macho

спасибо :)

ничего там нет, проверял, есть варианты как запретить фрагментацию пакетов ?:) или df бит все виндовые машины ставят по умолчанию, например tcp adj mss?

Всем привет, имеем на одном конце VTI тунеля 2811 с aim vpn EPII plus, на другом 1841. Конфиг с 1841 Код: Building configuration... ! version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption ! hostname vrh.c1841 ! boot-start-marker boot-end-marker ! logging buffered 4096 warnings no logging console no logging monitor enable secret 5 $1$ecOd$.noqOSFisnTJ01D93Vauq. ! aaa new-model ! ! aaa authentication login default local aaa authentication login console local aaa accounting send stop-record authentication failure ! aaa session-id common clock timezone MSK 3 clock summer-time MSK_Summer recurring last Sun Mar 2:00 last Sun Oct 3:00 no ip source-route no ip gratuitous-arps ip cef ! ! no ip dhcp use vrf connected ip dhcp excluded-address 192.168.25.3 ! ip dhcp pool dhcppoolSTAFF import all network 172.23.0.0 255.255.255.0 default-router 172.23.0.1 dns-server 172.16.0.11 option 176 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90 option 242 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90 ! ip dhcp pool dhcppoolVOIP import all network 172.23.1.0 255.255.255.0 default-router 172.23.1.1 dns-server 172.16.0.11 option 242 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90 option 176 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90 ! ! no ip bootp server ip inspect name firewall cuseeme ip inspect name firewall dns ip inspect name firewall ftp ip inspect name firewall h323 ip inspect name firewall https ip inspect name firewall icmp ip inspect name firewall imap ip inspect name firewall pop3 ip inspect name firewall netshow ip inspect name firewall rcmd ip inspect name firewall realaudio ip inspect name firewall rtsp ip inspect name firewall esmtp ip inspect name firewall sqlnet ip inspect name firewall streamworks ip inspect name firewall tftp ip inspect name firewall tcp ip inspect name firewall udp ip inspect name firewall vdolive ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 ip ips sdf location flash://128MB.sdf ip ips signature 4620 0 disable ip ips signature 2156 0 disable ip ips name ips_rule ! ! archive path tftp://172.16.0.23/vrh.c1841/ write-memory ! ! ip ssh version 2 ! class-map match-all voip match access-group 150 ! ! policy-map voip_prio class voip priority 9000 class class-default fair-queue random-detect policy-map total class class-default shape average 10000000 service-policy voip_prio ! ! ! crypto isakmp policy 10 encr 3des authentication pre-share group 2 crypto isakmp key nhytne address crypto isakmp key neytkne address crypto isakmp invalid-spi-recovery crypto isakmp keepalive 20 periodic ! ! crypto ipsec transform-set fox esp-3des esp-sha-hmac ! crypto ipsec profile foxprof set transform-set fox ! ! ! ! interface Tunnel2 ip address 10.1.2.126 255.255.255.252 load-interval 30 keepalive 10 3 tunnel source FastEthernet0/0 tunnel destination 8 tunnel mode ipsec ipv4 tunnel protection ipsec profile foxprof service-policy output total ! interface Tunnel3 ip address 10.1.1.126 255.255.255.252 ip ospf cost 20100 keepalive 10 3 tunnel source FastEthernet0/0 tunnel destination 8 tunnel mode ipsec ipv4 tunnel protection ipsec profile foxprof service-policy output total ! interface FastEthernet0/0 ip address 8 ip access-group 103 in ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip nat outside ip virtual-reassembly duplex auto speed auto no cdp enable no mop enabled ! interface FastEthernet0/1 no ip address no ip proxy-arp ip virtual-reassembly duplex auto speed auto no mop enabled ! interface FastEthernet0/1.1 description #voip# encapsulation dot1Q 30 ip address 172.23.1.1 255.255.255.0 no cdp enable ! interface FastEthernet0/1.2 description #management# encapsulation dot1Q 20 ip address 172.23.2.1 255.255.255.240 no cdp enable ! interface FastEthernet0/1.3 description #Staff# encapsulation dot1Q 10 ip address 172.23.0.1 255.255.255.0 ip access-group 100 in no ip proxy-arp ip nat inside ip virtual-reassembly no cdp enable ! router ospf 1 log-adjacency-changes passive-interface FastEthernet0/1 passive-interface FastEthernet0/1.1 passive-interface FastEthernet0/1.2 passive-interface FastEthernet0/1.3 network 10.1.1.124 0.0.0.3 area 0 network 10.1.2.124 0.0.0.3 area 0 network 172.23.0.0 0.0.0.255 area 40 network 172.23.1.0 0.0.0.255 area 40 network 172.23.2.0 0.0.0.15 area 40 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 8 ! ! no ip http server ip http authentication local no ip http secure-server ! ip access-list standard vty_in permit 172.16.0.29 permit 172.22.1.0 0.0.0.255 permit 83.242.184.144 0.0.0.7 deny any ! logging 172.16.0.29 snmp-server community bublik RO snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart snmp-server enable traps vrrp snmp-server enable traps ds1 snmp-server enable traps tty snmp-server enable traps eigrp snmp-server enable traps envmon snmp-server enable traps flash insertion removal snmp-server enable traps icsudsu snmp-server enable traps isdn call-information snmp-server enable traps isdn layer2 snmp-server enable traps isdn chan-not-avail snmp-server enable traps isdn ietf snmp-server enable traps ds0-busyout snmp-server enable traps ds1-loopback snmp-server enable traps aaa_server snmp-server enable traps atm subif snmp-server enable traps bgp snmp-server enable traps bulkstat collection transfer snmp-server enable traps cnpd snmp-server enable traps config-copy snmp-server enable traps config snmp-server enable traps dsp card-status snmp-server enable traps entity snmp-server enable traps event-manager snmp-server enable traps frame-relay snmp-server enable traps frame-relay subif snmp-server enable traps hsrp snmp-server enable traps ipmobile snmp-server enable traps ipmulticast snmp-server enable traps msdp snmp-server enable traps mvpn snmp-server enable traps ospf state-change snmp-server enable traps ospf errors snmp-server enable traps ospf retransmit snmp-server enable traps ospf lsa snmp-server enable traps ospf cisco-specific state-change nssa-trans-change snmp-server enable traps ospf cisco-specific state-change shamlink interface-old snmp-server enable traps ospf cisco-specific state-change shamlink neighbor snmp-server enable traps ospf cisco-specific errors snmp-server enable traps ospf cisco-specific retransmit snmp-server enable traps ospf cisco-specific lsa snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message snmp-server enable traps pppoe snmp-server enable traps cpu threshold snmp-server enable traps rsvp snmp-server enable traps rtr snmp-server enable traps syslog snmp-server enable traps l2tun session snmp-server enable traps vtp snmp-server enable traps isakmp policy add snmp-server enable traps isakmp policy delete snmp-server enable traps isakmp tunnel start snmp-server enable traps isakmp tunnel stop snmp-server enable traps ipsec cryptomap add snmp-server enable traps ipsec cryptomap delete snmp-server enable traps ipsec cryptomap attach snmp-server enable traps ipsec cryptomap detach snmp-server enable traps ipsec tunnel start snmp-server enable traps ipsec tunnel stop snmp-server enable traps ipsec too-many-sas ! end вот ненмого подрезал )не обращайте внимание на инспекты, и наты, они отключены. Так вот 12 человек сосут по тунелю траф Service-policy output: total Class-map: class-default (match-any) 82236817 packets, 48323505192 bytes 30 second offered rate 7491000 bps, drop rate 0 bps Match: any Traffic Shaping Target/Average Byte Sustain Excess Interval Increment Rate Limit bits/int bits/int (ms) (bytes) 10000000/10000000 62500 250000 250000 25 31250 Adapt Queue Packets Bytes Packets Bytes Shaping Active Depth Delayed Delayed Active - 0 82193704 889838205 34673 36096166 no Service-policy : voip_prio Class-map: voip (match-all) 3702213 packets, 235637454 bytes 30 second offered rate 0 bps, drop rate 0 bps Match: access-group 150 Queueing Strict Priority Output Queue: Conversation 264 Bandwidth 9000 (kbps) Burst 225000 (Bytes) (pkts matched/bytes matched) 863/51534 (total drops/bytes drops) 0/0 а вот и проблема: 787655565599999999999999999999999999999999986666666655669985 828394385536597755678577946665666977997856482057514489893443 100 **##********** ***********#**** 90 *##############*##*###########*#** ** 80 *** *##############*#################* *#* 70 #*# * #################################* *** **##* 60 ####* ***##########################################**####* 50 ##########################################################** 40 ###########################################################* 30 ###########################################################* 20 ############################################################ 10 ############################################################ 0....5....1....1....2....2....3....3....4....4....5....5....6 0 5 0 5 0 5 0 5 0 5 0 CPU% per minute (last 60 minutes) * = maximum CPU% # = average CPU% Это нормально? При full duplex 16491000 бит/с , это я еще на 50Mbit не разогнал ) По поводу Qos ... можно и GRE шейпить, но мне удобнее мой вариант. 2811 грузится до 60% при наличии только ЭТОГО трафа.

Суть впринципи проста, надо удалить эту группу, но далее изменить на интерфейсе парметр pppoe enable group global на pppoe enable... а этого не происходит ).... он снова ставит pppoe enable group global. А это уже косяк )

vpdn enable vpdn-group pppoe protocol pppoe теперь это трансформируется в bba-group (

НЕт не может работать циска без этой группы!!! Она по умолчанию ссылается на pppoe enable group global когда пишешь pppoe enable...

ага, словил ) ... bba-group убрал и не работает.... no ip address ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip flow ingress ip flow egress ip virtual-reassembly duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 no cdp enable no mop enabled pppoe enable group global - тоже править надо получается в pppoe enable

спасибо!

bba-group pppoe global mac-address autoselect interface Dialer1 ip address negotiated ip access-group 103 in ip mtu 1492 ip nat outside ip inspect firewall out ip virtual-reassembly encapsulation ppp dialer pool 1 dialer idle-timeout 0 dialer persistent dialer-group 1 no cdp enable ppp authentication chap callin ppp chap hostname oe1skizhevsk ppp chap password 7 10541C ppp ipcp route default Где тут строчка, которая заставляет думать 1841 что он сервер ? Мешает работе других клиентов типа d-link, они при поиске сервера считают её за сервер... Подскажите как исправить спасибо