Hi there, I think I'm experiencing the same issue here:
SRX 3600 in cluster mode, running 10.1R2.8 1 SPC / 1 NPC per chassis VPN in policy based mode with a remote CheckPoint I can clearly see packet loss in the way SRX -> Checkpoint, resulting in very poor performances in the tunnel We'll try to upgrade to 10.1R3.7 to see if it fixes the issue. On Tue, Aug 3, 2010 at 09:38, Fahad Khan <[email protected]> wrote: > Very scary!!! > > regards, > > Muhammad Fahad Khan > JNCIP - M/T # 834 > IT Specialist > Global Technology Services, IBM > [email protected] > +92-301-8247638 > Skype: fahad-ibm > http://pk.linkedin.com/in/muhammadfahadkhan > > > On Tue, Aug 3, 2010 at 9:35 AM, Ivan Ivanov <[email protected]> wrote: > >> Hm, this sounds more than scary! >> >> Soon I will now if there is the same problem with 10.0R3.10 on 3600 >> cluster. >> >> So now I have good experience with router-based VPNs starting from >> routing-instance. Policy-based are working also, but I found router-based >> more scalable. But no with real traffic tested, until end of the week I will >> let you know. >> >> Ivan, >> >> On Mon, Aug 2, 2010 at 23:58, Amos Rosenboim <[email protected]> wrote: >> >>> As far as I know the code you are running is the recommended version by >>> Juniper. >>> However it's important to mention that I have no experience with the high >>> end SRX boxes. >>> The stuff mentioned below by quoc sounds a little scary to me. >>> >>> Amos >>> >>> Sent from my iPhone >>> >>> On 2 Aug 2010, at 23:44, "Fahad Khan" <[email protected]<mailto: >>> [email protected]>> wrote: >>> >>> I have 3 SPCs and 3 NPCs and running Junos 10.0R3.10, should I need to >>> upgrade junos? >>> >>> regards, >>> >>> >>> Muhammad Fahad Khan >>> JNCIP - M/T # 834 >>> IT Specialist >>> Global Technology Services, IBM >>> [email protected]<mailto:[email protected]> >>> >>> +92-301-8247638 >>> Skype: fahad-ibm >>> http://pk.linkedin.com/in/muhammadfahadkhan >>> >>> >>> On Tue, Aug 3, 2010 at 12:02 AM, Quoc Hoang <[email protected]<mailto: >>> [email protected]>> wrote: >>> >>> I've deployed IPSEC VPNs between a pair of SRX3600 and NS5400 without >>> issue. SRX was running Junos 9.5r3. Performance wasn't great then. >>> >>> We recently ran into another vpn performance issue on more recent code, >>> 10.0r2. Avoid running ipsec vpns on the high end SRX till Juniper resolves >>> the issue unless you are planning to run with a single SPC. The fix will >>> require an architectural change. >>> >>> Problem description: >>> Low throughput is experienced on the Juniper high-end SRX line with >>> systems >>> that have multiple SPC’s. The issue occurs when a tunnel anchor SPU and >>> the >>> clear text session SPU are different. The problem exists because hash and >>> SEQ bit values in the switch header are not accounted for properly when >>> forwarding the packet to alternative SPU’s. >>> >>> >>> Quoc >>> >>> --- On Mon, 8/2/10, Fahad Khan <[email protected]<mailto: >>> [email protected]>> wrote: >>> >>> From: Fahad Khan <[email protected]<mailto:[email protected]>> >>> >>> Subject: [j-nsp] Traffic drops on IPSEC - SRX3600 >>> To: <mailto:[email protected]> [email protected] >>> <mailto:[email protected]> >>> >>> Date: Monday, August 2, 2010, 4:48 AM >>> Hi folks, >>> >>> I am seeing very strange issue on SRX3600 when the traffic >>> is flown through >>> an IPSEC VPN tunnel (established with ISG2000), the tunnel >>> gets up and the >>> traffic flows properly, but suddenly traffic drops, while >>> the tunnel remains >>> up. >>> >>> And it continues to flow after 15 to 20 time out but again >>> it starts >>> droping. I am sure that there is no issue at physical >>> layer. >>> >>> Has any body faced it yet?? >>> >>> Please reply ASAP. >>> >>> Thanks in adv >>> >>> regards >>> Muhammad Fahad Khan >>> JNCIP - M/T # 834 >>> IT Specialist >>> Global Technology Services, IBM >>> [email protected]<mailto:[email protected]> >>> >>> +92-301-8247638 >>> Skype: fahad-ibm >>> http://pk.linkedin.com/in/muhammadfahadkhan >>> _______________________________________________ >>> juniper-nsp mailing list <mailto:[email protected]> >>> [email protected]<mailto:[email protected]> >>> >>> https://puck.nether.net/mailman/listinfo/juniper-nsp >>> >>> >>> _______________________________________________ >>> juniper-nsp mailing list <mailto:[email protected]> >>> [email protected]<mailto:[email protected]> >>> >>> https://puck.nether.net/mailman/listinfo/juniper-nsp >>> _______________________________________________ >>> juniper-nsp mailing list [email protected] >>> https://puck.nether.net/mailman/listinfo/juniper-nsp >>> >> >> >> >> -- >> Best Regards! >> >> Ivan Ivanov >> > _______________________________________________ > juniper-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/juniper-nsp > _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
