Infrastructure Services · Topic 5 of 6

Troubleshooting with IP SLA

Use IP SLA on IOS XE to measure delay, jitter and connectivity, schedule probes, and link them to tracking objects that control static routes and failover.

  • 5 min
In a nutshell
  • An IP SLA operation must be scheduled with ip sla schedule.
  • icmp-echo measures reachability and delay.
  • udp-jitter measures delay, jitter and loss, and needs a responder.

What it is

IP SLA sends test traffic from the router to a target and records how the network performed.

Each test is an operation. It can check whether a target is reachable, measure round trip delay, and measure jitter and loss for voice and video paths.

The results can feed a tracking object. A tracked result can then remove a route, move a first hop gateway or trigger an alert, so the network reacts to a measured fault instead of waiting for a link to go down.

IP SLA operationicmp echo to targetresultTrack objectup or downcontrolsStatic routeinstalled or removed

How it works

An operation is defined, scheduled, and then optionally tracked.

Common operations

OperationWhat it measures
icmp-echoReachability and round trip delay
udp-jitterDelay in each direction, jitter and packet loss
tcp-connectWhether a TCP port accepts a connection
httpWeb server response
dnsDNS resolution time

The udp-jitter operation needs an IP SLA responder on the target, which answers and adds timestamps. A Cisco router becomes a responder with the ip sla responder command. The responder is what lets one way delay and jitter be measured.

One way delay measurements need clocks that are synchronised, normally with NTP. Round trip results do not.

Configuring an operation

R1(config)# ip sla 10
R1(config-ip-sla)# icmp-echo 192.0.2.1 source-interface GigabitEthernet0/0
R1(config-ip-sla-echo)# frequency 10
R1(config-ip-sla-echo)# timeout 2000
R1(config)# ip sla schedule 10 life forever start-time now

The operation runs every 10 seconds, and waits 2000 milliseconds for a reply. The schedule command starts it. An operation that is not scheduled does nothing.

A jitter operation looks like this.

R1(config)# ip sla 20
R1(config-ip-sla)# udp-jitter 10.2.2.2 16384 codec g711ulaw
R1(config)# ip sla schedule 20 life forever start-time now
R2(config)# ip sla responder

The codec option makes the router send packets shaped like voice, so it can estimate call quality.

Tracking objects

A tracking object watches something and reports up or down. It can follow an IP SLA operation, an interface or a route.

R1(config)# track 10 ip sla 10 reachability
R1(config-track)# delay down 10 up 20
R1(config)# ip route 0.0.0.0 0.0.0.0 192.0.2.1 track 10
R1(config)# ip route 0.0.0.0 0.0.0.0 198.51.100.1 250

The primary default route is installed only while track 10 is up. When the probe fails, the route is removed and the floating static route with AD 250 takes over. The delay command avoids flapping by waiting before it changes state.

The same tracking object can be used elsewhere, such as with HSRP or with PBR using set ip next-hop verify-availability.

R1(config)# track 20 interface GigabitEthernet0/1 line-protocol

An interface track only reports link status. It does not notice a failure further away, which is why an IP SLA probe is often better for reachability.

Primary ISPprobe failstrack goes downStatic routeremovedbackup route AD 250Backup ISPnow used

Verifying and troubleshooting

R1# show ip sla configuration 10
R1# show ip sla statistics 10
R1# show ip sla summary
R1# show track 10

show ip sla statistics shows the latest result, the number of successes and failures, and for jitter the delay and loss values. show track shows the state of the object and how long it has been in that state.

Work through these checks in order.

  • Is the operation scheduled and running?
  • Does the probe reach the target from the right source?
  • For jitter, is the responder enabled on the far end?
  • Does the track object point to the right operation number?
  • Does the route or protocol use the track number correctly?
Exam tip

Probe a target that proves the path works, such as a host beyond the ISP, and not just the next hop address.

What to remember for the exam

Seven facts cover most questions on this topic.

  • An IP SLA operation must be scheduled with ip sla schedule.
  • icmp-echo measures reachability and delay.
  • udp-jitter measures delay, jitter and loss, and needs a responder.
  • ip sla responder enables the responder on the target Cisco device.
  • A tracking object can follow an IP SLA operation with track NUMBER ip sla NUMBER reachability.
  • A tracked static route is removed when the object goes down.
  • show ip sla statistics and show track show results and state.
Watch out

A tracked static route needs a floating backup route. Without one, there is no path when the track goes down.

Common mistakes

These five mistakes appear often.

Forgetting the schedule. The operation is configured but never runs.

No responder for jitter. The operation fails or returns no data.

Track number mismatch. The route follows an object that tracks something else.

Backup route AD too low. The floating route replaces the primary route even while the primary is up.

Probing only the next hop. The next hop answers while the path beyond it is broken.

Check yourself

Work through these three questions.

  • What does an IP SLA operation need before it starts running?

    It must be scheduled with ip sla schedule, for example with life forever start-time now.

  • How does a tracked static route provide failover?

    The route is removed when the track goes down, and a floating static route with a higher AD takes over.

  • Why does udp-jitter need a responder?

    The responder answers the probes and adds timestamps, so delay and jitter can be measured.

Topic 5 of 6 in Infrastructure Services

Test yourself on Infrastructure Services

The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.