We have an MPLS/VPLS network. This particular segment is a V7 RC2 2004, to a 1016 V6.49.8 box. That in turn bridges in to a 1016 Access concentrator over vlans which is another 1016 with V6 on it.
We have a very strange issue where this new segment won’t load cpe radio web pages. We can ping those cpe’s at full 1492 pings. We have tried to double check all links in between and make sure our MTU’s are correct, etc.. OTHER segments that route and terminate to this AC over vpls work just fine. (except none of them use V7)
Now, when we enable packet sniffer on the access concentrator to see what is going on. The web pages load fine. When we disable it, the pages won’t load any more.. This AC “box” does nothing but route and do PPPoE server. No nat, no firewall rules, not even any mangles or raw.. Nothing but pppoe.
What in the world would cause those packets to flow differently, or properly once packet sniffer is turned on?
Enabling packet sniffer disables fasttrack/fastpath. So you need to check with your config why any of these two break your data streams (and fasttrack is prime suspect).
I actually thought it was mention in docs, but I don’t see it directly mentioned. But fasttrack has long bypassed the sniffer.
One subtle feature is the using a firewall mangle rule to sniff traffic. So depending on what you’re trying to sniff, you can create a rule with “sniff-tzsp” action to stream to a remote Wireshark. This is useful if your looking at specific protocol like SIP etc.
That’s just it. There are zero firewall, nat, mangle, rules on this router at all. All it does is PPPoE, and route packets. With that said, there are automatically generated queues that come with pppoe. I have a script that deletes them all every 5 minutes since we use an external QOE box. And don’t want to use MT’s queuing.
What I find perplexing, is out of the 7 vpls tunnels that come in to the router before it. Only the one that is running v7, has clients that we couldn’t get in to. Turn on sniffer on this Access concentrator router, and it works fine.. Turned off fast track on this router, it now works fine.. So, it seems like it’s this router causing the issue. If it is indeed fast track causing that, how??
Indeed your config doesn’t contain anything that fasttrack might be affecting.
Fastpath is another thing. I see you’re setting slightly larger-than-standard MTU on VLAN interfaces … what are MTU and L2MTU settings on underlying physical interface (sfpplus1)? Make sure they are both large enough to carry 1500byte+PPPoE+VLAN packets including overhead. While vlan interface settings should do the trick (for L3 MTU at least), fastpath might be cutting a corner too many here.
1500 for MTU, 1600 or higher for L2MTU across the whole path. We use 1560 on our MPLS interface settings to accommodate any tagging we do internal to VPLS tunnels.
The only one I can’t seem to set any higher is the bridge group on the far side for the VPLS. It maxes out at 1500 and 1504..