Arie,
encapsulating/decapsulating L2TP packets should not happen in IP Input
process, this is done in the interrupt path
Anthony: Something is preventing your interfaces from
interrupt-switching the traffic. Another possibility is packet
re-assembly (which would be shown in "show ip traffic", as Paul just
suggested). Do a "clear counter" and then check "show int stat" which
interface(s) send the majority of pkts in the process path. Are still
users connected which received a framed-compression attribute before you
made the change?
oli
________________________________
From: cisco-bba-bounces@puck.nether.net
[mailto:cisco-bba-bounces@puck.nether.net] On Behalf Of Arie Vayner
Sent: Thursday, January 25, 2007 8:38 AM
To: Anthony Law; cisco-bba@puck.nether.net
Subject: Re: [cisco-bba] need help on troubleshooting high cpu
on 7206NPE300 LNS
On 1/25/07, Arie Vayner <ariev@vayner.net> wrote:
Anthony,
The high CPU on IP Input is normal, as this is where the
L2TP work is being done.
Also note that you have a high rate of CPU being used in
Interrupts (91%/44% means that 44% is used for Interrupts). Interrupts
on Cisco routers are usually linked directly to a high rate of traffic
(on centralized CPU devices).
I would assume you box is very close to its limit of how
much traffic it can handle. Could you please send some of the "show
interface" outputs (for the FastEthernet/GigE/ATM ports you might have).
This would allow us to get a better estimation.
You need to take into account that this is a centralized
CPU platform, and all traffic is handled by the CPU. This means that the
scale factor is not only a question of how many sessions you have
concurrently, but also how much traffic (mostly in PPS and not BPS) they
transmit.
Thanks
Arie
On 1/25/07, Anthony Law < antnada@hotmail.com
<mailto:antnada@hotmail.com> > wrote:
Dear all
Thank you for all of your input. I configured
vpdn ip udp ignore checksum
& I have corrected a mis-config on our radius
server (passing compression attribute to cisco) now that the L2TP data
daemon is running normal, but I am still facing high cpu on Pool Manager
& IP Input
anymore suggestions?
CPU utilization for five seconds: 91%/44%; one
minute: 91%; five minutes: 86%
PID Runtime(ms) Invoked uSecs 5Sec
1Min 5Min TTY Process
1 4 175 22 0.00%
0.00% 0.00% 0 Chunk Manager
2 487964 5014024 97 0.00%
0.00% 0.00% 0 Load Meter
3 1606476 870141 1846 0.00%
0.00% 0.00% 0 CEF Scanner
4 22428792 3318958 6757 0.00%
0.06% 0.05% 0 Check heaps
5 481842360 102963163 4679 9.05%
9.70% 7.90% 0 Pool Manager
37 11275060121049358292 1074 36.02%
35.07% 32.40% 0 IP Input
Thank You
Anthony
________________________________
> Date: Wed, 24 Jan 2007 02:37:10 +0200
> From: nitzan.tzelniker@gmail.com
> To: antnada@hotmail.com
> Subject: Re: [cisco-bba] need help on
troubleshooting high cpu on 7206 NPE300 LNS
> CC: cisco-bba@puck.nether.net
>
> You can try
>
> vpdn ip udp ignore checksum
>
> Nitzan
>
> On 1/24/07, Anthony Law < antnada@hotmail.com
<mailto:antnada@hotmail.com> > wrote:
> > Dear all,
> >
> > We have a 7206 w/NPE300 running as a LNS
terminating pppoe sessions from our
> > telco. We are concurrently running around
360 pppoe sessions.
> >
> > Recently. I noticed that our 7206 is having
extremely high cpu, at times
> > going to 100%, please see below
> >
> > CPU utilization for five seconds: 99%/42%;
one minute: 99%; five minutes:
> > 99%
> > PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min
TTY Process
> > 1 0 75 0 0.00% 0.00% 0.00% 0 Chunk Manager
> >
> >
> > 5 472509060 101324023 4663 7.65% 8.80% 8.84%
0 Pool Manager
> >
> > 37 10810547881019294234 1060 22.79% 25.16%
25.51% 0 IP Input
> >
> >
> > 101 705044020 800103660 881 18.89% 21.35%
19.34% 0 L2TP data
> > daemon
> > 102 53153196 10197928 5212 2.19% 0.46% 0.45%
0 L2TP mgmt
> > daemon
> >
> >
> > It seemed that Pool Manager + IP Input +
L2TP data daemon together is
> > causing this issue. I was searching for
documents regarding this on google
> > and came to this mailing list. I am
wondering if you guys can help me out by
> > identifying the mis-configuration that I
have on my end as it is my
> > understanding that a 7206 should at least
take close 1000 pppoe sessions.
> > Thank You in advance for your input.
> >
> >
> > hostname LNS
> > !
> > boot system slot1:c7200-is-mz.122-32.bin
> > boot system slot1:c7200-is-mz.120-3.T3
> > aaa new-model
> > aaa authentication login default local
> > aaa authentication login no_rad line
> > aaa authentication ppp default group radius
local
> > aaa authentication ppp vpdn group radius
> > aaa authorization network default group
radius
> > aaa authorization configuration default
group radius
> > aaa accounting delay-start
> > aaa accounting exec default start-stop group
radius
> > aaa accounting network default start-stop
group radius
> > enable secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXX
> > !
> > clock timezone EST -5
> > clock summer-time EDT recurring
> > ip subnet-zero
> > no ip source-route
> > ip cef
> > !
> > !
> > ip name-server XXXXXX
> > ip name-server XXXXXX
> > ip name-server XXXXXX
> > !
> > vpdn enable
> > !
> > vpdn-group XXXXXXXX
> > accept-dialin
> > protocol l2tp
> > virtual-template 1
> > terminate-from hostname XXXXXX
> > local name XXXXXXX
> > lcp renegotiation always
> > !
> > interface FastEthernet0/0
> > ip address X.X.X.X 255.255.255.192
> > no ip mroute-cache
> > duplex full
> > !
> > interface FastEthernet1/0
> > no ip address
> > no ip mroute-cache
> > duplex full
> > !
> > interface FastEthernet1/0.401
> > description !!XXXXXXXXXXXXXXXXXXXXXXXX!!
> > encapsulation dot1Q 401
> > ip address 10.70.X.X 255.255.255.252
> > no ip mroute-cache
> > !
> > interface FastEthernet2/0
> > description !!Internet Feed!!
> > ip address Y.Y.Y.Y 255.255.255.252
> > no ip mroute-cache
> > duplex full
> > !
> > interface Virtual-Template1
> > mtu 1492
> > ip unnumbered FastEthernet2/0
> > peer default ip address pool internet1
internet2
> > ppp authentication pap vpdn
> > !
> > ip local pool internet1 A.A.A.A B.B.B.B
> > ip local pool internet2 C.C.C.C D.D.D.D
> > ip classless
> > ip route 0.0.0.0 0.0.0.0 Y.Y.Y.Y
> > no ip http server
> > !
> > ip radius source-interface FastEthernet0/0
> > radius-server host X.X.X.X auth-port 1645
acct-port 1646
> > radius-server host X.X.X.X auth-port 1645
acct-port 1646
> > radius-server key 7 ZZZZZZZZZZZZZZZ
> >
> > Anthony
> >
> > ________________________________
> > Be one of the first to try Windows Live
Mail.
> >
_______________________________________________
> > cisco-bba mailing list
> > cisco-bba@puck.nether.net
> >
https://puck.nether.net/mailman/listinfo/cisco-bba
> >
> >
> >
________________________________
Be one of the first to try Windows Live Mail.
<http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0
e-4911fb2b2e6d>
_______________________________________________
cisco-bba mailing list
cisco-bba@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-bba
encapsulating/decapsulating L2TP packets should not happen in IP Input
process, this is done in the interrupt path
Anthony: Something is preventing your interfaces from
interrupt-switching the traffic. Another possibility is packet
re-assembly (which would be shown in "show ip traffic", as Paul just
suggested). Do a "clear counter" and then check "show int stat" which
interface(s) send the majority of pkts in the process path. Are still
users connected which received a framed-compression attribute before you
made the change?
oli
________________________________
From: cisco-bba-bounces@puck.nether.net
[mailto:cisco-bba-bounces@puck.nether.net] On Behalf Of Arie Vayner
Sent: Thursday, January 25, 2007 8:38 AM
To: Anthony Law; cisco-bba@puck.nether.net
Subject: Re: [cisco-bba] need help on troubleshooting high cpu
on 7206NPE300 LNS
On 1/25/07, Arie Vayner <ariev@vayner.net> wrote:
Anthony,
The high CPU on IP Input is normal, as this is where the
L2TP work is being done.
Also note that you have a high rate of CPU being used in
Interrupts (91%/44% means that 44% is used for Interrupts). Interrupts
on Cisco routers are usually linked directly to a high rate of traffic
(on centralized CPU devices).
I would assume you box is very close to its limit of how
much traffic it can handle. Could you please send some of the "show
interface" outputs (for the FastEthernet/GigE/ATM ports you might have).
This would allow us to get a better estimation.
You need to take into account that this is a centralized
CPU platform, and all traffic is handled by the CPU. This means that the
scale factor is not only a question of how many sessions you have
concurrently, but also how much traffic (mostly in PPS and not BPS) they
transmit.
Thanks
Arie
On 1/25/07, Anthony Law < antnada@hotmail.com
<mailto:antnada@hotmail.com> > wrote:
Dear all
Thank you for all of your input. I configured
vpdn ip udp ignore checksum
& I have corrected a mis-config on our radius
server (passing compression attribute to cisco) now that the L2TP data
daemon is running normal, but I am still facing high cpu on Pool Manager
& IP Input
anymore suggestions?
CPU utilization for five seconds: 91%/44%; one
minute: 91%; five minutes: 86%
PID Runtime(ms) Invoked uSecs 5Sec
1Min 5Min TTY Process
1 4 175 22 0.00%
0.00% 0.00% 0 Chunk Manager
2 487964 5014024 97 0.00%
0.00% 0.00% 0 Load Meter
3 1606476 870141 1846 0.00%
0.00% 0.00% 0 CEF Scanner
4 22428792 3318958 6757 0.00%
0.06% 0.05% 0 Check heaps
5 481842360 102963163 4679 9.05%
9.70% 7.90% 0 Pool Manager
37 11275060121049358292 1074 36.02%
35.07% 32.40% 0 IP Input
Thank You
Anthony
________________________________
> Date: Wed, 24 Jan 2007 02:37:10 +0200
> From: nitzan.tzelniker@gmail.com
> To: antnada@hotmail.com
> Subject: Re: [cisco-bba] need help on
troubleshooting high cpu on 7206 NPE300 LNS
> CC: cisco-bba@puck.nether.net
>
> You can try
>
> vpdn ip udp ignore checksum
>
> Nitzan
>
> On 1/24/07, Anthony Law < antnada@hotmail.com
<mailto:antnada@hotmail.com> > wrote:
> > Dear all,
> >
> > We have a 7206 w/NPE300 running as a LNS
terminating pppoe sessions from our
> > telco. We are concurrently running around
360 pppoe sessions.
> >
> > Recently. I noticed that our 7206 is having
extremely high cpu, at times
> > going to 100%, please see below
> >
> > CPU utilization for five seconds: 99%/42%;
one minute: 99%; five minutes:
> > 99%
> > PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min
TTY Process
> > 1 0 75 0 0.00% 0.00% 0.00% 0 Chunk Manager
> >
> >
> > 5 472509060 101324023 4663 7.65% 8.80% 8.84%
0 Pool Manager
> >
> > 37 10810547881019294234 1060 22.79% 25.16%
25.51% 0 IP Input
> >
> >
> > 101 705044020 800103660 881 18.89% 21.35%
19.34% 0 L2TP data
> > daemon
> > 102 53153196 10197928 5212 2.19% 0.46% 0.45%
0 L2TP mgmt
> > daemon
> >
> >
> > It seemed that Pool Manager + IP Input +
L2TP data daemon together is
> > causing this issue. I was searching for
documents regarding this on google
> > and came to this mailing list. I am
wondering if you guys can help me out by
> > identifying the mis-configuration that I
have on my end as it is my
> > understanding that a 7206 should at least
take close 1000 pppoe sessions.
> > Thank You in advance for your input.
> >
> >
> > hostname LNS
> > !
> > boot system slot1:c7200-is-mz.122-32.bin
> > boot system slot1:c7200-is-mz.120-3.T3
> > aaa new-model
> > aaa authentication login default local
> > aaa authentication login no_rad line
> > aaa authentication ppp default group radius
local
> > aaa authentication ppp vpdn group radius
> > aaa authorization network default group
radius
> > aaa authorization configuration default
group radius
> > aaa accounting delay-start
> > aaa accounting exec default start-stop group
radius
> > aaa accounting network default start-stop
group radius
> > enable secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXX
> > !
> > clock timezone EST -5
> > clock summer-time EDT recurring
> > ip subnet-zero
> > no ip source-route
> > ip cef
> > !
> > !
> > ip name-server XXXXXX
> > ip name-server XXXXXX
> > ip name-server XXXXXX
> > !
> > vpdn enable
> > !
> > vpdn-group XXXXXXXX
> > accept-dialin
> > protocol l2tp
> > virtual-template 1
> > terminate-from hostname XXXXXX
> > local name XXXXXXX
> > lcp renegotiation always
> > !
> > interface FastEthernet0/0
> > ip address X.X.X.X 255.255.255.192
> > no ip mroute-cache
> > duplex full
> > !
> > interface FastEthernet1/0
> > no ip address
> > no ip mroute-cache
> > duplex full
> > !
> > interface FastEthernet1/0.401
> > description !!XXXXXXXXXXXXXXXXXXXXXXXX!!
> > encapsulation dot1Q 401
> > ip address 10.70.X.X 255.255.255.252
> > no ip mroute-cache
> > !
> > interface FastEthernet2/0
> > description !!Internet Feed!!
> > ip address Y.Y.Y.Y 255.255.255.252
> > no ip mroute-cache
> > duplex full
> > !
> > interface Virtual-Template1
> > mtu 1492
> > ip unnumbered FastEthernet2/0
> > peer default ip address pool internet1
internet2
> > ppp authentication pap vpdn
> > !
> > ip local pool internet1 A.A.A.A B.B.B.B
> > ip local pool internet2 C.C.C.C D.D.D.D
> > ip classless
> > ip route 0.0.0.0 0.0.0.0 Y.Y.Y.Y
> > no ip http server
> > !
> > ip radius source-interface FastEthernet0/0
> > radius-server host X.X.X.X auth-port 1645
acct-port 1646
> > radius-server host X.X.X.X auth-port 1645
acct-port 1646
> > radius-server key 7 ZZZZZZZZZZZZZZZ
> >
> > Anthony
> >
> > ________________________________
> > Be one of the first to try Windows Live
Mail.
> >
_______________________________________________
> > cisco-bba mailing list
> > cisco-bba@puck.nether.net
> >
https://puck.nether.net/mailman/listinfo/cisco-bba
> >
> >
> >
________________________________
Be one of the first to try Windows Live Mail.
<http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0
e-4911fb2b2e6d>
_______________________________________________
cisco-bba mailing list
cisco-bba@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-bba