Hi Laszlo, On Tue, 2008-09-30 at 15:55 +0200, Nemeth Laszlo wrote: > I have two 7201 (c7200p-advipservicesk9-mz.124-15.T3.bin) routers with > SA-VAM2+ modules. > > I have a tunnel interface between this routers. If I make a ~24Mbit/sec > traffic into this tunnel, the routers CPU's goes to 90%. It was the > performance without VAM2+ too. So the VAM2+ modul doesn't use?
We currently have a NPE-G1 with SA-VAM2 (not +) doing more or less the same thing, and it uses ~20% CPU doing about 20 mbit/s through the tunnel. As far as I can see it's 50/50 interrupt and process routing, probably the GRE part that's handled in the slow path. I'm not sure, but a GRE configuration like this and CEF might not be best friends. When you send the 24mbit/s traffic, what does you "show cpu" say? The 7201 should be an NPE-G2, so you shouldn't get worse results than the above. We use 12.4 mainline (IP IPSEC 3DES) by the way, that may make a difference. > Our routers config same, only the IP addresses different. The Tunnel > interface very important, because i run an OSPF protokoll into them. > > vpn0# sh pas vam interface > VPN Acceleration Module Version II+ in slot : 1 > Statistics for Hardware VPN Module since the last clear > of counters 4294967 seconds ago > 988980327 packets in 988980327 packets out > 302199518411 bytes in 318057273220 bytes out > 230 paks/sec in 230 paks/sec out > 562 Kbits/sec in 592 Kbits/sec out > 0 pkts compressed 0 pkts not compressed > 0 bytes before compress 0 bytes after compress > 1.0:1 compression ratio 1.0:1 overall > 526096 commands out 526096 commands acknowledged > Last 5 minutes: > 2854900 packets in 2854900 packets out > 9516 paks/sec in 9516 paks/sec out > 24058078 bits/sec in 25240088 bits/sec out > > In this last line the 24058078 bit/s traffic is normal, it is the > aggregated traffic on my tunnel0 interface. But the "562 Kbit/sec in" > and "592 Kbits/sec out" is to small, i think it should ~24000 Kbit/sec. I think the small numbers are the averages since you last cleared counters. Are they still too small? > interface Tunnel0 > description VPN0-VPN1 > ip address 10.0.0.1 255.255.255.252 > ip ospf cost 100 > load-interval 30 > keepalive 2 2 > tunnel source 192.168.0.1 > tunnel destination 192.168.1.1 > ! > interface GigabitEthernet0/1.2 > description VPN1 > encapsulation dot1Q 2 > ip address 192.168.0.1 > no ip redirects > no ip proxy-arp > ip nat outside > no ip virtual-reassembly > crypto map vpnmap > ! Fragmetation could be problematic too, so we use "ip tcp adjust-mss" on both the inside interface and the tunnel interface to compensate for the GRE + IPSec overhead. Regards, Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
