1

I'm completely stuck for solution to this issue. My ISP logs show my Cisco 860 router disconnecting and reconnecting every 30 minutes and 18 seconds all day - it's noticable when browsing as the site has an error then reloads.

I can also see in the logs the interface (GigabitEthernet2) being brought down them up (not sure if this is related). I'm not sure what setting this could possibly be? My static IP address is using a DHCP lease from the ISP - not sure if this is expiring and renewing or maybe this is an MTU issue? Or a duplex negotiation issue? Or simply a known bug with IOS - before I take out a support contract.

Version: 15.6(3)M0a

Below is my configuration for the port in question:

interface GigabitEthernet2
  description PrimaryWANDesc_iiNet NBN
  ip address dhcp
  ip nat outside
  ip virtual-reassembly in
  zone-member security WAN
  duplex auto
  speed auto
  no cdp enable

I'm not sure what other settings/logs you might need so please let me know what else I should be providing.

UPDATE: Have connected the 860 back after 3 days of no reconnections on an old Draytek and can confirm that at exactly 30 minutes (after the initial connection) the Cisco reconnected. The ISP logs show the following:

Connected using IPoE
Authenticated with Line Auth

However the logs do not show the any interfaces being brought down/up in this period. Is there a timer issue with IPoE or a bug?

UPDATE: I've provided a santised config. There are no log entries that I can find showing any disconnection. It appears the router needs to re-authenticate the IPoE connection every 30 minutes. This causes a drop in the connection briefly while this is happening.

Building configuration...

Current configuration : 16718 bytes
!
! Last configuration change at 06:54:13 UTC Tue May 14 2019 by iinet
!
version 15.6
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec localtime show-timezone
no service password-encryption
!
hostname nbn
!
boot-start-marker
boot system flash c860vaew-advsecurityk9-mz.SPA.156-3.M0a.bin
boot system flash 
boot-end-marker
!
aqm-register-fnf
!
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login local_access local
aaa authentication login vpn_xauth_ml_1 local
aaa authentication login sslvpn local
aaa authorization network vpn_group_ml_1 local 
!
!
!
!
!
aaa session-id common
wan mode ethernet
no ip source-route
!
!
!
!
!
!
ip inspect max-incomplete high 2000
ip inspect max-incomplete low 1600
ip inspect name Internet-out icmp router-traffic
ip inspect name Internet-out tcp router-traffic
ip inspect name Internet-out udp router-traffic
no ip bootp server
ip domain retry 0
ip domain timeout 1
ip domain name scnet.com.au
ip cef
no ipv6 cef
!
!
flow record nbar-appmon
 match ipv4 source address
 match ipv4 destination address
 match application name
 collect interface output
 collect counter bytes
 collect counter packets
 collect timestamp absolute first
 collect timestamp absolute last
!
!
flow monitor application-mon
 cache timeout active 60
 record nbar-appmon
!
parameter-map type inspect global
 max-incomplete low 1600
 max-incomplete high 2000
 nbar-classify
parameter-map type inspect ddos
 tcp synwait-time 15
!
!
!
!
!
!
!
!
!
crypto pki trustpoint TP-self-signed-3447020667
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3447020667
 revocation-check none
 rsakeypair TP-self-signed-3447020667
!
!
crypto pki certificate chain TP-self-signed-3447020667
 certificate self-signed 01

!
object-group service INTERNAL_UTM_SERVICE 
!
object-group network Others_dst_net 
 any
!
object-group network Others_src_net 
 any
!
object-group service Others_svc 
 ip
!
object-group network Web_dst_net 
 any
!
object-group network Web_src_net 
 any
!
object-group service Web_svc 
 ip
!
object-group network allowping_dst_net 
 any
!
crypto key pubkey-chain rsa
 named-key realm-cisco.pub signature

!
controller VDSL 0
 shutdown
no cdp run
!
!
class-map type inspect match-any INTERNAL_DOMAIN_FILTER
 match protocol msnmsgr
 match protocol ymsgr
class-map type inspect match-any Others_app
 match protocol https
 match protocol smtp
 match protocol pop3
 match protocol imap
 match protocol sip
 match protocol ftp
 match protocol dns
 match protocol icmp
class-map type inspect match-any allowping_app
 match protocol icmp
!
policy-map type inspect LAN-WAN-POLICY
 class type inspect lan-allow-all
  inspect 
!
zone security LAN
zone security WAN
zone security VPN
zone security DMZ
zone-pair security WAN-DMZ source WAN destination DMZ
 service-policy type inspect WAN-DMZ-POLICY
zone-pair security LAN-WAN source LAN destination WAN
 service-policy type inspect LAN-WAN-POLICY
zone-pair security WAN-LAN source WAN destination LAN
 service-policy type inspect WAN-LAN-POLICY
! 
!
!
!
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
!
!
!
crypto ipsec transform-set encrypt-method-1 esp-3des esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile VPN-Profile-1
 set transform-set encrypt-method-1 
!
!
!
!
!
!
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
!
interface Ethernet0
 no ip address
 ip nbar protocol-discovery
 ip flow monitor application-mon input
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 zone-member security LAN
 load-interval 30
 shutdown
!
interface FastEthernet0
 switchport access vlan 2
 no ip address
 zone-member security LAN
!
interface FastEthernet1
 switchport access vlan 2
 no ip address
 zone-member security LAN
!
interface FastEthernet2
 no ip address
 zone-member security LAN
!
interface GigabitEthernet0
 switchport access vlan 2
 no ip address
 zone-member security LAN
!
interface GigabitEthernet1
 switchport access vlan 2
 no ip address
 zone-member security LAN
!
interface GigabitEthernet2
 description PrimaryWANDesc_iiNet NBN
 ip address dhcp
 ip nat outside
 ip virtual-reassembly in
 zone-member security WAN
 duplex auto
 speed auto
 no cdp enable
!
interface Virtual-Template2 type tunnel
 ip unnumbered Vlan2
 zone-member security VPN
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile VPN-Profile-1
!
interface Wlan-GigabitEthernet0
 description Internal switch interface connecting to the embedded AP
 switchport mode trunk
 no ip address
 zone-member security LAN
!
interface Vlan1
 ip address 10.10.10.1 255.255.255.0
 ip nbar protocol-discovery
 ip flow monitor application-mon input
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 zone-member security LAN
 load-interval 30
!
interface Vlan2
 ip address 192.168.0.222 255.255.255.0
 ip nbar protocol-discovery
 ip flow monitor application-mon input
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 zone-member security LAN
 load-interval 30
!
ip local pool VPN-Pool 192.168.2.100 192.168.2.105
ip forward-protocol nd
ip http server
ip http upload enable path flash:
ip http upload overwrite
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip flow-top-talkers
 top 16
 sort-by bytes
!
ip dns view default
 domain timeout 1
 domain retry 0
no ip nat service sip tcp port 5060
no ip nat service sip udp port 5060
ip nat inside source list nat-list interface GigabitEthernet2 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet2
!
ip access-list extended ISAKMP_IPSEC
 permit udp any any eq isakmp
 permit ahp any any
 permit esp any any
 permit udp any any eq non500-isakmp
ip access-list extended Internet
.................
 deny   ip any any log
!
!
!
!
line con 0
 login authentication local_access
 no modem enable
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
 stopbits 1
line vty 0 4
 access-class 23 in
 exec-timeout 0 0
 privilege level 15
 login authentication local_access
 transport input telnet ssh
!
scheduler allocate 60000 1000
!
end

ISP LOGS

20 Jul 2019 08:53AM 20 Jul 2019 09:24AM 30 minutes, 18 seconds  Normal Termination  
20 Jul 2019 08:23AM 20 Jul 2019 08:53AM 30 minutes, 18 seconds  Normal Termination  
20 Jul 2019 07:53AM 20 Jul 2019 08:23AM 30 minutes, 19 seconds  Normal Termination  
20 Jul 2019 07:22AM 20 Jul 2019 07:53AM 30 minutes, 18 seconds  Normal Termination  
20 Jul 2019 06:52AM 20 Jul 2019 07:22AM 30 minutes, 18 seconds  Normal Termination  
................. this continues all day and night

UPDATE: I have found what is happening the interface is being restarted?? Why??

*Jul 20 03:24:32.491 UTC: %DHCP-5-RESTART: Interface GigabitEthernet2 is being restarted by DHCP

*Jul 20 03:24:34.491 UTC: %LINK-5-CHANGED: Interface GigabitEthernet2, changed state to administratively down
*Jul 20 03:24:35.491 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2, changed state to down
*Jul 20 03:24:37.527 UTC: %LINK-3-UPDOWN: Interface GigabitEthernet2, changed state to down
*Jul 20 03:24:40.487 UTC: %LINK-3-UPDOWN: Interface GigabitEthernet2, changed state to up
*Jul 20 03:24:41.487 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2, changed state to up
12
  • 2
    The handover is Ethernet? You see the port being brought down and up (shutdown) = caused by the router? Or is the link lost and renegotiated = caused by something external? Could you copy the log excerpt?
    – Zac67
    Jul 18, 2019 at 4:46
  • I'm running a Draytek in its place ATM and can confirm no dropouts/reconnects in the last 2 days. So I now know this is something specific to the Cisco 860 or its settings. After business hours I will cut back over and get the logs. I have a loopback internal on the WAN port (giving it a DHCP address to simulate the real WAN ISP connection) running for a couple of hours and haven't noticed any interface stop starts yet. Jul 18, 2019 at 6:44
  • Please give us the full (sanitized) router configurations and any logs or debugs that could help.
    – Ron Maupin
    Jul 19, 2019 at 14:56
  • You router should have some log entries. You can also, adjust the logging level. Did you try the show logging command, and press <space> until you get to the end? You can refer to documents, such as _System Message Logging. Also, ip route 0.0.0.0 0.0.0.0 GigabitEthernet2 is a poor choice, and ip route 0.0.0.0 0.0.0.0 dhcp is a much better idea.
    – Ron Maupin
    Jul 20, 2019 at 2:01
  • For security, you should disable HTTP access: no http server, and enable password encryption.
    – Ron Maupin
    Jul 20, 2019 at 2:08

1 Answer 1

2

As pointed out, this is an ISP issue trying to renew the lease every 30 minutes and the Cisco not being able to respond as the UDP packet is getting lost in the reply - therefore the connection drops and re-establishes. Any open sessions get dropped. There is no way an ISP is going to change their system so I'm posting a workaround which I can confirm has been working without any issue for a few weeks.

ip nat inside source static udp <LANIP> 68 interface <WAN INTERFACE> 68

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.