OK guys... heres your weekly EVPL problem thread

First thing that comes to mind os some sort of timeout. NAT maybe? How are the sites connected?

networker050184 wrote: »

First thing that comes to mind os some sort of timeout. NAT maybe? How are the sites connected?

its just a point to point evpl with the 2 Adtrans in the middle. once traffic destined for the internet hits the adtran its bounced back out and over to an ASA 5510. I was told this is ok. We also have no errors on any interface, router, switch or firewall. the strange part is that the users at the main site are experiencing it also. i can post running configs if it would help.

phoeneous wrote: »

Do you manage the Adtrans?

yes. any info you guys need i will do my best to provide. it seems the remote site is still having "random slowdown" for everyone that is accessing a term server at the main site. i honestly have done a ton of research and cant figure out why this has ended up working so poorly.

Monkerz

Can you give us a rough diagram of the setup and the configs of both adtrans? What was in their place before the adtrans?

Monkerz wrote: »

Can you give us a rough diagram of the setup and the configs of both adtrans? What was in their place before the adtrans?

I will do my best! Configs will be seperate in the next post. prior to this, there were watchguard firewalls in place doing everything. they expired and we had to set up a few vpn's so we went with ASA's.

Remote Site

Core Switch---ASA (to internet and seperate Adtran) and EVPL Adtran (to Main Site) Both connected

Main Site

Core Switch --ASA to internet and Adtran (other side of EVPL)
this site has all the term servers etc.

ASA Running config:

ASA Version 8.2(4)1
!
hostname asa5510
domain-name tcxxx.com
enable password AtZdPYziKTyHRqbO encrypted
passwd AtZdPYziKTyHRqbO encrypted
no names
name 172.22.1.0 Hyannis_LAN
name 10.10.10.0 Link_to_WG
name 172.22.0.0 TCxxx_Internal_Nets
!
interface Ethernet0/0
description Comcast Internet
nameif outside
security-level 0
ip address 75.xxx.xxx.73 255.255.255.248
!
interface Ethernet0/1
description TCxxx Lan
speed 100
duplex full
nameif tcxxx
security-level 50
ip address 172.22.1.234 255.255.255.0
!
interface Ethernet0/2
shutdown
nameif dmz
security-level 10
ip address 192.168.10.1 255.255.255.0
!
interface Ethernet0/3
shutdown
nameif unused
security-level 0
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
boot system disk0:/asa824-1-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns domain-lookup dmz
dns server-group DefaultDNS
name-server 172.22.1.7
name-server 172.22.1.92
domain-name xxxxx.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list outside_access_in extended permit icmp any any echo-reply
access-list lan_nat0_outbound remark No NAT to MDxxxxx via VPN
access-list lan_nat0_outbound extended permit ip 172.22.1.0 255.255.255.0 host 192.168.100.16
access-list lan_nat0_outbound remark No NAT for VPN Clients
access-list lan_nat0_outbound extended permit ip 172.22.0.0 255.255.0.0 192.168.200.0 255.255.255.0
access-list lan_nat0_outbound remark No NAT to Sandwich via VPN
access-list lan_nat0_outbound extended permit ip 172.22.1.0 255.255.255.0 172.22.4.0 255.255.255.0
access-list lan_nat0_outbound remark No NAT to Ixxx Hosting
access-list lan_nat0_outbound extended permit ip 172.22.1.0 255.255.255.0 172.18.1.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 172.22.0.0 255.255.0.0 host 192.168.100.16
access-list lan_access_out extended permit ip any any
access-list mdaxxxxx_vpn_filter extended permit ip host 192.168.100.16 host 172.22.1.80
access-list VPNClient_splitTunnelAcl standard permit 10.10.10.0 255.255.255.252
access-list VPNClient_splitTunnelAcl standard permit 10.50.70.0 255.255.255.252
access-list VPNClient_splitTunnelAcl standard permit 172.22.0.0 255.255.0.0
access-list VPNClient_splitTunnelAcl standard permit host 172.22.1.80
access-list outside_cryptomap extended permit ip 172.22.1.0 255.255.255.0 172.22.4.0 255.255.255.0
access-list outside_cryptomap_1 extended permit ip 172.22.1.0 255.255.255.0 172.18.1.0 255.255.255.0
pager lines 500
logging enable
logging monitor debugging
logging buffered debugging
logging asdm informational
mtu outside 1500
mtu tcsma 1500
mtu dmz 1500
mtu unused 1500
mtu management 1500
ip local pool RemotePool 192.168.200.1-192.168.200.50 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any tcxxx
icmp permit any dmz
icmp permit any management
asdm image disk0:/asdm-635.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (tcxxx) 0 access-list lan_nat0_outbound
nat (tcxxx) 1 172.22.1.0 255.255.255.0
nat (dmz) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
access-group lan_access_out in interface tcsma
route outside 0.0.0.0 0.0.0.0 75.xxx.xxx.78 1
route tcxxx 172.22.2.0 255.255.255.0 172.22.1.240 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable 8081
http 192.168.10.0 255.255.255.0 dmz
http 0.0.0.0 0.0.0.0 tcxxx
http 71.xxx.xx.232 255.255.255.255 outside
http 173.x.xx.213 255.255.255.255 outside
http 173.xx.xxx.125 255.255.255.255 outside
http redirect outside 80
snmp-server host outside 71.xxx.xx.232 poll community *****
snmp-server location Telco Room
snmp-server contact TDean at XXXXXXXsts
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group5
crypto map outside_map 1 set peer 64.xxx.xxx.180
crypto map outside_map 1 set transform-set ESP-AES-128-SHA
crypto map outside_map 2 match address outside_cryptomap
crypto map outside_map 2 set pfs group5
crypto map outside_map 2 set peer 173.xx.xxx.125
crypto map outside_map 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 3 match address outside_cryptomap_1
crypto map outside_map 3 set pfs group5
crypto map outside_map 3 set peer 207.xxx.xx.31
crypto map outside_map 3 set transform-set ESP-AES-128-SHA
crypto map outside_map 3 set security-association lifetime seconds 86400
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
enrollment terminal
fqdn vpn.tcxxx.com
subject-name CN=vpn.tcxxx.com,OU=IT,O=The xxxxxxx xxxxxxxx,C=US,St=MA,L=Hyannis
keypair vpnsslcert.key
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment terminal
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 07f75c9a1b2d75
30820559 30820441 a0030201 02020707 f75c9a1b 2d75300d 06092a86 4886f70d
01010505 003081ca 310b3009 06035504 06130255 53311030 0e060355 04081307
dd ad976c33 REMOVED
546e672f 60ebfbf3 3c07552d 4a0eb144 b68887bc 32c4437a 30ec40bc 45
quit
crypto ca certificate chain ASDM_TrustPoint1
certificate ca 0301
fc bf144c0e cc6ec4df REMOVED
3db71271 f4e8f151 40222849 e01d4b87 a834cc06 a2dd125a d1863664 03356f6f
776eebf2 8550985e ab0353ad 9123631f 169ccdb9 b205633a e1f4681b 17053595 53ee
quit
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 5
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 5
lifetime 86400
telnet timeout 5
ssh 71.xxx.xx.232 255.255.255.255 outside
ssh 173.xx.xxx.125 255.255.255.255 outside
ssh timeout 60
ssh version 2
console timeout 0
dhcpd dns 4.2.2.1 4.2.2.2
!
dhcpd address 192.168.10.5-192.168.10.20 dmz
dhcpd dns 4.2.2.1 4.2.2.2 interface dmz
dhcpd update dns both override interface dmz
dhcpd enable dmz
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
webvpn
url-list value RemoteAccess
svc ask none default webvpn
group-policy vpn_to_sandwich internal
group-policy vpn_to_sandwich attributes
vpn-filter none
vpn-tunnel-protocol IPSec
group-policy VPNClient internal
group-policy VPNClient attributes
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPNClient_splitTunnelAcl
group-policy vpn_to_ihs internal
group-policy vpn_to_ihs attributes
vpn-filter none
vpn-tunnel-protocol IPSec

***SSL Users Removed***

webvpn
url-list value RemoteAccess
tunnel-group 64.xxxxxx180 type ipsec-l2l
tunnel-group 64.xxxxx.180 general-attributes
default-group-policy mdxxxxxct-vpn
tunnel-group 64.xxxxxxx.180 ipsec-attributes
pre-shared-key *****
tunnel-group VPNClient type remote-access
tunnel-group VPNClient general-attributes
address-pool RemotePool
default-group-policy VPNClient
tunnel-group VPNClient ipsec-attributes
pre-shared-key *****
tunnel-group 173.xxxxxx125 type ipsec-l2l
tunnel-group 173.xxxxx.125 general-attributes
default-group-policy vpn_to_sandwich
tunnel-group 173.xxxxx125 ipsec-attributes
pre-shared-key *****
tunnel-group 207.xxxxx.31 type ipsec-l2l
tunnel-group 207.xxxxx.31 general-attributes
default-group-policy vpn_to_ihs
tunnel-group 207.xxxxx.31 ipsec-attributes
pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/...es/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:9ccf61f1a248d3858a93efa68354ddb4

Adtran running config "Main" site :

User Access Login
Password:
Hyannis>en
Password:
Hyannis#show run
Building configuration...
!
!
! ADTRAN, Inc. OS version 18.01.01.00
! Boot ROM version 17.06.01.00
! Platform: NetVanta 3430, part number 1202820G1
! Serial number LBADTN1130AF995
!
!
hostname "Hyannis"
enable password Axxxxx
!
clock timezone -1-Cape-Verde
!
ip subnet-zero
ip classless
ip routing
ipv6 unicast-routing
!
!
ip domain-proxy
!
!
no auto-config
!
event-history on
no logging forwarding
logging forwarding priority-level info
no logging email
!
no service password-encryption
!
username "xxxxx" password "pxxx"
!
!
no ip firewall alg msn
no ip firewall alg mszone
no ip firewall alg h323
!
!
!
!
!
!
!
!
!
no dot11ap access-point-control
!
!
!
!
!
!
!
!
!
!
!
no ethernet cfm
!
interface eth 0/1
speed 100
encapsulation 802.1q
no shutdown
!
interface eth 0/1.37xx
vlan-id 37xx
ip address 1.1.1.1 255.255.255.0
no shutdown
!
interface eth 0/2
speed 100
ip address 172.22.1.240 255.255.255.0
no shutdown
!
!
!
!
!
!
!
!
!
!
!
!
!
!
ip route 0.0.0.0 0.0.0.0 172.22.1.234
ip route 128.1.0.0 255.255.0.0 172.22.1.3
ip route 172.17.150.0 255.255.255.0 172.22.1.3
ip route 172.22.2.0 255.255.255.0 1.1.1.2
ip route 172.23.10.0 255.255.255.0 172.22.1.3
!
no tftp server
no tftp server overwrite
no ip http server
no ip http secure-server
no ip snmp agent
no ip ftp server
ip ftp server default-filesystem flash
no ip scp server
no ip sntp server
!
!
!
!
!
!
!
!
ip sip udp 5060
ip sip tcp 5060
!
!
!
!
!
!
!
!
!
!
!
!
!
!
line con 0
login
password Axxxxxx
!
line telnet 0 4
login
password pxxxxx
no shutdown
line ssh 0 4
login local-userlist
no shutdown
!
!
!
!
!
end
Hyannis#

Adtran running config "Remote" site:

User Access Login
Password:
Falmouth>en
Password:
Falmouth#sh run
Building configuration...
!
!
! ADTRAN, Inc. OS version 18.01.01.00
! Boot ROM version 17.06.01.00
! Platform: NetVanta 3430, part number 1202820G1
! Serial number LBADTN1129AM816
!
!
hostname "Falmouth"
enable password Axxxxx
!
clock timezone -1-Cape-Verde
!
ip subnet-zero
ip classless
ip routing
ipv6 unicast-routing
!
!
!
!
no auto-config
!
event-history on
no logging forwarding
no logging email
!
no service password-encryption
!
!
no ip firewall alg msn
no ip firewall alg mszone
no ip firewall alg h323
!
!
!
!
!
!
!
!
!
no dot11ap access-point-control
!
!
!
!
ip dhcp-server excluded-address 172.22.2.1 172.22.2.100
!
ip dhcp-server pool "lan"
network 172.22.2.0 255.255.255.0
dns-server 172.22.1.7
netbios-name-server 172.22.1.15
default-router 172.22.2.1
!
!
!
!
!
!
!
no ethernet cfm
!
interface eth 0/1
speed 100
encapsulation 802.1q
no shutdown
!
interface eth 0/1.3711
vlan-id 3711
ip address 1.1.1.2 255.255.255.0
no shutdown
!
interface eth 0/2
ip address 172.22.2.1 255.255.255.0
no shutdown
!
!
!
!
!
!
!
!
!
!
!
!
!
!
ip route 0.0.0.0 0.0.0.0 172.22.2.234
ip route 128.1.0.0 255.255.0.0 1.1.1.1
ip route 172.17.150.0 255.255.255.0 1.1.1.1
ip route 172.22.1.0 255.255.255.0 1.1.1.1
ip route 172.23.10.0 255.255.255.0 1.1.1.1
!
no tftp server
no tftp server overwrite
no ip http server
no ip http secure-server
no ip snmp agent
no ip ftp server
ip ftp server default-filesystem flash
no ip scp server
no ip sntp server
!
!
!
!
!
!
!
!
ip sip udp 5060
ip sip tcp 5060
!
!
!
!
!
!
!
!
!
!
!
!
!
!
line con 0
no login
!
line telnet 0 4
login
password Axxxx
no shutdown
line ssh 0 4
login local-userlist
no shutdown
!
!
!
!
!
end
Falmouth#

Lizano

Do the thin clients actually loose conectivity to the other site? Or is it only the applications that die?

I once had someone reporting a similar issue with RDP over a VPN. I ended up leaving a ping running with FREEping from a PC at the site to the RDP server, which proved to me that the RDP server never was unreachable, it ended up going away after changing the session timeout limit on a firewall.

Monkerz

I guess we can start by troubleshooting the main site. Are the users and term servers on the same LAN? If not, what is between the users and term servers at the main site?

Lizano wrote: »

Do the thin clients actually loose conectivity to the other site? Or is it only the applications that die?

I once had someone reporting a similar issue with RDP over a VPN. I ended up leaving a ping running with FREEping from a PC at the site to the RDP server, which proved to me that the RDP server never was unreachable, it ended up going away after changing the session timeout limit on a firewall.

Both, actually. Sometimes they get booted right out of their rdp connection (thats the protocol error) and other times the performance is so bad the app just hangs for 2-3 minutes and everyone has the "hourglass."

Monkerz wrote: »

I guess we can start by troubleshooting the main site. Are the users and term servers on the same LAN? If not, what is between the users and term servers at the main site?

main site, users and servers all on the same subnet.

tdean wrote: »

main site, users and servers all on the same subnet.

So the traffic that doesn't traverse the routers and ASAs have the same issue? Sounds like a problem with the server or local LAN to me. Have you looked into the server/application?

networker050184 wrote: »

So the traffic that doesn't traverse the routers and ASAs have the same issue? Sounds like a problem with the server or local LAN to me. Have you looked into the server/application?

it is intermittant with the main site... the performance is very good. the main site gets the protocol error. the remote site gets that and also poor performance. Sorry i didnt clarify.

***EDIT: the protocol error happens when a user launches a telnet based app (Meditech) that is routed through the Adtrans to the Hospital we are affiliated with,.

also, this didnt happen prior to the "upgrade" where we removed the watchguard firewalls and replaced them with the "faster" circuit and the combo of Adtrans and ASA firewalls, which is why i am not focusing on the server/app end of things.

tdean wrote: »

it is intermittant with the main site... the performance is very good. the main site gets the protocol error. the remote site gets that and also poor performance. Sorry i didnt clarify.

also, this didnt happen prior to the "upgrade" where we removed the watchguard firewalls and replaced them with the "faster" circuit and the combo of Adtrans and ASA firewalls, which is why i am not focusing on the server/app end of things.

Yeah, but the traffic that doesn't traverse these new devices is having trouble also. How would that have anything to do with the new equipment unless there is something I'm missing here? The poor performance could be do to the same issue thats causing the protocol error at the main site.

What kind of traffic is this application using? Have the users at the remote site noticed any issues with other connectivity or just this application?

networker050184 wrote: »

Yeah, but the traffic that doesn't traverse these new devices is having trouble also. How would that have anything to do with the new equipment unless there is something I'm missing here? The poor performance could be do to the same issue thats causing the protocol error at the main site.

What kind of traffic is this application using? Have the users at the remote site noticed any issues with other connectivity or just this application?

Sorry, i updated my previous post....

***EDIT: the protocol error happens when a user launches a telnet based app (Meditech) that is routed through the Adtrans to the Hospital we are affiliated with,.... that is the 128.x.x.x route in the Main site router config.

So, the main site performance is good but protocol error when launching this telnet based app.

Remote site, also getting protocol error but ALSO poor performance in general across the P2P link to the extent that sometimes all the thin client desktops will just have an hourglass for 2-3 minutes.

If I were you, and we have talked about this before, if you have the WGs handy I would perform an experiment. You won't normally hear people on these boards recommend WG over Cisco/Adtran but in this case we need to test something. I have clients on an EVPL and we use WGs to sort the traffic out. My experience is that it is easier to configure the WGs in these funny situations where you have to both firewall the WAN AND terminate a layer 2 connection from another site. The WG sees that layer 2 connection as just another ethernet port, you can set the port you plug the EVPL into as a "trusted" port and the WG will route the EVPL and WAN traffic appropriately if you set up both fireboxes correctly. That way you don't have 2 routers (one for the EVPL and one for the WAN).

Dollars to donuts the protocol errors and performance issues you are having is related to how the ad trans and Ciscos are configured. You have 2 more routers (2 at each site, should be one at each site) than you actually need to get the job done.

Adtran looks pretty basic so I doubt your problem is there. I see you have speed and duplex set a few places. Have you verified there are no mismatches causing errors?

Since you said these are new circuits also I'd have the carrier check them out for errors.

Monkerz

Yeah that was going to be my next question, are there any duplex mismatches on any routers, switches or servers?

there were errors at the beginning b/c some things were set to "auto". everything has been reset and there are 0 errors on the routers, core switches or firewall ports.

it_consultant, i have been thinking about going straight into the ASA's since the ports are available. Do you think that would be the best idea? I mean, at least its up and running right now... before, i had to replace the e-lan with the EVPL with no downtime.

From the remote router:

User Access Login
Password:
Falmouth>en
Password:
Falmouth#show int
Displaying interfaces...
eth 0/1 is UP, line protocol is UP
Hardware address is 00:A0:C8:7E:3E:F0
Running 802.1Q Encapsulation
100Mb/s, full-duplex
Last clearing of counters never
5 minute input rate 1361856 bits/sec, 263 packets/sec
5 minute output rate 908672 bits/sec, 224 packets/sec
Queueing method: fifo
Output queue: 0/256/0 (size/max total/drops)
Interface Shaper: NOT ENABLED
343705880 packets input, 718623725 bytes
343703993 unicasts, 1887 broadcasts, 0 multicasts input
0 unknown protocol, 0 symbol errors, 0 discards
0 input errors, 0 runts, 0 giants
0 no buffer, 0 overruns, 0 internal receive errors
0 alignment errors, 0 crc errors
229380293 packets output, 2409898157 bytes
0 unicasts, 0 broadcasts, 0 multicasts output
0 output errors, 0 deferred, 0 discards
0 single, 0 multiple, 0 late collisions
0 excessive collisions, 0 underruns
0 internal transmit errors, 0 carrier sense errors
0 resets, 0 throttles
eth 0/1.3711 is UP, line protocol is UP
Vlan Id is 3711
Ip address is 1.1.1.2, netmask is 255.255.255.0
MTU is 1500 bytes
ARP type: ARPA; ARP timeout is 20 minutes
eth 0/2 is UP, line protocol is UP
Hardware address is 00:A0:C8:7E:3E:F1
Ip address is 172.22.2.1, netmask is 255.255.255.0
MTU is 1500 bytes, BW is 100000 Kbit
100Mb/s, negotiated full-duplex, configured full-duplex
ARP type: ARPA; ARP timeout is 20 minutes
Last clearing of counters never
5 minute input rate 915080 bits/sec, 229 packets/sec
5 minute output rate 1365280 bits/sec, 267 packets/sec
Queueing method: fifo
Output queue: 0/256/0 (size/max total/drops)
Interface Shaper: NOT ENABLED
242439264 packets input, 2113455187 bytes
241973981 unicasts, 393652 broadcasts, 71631 multicasts input
0 unknown protocol, 0 symbol errors, 0 discards
0 input errors, 0 runts, 0 giants
0 no buffer, 0 overruns, 0 internal receive errors
0 alignment errors, 0 crc errors
356394083 packets output, 4026541336 bytes
0 unicasts, 0 broadcasts, 0 multicasts output
0 output errors, 0 deferred, 0 discards
0 single, 0 multiple, 0 late collisions
0 excessive collisions, 0 underruns
0 internal transmit errors, 0 carrier sense errors
0 resets, 0 throttles
Falmouth#

Main router:

User Access Login
Password:
Hyannis>en
Password:
Hyannis#show int
Displaying interfaces...
eth 0/1 is UP, line protocol is UP
Hardware address is 00:A0:C8:7E:9D:1C
Running 802.1Q Encapsulation
100Mb/s, full-duplex
Last clearing of counters never
5 minute input rate 722416 bits/sec, 195 packets/sec
5 minute output rate 1178728 bits/sec, 235 packets/sec
Queueing method: fifo
Output queue: 0/256/0 (size/max total/drops)
Interface Shaper: NOT ENABLED
143812252 packets input, 4068588207 bytes
143811171 unicasts, 1081 broadcasts, 0 multicasts input
0 unknown protocol, 0 symbol errors, 0 discards
0 input errors, 0 runts, 0 giants
0 no buffer, 0 overruns, 0 internal receive errors
0 alignment errors, 0 crc errors
228268260 packets output, 3198391055 bytes
0 unicasts, 0 broadcasts, 0 multicasts output
0 output errors, 0 deferred, 0 discards
0 single, 0 multiple, 0 late collisions
0 excessive collisions, 0 underruns
0 internal transmit errors, 0 carrier sense errors
0 resets, 0 throttles
eth 0/1.3711 is UP, line protocol is UP
Vlan Id is 3711
Ip address is 1.1.1.1, netmask is 255.255.255.0
MTU is 1500 bytes
ARP type: ARPA; ARP timeout is 20 minutes
eth 0/2 is UP, line protocol is UP
Hardware address is 00:A0:C8:7E:9D:1D
Ip address is 172.22.1.240, netmask is 255.255.255.0
MTU is 1500 bytes, BW is 100000 Kbit
100Mb/s, full-duplex
ARP type: ARPA; ARP timeout is 20 minutes
Last clearing of counters never
5 minute input rate 10982400 bits/sec, 1119 packets/sec
5 minute output rate 10520720 bits/sec, 1076 packets/sec
Queueing method: fifo
Output queue: 0/256/0 (size/max total/drops)
Interface Shaper: NOT ENABLED
920876315 packets input, 5981752 bytes
917139583 unicasts, 3694455 broadcasts, 42277 multicasts input
0 unknown protocol, 0 symbol errors, 0 discards
72173 input errors, 0 runts, 0 giants
0 no buffer, 0 overruns, 0 internal receive errors
0 alignment errors, 72173 crc errors <

this is from before i changed the duplex. no errors since
832781461 packets output, 312246507 bytes
0 unicasts, 0 broadcasts, 0 multicasts output
0 output errors, 0 deferred, 0 discards
0 single, 0 multiple, 0 late collisions
0 excessive collisions, 0 underruns
0 internal transmit errors, 0 carrier sense errors
0 resets, 0 throttles
Hyannis#

tdean wrote: »

there were errors at the beginning b/c some things were set to "auto". everything has been reset and there are 0 errors on the routers, core switches or firewall ports.

it_consultant, i have been thinking about going straight into the ASA's since the ports are available. Do you think that would be the best idea? I mean, at least its up and running right now... before, i had to replace the e-lan with the EVPL with no downtime.

I have a similar set up at a couple of my clients. For each I only have one router for the WAN and the EVPL. The WAN port is configured as an "untrusted" port, the port the EVPL is plugged into is set as a "trusted" port (essentially just another network hanging off the firewall) a simple route to the other side of the EVPL and a couple of "allow allow" statements for inbound and outbound traffic over the EVPL and you are off to the races.

it_consultant wrote: »

I have a similar set up at a couple of my clients. For each I only have one router for the WAN and the EVPL. The WAN port is configured as an "untrusted" port, the port the EVPL is plugged into is set as a "trusted" port (essentially just another network hanging off the firewall) a simple route to the other side of the EVPL and a couple of "allow allow" statements for inbound and outbound traffic over the EVPL and you are off to the races.

Hi it,

i remember you trying to walk me through that before but im just having a tough time visualizing it. heres what mine is on both ends... both the AdTrans and ASA's are physically connected to the core switch... the AdTran is the default gateway and there are routes on there to send internet traffic out the ASA. I wonder if the routers Verizon recommended are appropriate... heres what they are.

NetVanta 3430 (2nd Gen)

If im understanding you, i will have to change the default gateway to the ASA at one location and config the vlan on it?

this is driving me crazy, all i think about when i sleep is resolving this. i ordered a couple Wireshark books, maybe that will help.

I work with a consulting network engineer who works with a lot of EVPL providers in the Denver Area, she is in love with the adtran routers and the adtran router/switch combo devices.

In your configuration I would find the ad tran to be unnecessary. I would take a cable from the CPE provided by verizon and plug it into an unused port on the ASA. Configure that to be a trusted port by giving it a private address scheme and get rid of the deny statements and put in allow statements. Do the same at your other location. Create a little network between the two ASA ports which are plugged into the CPE at each location and create routes to the networks on either side of the verizon network. Remember that the EVPL is essentially like physically dragging an ethernet cable from building to building. So, if you remember your CCNA lab, this should be like configuring your Ciscos as if they are plugged right into each other.

Where is your verizon EVPL plugged into now, the core switches or the Ad tran?

it_consultant wrote: »

I work with a consulting network engineer who works with a lot of EVPL providers in the Denver Area, she is in love with the adtran routers and the adtran router/switch combo devices.

In your configuration I would find the ad tran to be unnecessary. I would take a cable from the CPE provided by verizon and plug it into an unused port on the ASA. Configure that to be a trusted port by giving it a private address scheme and get rid of the deny statements and put in allow statements. Do the same at your other location. Create a little network between the two ASA ports which are plugged into the CPE at each location and create routes to the networks on either side of the verizon network. Remember that the EVPL is essentially like physically dragging an ethernet cable from building to building. So, if you remember your CCNA lab, this should be like configuring your Ciscos as if they are plugged right into each other.

Where is your verizon EVPL plugged into now, the core switches or the Ad tran?

yeah, i see what you're saying... originally i couldnt do it like that b/c all the ports were taken up on the ASA. i was also told i need to add the vlan, although thats not a huge deal. now there are 2 ports open, so maybe i can at least start. the EVPL is currently the default gateway and plugged directly into the switch at both locations.

It isn't a good idea to have the evpl plugged directly into your switches unless you intend on having a layer 2 connection across your two offices. I asked because I thought for a second you might have done that, this can cause all sorts of issues since the devices on both ends will pollute each other with their ARP traffic. This can be an OK arrangement provided you are on the same layer 3 LAN and you don't mind your ARPs going across the EVPL. I have seen this configuration, it works if your remote offices have only a few PCs.

it_consultant wrote: »

It isn't a good idea to have the evpl plugged directly into your switches unless you intend on having a layer 2 connection across your two offices. I asked because I thought for a second you might have done that, this can cause all sorts of issues since the devices on both ends will pollute each other with their ARP traffic. This can be an OK arrangement provided you are on the same layer 3 LAN and you don't mind your ARPs going across the EVPL. I have seen this configuration, it works if your remote offices have only a few PCs.

ok... been a while since my CCNA studies... when you say "a layer 2 connection across the 2 offices" isnt that what the vlan is for? also, does the arp traffic traverse the vlan if they are on different subnets? i guess it would since there are routes to direct the traffic....

we are having a lot of trouble with our thin clients and term servers since this upgrade... protocol errors that i am researching. the causes seem to be apps using the same port as the TS and default gateway problems.

i dont have much experience with the ASA's yet and i dont want to pile a bunch of work on our FW guy b/c he is just helping out for now... are you suggesting i plug the Adtrans into the ASA's or eliminate the adtrans altogether and config vlans on the ASA? or FW guy said "lets let the adtrans do what routers do, and let the ASA's do what firewalls do...."

im torn.

tdean wrote: »

ok... been a while since my CCNA studies... when you say "a layer 2 connection across the 2 offices" isnt that what the vlan is for? also, does the arp traffic traverse the vlan if they are on different subnets? i guess it would since there are routes to direct the traffic....

we are having a lot of trouble with our thin clients and term servers since this upgrade... protocol errors that i am researching. the causes seem to be apps using the same port as the TS and default gateway problems.

i dont have much experience with the ASA's yet and i dont want to pile a bunch of work on our FW guy b/c he is just helping out for now... are you suggesting i plug the Adtrans into the ASA's or eliminate the adtrans altogether and config vlans on the ASA? or FW guy said "lets let the adtrans do what routers do, and let the ASA's do what firewalls do...."

im torn.

A firewall and a router are basically the same thing. You can easily configure a firewall to operate exactly like a basic router. Take the ad trans out all together, they add complexity and don't add needed capability. Networking is game of keeping stuff as simple as possible to get the job done. The ASA is a fully functional router as well as a 'firewall'.

When I say a layer 2 connection, I am talking about a data-link connection. The EVPL is providing you a virtual ethernet connection. It isn't real ethernet, the CPE translates the transport technology (Fiber, COE, etc) and emulates ethernet signaling so to your equipment it will look like the EVPL is just another ethernet device. Which is quite cool. If you have your ethernet switches plugged into the EVPL, the broadcast packets they send will go over that link. I think the protocol errors are happening because on the network layer (layer 3) the computers have a route to resources, but on the data link they also have a route and the two do not follow the same paths. Remember that even though your machines are on different subnets, since you have EVPL running they are on the same BROADCAST domain, which means ARPs will be flying around. Segregate the two subnets on layer 1 (physical) by plugging the EVPL into your firewall as opposed to your switches and you will eliminate this from happening.

I have never seen the answer for EVPL problems be "put the VLAN into your port configuration" because the VLANs you use and the VLANs the provider use operate on a different layer. That is the magic of EVPL. The provider has thousands of VLAN tags floating on their network, imagine you hook up your network to EVPL and you are using the same tags as your provider, chaos. In order to prevent this Verizon is able to segregate your VLAN tags to just your EVPL connection.

well, the vlans are on a subinterface... doesnt that matter? its strange b/c the Adtran guy set these up and this was the set up recommended by our Verizon guy... although thats not saying much. i am going to config a port on each ASA for testing. i should be able to use the same 1.1.1.1 and 1.1.1.2 on the other, the way the routers are set up, right? then i'd have to add all the static routes like for the internet and our other apps... oh damn... i'd have to change the ip of the ASA to do this b/c the Adtrans are the default gateway.....