某局点SecPath F5010(V7) 带宽策略限速后出现SSL VPN丢包的经验案例

不涉及

代理商反馈SSL VPN用户接入后，配置下面的带宽策略之后访问内网资源web界面会出现卡顿，后续测试ping SSL VPN的AC接口会出现丢包，但ping公网口正常。

 <F5010>dis cpu

Slot 1 CPU 0 CPU usage:

       2% in last 5 seconds

       3% in last 1 minute

       2% in last 5 minutes

Slot 2 CPU 0 CPU usage:

       1% in last 5 seconds

       2% in last 1 minute

       2% in last 5 minutes

 <F5010>display memory

Memory statistics are measured in KB:

Slot 1:

             Total      Used      Free    Shared   Buffers    Cached   FreeRatio

Mem:      16375296   5703872  10671424         0      3136    359964       65.9%

-/+ Buffers/Cache:   5340772  11034524

Swap:           0         0         0

Slot 2:

             Total      Used      Free    Shared   Buffers    Cached   FreeRatio

Mem:      16375296   5713736  10661560         0      6412    598240       67.3%

-/+ Buffers/Cache:   5109084  11266212

Swap:           0         0         0

2、当前设备版本Release 9330P17，未见版本bug

3、取消下列带宽策略后访问正常，问题定位

[F5010]display interface SSLVPN-AC 1                          

SSLVPN-AC1                                                                     

Current state: UP                                                              

Line protocol state: DOWN                                                      

Description: SSLVPN-AC0 Interface                                               

Bandwidth:64kbps                                                             

Maximum transmission unit: 1500                                                

Internet protocol processing: Disabled                                         

Link layer protocol is SSLVPN                                                  

Last clearing of counters: Never                                               

Last 300 seconds input rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec            

Last 300 seconds output rate: 0 bytes/sec, 0 bits/sec, 0 packets/sec           

Input: 0 packets, 0 bytes, 0 drops                                             

Output: 0 packets, 0 bytes, 0 drops

通过修改SSL-VPN AC接口的参考带宽，问题解决。