Исходное сообщение
"Проблема с нагрузкой на 1841 ipsec ?" Отправлено macho, 31-Май-10 16:51
Всем привет, имеем на одном конце VTI тунеля 2811 с aim vpn EPII plus, на другом 1841. Конфиг с 1841 Building configuration... ! version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption ! hostname vrh.c1841 ! boot-start-marker boot-end-marker ! logging buffered 4096 warnings no logging console no logging monitor enable secret 5 $1$ecOd$.noqOSFisnTJ01D93Vauq. ! aaa new-model ! ! aaa authentication login default local aaa authentication login console local aaa accounting send stop-record authentication failure ! aaa session-id common clock timezone MSK 3 clock summer-time MSK_Summer recurring last Sun Mar 2:00 last Sun Oct 3:00 no ip source-route no ip gratuitous-arps ip cef ! ! no ip dhcp use vrf connected ip dhcp excluded-address 192.168.25.3 ! ip dhcp pool dhcppoolSTAFF    import all    network 172.23.0.0 255.255.255.0    default-router 172.23.0.1    dns-server 172.16.0.11    option 176 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90    option 242 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90 ! ip dhcp pool dhcppoolVOIP    import all    network 172.23.1.0 255.255.255.0    default-router 172.23.1.1    dns-server 172.16.0.11    option 242 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90    option 176 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90 ! ! no ip bootp server ip inspect name firewall cuseeme ip inspect name firewall dns ip inspect name firewall ftp ip inspect name firewall h323 ip inspect name firewall https ip inspect name firewall icmp ip inspect name firewall imap ip inspect name firewall pop3 ip inspect name firewall netshow ip inspect name firewall rcmd ip inspect name firewall realaudio ip inspect name firewall rtsp ip inspect name firewall esmtp ip inspect name firewall sqlnet ip inspect name firewall streamworks ip inspect name firewall tftp ip inspect name firewall tcp ip inspect name firewall udp ip inspect name firewall vdolive ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 ip ips sdf location flash://128MB.sdf ip ips signature 4620 0 disable ip ips signature 2156 0 disable ip ips name ips_rule ! ! archive path tftp://172.16.0.23/vrh.c1841/ write-memory ! ! ip ssh version 2 ! class-map match-all voip match access-group 150 ! ! policy-map voip_prio class voip   priority 9000 class class-default   fair-queue   random-detect policy-map total class class-default   shape average 10000000   service-policy voip_prio ! ! ! crypto isakmp policy 10 encr 3des authentication pre-share group 2 crypto isakmp key nhytne address crypto isakmp key neytkne address crypto isakmp invalid-spi-recovery crypto isakmp keepalive 20 periodic ! ! crypto ipsec transform-set fox esp-3des esp-sha-hmac ! crypto ipsec profile foxprof set transform-set fox ! ! ! ! interface Tunnel2 ip address 10.1.2.126 255.255.255.252 load-interval 30 keepalive 10 3 tunnel source FastEthernet0/0 tunnel destination 8 tunnel mode ipsec ipv4 tunnel protection ipsec profile foxprof service-policy output total ! interface Tunnel3 ip address 10.1.1.126 255.255.255.252 ip ospf cost 20100 keepalive 10 3 tunnel source FastEthernet0/0 tunnel destination 8 tunnel mode ipsec ipv4 tunnel protection ipsec profile foxprof service-policy output total !         interface FastEthernet0/0 ip address 8 ip access-group 103 in ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly duplex auto speed auto no cdp enable no mop enabled ! interface FastEthernet0/1 no ip address no ip proxy-arp ip virtual-reassembly duplex auto speed auto no mop enabled ! interface FastEthernet0/1.1 description #voip# encapsulation dot1Q 30 ip address 172.23.1.1 255.255.255.0 no cdp enable ! interface FastEthernet0/1.2 description #management# encapsulation dot1Q 20 ip address 172.23.2.1 255.255.255.240 no cdp enable ! interface FastEthernet0/1.3 description #Staff# encapsulation dot1Q 10 ip address 172.23.0.1 255.255.255.0 ip access-group 100 in no ip proxy-arp ip nat inside ip virtual-reassembly no cdp enable ! router ospf 1 log-adjacency-changes passive-interface FastEthernet0/1 passive-interface FastEthernet0/1.1 passive-interface FastEthernet0/1.2 passive-interface FastEthernet0/1.3 network 10.1.1.124 0.0.0.3 area 0 network 10.1.2.124 0.0.0.3 area 0 network 172.23.0.0 0.0.0.255 area 40 network 172.23.1.0 0.0.0.255 area 40 network 172.23.2.0 0.0.0.15 area 40 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 8 ! !         no ip http server ip http authentication local no ip http secure-server ! ip access-list standard vty_in permit 172.16.0.29 permit 172.22.1.0 0.0.0.255 permit 83.242.184.144 0.0.0.7 deny   any ! logging 172.16.0.29 snmp-server community bublik RO snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart snmp-server enable traps vrrp snmp-server enable traps ds1 snmp-server enable traps tty snmp-server enable traps eigrp snmp-server enable traps envmon snmp-server enable traps flash insertion removal snmp-server enable traps icsudsu snmp-server enable traps isdn call-information snmp-server enable traps isdn layer2 snmp-server enable traps isdn chan-not-avail snmp-server enable traps isdn ietf snmp-server enable traps ds0-busyout snmp-server enable traps ds1-loopback snmp-server enable traps aaa_server snmp-server enable traps atm subif snmp-server enable traps bgp snmp-server enable traps bulkstat collection transfer snmp-server enable traps cnpd snmp-server enable traps config-copy snmp-server enable traps config snmp-server enable traps dsp card-status snmp-server enable traps entity snmp-server enable traps event-manager snmp-server enable traps frame-relay snmp-server enable traps frame-relay subif snmp-server enable traps hsrp snmp-server enable traps ipmobile snmp-server enable traps ipmulticast snmp-server enable traps msdp snmp-server enable traps mvpn snmp-server enable traps ospf state-change snmp-server enable traps ospf errors snmp-server enable traps ospf retransmit snmp-server enable traps ospf lsa snmp-server enable traps ospf cisco-specific state-change nssa-trans-change snmp-server enable traps ospf cisco-specific state-change shamlink interface-old snmp-server enable traps ospf cisco-specific state-change shamlink neighbor snmp-server enable traps ospf cisco-specific errors snmp-server enable traps ospf cisco-specific retransmit snmp-server enable traps ospf cisco-specific lsa snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message snmp-server enable traps pppoe snmp-server enable traps cpu threshold snmp-server enable traps rsvp snmp-server enable traps rtr snmp-server enable traps syslog snmp-server enable traps l2tun session snmp-server enable traps vtp snmp-server enable traps isakmp policy add snmp-server enable traps isakmp policy delete snmp-server enable traps isakmp tunnel start snmp-server enable traps isakmp tunnel stop snmp-server enable traps ipsec cryptomap add snmp-server enable traps ipsec cryptomap delete snmp-server enable traps ipsec cryptomap attach snmp-server enable traps ipsec cryptomap detach snmp-server enable traps ipsec tunnel start snmp-server enable traps ipsec tunnel stop snmp-server enable traps ipsec too-many-sas ! end вот ненмого подрезал )не обращайте внимание на инспекты, и наты, они отключены. Так вот 12 человек сосут по тунелю траф Service-policy output: total     Class-map: class-default (match-any)       82236817 packets, 48323505192 bytes       30 second offered rate 7491000 bps, drop rate 0 bps       Match: any       Traffic Shaping            Target/Average   Byte   Sustain   Excess    Interval  Increment              Rate           Limit  bits/int  bits/int  (ms)      (bytes)            10000000/10000000  62500  250000    250000    25        31250             Adapt  Queue     Packets   Bytes     Packets   Bytes     Shaping         Active Depth                         Delayed   Delayed   Active         -      0         82193704  889838205 34673     36096166  no       Service-policy : voip_prio         Class-map: voip (match-all)           3702213 packets, 235637454 bytes           30 second offered rate 0 bps, drop rate 0 bps           Match: access-group 150           Queueing             Strict Priority             Output Queue: Conversation 264             Bandwidth 9000 (kbps) Burst 225000 (Bytes)             (pkts matched/bytes matched) 863/51534             (total drops/bytes drops) 0/0 а вот и проблема:     787655565599999999999999999999999999999999986666666655669985     828394385536597755678577946665666977997856482057514489893443 100            **##********** ***********#****                   90           *##############*##*###########*#**            **   80 ***       *##############*#################*            *#* 70 #*#    *  #################################*  ***     **##* 60 ####*  ***##########################################**####* 50 ##########################################################** 40 ###########################################################* 30 ###########################################################* 20 ############################################################ 10 ############################################################    0....5....1....1....2....2....3....3....4....4....5....5....6              0    5    0    5    0    5    0    5    0    5    0                CPU% per minute (last 60 minutes)               * = maximum CPU%   # = average CPU% Это нормально? При 7491000 бит/с , это я еще на 50 не разогнал ) По поводу Qos ... можно и GRE шейпить, но мне удобнее мой вариант. 2811 грузится до 60% при наличии только ЭТОГО трафа. добавлю что sh proc cpu sorted | exc 0.0 не дает результатов