Recommended IPSec Policies for best performance

Question

Hello all, 
 Long time Sophos UTM users here. We have three offices and a HP ProLiant G9 in each office running Sophos UTM in Chicago, Seattle and Los Angeles. We're running Teradici PCoIP that requires the best throughput and lowest latency possible between the sites. Teradici uses both TCP and UCP for it's PCoIP protocol, so I'm not sure if running over a TCP IPSec S2S vpn is ideal. We're around 44-46ms and latency is the highest priority, looking to optimize our policies a bit better as I know they are out of whack! I've read something about AES 128 GCM using hardware acceleration on intel processors, looking for tweaks like that to speed up our IPSec connections between sites. I've included a screen grab of our VPN policy. 
 
 Any help would be much appreciated!!

DouglasFoster · Answer

From my reading, the most important issue for performance tuning is to prevent packet fragmentation. You need to reduce the MTU on the inside interface, so that after the tunnel envelope is added, the original payload still fits in one packet at the outside interace. Of course, you also have to consider the possibility that an intermediate hop along your Internet path uses a smaller-than-1512 MTU, because you do not want packets fragmented along the route either. 
 The Cisco support site has a long article about IPSEC Fragmentation and MTU Path Discovery that was my primary learning tool. I think they abbreviate "MTU Path Discovery" as MTUPD in some contexts. 
 Assuming that all hops are based on Ethernet technology, I think an inside MTU of about 1412 usually works, but the article provides the algorithm.