Excessively slow IPsec VPN traffic between two ATP200

pieroCastampi

Good morning. We are facing a major issue: IPsec VPN traffic between two ATP200 units is very slow—around 50 Mbps—despite both sites having 1 Gbps fiber connections. We sought assistance from one of your partners, but after about two months, the problem persists, likely because the partner doesn't know how to resolve it. How can we fix this? I understand that you typically provide support only to partners, whereas we are end-users. Is there any chance of getting help from you here? We are willing to pay for support if necessary. Thank you.

mMontana

Hi :)

IPsec VPN traffic between two ATP200 units is very slow—around 50 Mbps—despite both sites having 1 Gbps fiber connections.

MBps stands for Mbyte/s or MBit/s?

According to specs
https://www.zyxel.com/global/en/products/firewall-ngfw/zywall-atp200/license-and-spec
VPN throughput (Mbps)*3 500
(VPN throughput measured based on RFC 2544 (1,424-byte UDP packets).

Which roughly can be compared to 50mbyte/s.
Consider that
-your ISP might deliver you an asymmetric transport capacity (is not stated in your post)
-some CPEs cannot handle that well port forwarding to devices
-is not guaranteed that ISP will always allow you to have a single data stream that maximize your available bandiwidth.

pieroCastampi

Bandwidth is measured in Mbit/s. I don't fully understand the technical data you sent, but I gather that 50 Mbit/s is a standard, fixed speed limit for the VPN, which strikes me as odd. My ISP's fiber connection is asymmetric at Site 1 (averaging 800 Mbit/s down and 280 Mbit/s up), whereas at Site 2 it is symmetric (500 Mbit/s).
Thanks.

Zyxel_Melen

Hi @pieroCastampi

In order to check your issue, could you help to share below information with me? I need both site's device's:

1. Firmware version.
2. Device configuration (start-up config).
3. Your test method. Like iperf/open speed test/Windows file transfer/etc.

I will send you a private message so you can share the device's configuration there.

Zyxel_Melen

Hi @pieroCastampi

Thanks for sharing the detailed information with me.

I noticed one of device is using weekly firmware. Please help to upgrade to 5.43 patch 0 first. In my lab, with the firmware 5.43 patch 0 and the same VPN configuration as yours, I get more than 2 times result on iperf and Open speed test.

Please feel free to let me know the result after firmware upgrade.

pieroCastampi

Bandwidth is measured in Mbit/s. I don't fully understand the technical data you sent, but I gather that 50 Mbit/s is a standard, fixed speed limit for the VPN, which strikes me as odd. My ISP's fiber connection is asymmetric at Site 1 (averaging 800 Mbit/s down and 280 Mbit/s up), whereas at Site 2 it is symmetric (500 Mbit/s).
Thanks.