Исходное сообщение
"Оптимизация C1841" Отправлено dxer, 26-Май-09 11:52
Добрый день коллеги! Интересная проблема, Есть в Бренч-офисе Cisco 1841 128/32 с модулем HWIC-4ESW. На ней терминируется GRE over IPSec с HQ. А так же она является PPTP сервером для одной станции из HQ (через GRE туннель). При интенсивном трафике с быстрого хоста через туннель PPTP из ЦО в бренч (~300-400kbyte/s) обрываются сессии с менее скоростных хостов. Т.е. трафик идет с доминирующего хоста. Ес-но загрузка CPU при этом составляет под 100%. Процесс, который лидирует в списке show proc cpu so 5m: L2X Data Daemon. Задаюсь вопросом, почему маршрутизатор не разделяет сессии поровну, а обрывает их? Т.е. задача не в том, чтобы выжать мегабайт в секунду с 18-серии, пусть 100 килобайт в секунду, но без обрывов соединений. Как можно оптимизировать сие детище? Где копать? Переходить на более взрослую серию не предлагать :-) Ниже конфиг: version 12.4 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname gw ! boot-start-marker boot system flash c1841-advipservicesk9-mz.124-21.bin boot-end-marker ! security authentication failure rate 3 log security passwords min-length 6 logging buffered 51200 informational ! aaa new-model ! ! aaa authentication ppp default local ! aaa session-id common clock timezone MSK 4 clock summer-time Russia date Mar 30 2003 4:00 Oct 26 2003 5:00 ip cef ! ! ! ! ip name-server 172.16.1.1 ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 vpdn enable ! vpdn-group 10 ! Default PPTP VPDN group   accept-dialin     protocol pptp     virtual-template 1 ! l2tp-class corbina ! ! ! ! username user1 password 7 XXXXXXXXXXX ! ! pseudowire-class class1   encapsulation l2tpv2   protocol l2tpv2 corbina   ip local interface FastEthernet0/0 ! ! ! crypto isakmp policy 10   encr aes   authentication pre-share   group 2 crypto isakmp key XXXXXX address 11.11.11.11 crypto isakmp key XXXXXX address 12.12.12.12 ! ! crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac ! crypto map SRT 10 ipsec-isakmp   set peer 11.11.11.11 default   set peer 12.12.12.12   set transform-set ESP-AES-SHA   match address 102 ! ! ! interface Loopback0   description Loopback interface for GRE p2p tunnel   ip address 172.30.0.2 255.255.255.255 ! interface Tunnel0   description Tunnel to Cisco 2851 (Moscow)   bandwidth 10240   ip address 172.28.254.6 255.255.255.252   ip access-group 140 in   ip access-group 140 out   no ip redirects   no ip unreachables   no ip proxy-arp   ip nat outside   no ip virtual-reassembly   tunnel source Loopback0   tunnel destination 172.30.0.1 ! interface FastEthernet0/0   description CORBINA_LAN   no ip dhcp client request dns-nameserver   ip address dhcp   ip access-group 120 in   ip access-group 120 out   no ip redirects   no ip unreachables   no ip proxy-arp   duplex auto   speed auto   no cdp enable ! interface FastEthernet0/1   no ip address   shutdown   duplex auto   speed auto   no cdp enable ! interface FastEthernet0/0/0 ! interface FastEthernet0/0/1 ! interface FastEthernet0/0/2 ! interface FastEthernet0/0/3 ! interface Virtual-PPP1   description CORBINA_L2TP   ip address negotiated   ip access-group 130 in   ip access-group 130 out   no ip redirects   no ip unreachables   no ip proxy-arp   ip mtu 1460   ip nat outside   no ip virtual-reassembly   ip tcp adjust-mss 1460   no cdp enable   ppp chap hostname usr   ppp chap password 7 XXXXX   pseudowire 85.21.0.250 10 pw-class class1   crypto map SRT ! interface Virtual-Template1   ip unnumbered Tunnel0   ip access-group 150 in   ip access-group 151 out   no ip redirects   no ip unreachables   no ip proxy-arp   ip mtu 1328   ip nat inside   no ip virtual-reassembly   ip tcp adjust-mss 1320   peer default ip address pool VPN   ppp authentication ms-chap-v2 ! interface Vlan1   description HOME_LAN   ip address 172.16.1.5 255.255.0.0   ip access-group 110 in   ip access-group 111 out   no ip redirects   no ip unreachables   no ip proxy-arp   ip nat inside   no ip virtual-reassembly ! router eigrp 10   passive-interface default   no passive-interface Tunnel0   network 172.28.0.0   network 172.29.0.0   no auto-summary ! ip local pool VPN 192.168.2.1 192.168.2.2 ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Virtual-PPP1 ip route 85.21.0.0 255.255.255.0 dhcp ip route 10.0.0.0 255.0.0.0 dhcp ! ! no ip http server no ip http secure-server ip nat inside source list 101 interface Virtual-PPP1 overload ip nat inside source list 103 interface Tunnel0 overload ! access-list 1 permit 172.16.0.0 0.0.255.255 access-list 2 permit 172.16.1.4 access-list 101 remark INET_NAT access-list 101 deny ip 172.16.0.0 0.0.255.255 172.28.0.0 0.1.255.255 access-list 101 permit ip 172.16.0.0 0.0.255.255 any access-list 101 permit ip 192.168.2.0 0.0.0.3 any access-list 102 remark GRE access-list 102 permit ip host 172.30.0.2 host 172.30.0.1 access-list 103 remark WORK_NAT access-list 103 permit ip 172.16.0.0 0.0.255.255 172.28.0.0 0.1.255.255 access-list 110 remark Filter HOME_LAN In access-list 110 permit udp host 172.16.1.1 any access-list 110 permit ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255 access-list 110 permit ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.255.255 access-list 110 permit ip host 172.16.1.4 any access-list 110 permit ip 172.16.0.0 0.0.255.255 172.28.0.0 0.1.255.255 access-list 110 permit tcp host 172.16.1.1 host 207.38.11.174 access-list 110 deny ip any any log access-list 111 remark Filter HOME_LAN Out access-list 111 permit udp any host 172.16.1.1 access-list 111 permit ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255 access-list 111 permit ip 192.168.0.0 0.0.255.255 172.16.0.0 0.0.255.255 access-list 111 permit ip any host 172.16.1.4 access-list 111 permit ip 172.28.0.0 0.1.255.255 172.16.0.0 0.0.255.255 access-list 111 permit tcp host 207.38.11.174 host 172.16.1.1 access-list 111 deny ip any any log access-list 120 remark Filter CORBINA_LAN access-list 120 deny tcp any eq 1723 any access-list 120 deny tcp any any eq 1723 access-list 120 deny ip any 172.16.0.0 0.15.255.255 log-input access-list 120 deny ip 172.16.0.0 0.15.255.255 any log-input access-list 120 deny ip any 192.168.0.0 0.0.255.255 log-input access-list 120 deny ip 192.168.0.0 0.0.255.255 any log-input access-list 120 permit ip any any access-list 130 remark Filter INET access-list 130 deny udp any range netbios-ns netbios-ss any access-list 130 deny udp any eq 445 any access-list 130 deny udp any any range netbios-ns netbios-ss access-list 130 deny udp any any eq 445 access-list 130 deny tcp any eq 139 any access-list 130 deny tcp any eq 445 any access-list 130 deny tcp any eq 1723 any access-list 130 deny tcp any any eq 139 access-list 130 deny tcp any any eq 445 access-list 130 deny tcp any any eq 1723 access-list 130 deny ip any 10.0.0.0 0.255.255.255 log-input access-list 130 deny ip 10.0.0.0 0.255.255.255 any log-input access-list 130 deny ip any 172.16.0.0 0.15.255.255 log-input access-list 130 deny ip 172.16.0.0 0.15.255.255 any log-input access-list 130 deny ip any 192.168.0.0 0.0.255.255 log-input access-list 130 deny ip 192.168.0.0 0.0.255.255 any log-input access-list 130 deny udp any any eq bootpc log-input access-list 130 deny udp any eq bootpc any log-input access-list 130 permit ip any any access-list 140 remark Filter WORK access-list 140 deny udp any range netbios-ns netbios-ss any access-list 140 deny udp any eq 445 any access-list 140 deny udp any any range netbios-ns netbios-ss access-list 140 deny udp any any eq 445 access-list 140 deny tcp any eq 139 any access-list 140 deny tcp any eq 445 any access-list 140 deny tcp any any eq 139 access-list 140 deny tcp any any eq 445 access-list 140 deny udp any any eq bootpc access-list 140 deny udp any eq bootpc any access-list 140 permit ip 172.28.0.0 0.1.255.255 172.28.0.0 0.1.255.255 access-list 140 permit eigrp any any access-list 140 deny ip any any log-input access-list 150 remark Filter PPTP In access-list 150 deny udp any range netbios-ns netbios-ss any access-list 150 deny udp any eq 445 any access-list 150 deny udp any any range netbios-ns netbios-ss access-list 150 deny udp any any eq 445 access-list 150 deny tcp any eq 139 any access-list 150 deny tcp any eq 445 any access-list 150 deny tcp any any eq 139 access-list 150 deny tcp any any eq 445 access-list 150 deny udp any any eq bootpc access-list 150 deny udp any eq bootpc any access-list 150 permit ip 192.168.0.0 0.0.255.255 172.16.0.0 0.0.255.255 access-list 150 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 access-list 150 permit udp host 192.168.2.1 any access-list 150 permit tcp host 192.168.2.1 any access-list 150 deny ip any any log-input access-list 151 remark Filter PPTP Out access-list 151 deny udp any range netbios-ns netbios-ss any access-list 151 deny udp any eq 445 any access-list 151 deny udp any any range netbios-ns netbios-ss access-list 151 deny udp any any eq 445 access-list 151 deny tcp any eq 139 any access-list 151 deny tcp any eq 445 any access-list 151 deny tcp any any eq 139 access-list 151 deny tcp any any eq 445 access-list 151 deny udp any any eq bootpc access-list 151 deny udp any eq bootpc any access-list 151 permit ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.255.255 access-list 151 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 access-list 151 permit udp any host 192.168.2.1 access-list 151 permit tcp any host 192.168.2.1 access-list 151 deny ip any any log-input no cdp run ! ! ! ! control-plane ! ! ! line con 0 line aux 0 line vty 0 4   access-class 1 in   access-class 1 out   transport preferred none   transport input ssh ! scheduler allocate 20000 1000 ntp clock-period 17178403 ntp access-group peer 2 ntp update-calendar ntp server 172.16.1.1 end