In an office setting, multiple clients (Mac OSX, Ubuntu, iOS, Android and Windows 8) connect to a VPN server in another location. These clients are behind an SRX240B router which is connected to a PPPoE fiber uplink.
The SRX240B replaced the previous router, an SRX100H. The SRX100 was completely stable, but the SRX240B has some weird issues.
When clients connect to VPN, the connection usually works for a couple of minutes, but then all internet traffic disappears. Every device, every browser, every connection is lost.
I can SSH into the router, but pinging external hosts (8.8.8.8 for example) just times out. When a specific VPN connection is disconnected by the user, all internet traffic returns.
I have no idea what could cause this. The only thing I can imagine is that the SRX runs its own VPN software (and has active listening processes on UDP port 500 and 4500), and this somehow interferes with the client VPN. However, this does not explain why the SRX100 running exactly the same config has no issues.
For completeness, here is my router config on the SRX100. The only difference with the SRX240 is that all fe-*/*/*.*-interfaces are replaced with ge-*/*/*.*-interfaces.
## Last commit: 2015-02-19 15:37:07 UTC by root
version 12.1X44-D40.2;
system {
host-name --obscured--;
root-authentication {
encrypted-password --obscured--;
}
name-server {
8.8.8.8;
8.8.4.4;
}
services {
ssh;
dns {
dns-proxy {
propogate-setting enable;
interface {
vlan.0;
}
default-domain * {
forwarders {
--obscured--;
--obscured--;
--obscured--;
}
}
}
}
web-management {
http {
port 80;
interface vlan.0;
}
}
dhcp {
pool 192.168.2.0/24 {
address-range low 192.168.2.1 high 192.168.2.99;
name-server {
192.168.2.254;
}
router {
192.168.2.254;
}
propagate-settings vlan.0;
}
}
}
}
interfaces {
interface-range interfaces-trust {
member fe-0/0/1;
member fe-0/0/2;
member fe-0/0/3;
member fe-0/0/4;
unit 0 {
family ethernet-switching {
vlan {
members vlan-trust;
}
}
}
}
fe-0/0/0 {
unit 0 {
encapsulation ppp-over-ether;
}
}
pp0 {
unit 0 {
point-to-point;
ppp-options {
pap {
local-name --obscured--;
local-password --obscured--; ## SECRET-DATA
passive;
}
}
pppoe-options {
underlying-interface fe-0/0/0.0;
idle-timeout 0;
auto-reconnect 10;
client;
}
family inet {
mtu 1492;
negotiate-address;
}
}
}
vlan {
unit 0 {
family inet {
address 192.168.2.254/24;
}
}
}
}
snmp {
location --obscured--;
contact --obscured--;
community public {
authorization read-only;
clients {
192.168.2.0/24;
}
}
}
routing-options {
static {
route 0.0.0.0/0 {
next-hop pp0.0;
metric 0;
}
}
}
security {
address-book {
global {
address --obscured-- --obscured--;
address nagios02 192.168.2.249/32;
address anywhere 0.0.0.0/0;
address jeroen 192.168.2.170/32;
}
}
flow {
tcp-mss {
all-tcp {
mss 1300;
}
}
}
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
limit-session {
source-ip-based 50000;
destination-ip-based 50000;
}
}
}
nat {
source {
rule-set untrust-to-trust {
from zone trust;
to zone untrust;
rule outbound-nat-rule {
match {
source-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
destination {
pool --obscured-- {
address 192.168.2.249/32;
}
pool --obscured-- {
address 192.168.2.170/32;
}
rule-set ruleset-from-untrust {
from interface pp0.0;
rule --obscured-- {
match {
source-address --obscured--/32;
destination-address --obscured--/32;
destination-port 5666;
}
then {
destination-nat pool --obscured--;
}
}
rule port_17071 {
match {
destination-address --obscured--/32;
destination-port 17071;
}
then {
destination-nat pool --obscured--;
}
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy outbound {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone untrust to-zone trust {
policy nrpe {
match {
source-address --obscured--;
destination-address --obscured--;
application nrpe;
}
then {
permit;
}
}
policy --obscured-- {
match {
source-address anywhere;
destination-address --obscured--;
application --obscured--;
}
then {
permit;
}
}
}
}
zones {
security-zone untrust {
screen untrust-screen;
interfaces {
pp0.0;
}
}
security-zone trust {
interfaces {
vlan.0 {
host-inbound-traffic {
system-services {
dhcp;
ssh;
ping;
snmp;
http;
dns;
}
protocols {
all;
}
}
}
}
}
}
}
applications {
application nrpe {
protocol tcp;
destination-port 5666;
}
application --obscured-- {
protocol tcp;
destination-port 17071;
}
}
vlans {
vlan-trust {
vlan-id 10;
l3-interface vlan.0;
}
}
Update 1: Extra information, as requested by Jordan Head in the comments:
The SRX100 runs Junos 12.1X44-D40.2. The SRX240 runs Junos 12.1X46-D30.2, but the problem als occurred with an older version. I don't remember which version exactly, but I believe it was from the 11.4-series.
The problem occurs with any number of connected VPN clients (varying from 1 to 5 simultaneously).
I've checked the logs but nothing stood out.
The results of show system license:
root@router> show system license
License usage:
Licenses Licenses Licenses Expiry
Feature name used installed needed
dynamic-vpn 0 2 0 permanent
ax411-wlan-ap 0 2 0 permanent
Licenses installed: none
Update 2: status when connection is lost
I needed some time to reproduce the problem because my users are depending on this uplink. I got the following status at the moment the problem occurs:
root@router> show interfaces pp0.0 detail | no-more
Logical interface pp0.0 (Index 71) (SNMP ifIndex 548) (Generation 145)
Flags: Hardware-Down Point-To-Point SNMP-Traps 0x0 Encapsulation: PPPoE
PPPoE:
State: SessionDown, Session ID: None,
Configured AC name: None, Service name: None,
Auto-reconnect timeout: 10 seconds, Idle timeout: Never,
Underlying interface: ge-0/0/0.0 (Index 70)
Traffic statistics:
Input bytes : 665311
Output bytes : 41008220
Input packets: 2442
Output packets: 114687
Local statistics:
Input bytes : 665311
Output bytes : 946794
Input packets: 2442
Output packets: 6297
Transit statistics:
Input bytes : 0 0 bps
Output bytes : 40061426 0 bps
Input packets: 0 0 pps
Output packets: 108390 0 pps
Keepalive settings: Interval 10 seconds, Up-count 1, Down-count 3
Keepalive statistics:
Input : 63 (last seen 00:03:17 ago)
Output: 191 (last sent 00:03:19 ago)
LCP state: Down
NCP state: inet: Down, inet6: Down, iso: Not-configured, mpls: Not-configured
CHAP state: Closed
PAP state: Closed
Security: Zone: untrust
Flow Statistics :
Flow Input statistics :
Self packets : 2092
ICMP packets : 1385
VPN packets : 0
Multicast packets : 5
Bytes permitted by policy : 84103935
Connections established : 52
Flow Output statistics:
Multicast packets : 0
Bytes permitted by policy : 39000259
Flow error statistics (Packets dropped due to):
Address spoofing: 0
Authentication failed: 0
Incoming NAT errors: 0
Invalid zone received packet: 0
Multiple user authentications: 0
Multiple incoming NAT: 0
No parent for a gate: 0
No one interested in self packets: 18
No minor session: 0
No more sessions: 0
No NAT gate: 0
No route present: 409
No SA for incoming SPI: 0
No tunnel found: 0
No session for a gate: 0
No zone or NULL zone binding 0
Policy denied: 0
Security association not active: 0
TCP sequence number out of window: 1
Syn-attack protection: 0
User authentication errors: 0
Protocol inet, MTU: 1400, Generation: 158, Route table: 0
Flags: Sendbcast-pkt-to-re, Protocol-Down, User-MTU, Negotiate-Address
Protocol inet6, MTU: 1400, Generation: 159, Route table: 0
Flags: Protocol-Down, User-MTU
Addresses, Flags: Dest-route-down Is-Preferred Is-Primary
Destination: --obscured--/64, Local: --obscured--
Generation: 162
Addresses, Flags: Dest-route-down Is-Preferred
Destination: fe80::/64, Local: fe80::56e0:320f:fcea:9480
Generation: 164
root@router> show ethernet-switching table interface Ethernet-switching table: 30 entries, 28 learned, 0 persistent entries VLAN MAC address Type Age Interfaces vlan-trust * Flood - All-members vlan-trust 00:00:aa:c3:3d:c0 Learn 0 ge-0/0/3.0 vlan-trust 00:0c:29:c9:4e:ef Learn 0 ge-0/0/3.0 vlan-trust 00:0c:29:ea:61:c0 Learn 0 ge-0/0/3.0 vlan-trust 00:23:df:f7:e8:aa Learn 0 ge-0/0/3.0 vlan-trust 00:25:00:ad:f2:44 Learn 0 ge-0/0/4.0 vlan-trust 1c:b0:94:c0:56:51 Learn 0 ge-0/0/4.0 vlan-trust 20:a2:e4:62:0d:ec Learn 0 ge-0/0/4.0 vlan-trust 30:10:e4:77:da:f8 Learn 0 ge-0/0/4.0 vlan-trust 30:19:66:f3:52:de Learn 0 ge-0/0/4.0 vlan-trust 40:6c:8f:0a:bc:5f Learn 0 ge-0/0/3.0 vlan-trust 40:6c:8f:36:99:0b Learn 0 ge-0/0/3.0 vlan-trust 54:e0:32:ea:94:90 Static - Router vlan-trust 54:e4:3a:2f:81:2b Learn 0 ge-0/0/4.0 vlan-trust 68:5b:35:93:b2:ea Learn 0 ge-0/0/2.0 vlan-trust 68:5b:35:cb:b8:b4 Learn 0 ge-0/0/1.0 vlan-trust 70:de:e2:75:e0:5c Learn 0 ge-0/0/4.0 vlan-trust 78:19:f7:85:1e:f0 Learn 0 ge-0/0/3.0 vlan-trust 7c:6d:62:72:f8:0d Learn 0 ge-0/0/4.0 vlan-trust 7c:c5:37:1b:6d:42 Learn 0 ge-0/0/4.0 vlan-trust 8c:fa:ba:7d:81:a3 Learn 0 ge-0/0/4.0 vlan-trust 9c:04:eb:b1:92:9f Learn 0 ge-0/0/4.0 vlan-trust ac:87:a3:29:77:57 Learn 0 ge-0/0/3.0 vlan-trust b4:75:0e:60:b1:65 Learn 0 ge-0/0/4.0 vlan-trust b8:09:8a:bd:5d:17 Learn 0 ge-0/0/4.0 vlan-trust bc:30:5b:e0:fa:1b Learn 0 ge-0/0/3.0 vlan-trust bc:5f:f4:3b:6e:8d Learn 0 ge-0/0/3.0 vlan-trust bc:92:6b:0e:44:d9 Learn 0 ge-0/0/4.0 vlan-trust e0:b5:2d:06:93:c6 Learn 0 ge-0/0/4.0 vlan-trust e8:50:8b:05:72:2f Learn 0 ge-0/0/4.0
root@root> show route
inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
192.168.2.0/24 *[Direct/0] 00:34:54
> via vlan.0
192.168.2.254/32 *[Local/0] 00:34:54
Local via vlan.0
inet6.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
--obscured--/128
*[Local/0] 00:34:54
Reject
fe80::56e0:320f:fcea:9480/128
*[Local/0] 00:34:54
Reject
update 06 may - ppp logs
I'm sorry it took me a while to respond, but these are the logs when PPP goes down (at 12:03) and comes back up (at 12:11).
12:03:49 op change ifl pp0.0 idx 71 devindex 128 flags c010 12:03:49 op change ifl pp0.0 idx 71 devindex 128 12:03:49 IFL State TLV: 12:03:49 State - Opened 12:03:49 Auth Chap flags - 00 12:03:49 Auth Pap flags - 0b 12:03:49 Options: 12:03:49 MRU: 1492 12:03:49 Auth proto: PAP 12:03:49 Magic Num: 1430297898 12:03:49 IFL Config TLV: 12:03:49 Media flags - 0000 12:03:49 Auth protocol PAP - 0xc023 12:03:49 PPP flags - 00 12:03:49 MRU - 1492 12:03:49 pppd_iflm_handle_change: ifl->ifl_flags 0xc010 iflm->iflm_flags 0xc010 12:03:49 pp0.0: Session LCP max configuration request count 254 is set(254 default count) 12:03:49 pp0.0: pppd_ncp_close_proto 12:03:49 pp0.0: IPCP - State changed to: Closed 12:03:49 pp0.0: IFF af inet - Building TLV (changed 0xb) 12:03:49 pp0.0: IFF af inet - Building flags (0x80000000), cflags (0x1000804) 12:03:49 pp0.0: IFF af inet - Building NCP, proto 0x8021, len 16 12:03:49 pp0.0: IFF af inet - Building IFA delete 12:03:49 Upd iff pp0.0 af inet iflidx 71 devidx 128: done 12:03:49 pp0.0: pppd_ncp_close_proto 12:03:49 pp0.0: IPV6CP - Stopping protocol timer [local] 12:03:49 pp0.0: IPV6CP - State changed to: Closed 12:03:49 pp0.0: IFF af inet6 - Building TLV (changed 0x3) 12:03:49 pp0.0: IFF af inet6 - Building flags (0x0), cflags (0x804) 12:03:49 pp0.0: IFF af inet6 - Building NCP, proto 0x8057, len 16 12:03:49 Upd iff pp0.0 af inet6 iflidx 71 devidx 128: done 12:03:49 pp0.0: PAP - Stopping pap_proto timer 12:03:49 pp0.0: PAP - Stopping answer wait timer 12:03:49 pp0.0: IFL - Building TLV (changed 0x5) 12:03:49 pp0.0: IFL - Building flags (0xc011), cflags (0x1) 12:03:49 pp0.0: IFL - Building AUTH, len 3 12:03:49 Upd ifl pp0.0 iflidx 71 devidx 128: done 12:03:49 pp0.0: LCP - State changed to: Closed 12:03:49 pp0.0: IFL - Building TLV (changed 0x3) 12:03:49 pp0.0: IFL - Building flags (0xc011), cflags (0x1) 12:03:49 pp0.0: IFL - Building LCP, len 16 12:03:49 Upd ifl pp0.0 iflidx 71 devidx 128: done 12:03:49 pp0.0: Session phase changed Network -> Disabled 12:03:49 op delete ifa .0 af inet iflidx 71 devindex 128 12:03:49 Deleting ifa pp0.0 iflidx 71 af inet 12:03:49 op change ifl pp0.0 idx 71 devindex 128 flags c011 12:03:49 op change ifl pp0.0 idx 71 devindex 128 12:03:49 IFL State TLV: 12:03:49 State - Closed 12:03:49 Auth Chap flags - 00 12:03:49 Auth Pap flags - 0a 12:03:49 Options: 12:03:49 MRU: 1492 12:03:49 Magic Num: 2860994156 12:03:49 IFL Config TLV: 12:03:49 Media flags - 0000 12:03:49 Auth protocol PAP - 0xc023 12:03:49 PPP flags - 00 12:03:49 MRU - 1492 12:03:49 pppd_iflm_handle_change: ifl->ifl_flags 0xc011 iflm->iflm_flags 0xc011 12:03:49 pp0.0: Session LCP max configuration request count 254 is set(254 default count) 12:03:49 op change iff pp0.0 af inet iflidx 71 devindex 128 12:03:49 IFF State TLV: 12:03:49 State - Closed 12:03:49 Options: 12:03:49 Address: local 213.206.222.121, remote 213.207.113.2 12:03:49 op change iff pp0.0 af inet6 iflidx 71 devindex 128 12:03:49 IFF State TLV: 12:03:49 State - Closed 12:03:49 Options: 12:03:49 Local interface ID: 56e0:320f:fcea:9480, remote interface ID: 0200:000f:fc00:0000 12:10:56 op change ifd ge-0/0/0 devidx 134 flags c001 12:10:56 op change ifd ge-0/0/0 devidx 134 (skipped) 12:11:00 op change ifd ge-0/0/0 devidx 134 flags c000 12:11:00 op change ifd ge-0/0/0 devidx 134 (skipped) 12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011 12:11:00 op change ifl pp0.0 idx 71 devindex 128 12:11:00 pppd_iflm_handle_change: ifl->ifl_flags 0xc011 iflm->iflm_flags 0xc011 12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011 12:11:00 op change ifl pp0.0 idx 71 devindex 128 12:11:00 IFL State TLV: 12:11:00 State - Closed 12:11:00 Auth Chap flags - 00 12:11:00 Auth Pap flags - 0a 12:11:00 Options: 12:11:00 MRU: 1492 12:11:00 Magic Num: 2860994156 12:11:00 IFL Config TLV: 12:11:00 Media flags - 0000 12:11:00 Auth protocol PAP - 0xc023 12:11:00 PPP flags - 01 12:11:00 MRU - 1492 12:11:00 pppd_iflm_handle_change: ifl->ifl_flags 0xc011 iflm->iflm_flags 0xc011 12:11:00 pp0.0: Session LCP max configuration request count 254 is set(254 default count) 12:11:00 pp0.0: LCP - Starting protocol timer (3 sec, 0 nsec) 12:11:00 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x21 0xc0 0x13 0x01 12:11:00 pp0.0: LCP - State changed to: Creq-sent 12:11:00 pp0.0: Session phase changed Disabled -> Establish 12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x21 0x01 12:11:00 pp0.0: Sent 22 byte (14 data bytes) PPP packet: 0x21 0xc0 0x1c 0x02 12:11:00 pp0.0: LCP - State changed to: Ack-sent 12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x21 0x02 12:11:00 pp0.0: LCP - Stopping protocol timer 12:11:00 pp0.0: LCP - State changed to: Opened 12:11:00 pp0.0: IFL - Building TLV (changed 0xa) 12:11:00 pp0.0: IFL - Building magic 1430297898, len 8 12:11:00 pp0.0: IFL - Building LCP, len 16 12:11:00 Upd ifl pp0.0 iflidx 71 devidx 128: done 12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011 12:11:00 op change ifl pp0.0 idx 71 devindex 128 12:11:00 IFL State TLV: 12:11:00 State - Opened 12:11:00 Auth Chap flags - 00 12:11:00 Auth Pap flags - 0b 12:11:00 Options: 12:11:00 MRU: 1492 12:11:00 Auth proto: PAP 12:11:00 Magic Num: 1430297898 12:11:00 IFL Config TLV: 12:11:00 Media flags - 0000 12:11:00 Auth protocol PAP - 0xc023 12:11:00 PPP flags - 01 12:11:00 MRU - 1492 12:11:00 pppd_iflm_handle_change: ifl->ifl_flags 0xc011 iflm->iflm_flags 0xc011 12:11:00 pp0.0: Session LCP max configuration request count 254 is set(254 default count) 12:11:00 pp0.0: Sent 32 byte (24 data bytes) PPP packet: 0x23 0xc0 0x14 0x01 12:11:00 pp0.0: PAP - Stopping pap_proto timer 12:11:00 pp0.0: PAP - Starting pap_proto timer 2 sec, 0 nsec 12:11:00 pp0.0: Session phase changed Establish -> Authenticate 12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x23 0x02 12:11:00 pp0.0: PAP - PAP Authentication is succesful , ACK received interface pp0.0 12:11:00 pp0.0: PAP - Stopping pap_proto timer 12:11:00 pp0.0: PAP - Stopping answer wait timer 12:11:00 pp0.0: IFL - Building TLV (changed 0x5) 12:11:00 pp0.0: IFL - Building flags (0xc010), cflags (0x1) 12:11:00 pp0.0: IFL - Building AUTH, len 3 12:11:00 Upd ifl pp0.0 iflidx 71 devidx 128: done 12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:01 op change ifl pp0.0 idx 71 devindex 128 flags c010 12:11:01 op change ifl pp0.0 idx 71 devindex 128 12:11:01 IFL State TLV: 12:11:01 State - Opened 12:11:01 Auth Chap flags - 00 12:11:01 Auth Pap flags - 0b 12:11:01 Options: 12:11:01 MRU: 1492 12:11:01 Auth proto: PAP 12:11:01 Magic Num: 1430297898 12:11:01 IFL Config TLV: 12:11:01 Media flags - 0000 12:11:01 Auth protocol PAP - 0xc023 12:11:01 PPP flags - 01 12:11:01 MRU - 1492 12:11:01 pppd_iflm_handle_change: ifl->ifl_flags 0xc010 iflm->iflm_flags 0xc010 12:11:01 pp0.0: Session LCP max configuration request count 254 is set(254 default count) 12:11:01 pp0.0: IPCP - ADDRESS using local address: 0.0.0.0 12:11:01 pp0.0: IPCP - Config-Request, Built 6 bytes of PRIMARY DNS at 0x3ffed87e 12:11:01 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec) 12:11:01 pp0.0: Sent 26 byte (18 data bytes) PPP packet: 0x21 0x80 0x15 0x01 12:11:01 pp0.0: IPCP - State changed to: Creq-sent 12:11:01 pp0.0: IPV6CP - Using interface ID: 56e0:320f:fcea:9480 12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local] 12:11:01 pp0.0: IPV6CP - Starting protocol timer (3 sec, 0 nsec) [local] 12:11:01 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x57 0x80 0x16 0x01 12:11:01 pp0.0: IPV6CP - State changed to: Creq-sent 12:11:01 pp0.0: Session phase changed Authenticate -> Network 12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x04 12:11:01 pp0.0: pppd_ncp_process_nak_rej 12:11:01 pp0.0: IPCP - Stopping protocol timer 12:11:01 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec) 12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x57 0x02 12:11:01 pp0.0: pppd_ncp_process_conf_ack 12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local] 12:11:01 pp0.0: IPV6CP - Current state Creq-sent 12:11:01 pp0.0: IPV6CP - State changed to: Ack-rcvd 12:11:01 pp0.0: IPV6CP - Starting protocol timer (3 sec, 0 nsec) [local] 12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x01 12:11:01 pp0.0: pppd_ncp_process_conf_req 12:11:01 pp0.0: IPCP - Remote peer requesting address 213.207.113.2 12:11:01 pp0.0: IPCP - Need to negotiate address 12:11:01 pp0.0: IPCP - Current state Creq-sent 12:11:01 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x40 0x02 12:11:01 pp0.0: IPCP - State changed to: Ack-sent 12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x57 0x01 12:11:01 pp0.0: pppd_ncp_process_conf_req 12:11:01 pp0.0: IPV6CP - Current state Ack-rcvd 12:11:01 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x57 0x80 0xe0 0x02 12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local] 12:11:01 pp0.0: IPV6CP - State changed to: Opened 12:11:01 pp0.0: IFF af inet6 - Building TLV (changed 0x3) 12:11:01 pp0.0: IFF af inet6 - Building flags (0x0), cflags (0x800) 12:11:01 pp0.0: IFF af inet6 - Building NCP, proto 0x8057, len 16 12:11:01 Upd iff pp0.0 af inet6 iflidx 71 devidx 128: done 12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:01 op change iff pp0.0 af inet6 iflidx 71 devindex 128 12:11:01 IFF State TLV: 12:11:01 State - Opened 12:11:01 Options: 12:11:01 Local interface ID: 56e0:320f:fcea:9480, remote interface ID: 0200:000f:fc00:0000 12:11:03 pp0.0: IPCP - Timer expired 12:11:03 pp0.0: IPCP - Proto timeout 12:11:03 pp0.0: IPCP - ADDRESS using local address: 0.0.0.0 12:11:03 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec) 12:11:03 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x17 0x01 12:11:03 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x03 12:11:03 pp0.0: pppd_ncp_process_nak_rej 12:11:03 pp0.0: IPCP - Handling Conf-Nak 12:11:03 pp0.0: IPCP - Negotiated address 12:11:03 pp0.0: IPCP - Stopping protocol timer 12:11:03 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec) 12:11:03 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:04 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x01 12:11:04 pp0.0: pppd_ncp_process_conf_req 12:11:04 pp0.0: IPCP - Remote peer requesting address 213.207.113.2 12:11:04 pp0.0: IPCP - Need to negotiate address 12:11:04 pp0.0: IPCP - Current state Ack-sent 12:11:04 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x41 0x02 12:11:04 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:06 pp0.0: IPCP - Timer expired 12:11:06 pp0.0: IPCP - Proto timeout 12:11:06 pp0.0: IPCP - ADDRESS using local address: 213.206.222.121 12:11:06 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec) 12:11:06 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x18 0x01 12:11:06 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x02 12:11:06 pp0.0: pppd_ncp_process_conf_ack 12:11:06 pp0.0: IPCP - Stopping protocol timer 12:11:06 pp0.0: IPCP - Current state Ack-sent 12:11:06 pp0.0: IPCP - State changed to: Opened 12:11:06 pp0.0: IFF af inet - Building TLV (changed 0x7) 12:11:06 pp0.0: IFF af inet - Building flags (0x80000000), cflags (0x1000800) 12:11:06 pp0.0: IFF af inet - Building NCP, proto 0x8021, len 16 12:11:06 pp0.0: IFF af inet - Building IFA add 12:11:06 Upd iff pp0.0 af inet iflidx 71 devidx 128: done 12:11:06 pppd_msg_input: recvmsg: Resource temporarily unavailable 12:11:06 op change iff pp0.0 af inet iflidx 71 devindex 128 12:11:06 IFF State TLV: 12:11:06 State - Opened 12:11:06 Options: 12:11:06 Address: local 213.206.222.121, remote 213.207.113.2 12:11:06 op add ifa pp0.0 af inet iflidx 71 devindex 128 12:11:06 pp0: Local IP address set to 213.206.222.121/32 12:11:06 pp0: Remote IP address set to 213.207.113.2/32 12:11:06 Added ifa pp0.0 iflidx 71 af inet (primary address)
show int pp0.0 detailand look under the heading Flow error statistics (Packets dropped due to) You should check the messages log for any obvious errors if you haven'tshow log messages. I would also look at the output ofshow security screen statistics zone untrust.