подскажите пожалуйста, что нужно подправить в следующем конфиге:
- Код: Выделить всё
routing-options {
static {
route 0.0.0.0/0 next-hop шлюз_провайдера;
route 192.168.30.0/24 next-hop st0.0;
}
}
security {
ike {
policy ike-policy-stskuba {
mode aggressive;
proposal-set standard;
pre-shared-key ascii-text "ключик"; ##
SECRET-DATA
}
gateway ike-gate-stskuba {
ike-policy ike-policy-stskuba;
address Remote_external_IP;
external-interface ge-0/0/0;
}
}
ipsec {
policy ipsec-policy-stskuba {
perfect-forward-secrecy {
keys group2;
}
proposal-set standard;
}
vpn ipsec-vpn-stskuba {
bind-interface st0.0;
ike {
gateway ike-gate-stskuba;
ipsec-policy ipsec-policy-stskuba;
}
establish-tunnels immediately;
}
}
- Код: Выделить всё
show security ike security-associations detail
IKE peer Remote_IP, Index 79,
Role: Responder, State: UP
Initiator cookie: 15bf76752c6655ce, Responder cookie: c81c0009571a3fcc
Exchange type: Aggressive, Authentication method: Pre-shared-keys
Local: Local_IP:500, Remote: Remote_IP:500
Lifetime: Expires in 25106 seconds
Peer ike-id: Remote_IP
Xauth assigned IP: 0.0.0.0
Algorithms:
Authentication : sha1
Encryption : 3des-cbc
Pseudo random function: hmac-sha1
- Код: Выделить всё
show security ipsec security-associations detail
Virtual-system: root
Local Gateway: Local_IP, Remote Gateway: Remote_IP
Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
DF-bit: clear
Direction: inbound, SPI: be197135, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 2922 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 2321 seconds
Mode: tunnel, Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
соотно на втором джунипере тоже самое, только с другими адресами.
проблема:
результаты iperf'а через этот туннель удручающие:
- Код: Выделить всё
C:\jperf-2.0.0\bin>iperf.exe -c 192.168.30.5 -P 10 -n 100000000
------------------------------------------------------------
Client connecting to 192.168.30.5, TCP port 5001
TCP window size: 8.00 KByte (default)
------------------------------------------------------------
[1316] local 172.16.0.69 port 49536 connected with 192.168.30.5 port 5001
[1304] local 172.16.0.69 port 49535 connected with 192.168.30.5 port 5001
[1292] local 172.16.0.69 port 49534 connected with 192.168.30.5 port 5001
[1280] local 172.16.0.69 port 49533 connected with 192.168.30.5 port 5001
[1268] local 172.16.0.69 port 49532 connected with 192.168.30.5 port 5001
[1256] local 172.16.0.69 port 49531 connected with 192.168.30.5 port 5001
[1244] local 172.16.0.69 port 49530 connected with 192.168.30.5 port 5001
[1232] local 172.16.0.69 port 49529 connected with 192.168.30.5 port 5001
[1220] local 172.16.0.69 port 49528 connected with 192.168.30.5 port 5001
[1208] local 172.16.0.69 port 49527 connected with 192.168.30.5 port 5001
[ ID] Interval Transfer Bandwidth
[1304] 0.0-161.5 sec 95.4 MBytes 4.95 Mbits/sec
[1220] 0.0-161.7 sec 95.4 MBytes 4.95 Mbits/sec
[1268] 0.0-166.5 sec 95.4 MBytes 4.81 Mbits/sec
[1232] 0.0-167.1 sec 95.4 MBytes 4.79 Mbits/sec
[1316] 0.0-169.4 sec 95.4 MBytes 4.72 Mbits/sec
[1280] 0.0-169.6 sec 95.4 MBytes 4.72 Mbits/sec
[1256] 0.0-170.0 sec 95.4 MBytes 4.71 Mbits/sec
[1292] 0.0-172.5 sec 95.4 MBytes 4.64 Mbits/sec
[1244] 0.0-173.5 sec 95.4 MBytes 4.61 Mbits/sec
[1208] 0.0-178.9 sec 95.4 MBytes 4.47 Mbits/sec
[SUM] 0.0-178.9 sec 954 MBytes 44.7 Mbits/sec
почему удручающие - да потому что рядом стоят Windows Server 2003+ISA 2006, на которых сейчас туннели подняты и там показания совсем другие:
- Код: Выделить всё
D:\jperf-2.0.0\bin>iperf.exe -c 192.168.0.7 -P 10 -n 100000000
------------------------------------------------------------
Client connecting to 192.168.0.7, TCP port 5001
TCP window size: 63.0 KByte (default)
------------------------------------------------------------
[1608] local 172.16.0.100 port 5383 connected with 192.168.0.7 port 5001
[1596] local 172.16.0.100 port 5382 connected with 192.168.0.7 port 5001
[1572] local 172.16.0.100 port 5380 connected with 192.168.0.7 port 5001
[1548] local 172.16.0.100 port 5378 connected with 192.168.0.7 port 5001
[1524] local 172.16.0.100 port 5376 connected with 192.168.0.7 port 5001
[1244] local 172.16.0.100 port 5373 connected with 192.168.0.7 port 5001
[1584] local 172.16.0.100 port 5381 connected with 192.168.0.7 port 5001
[1560] local 172.16.0.100 port 5379 connected with 192.168.0.7 port 5001
[1536] local 172.16.0.100 port 5377 connected with 192.168.0.7 port 5001
[1512] local 172.16.0.100 port 5375 connected with 192.168.0.7 port 5001
[ ID] Interval Transfer Bandwidth
[1596] 0.0-84.5 sec 95.4 MBytes 9.47 Mbits/sec
[1244] 0.0-85.0 sec 95.4 MBytes 9.41 Mbits/sec
[1584] 0.0-85.4 sec 95.4 MBytes 9.37 Mbits/sec
[1524] 0.0-85.9 sec 95.4 MBytes 9.32 Mbits/sec
[1572] 0.0-85.9 sec 95.4 MBytes 9.31 Mbits/sec
[1560] 0.0-86.3 sec 95.4 MBytes 9.28 Mbits/sec
[1548] 0.0-86.5 sec 95.4 MBytes 9.25 Mbits/sec
[1512] 0.0-87.0 sec 95.4 MBytes 9.19 Mbits/sec
[1608] 0.0-87.2 sec 95.4 MBytes 9.17 Mbits/sec
[1536] 0.0-87.5 sec 95.4 MBytes 9.15 Mbits/sec
[SUM] 0.0-87.5 sec 954 MBytes 91.5 Mbits/sec
так с Juniper'ами я новичок, то буду очень благодарен если напишите по шагам для нубов.
спасибо
