This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ACC: Add new VPN options

Since i have updated all ASG's from 7.5xx to 8.30x the VPN connections are very slow (35-45 kBytes/s).

As read in the forums, it looks like it's a MTU issue in most cases. "Support Path MTU discovery" option should fix it, but ACC doesn't support the newer VPN options, and all our VPNs were created with ACC.

When will ACC support the advanced options?
("Support Path MTU discovery", "Support congestion signaling (ECN)", "Enable XAUTH client mode")

We really need that ASAP, and i don't want to recreate all VPN connections manually. That's because we have ACC running...

Is there a workaround by changing a setting somewhere manually to fix without recreating all the VPNs outside ACC manually?

Thanks
Urs

This thread was automatically locked due to age.

Parents

0 Hakan Yueksel over 12 years ago
Hi Urs,

there is the possibility to change the remote gateway object on the ASG
per script. You could set the Path MTU discovery on two ASGs of
one of your tunnels in order to try out whether this option solves your issue.

Do the following:

login to one your ASGs per ssh
find out the reference of your connection:
cc get ipsec

with this reference find out the reference of your remote gateway:
cc get_object reference_of_your_connection

save the following perl code as set_pmtu_discovery.pl:

#!/usr/bin/perl

use warnings;
use strict;

use lib '/var/lib';

use Data:[:D]umper;
use Astaro::ConfdPlRPC;

if (@ARGV \n";
}

my $ref_remote_gw = $ARGV[0];
chomp($ref_remote_gw);

my $confd = Astaro::ConfdPlRPC->new({facility => 'acc-agent'});
if( ! $confd ) {
    die "confd connection failed!";
}

$confd->lock();
my $object = $confd->get_object($ref_remote_gw);
$object->{data}{pmtu_discovery} = 1;
if (!$confd->set_object($object)) {
    print Dumper($confd->err_get_extended()), "\n";
}
else{
    $confd->commit();
}

$confd->disconnect;

call the script with the reference of the remote gateway:
perl set_pmtu_discovery.pl reference_of_your_remote_gateway

If setting the Path MTU discovery helps solving your issue for one of
your tunnels you could do the same procedure for all tunnels until we can
provide a solution.

Regards, Hakan
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Hakan Yueksel over 12 years ago
Hi Urs,

there is the possibility to change the remote gateway object on the ASG
per script. You could set the Path MTU discovery on two ASGs of
one of your tunnels in order to try out whether this option solves your issue.

Do the following:

login to one your ASGs per ssh
find out the reference of your connection:
cc get ipsec

with this reference find out the reference of your remote gateway:
cc get_object reference_of_your_connection

save the following perl code as set_pmtu_discovery.pl:

#!/usr/bin/perl

use warnings;
use strict;

use lib '/var/lib';

use Data:[:D]umper;
use Astaro::ConfdPlRPC;

if (@ARGV \n";
}

my $ref_remote_gw = $ARGV[0];
chomp($ref_remote_gw);

my $confd = Astaro::ConfdPlRPC->new({facility => 'acc-agent'});
if( ! $confd ) {
    die "confd connection failed!";
}

$confd->lock();
my $object = $confd->get_object($ref_remote_gw);
$object->{data}{pmtu_discovery} = 1;
if (!$confd->set_object($object)) {
    print Dumper($confd->err_get_extended()), "\n";
}
else{
    $confd->commit();
}

$confd->disconnect;

call the script with the reference of the remote gateway:
perl set_pmtu_discovery.pl reference_of_your_remote_gateway

If setting the Path MTU discovery helps solving your issue for one of
your tunnels you could do the same procedure for all tunnels until we can
provide a solution.

Regards, Hakan
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 UrsWeiss over 12 years ago in reply to Hakan Yueksel

Hello Hakan

Thank you for the script.

Tried that with my VPN from home (8.930) to our office (8.301). But, isn't faster yet.

Transfer of a 4.5MB Pdf (from a Windows share to my Mac at home) takes a bit over 2 minutes...

Then i disabled and re-enabled the VPN from ACC to reestablish the VPN connection, but this disables the "pmtu_discovery" again on both sides.

Have to investigate that a bit closer.

Thanks
Urs
Cancel
Vote Up 0 Vote Down

Cancel