1

I've encountered an abnormal behavior of my GRE Tunnel between two routers Cisco. When I ping the remote physical IP of the tunnel, I reach it without any loss. But when I ping the remote Tunnel IP, I have 50% loss. Have anyone already meet this issue and can you help solving it ?

Topology:

R1 Tunnel0 <-> R2 <-> R3 Tunnel1

  • Tunnel0 configuration
interface Tunnel0
 ip address 192.168.1.1 255.255.255.252
 ip mtu 1500
 ip tcp adjust-mss 1400
 qos pre-classify
 tunnel source 192.168.10.2
 tunnel destination 192.168.144.1
  • Tunnel1 configuration
interface Tunnel1
 ip address 192.168.1.2 255.255.255.252
 ip mtu 1500
 ip tcp adjust-mss 1400
 qos pre-classify
 tunnel source 192.168.144.1
 tunnel destination 192.168.10.2
  • Physical remote IP ping : 0% lost OK
R3#ping 192.168.10.2 sou 192.168.144.1 repeat 50

Type escape sequence to abort.
Sending 50, 100-byte ICMP Echos to 192.168.10.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (50/50), round-trip min/avg/max = 76/104/184 ms
  • Tunnel remote IP ping : 50% lost NOK
R3#ping 192.168.1.1 repeat 20   

Type escape sequence to abort.
Sending 20, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
.!..!!.!.!..!!.!.!.!
Success rate is 50 percent (10/20), round-trip min/avg/max = 64/87/116 ms
R3#

I have taken a dump and analyzed it with wireshark and the abnormal thing that i see is : Secure Sockets Layer (Ignored Unknown Record).

1
  • 2
    can you provide any information about the underlaying network? I Wonder why you configure "ip mtu 1500" but are MSS clamping TCP to 1400 Bytes. Commented Feb 4, 2019 at 17:33

1 Answer 1

3

There is not a lot to go on in your output there, but try removing qos pre-classify from the tunnel interface - it may be that you have misconfigured qos settings causing traffic to be dropped.

1
  • After checking, it's really a misconfiguration of qos settings, thank you Commented Feb 6, 2019 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.