Cisco 1841 vs 1801 VPN IPSec

[Charly Coueffe]

Hi,

I've an issue with a Cisco router 1841. I've a tunnel IPsec between two routers Cisco. The first is a router 1801 and the second is a router 1841.

During the day I've the trafic increase to 4 Mbit/s with essentially UDP packets ( VOIP ).  My problem is that the router 1841 has 100% CPU usage and the 1801 only use  50%.

I've changed the 1841 by another router with more memory and a more recent IOS version but it don't resolved the issue.

Then I've used a 1801 on the both side and I only have 50% of CPU usage.

The configuration is very basic.

I've one tunnel with 3des for the phase 1 and a pre-share key.  For the second phase I use 3Des  and sha.

The crypto engine hardware is enable on the two routers (1801 and 1841).

Do you already meet this problem ?

regards,

During the test I've used the following IOS :

IOS version for 1801 : c180x-advipservicesk9-mz.124-6.T5.bin

IOS version for 1841 : c1841-adventerprisek9-mz.124-9.T1.bin, c1841-adventerprisek9-mz.124-13.bin, c1841-advipservicesk9-mz.151-1.T.bin

Charly

[Marcin Latosiewicz]

Charly,

Were you able to resolve this until now?

If not maybe you can attach show techs for us to have a looks (things like this very often end up in bugs).

The "high cpu" you mentioned is it caoused by IO operations or a particular process?

Marcin

[Charly Coueffe]

Hello Marcin,

Sorry for the late reply, but the client did not use the old router. He preferred to stay on the 1803 which worked better.

This morning I generated a "technical support". The router consumes much more CPU than the 1803.

Best regards,

Charly COUEFFE

[Marcin Latosiewicz]

Charly,

By the quick look it looks like most stuff is caused by IO.

"show buffers" shows some failures ... interesting .... try disabling SNMP-server ... it's long shot ... but could be interesting to try.

Marcin

[Charly Coueffe]

Marcin,

We have disabled snmp but the issue is the same. We have the same hight CPU value. We have retry with the 1803 and CPU still to 50%.

Charly

[Marcin Latosiewicz]

Charly,

There's little I can do via support forums, did you already open a TAC case with us for this? 50% is not not bad - at least your CPU is not bored :-)

Check if/where you have higher input or output rate (as seen "show interface").

I'd be also in terrested if "show buffer" shows failures and on which buffers.

Marcin