Коллеги, здравствуйте. С 1-го февраля запустили мы безлимитные тарифы с ограничением скорости. Технически организовали это на аппарате 2611 с помощью traffic-shape. Конфиг прилагаю.

!
! Last configuration change at 21:59:21 UTC Wed Feb 8 2006 by ***
! NVRAM config last updated at 16:54:59 UTC Wed Feb 8 2006 by ***
!
version 12.3
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname ***
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
enable password 7 ***
!
username k** password 7 ххх
username i** password 7 ххх
clock timezone UTC 4
aaa new-model
!
!
aaa group server radius rad_vpn_group
server х.х.х.х auth-port 1812 acct-port 1813
!
aaa authentication login default local group radius
aaa authentication ppp default group rad_vpn_group
aaa authorization network default group rad_vpn_group
aaa authorization auth-proxy default group radius
aaa accounting network default start-stop group rad_vpn_group
aaa session-id common
ip subnet-zero
ip cef
!
!
ip domain name ***.ru.
ip name-server х.х.х.х
!
ip auth-proxy max-login-attempts 20
ip auth-proxy name DTC_authproxy http auth-cache-time 60 list 133
ip audit po max-events 100
no ftp-server write-enable
!
!
interface Loopback0
ip address 192.168.56.1 255.255.255.0
ip broadcast-address 192.168.56.0
ip route-cache policy
ip route-cache flow
!
interface Ethernet0/0
ip address х.х.х.х 255.255.255.252
ip broadcast-address 195.209.32.64
ip nat outside
ip route-cache policy
ip route-cache flow
ip policy route-map MAP
half-duplex
!
interface Ethernet0/1
ip address 192.168.55.100 255.255.254.0 secondary
ip address 192.168.1.134 255.255.255.0 secondary
ip address х.х.х.х 255.255.255.224
ip broadcast-address х.х.х.х
ip access-group authACL in
ip nat inside
ip auth-proxy DTC_authproxy
ip route-cache policy
ip route-cache flow
half-duplex
traffic-shape group 2010 49152 6144 6144 1000
traffic-shape group 2011 49152 6144 6144 1000
traffic-shape group 2012 49152 6144 6144 1000
traffic-shape group 2013 49152 6144 6144 1000
traffic-shape group 2014 49152 6144 6144 1000
traffic-shape group 2015 49152 6144 6144 1000
traffic-shape group 2016 49152 6144 6144 1000
traffic-shape group 2017 49152 6144 6144 1000
traffic-shape group 2018 49152 6144 6144 1000
traffic-shape group 2019 49152 6144 6144 1000
traffic-shape group 2020 49152 6144 6144 1000
traffic-shape group 2021 49152 6144 6144 1000
traffic-shape group 2022 49152 6144 6144 1000
traffic-shape group 2023 49152 6144 6144 1000
traffic-shape group 2024 49152 6144 6144 1000
traffic-shape group 2025 49152 6144 6144 1000
traffic-shape group 2026 49152 6144 6144 1000
traffic-shape group 2027 49152 6144 6144 1000
traffic-shape group 2028 49152 6144 6144 1000
traffic-shape group 2029 49152 6144 6144 1000
traffic-shape group 2054 49152 6144 6144 1000
traffic-shape group 2056 49152 6144 6144 1000
traffic-shape group 2102 98304 12288 12288 1000
traffic-shape group 2103 98304 12288 12288 1000
traffic-shape group 2104 98304 12288 12288 1000
traffic-shape group 2105 98304 12288 12288 1000
traffic-shape group 2106 98304 12288 12288 1000
traffic-shape group 2107 98304 12288 12288 1000
traffic-shape group 2108 98304 12288 12288 1000
traffic-shape group 2109 98304 12288 12288 1000
traffic-shape group 2110 98304 12288 12288 1000
traffic-shape group 2202 131072 16384 16384 1000
traffic-shape group 2203 131072 16384 16384 1000
traffic-shape group 2204 131072 16384 16384 1000
traffic-shape group 2205 131072 16384 16384 1000
traffic-shape group 2206 131072 16384 16384 1000
traffic-shape group 2207 131072 16384 16384 1000
traffic-shape group 2057 49152 6144 6144 1000
traffic-shape group 2208 131072 16384 16384 1000
traffic-shape group 2058 49152 6144 6144 1000
traffic-shape group 2059 49152 6144 6144 1000
traffic-shape group 2060 49152 6144 6144 1000
traffic-shape group 2061 49152 6144 6144 1000
traffic-shape group 2111 98304 12288 12288 1000
traffic-shape group 2062 98304 12288 12288 1000
traffic-shape group 2063 49152 6144 6144 1000
traffic-shape group 2112 98304 12288 12288 1000
traffic-shape group 2064 49152 6144 6144 1000
!
!
interface Ethernet1/0
ip address х.х.х.х 255.255.255.252
ip broadcast-address х.х.х.х
ip access-group outsidefw in
ip access-group outgoingfw out
ip nat outside
ip route-cache policy
ip route-cache flow
ip policy route-map MAP
half-duplex
!
ip nat pool zdrv-pool х.х.х.х х.х.х.х netmask 255.255.255.248
ip nat inside source list 1 pool zdrv-pool overload
ip nat inside source static 192.168.55.200 х.х.х.х
ip http server
ip http access-class 13
ip http authentication aaa
ip flow-export source Ethernet0/0
ip flow-export version 5
ip flow-export destination х.х.х.х 9800
ip classless
ip route 0.0.0.0 0.0.0.0 х.х.х.х
ip route х.х.х.х 255.255.255.0 Ethernet0/1
ip route х.х.х.х 255.255.255.192 Null0
ip route х.х.х.х 255.255.255.255 х.х.х.х
!
!
!
...
!
access-list 2009 remark ACLs from 2010 to 2100 is unlimited 48 kbps
access-list 2010 permit ip any host 192.168.54.229
access-list 2011 permit ip any host 192.168.54.109
access-list 2012 permit ip any host 192.168.54.117
access-list 2013 permit ip any host 192.168.54.56
access-list 2014 permit ip any host 192.168.54.221
access-list 2015 permit ip any host 192.168.54.174
access-list 2016 permit ip any host 192.168.54.164
access-list 2017 permit ip any host 192.168.54.161
access-list 2018 permit ip any host 192.168.54.219
access-list 2019 permit ip any host 192.168.55.59
access-list 2020 permit ip any host 192.168.55.190
access-list 2021 permit ip any host 192.168.54.233
access-list 2022 permit ip any host 192.168.55.60
access-list 2023 permit ip any host 192.168.54.35
access-list 2024 permit ip any host 192.168.55.205
access-list 2025 permit ip any host 192.168.55.224
access-list 2026 permit ip any host 192.168.55.151
access-list 2027 permit ip any host 192.168.54.134
access-list 2028 permit ip any host 192.168.55.111
access-list 2029 permit ip any host 192.168.55.121
access-list 2030 permit ip any host 192.168.54.91
access-list 2031 permit ip any host 192.168.55.165
access-list 2032 permit ip any host 192.168.55.56
access-list 2033 permit ip any host 192.168.55.76
access-list 2034 permit ip any host 192.168.54.116
access-list 2035 permit ip any host 192.168.54.122
access-list 2036 permit ip any host 192.168.54.213
access-list 2037 permit ip any host 192.168.54.183
access-list 2038 permit ip any host 192.168.54.149
access-list 2039 permit ip any host 192.168.54.107
access-list 2040 permit ip any host 192.168.54.203
access-list 2041 permit ip any host 192.168.54.146
access-list 2042 permit ip any host 192.168.54.44
access-list 2043 permit ip any host 192.168.54.29
access-list 2044 permit ip any host 192.168.55.88
access-list 2045 permit ip any host 192.168.54.97
access-list 2046 permit ip any host 192.168.54.154
access-list 2047 permit ip any host 192.168.55.191
access-list 2048 permit ip any host 192.168.54.50
access-list 2060 permit ip any host 192.168.54.244
access-list 2061 permit ip any host 192.168.54.241
access-list 2062 permit ip any host 192.168.55.50
access-list 2063 permit ip any host 192.168.54.248
access-list 2064 permit ip any host 192.168.54.253
access-list 2101 remark ACLs from 2100 to 2199 is unlimited 96 kbps
access-list 2102 permit ip any host 192.168.55.26
access-list 2103 permit ip any host 192.168.55.188
access-list 2104 permit ip any host 192.168.54.95
access-list 2105 permit ip any host 192.168.54.121
access-list 2106 permit ip any host 192.168.55.189
access-list 2107 permit ip any host 192.168.54.205
access-list 2108 permit ip any host 192.168.54.172
access-list 2109 permit ip any host 192.168.55.172
access-list 2110 permit ip any host 192.168.55.88
access-list 2111 permit ip any host 192.168.54.237
access-list 2112 permit ip any host 192.168.54.250
access-list 2201 remark ACLs from 2200 to 2299 is unlimited 128 kbps
access-list 2202 permit ip any host 192.168.55.211
access-list 2203 permit ip any host 192.168.55.173
access-list 2204 permit ip any host 192.168.54.206
access-list 2205 permit ip any host 192.168.54.197
access-list 2206 permit ip any host 192.168.54.67
access-list 2207 permit ip any host 192.168.55.47
access-list 2208 permit ip any host 192.168.54.89
!
....
!
route-map MAP permit 10
match ip address 108
set interface Loopback0 Ethernet0/1
!
radius-server host 192.168.55.200 auth-port 1812 acct-port 1813 key 7 ***
radius-server host х.х.х.х auth-port 1812 acct-port 1813 key 7 ***
!
line con 0
line aux 0
line vty 0 4
access-class 10 in
!
ntp clock-period 17208603
ntp server 194.149.67.130 prefer
!
end

После запуска этого конфига. Безлимитники заработали. Но открылись побочные явления. На вечерних нагрузках маршрутизатор просто задыхается. Работать нормально не может никто. Да еще плюс ко всему, в этом трафике идет еще и голос. До введения traffic-shape такого не было. В связи с этим вопрос: как эту проблему снять? Может быть пришло время трафик классифицировать и нарезать очереди? Если да, то какой вид QoS наиболее подходит в данной ситуации? Заранее спасибо.

Еще параллельный вопрос. Поискал в форуме решение на предмет сокращения дикого количества access-list-ов при использовании traffic-shape. Убедился только лишний раз, что такая проблема не у меня одного. Неужели нет более красивого решения???