Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • +4 person also asked this people also asked this
  • Locked Locked
  • Replies 36 replies
  • Answers 1 answer
  • Subscribers 53 subscribers
  • Views 185041 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site IPSEC Extremely Slow

ChrisWestmacott

I have an IPSEC tunnel established between two sites that are within 30ft of each other (the buildings are next door).  Both sites get 100Mbps down / 10 Mbps up.  I setup an IPSEC tunnel between both sites using the default configuration of DefaultHeadOffice and DefaultBranchOffice in the IPSEC settings.  I have policies allowing LAN to VPN and VPN to LAN.  Everything is all pretty basic.

Once I setup the tunnel, I tried to do a simple file transfer of one 20MB file between a branch workstation and a server at Head Office.  It transferred the file at a speed of 0.7Mbps.  Considering both sites get 10Mbps upload, and given some overhead for the VPN tunnel, I would expect the speeds to be at least 7 or 8 Mbps, not 0.7....  Does anyone else have any experiences of insanely slow site-to-site IPSEC tunnels or have any recommendations?

The Head Office has an XG125 and remote office has an XG105 running MR2.  Both are at 50% memory usage and between 0-10% CPU usage.



This thread was automatically locked due to age.
Parents
  • 0

    I worked with this some more today and found by turning off PFS it seemed to resolve the slow speed issues for me.  I went from about 2Mbit to the full bandwidth of my connection which is 30Mbit.  I would be interested to know if someone else is having this issue if it resolves the issue for them.

    I am using:

    Phase 1:
    AES256
    DH GRP 5
    Lifetime 7800
    pre-shared key

    Phase 2:
    AES128
    No DH GRP
    Lifetime 3600

    Dead-peer detection is enabled to re-initiate
    Re-Keying is also enabled, mode is main.

Reply
  • 0

    I worked with this some more today and found by turning off PFS it seemed to resolve the slow speed issues for me.  I went from about 2Mbit to the full bandwidth of my connection which is 30Mbit.  I would be interested to know if someone else is having this issue if it resolves the issue for them.

    I am using:

    Phase 1:
    AES256
    DH GRP 5
    Lifetime 7800
    pre-shared key

    Phase 2:
    AES128
    No DH GRP
    Lifetime 3600

    Dead-peer detection is enabled to re-initiate
    Re-Keying is also enabled, mode is main.

Children
Unfiltered HTML