1

I have a question. Equipment: Cisco 2821

CEF is enabled on all router ports:

sh ip interface | i CEF
  Post encapsulation features: CEF Packet Capture
   IP CEF switching is enabled
   IP CEF switching turbo vector
   IP route-cache flags are Fast, CEF

I started taking a traffic dump using the command:

monitor capture point ip process-switched POINT both

And I saw a huge count of packets in the dump, requests from the external servers to the internal one, and the responses back.

enter image description here Accordingly, the question is, why are DNS requests from the host processed by the processor? Other traffic is fine. I'm interested in this particular moment, because... There are problems with CPU load on the router.

Config:

version 15.1
service timestamps debug datetime msec
service timestamps log datetime localtime
service password-encryption
service sequence-numbers
!
!
boot-start-marker
boot-end-marker
!
!
logging userinfo
logging buffered 128000
logging rate-limit 100
no logging console
!
aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authentication login console local
aaa authentication enable default group tacacs+ enable
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
!
aaa session-id common
!
process cpu statistics limit entry-percentage 10 size 86400
process cpu extended history 60
clock timezone MSK 3 0
!
no dot11 syslog
ip source-route
!
!
ip cef

!
no ipv6 cef
!
multilink bundle-name authenticated

redundancy
!

!!
!
!
!
interface Loopback10
 ip address 10.250.250.3 255.255.255.255
!
interface GigabitEthernet0/0
 description MGMT
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip route-cache cef
 load-interval 30
 duplex auto
 speed auto
!
interface GigabitEthernet0/0.2255
 description MGF_TO_ISP
 encapsulation dot1Q 2255
 ip access-group input_MGF in
 ip access-group output_MGF out
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip virtual-reassembly in drop-fragments
 ip virtual-reassembly out drop-fragments
!

interface GigabitEthernet0/1
 no ip address
 load-interval 30
 ip route-cache cef
 duplex auto
 speed auto
!

interface GigabitEthernet0/1.666
 description MGF_DOMAIN
 encapsulation dot1Q 666
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip virtual-reassembly in drop-fragments
 ip virtual-reassembly out drop-fragments
!
interface GigabitEthernet0/1.671
 description MGF_DMZ
 encapsulation dot1Q 671
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip virtual-reassembly in drop-fragments
 ip virtual-reassembly out drop-fragments
!

interface GigabitEthernet0/1.673
 description MGF_PARTNERS
 encapsulation dot1Q 673
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip virtual-reassembly in drop-fragments
 ip virtual-reassembly out drop-fragments
!
interface GigabitEthernet0/1.674
 description MGF
 encapsulation dot1Q 674
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip virtual-reassembly in drop-fragments
 ip virtual-reassembly out drop-fragments
 service-policy input 10Mb-WiFi
 service-policy output 10Mb-WiFi
!

interface FastEthernet0/3/0
 no ip address
 shutdown
!
interface FastEthernet0/3/1
 no ip address
 shutdown
!
interface FastEthernet0/3/2
 no ip address
 shutdown
!
interface FastEthernet0/3/3
 no ip address
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip flow-top-talkers
 top 200
 sort-by bytes
 cache-timeout 3600000
!
ip pim autorp listener
ip pim spt-threshold infinity group-list 10
ip nat translation timeout 900
ip nat translation tcp-timeout 300
ip nat translation udp-timeout 60
ip nat translation dns-timeout 10
ip nat translation icmp-timeout 6
ip nat translation port-timeout tcp 110 60
ip nat translation port-timeout tcp 25 60
ip nat translation port-timeout tcp 80 20
ip nat translation port-timeout tcp 8080 20
ip nat translation max-entries 110000
ip nat translation max-entries all-host 300

ip route 0.0.0.0 0.0.0.0 X.X.X.X
ip route 10.0.0.0 255.0.0.0 Null0
ip route 127.0.0.0 255.0.0.0 Null0
ip route 169.254.0.0 255.255.0.0 Null0
ip route 172.16.0.0 255.240.0.0 Null0


ip sla key-chain 
ip sla 10
 tos 184
 frequency 300
ip sla schedule 10 life forever start-time now
ip sla 20
 tos 184
 frequency 300
ip sla schedule 20 life forever start-time now
ip sla 30
 frequency 10
ip sla schedule 30 life forever start-time now
ip sla 40
 frequency 10
ip sla schedule 40 life forever start-time now
ip sla enable reaction-alerts
ip sla responder
ip sla responder twamp
 timeout 300
ip sla server twamp
 port 9000
 timer inactivity 300

!
logging history size 50

!
!
!
!
snmp-server trap-source GigabitEthernet0/0
snmp-server source-interface informs GigabitEthernet0/0
!
!
!
control-plane host
!
control-plane transit
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
 session-timeout 5
 exec-timeout 60 0
 transport input ssh
 transport output ssh
!
monitor event-trace cef ipv4 size 4096
scheduler allocate 20000 1000
ntp master 5
ntp update-calendar
ntp peer 10.0.0.1
ntp peer 10.0.0.2
end
Improve this question
3
  • PLease edit your question to include the entire router configuration (sanitized). Use the preformatted { } text option. Otherwise we're just guessing.
    – Ron Trunk
    Commented Feb 15 at 9:25
  • Ron, no problem.
    – Глеб Щеголев
    Commented Feb 15 at 11:40
  • The config is sanitized to the point of useless. You'll see a lot of things "process-switched" because of NAT. NAT will be a majority of the CPU load, and will mostly show up at "interrupt" level (the second % in "sh proc cpu") The 2821 really isn't all that fast.
    – Ricky
    Commented Feb 15 at 21:05

2 Answers 2

Reset to default
2

You have NAT and ip virtual-reassembly enabled on the router with what appears to be a 1 gigabit internet service (or at least it is connected on a 1 gigabit port). This can easily overwhelm the performance capability of the 2821 router. You should be using a firewall such as ASA 5508 or 5516 for the desired level of features and performance, assuming it is a 1 gigabit internet service.

The 2821 will reach its limits somewhere between about 50 megabit and 80 megabit of throughput, depending on what features you have enabled. Virtual-reassembly and NAT require additional CPU and buffer performance for high throughput. If you want to keep using the 2821, disable the ip virtual-reassembly feature and see if the CPU load is reduced. Troubleshoot any fragmentation issue separately or use a more capable gateway device to match your internet service capacity.

The DNS query traffic may be a red herring. You have blanked out the source or destination IP addresses for the queries so it is not possible to tell where they came from. They could be internet IP addresses trying to use your router as a DNS server, or your LAN clients using the router as DNS server or the router itself making DNS queries for unknown reasons like a call home feature or similar. I would guess they are probably just general background noise connection attempts from botnets etc. that hit the router and are denied. Your WAN IP address may have been formarly used on a DNS server so queries still hit it. Or it could be legitimate traffic to a DNS server on your network that is allowed via NAT. You have no NAT or ACL rules showing or IP address info so it is impossible to tell.

If the traffic is undesired, you can use an access list to block traffic from the network that is sourcing the connection attempts if needed but it likely will not reduce your CPU load unless it is related to the NAT and virtual-reassembly processes in which case, the issue is the features on a low performance router.

Check the output of 'show process cpu sort' to see more information on what process is keeping the CPU busy.

Improve this answer
4
  • virtual-reassembly is set to drop-fragments, so it'll be of minimal impact. (and v-r is done by CEF)
    – Ricky
    Commented Feb 15 at 21:07
  • I thought that as well (that it should have no or little impact via CEF support etc.) but Cisco mentions a potential for performance impact (in IOS-XE docs at least, classic IOS is harder to find info on these days) without qualifications so I'm betting it could be a factor, even if small. If nothing else, it is worth a shot when the router is already under strain.
    – FrameHowitzer
    Commented Feb 16 at 0:31
  • Everything has some impact, as the 28xx line is a software platform. ('tho they do have a tiny crypto coprocessor)
    – Ricky
    Commented Feb 16 at 1:35
  • Ricky, If I decided to transmit fragmented packets, the load would increase even more in this case, on the contrary, it helped me reduce the load. The most heavily loaded process is "IP Input".
    – Глеб Щеголев
    Commented Feb 16 at 12:08
1

The problem was solved by blocking a pool of IP addresses from Brazil; CPU load dropped from 90% to 30%. It is not clear why and why they sent a bunch of DNS requests to us. But why exactly these requests were displayed in the dump is unclear, because CEF is working, NAT did not work on this router.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.