VPN300 - Poor IPSec Throughput

Options
Brad
Brad Posts: 9
First Anniversary Friend Collector First Comment
Hello, I have a VPN300 with a site-to-site VPN connection that we are experiencing poor throughput with.

Internet - 300/30Mbps - Static IP

VPN_Connection
 - IKEv2
 - SA Lifetime: 86400
 - AES256/SHA256
 - DH14
 - Nailed Up / MSS - Auto / Narrowed

Policy
 - Local: NAT_23_56 (x.x.23.56/29)
 - Remote: DEST_22_56 (x.x.22.56/29)
 - Policy Enforcement (Checked)
 - SA Lifetime: 28800
 - AES256/SHA256
 - PFS: None

Inbound/Outbound NAT
Source NAT
 - LAN1_SUBNET (x.x.1.0/24)
 - Destination: DEST_22_56 (x.x.22.56/29)
 - SNAT: NAT_23_56 (x.x.23.56/29)

The issue I am running into is that my throughput from downloading a file from x.x.22.56 is about 2MB/s (17Mb/s) which is not anywhere close to what we are expecting. The connection otherwise is extremely stable and the throughput is consistent.

On the remote end packet captures were done and it appears that the VPN300 starts the connection and the mysteriously kills it.

There are no BWM or other traffic shaping configurations.

Any thoughts would be appreciated.

All Replies

  • PeterUK
    PeterUK Posts: 2,758  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Maybe the encryption/authentication is too high? Try phase 1 AES128/SHA1 key group DH2 and phase 2 AES128/SHA1 key group none and see what you get.


  • Brad
    Brad Posts: 9
    First Anniversary Friend Collector First Comment
    Options
    PeterUK said:

    Maybe the encryption/authentication is too high? Try phase 1 AES128/SHA1 key group DH2 and phase 2 AES128/SHA1 key group none and see what you get.


    We had it lower on a previous connection with the same throughput. We recently transitioned to IKEv2 from IKEv1 for this connection.
  • Brad
    Brad Posts: 9
    First Anniversary Friend Collector First Comment
    Options
    I just ran a few tests with iperf3 and have similar results on another site-to-site connection.

    [ ID] Interval           Transfer     Bandwidth
    [  4]   0.00-4.63   sec  10.1 MBytes  2.18 MBytes/sec                  sender
    [  4]   0.00-4.63   sec  10.1 MBytes  2.18 MBytes/sec                  receiver

    [ ID] Interval           Transfer     Bandwidth
    [  4]   0.00-28.24  sec  50.1 MBytes  1.78 MBytes/sec                  sender
    [  4]   0.00-28.24  sec  50.1 MBytes  1.78 MBytes/sec                  receiver

    Any help would be appreciated.
  • Brad
    Brad Posts: 9
    First Anniversary Friend Collector First Comment
    Options
    So I just ran multiple tests with parallel streams and was able to get the total bandwidth to about 15/17MBps.

    What do I need to do in order to achieve this every time even though the applications running across are not maxing it out in this way?
  • MJStar
    MJStar Posts: 34  Freshman Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options
    I think you don't need to do other somethings, the throughput of multiple streams is better than single stream. I verified it on my Zyxel ATP device, too. It's the same result just like yours B) .

Security Highlight