Networking-Blog

Tags: Cisco QOS, Ipsec QOS, QOS, Vpn QOS

by admin

Cisco IPSEC Pre-fragmentation VPN’s

Feature Overview

When a packet is nearly the size of the maximum transmission unit (MTU) of the outbound link of the
encrypting router, and it is encapsulated with IPSec headers, it is likely to exceed the MTU of the
outbound link.
This causes packet fragmentation after encryption, which makes the decrypting router reassemble
in the process path. Pre-fragmentation for IPSec VPNs increases the decrypting router’s performance
by enabling it to operate in the high performance CEF path instead of the process path.

Pre-fragmentation for IPSec VPNs enables an encrypting router to pre-determine the encapsulated
packet size from information available in transform sets, which are configured as part of the
IPSec security association (SA). If it is pre-determined that the packet will exceed the MTU of the
output interface, the packet is fragmented before encryption.

This avoids process level reassembly before decryption and helps improve decryption performance and
overall IPSec traffic throughput.

Benefits

Increased Performance
Delivers encryption throughput at maximum encryption hardware accelerator speeds.
This performance increase is for near MTU sized packets.

Uniform Fragmentation
Packets are fragmented into equally sized units to prevent further downstream fragmentation.

Restrictions

Take the following information into consideration before this feature is configured:

Pre-fragmentation for IPSec VPNs is on by default.
Pre-fragmentation for IPSec VPNs operates in IPSec Tunnel mode and IPSec tunnel mode with GRE,
but not with IPSec transport mode.
Pre-fragmentation for IPSec VPNs configured on the decrypting router in a unidirectional traffic scenario
does not improve the performance or change the behavior of either of the peers.
Pre-fragmentation for IPSec VPNs occurs before the transform is applied if compression is turned
on for outgoing packets.
Pre-fragmentation for IPSec VPNs functionality depends on the egress interface crypto ipsec df-bit
configuration and the incoming packet “do not fragment” (DF) bit state. See Table .

You may want use the clear setting for the DF bit when encapsulating tunnel mode IPSec traffic
so you can send packets larger than the available MTU size or if you do not know what the available
MTU size is.

clear	Specifies that the outer IP header will have the DF bit cleared and that the router may fragment the packet to add the IPSec encapsulation.
set	Specifies that the outer IP header will have the DF bit set; however, the router may fragment the packet if the original packet had the DF bit cleared.
copy	Specifies that the router will look in the original packet for the outer DF bit setting.

**Table 1 Pre-fragmentation For Ipsec VPNs Dependencies**

Enabled	crypto ipsec df-bit clear	0	Fragmentation occurs before encryption.
Enabled	crypto ipsec df-bit clear	1	Fragmentation occurs before encryption.
Disabled	crypto ipsec df-bit clear	0	Fragmentation occurs after encryption and packets are reassembled before decryption.
Disabled	crypto ipsec df-bit clear	1	Fragmentation occurs after encryption and packets are reassembled before decryption.
Enabled	crypto ipsec df-bit set	0	Fragmentation occurs before encryption.
Enabled	crypto ipsec df-bit set	1	Packets are dropped.
Disabled	crypto ipsec df-bit set	0	Fragmentation occurs after encryption and packets are reassembled before decryption.
Disabled	crypto ipsec df-bit set	1	Packets are dropped.
Enabled	crypto ipsec df-bit copy	0	Fragmentation occurs before encryption.
Enabled	crypto ipsec df-bit copy	1	Packets are dropped.
Disabled	crypto ipsec df-bit copy	0	Fragmentation occurs after encryption and packets are reassembled before decryption.
Disabled	crypto ipsec df-bit copy	1	Packets are dropped.

July 27, 2010 1:22 pm

Tags: cisco ipsec, df-bit, fragmentation, ipsec

by admin

Cisco Inspect Statement

service tcp-keepalives-in
service tcp-keepalives-out
ip inspect max-incomplete high 900
ip inspect max-incomplete low 800
ip inspect one-minute high 900
ip inspect one-minute low 800
ip inspect udp idle-time 10
ip inspect dns-timeout 10
ip inspect tcp idle-time 900
!
ip inspect name myfw cuseeme timeout 900
ip inspect name myfw ftp timeout 900
ip inspect name myfw rcmd timeout 900
ip inspect name myfw realaudio timeout 900
ip inspect name myfw smtp timeout 900
ip inspect name myfw tftp timeout 900
ip inspect name myfw udp timeout 10
ip inspect name myfw tcp timeout 900
ip inspect name myfw h323 timeout 900
ip inspect name myfw pptp timeout 900
ip tcp ecn
ip tcp selective-ack
ip tcp timestamp
ip tcp synwait-time 30
ip tcp path-mtu-discovery
!
int vlan 1
ip inspect myfw in

service tcp-keepalives-in :
service tcp-keepalives-out :

You can use the service tcp-keepalives-in and the service tcp-keepalives-out commands to monitor TCP connections to and from the router. They can terminate connections if the router or switch doesn’t receive a response from the remote device.

service timestamps :

You can use the service timestamps command to create timestamps on the router’s log files

service timestamps log datetime localtime msec show-timezone year service timestamps debugging datetime localtime msec show-timezone year

ip tcp ecn :

The TCP Explicit Congestion Notification (ECN) feature provides a method for an intermediate router to notify the end hosts of impending network congestion. It also provides enhanced support for TCP sessions associated with applications that are sensitive to delay or packet loss including Telnet, web browsing, and transfer of audio and video data. The benefit of this feature is the reduction of delay and packet loss in data transmissions.

ip tcp timestamp :

The timestamp option lets the sender place a timestamp value in every segment. The receiver reflects this value in the acknowledgment, allowing the sender to calculate an RTT for each received ACK.
TCP time stamp improves round-trip time estimates

ip tcp selective-ack :

TCP might not experience optimal performance if multiple packets are lost from one window of data. With the limited information available from cumulative acknowledgments, a TCP sender can learn about only one lost packet per round-trip time. An aggressive sender could resend packets early, but such re-sent segments might have already been received.

The TCP selective acknowledgment mechanism helps overcome these limitations. The receiving TCP returns selective acknowledgment packets to the sender, informing the sender about data that has been received. The sender can then resend only the missing data segments.

TCP selective acknowledgment improves overall performance. The feature is used only when a multiple number of packets drop from a TCP window. There is no performance impact when the feature is enabled but not used.

This command becomes effective only on new TCP connections opened after the feature is enabled.

ip tcp synwait-time :

Set a period of time the Cisco IOS software waits while attempting to establish a TCP connection before it times out

July 27, 2010 12:07 pm

Tags: cisco inspect, inspect, inspect statement

by admin

Cisco TCP MTU

ip mtu 1472
ip tcp-adjust mss 1372
crypto ipsec df-bit clear

July 23, 2010 5:22 pm

Tags: cisco mtu, mtu, tcp mtu

by admin

Cisco TCP Tuning

ip tcp ecn
ip tcp chunk-size 65535
ip tcp window-size 750000
ip tcp queuemax 500
ip tcp synwait-time 20
ip tcp selective-ack
ip tcp timestamp
ip tcp path-mtu-discovery

ip tcp ecn

The TCP Explicit Congestion Notification (ECN) feature provides a method for an intermediate router to notify the end hosts of impending network congestion. It also provides enhanced support for TCP sessions associated with applications that are sensitive to delay or packet loss including Telnet, web browsing, and transfer of audio and video data. The benefit of this feature is the reduction of delay and packet loss in data transmissions.

ip tcp selective-ack

The TCP selective acknowledgment mechanism helps improve performance. The receiving TCP host returns selective acknowledgment packets to the sender, informing the sender of data that have been received. In other words, the receiver can acknowledge packets received out of order. The sender can then resend only the missing data segments (instead of everything since the first missing packet).

ip tcp window-size 12384

This is where you set the Rwin. This is the single most important tweak, and raising the value from the Windows default will greatly improve download speeds. My Rwin is set to 65535.

ip tcp queuemax 15

The queue for outgoing TCP packets
Default 5 for TTY (async and console) interfaces; 20 for others
This command sets the size of the outgoing TCP queue to packets. The queue is maintained per-connection; i.e., every connection has its own queue.

ip tcp mss

Interacts with the ip tcp path-mtu-discovery command and not the ip tcp header-compression command. The ip tcp path-mtu-discovery command changes the default MSS to 1460 even for nonlocal nodes.

The maximum segment size (MSS) is an option of the TCP protocol that specifies the largest amount of data, specified in bytes, that a computer or communications device can receive in a single, unfragmented piece. It does not count the TCP header or the IP header^[1]. For optimum communications, the number of bytes in the data segment and the headers must not add up to more than the number of bytes in the maximum transmission unit (MTU).

The MSS is an important consideration in Internet connections. As data is routed over the Internet, it must pass through multiple gateway routers. Ideally, each TCP segment can pass through every router without being fragmented. If the data segment size is too large for any of the routers through which the data passes, the oversized segments are fragmented. This decreases throughput and increases latency, in some cases dramatically^[2]. The likelihood of such fragmentation can be minimized by keeping the MSS as small as reasonably possible. Every host is required to be able to handle an MSS of at least 536 bytes.

For most computer users, the MSS option is set automatically by the operating system on the SYN packet during the TCP handshake. Each direction of data flow can use a different MSS.

July 23, 2010 5:21 pm

Tags: cisco tcp, tcp tuning

by admin

Cisco SSH

config t
crypto key generate rsa
1024
!
ip access-list standard TELNET_SSH
permit (ip-address)
permit 1.1.1.1 0.0.0.7
!

line vty 0 4
 access-class TELNET_SSH in

July 21, 2010 8:42 am

Tags: cisco ssh, crypto key

by admin

Kilobyte Transfer Speeds

Notes: Use Kilo 1024 when you are referencing to computer data storage, and use Kilo 1000 when you are referencing to computer transfer speed.

Example: When you wanna now how much megabytes one gigabyte represents in your hard disk, use the calculator with kilo 1024 and convert gigabyte to megabyte, you can use it to all kilobyte to megabyte, kilobyte to kilobit, megabyte to terabyte, you can convert to all units listed on the table.

10240KB = 10.00 MB.
10240KB = 10485760 Bytes
10240KB = 83886080 Bits

Storage (Kilo = 1024 bits)

Bit	8388608
Byte	1048576
Kilobit	8192
Kilobyte	1024
Megabit	8
Megabyte	1
Gigabit	0.0078125
Gigabyte	0.0009765625
Terabit	7.62939453125E-06
Terabyte	9.5367431640625E-07

July 13, 2010 6:32 pm

Tags: bits, bytes, gigabits, gigabytes, kilobits, kilobytes, megabits, megabytes, terabits, terabytes

by admin

Cisco TCP Keepalives

Turn on TCP keepalives on both routers so that one router will notice when the connection to the other router goes away; otherwise, the far end has no way to know that a reboot or other connection loss has happened. TCP keepalives are non-configurable on the CLI and the keepalives can be changed through programming.

To enable TCP keepalives on the routers, use the following configuration commands:

Router1# config term
Router1(config)# service tcp-keepalives-in
Router1(config)# service tcp-keepalives-out
Router1(config)# end

service tcp-keepalives-in

To generate keepalive packets on idle incoming network connections (initiated by the remote host), use the service tcp-keepalives-in global configuration command.

service tcp-keepalives-out

To generate keepalive packets on idle outgoing network connections (initiated by a user), use the service tcp-keepalives-out global configuration command.

P.S – Use of this feature can reduce the affects of DoS attacks on the device as connections that do not respond to the keepalives will be terminated and no longer consume system resources.

July 11, 2010 3:51 pm

Tags: service tcp, tcp, tcp keepalives

by admin

Cisco Wireless 877w Signal Tweak

Commstest(config)#int dot11Radio0
!
world-mode dot11d country GB outdoor
station-role root access-point
channel 2462
power local cck max
power local ofdm max

!

speed throughput ofdm – OFDM Weak Signal Detection ON
speed range
speed 54.0
!
channel least-congested – Dynamically channel set for least-congested chanel.

config t
interface dot11radio0
channel 2462

This set the channel to 11

I was able to verfiy this using the show controllers command
I found this table with the channels and their respective frequencies

Channel 1 : 2412 Mhz 11g
Channel 2 : 2417 Mhz 11g
Channel 3 : 2422 Mhz 11g
Channel 4 : 2427 Mhz 11g
Channel 5 : 2432 Mhz 11g
Channel 6 : 2437* Mhz 11g
Channel 7 : 2442 Mhz 11g
Channel 8 : 2447 Mhz 11g
Channel 9 : 2452 Mhz 11g
Channel 10 : 2457 Mhz 11g
Channel 11 : 2462 Mhz 11g
!
!
show controllers dot11Radio 0

Configuring the RTS Threshold

Request to Send (RTS) indicates the size of a frame that requires an RTS control message sent before it.
You must keep a few considerations in mind when you set this parameter.

RTS packets are sent more often because of smaller values. In addition, more bandwidth is consumed,
therefore reducing the amount of throughput on the network. However, the more RTS packets sent, the
quicker the system can recover from interference or collisions, which occurs in large, busy networks.

RTS is also helpful when two clients cannot hear each other (for instance, they are on opposite sides of a cell),
although they can hear the AP.

The RTS Threshold setting is between 0 and 2339 bytes. The default value is 2312.

The RTS Max. Retries setting dictates the number of times the AP issues an RTS before it quits.
This setting is a value between 1 and 128. The default value is 32.

Configuring Data Retries

When packets are sent, they can be lost. As such, the AP resends the packets to ensure the packets are
received by the client. You can tell the AP how often to resend packets by configuring the maximum amount
of data retries.

packet retries 128

June 25, 2010 8:40 am

Tags: 877w, increase, range, signal, tweaks, wireless

by admin

Cisco NTP Server

ntp authentication-key 1 md5 135445465259527E7E707D661677475240542701010F01 7
ntp authenticate
ntp master
ntp clock-period 17178719
ntp server 193.201.200.74

clock set 21:16:30 17 Nov 2007

Show Commands :
show ntp associations
show ntp associations detail
show ntp status

June 9, 2010 8:54 pm