Preamble
A couple years ago I managed to get hold of some ancient Cisco equipment, probably a pile of rubble to the eyes of professionals, but a little treasure for a young man like me that wanted to learn something about networking. To keep it short, I managed to fully recover a 2611xm and while playing with it (many days of trial & error) I noticed that one IOS feature was not really working like intended.
The issue
CEF, or to be precise, the "ip cef" command seems to put the router off its tracks. Whenever CEF is enabled the connectivity starts misbehaving, opening web pages takes considerably longer even though the bandwidth available is still the same. From my inexperienced point of view it seems like having a bad dns server, one with 500 ms latency, that's what it feels like to enable CEF on my router.
Considering my setup (below and in the *.*txt attached) is this behaviour an anomaly or is to be expected?
Some details
HW/SW:
Cisco 2611xm (C2600-ADVSECURITYK9-M), Version 12.4(15)T14, RELEASE SOFTWARE (fc2), 256MB RAM, 32MB Flash.
Topology:
+--------------+
| Cisco Router |
+--+--------+--+
| |
fa0/0 | | fa0/1
| |
+-----------------+ +--+--------+--+ +------------+
| Rest of the LAN +---+ Switch +---+ ADSL Modem |
+-----------------+ +--------------+ +------------+
Enabled Features:
dhcp server, ddns, QoS (CBWFQ), Zone-Based Policy Firewall, PPPoE client, NAT overload, NTP.
Running-config:
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname shield2
!
boot-start-marker
boot-end-marker
!
logging buffered 240000
no logging console
no logging monitor
enable secret 5 *snip*
enable password 7 *snip*
!
no aaa new-model
clock timezone CET 1
clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00
no network-clock-participate slot 1
no network-clock-participate wic 0
no ip source-route
no ip gratuitous-arps
ip options drop
no ip cef
!
!
no ip dhcp use vrf connected
ip dhcp bootp ignore
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.0.1 192.168.0.255
!
ip dhcp pool uss-local-dynamic
import all
network 192.168.0.0 255.255.254.0
domain-name *snip*
default-router 192.168.0.12
dns-server 8.8.8.8 8.8.4.4 4.2.2.2
option 26 hex 05d4
!
*snip*
!
no ip bootp server
ip domain name *snip*
*snip*
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip name-server 4.2.2.2
ip name-server 4.2.2.4
!
ip ddns update method no-ip
HTTP
add *snip*
interval maximum 2 0 0 0
!
multilink bundle-name authenticated
!
username root privilege 15 password 7 *snip*
archive
log config
hidekeys
!
ip ssh rsa keypair-name FAKE
!
class-map type inspect match-all INSIDE-TO-OUTSIDE-CLASS
match access-group name INSIDE-TO-OUTSIDE
class-map type inspect match-all OUTSIDE-TO-INSIDE-CLASS
match access-group name OUTSIDE-TO-INSIDE
class-map type inspect match-all SELF-TO-OUTSIDE-CLASS
match access-group name SELF-TO-OUTSIDE
class-map type inspect match-all OUTSIDE-TO-SELF-CLASS
match access-group name OUTSIDE-TO-SELF
!
class-map match-any Hi-Class-Outbound-Upload
match access-group name Hi-Precedence-Upload
!
class-map match-any Hi-Class-Outbound-Download
match access-group name Hi-Precedence-Download
!
policy-map Packet-Queueing-Download
class Hi-Class-Outbound-Download
priority percent 75
class class-default
fair-queue
queue-limit 8
!
policy-map Packet-Shaping-Download
class class-default
shape peak 3300000 33000
service-policy Packet-Queueing-Download
!
policy-map Packet-Queueing-Upload
class Hi-Class-Outbound-Upload
priority percent 75
class class-default
fair-queue
queue-limit 8
!
policy-map Packet-Shaping-Upload
class class-default
shape peak 175000 1750
service-policy Packet-Queueing-Upload
!
policy-map type inspect INSIDE-TO-OUTSIDE-POLICY
class type inspect INSIDE-TO-OUTSIDE-CLASS
inspect
class class-default
drop
policy-map type inspect OUTSIDE-TO-INSIDE-POLICY
class type inspect OUTSIDE-TO-INSIDE-CLASS
inspect
class class-default
drop log
policy-map type inspect SELF-TO-OUTSIDE-POLICY
class type inspect SELF-TO-OUTSIDE-CLASS
inspect
class class-default
drop
policy-map type inspect OUTSIDE-TO-SELF-POLICY
class type inspect OUTSIDE-TO-SELF-CLASS
inspect
class class-default
drop log
!
zone security INSIDE
zone security OUTSIDE
zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
service-policy type inspect INSIDE-TO-OUTSIDE-POLICY
zone-pair security OUT-TO-IN source OUTSIDE destination INSIDE
service-policy type inspect OUTSIDE-TO-INSIDE-POLICY
zone-pair security SELF-TO-OUT source self destination OUTSIDE
service-policy type inspect SELF-TO-OUTSIDE-POLICY
zone-pair security OUT-TO-SELF source OUTSIDE destination self
service-policy type inspect OUTSIDE-TO-SELF-POLICY
!
!
interface FastEthernet0/0
description LAN Interface
ip address 192.168.0.12 255.255.254.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
no ip virtual-reassembly
zone-member security INSIDE
ip tcp adjust-mss 1452
speed auto
full-duplex
no cdp enable
no mop enabled
service-policy output Packet-Shaping-Download
!
interface FastEthernet0/1
description ADSL WAN Interface
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no ip virtual-reassembly
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no cdp enable
no mop enabled
service-policy output Packet-Shaping-Upload
!
interface Dialer1
description ADSL WAN Dialer
bandwidth 7200
ip ddns update hostname *snip*
ip ddns update no-ip
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip nat outside
ip virtual-reassembly
zone-member security OUTSIDE
encapsulation ppp
no ip mroute-cache
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp pap sent-username *snip* password 7 *snip*
ppp ipcp route default
!
no ip forward-protocol nd
!
no ip http server
no ip http secure-server
no ip dns server
ip nat inside source list 7 interface Dialer1 overload
ip nat inside source static tcp 192.168.1.22 51613 interface Dialer1 51613
ip nat inside source static udp 192.168.1.22 51613 interface Dialer1 51613
!
ip access-list extended INSIDE-TO-OUTSIDE
permit ip 192.168.0.0 0.0.1.255 any
!
ip access-list extended OUTSIDE-TO-INSIDE
permit tcp any host 192.168.1.22 eq 51613
permit udp any host 192.168.1.22 eq 51613
!
ip access-list extended OUTSIDE-TO-SELF
deny ip any any
!
ip access-list extended SELF-TO-OUTSIDE
permit ip any any
!
ip access-list extended Hi-Precedence-Upload
remark --- High precedence connections
permit icmp any any
permit tcp any any rst syn
permit udp any any eq domain
permit tcp any any eq 2099
permit tcp any any range 5222 5223
permit udp any any range 5000 5500
!
ip access-list extended Hi-Precedence-Download
remark --- High precedence connections
permit icmp any any
permit tcp any any rst syn
permit udp any eq domain any
permit tcp any eq 2099 any
permit tcp any range 5222 5223 any
permit udp any range 5000 5500 any
!
access-list 7 permit 192.168.0.12
access-list 7 permit 192.168.1.0 0.0.0.63
dialer-list 1 protocol ip permit
snmp-server community *snip* RO
snmp-server chassis-id SHIELD2
snmp-server contact *snip*
!
no cdp run
!
control-plane
!
banner motd ^CC
*snip*
!
line con 0
exec-timeout 0 0
line aux 0
exec-timeout 0 1
no exec
transport output none
line vty 0 4
exec-timeout 120 0
password 7 *snip*
login
transport input telnet
!
no process cpu extended
no process cpu autoprofile hog
ntp clock-period 17208491
ntp server 193.204.114.232 key 0 prefer
!
end
