[macho]

Всем привет, имеем на одном конце VTI тунеля 2811 с aim vpn EPII plus, на другом 1841.

 

Конфиг с 1841

 

Код:

 

Building configuration...

 

!

version 12.4

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

!

hostname vrh.c1841

!

boot-start-marker

boot-end-marker

!

logging buffered 4096 warnings

no logging console

no logging monitor

enable secret 5 $1$ecOd$.noqOSFisnTJ01D93Vauq.

!

aaa new-model

!

!

aaa authentication login default local

aaa authentication login console local

aaa accounting send stop-record authentication failure

!

aaa session-id common

clock timezone MSK 3

clock summer-time MSK_Summer recurring last Sun Mar 2:00 last Sun Oct 3:00

no ip source-route

no ip gratuitous-arps

ip cef

!

!

no ip dhcp use vrf connected

ip dhcp excluded-address 192.168.25.3

!

ip dhcp pool dhcppoolSTAFF

import all

network 172.23.0.0 255.255.255.0

default-router 172.23.0.1

dns-server 172.16.0.11

option 176 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90

option 242 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90

!

ip dhcp pool dhcppoolVOIP

import all

network 172.23.1.0 255.255.255.0

default-router 172.23.1.1

dns-server 172.16.0.11

option 242 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90

option 176 ascii L2QVLAN=30,HTTPSRVR=172.16.0.23,HTTPDIR=/46xx/,MCIPADD=172.16.0.90

!

!

no ip bootp server

 

ip inspect name firewall cuseeme

ip inspect name firewall dns

ip inspect name firewall ftp

ip inspect name firewall h323

ip inspect name firewall https

ip inspect name firewall icmp

ip inspect name firewall imap

ip inspect name firewall pop3

ip inspect name firewall netshow

ip inspect name firewall rcmd

ip inspect name firewall realaudio

ip inspect name firewall rtsp

ip inspect name firewall esmtp

ip inspect name firewall sqlnet

ip inspect name firewall streamworks

ip inspect name firewall tftp

ip inspect name firewall tcp

ip inspect name firewall udp

ip inspect name firewall vdolive

ip auth-proxy max-nodata-conns 3

ip admission max-nodata-conns 3

ip ips sdf location flash://128MB.sdf

ip ips signature 4620 0 disable

ip ips signature 2156 0 disable

ip ips name ips_rule

!

!

archive

path tftp://172.16.0.23/vrh.c1841/

write-memory

!

!

ip ssh version 2

!

class-map match-all voip

match access-group 150

!

!

policy-map voip_prio

class voip

priority 9000

class class-default

fair-queue

random-detect

policy-map total

class class-default

shape average 10000000

service-policy voip_prio

!

!

!

crypto isakmp policy 10

encr 3des

authentication pre-share

group 2

crypto isakmp key nhytne address

crypto isakmp key neytkne address

crypto isakmp invalid-spi-recovery

crypto isakmp keepalive 20 periodic

!

!

crypto ipsec transform-set fox esp-3des esp-sha-hmac

!

crypto ipsec profile foxprof

set transform-set fox

!

!

!

!

interface Tunnel2

ip address 10.1.2.126 255.255.255.252

load-interval 30

keepalive 10 3

tunnel source FastEthernet0/0

tunnel destination 8

tunnel mode ipsec ipv4

tunnel protection ipsec profile foxprof

service-policy output total

!

interface Tunnel3

ip address 10.1.1.126 255.255.255.252

ip ospf cost 20100

keepalive 10 3

tunnel source FastEthernet0/0

tunnel destination 8

tunnel mode ipsec ipv4

tunnel protection ipsec profile foxprof

service-policy output total

!

interface FastEthernet0/0

ip address 8

ip access-group 103 in

ip verify unicast reverse-path

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

no cdp enable

no mop enabled

!

interface FastEthernet0/1

no ip address

no ip proxy-arp

ip virtual-reassembly

duplex auto

speed auto

no mop enabled

!

interface FastEthernet0/1.1

description #voip#

encapsulation dot1Q 30

ip address 172.23.1.1 255.255.255.0

no cdp enable

!

interface FastEthernet0/1.2

description #management#

encapsulation dot1Q 20

ip address 172.23.2.1 255.255.255.240

no cdp enable

!

interface FastEthernet0/1.3

description #Staff#

encapsulation dot1Q 10

ip address 172.23.0.1 255.255.255.0

ip access-group 100 in

no ip proxy-arp

ip nat inside

ip virtual-reassembly

no cdp enable

!

router ospf 1

log-adjacency-changes

passive-interface FastEthernet0/1

passive-interface FastEthernet0/1.1

passive-interface FastEthernet0/1.2

passive-interface FastEthernet0/1.3

network 10.1.1.124 0.0.0.3 area 0

network 10.1.2.124 0.0.0.3 area 0

network 172.23.0.0 0.0.0.255 area 40

network 172.23.1.0 0.0.0.255 area 40

network 172.23.2.0 0.0.0.15 area 40

!

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 8

!

!

no ip http server

ip http authentication local

no ip http secure-server

!

ip access-list standard vty_in

permit 172.16.0.29

permit 172.22.1.0 0.0.0.255

permit 83.242.184.144 0.0.0.7

deny any

!

logging 172.16.0.29

 

snmp-server community bublik RO

snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart

snmp-server enable traps vrrp

snmp-server enable traps ds1

snmp-server enable traps tty

snmp-server enable traps eigrp

snmp-server enable traps envmon

snmp-server enable traps flash insertion removal

snmp-server enable traps icsudsu

snmp-server enable traps isdn call-information

snmp-server enable traps isdn layer2

snmp-server enable traps isdn chan-not-avail

snmp-server enable traps isdn ietf

snmp-server enable traps ds0-busyout

snmp-server enable traps ds1-loopback

snmp-server enable traps aaa_server

snmp-server enable traps atm subif

snmp-server enable traps bgp

snmp-server enable traps bulkstat collection transfer

snmp-server enable traps cnpd

snmp-server enable traps config-copy

snmp-server enable traps config

snmp-server enable traps dsp card-status

snmp-server enable traps entity

snmp-server enable traps event-manager

snmp-server enable traps frame-relay

snmp-server enable traps frame-relay subif

snmp-server enable traps hsrp

snmp-server enable traps ipmobile

snmp-server enable traps ipmulticast

snmp-server enable traps msdp

snmp-server enable traps mvpn

snmp-server enable traps ospf state-change

snmp-server enable traps ospf errors

snmp-server enable traps ospf retransmit

snmp-server enable traps ospf lsa

snmp-server enable traps ospf cisco-specific state-change nssa-trans-change

snmp-server enable traps ospf cisco-specific state-change shamlink interface-old

snmp-server enable traps ospf cisco-specific state-change shamlink neighbor

snmp-server enable traps ospf cisco-specific errors

snmp-server enable traps ospf cisco-specific retransmit

snmp-server enable traps ospf cisco-specific lsa

snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message

snmp-server enable traps pppoe

snmp-server enable traps cpu threshold

snmp-server enable traps rsvp

snmp-server enable traps rtr

snmp-server enable traps syslog

snmp-server enable traps l2tun session

snmp-server enable traps vtp

snmp-server enable traps isakmp policy add

snmp-server enable traps isakmp policy delete

snmp-server enable traps isakmp tunnel start

snmp-server enable traps isakmp tunnel stop

snmp-server enable traps ipsec cryptomap add

snmp-server enable traps ipsec cryptomap delete

snmp-server enable traps ipsec cryptomap attach

snmp-server enable traps ipsec cryptomap detach

snmp-server enable traps ipsec tunnel start

snmp-server enable traps ipsec tunnel stop

snmp-server enable traps ipsec too-many-sas

!

end

 

 

вот ненмого подрезал )не обращайте внимание на инспекты, и наты, они отключены.

 

Так вот 12 человек сосут по тунелю траф

 

Service-policy output: total

 

Class-map: class-default (match-any)

82236817 packets, 48323505192 bytes

30 second offered rate 7491000 bps, drop rate 0 bps

Match: any

Traffic Shaping

Target/Average Byte Sustain Excess Interval Increment

Rate Limit bits/int bits/int (ms) (bytes)

10000000/10000000 62500 250000 250000 25 31250

 

Adapt Queue Packets Bytes Packets Bytes Shaping

Active Depth Delayed Delayed Active

- 0 82193704 889838205 34673 36096166 no

 

Service-policy : voip_prio

 

Class-map: voip (match-all)

3702213 packets, 235637454 bytes

30 second offered rate 0 bps, drop rate 0 bps

Match: access-group 150

Queueing

Strict Priority

Output Queue: Conversation 264

Bandwidth 9000 (kbps) Burst 225000 (Bytes)

(pkts matched/bytes matched) 863/51534

(total drops/bytes drops) 0/0

 

а вот и проблема:

 

 

787655565599999999999999999999999999999999986666666655669985

828394385536597755678577946665666977997856482057514489893443

100 **##********** ***********#****

90 *##############*##*###########*#** **

80 *** *##############*#################* *#*

70 #*# * #################################* *** **##*

60 ####* ***##########################################**####*

50 ##########################################################**

40 ###########################################################*

30 ###########################################################*

20 ############################################################

10 ############################################################

0....5....1....1....2....2....3....3....4....4....5....5....6

0 5 0 5 0 5 0 5 0 5 0

CPU% per minute (last 60 minutes)

* = maximum CPU% # = average CPU%

 

 

Это нормально? При full duplex 16491000 бит/с , это я еще на 50Mbit не разогнал )

 

 

По поводу Qos ... можно и GRE шейпить, но мне удобнее мой вариант.

 

 

2811 грузится до 60% при наличии только ЭТОГО трафа.

 

[Telesis]

sh proc cpu sort | ex 0.00 ?

[macho]

ничего там нет, проверял,

 

есть варианты как запретить фрагментацию пакетов ?:) или df бит все виндовые машины ставят по умолчанию, например tcp adj mss?

Изменено 1 июня, 2010 пользователем macho

[puh]

ip tcp mss-adjust вполне себе работает.

 

Но откуда вы взяли, что 1841 должна молотить 50 мегабит? cisco пишет в своём гайде о 45 мбит/с 3des для 1841. Это в стерильных и идеальных лабораторных условиях. У вас же она загружена по самое небалуй фрагментацией, косом... То, что она у вас тянет 16,5 мбит/с full duplex вместо 22,5 лабораторных, это просто фантастика.

[macho]

спасибо :)

[electro-club]

да, в вашем случае приговор, при такой полосе разве что asa5505 спасет из бюджетного решения