нашёл причину, в ACL, возможно в корявых ручках, поправьте если ошибка есть:
Код:
# ACL
create access_profile ip udp src_port_mask 0xFFFF profile_id 7
config access_profile profile_id 7 add access_id 1 ip udp src_port 67 port 1-24 deny
config access_profile profile_id 7 add access_id 25 ip udp src_port 67 port 25-26 permit priority 7 replace_dscp_with 48
create access_profile ip source_ip_mask 255.255.255.255 destination_ip_mask 255.0.0.0 profile_id 10
create access_profile ip destination_ip_mask 224.0.0.0 profile_id 41
config access_profile profile_id 41 add access_id 25 ip destination_ip 224.0.0.0 port 25-26 permit priority 5 replace_dscp_with 48
create access_profile ip destination_ip_mask 0.0.0.0 profile_id 254
disable cpu_interface_filtering
после добавления этих ACL в течении 2-4 часов загрузка CPU выростает до 60-75%, удалил, перегрузился уже вторые сутки как загрузка < 10% средняя 4-5%
Код:
# VLAN
disable asymmetric_vlan
config vlan default delete 1-26
config vlan default add untagged 25-26
config vlan default advertisement enable
create vlan Users tag 5
config vlan Users add tagged 25-26
config vlan Users add untagged 1-24
config vlan Users advertisement disable
create vlan Block tag 6
config vlan Block add tagged 25-26
config vlan Block advertisement disable
create vlan Private tag 7
config vlan Private add tagged 25-26
config vlan Private advertisement disable
create vlan NewUsers tag 8
config vlan NewUsers add tagged 25-26
config vlan NewUsers advertisement disable
create vlan InterNet-01 tag 201
config vlan InterNet-01 add tagged 25-26
config vlan InterNet-01 advertisement disable
create vlan InterNet-02 tag 202
config vlan InterNet-02 add tagged 25-26
config vlan InterNet-02 advertisement disable
disable gvrp
так же использую:
Код:
# DHCP_NETBIOS_FILTER
config filter netbios 1-26 state enable
config filter extensive_netbios 1-26 state enable
# IPBIND
config address_binding ip_mac ports 1-24 state enable
config address_binding ip_mac ports 1-24 allow_zeroip enable
config address_binding ip_mac ports 1-26 forward_dhcppkt enable
config address_binding ip_mac ports 1-24 state enable loose
enable address_binding acl_mode
enable address_binding trap_log
disable address_binding dhcp_snoop
# SNOOP
enable igmp_snooping
create igmp_snooping multicast_vlan V-01 4001
config igmp_snooping multicast_vlan V-01 member_port 1-24 source_port 25-26 state enable replace_source_ip 192.168.151.250
config igmp_snooping V-01 host_timeout 260 router_timeout 260 leave_timer 2 state enable
config igmp_snooping querier V-01 query_interval 125 max_response_time 10 robustness_variable 2
config igmp_snooping querier V-01 last_member_query_interval 1 state enable
config limited_multicast_addr ports 1-26 access deny state disable
# STP
config stp version mstp
config stp maxage 20 maxhops 20 forwarddelay 15 txholdcount 6 fbpdu enable
config stp priority 32768 instance_id 0
create stp instance_id 2
config stp instance_id 2 add_vlan 5-6,8,201-202,4001
config stp priority 32768 instance_id 2
create stp instance_id 3
config stp instance_id 3 add_vlan 7
config stp priority 32768 instance_id 3
config stp mst_config_id name TestNet revision_level 1
enable stp
config stp ports 1-24 externalCost auto hellotime 2 edge true p2p auto state enable
config stp ports 1-26 fbpdu disable
config stp ports 1-24 restricted_role true
config stp ports 1-26 restricted_tcn false
config stp mst_ports 1-26 instance_id 0 internalCost auto priority 128
config stp ports 25-26 externalCost auto hellotime 2 edge false p2p auto state enable
config stp ports 25-26 restricted_role false
config stp mst_ports 1-26 instance_id 2 internalCost auto priority 128
config stp mst_ports 1-26 instance_id 3 internalCost auto priority 128
Вход
Регистрация
FAQ
Поиск
.
)и даже раз в 5 минут сотрим MACи на портах...