Hello Folks,  One of our branch router is facing latency issues. Upon checking I found the circuit clean and utilization is normal. However, found lot of output drops. This is a 6M MPLS circuit.  Solarwinds NMS is also showing Transmit discards on the WAN facing interface. The applied QoS policy was shaping 100%, I changed it to 85% but output drops are still increasing. E.g around 8:00 PM CST I cleared the counters before applying 85% policy. At the moment at 1:27 AM, I can see 520 Output drops on the interface.  NMS also showing transmit discards. Can anyone please help? It is a Cisco 2901 router.  Here is the output with a 100% Shape, before applying 85% shaping policy....  show int gigabitEthernet 0/1 GigabitEthernet0/1 is up, line protocol is up Hardware is CN Gigabit Ethernet, address is 00f6.6384.2181 (bia 00f6.6384.2181) MTU 1500 bytes, BW 6000 Kbit/sec, DLY 100 usec, reliability 255/255, txload 4/255, rxload 2/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full Duplex, 100Mbps, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 4w6d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 121037 Queueing strategy: Class-based queueing Output queue: 0/1000/0 (size/max total/drops) 30 second input rate 52000 bits/sec, 25 packets/sec 30 second output rate 107000 bits/sec, 25 packets/sec 96300307 packets input, 38294522 bytes, 0 no buffer Received 302429 broadcasts (154240 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 302429 multicast, 0 pause input 93874826 packets output, 86768059 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out Here is the configuration of interface with 100% shaping...  show runn int GigabitEthernet0/1 Building configuration... Current configuration : 277 bytes ! interface GigabitEthernet0/1 bandwidth 6000 ip address x.x.x.x 255.255.255.252 ip flow ingress ip pim sparse-mode load-interval 30 duplex full speed 100 history BPS service-policy output SHAPE_100 ---------------------------------------------------------------------- policy-map SHAPE_100 class class-default shape average percent 100 service-policy QUEUE -------------------------------------------------------------------- policy-map QUEUE class EF priority percent 50 class AF41 bandwidth remaining percent 15 class AF31 bandwidth remaining percent 60 class AF21 bandwidth remaining percent 20 class AF11 bandwidth remaining percent 3 class BE bandwidth remaining percent 1 --------------------------------------------------------------------- Show int gi0/1 output when SHAPE_85 was applied.  #show int gigabitEthernet 0/1 GigabitEthernet0/1 is up, line protocol is up Hardware is CN Gigabit Ethernet, address is 00f6.6384.2181 (bia 00f6.6384.2181) MTU 1500 bytes, BW 6000 Kbit/sec, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full Duplex, 100Mbps, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 04:48:49 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 562 Queueing strategy: Class-based queueing Output queue: 0/1000/562 (size/max total/drops) 30 second input rate 15000 bits/sec, 14 packets/sec 30 second output rate 47000 bits/sec, 15 packets/sec 201041 packets input, 39694711 bytes, 0 no buffer Received 1736 broadcasts (871 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 1736 multicast, 0 pause input 233482 packets output, 82459145 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out -------------------------------- Interface configuration with 85% Shape...  show runn int gigabitEthernet 0/1 Building configuration... Current configuration : 276 bytes ! interface GigabitEthernet0/1 bandwidth 6000 ip address x.x.x.x 255.255.255.252 ip flow ingress ip pim sparse-mode load-interval 30 duplex full speed 100 history BPS service-policy output SHAPE_85 end -------------------------------- policy-map SHAPE_85 class class-default shape average percent 85 service-policy QUEUE -------------------------------------------------------------------- policy-map QUEUE class EF priority percent 50 class AF41 bandwidth remaining percent 15 class AF31 bandwidth remaining percent 60 class AF21 bandwidth remaining percent 20 class AF11 bandwidth remaining percent 3 class BE bandwidth remaining percent 1 --------------------------------------------------------------------- Router is using following image: c2900-universalk9-mz.SPA.154-3.M3.bin Help please...  ... View more

I have configured Dyn DNS on my Cisco 1921 router (15.3(3)M3) but it is not updating the host-name. I used debug command too to see the DDNS updates but no update or information shown in response to debug ip ddns update command. Can anyone please suggest what is missing in following configuration? BR-RTR#show runn Building configuration... Current configuration : 8336 bytes ! ! Last configuration change at 10:25:57 UTC Tue Feb 9 2016 by pilot1 version 15.3 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname BR-RTR ! boot-start-marker boot-end-marker ! ! logging buffered 51200 warnings enable secret 5 $1$PGMm$.ARlNw3FeDyBc0033Fklf1 ! no aaa new-model ! ! ! ! ip dhcp excluded-address 192.168.206.1 192.168.206.100 ip dhcp excluded-address 192.168.206.200 192.168.206.254 ! ip dhcp pool BR-RTR network 192.168.206.0 255.255.255.0 default-router 192.168.206.1 dns-server 8.8.8.8 8.8.4.4 ! ! ! ip domain name hq.com ip name-server 8.8.8.8 ip name-server 8.8.4.4 ip ddns update method MYDYN HTTP add http://EmailID:Password@members.dyndns.org/nic/update?system=dyndns&hostname=mydomain.dyndns.org&myip=MYWANIP add http://EmailID:Password@members.dyndns.org/nic/update?system=dyndns&hostname=mydomain.dyndns.org&myip=MYWANIP interval maximum 2 0 0 0 ! ! ip cef no ipv6 cef ! multilink bundle-name authenticated ! ! crypto pki trustpoint TP-self-signed-1724857321 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-1724857321 revocation-check none rsakeypair TP-self-signed-1724857321 ! ! crypto pki certificate chain TP-self-signed-1724857321 certificate self-signed 01 3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 31373234 38353733 3231301E 170D3134 31313134 31393539 31315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 37323438 35373332 3130819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100BCEA D2FEE707 C4B0C4C6 6C604A08 82F79EB8 D470A9BA E5C3DD0B F0D6A335 4C33ECDA C6C8C0A7 A8F1C66B 8C07E90F C11D9EAC 6C062044 B19F5056 5BA0ACC5 DE8968FB 6847E723 81C14BBB 65D7B8AD 08988C33 19D37355 4ABD997E 86D635ED 61C04F4E 77407E1B 68C98D28 47FF95F6 CF2E5052 6E1D1846 F0A264FE 45EC384F C7050203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304 18301680 14C44FAA 91D904CA B7649917 DD82FF4F 252AA380 35301D06 03551D0E 04160414 C44FAA91 D904CAB7 649917DD 82FF4F25 2AA38035 300D0609 2A864886 F70D0101 05050003 818100AF C998BE34 B2279F5A 60A7349B 80F2E2CC 31D56281 92FD8E56 C6BBB14F 7BCD0479 6BFE91BC 23315B32 A2057AFD 44E7E490 7CB9E67C 4650B4E5 B51EE0EC 85199D11 C6D52B75 8095F719 D373FC43 EF052098 741247D6 00CF278E 70B1EC23 F4B71E7E 81383E20 DD350EB5 5B9F03A7 E91DEBB3 220AA6FD 922ED672 92E9D359 9F53B9 quit license udi pid CISCO1921/K9 sn abcdefghij ! ! username admin privilege 15 secret 5 $secret/ ! redundancy ! ! ! ! ! ! ! crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key cisco123 address HO_WAN_IP crypto isakmp key cisco123 address JAD-WAN-IP crypto isakmp key cisco123 hostname hooffice.dyndns.org ! ! crypto ipsec transform-set VPN esp-3des esp-md5-hmac mode tunnel ! crypto ipsec profile HO set security-association lifetime days 7 ! ! ! crypto map CMAP 10 ipsec-isakmp set peer HO_WAN_IP set transform-set VPN match address JADC reverse-route crypto map CMAP 20 ipsec-isakmp set peer JAD-WAN-IP set transform-set VPN match address HO reverse-route crypto map CMAP 30 ipsec-isakmp set peer hooffice.dyndns.org dynamic set security-association lifetime seconds 86400 set transform-set VPN match address HO reverse-route ! ! ! ! ! interface Embedded-Service-Engine0/0 no ip address shutdown ! interface GigabitEthernet0/0 description ***WAN-INTERFACE*** no ip address ip tcp adjust-mss 1412 duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 ! interface GigabitEthernet0/1 description ***LAN-INTERFACE*** ip address 192.168.206.1 255.255.255.0 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1412 duplex auto speed auto ! interface Dialer1 ip ddns update hostname mydomain.dyndns.org ip ddns update MYDYN host mydomain.dyndns.org ip address negotiated ip mtu 1452 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer-group 1 ppp authentication chap pap callin ppp chap hostname usename ppp chap password 0 pass ppp pap sent-username username password 0 pass ppp ipcp dns request crypto map CMAP ! ip forward-protocol nd ! ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ip dns server ip nat inside source route-map NONAT interface Dialer1 overload ip route 0.0.0.0 0.0.0.0 Dialer1 ip route 192.168.6.0 255.255.255.0 JAD-WAN-IP ! ip access-list extended HO permit ip 192.168.206.0 0.0.0.255 192.168.6.0 0.0.0.255 permit ip 192.168.206.0 0.0.0.255 192.168.5.0 0.0.0.255 permit ip 192.168.206.0 0.0.0.255 172.16.1.0 0.0.0.255 ip access-list extended JADC permit ip 192.168.206.0 0.0.0.255 10.1.2.0 0.0.0.255 permit ip 192.168.206.0 0.0.0.255 10.1.3.0 0.0.0.255 permit ip 192.168.206.0 0.0.0.255 10.1.4.0 0.0.0.255 ip access-list extended NONAT deny ip 192.168.206.0 0.0.0.255 10.1.2.0 0.0.0.255 deny ip 192.168.206.0 0.0.0.255 10.1.3.0 0.0.0.255 deny ip 192.168.206.0 0.0.0.255 10.1.4.0 0.0.0.255 deny ip 192.168.206.0 0.0.0.255 192.168.6.0 0.0.0.255 deny ip 192.168.206.0 0.0.0.255 192.168.5.0 0.0.0.255 deny ip 192.168.206.0 0.0.0.255 172.16.1.0 0.0.0.255 deny ip 192.168.206.0 0.0.0.255 192.168.0.0 0.0.0.255 permit ip 192.168.206.0 0.0.0.255 any ip access-list extended HO permit ip 192.168.206.0 0.0.0.255 192.168.0.0 0.0.0.255 ! ip sla auto discovery ip sla 3 icmp-echo 192.168.0.254 source-ip 192.168.206.1 ip sla schedule 3 life forever start-time now ip sla 10 icmp-echo 172.16.1.254 source-ip 192.168.206.1 ip sla schedule 10 life forever start-time now dialer-list 1 protocol ip permit ! route-map NONAT permit 10 match ip address NONAT ! ! ! control-plane ! ! ! line con 0 login local line aux 0 line 2 no activation-character no exec transport preferred none transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 privilege level 15 login local transport input telnet ssh line vty 5 15 privilege level 15 login local transport input telnet ssh ! scheduler allocate 20000 1000 ! end ... View more

Hi all, I have a Cisco 1921 router with VPN configured on it, at the moment, Internet Modem (ISP modem) is in bridge mode. Problem happens when Public IP changes since this branch doesn't have a static IP. I have tried DDNS (DynDNS) but it didn't work, explored many forums for DDNS issue but nothing helped.. I am now thinking to use ISP modem in routing mode because DDNS works absolutely fine with this modem. My question is: where would the NAT stand, since ISP modem can also do NATTING and what other settings would I need in order to configure VPN on cisco router?  Do I need to disable it on ISP modem? Will I need Port-forwarding on ISP modem? Awaiting your kind response, Thanks in advance. ... View more

Hi all; Is there anyway to check who is trying or have tried to hack network ? I am using ASA 5520 firewall. Is there any command to check it ? Thanks. ... View more

Hi all; Is there anyway to check who is trying or have tried to hack network ? I am using ASA 5520 firewall. Is there any command to check it ? Thanks. ... View more

Hi All; I want to know, is there any way to check hacking attempts on my network ? My network has a Cisco 5520 firewall behind router. Is there any command to check it on firewall ? Need your kind. help thanks. ... View more