Добрый день коллеги!

Интересная проблема,
Есть в Бренч-офисе Cisco 1841 128/32 с модулем HWIC-4ESW.
На ней терминируется GRE over IPSec с HQ.
А так же она является PPTP сервером для одной станции из HQ (через GRE туннель).

При интенсивном трафике с быстрого хоста через туннель PPTP из ЦО в бренч (~300-400kbyte/s) обрываются сессии с менее скоростных хостов. Т.е. трафик идет с доминирующего хоста. Ес-но загрузка CPU при этом составляет под 100%. Процесс, который лидирует в списке show proc cpu so 5m: L2X Data Daemon.

Задаюсь вопросом, почему маршрутизатор не разделяет сессии поровну, а обрывает их?

Т.е. задача не в том, чтобы выжать мегабайт в секунду с 18-серии, пусть 100 килобайт в секунду, но без обрывов соединений.

Как можно оптимизировать сие детище? Где копать?
Переходить на более взрослую серию не предлагать :-)

Ниже конфиг:

version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname gw
!
boot-start-marker
boot system flash c1841-advipservicesk9-mz.124-21.bin
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 informational
!
aaa new-model
!
!
aaa authentication ppp default local
!
aaa session-id common
clock timezone MSK 4
clock summer-time Russia date Mar 30 2003 4:00 Oct 26 2003 5:00
ip cef
!
!
!
!
ip name-server 172.16.1.1
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
vpdn enable
!
vpdn-group 10
! Default PPTP VPDN group
  accept-dialin
    protocol pptp
    virtual-template 1
!
l2tp-class corbina
!
!
!
!
username user1 password 7 XXXXXXXXXXX
!
!
pseudowire-class class1
  encapsulation l2tpv2
  protocol l2tpv2 corbina
  ip local interface FastEthernet0/0
!
!
!
crypto isakmp policy 10
  encr aes
  authentication pre-share
  group 2
crypto isakmp key XXXXXX address 11.11.11.11
crypto isakmp key XXXXXX address 12.12.12.12
!
!
crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac
!
crypto map SRT 10 ipsec-isakmp
  set peer 11.11.11.11 default
  set peer 12.12.12.12
  set transform-set ESP-AES-SHA
  match address 102
!
!
!
interface Loopback0
  description Loopback interface for GRE p2p tunnel
  ip address 172.30.0.2 255.255.255.255
!
interface Tunnel0
  description Tunnel to Cisco 2851 (Moscow)
  bandwidth 10240
  ip address 172.28.254.6 255.255.255.252
  ip access-group 140 in
  ip access-group 140 out
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip nat outside
  no ip virtual-reassembly
  tunnel source Loopback0
  tunnel destination 172.30.0.1
!
interface FastEthernet0/0
  description CORBINA_LAN
  no ip dhcp client request dns-nameserver
  ip address dhcp
  ip access-group 120 in
  ip access-group 120 out
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  duplex auto
  speed auto
  no cdp enable
!
interface FastEthernet0/1
  no ip address
  shutdown
  duplex auto
  speed auto
  no cdp enable
!
interface FastEthernet0/0/0
!
interface FastEthernet0/0/1
!
interface FastEthernet0/0/2
!
interface FastEthernet0/0/3
!
interface Virtual-PPP1
  description CORBINA_L2TP
  ip address negotiated
  ip access-group 130 in
  ip access-group 130 out
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip mtu 1460
  ip nat outside
  no ip virtual-reassembly
  ip tcp adjust-mss 1460
  no cdp enable
  ppp chap hostname usr
  ppp chap password 7 XXXXX
  pseudowire 85.21.0.250 10 pw-class class1
  crypto map SRT
!
interface Virtual-Template1
  ip unnumbered Tunnel0
  ip access-group 150 in
  ip access-group 151 out
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip mtu 1328
  ip nat inside
  no ip virtual-reassembly
  ip tcp adjust-mss 1320
  peer default ip address pool VPN
  ppp authentication ms-chap-v2
!
interface Vlan1
  description HOME_LAN
  ip address 172.16.1.5 255.255.0.0
  ip access-group 110 in
  ip access-group 111 out
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip nat inside
  no ip virtual-reassembly
!
router eigrp 10
  passive-interface default
  no passive-interface Tunnel0
  network 172.28.0.0
  network 172.29.0.0
  no auto-summary
!
ip local pool VPN 192.168.2.1 192.168.2.2
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Virtual-PPP1
ip route 85.21.0.0 255.255.255.0 dhcp
ip route 10.0.0.0 255.0.0.0 dhcp
!
!
no ip http server
no ip http secure-server
ip nat inside source list 101 interface Virtual-PPP1 overload
ip nat inside source list 103 interface Tunnel0 overload
!
access-list 1 permit 172.16.0.0 0.0.255.255
access-list 2 permit 172.16.1.4
access-list 101 remark INET_NAT
access-list 101 deny ip 172.16.0.0 0.0.255.255 172.28.0.0 0.1.255.255
access-list 101 permit ip 172.16.0.0 0.0.255.255 any
access-list 101 permit ip 192.168.2.0 0.0.0.3 any
access-list 102 remark GRE
access-list 102 permit ip host 172.30.0.2 host 172.30.0.1
access-list 103 remark WORK_NAT
access-list 103 permit ip 172.16.0.0 0.0.255.255 172.28.0.0 0.1.255.255
access-list 110 remark Filter HOME_LAN In
access-list 110 permit udp host 172.16.1.1 any
access-list 110 permit ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
access-list 110 permit ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.255.255
access-list 110 permit ip host 172.16.1.4 any
access-list 110 permit ip 172.16.0.0 0.0.255.255 172.28.0.0 0.1.255.255
access-list 110 permit tcp host 172.16.1.1 host 207.38.11.174
access-list 110 deny ip any any log
access-list 111 remark Filter HOME_LAN Out
access-list 111 permit udp any host 172.16.1.1
access-list 111 permit ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
access-list 111 permit ip 192.168.0.0 0.0.255.255 172.16.0.0 0.0.255.255
access-list 111 permit ip any host 172.16.1.4
access-list 111 permit ip 172.28.0.0 0.1.255.255 172.16.0.0 0.0.255.255
access-list 111 permit tcp host 207.38.11.174 host 172.16.1.1
access-list 111 deny ip any any log
access-list 120 remark Filter CORBINA_LAN
access-list 120 deny tcp any eq 1723 any
access-list 120 deny tcp any any eq 1723
access-list 120 deny ip any 172.16.0.0 0.15.255.255 log-input
access-list 120 deny ip 172.16.0.0 0.15.255.255 any log-input
access-list 120 deny ip any 192.168.0.0 0.0.255.255 log-input
access-list 120 deny ip 192.168.0.0 0.0.255.255 any log-input
access-list 120 permit ip any any
access-list 130 remark Filter INET
access-list 130 deny udp any range netbios-ns netbios-ss any
access-list 130 deny udp any eq 445 any
access-list 130 deny udp any any range netbios-ns netbios-ss
access-list 130 deny udp any any eq 445
access-list 130 deny tcp any eq 139 any
access-list 130 deny tcp any eq 445 any
access-list 130 deny tcp any eq 1723 any
access-list 130 deny tcp any any eq 139
access-list 130 deny tcp any any eq 445
access-list 130 deny tcp any any eq 1723
access-list 130 deny ip any 10.0.0.0 0.255.255.255 log-input
access-list 130 deny ip 10.0.0.0 0.255.255.255 any log-input
access-list 130 deny ip any 172.16.0.0 0.15.255.255 log-input
access-list 130 deny ip 172.16.0.0 0.15.255.255 any log-input
access-list 130 deny ip any 192.168.0.0 0.0.255.255 log-input
access-list 130 deny ip 192.168.0.0 0.0.255.255 any log-input
access-list 130 deny udp any any eq bootpc log-input
access-list 130 deny udp any eq bootpc any log-input
access-list 130 permit ip any any
access-list 140 remark Filter WORK
access-list 140 deny udp any range netbios-ns netbios-ss any
access-list 140 deny udp any eq 445 any
access-list 140 deny udp any any range netbios-ns netbios-ss
access-list 140 deny udp any any eq 445
access-list 140 deny tcp any eq 139 any
access-list 140 deny tcp any eq 445 any
access-list 140 deny tcp any any eq 139
access-list 140 deny tcp any any eq 445
access-list 140 deny udp any any eq bootpc
access-list 140 deny udp any eq bootpc any
access-list 140 permit ip 172.28.0.0 0.1.255.255 172.28.0.0 0.1.255.255
access-list 140 permit eigrp any any
access-list 140 deny ip any any log-input
access-list 150 remark Filter PPTP In
access-list 150 deny udp any range netbios-ns netbios-ss any
access-list 150 deny udp any eq 445 any
access-list 150 deny udp any any range netbios-ns netbios-ss
access-list 150 deny udp any any eq 445
access-list 150 deny tcp any eq 139 any
access-list 150 deny tcp any eq 445 any
access-list 150 deny tcp any any eq 139
access-list 150 deny tcp any any eq 445
access-list 150 deny udp any any eq bootpc
access-list 150 deny udp any eq bootpc any
access-list 150 permit ip 192.168.0.0 0.0.255.255 172.16.0.0 0.0.255.255
access-list 150 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
access-list 150 permit udp host 192.168.2.1 any
access-list 150 permit tcp host 192.168.2.1 any
access-list 150 deny ip any any log-input
access-list 151 remark Filter PPTP Out
access-list 151 deny udp any range netbios-ns netbios-ss any
access-list 151 deny udp any eq 445 any
access-list 151 deny udp any any range netbios-ns netbios-ss
access-list 151 deny udp any any eq 445
access-list 151 deny tcp any eq 139 any
access-list 151 deny tcp any eq 445 any
access-list 151 deny tcp any any eq 139
access-list 151 deny tcp any any eq 445
access-list 151 deny udp any any eq bootpc
access-list 151 deny udp any eq bootpc any
access-list 151 permit ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.255.255
access-list 151 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
access-list 151 permit udp any host 192.168.2.1
access-list 151 permit tcp any host 192.168.2.1
access-list 151 deny ip any any log-input
no cdp run
!
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
  access-class 1 in
  access-class 1 out
  transport preferred none
  transport input ssh
!
scheduler allocate 20000 1000
ntp clock-period 17178403
ntp access-group peer 2
ntp update-calendar
ntp server 172.16.1.1
end