On average, the VAM2+ should be able to do ~60Mbps VPN traffic (on a 7206VXR NPEG2) Maybe try to use IPSEC profile configuration instead of the legacy interface crypto map configuration. And also, try a different IOS. There should be at least a 12.4.15T7 out there I believe.
---------------------------------------------------------------------------- ------------------------------------------------------------------------- Luan Nguyen Senior Network Engineer Chesapeake NetCraftsmen, LLC. www.NetCraftsmen.net ---------------------------------------------------------------------------- ------------------------------------------------------------------------- -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nemeth Laszlo Sent: Tuesday, September 30, 2008 9:55 AM To: [email protected] Subject: [c-nsp] SA-VAM2+ usage problem? Hello, I have two 7201 (c7200p-advipservicesk9-mz.124-15.T3.bin) routers with SA-VAM2+ modules. I have a tunnel interface between this routers. If I make a ~24Mbit/sec traffic into this tunnel, the routers CPU's goes to 90%. It was the performance without VAM2+ too. So the VAM2+ modul doesn't use? Our routers config same, only the IP addresses different. The Tunnel interface very important, because i run an OSPF protokoll into them. vpn0# sh pas vam interface VPN Acceleration Module Version II+ in slot : 1 Statistics for Hardware VPN Module since the last clear of counters 4294967 seconds ago 988980327 packets in 988980327 packets out 302199518411 bytes in 318057273220 bytes out 230 paks/sec in 230 paks/sec out 562 Kbits/sec in 592 Kbits/sec out 0 pkts compressed 0 pkts not compressed 0 bytes before compress 0 bytes after compress 1.0:1 compression ratio 1.0:1 overall 526096 commands out 526096 commands acknowledged Last 5 minutes: 2854900 packets in 2854900 packets out 9516 paks/sec in 9516 paks/sec out 24058078 bits/sec in 25240088 bits/sec out In this last line the 24058078 bit/s traffic is normal, it is the aggregated traffic on my tunnel0 interface. But the "562 Kbit/sec in" and "592 Kbits/sec out" is to small, i think it should ~24000 Kbit/sec. Config: crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key abcabc address 192.168.1.1 ! crypto ipsec security-association replay window-size 1024 ! crypto ipsec transform-set vpn-standard esp-3des esp-sha-hmac ! crypto map vpnmap 20 ipsec-isakmp set peer 192.168.1.1 set transform-set vpn-standard match address VPN ! interface Tunnel0 description VPN0-VPN1 ip address 10.0.0.1 255.255.255.252 ip ospf cost 100 load-interval 30 keepalive 2 2 tunnel source 192.168.0.1 tunnel destination 192.168.1.1 ! interface GigabitEthernet0/1.2 description VPN1 encapsulation dot1Q 2 ip address 192.168.0.1 no ip redirects no ip proxy-arp ip nat outside no ip virtual-reassembly crypto map vpnmap ! ip access-list extended VPN permit gre host 192.168.0.1 host 192.168.1.1 Any idea? Thanks! Regards, Laszlo _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
