Strange delay during ESTABLISHING PPP

[giomm2001]

I have a problem with a strange delay in phase of ESTABLISHING PPP, exactly 20 seconds and I don't understand it is an error of the configuration of the router or an ISP problem.

If I try the connection with the router as bridge and the PC as client PPPoE the connection it is fast, this makes me believe that the cause is the configuration of the router but I has made a lot of tests and I haven't succeeded in resolving.

Attached there is a running-config and the debug PPP Negotiation.

Can someone help me?

Regards

Giovanni

from Italy

[Kevin Dorrell]

Ciao Giovanni,

It may be because the dialer will discard packets during dialing. Try setting something like dialer hold-queue 10 timeout 20 in the dialer interface.

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fdial_r/drfd.htm#wp1017934

Kevin Dorrell

Lussemburgo

[giomm2001]

Hi Kevin

Thanks, your suggestion has resolved another problem with the timeout of IExplorer (during the connection time) but however 20 seconds of delay remain in phase of ESTABLISHING that I don't understand whether to eliminate.

Do you have some other suggestion?

Giovanni

[Kevin Dorrell]

Giovanni,

I'm not sure I can solve your problem, because I do not have any experience with PPPoE and ATM. All I can say is that if it was dial over ISDN, then you would need encapsulation ppp on the physical interface as well as the dialer. However, that may not be relevant here.

Other than that, I am running out of ideas. The LCPs are exchanging magic numbers, but then just sitting there doing nothing until the far end decides it is time to make a move. Why isn't your end taking the initialtive?

Here is an idea - maybe you need ppp authentication pap on the dialer in order to force your end to take the initiative.

Try it and let me know.

One other observation I will make (but not relevant to the current problem) is that your access list 113 has been applied as a filter to packets coming in to the dialer, as well as controlling the outward dialing. What we are saying is that packets will only be received if they are destined for one of the ports listed in the access list. Is this really what you intended?

Kevin Dorrell

Luxembourg

[giomm2001]

Hi Kevin

I've tried "ppp authentication pap" whitout success because I think the ISP doesn't give me usr/passw, so the ppp run to timeout (I hope my english right).

Probably you're right about access-list, if I understand the "accesn-list nnn in" are defined for input packet (from ISP to dialer).

So probably this is a my mistake.

I'll try to change "in" to "out" and see what appens..

What I really want is :

The dialer connect to ISP only if my PC ask for something (http,ftp,ecc...) outside my subnet.

The duration of the connection is only the time necessary to :connect, send the request to web site, receive the response from web site and keep the connection up until there is traffic outside the subnet (so ddr timeout is userfull).

I hope my idea is clear, i'm not sure the same on my router configuration :-)

I'll try also to remove the firewall inspecting istruction (as Tepatel tips).

Now I haven't my router so I'll try in the afternoon and give you a response about above tips.

Many thanks

Giovanni

[giomm2001]

Many, many thanks Kevin for your support but the situation doesn't change.

I tried your tips without success.

About access-list I'll try to adjust when the dialer works well otherwise it isn't an important things, as you may see on my response to Tepatel now I'm using a router as modem but I want to re-enable his original feature.

Any other tips are wellcome.

Thanks

Giovanni

Italy

[giomm2001]

Hi

If you want please see my response to dbellaze

Thanks

Giovanni

[tepatel]

Remote side is not sending LCP CONFREQ for 20 secs once it ack the CONFREQ sent by dsl router. So it might be an issue with ISP side too.

But pl. try to remove "ip access-group 113 in" and "ip inspect myfw out" from the dialer intreface and then see if that makes any difference.

Also turn on debugs in msec using "service time debug date msec" in the global config.

[giomm2001]

Thanks

I'll try to do it in the afternoon (for italy) but I have a doubt: why if I use the router as bridge and the PC as client pppoe there isn't the delay of 20 seconds and the time of connection is it 2 seconds at the most?

I think that if it were an issue of the isp I should also have it with the pc as client pppoe.

Thanks

giovanni

[tepatel]

I agree with you but when router is trying to make connection, there is no LCP packet from ISP side for 20 secs. Thats too long. Router should have timedout on LCP and start sending LCP CONFREG again after 2 secs unless we have drops under that virtual-access interface. So during that 20 secs of gap, can you issue "show interface virtual-access x" and see if we have packet drops?

You can try to use "ppp lcp predictive" command under the interface to reduce negotiation time by predicting responses from peers and sending expected reply and request packets in advance.

[giomm2001]

Attached you can see the first debug ppp negotiation where is visible 10 retry of 2 second from the router to the isp because of timeout.

After this I add a line to dialer section "ppp timeout retry 60" because I think it's a config mistake but the result it isn't sufficient.

My opinion is the ISP want a different initialization of session but my know-how is very limited about that.

Also attached you can see a sniff of ethernet connection using a modem ethernet and the PC as client pppoe.

This file (tcpdump format) was created by Ethereal, a freeware sniffer sofware and seems the connection phase is very simple but I've a difficult to understand if there is similarity between two connection.

I've already tried the"ppp lcp predictive" but nothing change, now I haven't a debug of this test but repeat it and post the result asap.

About the "ip access-group xxx" and the "ip inspect..." I tried to remove it but always nothing change and the delay remain.

I'll try to see if there is a dropped packet as your request.

I'm very frustrated about this situation, now i'm using the router as modem but it's very underutilization and is not good for my necessity.

[dbellaze]

Remove the "ip tcp adjust-mss" command from your dialer interface, and re-apply "ip mtu 1492" to the dialer interface and try again from the router.

debug ppp neg

Daniel

[giomm2001]

Yesterday I have made a test using the CRWS and I've configured the router in PPPoA.

The connection is instant (to see the file PPPoADebugPPPNeg.txt) and the problem of the 20 sec. it disappears.

I suppose the ISP is shaped in autosense.

But with this configuration (PPPoA01.txt) I don't succeed in making DIAL-ON-DEMAND, the command "dialer idle-timeout 30 either" it's ignored and the line is always active.

So with this router's configuration this is the problem.

Do I also attach the debug ppp negot (debugpppoa.txt) of the connection PPPoA that is different in the phases of ESTABLISHMENT from that of the PPPoE (probably this is correct, but what is wrong in my configuration PPPoE?)

However I don't care it if the router connects him in overA or overE but it interests me that he work as I say.

Do you have some suggestion to resolve one of the two problems?

[dbellaze]

As far as I know there is no DDR feature for PPPoA at this time. Did you try connecting the router w/PPPoE with the suggestions that I gave you?

Daniel

[giomm2001]

I suppose this about pppoa but i hope i'm wrong.

Yes, I've tried your suggestion without success.

There are always 20 second delay.

Comparing debug pppoe and pppoa i see there is a different lcp sequence :

pppoa-

00:13:42: Vi2 PPP: Phase is ESTABLISHING, Active Open

00:13:42: Vi2 PPP: No remote authentication for call-out

00:13:42: Vi2 LCP: O CONFREQ [Closed] id 12 len 10

00:13:42: Vi2 LCP: MagicNumber 0x119E92B1 (0x0506119E92B1)

00:13:42: Vi2 LCP: I CONFREQ [REQsent] id 1 len 14

00:13:42: Vi2 LCP: AuthProto PAP (0x0304C023)

00:13:42: Vi2 LCP: MagicNumber 0x146BC621 (0x0506146BC621)

00:13:42: Vi2 LCP: O CONFACK [REQsent] id 1 len 14

00:13:42: Vi2 LCP: AuthProto PAP (0x0304C023)

00:13:42: Vi2 LCP: MagicNumber 0x146BC621 (0x0506146BC621)

0

pppoe-

00:41:42: Vi1 PPP: Phase is ESTABLISHING, Active Open

00:41:42: Vi1 PPP: No remote authentication for call-out

00:41:42: Vi1 LCP: O CONFREQ [Closed] id 1 len 10

00:41:42: Vi1 LCP: MagicNumber 0x11B837D8 (0x050611B837D8)

00:41:42: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up

00:41:42: Vi1 LCP: I CONFACK [REQsent] id 1 len 10

00:41:42: Vi1 LCP: MagicNumber 0x11B837D8 (0x050611B837D8)

00:42:02: Vi1 LCP: I CONFREQ [ACKrcvd] id 2 len 18

00:42:02: Vi1 LCP: MRU 1492 (0x010405D4)

00:42:02: Vi1 LCP: AuthProto PAP (0x0304C023)

00:42:02: Vi1 LCP: MagicNumber 0x5647D73A (0x05065647D73A)

But I don't know if it's important.

Do you have any other suggestion for eliminate the pppoe 20 second delay ?

Giovanni