Very scary!!! regards,
Muhammad Fahad Khan JNCIP - M/T # 834 IT Specialist Global Technology Services, IBM [email protected] +92-301-8247638 Skype: fahad-ibm http://pk.linkedin.com/in/muhammadfahadkhan On Tue, Aug 3, 2010 at 9:35 AM, Ivan Ivanov <[email protected]> wrote: > Hm, this sounds more than scary! > > Soon I will now if there is the same problem with 10.0R3.10 on 3600 > cluster. > > So now I have good experience with router-based VPNs starting from > routing-instance. Policy-based are working also, but I found router-based > more scalable. But no with real traffic tested, until end of the week I will > let you know. > > Ivan, > > On Mon, Aug 2, 2010 at 23:58, Amos Rosenboim <[email protected]> wrote: > >> As far as I know the code you are running is the recommended version by >> Juniper. >> However it's important to mention that I have no experience with the high >> end SRX boxes. >> The stuff mentioned below by quoc sounds a little scary to me. >> >> Amos >> >> Sent from my iPhone >> >> On 2 Aug 2010, at 23:44, "Fahad Khan" <[email protected]<mailto: >> [email protected]>> wrote: >> >> I have 3 SPCs and 3 NPCs and running Junos 10.0R3.10, should I need to >> upgrade junos? >> >> regards, >> >> >> Muhammad Fahad Khan >> JNCIP - M/T # 834 >> IT Specialist >> Global Technology Services, IBM >> [email protected]<mailto:[email protected]> >> >> +92-301-8247638 >> Skype: fahad-ibm >> http://pk.linkedin.com/in/muhammadfahadkhan >> >> >> On Tue, Aug 3, 2010 at 12:02 AM, Quoc Hoang <[email protected]<mailto: >> [email protected]>> wrote: >> >> I've deployed IPSEC VPNs between a pair of SRX3600 and NS5400 without >> issue. SRX was running Junos 9.5r3. Performance wasn't great then. >> >> We recently ran into another vpn performance issue on more recent code, >> 10.0r2. Avoid running ipsec vpns on the high end SRX till Juniper resolves >> the issue unless you are planning to run with a single SPC. The fix will >> require an architectural change. >> >> Problem description: >> Low throughput is experienced on the Juniper high-end SRX line with >> systems >> that have multiple SPC’s. The issue occurs when a tunnel anchor SPU and >> the >> clear text session SPU are different. The problem exists because hash and >> SEQ bit values in the switch header are not accounted for properly when >> forwarding the packet to alternative SPU’s. >> >> >> Quoc >> >> --- On Mon, 8/2/10, Fahad Khan <[email protected]<mailto: >> [email protected]>> wrote: >> >> From: Fahad Khan <[email protected]<mailto:[email protected]>> >> >> Subject: [j-nsp] Traffic drops on IPSEC - SRX3600 >> To: <mailto:[email protected]> [email protected] >> <mailto:[email protected]> >> >> Date: Monday, August 2, 2010, 4:48 AM >> Hi folks, >> >> I am seeing very strange issue on SRX3600 when the traffic >> is flown through >> an IPSEC VPN tunnel (established with ISG2000), the tunnel >> gets up and the >> traffic flows properly, but suddenly traffic drops, while >> the tunnel remains >> up. >> >> And it continues to flow after 15 to 20 time out but again >> it starts >> droping. I am sure that there is no issue at physical >> layer. >> >> Has any body faced it yet?? >> >> Please reply ASAP. >> >> Thanks in adv >> >> regards >> Muhammad Fahad Khan >> JNCIP - M/T # 834 >> IT Specialist >> Global Technology Services, IBM >> [email protected]<mailto:[email protected]> >> >> +92-301-8247638 >> Skype: fahad-ibm >> http://pk.linkedin.com/in/muhammadfahadkhan >> _______________________________________________ >> juniper-nsp mailing list <mailto:[email protected]> >> [email protected]<mailto:[email protected]> >> >> https://puck.nether.net/mailman/listinfo/juniper-nsp >> >> >> _______________________________________________ >> juniper-nsp mailing list <mailto:[email protected]> >> [email protected]<mailto:[email protected]> >> >> https://puck.nether.net/mailman/listinfo/juniper-nsp >> _______________________________________________ >> juniper-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/juniper-nsp >> > > > > -- > Best Regards! > > Ivan Ivanov > _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
