Slow large file copies via file-share, but fast if using http (both with IPSEC VPN)

Great insight, Giovani - I hadn't considered asking about which IPsec Policy was in use.  Honestly, depending on the Policy and the underlying hardware, IPsec can be faster or slower than RED.  I don't know if the RED technology takes advantage of it, but the SSL VPN will using the default AES-128-CBC.  AES 128 GCM will be from 50% to 100% faster than AES-128-CBC, depending on the underlying CPU (AES-NI SSL Performance).  Here's what I like to use where there's hardware support for AES-NI:

Cheers - Bob

Bob, that's some top shelf knowledge right there, as usual. I shall review my concepts.

Regards,

Giovani

Gentlemen:

I've swapped out all of the NICs in that cloud environment to VMXNET3, no more E1000s on any of the VMs.  This didn't help, but it did trigger the VMWare VCloud Director's Edge Gateway to actually start enforcing it's 100Mbps throttle... I had to contact the datacenter and have them bump that back up to 1000Mbps.   Speedtest.net shows about 230Mbsp up and down from the receiving side of the copy and we get around 300Mbps up and down on the sending side, other speed testing sites show similar numbers (just for ball-park, not expecting them to be horribly accurate beyond showing what order of magnitude we're lying within).

After the updating of the NICs, the robocopy is getting about 25Mbps.  During the transfer, the Sophos VM is bumping along between 0-2% CPU utilization, and abotu 25% RAM usage...

The low CPU utilization makes me think the encryption overhead isn't much of a factor, but maybe some profiles are heavier on the wire than others, stealing bandwidth?

Presently, the IPSec VPN is using AES-256, which is configured as:

The remote gateway's advanced options are:

Would changing the IPSec VPN policy result in significantly faster transfers, or just a couple percent?  As it is, we're getting just over 10% of actual throughput... seems like 90% overhead is steep by any measure... what else could be causing this to be so slow?

I would not expect an increase in speed.  I really think you are likely topping out the performance of SMB over a high latency VPN at 25mbps.  It is really not a protocol made for WAN links.  I know that is not what you want to hear, but I think it is as good as it will get for you.

From what I've read, AES 256 has about 40% more overhead than AES 128.  I think AES 128 PFS is more secure than plain AES 256, especially since reading a few years ago that there's a vulnerability in AES 256 (don't remember now what it was).

I would definitely select 'Support path MTU discovery' in the Remote Gateways on both sides.

Have you tried an Exception for Intrusion Prevention on each side for traffic coming from subnets on the other side?

Cheers - Bob