ip 10.0.0.0 0.0.255.255 192.168.3.0 0.0.0.255
access-list 105 permit ip 10.0.0.0 0.0.255.255 192.168.4.0 0.0.0.255
access-list 150 permit ip 10.0.0.0 0.0.255.255 192.168.9.0 0.0.0.255
access-list 199 deny ip 10.0.0.0 0.0.255.255 192.168.1.0 0.0.0.255
access-list 199 deny ip 10.0.0.0 0.0.255.255 192.168.2.0 0.0.0.255
access-list 199 deny ip 10.0.0.0 0.0.255.255 192.168.3.0 0.0.0.255
access-list 199 deny ip 10.0.0.0 0.0.255.255 192.168.4.0 0.0.0.255
access-list 199 deny ip 10.0.0.0 0.0.255.255 192.168.9.0 0.0.0.255
access-list 199 permit ip 10.0.0.0 0.0.255.255 any
!
!
route-map NAT-POLICY permit 10
match ip address 199
!
snmp-server community ro RO
snmp-server community public RO
snmp-server community private RW
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps vrrp
snmp-server enable traps pfr
snmp-server enable traps flowmon
snmp-server enable traps ds1
snmp-server enable traps entity-perf throughput-notif
snmp-server enable traps ds3
snmp-server enable traps call-home message-send-fail server-fail
snmp-server enable traps tty
snmp-server enable traps eigrp
snmp-server enable traps casa
snmp-server enable traps ospf state-change
snmp-server enable traps ospf errors
snmp-server enable traps ospf retransmit
snmp-server enable traps ospf lsa
snmp-server enable traps ospf cisco-specific state-change nssa-trans-change
snmp-server enable traps ospf cisco-specific state-change shamlink interface
snmp-server enable traps ospf cisco-specific state-change shamlink neighbor
snmp-server enable traps ospf cisco-specific errors
snmp-server enable traps ospf cisco-specific retransmit
snmp-server enable traps ospf cisco-specific lsa
snmp-server enable traps license
snmp-server enable traps smart-license
snmp-server enable traps cef resource-failure peer-state-change peer-fib-state-change inconsistency
snmp-server enable traps memory bufferpeak
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps config-ctid
snmp-server enable traps fru-ctrl
snmp-server enable traps entity
snmp-server enable traps event-manager
snmp-server enable traps frame-relay
snmp-server enable traps frame-relay subif
snmp-server enable traps hsrp
snmp-server enable traps ip local pool
snmp-server enable traps pppoe
snmp-server enable traps cpu threshold
snmp-server enable traps syslog
snmp-server enable traps l2tun session
snmp-server enable traps l2tun pseudowire status
snmp-server enable traps atm subif
snmp-server enable traps pki
snmp-server enable traps ethernet evc status create delete
snmp-server enable traps ether-oam
snmp-server enable traps ethernet cfm cc mep-up mep-down cross-connect loop config
snmp-server enable traps ethernet cfm crosscheck mep-missing mep-unknown service-up
snmp-server enable traps entity-state
snmp-server enable traps entity-qfp mem-res-thresh throughput-notif
snmp-server enable traps adslline
snmp-server enable traps vdsl2line
snmp-server enable traps flash insertion removal lowspace
snmp-server enable traps srp
snmp-server enable traps entity-diag boot-up-fail hm-test-recover hm-thresh-reached scheduled-test-fail
snmp-server enable traps isdn call-information
snmp-server enable traps isdn layer2
snmp-server enable traps isdn chan-not-avail
snmp-server enable traps isdn ietf
snmp-server enable traps cnpd
snmp-server enable traps bfd
snmp-server enable traps ipsla
snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency
snmp-server enable traps c3g
snmp-server enable traps LTE
snmp-server enable traps vtp
snmp-server enable traps vlancreate
snmp-server enable traps vlandelete
snmp-server enable traps firewall serverstatus
snmp-server enable traps trustsec-sxp conn-srcaddr-err msg-parse-err conn-config-err binding-err conn-up conn-down binding-expn-fail oper-nodeid-change binding-conflict
snmp-server enable traps aaa_server
snmp-server enable traps dhcp
snmp-server enable traps auth-framework sec-violation
snmp-server enable traps rsvp
snmp-server enable traps ipmulticast
snmp-server enable traps msdp
snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message
snmp-server enable traps mvpn
snmp-server enable traps pimstdmib neighbor-loss invalid-register invalid-join-prune rp-mapping-change interface-election
snmp-server enable traps isis
snmp-server enable traps bgp cbgp2
snmp-server enable traps ospfv3 state-change
snmp-server enable traps ospfv3 errors
snmp-server enable traps nhrp nhs
snmp-server enable traps nhrp nhc
snmp-server enable traps nhrp nhp
snmp-server enable traps nhrp quota-exceeded
snmp-server enable traps ike policy add
snmp-server enable traps ike policy delete
snmp-server enable traps ike tunnel start
snmp-server enable traps ike tunnel stop
snmp-server enable traps ipsec cryptomap add
snmp-server enable traps ipsec cryptomap delete
snmp-server enable traps ipsec cryptomap attach
snmp-server enable traps ipsec cryptomap detach
snmp-server enable traps ipsec tunnel start
snmp-server enable traps ipsec tunnel stop
snmp-server enable traps ipsec too-many-sas
snmp-server enable traps gdoi gm-start-registration
snmp-server enable traps gdoi gm-registration-complete
snmp-server enable traps gdoi gm-re-register
snmp-server enable traps gdoi gm-rekey-rcvd
snmp-server enable traps gdoi gm-rekey-fail
snmp-server enable traps gdoi ks-rekey-pushed
snmp-server enable traps gdoi gm-incomplete-cfg
snmp-server enable traps gdoi ks-no-rsa-keys
snmp-server enable traps gdoi ks-new-registration
snmp-server enable traps gdoi ks-reg-complete
snmp-server enable traps gdoi ks-role-change
snmp-server enable traps gdoi ks-gm-deleted
snmp-server enable traps gdoi ks-peer-reachable
snmp-server enable traps gdoi ks-peer-unreachable
snmp-server enable traps bulkstat collection transfer
snmp-server enable traps alarms informational
snmp-server enable traps ethernet cfm alarm
snmp-server enable traps rf
snmp-server enable traps transceiver all
snmp-server enable traps vrfmib vrf-up vrf-down vnet-trunk-up vnet-trunk-down
snmp-server host 10.0.0.175 SNMPv1/v2c flowmon rf
snmp ifmib ifindex persist
!
!
!
!
control-plane
!
banner login ^ThIS DEVICE IS MONITORED **Access to this system is PROHIBITED unless AUTHORIZED** **If you are not authorized please disconnect now**. If you fail to disconnect now you may be prosecuted under the Cyber Crime Act^C
!
line con 0
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 5 15
!
wsma agent exec
!
wsma agent config
!
wsma agent filesys
!
wsma agent notify
!
!
end

Router#

[manish.sharma@cjpl.in]

forgot to mention the website address

https://www.obconline.co.in/corporate/AuthenticationController?FORMSGROUP_ID__=AuthenticationFG&__START_TRAN_FLAG__=Y&__FG_BUTTONS__=LOAD&ACTION.LOAD=Y&AuthenticationFG.LOGIN_FLAG=1&BANK_ID=022&AuthenticationFG.USER_TYPE=2

However, when i bypass my router this site is working fine

[Seb Rupik]

Hi there,

This sounds very much like a fragmentation issue. What is the output of:

sh ip traffic

..what ip tcp mss-adjust settings did you try?

cheers,

Seb.

[manish.sharma@cjpl.in]

Following are the settings i tried for MSS

LAN

IP TCP adjuste-mss 1452

WAN

IP TCP adjust-mss 1460 

( <500-1460> Maximum segment size in bytes is allowed in ISR4331)

Following is the output of Sh IP traffic

Router#sh ip traffic
IP statistics:
Rcvd: 3955287667 total, 20739775 local destination
15 format errors, 0 checksum errors, 135 bad hop count
199 unknown protocol, 0 not a gateway
0 security failures, 0 bad options, 199 with options
Opts: 0 end, 0 nop, 0 basic security, 0 loose source route
0 timestamp, 0 extended security, 0 record route
0 stream ID, 0 strict source route, 199 alert, 0 cipso, 0 ump
0 other, 0 ignored
Frags: 285285 reassembled, 1241 timeouts, 4 couldn't reassemble
1640 fragmented, 3802 fragments, 11 couldn't fragment
0 invalid hole
Bcast: 11151913 received, 4 sent
Mcast: 11353358 received, 0 sent
Sent: 3909016 generated, 3885589055 forwarded
Drop: 0 encapsulation failed, 0 unresolved, 21905 no adjacency
36881 no route, 0 unicast RPF, 0 forced drop, 0 unsupported-addr
0 options denied, 1 source IP address zero

ICMP statistics:
Rcvd: 27691 format errors, 1638 checksum errors, 31 redirects, 78932 unreachab le
55486 echo, 165301 echo reply, 0 mask requests, 0 mask replies, 1 quench
1 parameter, 1 timestamp, 0 timestamp replies, 0 info request, 0 other
0 irdp solicitations, 0 irdp advertisements
6624 time exceeded, 0 info replies
Sent: 32 redirects, 211394 unreachable, 165711 echo, 55486 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp, 1 timestamp replies
0 info reply, 135 time exceeded, 0 parameter problem
0 irdp solicitations, 0 irdp advertisements

UDP statistics:
Rcvd: 17404017 total, 15364 checksum errors, 17363534 no port 0 finput
Sent: 25839 total, 0 forwarded broadcasts

TCP statistics:
Rcvd: 3055800 total, 1154 checksum errors, 52752 no port
Sent: 3508783 total

EIGRP-IPv4 statistics:
Rcvd: 0 total
Sent: 0 total

OSPF statistics:
Last clearing of OSPF traffic counters never
Rcvd: 0 total, 0 checksum errors
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks
Sent: 0 total
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks

BGP statistics:
Rcvd: 0 total, 0 opens, 0 notifications, 0 updates
0 keepalives, 0 route-refresh, 0 unrecognized
Sent: 0 total, 0 opens, 0 notifications, 0 updates
0 keepalives, 0 route-refresh

PIMv2 statistics: Sent/Received
Total: 0/0, 0 checksum errors, 0 format errors
Registers: 0/0 (0 non-rp, 0 non-sm-group), Register Stops: 0/0, Hellos: 0/0
Join/Prunes: 0/0, Asserts: 0/0, grafts: 0/0
Bootstraps: 0/0, Candidate_RP_Advertisements: 0/0
Queue drops: 0
State-Refresh: 0/0

IGMP statistics: Sent/Received
Total: 0/0, Format errors: 0/0, Checksum errors: 0/0
Host Queries: 0/0, Host Reports: 0/0, Host Leaves: 0/0
DVMRP: 0/0, PIM: 0/0
Queue drops: 0

ARP statistics:
Rcvd: 12636959 requests, 27078 replies, 40 reverse, 0 other
Sent: 51205 requests, 1633467 replies (62382 proxy), 0 reverse
Drop due to input queue full: 0
Router#

[Seb Rupik]

What is the transport used to access the internet? DSL, PPPOE?

If so, the MTU should be set to 1492 bytes, less the 40 bytes for the IP and TCP headers you should set the MSS value to 1452 bytes.

I would set this on all interfaces.

cheers,

Seb.

[manish.sharma@cjpl.in]

i have DSL Connection with Modem configured in bridge mode

I have configured following on LAN and WAN port but no luck

Router# Int Gi 0/0/0

Router# ip tcp adjust-mss 1452

Router# Int Gi 0/0/1

Router# ip tcp adjust-mss 1452

Still getting following message while opening URL https://www.obconline.co.in/corporate/AuthenticationController?FORMSGROUP_ID__=AuthenticationFG&__START_TRAN_FLAG__=Y&__FG_BUTTONS__=LOAD&ACTION.LOAD=Y&AuthenticationFG.LOGIN_FLAG=1&BANK_ID=022&AuthenticationFG.USER_TYPE=2

This site can’t be reached

www.obconline.co.in took too long to respond.

Try:

• Checking the connection
• Checking the proxy and the firewall
• Running Windows Network Diagnostics

ERR_CONNECTION_TIMED_OUT

[Seb Rupik]

Try using ping with the DF flag set to determine the maximum MTU permitted. The command on linux is:

ping -M do -s <MTU_size_in_bytes> 8.8.8.8

Start with an MTU size of 1460 and keep lowering it until you find a value which gives you a ping reply. Once you have found a MTU value, subtract 40 and use that as your MSS value on the ISR.

[manish.sharma@cjpl.in]

i do not have any linux machine to test this command.

I tried this command on Windows machines as well as on Cisco router but not working on both devices.

Please advise alternative command to run on Windows machine or on Cisco router

[Seb Rupik]

ping -f -l <MTU_size_in_bytes> 8.8.8.8

[manish.sharma@cjpl.in]

Still no luck

Following are the steps 

STEPS DONE ON WINDOWS MACHINE TO FIND CORRECT MSS VALUE
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\Manish Sharma>ping -f -l 1460 8.8.8.8

Pinging 8.8.8.8 with 1460 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 11ms, Average = 11ms

C:\Users\Manish Sharma>ping -f -l 1460 8.8.8.8

Pinging 8.8.8.8 with 1460 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 11ms, Average = 11ms

C:\Users\Manish Sharma>ping -f -l 1460 8.8.8.8

Pinging 8.8.8.8 with 1460 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=12ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1460) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 12ms, Average = 11ms

C:\Users\Manish Sharma>ping -f -l 1490 8.8.8.8

Pinging 8.8.8.8 with 1490 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.

Ping statistics for 8.8.8.8:
Packets: Sent = 3, Received = 0, Lost = 3 (100% loss),
Control-C
^C
C:\Users\Manish Sharma>ping -f -l 1459 8.8.8.8

Pinging 8.8.8.8 with 1459 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1459) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1459) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1459) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1459) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 11ms, Average = 11ms

C:\Users\Manish Sharma>ping -f -l 1461 8.8.8.8

Pinging 8.8.8.8 with 1461 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1461) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1461) time=15ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1461) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1461) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 15ms, Average = 12ms

C:\Users\Manish Sharma>ping -f -l 1462
IP address must be specified.

C:\Users\Manish Sharma>ping -f -l 1462 8.8.8.9

Pinging 8.8.8.9 with 1462 bytes of data:
Control-C
^C
C:\Users\Manish Sharma>ping -f -l 1462 8.8.8.8

Pinging 8.8.8.8 with 1462 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1462) time=12ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1462) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1462) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1462) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 12ms, Average = 11ms

C:\Users\Manish Sharma>ping -f -l 1463 8.8.8.8

Pinging 8.8.8.8 with 1463 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1463) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1463) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1463) time=16ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1463) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 16ms, Average = 12ms

C:\Users\Manish Sharma>ping -f -l 1480 8.8.8.8

Pinging 8.8.8.8 with 1480 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users\Manish Sharma>ping -f -l 1470 8.8.8.8

Pinging 8.8.8.8 with 1470 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1470) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1470) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1470) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1470) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 11ms, Average = 11ms

C:\Users\Manish Sharma>ping -f -l 1475 8.8.8.8

Pinging 8.8.8.8 with 1475 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users\Manish Sharma>ping -f -l 1472 8.8.8.8

Pinging 8.8.8.8 with 1472 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1472) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1472) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1472) time=12ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1472) time=11ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 12ms, Average = 11ms

C:\Users\Manish Sharma>ping -f -l 1473 8.8.8.8

Pinging 8.8.8.8 with 1473 bytes of data:
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users\Manish Sharma>ping -f -l 1472 8.8.8.8

Pinging 8.8.8.8 with 1472 bytes of data:
Reply from 8.8.8.8: bytes=68 (sent 1472) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1472) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1472) time=11ms TTL=55
Reply from 8.8.8.8: bytes=68 (sent 1472) time=12ms TTL=55

Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 12ms, Average = 11ms

C:\Users\Manish Sharma>

Configuration done on Router

Router(config)#interface gigabitEthernet 0/0/1 (WAN Interface)
Router(config-if)#ip tcp adjust-mss 1420
Router(config-if)#exit
Router(config)#interface gigabitEthernet 0/0/0 (Local LAN Interface)
Router(config-if)#ip tcp adjust-mss 1420
Router(config-if)#exit

Router#sh ip traffic
IP statistics:
Rcvd: 4011379783 total, 21346600 local destination
15 format errors, 0 checksum errors, 138 bad hop count
208 unknown protocol, 0 not a gateway
0 security failures, 0 bad options, 209 with options
Opts: 0 end, 0 nop, 0 basic security, 0 loose source route
2 timestamp, 0 extended security, 0 record route
0 stream ID, 0 strict source route, 207 alert, 0 cipso, 0 ump
0 other, 0 ignored
Frags: 285327 reassembled, 1241 timeouts, 4 couldn't reassemble
1650 fragmented, 3822 fragments, 13 couldn't fragment
0 invalid hole
Bcast: 11413022 received, 4 sent
Mcast: 11581052 received, 0 sent
Sent: 4180860 generated, 3940779097 forwarded
Drop: 0 encapsulation failed, 0 unresolved, 45029 no adjacency
36881 no route, 0 unicast RPF, 0 forced drop, 0 unsupported-addr
0 options denied, 4 source IP address zero

ICMP statistics:
Rcvd: 27691 format errors, 1714 checksum errors, 36 redirects, 79330 unreachable
57279 echo, 173681 echo reply, 0 mask requests, 0 mask replies, 1 quench
1 parameter, 3 timestamp, 0 timestamp replies, 0 info request, 0 other
0 irdp solicitations, 0 irdp advertisements
6836 time exceeded, 0 info replies
Sent: 32 redirects, 238654 unreachable, 174099 echo, 57279 echo reply
0 mask requests, 0 mask replies, 0 quench, 0 timestamp, 3 timestamp replies
0 info reply, 138 time exceeded, 0 parameter problem
0 irdp solicitations, 0 irdp advertisements

UDP statistics:
Rcvd: 17828585 total, 15576 checksum errors, 17781539 no port 0 finput
Sent: 32199 total, 0 forwarded broadcasts

TCP statistics:
Rcvd: 3228952 total, 1253 checksum errors, 55782 no port
Sent: 3738688 total

EIGRP-IPv4 statistics:
Rcvd: 0 total
Sent: 0 total

OSPF statistics:
Last clearing of OSPF traffic counters never
Rcvd: 0 total, 0 checksum errors
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks
Sent: 0 total
0 hello, 0 database desc, 0 link state req
0 link state updates, 0 link state acks

BGP statistics:
Rcvd: 0 total, 0 opens, 0 notifications, 0 updates
0 keepalives, 0 route-refresh, 0 unrecognized
Sent: 0 total, 0 opens, 0 notifications, 0 updates
0 keepalives, 0 route-refresh

PIMv2 statistics: Sent/Received
Total: 0/0, 0 checksum errors, 0 format errors
Registers: 0/0 (0 non-rp, 0 non-sm-group), Register Stops: 0/0, Hellos: 0/0
Join/Prunes: 0/0, Asserts: 0/0, grafts: 0/0
Bootstraps: 0/0, Candidate_RP_Advertisements: 0/0
Queue drops: 0
State-Refresh: 0/0

IGMP statistics: Sent/Received
Total: 0/0, Format errors: 0/0, Checksum errors: 0/0
Host Queries: 0/0, Host Reports: 0/0, Host Leaves: 0/0
DVMRP: 0/0, PIM: 0/0
Queue drops: 0

ARP statistics:
Rcvd: 13362410 requests, 27119 replies, 600 reverse, 0 other
Sent: 72525 requests, 1672468 replies (63135 proxy), 0 reverse
Drop due to input queue full: 0

[Georg Pauwen]

Hello,

not sure if it helps much, but try and enable 'ip virtual-reassembly in' on bothe the NAT inside and outside interfaces:

interface GigabitEthernet0/0/0
ip flow monitor NFAmonitor input
ip address 10.0.0.1 255.255.255.0
ip nat inside

--> ip virtual-reassembly in
negotiation auto
!
interface GigabitEthernet0/0/1
ip flow monitor NFAmonitor input
ip address XX.XX.XX.XX 255.255.255.0
ip nat outside

--> ip virtual-reassembly in
negotiation auto
crypto map IPSEC-SITE-TO-SITE-VPN

[manish.sharma@cjpl.in]

still no luck

not able to access only this website. However, same is working after bypassing Cisco Router and connecting directly to DSL modem

https://www.obconline.co.in/corporate/AuthenticationController?FORMSGROUP_ID__=AuthenticationFG&__START_TRAN_FLAG__=Y&__FG_BUTTONS__=LOAD&ACTION.LOAD=Y&AuthenticationFG.LOGIN_FLAG=1&BANK_ID=022&AuthenticationFG.USER_TYPE=2

Thanks & Regards

Manish Sharma