Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • +4 person also asked this people also asked this
  • Locked Locked
  • Replies 36 replies
  • Answers 1 answer
  • Subscribers 53 subscribers
  • Views 185041 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site IPSEC Extremely Slow

ChrisWestmacott

I have an IPSEC tunnel established between two sites that are within 30ft of each other (the buildings are next door).  Both sites get 100Mbps down / 10 Mbps up.  I setup an IPSEC tunnel between both sites using the default configuration of DefaultHeadOffice and DefaultBranchOffice in the IPSEC settings.  I have policies allowing LAN to VPN and VPN to LAN.  Everything is all pretty basic.

Once I setup the tunnel, I tried to do a simple file transfer of one 20MB file between a branch workstation and a server at Head Office.  It transferred the file at a speed of 0.7Mbps.  Considering both sites get 10Mbps upload, and given some overhead for the VPN tunnel, I would expect the speeds to be at least 7 or 8 Mbps, not 0.7....  Does anyone else have any experiences of insanely slow site-to-site IPSEC tunnels or have any recommendations?

The Head Office has an XG125 and remote office has an XG105 running MR2.  Both are at 50% memory usage and between 0-10% CPU usage.



This thread was automatically locked due to age.
  • 0 in reply to sachingurung

    Hi Sachin,


    Thank you.  The ticket number is 6009528.


    Thanks,


    Chris

  • 0 in reply to ChrisWestmacott

    Just to be clear:

    - Both offices are within 30ft of each other and have a latency of 15ms

    - One office has an XG125, the other has an XG105.

    - On the XG105 end, a L2 switch connects to port 1 and all devices plug into the L2 switch

    - On the XG125 end, a L2 switch connects to port 1 and all devices plug into the L2 switch

    - This has been tested with a workstation directly connected to port 1 instead of the switch; same results

    - I have tested different MSS on both sides for the LAN and WAN interfaces.  I have not tweaked MTU.

    - I have tried disabling compression and PFS

    - I have tried setting up the following phase 1 AND phase 2 negotiations and the speeds were slow in each one:

         - DES / MD5

         - 3DES / MD5

         - AES128 / MD5

         - AES128 / SHA1

         - AES128 / SHA256

         - AES256 / SHA256

    - I have tried most of the DH groups.

  • 0 in reply to ChrisWestmacott

    And both offices get 120 Mbps down / 10 Mbps up.

    Speeds through IPSEC tunnel:

    Read: 0.72Mbps
    Write: 0.70Mbps

    Speeds through SSL VPN tunnel:

    Read: 9.8Mbps
    Write: 9.8Mbps

  • 0 in reply to sachingurung

    Hey Sachin,

    I am experiencing the same issue as Chris.  However I am having a hard time setting up an SSL Site to Site because the documentation is pretty brutal...

    I have had 2 sophos xg firewalls for about 6 months and they have been miserable speed wise.  


    Our main site is an XG135 with a voice server and 100/50mbps bandwidth.  Our satellite office across the street has an xg 115 with VoIP phones and 100/50mbps bandwidth.

    Latency is all over the map and file transfers over the VPN are miserable.  Everything to the internet is working perfectly.

    Can you point me in the direction of help?

  • 0 in reply to JimBoyle

    Update: Sophos is still working on my ticket.  It sounds like they were able to replicate the horrible speed issue with using IPSEC Site to Site tunnels, but have not been able to find a workaround yet.

  • 0 in reply to sachingurung

    Hi Sachin,

    Can you provide an update on this issue?  I am currently experiencing this exact problem with an IPsec configuration using Branch and Headoffice policies.  Everything asked in this article has been done.  Speeds between sites are capable of 30Mbps but I am only seeing about 2Mbps.  I have a fail over setup with a P2P connection and don't really wan't to migrate away from the IPsec.


    Thank you,
    Hugh

  • 0

    I worked with this some more today and found by turning off PFS it seemed to resolve the slow speed issues for me.  I went from about 2Mbit to the full bandwidth of my connection which is 30Mbit.  I would be interested to know if someone else is having this issue if it resolves the issue for them.

    I am using:

    Phase 1:
    AES256
    DH GRP 5
    Lifetime 7800
    pre-shared key

    Phase 2:
    AES128
    No DH GRP
    Lifetime 3600

    Dead-peer detection is enabled to re-initiate
    Re-Keying is also enabled, mode is main.

  • 0 in reply to hjherron6

    What exactly is PFS and how do you turn it off?

    Is there any risk in having this off?

    We are going to be moving from using IPSEC over to RED site-to-site interfaces between all of our XG firewalls, but I have had some issue with that too.

  • 0 in reply to JohnSmock

    See here for more Informations about PFS: https://de.wikipedia.org/wiki/Perfect_Forward_Secrecy 

    XG 125 does support IPSec VPN Acceleration via QuickAssist - XG 105 does not. Maybe the Reason is related somewhere there? You can proof, if QuickAssist is enabled with the following command: 

    console> system hardware_acceleration status



    If it's enabled, I would disable it so both XG Devices are using Software to bring Up VPN Tunnel.

    Please send me Spam gueselkuebel@sg-utm.also-solutions.ch

Unfiltered HTML