MSR810-LM-WiNet,开机后cpu利用很高，没有接入业务

没有什么配置，就是插了个4g卡，上几个地址能上网就行了，这是备用链路，都没有流量产生，就是cpu就起来了

<D-XZL-2F-4G>disp cur # version 7.1.064, Release 0615P16 # sysname D-XZL-2F-4G # telnet server enable # ip load-sharing mode per-flow src-ip global # dhcp enable dhcp server always-broadcast # dns proxy enable dns server 222.21.192.8 # lldp global enable # password-recovery enable # vlan 1 # vlan 1112 # dhcp server ip-pool lan1 gateway-list 192.168.1.1 network 192.168.1.0 mask 255.255.255.0 dns-list 222.21.192.8 114.114.114.114 # controller Cellular0/0 # controller Cellular1/0 eth-channel 0 # interface Dialer0 mtu 1492 ppp chap password cipher $c$3$fy9s3vZ/HXXf2njzMjlYfoxEt8DLwmrjhA== ppp chap user 17339457721 ppp ipcp dns admit-any ppp ipcp dns request ppp pap local-user 17339457721 password cipher $c$3$6R4aiekP0fDeYUyY63LYK/k2TfHKIcf//w== dialer bundle enable dialer-group 10 dialer timer idle 0 dialer timer autodial 60 ip address ppp-negotiate tcp mss 1024 nat outbound 3001 # interface Dialer1 # interface Dialer2 # interface Dialer3 # interface Dialer4 # interface Dialer5 # interface Dialer6 # interface Dialer7 # interface Dialer8 # interface Dialer1023 # interface NULL0 # interface Vlan-interface1 ip address 192.168.1.1 255.255.255.0 tcp mss 1024 # interface Vlan-interface1112 ip address 172.168.100.1 255.255.255.0 tcp mss 1024 # interface GigabitEthernet0/0 port link-mode route # interface GigabitEthernet0/5 port link-mode route # interface GigabitEthernet0/1 port link-mode bridge # interface GigabitEthernet0/2 port link-mode bridge port access vlan 1112 # interface GigabitEthernet0/3 port link-mode bridge # interface GigabitEthernet0/4 port link-mode bridge # interface Eth-channel1/0:0 dialer circular enable dialer-group 10 dialer timer idle 0 dialer timer autodial 5 dialer number #777 autodial ip address cellular-alloc tcp mss 1024 nat outbound 3001 ipsec apply policy policy2 # scheduler logfile size 16 # line class console user-role network-admin # line class tty user-role network-operator # line class usb user-role network-operator # line class vty user-role network-operator # line con 0 user-role network-admin # line vty 0 4 authentication-mode scheme user-role network-admin user-role network-operator # line vty 5 63 authentication-mode scheme user-role network-operator # ip route-static 0.0.0.0 0 Eth-channel1/0:0 ip route-static 172.168.20.0 24 172.168.100.2 # acl advanced 3000 rule 0 permit ip source 172.168.100.0 0.0.0.255 destination 10.10.26.0 0.0.0.255 # acl advanced 3001 rule 0 deny ip source 172.168.100.0 0.0.0.255 destination 10.10.26.0 0.0.0.255 rule 5 permit ip # password-control enable undo password-control aging enable undo password-control history enable password-control length 6 password-control login-attempt 3 exceed lock-time 10 password-control update-interval 0 password-control login idle-time 0 password-control complexity user-name check # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage service-type telnet http authorization-attribute user-role network-admin # ipsec transform-set tran1 # ipsec transform-set tran2 esp encryption-algorithm aes-cbc-128 esp authentication-algorithm sha1 # ipsec policy policy2 1 isakmp transform-set tran2 security acl 3001 remote-address 61.163.127.93 ike-profile profile2 # ike identity fqdn D-XZL # ike profile profile2 keychain keychain2 exchange-mode aggressive local-identity fqdn D-XZL match remote identity address 61.163.127.93 255.255.255.255 proposal 2 # ike proposal 2 encryption-algorithm 3des-cbc authentication-algorithm md5 sa duration 60 # ike keychain keychain2 pre-shared-key address 61.163.127.93 255.255.255.255 key cipher $c$3$LA4ftjflB/l4iJ0ApPxHmlG6rwoaWLE= # ip http enable # wlan global-configuration nas-id 838852 # wlan ap-group default-group # cloud-management server domain oasis.h3c.com # return

我传文件把

undo ip load-sharing mode per-flow src-ip global

没这条命令啊

刚刚试了一下，把接口下得ipsec 策略删除掉就好了，可是跟这会有什么关系啊

ipsec流量大不大，ipsec需要CPU进行加密解密

全部配置发一下，是不是开启逐包转发了？

什么是逐包转发啊