MSR810使用ipsecVPN之后导致互联网tcp连接丢包严重

请教一下大佬们    msr810在使用ipsecVPN连接之后，使用ping命令检查互联网比如百度都是正常的，但是如果使用tcpping命令去检查，不定时出现间接或则持续丢包，导致打开网页失败或者打开网页非常慢。

组网方式：电信光猫下挂810路由器和一个傻瓜交换机   810拨ipsecVPN，有问题时整个出口都很慢 不仅仅只是810下挂的终端。

配置：

#

 version 7.1.064, Release 0615P20

#

 sysname DM-Network

#

 clock timezone 8 add 08:00:00

 clock protocol ntp

#

wlan global-configuration

#

 dns server 223.5.5.5

#

 undo password-recovery enable

#

vlan 1

#

vlan 10

#

#

controller Cellular0/0

#

controller Cellular1/0

 eth-channel 0

#

interface NULL0

#

#

interface GigabitEthernet0/0

 port link-mode route

 mtu 1400

 ip address 192.168.1.252 255.255.255.0

 tcp mss 1200

 nat outbound 3010

 ipsec apply policy bg10

#

interface GigabitEthernet0/1

 port link-mode route

 ip address 172.16.100.254 255.255.255.0

#

interface GigabitEthernet0/5

 port link-mode route

#

interface GigabitEthernet0/2

 port link-mode bridge

#

interface GigabitEthernet0/3

 port link-mode bridge

#

interface GigabitEthernet0/4

 port link-mode bridge

#

interface Eth-channel1/0:0

 tcp mss 1024

#

 scheduler logfile size 16

#

line class console

 user-role network-admin

#              

line class tty

 user-role network-operator

#

line class usb

 user-role network-admin

#

line class vty

 user-role network-operator

#

line con 0

 authentication-mode scheme

 user-role network-admin

#

line vty 0 4

 authentication-mode scheme

 user-role level-15

 user-role network-admin

 user-role network-operator

#

line vty 5 63

 user-role network-operator

#

 ip route-static 0.0.0.0 0 192.168.1.1

#

 ssh server enable

#

 ntp-service enable

 ntp-service unicast-server ***.***

#

acl advanced 3001

 rule 0 permit ip source 172.16.100.0 0.0.0.255

#

acl advanced 3010

 rule 5 deny ip source 172.16.100.0 0.0.0.255 destination 172.18.9.0 0.0.0.255

 rule 10 deny ip source 172.16.100.0 0.0.0.255 destination 192.168.100.0 0.0.0.255

 rule 15 deny ip source 172.16.100.0 0.0.0.255 destination 10.10.10.0 0.0.0.255

 rule 100 permit ip

#

acl advanced 3011

#

domain system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#              

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

#

ipsec transform-set bg10

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha1 

#

ipsec policy bg10 18 isakmp

 transform-set bg10 

 security acl 3001 

 remote-address  58.16.5.8

 ike-profile bg10

 sa idle-time 120

#

ike profile bg10

 keychain bg10

 exchange-mode aggressive

 local-identity fqdn ***.***

 match remote identity fqdn ***.***

 proposal 18 

#

ike proposal 18

 encryption-algorithm aes-cbc-128

 dh group2

#

ike keychain bg10

 pre-shared-key address 58.16.5.8 255.255.255.255 key cipher $c$3$/epF+vXDAowffc0pcv1Shi7G2cnxtddMVNMdd==

#

wlan ap-group default-group

 vlan 1

#

return