cisco2821+cisco3750 出现QQ频繁掉线的现象

cui6522123

我公司现在使用的是cisco2821路由器，版本的12.4(22)T和cisco的3750G核心交换机，版本12.2(35)SE5.

现在配置好后出现的问题是QQ总是频繁掉线，但其他的IM软件不会掉线，网页浏览页正常。就是不知道是哪里出现问题了，以前用的netgare的防火墙没有这样的现象。刚刚更换的设备就出现，不知道是不是配置的问题，请大家帮忙分析分析，需要配置的话   我稍后会贴出来！

cui6522123

Dec 28 12:01:18.694: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:02:28.650: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:02:59.714: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:04:54.690: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:05:24.690: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:07:28.418: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:09:28.394: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:10:59.618: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:11:33.122: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:12:19.130: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:15:25.778: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:16:22.674: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:18:17.010: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:18:47.998: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:40:44.206: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:41:29.670: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 12:54:47.150: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 14:41:22.289: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x40069370
*Dec 28 14:41:41.577: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006918C
*Dec 28 14:41:43.177: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x40069370
*Dec 28 14:41:45.933: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A784
*Dec 28 14:41:46.881: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x400693E8
*Dec 28 14:41:47.085: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x40069370
*Dec 28 14:41:48.689: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x400693E8
*Dec 28 14:41:52.029: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x400693E8
*Dec 28 14:41:58.365: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x400693E8
*Dec 28 14:42:02.089: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006918C
*Dec 28 14:42:02.389: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x400693E8
*Dec 28 14:42:12.145: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A75C
*Dec 28 14:42:16.865: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x404A18F8
*Dec 28 14:42:24.913: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x400693E8
*Dec 28 14:42:35.281: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x40069370
*Dec 28 14:42:36.665: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A7B8
*Dec 28 14:42:42.321: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A7B8
*Dec 28 14:42:43.329: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006918C
*Dec 28 14:42:44.789: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A784
*Dec 28 14:42:45.421: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A75C
*Dec 28 14:42:47.349: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x40069370
*Dec 28 14:42:58.065: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A7B8
*Dec 28 14:43:03.441: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A7B8
*Dec 28 14:43:07.477: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A784
*Dec 28 14:43:07.969: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x423AB9F8
*Dec 28 14:43:11.493: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A7B8
*Dec 28 14:43:12.717: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A784
*Dec 28 14:43:20.709: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x400693E8
*Dec 28 14:43:24.285: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A7B8
*Dec 28 14:43:26.613: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x4006A784
*Dec 28 14:43:29.593: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44
*Dec 28 14:43:29.597: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44
*Dec 28 14:43:33.617: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x400693E8
*Dec 28 14:43:45.689: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44
*Dec 28 14:44:05.805: %L2TP-3-ILLEGAL: _____:________: ERROR: failed to get cc: no l2tp db hdl,  -Traceback= 0x41A682BC 0x438332AC 0x4383341C 0x438313AC 0x43855588 0x40A670B4 0x403D5668 0x403D58E4 0x40058B44 0x42E2A008
*Dec 28 15:25:10.329: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 15:37:57.077: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 15:40:02.317: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 15:57:36.681: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 15:59:48.601: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 16:02:14.797: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 16:03:50.097: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 16:09:02.173: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16
*Dec 28 16:11:08.409: %IP_VFR-4-FRAG_TABLE_OVERFLOW: GigabitEthernet0/0: the fragment table has reached its maximum threshold 16

ballbar

应该是配置的问题
http://www.bocatong.com

ssffzz1

看看配置。

tomyung

带上拓扑图

hyagami

3楼5毛很隐蔽啊

marsteel

拓扑+配置 发上来

cui6522123

version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname pip2821
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 51200 warnings
enable secret 5 $1$Iq3S$N6.ilnmG0OO8zvXtmUvAo/
!
no aaa new-model
clock timezone UTC 8
!
dot11 syslog
ip source-route
!
!
ip cef   
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!         
!
!
!
!
voice-card 0
!
!
crypto pki trustpoint TP-self-signed-2577016369
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2577016369
revocation-check none
rsakeypair TP-self-signed-2577016369
!
!
crypto pki certificate chain TP-self-signed-2577016369
certificate self-signed 01
  3082023F 308201A8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 32353737 30313633 3639301E 170D3039 31323238 30353235
  30385A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 35373730
  31363336 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  8100B3C3 6E83D871 A2A735C7 C3C7E6B8 26B39E26 8A8483F3 DF640BFC 37477AF7
  802CFA32 823DEC57 C1023F0C 031885EE 221E0202 C29CD901 DF60F413 5115BE11
  8F04D921 F49E9F73 86A289C2 6006A635 B0E0C316 B21BF559 01481A44 E7F6AF95
  6B76131D E0A06238 DB309A94 97121BEE 8A8D166C F568E949 B527C693 65F8D679
  2BED0203 010001A3 67306530 0F060355 1D130101 FF040530 030101FF 30120603
  551D1104 0B300982 07706970 32383231 301F0603 551D2304 18301680 14906C5E
  77A1F505 EB5D68A6 0D76C5F3 5834CD9F 37301D06 03551D0E 04160414 906C5E77
  A1F505EB 5D68A60D 76C5F358 34CD9F37 300D0609 2A864886 F70D0101 04050003
  81810062 5777330F FEC1FF5D 497F5847 575BADCE 94A72F59 2848516F EEABBCC9
  E6267E40 51B2BFEB BFF73F2A 557ED755 39E60C51 C31EA2D4 93FEC4E6 6F11006F
  278E144C 2B555B43 2109E66B DB0A7B96 990D1F9D E5D7992B ABFD18E6 862456A1
  162E94DC 9ED7811F B6685166 5D4590E0 0CB14DCB B3D6ACDF 4E160ACF 0CF9A4F3 8AEB1A
        quit
!
!
username root privilege 15 password 7 075D791E1F29090C07212E2F
archive
log config
  hidekeys
!
!
!
!
!
!
!         
!
!
interface GigabitEthernet0/0
description GE int to WAN
ip address *.*.*.* 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface GigabitEthernet0/1
description GE int to LAN
ip address 192.168.0.2 255.255.255.0
ip access-group 101 in
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 *.*.*.*
ip route 192.168.10.0 255.255.255.0 192.168.0.1
ip route 192.168.20.0 255.255.255.0 192.168.0.1
ip route 192.168.30.0 255.255.255.0 192.168.0.1
ip route 192.168.40.0 255.255.255.0 192.168.0.1
ip route 192.168.50.0 255.255.255.0 192.168.0.1
no ip http server
no ip http secure-server
!
!
ip nat translation timeout 500
ip nat translation tcp-timeout 2500
ip nat translation finrst-timeout 45
ip nat translation syn-timeout 45
ip nat translation dns-timeout 45
ip nat translation icmp-timeout 45
ip nat pool pip *.*.*.* *.*.*.* netmask 255.255.255.252
ip nat inside source list 1 pool pip overload
ip nat inside source static tcp 192.168.0.252 8080 *.*.*.* 8080 extendable
ip nat inside source static tcp 192.168.0.252 8866 *.*.*.* 8866 extendable
!
access-list 1 permit 192.168.0.0 0.0.255.255
access-list 101 permit ip host 192.168.0.18 any
access-list 101 permit ip host 192.168.0.20 any
access-list 101 permit tcp host 192.168.0.252 eq 8080 any gt 1023
access-list 101 permit tcp host 192.168.0.252 eq 8866 any gt 1023
access-list 101 deny   tcp any any range 1 chargen
access-list 101 deny   tcp any any range 26 52
access-list 101 deny   tcp any any range 54 finger
access-list 101 deny   tcp any any range 81 pop2
access-list 101 deny   tcp any any range sunrpc 118
access-list 101 deny   tcp any any range 181 442
access-list 101 deny   tcp any any range 466 994
access-list 101 deny   tcp any any range 1026 1098
access-list 101 deny   tcp any any range 1120 1502
access-list 101 deny   tcp any any range 1504 1722
access-list 101 deny   tcp any any range 1978 3305
access-list 101 deny   tcp any any range 3311 3723
access-list 101 deny   tcp any any range 4001 4999
access-list 101 deny   tcp any any range 13051 13999
access-list 101 deny   tcp any any range 18242 20000
access-list 101 deny   tcp any any range 33000 33329
access-list 101 deny   tcp any any range 33334 35999
access-list 101 deny   tcp any any range 37000 65535
access-list 101 deny   udp any any range 1 19
access-list 101 deny   udp any any range 26 52
access-list 101 deny   udp any any range 54 79
access-list 101 deny   udp any any range 81 109
access-list 101 deny   udp any any range sunrpc 118
access-list 101 deny   udp any any range 181 442
access-list 101 deny   udp any any range 466 994
access-list 101 deny   udp any any range 1026 1098
access-list 101 deny   udp any any range 1120 1502
access-list 101 deny   udp any any range 1504 1722
access-list 101 deny   udp any any range 1978 3305
access-list 101 deny   udp any any range 3311 3723
access-list 101 deny   udp any any range 4001 4999
access-list 101 deny   udp any any range 13051 13999
access-list 101 deny   udp any any range 18242 20000
access-list 101 deny   udp any any range 33000 33329
access-list 101 deny   udp any any range 33334 35999
access-list 101 deny   udp any any range 37000 65535
access-list 101 permit ip any any
!
!
!
!
!
!
!
control-plane
!
!
!
ccm-manager fax protocol cisco
!
mgcp fax t38 ecm
!
!
!
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
login local
line aux 0
line vty 0 4
exec-timeout 0 0
privilege level 15
logging synchronous
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
end


我找朋友帮忙看过一次，但是朋友说可能是我deny  UDP 4001-4999端口的缘故，可我们之前没有封这些端口之前也是该问题。且以前使用netgare防火墙的时候就封了如上的端口，也没出现过掉线现象。   所以不知道什么问题了？


拓扑结果是光线接路由器---核心交换机----到接入交换机，但因为一些原因，目前我们只启用了VLAN10,VALN20,VLAN40,VLAN60.且大部分的计算机都在vlan60中   即192.168.0.0网段里   这个网段里经常会出现QQ掉线，但别的如MSN，WEB都没事。很无语了

ssffzz1

ip virtual-reassembly  去掉试试

ip nat translation timeout 500 改大一点

那个4001-4999端口DENY的先去掉。