This article explains the possible cause of packet drops on traffic passing through a GRE tunnel on SRX devices.

• Packet drops observed on GRE tunnel traffic.
• High CPU utilization on a single thread when checking performance statistics.

Example outputs:

PFE CPU usage:

> request pfe execute target fpc0 command "show i386 cpu"
...
23    100   96    alive  >>>>>> High CPU on only one thread
24    77    73    alive
Average cpu0-23 (17)

SPU performance monitoring:

> show security monitoring performance spu extensive
...
20    100   96    alive  >>>>>> High CPU on one thread
21    77    73    alive

Cause

SRX uses a bitwise XOR of the source and destination IP addresses to determine the processing thread for GRE traffic. If multiple GRE tunnels have similar source and destination IP addresses, the XOR result will be the same, causing all tunnels to be processed by the same thread. This leads to uneven load distribution and high CPU usage on a single thread.

To distribute GRE tunnel traffic across multiple threads and reduce CPU load, ensure that the source and destination IP addresses of the tunnels vary enough to produce different XOR results.

How XOR works:

• The XOR result for each bit is 1 if only one of the bits is 1; otherwise, it is 0.
• If the first three octets of the IP addresses are identical, the XOR result will depend only on the last octet.

Example of problematic configuration:

set interfaces gr-0/0/0 unit 0 tunnel source 10.0.80.34
set interfaces gr-0/0/0 unit 0 tunnel destination 10.0.80.2
set interfaces gr-0/0/0 unit 1 tunnel source 10.0.80.35
set interfaces gr-0/0/0 unit 1 tunnel destination 10.0.80.3
set interfaces gr-0/0/0 unit 2 tunnel source 10.0.80.36
set interfaces gr-0/0/0 unit 2 tunnel destination 10.0.80.4

All XOR results are the same (100000), so all tunnels use the same thread.

Recommended IP schema for better distribution:

Source         Destination    XOR Result
192.168.1.2    192.168.1.3    1
192.168.1.4    192.168.1.6    10
192.168.1.8    192.168.1.11   11
192.168.1.9    192.168.1.13   100
...
192.168.1.50   192.168.1.61   1111

Each pair produces a different XOR result, ensuring tunnels are processed by different threads.

In short:
Use source/destination IP addresses with enough variation to achieve different XOR results, which will balance the load across multiple threads and reduce CPU usage.