Приветствую.Есть cisco 2811. Держит два туннеля. По туннелям передается голос(три колцентра)
1ая точка - Колцентр Cisco.
2ая точка - Колцентр Avaya, клиентские места аваевского и цисковского колцентра(~10 раб мест)
3яя точка - вынос Аваевского колцентра, клиентские места аваевского и цисковского колцентра.(~20+ раб мест)
cisco 2811 стоит на 2 точке и держит туннель с ISA 2006(1ая точка) и на 3й точке с juniper ssg.
show proc cpu hist - показывает 99% загрузку.
Даже на внутреннем интерфейсе циски потери пакетов и пинги в районе 100-200мс.
Через циску ходит только голос, всё остальное ходит через другую проксю.
Помогите, может чего поправить надо ? или без замены 2811 на что то другое не обойтись ?
----------------------------------------------------------------------
Если что, конфиг:
cisco-n-a-c#sh run
Building configuration...
Current configuration : 4544 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cisco-n-a-c
!
boot-start-marker
boot system flash c2800nm-advipservicesk9-mz.124-21a.bin
boot-end-marker
!
logging buffered 4096 debugging
!
aaa new-model
!
aaa authentication login default local
aaa authentication ppp default local
!
aaa session-id common
!
ip cef
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
voice-card 0
no dspfarm
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp key xxxxxxxxxx address 94.xx.xx.xx
crypto isakmp key xxxxxxxxxx address 81.xx.xx.xx
!
crypto ipsec transform-set des-sha esp-des esp-sha-hmac
crypto ipsec transform-set 3des-sha esp-3des esp-sha-hmac
!
crypto ipsec profile VTI
set transform-set 3des-sha
set pfs group2
!
!
crypto map IPSEC_TUNNEL 20 ipsec-isakmp
set peer 81.xx.xx.x
set transform-set 3des-sha
set pfs group2
match address SB
!
interface Loopback1
no ip address
!
interface Tunnel1
ip unnumbered FastEthernet0/1
ip accounting output-packets
ip mtu 1400
tunnel source 89.28.xx.xx
tunnel destination 94.xx.xx.xx
tunnel mode ipsec ipv4
tunnel protection ipsec profile VTI
!
interface FastEthernet0/0
description --- WAN ---
ip address 89.28.xx.xx 255.255.255.224
ip access-group BlockFromInternet in
ip accounting output-packets
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map IPSEC_TUNNEL
!
interface FastEthernet0/1
description --- LAN ---
ip address 192.168.104.254 255.255.255.0 secondary
ip address 192.168.103.254 255.255.255.0 secondary
ip address 192.168.101.254 255.255.255.0 secondary
ip address 192.168.3.254 255.255.255.0
ip accounting output-packets
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
ip local pool PPTP xxxxxxxxxxxxxxxxxxxxx
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 89.28.xxx.xxx
ip route 192.168.1.0 255.255.255.0 87.226.231.126
ip route 192.168.2.0 255.255.255.0 87.226.231.126
ip route 192.168.4.0 255.255.254.0 Tunnel1
ip route 192.168.52.0 255.255.255.0 Tunnel1
ip route 192.168.102.0 255.255.255.0 192.168.3.251
!
!
no ip http server
no ip http secure-server
ip nat inside source list NAT interface FastEthernet0/0 overload
ip nat inside source static tcp 192.168.3.1 22 89.28.xx.xx 22 extendable
ip nat inside source static tcp 192.168.3.1 80 89.28.xx.xx 80 extendable
ip nat inside source static tcp 192.168.3.1 443 89.28.xx.xx 443 extendable
ip nat inside source static tcp 192.168.3.35 3389 89.28.xx.xx 3390 extendable
ip nat inside source static tcp 192.168.3.9 3389 89.28.xx.xx 4083 extendable
ip nat inside source static tcp 192.168.3.50 3389 89.28.xx.xx 4084 extendable
ip nat inside source static tcp 192.168.3.1 5022 89.28.xx.xx 5022 extendable
!
ip access-list extended BlockFromInternet
............................
ip access-list extended NAT
..............................
ip access-list extended SB
permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255 log
permit ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255 log
permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255 log
permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 log
permit ip 192.168.4.0 0.0.0.255 192.168.2.0 0.0.0.255 log
permit ip 192.168.2.0 0.0.0.255 192.168.4.0 0.0.0.255 log
permit ip 192.168.4.0 0.0.0.255 192.168.1.0 0.0.0.255 log
permit ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255 log
!
access-list
............................................
!
control-plane
!
line con 0
line aux 0
line vty 0 4
access-class 1 in
!
scheduler allocate 20000 1000
!
end
cisco-n-a-c#
