Добрый день, уважаемые!Возникла следующая проблема с загрузкой процессора роутера:
В офисе cisco 1841 смотрит в инет (входящий трафик до 2 мб/с, вид трафика: сайты, скачивание файлов, 250 пользователей за иса сервером), на циске статик нат, ацл, впн сервер.
Появилась необходимость прицепиться ей, как изи впн клиенту к сторонней организации, сконфигурил требуемое, вродь заработало.
Исходящий трафик около 4 мб/с (шифрованый 256-aes) – копирование файлов от нас.
Проблема возникла после того, как вместо 2 мб/с у нас появилось 4. Наблюдается следующая картина:
Входящий трафик инета 4 мб/с – загрузка проца 10-15 %
Входящий трафик инета в округах 1 мб/с + исходящий (указывал выше) – загрузка проца 20-25%
Входящий трафик инета в округах 2 мб/с + исходящий (указывал выше) – загрузка проца 45-50%
Входящий трафик инета в округах 3 мб/с + исходящий (указывал выше) – загрузка проца 85-90%
Входящий трафик инета более 3 мб/с + исходящий (указывал выше) – роутер в ауте
В связи с этим огромная просьба , подскажите пожалуйста, де что не так в конфиге, либо куда мне глянуть на роутере, или это нормально для 1841, хотя вродь пишут что она и больше переваривает спокойно, или куда копать-читать?
Еще замечу – по sh proc cpu загрузки по процессам нет, в sh ip nat tr стабильно около 1000 трансляций статики вида и одна,две в локальную сетку сторонней организации, торрент только для избранных и в вечернее время.
Конфиг:
version 12.4
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service sequence-numbers
no service dhcp
!
hostname sec
!
boot-start-marker
boot system flash c1841-adventerprisek9-mz.124-24.T2.bin
boot-end-marker
!
logging message-counter syslog
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login userauthen local
aaa authentication ppp default local
aaa authorization exec default local
aaa authorization network default local
aaa authorization network groupauthor local
!
!
aaa session-id common
dot11 syslog
ip source-route
!
!
!
!
ip cef
no ip bootp server
ip inspect max-incomplete low 300
ip inspect max-incomplete high 400
ip inspect one-minute low 500
ip inspect one-minute high 600
ip inspect udp idle-time 20
ip inspect tcp idle-time 60
ip inspect tcp synwait-time 20
ip inspect tcp max-incomplete host 300 block-time 0
no ipv6 cef
!
multilink bundle-name authenticated
!
!
crypto isakmp policy 6
hash md5
authentication pre-share
group 2
crypto isakmp key xxxxxx hostname xxxxxxxx
crypto isakmp keepalive 10 5 periodic
!
crypto isakmp client configuration group xxxxx
key 6 xxxxxxxx
pool ippool
acl 108
include-local-lan
!
!
crypto ipsec transform-set losk esp-3des esp-sha-hmac
!
!
!
crypto ipsec client ezvpn centr
connect auto
group enplus-external key xxxxx
mode client
peer xxxxxxxxx
username volgaenergo password xxxxxx
xauth userid mode local
!
crypto dynamic-map los 10
set transform-set los
reverse-route
!
!
crypto map los client authentication list userauthen
crypto map los isakmp authorization list groupauthor
crypto map los client configuration address respond
crypto map los 10 ipsec-isakmp dynamic los
!
!
!
ip tcp selective-ack
ip tcp timestamp
!
class-map match-all cb
class-map match-all rt
class-map match-all Traf1
match access-group 109
!
!
policy-map Policy1
class Traf1
policy-map pb
class cb
police rate 56000 bps
!
!
interface Loopback10000
no ip address
ip virtual-reassembly
!
interface FastEthernet0/0
ip address 1.1.1.2 255.255.255.248
ip access-group 166 in
ip access-group 177 out
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map los
crypto ipsec client ezvpn centr
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
!
interface FastEthernet0/1.1
encapsulation dot1Q 80
ip address 192.168.10.245 255.255.254.0
no ip proxy-arp
ip dns view-group ezvpn-internal-viewlist
ip nat inside
ip virtual-reassembly
crypto ipsec client ezvpn moskva inside
!
interface FastEthernet0/1.2
encapsulation dot1Q 101
ip address 10.10.1.254 255.255.255.0
no ip proxy-arp
ip nat inside
ip virtual-reassembly
!
i
interface Async1
ip unnumbered FastEthernet0/1.1
encapsulation ppp
ip tcp header-compression
no ip mroute-cache
async mode interactive
peer default ip address dhcp
compress mppc
no fair-queue
ppp authentication chap
ppp chap hostname filial
ppp chap password xxxxxxxxx
routing dynamic
!
!
ip local pool ippool 192.168.22.60 192.168.22.70
no ip classless
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 1.1.1.1
no ip http server
no ip http secure-server
!
!
ip nat inside source list 110 interface Loopback10000 overload
ip nat inside source static 10.10.1.10 1.1.1.10
!
access-list 108 permit ip 192.168.10.0 0.0.0.255 192.168.22.0 0.0.0.255
access-list 110 permit ip 192.168.10.0 0.0.0.255 172.17.20.0 0.0.0.255
access-list 110 permit ip 192.168.10.0 0.0.0.255 172.18.20.0 0.0.0.255
access-list 110 deny ip any any
access-list 166 permit tcp any host 1.1.1.10 eq 9443
access-list 166 permit tcp any host 1.1.1.10 eq 9080
access-list 166 permit tcp any host 1.1.1.10 range 27005 27030
access-list 166 permit tcp any host 1.1.1.10 eq 7600
access-list 166 permit tcp any host 1.1.1.10 eq 444
access-list 166 permit tcp any host 1.1.1.2 eq 64015
access-list 166 permit udp any host 1.1.1.2 eq 64015
access-list 166 permit tcp any host 1.1.1.2 eq 64011
access-list 166 permit udp any host 1.1.1.2 eq 64011
access-list 166 permit tcp any host 1.1.1.2 eq 63965
access-list 166 permit udp any host 1.1.1.2 eq 62621
access-list 166 permit udp any host 1.1.1.10 eq 64005
access-list 166 permit tcp any host 1.1.1.10 eq 64001
access-list 166 permit udp any host 1.1.1.10 eq 64001
access-list 166 permit esp any host 1.1.1.2
access-list 166 permit udp any host 1.1.1.2 eq ntp
access-list 166 permit udp any host 1.1.1.10 eq ntp
access-list 166 permit tcp any host 1.1.1.10 eq ftp
access-list 166 permit tcp any host 1.1.1.10 eq ftp-data
access-list 166 permit tcp any host 1.1.1.10 range 6881 6885
access-list 166 permit tcp any host 1.1.1.10 eq www
access-list 166 permit tcp any host 1.1.1.10 eq domain
access-list 166 permit udp any host 1.1.1.10 eq domain
access-list 166 permit tcp any host 1.1.1.2 eq domain
access-list 166 permit udp any host 1.1.1.2 eq domain
access-list 166 permit tcp any host 1.1.1.3 eq domain
access-list 166 permit udp any host 1.1.1.3 eq domain
access-list 166 permit udp any host 1.1.1.3 eq isakmp
access-list 166 permit udp any host 1.1.1.10 eq non500-isakmp
access-list 166 permit udp any host 1.1.1.10 eq isakmp
access-list 166 permit udp any host 1.1.1.3 eq non500-isakmp
access-list 166 permit udp any host 1.1.1.2 eq isakmp
access-list 166 permit udp any host 1.1.1.2 eq non500-isakmp
access-list 166 permit udp any host 1.1.1.3 eq 9940
access-list 166 permit udp any host 1.1.1.10 eq 9940
access-list 166 permit tcp any host 1.1.1.10 eq 9091
access-list 166 permit tcp any host 1.1.1.10 eq smtp
access-list 166 permit tcp any host 1.1.1.3 eq smtp
access-list 166 permit tcp any any established
access-list 166 permit icmp any any
access-list 166 permit tcp any eq ftp-data any gt 1024
access-list 166 permit udp any eq 87 any gt 1024
access-list 166 permit tcp any eq domain host 1.1.1.10
access-list 166 permit udp any eq domain host 1.1.1.10
access-list 166 permit tcp any host 1.1.1.10 eq 443
access-list 166 permit udp any eq isakmp host 1.1.1.10
access-list 166 permit udp any eq non500-isakmp host 1.1.1.2
access-list 166 permit udp any eq isakmp host 1.1.1.2
access-list 166 permit udp any eq non500-isakmp host 1.1.1.10
access-list 166 deny ip any any log
access-list 177 permit tcp any any eq 2710
access-list 177 permit udp host 1.1.1.2 eq 64015 any
access-list 177 permit udp host 1.1.1.10 eq 64001 any
access-list 177 permit tcp any any eq 10100
access-list 177 permit tcp any any eq 2221
access-list 177 permit tcp any any eq 8088
access-list 177 permit tcp any any eq 8089
access-list 177 permit tcp any any eq 389
access-list 177 permit tcp any any eq 8090
access-list 177 permit tcp any any range 27005 27030
access-list 177 permit tcp any any eq 444
access-list 177 permit tcp any any eq telnet
access-list 177 permit tcp any any eq 238
access-list 177 permit tcp any any eq 1024
access-list 177 permit tcp any any eq 995
access-list 177 permit tcp any any eq 4661
access-list 177 permit tcp any any eq 465
access-list 177 permit tcp any any eq 50025
access-list 177 permit tcp any any eq 27227
access-list 177 permit tcp any any eq 85
access-list 177 permit tcp any any eq 50110
access-list 177 permit tcp any any range 7600 7602
access-list 177 permit tcp any any range 64000 64100
access-list 177 permit udp any any range 64000 64100
access-list 177 permit udp any any range 6881 6889
access-list 177 permit esp any any
access-list 177 permit tcp any any eq smtp
access-list 177 permit udp any any eq ntp
access-list 177 permit tcp any any eq www
access-list 177 permit tcp any any eq pop3
access-list 177 permit tcp any any eq domain
access-list 177 permit udp any any eq domain
access-list 177 permit tcp any any range ftp-data ftp
access-list 177 permit tcp any any established
access-list 177 permit udp any eq domain any
access-list 177 permit udp any any eq 3478
access-list 177 permit icmp any any
access-list 177 permit tcp any any eq nntp
access-list 177 permit tcp any any range 1911 1922
access-list 177 permit tcp any any eq 5190
access-list 177 permit tcp any any eq 1352
access-list 177 permit tcp any any eq 4000
access-list 177 permit tcp any any eq 4090
access-list 177 permit udp any any eq 4090
access-list 177 permit udp any any eq non500-isakmp
access-list 177 permit tcp any any eq 443
access-list 177 permit tcp any any eq 7778
access-list 177 permit tcp any any eq 8081
access-list 177 permit tcp any any eq 81
access-list 177 permit tcp any any eq 84
access-list 177 permit tcp any any eq 83
access-list 177 permit tcp any any eq 88
access-list 177 permit tcp any any eq 8108
access-list 177 permit tcp any any eq 8000
access-list 177 permit tcp any any eq 8109
access-list 177 permit tcp any any eq 8110
access-list 177 permit tcp any any eq 4321
access-list 177 permit tcp any any eq 92
access-list 177 permit tcp any any eq 8101
access-list 177 permit tcp any any eq 8801
access-list 177 permit tcp any any eq 8080
access-list 177 permit tcp any any eq 8443
access-list 177 permit tcp any any eq 9091
access-list 177 permit tcp any any eq 9900
access-list 177 permit tcp any any eq 9080
access-list 177 permit tcp any any eq 9443
access-list 177 permit tcp any any eq 5000
access-list 177 permit tcp any any eq 5001
access-list 177 permit tcp any any eq 5002
access-list 177 permit tcp any any eq 5003
access-list 177 permit udp any any eq isakmp
access-list 177 permit tcp any any eq 20000
access-list 177 permit udp any range 9940 9950 any
access-list 177 permit tcp any any range 1001 1007
access-list 177 permit tcp any any range 2000 2022
access-list 177 permit udp any any eq 87
access-list 177 permit tcp host 1.1.1.10 eq ftp-data any gt 1024
access-list 177 permit udp host 1.1.1.2 eq isakmp any
access-list 177 permit udp host 1.1.1.2 eq non500-isakmp any
access-list 177 deny ip any any log
!
!
!
!
control-plane
!
!
line con 0
line aux 0
session-timeout 60
exec-timeout 0 0
modem InOut
modem autoconfigure discovery
exec-character-bits 8
transport input all
autoselect during-login
autoselect ppp
stopbits 1
speed 38400
flowcontrol hardware
line vty 0 4
exec-timeout 0 0
transport input telnet
!
scheduler allocate 20000 1000
ntp server 194.149.67.130
ntp server 193.233.9.7
ntp server 62.117.76.141
!
end
Комментарии к конфигу: 1.1.1.0 - белые адреса, 192.168.10.0 и 10.10.1.0 - наша локалка, 172.17.20.0 и 172.18.20.0 локальные сети "сторонней организации"
Заранее благодарен за любые ответы.