Cisco 7600 Wireless Security Gateway Configuration Guide, Release 5.0.

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco 7600 Wireless Security Gateway Configuration Guide, Release 5.0.

Chapter Title

Fast Path Statistic Counters

Results

Updated:
April 25, 2016

Chapter: Fast Path Statistic Counters

Fast Path Stats Counters

This appendix describes the Fast Path stats counters.

Table B-1 and Table B-2 lists the Fast Path Stats supported by the WSG:

Table B-1 Global IPsec Fast Path Stats Supported by the WSG

Stats
Source
Description

ceipSecGlobalInDrops

NPU

The total number of packets dropped during receive processing by all current and previous IPsec Phase-2 Tunnels. This count does NOT include packets dropped due to Anti-Replay processing.

Possible causes of this error:

  • Incorrect IP version
  • TTL field is zero
  • ESP packet’s Next Header field does not match the IP protocol of the encapsulated packet

ceipSecGlobalOutDrops

NPU

The total number of packets dropped during send processing by all current and previous IPsec Phase-2 Tunnels

Possible cause of this error:

  • Fragmentation errors; E.g., packet larger than the WSG’s configured pre-framentation MTU with DF bit set.

ceipSecGlobalInReplayDrops

Crypto chip

The total number of packets dropped during receive processing due to Anti-Replay processing by all current and previous IPsec Phase-2 Tunnels

Possible causes of this error:

  • WSG recives an ESP packet with sequence number out of the replay window.
  • Simulated by capturing and reply the ESP packet.

ceipSecGlobalInAuthFails

Crypto chip

The total number of decrypt packet authentications which ended in failure by all current and previous IPsec Phase-2 Tunnels.

ceipSecGlobalOutAuthFails

NPU

The total number of encrypt packet authentications which ended in failure by all current and previous IPsec Phase-2 Tunnels.

Possible cause of this error:

  • Failures during encryption of the packets for any tunnel on the card.

Table B-2 IPsec Tunnel Fast Path Stats Supported by the WSG

Stats
Source
Description

ceipSecTunInDropPkts

NPU

The total number of packets dropped during receive processing by this IPsec Phase-2 Tunnel. This count does NOT include packets dropped due to Anti-Replay processing.

Possible causes of this error:

  • Incorrect IP version
  • TTL field is zero
  • ESP packet’s Next Header field does not match the IP protocol of the encapsulated packet

ceipSecTunOutDropPkts

NPU

The total number of packets dropped during send processing by this IPsec Phase-2 Tunnel.

Possible cause of this error:

  • Fragmentation errors; E.g., packet larger than the WSG’s configured pre-framentation MTU with DF bit set.

ceipSecTunInAuthFails

NPU

The total number of inbound authentication's which ended in failure by this IPsec Phase-2 Tunnel.

Possible cause of this error:

  • Failures during decryption of the packet because of mis-comparison in the hash mac.

ceipSecTunOutAuthFails

NPU

The total number of outbound authentication's which ended in failure by this IPsec Phase-2 Tunnel.

ceipSecTunInDecryptFails

NPU

The total number of inbound decryption's which ended in failure by this IPsec Phase-2 Tunnel.

Possible causes of this error:

  • Tunnel decryption failed due to next header mismatch in the decrypted packet
  • Bad IP version
  • Bad IP checksum
  • TTL expiry

ceipSecTunOutEncryptFails

NPU

The total number of outbound encryption's which ended in failure by this IPsec Phase-2 Tunnel.

Possible cause of this error:

  • Badly formed IP packet getting encrypted; e.g. wrong checksum, bad IP version, etc.

ceipSecTunInReplayDropPkts

NPU

The total number of packets dropped during receive processing due to Anti-Replay processing by this IPsec Phase-2 Tunnel.

Possible cause of this error:

  • Receiving packets with ESP sequence numbers within the replay window.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco