想请教一下，三层交换机的转发速率。

二层一般都是满速，三层惨不忍睹

@trepwq 就是很卡，但是没有什么证据，明天看看 华为 售前有没有数据； 准备自己 测了，这种东西，估计别人不好意思拿出来。

三层和二层是两个指标的
我个人遇到的实际 CPU 负载在 70%的时候已经很饱和的在工作了,出现各种问题也很正常
你看一下 CPU 负载,在看一下出口负载.

核心交换机三层不是线速吗？？？线速都达不到的设备拿来放核心层？？？

@ixiaoyui N 年前， 公司在机房只有两三个柜， 现在 加到了 9 个，换交换机 有风险

什么型号呀，我帮你看看文档，版本发下？

别开玩笑了，10 年前的三层交换机，L2/L3 都是线速转发了。
如果是负载重，除非你们让交换机承担了很多访问控制的功能

@intoext #7 +1，或者拓扑变化、网络震荡导致动态路由之类的进程负载太重了。

@helijia21 S5700-52C-EI 做了堆叠

@intoext 没有设置 acl
@Tianao 没有动态路由， 路由表立都是 直连 和 静态

表现 就是 本地 ping 1.5ms ~ 2ms，然后 ssh 上去 很慢，找不到原因。
其次是

@CallMeReznov cpu 负载 30% 左右，

@Tianao
CIST topology change information
Number of topology changes :921
Time since last topology change :15 days 3h:39m:32s
Topology change initiator(notified) :GigabitEthernet0/0/1
Topology change last received from :0425-c529-60b0
Number of generated topologychange traps : 80
Number of suppressed topologychange traps: 4


似乎也没有 网络震荡

@ericbize 这个情况看起来有点玄学问题，建议先无脑刷一波版本，5700-EI 作核心大部分场景下完全 OK 啊。确定这个延迟不是接入层带来的吗？或者如果方便楼主贴下配置？

@Tianao

#
interface Vlanif1
#
interface Vlanif19
ip address 172.31.99.254 255.255.255.0
#
interface Vlanif20
ip address 172.31.100.248 255.255.255.0
#
interface Vlanif21
ip address 172.31.101.254 255.255.255.0
#
interface Vlanif308
ip address 172.18.1.254 255.255.255.0
#
interface Vlanif3700
ip address 172.18.2.225 255.255.255.224
#
interface MEth0/0/1
ip address 10.1.1.1 255.255.255.0
#
interface Eth-Trunk4
#
interface Eth-Trunk5
description to_emmm-emmm-002
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface Eth-Trunk6
description to_emmm_emmm_058
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface Eth-Trunk7
description to_emmm_emmm_017
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface Eth-Trunk8
description to_emmm_emmm_030
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface Eth-Trunk9
description to_emmm_emmm_037
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface Eth-Trunk10
description to_emmm_emmm_080
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface Eth-Trunk11
description to_emmm_emmm_081
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface Eth-Trunk12
description to_emmm_emmm_082
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 19 308
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 3700
port-mirroring to observe-port 1 inbound
port-mirroring to observe-port 1 outbound
#
interface GigabitEthernet0/0/3
eth-trunk 7
#
interface GigabitEthernet0/0/4
eth-trunk 8
#
interface GigabitEthernet0/0/5
eth-trunk 9
#
interface GigabitEthernet0/0/6
eth-trunk 10
#
interface GigabitEthernet0/0/7
eth-trunk 11
#
interface GigabitEthernet0/0/8
eth-trunk 12
#
interface GigabitEthernet0/0/9
#
interface GigabitEthernet0/0/10
shutdown
#
interface GigabitEthernet0/0/11
#
interface GigabitEthernet0/0/12
#
interface GigabitEthernet0/0/13
#
interface GigabitEthernet0/0/14
description toFTFW
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/15
#
interface GigabitEthernet0/0/16
description toShiJinFW(89)
port link-type access
port default vlan 3700
#
interface GigabitEthernet0/0/17
#
interface GigabitEthernet0/0/18
#
interface GigabitEthernet0/0/19
#
interface GigabitEthernet0/0/20
port link-type trunk
port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/21
#
interface GigabitEthernet0/0/22
#
interface GigabitEthernet0/0/23
#
interface GigabitEthernet0/0/24
#
interface GigabitEthernet0/0/25
#
interface GigabitEthernet0/0/26
#
interface GigabitEthernet0/0/27
#
interface GigabitEthernet0/0/28
#
interface GigabitEthernet0/0/29
#
interface GigabitEthernet0/0/30
#
interface GigabitEthernet0/0/31
#
interface GigabitEthernet0/0/32
#
interface GigabitEthernet0/0/33
#
interface GigabitEthernet0/0/34
#

@Tianao


interface GigabitEthernet0/0/35
port link-type access
port default vlan 308
#
interface GigabitEthernet0/0/36
port link-type access
port default vlan 308
#
interface GigabitEthernet0/0/37
#
interface GigabitEthernet0/0/38
port link-type access
port default vlan 308
#
interface GigabitEthernet0/0/39
#
interface GigabitEthernet0/0/40
description toWAF
port link-type access
port default vlan 20
#
interface GigabitEthernet0/0/41
port link-type trunk
#
interface GigabitEthernet0/0/42
port link-type access
port default vlan 20
#
interface GigabitEthernet0/0/43
eth-trunk 6
#
interface GigabitEthernet0/0/44
eth-trunk 5
#
interface GigabitEthernet0/0/45
#
interface GigabitEthernet0/0/46
#
interface GigabitEthernet0/0/47
#
interface GigabitEthernet0/0/48
shutdown
#
interface GigabitEthernet1/0/1
port link-type access
port default vlan 3700
#
interface GigabitEthernet1/0/2
#
interface GigabitEthernet1/0/3
eth-trunk 7
#
interface GigabitEthernet1/0/4
eth-trunk 8
#
interface GigabitEthernet1/0/5
eth-trunk 9
#
interface GigabitEthernet1/0/6
eth-trunk 10
#
interface GigabitEthernet1/0/7
eth-trunk 11
#
interface GigabitEthernet1/0/8
eth-trunk 12
#
interface GigabitEthernet1/0/9
#
interface GigabitEthernet1/0/10
#
interface GigabitEthernet1/0/11
#
interface GigabitEthernet1/0/12
#
interface GigabitEthernet1/0/13
#
interface GigabitEthernet1/0/14
#
interface GigabitEthernet1/0/15
#
interface GigabitEthernet1/0/16
#
interface GigabitEthernet1/0/17
#
interface GigabitEthernet1/0/18
#
interface GigabitEthernet1/0/19
#
interface GigabitEthernet1/0/20
#
interface GigabitEthernet1/0/21
#
interface GigabitEthernet1/0/22
#
interface GigabitEthernet1/0/23
#
interface GigabitEthernet1/0/24
#
interface GigabitEthernet1/0/25
#
interface GigabitEthernet1/0/26
#
interface GigabitEthernet1/0/27
#
interface GigabitEthernet1/0/28
#
interface GigabitEthernet1/0/29
#
interface GigabitEthernet1/0/30
#
interface GigabitEthernet1/0/31
#
interface GigabitEthernet1/0/32
#
interface GigabitEthernet1/0/33
#
interface GigabitEthernet1/0/34
port link-type access
port default vlan 20
#
interface GigabitEthernet1/0/35
#
interface GigabitEthernet1/0/36
port link-type access
port default vlan 3700
#
interface GigabitEthernet1/0/37
#
interface GigabitEthernet1/0/38
port default vlan 21
#
interface GigabitEthernet1/0/39
#
interface GigabitEthernet1/0/40
#
interface GigabitEthernet1/0/41
port link-type trunk
#
interface GigabitEthernet1/0/42
port link-type trunk
#
interface GigabitEthernet1/0/43
eth-trunk 6
#
interface GigabitEthernet1/0/44
eth-trunk 5
#
interface GigabitEthernet1/0/45
#
interface GigabitEthernet1/0/46
#
interface GigabitEthernet1/0/47
#
interface GigabitEthernet1/0/48
port link-type access
port default vlan 3700
#
interface NULL0
#
cpu-defend policy arpattcheck
auto-defend enable
auto-defend threshold 30
#
ip route-static 0.0.0.0 0.0.0.0 172.18.2.254
ip route-static 10.230.8.0 255.255.255.0 172.18.2.250
ip route-static 172.16.0.0 255.255.0.0 172.18.2.250
ip route-static 172.30.1.0 255.255.255.0 172.18.2.250
ip route-static 172.30.16.0 255.255.240.0 172.18.2.250
ip route-static 172.30.32.0 255.255.255.0 172.18.2.250
ip route-static 192.168.0.0 255.255.0.0 172.18.2.250
#
snmp-agent

stelnet server enable
ssh authentication-type default password
ssh client first-time enable
ssh client 172.18.2.227 assign rsa-key 172.18.2.227
ssh client 172.31.100.249 assign rsa-key 172.31.100.249
ssh client 172.31.100.250 assign rsa-key 172.31.100.250
ssh client 172.31.100.251 assign rsa-key 172.31.100.251
ssh client 172.31.100.66 assign rsa-key 172.31.100.66
#
cpu-defend-policy arpattcheck global
#
user-interface con 0

user-interface vty 0 4
authentication-mode aaa
user privilege level 15
protocol inbound all
user-interface vty 16 20
#
return

我这边思科的核心也是用了挺久，发现高峰时段负荷经常跑到 70-80 以上，内网也只是个简单三层环境，赶紧升级换了新设备就降到 10-20 正常了。

@ericbize 看到楼主使能了 cpu auto-defend，建议楼主使用
display cpu-defend statistics
display auto-port-defend statistics
display auto-port-defend attack-source
命令查看下是否有正常报文被误伤。

@lirno 线上环境，不是想换就换的啊；经费是一回事；服务暂停又是另外一回事了……

>display auto-port-defend att
Attack source table on MPU:
Total : 1
--------------------------------------------------------------------------------
Interface Vlan Protocol Expire(s) PacketRate(pps) LastAttackTime
--------------------------------------------------------------------------------
GE1/0/44 20 arp-request 165 10 2019-06-28 21:50:25
--------------------------------------------------------------------------------

display cpu-defend statistics
Statistics on slot 0:
--------------------------------------------------------------------------------
Packet Type Pass(Packet/Byte) Drop(Packet/Byte) Last-dropping-time
--------------------------------------------------------------------------------
arp-miss 121981498 2179095 2019-06-28 08:05:39
NA NA
arp-request 307021137 1414108 2019-03-06 21:45:16
NA NA
dns 89275 0 -
NA NA
fib-hit 9409 0 -
NA NA
ftp 84937 19 2019-04-15 16:15:23
NA NA
http 107546 0 -
NA NA
https 225246 3127 2019-06-15 08:55:35
NA NA
hw-tacacs 0 0 -
NA NA
icmp 2936317 0 -
NA NA
lnp 8003840 0 -
NA NA
ntp 304137 0 -
NA NA
radius 0 0 -
NA NA
snmp 500256 0 -
NA NA
ssh 411008 0 -
NA NA
tcp 1703945 133028 2019-06-28 08:05:39
NA NA
telnet 80136 0 -
NA NA
ttl-expired 13895550 11 2019-03-30 10:55:21
NA NA
vcmp 0 0 -
NA NA
--------------------------------------------------------------------------------

@Tianao

>display auto-port-defend ?
attack-source Attack source
configuration Current configuration

剩下那个，命令似乎没有

@ericbize 命令没有可能是版本问题吧，我也不太熟悉这块的命令……
不过从 #19、#20 的结果来看，貌似是有来自 GE1/0/44 VLAN20 的 ARP 报文被误伤了，虽然不能确定这个事件是否和现有问题有关，但还是建议楼主检查下这个接口来的报文，或者暂时关闭交换机的 ARP 自动防护功能。
除此以外，恕我无法看出楼主贴出的配置有其他可疑之处。

@Tianao 其实我们也一直在怀疑是 arp 攻击， 但是无奈于 虚拟机太多， 所以有点想 把核心换了

@erivbize
arp anti-attack gateway-duplicate enable
arp speed-limit source-ip maximum 500
arp-miss speed-limit source-ip maximum 100
arp 攻击的话可以用这三条试试，建议参考一下华为的手册食用