Site to Site Slow

I have a site to site VPN setup using to instances of Sophos UTM 9. Everything works fine except I find it is a bit slow. Copying from site B NAS to Site A I get just under 1 MB/s usually more in the 700-900 KB/s range which isn't awful but opening directories takes forever -- like if I click on a folder it can take 30 seconds or more before it even opens and then it takes forever to populate. I have decent internet at both ends so I expected better.

I'm using IPsec -- Auto Firewall rules and strick routing on -- I've lowered the policy to AES-128 PFS to see if that would help but no change. Neither Sophos instances show any significant resource spike (CPU is 2-9% and RAM is the mid-60s on one instance and under 50% on the other which is where it typically is).

Are there any typical issues I should be looking at or testing to determine why the VPN has so much lag?

  • Hey  

    Have you checked if you are experiencing any fragmented packets? Did you have Support Path MTU Discovery enabled in your remote gateways > advanced ?

    Here's a related article to help you troubleshoot.

    Regards,

  • Carlos, try the following to ping from one "Internal (Address)" [10.10.10.1] to the other [172.30.0.1]:

     ping -I 10.1.1.34 172.30.0.20 -s 1500 -M do

    Lower the 1500 to find the maximum message length and then set the MTU of the Internal interfaces to that value.

    Also, if you've selected 'Support Path MTU Discovery', note that that requires that ICMP type 3 code 4 be allowed between the devices.  If that doesn't seem to be working, you might challenge your ISP.

    Cheers - Bob