RE: [fw-wiz] IPSEC over load-shared T1s (per packet)

From: Ben Nagy (ben_at_iagu.net)
Date: 09/18/03

  • Next message: TSimons_at_Delphi-Tech.com: "RE: [fw-wiz] IPSEC over load-shared T1s (per packet)" 
    To: <TSimons@Delphi-Tech.com>, <firewall-wizards@honor.icsalabs.com>
Date: Thu, 18 Sep 2003 22:40:34 +0200

    ObBOFH: One of the T1 RJ connectors must be dirty, which is causing packet
    corruption. Give both the telco jacks a good clean (licking them works well)
    and see if that fixes the problem. [1]

    Seriously, I do have a theory ;)

    Does this routing guarantee to preserve sequencing?

    If it's really as you described (packets send one for one via alternate
    links) then you have some potential problems brewing, I think.

    TCP will "work things out" when packets arrive out of sequence, but with
    IPSec it's left up to the implementation. One security concern with most
    crypto things is replay protection. IPSec addresses this by using a
    mandatory sequence number in the ESP header. The receiveing IPSec doesn't
    _have_ to take any notice, but most do. If your receiving IPSec has enabled
    replay protection then if one link is going faster half the packets are
    going to get dropped (sequence number < current).

    This would make your tunneled protocol (say TCP) do the retransission thing,
    so it would work itself out eventually, but the speed would indeed suffer
    horribly.

    See if you can convince your router to preserve "IP flows" and use the two
    links in a more sensible manner. That might help.

    Best of luck,

    ben

    PS: Let us know when you work it out? This is an interesting one.

    [1] The RJ's are live, for non-network-engineer types. Not enough to kill
    you, but it hurts. :)

    > -----Original Message-----
    > From: firewall-wizards-admin@honor.icsalabs.com
    > [mailto:firewall-wizards-admin@honor.icsalabs.com] On Behalf
    > Of TSimons@Delphi-Tech.com
    > Sent: Thursday, September 18, 2003 3:38 AM
    > To: firewall-wizards@honor.icsalabs.com
    >
    > Hello All
    >
    > Recently we doubled our internet bandwith to two T1s from the
    > same provider
    > that terminate on in the same router on the NOC side.
    >
    > We setup IP LOAD-SHARING PER-PACKET on each of the serial
    > links on both
    > sides (NOC and Us) in order to get an aggregate 3.0mbit.
    > PER-PACKET routing
    > alternates usage of the T1s, one for one...
    >
    > Since then, VPN performance has taken a dive. Sniffing out
    > traffic, ESP
    > packets are sent 3-4 times before they can be properly decrypted.
    >
    > Someone along the way said that using PER-PACKET routing
    > changes the CRC
    > value of the packets. Is this correct, has anyone else seen
    > this issue? I
    > can't see how the CRC is changed, the hop count isn't
    > changing, the lines
    > are identical, and they terminate in the same router, so the
    > last hop is the
    > F0/0 interface of the router before getting to the firewall.
    >
    > Thanks,
    > ~Todd
    >
    > __________________________________
    > Todd M. Simons
    > Senior MIS Engineer
    > Dell Tier 1 PA Technician
    > Delphi Technology, Inc.
    > New Brunswick, NJ

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: TSimons_at_Delphi-Tech.com: "RE: [fw-wiz] IPSEC over load-shared T1s (per packet)"

    Relevant Pages

    • RE: Cisco IOS vulnerability
      ... You are vulnerable unless you have deny statement which blocks all ... packets other than say ICMP or IPSEC coming to the router interface ... Even though the packets targeted *at* the routers interface is only ...
      (Incidents)
    • Re: Router stops routing after changing MAC Address
      ... I have a Linux router and I need the ability to swap hardware without ... How to change MAC addresses is documented well enough - and it works - ... ip link set eth0 down ... the right side and back with echo request and reply packets. ...
      (Linux-Kernel)
    • Low Reliability on Ethernet interface 2610
      ... After rebooting both router & connected Switch the ... from lan pc drop around 2% of the packets while invistigating the ... I tried to change both the ethernet ... 8192K bytes of processor board System flash (Read/Write) ...
      (comp.dcom.sys.cisco)
    • Re: Problems with 7206vxr-npe400
      ... indication that you just can move that many packets through it. ... happening is that you are exceeding the capacity of the router, ... pondered enabling cflow for traffic analysis but I am a little ... hesitant due to already mentioned load. ...
      (comp.dcom.sys.cisco)
    • RE: NIDS/NIPS implications on HSRP
      ... Another event that may trigger HSRP to send out packets outside of your ... primary and secondary router is another router coming online. ... HSRP/VRRP/whatever packets should be the determing ... FREE Network Security Webinar - How to implement IPSec security into VPN ...
      (Focus-IDS)