Hi Paul, The only routing protocol I have running on these routers is BGP, for a IPSEC GRE VPN tunnel. -Ken ... View more

Hi Guys, for simplicity, posting just what might  be applicable. Let me know if I am missing anything, or you want config from other router - configured pretty much the same: version 16.9 no service pad no service dhcp hostname Sparklight boot-start-marker boot system bootflash:isr4300-universalk9.16.09.04.SPA.bin boot-end-marker vrf definition Mgmt-intf  !  address-family ipv4  exit-address-family  !  address-family ipv6  exit-address-family no ip source-route track 10 ip sla 10 reachability ! no cdp run ! class-map type inspect match-all Inside-DMZ-Class  match access-group name Inside-DMZ class-map type inspect match-all Outside-Inside-Class  match access-group name Outside-Inside class-map type inspect match-all Outside-DMZ-Class  match access-group name Outside-DMZ class-map type inspect match-any All-Protocols-Class  match protocol tcp  match protocol udp  match protocol icmp ! policy-map type inspect Outside-Inside-Policy  class type inspect Outside-Inside-Class   inspect  class class-default   drop policy-map type inspect All-Protocols-Policy  class type inspect All-Protocols-Class   inspect  class class-default   drop policy-map type inspect Outside-DMZ-Policy  class type inspect Outside-DMZ-Class   inspect  class class-default   drop log policy-map type inspect Inside-DMZ-Policy  class type inspect Inside-DMZ-Class   inspect  class class-default   drop ! zone security DMZ zone security Inside zone security Outside zone security Snort zone-pair security DMZ-Inside source DMZ destination Inside  service-policy type inspect All-Protocols-Policy zone-pair security DMZ-Outside source DMZ destination Outside  service-policy type inspect All-Protocols-Policy zone-pair security Inside-DMZ source Inside destination DMZ  service-policy type inspect Inside-DMZ-Policy zone-pair security Inside-Outside source Inside destination Outside ! interface GigabitEthernet0/0/0  no ip address  ip nat inside  zone-member security Inside  negotiation auto  spanning-tree portfast disable !  service-policy type inspect All-Protocols-Policy zone-pair security Outside-DMZ source Outside destination DMZ  service-policy type inspect Outside-DMZ-Policy zone-pair security Outside-Inside source Outside destination Inside  service-policy type inspect Outside-Inside-Policy zone-pair security Snort-Outside source Snort destination Outside  service-policy type inspect All-Protocols-Policy ! interface GigabitEthernet0/0/0.1  encapsulation dot1Q 1 native  ip address 10.0.0.1 255.255.0.0  ip nat inside  zone-member security Inside ! interface GigabitEthernet0/0/0.4  encapsulation dot1Q 4  ip address 172.17.0.2 255.255.0.0  ip nat inside  zone-member security DMZ  standby version 2  standby 1 ip 172.17.0.20  standby 1 preempt  standby 1 track 10 decrement 10 ! interface GigabitEthernet0/0/1  ip flow monitor FlowMonitor input  ip flow monitor FlowMonitor output  ip address 24.116.74.210 255.255.255.240  ip nat outside  zone-member security Outside  negotiation auto  spanning-tree portfast disable ip forward-protocol nd ip tcp synwait-time 10 no ip http server ip http access-class ipv4 RouterAccess ip http authentication local ip http secure-server ip http session-idle-timeout 1200 ip tftp source-interface GigabitEthernet0/0/0.1 ip nat inside source static x xxx xxx ip route 0.0.0.0 0.0.0.0 24.116.74.209 ip access-list standard ovrld  permit 172.17.0.0 0.0.255.255  permit 10.0.0.0 0.255.255.255 ip access-list extended Inside-DMZ  permit tcp any any eq www  permit tcp any any eq 443 ip access-list extended Outside-DMZ  permit tcp any host 172.17.0.xxx eq 30175 xxx xxx ip sla 10  icmp-echo 8.8.8.8  frequency 5 ip sla schedule 10 life forever start-time now ... View more

Thank you all for your responses. I think I have figured it out. The bandwidth wasn't set on the dialer Interface, and I believe it defaults to 56k. Once I set the dialer interface it to 4000k, which is suppose to be my DSL up speed things look a bit better. It is vary confusing configuring a dialer - DSL interface for monitoring, and I can't seem to get a straight answer about what to apply where - the interface or the dialer interface - especially netflow. I had set the bandwidth for the interface and not the dialer. Ken ... View more

Hi Joseph, We have customers hitting a website, and udp device traffic incoming and outgoing though a vpn tunnel and the Internet. My concern is that no traffic gets drop. I think it's strange how the traffic is swinging from zero to 100 and back. Any idea how I can verify that I don't need more bandwidth to insure customer and device traffic? Thanks, Ken ... View more