Доброго времени суток!
Есть два SRX240H в кластере. Создано две группы избыточности (аплинк и даунлинк), в каждой из которых по четыре агрегированных линка (LACP). По факту, получаем канал в 2Gbps.
Проблема заключается в том, что SRX никак не хочет прокачивать через себя более 800Mbps (для замера использовался iperf). При этом, создана всего одна политика, которая разрешает все, выключены всевозможные IDS и прочие плюшки безопасности.
Проблема однозначно не в том, что мы упираемся в ширину одного канала, так как запустив с другого узла iperf, наши максимум 800Mbps равномерно размазываются по двум линкам. При этом, мы упираемся в процессор.
Собственно, вот как выглядит статистика интерфейсов:
ge-0/0/12 Up 321691451114 (2213144) 17918952891543 (463683024)
ge-0/0/13 Up 294040710631 (2800072) 35218610586628 (314543088)
ge-0/0/14 Up 17695752558858 (463147432) 302082471944 (5009608)
ge-0/0/15 Up 17607647812408 (314804488) 302044102698 (0)
Статистика по одному из интерфейсов выглядит так:
srx240-0 Seconds: 10 Time: 13:16:59
Delay: 0/0/26
Interface: reth1, Enabled, Link is Up
Encapsulation: Ethernet, Speed: 2000mbps
Traffic statistics: Current delta
Input bytes: 4114701162 (4859728 bps) [5932380]
Output bytes: 426401841869 (785199208 bps) [990003188]
Input packets: 75195903 (11674 pps) [114024]
Output packets: 288479021 (68159 pps) [687504]
Error statistics:
Input errors: 0 [0]
Input drops: 0 [0]
Input framing errors: 0 [0]
Carrier transitions: 0 [0]
Output errors: 0 [0]
Output drops: 0 [0]
RE не нагружен:
root@srx240-0# run show chassis routing-engine
node0:
--------------------------------------------------------------------------
Routing Engine status:
Temperature 47 degrees C / 116 degrees F
CPU temperature 45 degrees C / 113 degrees F
Total memory 1024 MB Max 799 MB used ( 78 percent)
Control plane memory 544 MB Max 479 MB used ( 88 percent)
Data plane memory 480 MB Max 322 MB used ( 67 percent)
CPU utilization:
User 7 percent
Background 0 percent
Kernel 11 percent
Interrupt 0 percent
Idle 82 percent
Model RE-SRX240H
Serial ID AAAR1824
Start time 2016-02-11 11:28:11 UTC
Uptime 18 days, 1 hour, 35 minutes, 1 second
Last reboot reason 0x1:power cycle/failure
Load averages: 1 minute 5 minute 15 minute
0.25 0.34 0.36
node1:
--------------------------------------------------------------------------
Routing Engine status:
Temperature 44 degrees C / 111 degrees F
CPU temperature 43 degrees C / 109 degrees F
Total memory 1024 MB Max 737 MB used ( 72 percent)
Control plane memory 544 MB Max 413 MB used ( 76 percent)
Data plane memory 480 MB Max 322 MB used ( 67 percent)
CPU utilization:
User 6 percent
Background 0 percent
Kernel 6 percent
Interrupt 0 percent
Idle 89 percent
Model RE-SRX240H
Serial ID AAAR1744
Start time 2016-02-11 11:16:17 UTC
Uptime 18 days, 1 hour, 34 minutes, 43 seconds
Last reboot reason 0x1:power cycle/failure
Load averages: 1 minute 5 minute 15 minute
0.04 0.07 0.08
А вот так вот выглядит нагрузка на FPC:
root@srx240-0# run show security monitoring performance spu
node0:
--------------------------------------------------------------------------
fpc 0 pic 0
Last 60 seconds:
0: 99 1: 99 2: 99 3: 99 4: 99 5: 99
6: 99 7: 81 8: 0 9: 0 10: 0 11: 0
12: 0 13: 0 14: 0 15: 0 16: 0 17: 0
18: 0 19: 0 20: 0 21: 0 22: 0 23: 0
24: 0 25: 0 26: 0 27: 0 28: 0 29: 0
30: 0 31: 0 32: 0 33: 0 34: 0 35: 0
36: 0 37: 0 38: 0 39: 0 40: 0 41: 0
42: 0 43: 0 44: 0 45: 0 46: 51 47: 99
48: 99 49: 99 50: 99 51: 99 52: 99 53: 99
54: 99 55: 99 56: 99 57: 99 58: 99 59: 99
node1:
--------------------------------------------------------------------------
fpc 0 pic 0
Last 60 seconds:
0: 0 1: 0 2: 0 3: 0 4: 0 5: 0
6: 0 7: 0 8: 0 9: 0 10: 0 11: 0
12: 0 13: 0 14: 0 15: 0 16: 0 17: 0
18: 0 19: 0 20: 0 21: 0 22: 0 23: 0
24: 0 25: 0 26: 0 27: 0 28: 0 29: 0
30: 0 31: 0 32: 0 33: 0 34: 0 35: 0
36: 0 37: 0 38: 0 39: 0 40: 0 41: 0
42: 0 43: 0 44: 0 45: 0 46: 0 47: 0
48: 0 49: 0 50: 0 51: 0 52: 0 53: 0
54: 0 55: 0 56: 0 57: 0 58: 0 59: 0
root@srx240-0# run show security monitoring fpc 0
node0:
--------------------------------------------------------------------------
FPC 0
PIC 0
CPU utilization : 99 %
Memory utilization : 67 %
Current flow session : 10
Current flow session IPv4: 10
Current flow session IPv6: 0
Max flow session : 131072
Total Session Creation Per Second (for last 96 seconds on average): 0
IPv4 Session Creation Per Second (for last 96 seconds on average): 0
IPv6 Session Creation Per Second (for last 96 seconds on average): 0
node1:
--------------------------------------------------------------------------
FPC 0
PIC 0
CPU utilization : 0 %
Memory utilization : 67 %
Current flow session : 10
Current flow session IPv4: 10
Current flow session IPv6: 0
Max flow session : 131072
Total Session Creation Per Second (for last 96 seconds on average): 0
IPv4 Session Creation Per Second (for last 96 seconds on average): 0
IPv6 Session Creation Per Second (for last 96 seconds on average): 0
Что интересно, при запуске iperf начинает расти
Packets dropped:
{primary:node0}[edit]
root@srx240-0# run show security flow statistics | match dro
Packets dropped: 238068
Packets dropped: 18902
{primary:node0}[edit]
root@srx240-0# run show security flow statistics | match dro
Packets dropped: 238071
Packets dropped: 18902
{primary:node0}[edit]
root@srx240-0# run show security flow statistics | match dro
Packets dropped: 238071
Packets dropped: 18902
При это в flow-statistics ничего интересного нет:
root@srx240-0# run show interfaces flow-statistics reth1
Physical interface: reth1, Enabled, Physical link is Up
Link-level type: Ethernet, MTU: 1514, Speed: 2Gbps, BPDU Error: None,
...
Logical interface reth1.0 (Index 98) (SNMP ifIndex 619)
Flow error statistics (Packets dropped due to):
Address spoofing: 0
Authentication failed: 0
Incoming NAT errors: 0
Invalid zone received packet: 0
Multiple user authentications: 0
Multiple incoming NAT: 0
No parent for a gate: 0
No one interested in self packets: 0
No minor session: 0
No more sessions: 0
No NAT gate: 0
No route present: 3
No SA for incoming SPI: 0
No tunnel found: 0
No session for a gate: 0
No zone or NULL zone binding 0
Policy denied: 0
Security association not active: 0
TCP sequence number out of window: 0
Syn-attack protection: 0
User authentication errors: 0
Подскажите, что я делаю не так, учитывая, что фаерволл не нагружен сложными настройками, а производитель заявил производительность порядка 1,8Gbps?
Простой
Простой
