Плохая производительность 3925E

Добрый день коллеги.

Решили заменить оборудование (на ISR-G2), ознакомился с рекомендациями от вендора

ISR G2 3925 :

Fast/CEF Switching - 833,000 pps
426.49 Mbps

IPSec Maximum Performance by Platform:

IPSec Mbps (SEC + HSEC license): 1494

Encrypted Tunnel Count by Platform:

HSEC license IPSec VPN tunnels : 3000

###

Total:

NAT + QoS + ACL Performance by Platform, IMIX Traffic at 75-Percent CPU

Cisco 3925E - 534 Mbps

###

На данный момент апстримы у нас 200 Mbit/s, DMVPN хабы терминируют ~ 100 споков, в планах больше и данного оборудования хватает за глаза.

В итоге поставили 3925E + HSEC.
(функционал на данный момент: DMVPN + LLQ + eigrp + acl + NAT/PAT и прочее..)

NAME: "CISCO3925-CHASSIS", DESCR: "CISCO3925-CHASSIS"
PID: CISCO3925-CHASSIS , VID: V02 , SN: FTX1448AHZM

NAME: "Cisco Services Performance Engine 200 for Cisco 3900 ISR on Slot 0", DESCR: "Cisco Services Performance Engine 200 for Cisco 3900 ISR"
PID: C3900-SPE200/K9 , VID: V01 , SN: FOC14454S08

Тестирую SNAT через www.speedtest.net получаю очень маленькие цифры ~ 90Mbit/s в лучшем случае...
Схема стенда простая:

PC ---> core1 (3750_stack) ----> WAN1 и WAN2----BR1 и BR2
(везде линки гигабитные)

При этом если трафик гонять через прокси на этих же каналах, всё ок ~ 185 Mbit/s.

схема простая: proxy---BR1 и BR2--internet

(проблема получается между PC ---core1---wan1 и wan2)

На всех интерфейсах стоит : speed/duplex - auto, везде определяется 1000/full, ошибок нет, в очередях есть дропы:

# основной WAN1 hub

root@noc:~ # rsh wan1 "sh int gi0/2 | i Du"
Full Duplex, 1Gbps, media type is RJ45

root@noc:~ # rsh wan1 "sh int gi0/2 | i err"
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
4183994774 packets output, 3852396711 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred

Input queue: 0/75/381061/18701542 (size/max/drops/flushes); Total output drops: 34203
Queueing strategy: Class-based queueing

root@noc:~ # rsh wan1 "sh int gi0/0 | i Du"
Full Duplex, 1Gbps, media type is RJ45

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
1395450296 packets output, 2081682188 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred

Input queue: 0/75/230/48372 (size/max/drops/flushes); Total output drops: 89582
Queueing strategy: Class-based queueing

# резервный WAN2 hub

root@noc:~ # rsh wan2 "sh int gi0/0 | i Du"
Full Duplex, 1Gbps, media type is RJ45

root@noc:~ # rsh wan2 "sh int gi0/0 | i err"
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
88332376 packets output, 3996897097 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred

Input queue: 0/75/914/7646 (size/max/drops/flushes); Total output drops: 4
Queueing strategy: Class-based queueing

root@noc:~ # rsh wan2 "sh int gi0/2 | i Du"

Full Duplex, 1Gbps, media type is RJ45

root@noc:~ # rsh wan2 "sh int gi0/2 | i err"
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
985258885 packets output, 2142210198 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred

Input queue: 0/75/19666/1391422 (size/max/drops/flushes); Total output drops: 20856
Queueing strategy: Class-based queueing

Утилизации CPU особа нет:

root@noc:~vadim/NEW_LIC # rsh wan1 "sh proc cpu | ex 0.00"

CPU utilization for five seconds: 21%/18%; one minute: 19%; five minutes: 19%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
33 1051470 66505351 15 0.15% 0.06% 0.05% 0 ARP Input
86 6451154 3080365 2094 0.23% 0.23% 0.23% 0 Per-Second Jobs
123 31180070 414197476 75 2.15% 1.88% 1.89% 0 IP Input
376 93620 688335 136 0.03% 0.02% 0.03% 0 Multicast Replic
379 750860 6519554 115 0.51% 0.32% 0.20% 0 IP NAT Ager
394 465408 25458742 18 0.11% 0.04% 0.04% 0 EIGRP-IPv4

root@noc:~vadim/NEW_LIC # rsh wan2 "sh proc cpu | ex 0.00"

CPU utilization for five seconds: 5%/2%; one minute: 6%; five minutes: 5%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
3 32 7 4571 0.63% 0.05% 0.01% 578 SSH Process
86 6242444 3107692 2008 0.19% 0.19% 0.19% 0 Per-Second Jobs
123 25145378 361678993 69 1.51% 1.71% 1.72% 0 IP Input
301 398462 43377726 9 0.03% 0.02% 0.02% 0 Crypto IKE Dispa

# rsh wan1 sh ver
Cisco IOS Software, C3900e Software (C3900e-UNIVERSALK9-M), Version 15.3(1)T, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Mon 26-Nov-12 18:34 by prod_rel_team

ROM: System Bootstrap, Version 15.1(1r)T2, RELEASE SOFTWARE (fc1)

ru-msk-edge-wan1 uptime is 5 weeks, 15 hours, 36 minutes
System returned to ROM by reload at 23:06:41 MSK Mon Apr 14 2014
System restarted at 23:08:30 MSK Mon Apr 14 2014
System image file is "flash:c3900e-universalk9-mz.SPA.153-1.T.bin"
Last reload type: Normal Reload
Last reload reason: Reload Command

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco CISCO3925-CHASSIS (revision 1.0) with C3900-SPE200/K9 with 756736K/291840K bytes of memory.
Processor board ID FTX1448AHZM
4 Gigabit Ethernet interfaces
1 Virtual Private Network (VPN) Module
DRAM configuration is 72 bits wide with parity enabled.
256K bytes of non-volatile configuration memory.
254464K bytes of ATA System CompactFlash 0 (Read/Write)

License Info:

License UDI:

-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 C3900-SPE200/K9 FOC14454S08

Technology Package License Information for Module:'c3900e'

-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
ipbase ipbasek9 Permanent ipbasek9
security securityk9 Permanent securityk9
uc None None None
data None None None

Configuration register is 0x2102

У кого есть мысли, куда смотреть ?