Cisco – How Can You Tell If IPSec Is Installed on Cisco

The problem is the split tunneling. I'm actually surprised you got it working in the first place with the stock vpn client. It's crap.

Anyway, the major carriers usually assign a private 10.0.0.0/8 ip to their devices, so when you try to split tunnel it fails as it can't determine what's tunneled and what's not. Enjoy.

Both Ethernet ports should be running auto/auto, as should the 4900's ports. This isn't the source of an ignored packet, though - media mismatches will show up as CRC errors, input errors, etc..

How many ignored packets are you seeing and over what period of time? A few hundred over a period of months isn't that big of a deal - especially if you're not noticing a performance hits.

Are you measuring CPU usage at all? Even tracking on 'sh proc cpu history' might give some clues as to whether your counter increases correlate with high cpu usage (..which can contribute in its own right to these kinds of issues). Also confirm that cef is enabled on the box globally as well as on the individual interfaces. Run 'show int st' to get a sense of the ratio of process switched to fast switched packets - the number should be predominantly fast switched. If not, a particular feature or configuration is likely hanging things up. Are you doing NBAR, fancy firewall/IDS or lots of un-accelerated crypto?

If you're at all memory constrained I would go slowly with the buffer changes - going too far can cause more harm than good.