This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site Tunnel mit IPSec - Durchsatz nur 4 kB/s

Hallo zusammen,

ich habe zwischen zwei Standorten mit einer SG115 und SG135 eine IPSec Verbindung über IPv6 eingerichtet. Ein Anschluß hat 100Mbit/s Down/Up und der andere hat 200Mbit down/up. Ein ping zwischen beiden UTM's dauert ca. 8ms. Das Einbinden von Freigaben und anschließende Kopieren dauert ewig. Es werden nur 4 kB/s angezeigt.

Leider habe ich keine Idee mehr, wo ich ansetzen soll.

 

Übersicht der IPSec VErbindung in der Site-to-Site Übersicht:

SA: 192.168.30.0/24=2a00:xxxxx   2a00:xxxxx=192.168.1.0/24
VPN ID: 2a00:xxxxxx
IKE: Auth PSK / Enc AES_CBC_256 / Hash HMAC_MD5 / Lifetime 7800s / DPD
ESP: Enc AES_CBC_256 / Hash HMAC_MD5 / Lifetime 3600s
 
   

 

 

Danke!



This thread was automatically locked due to age.
Parents
  • Evtl mag dein ISP nicht den ganzen Overhead und du könntest mal gucken was passiert wenn du die MTU für den tunnel was nach unten drehst?

  • Oder liegt es vielleicht sogar am Routing?

     

    ICh baue die IPSec-Verbindung zwischen den beiden UTMs über eine feste IPv6 auf.

    Anschließend möchte ich mit den Netzen dahinter per IPv4 kommunizieren.

     

     

    Anbei nochmal das Logfile. Wenn ich es richtig verstehe, wird der Tunnel aufgebaut. Ein ping funktioniert wunderbar. Nur ein Zugriff auf Daten will nicht wirklich ...

     

    2018:07:28-13:48:18 sg115 ipsec_starter[24137]: Starting strongSwan 4.4.1git20100610 IPsec [starter]...
    2018:07:28-13:48:18 sg115 pluto[24154]: Starting IKEv1 pluto daemon (strongSwan 4.4.1git20100610) THREADS VENDORID CISCO_QUIRKS
    2018:07:28-13:48:18 sg115 ipsec_starter[24147]: pluto (24154) started after 20 ms
    2018:07:28-13:48:19 sg115 pluto[24154]: loaded plugins: curl ldap aes des blowfish serpent twofish sha1 sha2 md5 random x509 pubkey pkcs1 pgp dnskey pem sqlite hmac gmp xauth attr attr-sql resolve
    2018:07:28-13:48:19 sg115 pluto[24154]:   including NAT-Traversal patch (Version 0.6c)
    2018:07:28-13:48:19 sg115 pluto[24154]: Using Linux 2.6 IPsec interface code
    2018:07:28-13:48:19 sg115 pluto[24154]: loading ca certificates from '/etc/ipsec.d/cacerts'
    2018:07:28-13:48:19 sg115 pluto[24154]:   loaded ca certificate from '/etc/ipsec.d/cacerts/REF_CaVerVpnSigniCaSun2.pem'
    2018:07:28-13:48:19 sg115 pluto[24154]:   loaded ca certificate from '/etc/ipsec.d/cacerts/REF_CaVerVpnSigniCaSun.pem'
    2018:07:28-13:48:19 sg115 pluto[24154]:   loaded ca certificate from '/etc/ipsec.d/cacerts/REF_CaSigVpnSigniCa.pem'
    2018:07:28-13:48:19 sg115 pluto[24154]: loading aa certificates from '/etc/ipsec.d/aacerts'
    2018:07:28-13:48:19 sg115 pluto[24154]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
    2018:07:28-13:48:19 sg115 pluto[24154]: Changing to directory '/etc/ipsec.d/crls'
    2018:07:28-13:48:19 sg115 pluto[24154]: loading attribute certificates from '/etc/ipsec.d/acerts'
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface tun0/tun0 10.10.30.1:500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface tun0/tun0 10.10.30.1:4500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface eth2/eth2 192.168.10.1:500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface eth2/eth2 192.168.10.1:4500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface eth1/eth1 192.168.3.1:500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface eth1/eth1 192.168.3.1:4500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface eth0/eth0 192.168.1.1:500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface eth0/eth0 192.168.1.1:4500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface lo/lo 127.0.0.1:500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface lo/lo 127.0.0.1:4500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface eth1/eth1 2yyyy:yyyy::yyyy:500
    2018:07:28-13:48:19 sg115 pluto[24154]: adding interface lo/lo ::1:500
    2018:07:28-13:48:19 sg115 pluto[24154]: loading secrets from "/etc/ipsec.secrets"
    2018:07:28-13:48:19 sg115 pluto[24154]:   loaded PSK secret for 2yyyy:yyyy::yyyy 2xxx:xxxx::xxxx
    2018:07:28-13:48:19 sg115 pluto[24154]: listening for IKE messages
    2018:07:28-13:48:19 sg115 pluto[24154]: added connection description "IpSitA2B0"
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: initiating Main Mode
    2018:07:28-13:48:19 sg115 pluto[24154]: added connection description "IpSitA2B1"
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: received Vendor ID payload [strongSwan]
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: ignoring Vendor ID payload [Cisco-Unity]
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: received Vendor ID payload [XAUTH]
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: received Vendor ID payload [Dead Peer Detection]
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: received Vendor ID payload [RFC 3947]
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: enabling possible NAT-traversal with method 3
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: NAT-Traversal: Result using RFC 3947: no NAT detected
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: Peer ID is ID_IPV6_ADDR: '2xxx:xxxx::xxxx'
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: Dead Peer Detection (RFC 3706) enabled
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: ISAKMP SA established
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B1" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#1}
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #3: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#1}
    2018:07:28-13:48:19 sg115 pluto[24154]: id="2203" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN up" variant="ipsec" connection="REF_IpsSitA2B" address="2yyyy:yyyy::yyyy" local_net="192.168.1.0/24" remote_net="192.168.30.0/24"
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B1" #2: sent QI2, IPsec SA established {ESP=>0x7ff2410a <0x9d06f096 DPD}
    2018:07:28-13:48:19 sg115 pluto[24154]: "IpSitA2B0" #1: ignoring informational payload, type INVALID_ID_INFORMATION
    2018:07:28-13:48:28 sg115 pluto[24154]: "IpSitA2B0" #1: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xd9eea003) not found (maybe expired)
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: received Vendor ID payload [strongSwan]
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: ignoring Vendor ID payload [Cisco-Unity]
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: received Vendor ID payload [XAUTH]
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: received Vendor ID payload [Dead Peer Detection]
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: received Vendor ID payload [RFC 3947]
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
    2018:07:28-13:48:28 sg115 pluto[24154]: packet from 2xxx:xxxx::xxxx:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
    2018:07:28-13:48:28 sg115 pluto[24154]: "IpSitA2B1" #4: responding to Main Mode
    2018:07:28-13:48:28 sg115 pluto[24154]: "IpSitA2B1" #4: NAT-Traversal: Result using RFC 3947: no NAT detected
    2018:07:28-13:48:28 sg115 pluto[24154]: "IpSitA2B1" #4: Peer ID is ID_IPV6_ADDR: '2xxx:xxxx::xxxx'
    2018:07:28-13:48:28 sg115 pluto[24154]: "IpSitA2B1" #4: Dead Peer Detection (RFC 3706) enabled
    2018:07:28-13:48:28 sg115 pluto[24154]: "IpSitA2B1" #4: sent MR3, ISAKMP SA established
    2018:07:28-13:48:28 sg115 pluto[24154]: "IpSitA2B1" #5: responding to Quick Mode
    2018:07:28-13:48:28 sg115 pluto[24154]: "IpSitA2B1" #5: IPsec SA established {ESP=>0x2870b384 <0x6c26ef33 DPD}
    2018:07:28-13:48:29 sg115 pluto[24154]: "IpSitA2B0" #1: ignoring informational payload, type INVALID_MESSAGE_ID
    2018:07:28-13:48:49 sg115 pluto[24154]: "IpSitA2B0" #1: ignoring informational payload, type INVALID_MESSAGE_ID
    2018:07:28-13:49:29 sg115 pluto[24154]: "IpSitA2B0" #3: max number of retransmissions (2) reached STATE_QUICK_I1.  No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
    2018:07:28-13:49:29 sg115 pluto[24154]: "IpSitA2B0" #3: starting keying attempt 2 of an unlimited number
    2018:07:28-13:49:29 sg115 pluto[24154]: "IpSitA2B0" #6: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP to replace #3 {using isakmp#4}
    2018:07:28-13:49:29 sg115 pluto[24154]: "IpSitA2B1" #4: next payload type of ISAKMP Hash Payload has an unknown value: 54
    2018:07:28-13:49:29 sg115 pluto[24154]: "IpSitA2B1" #4: malformed payload in packet
    2018:07:28-13:49:39 sg115 pluto[24154]: "IpSitA2B1" #4: ignoring informational payload, type INVALID_MESSAGE_ID
    2018:07:28-13:49:59 sg115 pluto[24154]: "IpSitA2B1" #4: ignoring informational payload, type INVALID_MESSAGE_ID
    2018:07:28-13:50:39 sg115 pluto[24154]: "IpSitA2B0" #6: max number of retransmissions (2) reached STATE_QUICK_I1.  No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
    2018:07:28-13:50:39 sg115 pluto[24154]: "IpSitA2B0" #6: starting keying attempt 3 of an unlimited number
    2018:07:28-13:50:39 sg115 pluto[24154]: "IpSitA2B0" #7: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP to replace #6 {using isakmp#4}
    2018:07:28-13:50:39 sg115 pluto[24154]: "IpSitA2B1" #4: next payload type of ISAKMP Hash Payload has an unknown value: 221
    2018:07:28-13:50:39 sg115 pluto[24154]: "IpSitA2B1" #4: malformed payload in packet
    2018:07:28-13:50:49 sg115 pluto[24154]: "IpSitA2B1" #4: ignoring informational payload, type INVALID_MESSAGE_ID
    2018:07:28-13:51:09 sg115 pluto[24154]: "IpSitA2B1" #4: ignoring informational payload, type INVALID_MESSAGE_ID
    2018:07:28-13:51:49 sg115 pluto[24154]: "IpSitA2B0" #7: max number of retransmissions (2) reached STATE_QUICK_I1.  No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
    2018:07:28-13:51:49 sg115 pluto[24154]: "IpSitA2B0" #7: starting keying attempt 4 of an unlimited number
    2018:07:28-13:51:49 sg115 pluto[24154]: "IpSitA2B0" #8: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP to replace #7 {using isakmp#4}
    2018:07:28-13:51:49 sg115 pluto[24154]: "IpSitA2B1" #4: next payload type of ISAKMP Hash Payload has an unknown value: 157
    2018:07:28-13:51:49 sg115 pluto[24154]: "IpSitA2B1" #4: malformed payload in packet
    2018:07:28-13:51:59 sg115 pluto[24154]: "IpSitA2B1" #4: ignoring informational payload, type INVALID_MESSAGE_ID
    2018:07:28-13:52:19 sg115 pluto[24154]: "IpSitA2B1" #4: ignoring informational payload, type INVALID_MESSAGE_ID
    2018:07:28-13:52:59 sg115 pluto[24154]: "IpSitA2B0" #8: max number of retransmissions (2) reached STATE_QUICK_I1.  No acceptable response to our first Quick Mode message: perhaps peer likes no proposal

  • Puh, ich komme nicht weiter ...

     

     

    IPv4 LAN <-> UTM IPv6 < ---- > UTM IPv6 <-> LAN IPv4

     

    ping6 -s zw. den UTM's IPv6 geht bis 1432 (MTU der UTM's habe ich auf 1480 gesetellt)

    ping -s 1362 im LAN zu LAN (IPv4) ist maximum

     

    Die MTU der UTM's habe ich auf 1480 gestellt. Muss ich die MTU der Clients im LAN (IPv4) auch entsprechend herabsetzen?

    Wenn ja, auf welchen Wert? MTU 1390?

     

    So wird es zumindestens beim ping angezeigt ....

    ping -s 1364 192.168.30.254 -D -c 1
    PING 192.168.30.254 (192.168.30.254): 1364 data bytes
    556 bytes from 192.168.2.1: frag needed and DF set (MTU 1390)
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 7005 52f1   0 0000  40  01 404a 192.168.2.3  192.168.30.254

     

    Seltsamerweise geht eine OpenVPN-Verbindung über feste-ip "ohne Probleme". Nur komme ich dort nur auf die Geschwindigkeit von feste-ip und nicht auf die vom möglichen Glasfaseranschluß im Netz der Deutschen Glasfaser (100 up and down).

     

    Hat vlt. noch jemand eine Idee oder einen Tipp für mich???

     

    Vielen Dank...

  • 556 bytes from 192.168.2.1: frag needed

    Ahh, it looks like you have the dreaded MTU problem.  try a Google:

    site:community.sophos.com/products/unified-threat-management/f MTU 576

    MfG - Bob (Bitte auf Deutsch weiterhin.)

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Schon mal vielen Dank für die Antwort.

     

    Allerdings verstehe ich sie nicht ganz, da ich keine Dynamic IP nutze. Ich habe auf dem WAN die MTU manuell von 1500 auf 1480 gesetzt.

  • Der Ping geht wieder wie zuvor beschrieben bis size 1362 durch. Ansonsten erhalte ich die Fehlermeldung Message to Long, mtu=1382

    Allerdings bricht die ubertragungsgeschwindigkeit bei größeren Dateien ein.

    Was kann ich noch machen/versuchen?

    Werden noch irgendwelche tcpdumps benötigt?

    Vielen Dank!

  • Noch jemand eine Idee, was ich noch probieren kann?

  • Did you enable the option:  "Support path MTU discovery" under the "remote gateway"?


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • Thanks for your answer. Yes, I did.

    The next idea is to change the mtu size on the Tunnel end points (Clients) to 1390.

    I do Not have any Problems with small packets, like voip.

  • Sorry, but I Need your help!

    I changed the mtu to 1390 on both Computer endpoints. After Mounting a Share and transfering Data, the Speed of the connecting slows down again.

    What can I do NOW to get the Tunnel working as expected?

    Thanks

  • Additional Info:

    I can See the following in the espdump onnthe Sophos

    ....length 1338SMB-over-TCP packet: (raw Data or continuation?)

    One side is a Windows with Share mounted via cifs on Linux Client. I also disabled lso in Windows.

  • Assuming that your WAN connection is on eth1, what result do you get from:

    ifconfig eth1

    MfG - Bob (Bitte auf Deutsch weiterhin.)

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • Assuming that your WAN connection is on eth1, what result do you get from:

    ifconfig eth1

    MfG - Bob (Bitte auf Deutsch weiterhin.)

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • The output of eth1 (wan) interface is

     

    sg115:/root # ifconfig eth1
    eth1      Link encap:Ethernet  HWaddr 00:1A:8C:43:32:F9  
              inet addr:192.168.3.251  Bcast:192.168.3.255  Mask:255.255.255.0
              inet6 addr: 2a00:6010:13a6:2100:21a:8cff:fe43:32f9/64 Scope:Global
              inet6 addr: fe80::21a:8cff:fe43:32f9/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:182535440 errors:0 dropped:1129 overruns:0 frame:0
              TX packets:111550355 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:205820574255 (196285.7 Mb)  TX bytes:30375481945 (28968.3 Mb)

    sg115:/root # ip a s dev eth1
    3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc hfsc state UP group default qlen 1000
        link/ether 00:1a:8c:43:32:f9 brd ff:ff:ff:ff:ff:ff
        inet 192.168.3.251/24 brd 192.168.3.255 scope global eth1
           valid_lft forever preferred_lft forever
        inet6 2a00:6020:15e6:2200:21a:8cff:fe43:32f9/64 scope global dynamic
           valid_lft 3043sec preferred_lft 1693sec
        inet6 fe80::21a:8cff:fe43:32f9/64 scope link
           valid_lft forever preferred_lft forever

     

     

     

    And on the other utm (wan is on eth7):

    sg135:/root # ifconfig eth7
    eth7      Link encap:Ethernet  HWaddr 00:1A:8C:4B:15:D7  
              inet addr:192.168.50.99  Bcast:192.168.50.255  Mask:255.255.255.0
              inet6 addr: fe80::21a:8cff:fe4b:15d7/64 Scope:Link
              inet6 addr: 2a00:6010:23ae:af10:21a:8cff:fe4b:15d7/64 Scope:Global
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:308355686 errors:0 dropped:0 overruns:0 frame:0
              TX packets:178763670 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:384447335574 (366637.5 Mb)  TX bytes:29044146511 (27698.6 Mb)

    sg135:/root # ip a s dev eth7
    9: eth7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
        link/ether 00:1a:8c:4b:15:d7 brd ff:ff:ff:ff:ff:ff
        inet 192.168.50.99/24 brd 192.168.50.255 scope global eth7
           valid_lft forever preferred_lft forever
        inet6 2a00:6020:15ee:af00:21a:8cff:fe4b:15d7/64 scope global
           valid_lft forever preferred_lft forever
        inet6 fe80::21a:8cff:fe4b:15d7/64 scope link
           valid_lft forever preferred_lft forever

     

    I only changed the mtu size on the tunnel endpoints

  • I'm out of questions.  What does Sophos Support have to say about this?

    MfG - Bob (Bitte auf Deutsch weiterhin.)

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • I do Not have a valid subscription for Support (only for license) :(

  • What happens if you use IPv4 instead of IPv6?

    MfG - Bob (Bitte auf Deutsch weiterhin.)

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • That is Not possible. I have a IPv6 Connection from deutsche Glasfaser with no direct ipv4 Access.

  • Is this the case on both sides, or is the other side having to use 4-to-6?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Yes. Both sides habe the same Internet Access and Provider.

  • I have done another test with Linux clients at the Tunnel endpoints. They use nfs for file transfer. I have also start a tcpdump for sniffing.

    I can see  strange Message in the dump which I can Not Interpret.

     

    I have attached a dump file which is splitted (linxu split command) in several files and zipped for uploading (max uplaod size is 1 MB).

     

    7356.xaa.zip0336.xab.zip4150.xac.zip3146.xad.zip6761.xae.zip0474.xaf.zip8836.xag.zip2541.xah.zip5265.xai.zip8080.xaj.zip3603.xak.zip

  • Hi,

     

    I had still the described issue.

    Does anyone have an idea about next steps to solve this issue?

     

    Thanks!

     

    Regards

    Daniel