topic Re: Cisco Secure Connect download bandwidth problem in Cisco SASE with Meraki

Cisco Secure Connect download bandwidth problem

SecureConnctUsr — Tue, 15 Oct 2024 00:04:58 GMT

Hello,

My company migrated from ‘Cisco Meraki + Umbrella’ to ‘Cisco Secure Connect’ a few weeks ago.

Since this upgrade, our download speeds have been catastrophic.

For example, when I download the Windows 11 ISO, I can only download at 2Mb/s even though we have a symmetrical 1Gb fibre line.

We have 10 sites made up of MX67, MX85 and MX95 all at version MX18.211.2.

At first I thought it was the IDS that was causing the problem, so I disabled it but nothing has improved.

I then checked all the firewall rules but none of them could restrict the bandwidth.

The same goes for the QoS rules

On the Umbrella side, there's nothing to suggest that the bandwidth per site is very limited.

I'm at a loss, so to speak

Has anyone encountered this problem before?

Thanks in advance for your answers,

Best regards,

Re: Cisco Secure Connect download bandwidth problem

Philip D'Ath — Tue, 15 Oct 2024 07:23:16 GMT

Are you using the Umbrella DNS servers?

Are you referring to access from Cisco Secure Client, or are you meaning via an MX through AutoVPN to Umbrella?

Re: Cisco Secure Connect download bandwidth problem

SecureConnctUsr — Tue, 15 Oct 2024 08:27:33 GMT

Hello,

We are using Umbrella as public DNS servers and i am reffering to MX through AutoVPN to Umbrella

Sincerly,

Re: Cisco Secure Connect download bandwidth problem

matt_uc — Wed, 16 Oct 2024 19:41:48 GMT

We don't use SecureConnect for the record, but this is where I would start, in particular check if you are hitting the tunnel performance limit:

https://docs.umbrella.com/umbrella-user-guide/docs/limitations-and-range-limits

IPsec Tunnel Performance

250 Mbps download, 80 Mbps upload, and 50,000 combined packets per second.

Based on GCM encryption with 900 byte average package size.

Re: Cisco Secure Connect download bandwidth problem

schalabi — Sun, 27 Oct 2024 23:43:22 GMT

Hi SecureConnctUsr,

You mentioned you moved from Meraki MX + Umbrella to Secure Connect, was that Umbrella DNS or SIG?

The QoS rules won't help much after traffic leaves the MX. Once that traffic is forwarded through the AutoVPN tunnel up to Secure Connect, the cloud VPN headend won't make any traffic prioritization decisions based on the DSCP tags configured.

To verify this is definitely a symptom of traffic going through Secure Connect, create a test VLAN set to VPN mode off, and run the tests again. If you verify that traffic being passed through Secure Connect is significantly slower, review your policies (specifically Cloud Firewall policies to check the IPS there, and Web policies for SSL decryption).

Re: Cisco Secure Connect download bandwidth problem

schalabi — Sun, 27 Oct 2024 23:48:13 GMT

Hi mlefebvre,

This is definitely applicable for IPsec tunnels. The AutoVPN tunnels in question are capable of 500 Mbps bi-directional.

https://documentation.meraki.com/CiscoPlusSecureConnect/Cisco__Secure_Connect_Now-_Sites/Cisco_Secure_Connect_Sites_-_Meraki_SD-WAN_Integration

We're planning on bringing bandwidth parity between the two VPN headend implementations in the near future, as well as long-term plans for better performance all round.

Re: Cisco Secure Connect download bandwidth problem

SecureConnctUsr — Wed, 30 Oct 2024 08:29:34 GMT

Hello SahandC,

Thank you for your answer and your time,

It was Umbrella SIG,

I deleted the tunnels in "Cloud on Ramp" before migrating.

As our speed problems occurred shortly after the migration, I didn't create any rules in the cloud firewall.

Here's the web Policy i configured

I can't think of anything that would cause bandwidth problems. Do you have any ideas?

I had deactivated IPS to make sure it wasn't the cause of the problem, but nothing has changed since it was deactivated.

However, I didn't activate the ‘Umbrella Protection’ section. Could this be the cause?

Sincerly,

Re: Cisco Secure Connect download bandwidth problem

schalabi — Tue, 05 Nov 2024 15:13:04 GMT

Did you migrate to Secure Connect from SIGraki or just a regular Meraki SD-WAN deployment?

Re: Cisco Secure Connect download bandwidth problem

anfare — Tue, 19 Nov 2024 19:54:28 GMT

Are you downloading from Windows or from somewhere on your LAN? If from the web, you can try adding windows download (and other) URL's to your global or specific Whitelist/Allow list. You can also try to bypass Decryption if you have that enabled. Finally, you can avoid Umbrella altogether with those domains/URL's by adding them to the Security & SD-Wan > Threat Protection > Umbrella protection > "Specify one or more domain names below (one per row) to be excluded from being routed to Cisco Umbrella." text area.

Re: Cisco Secure Connect download bandwidth problem

SecureConnctUsr — Thu, 21 Nov 2024 15:46:23 GMT

Hello Sahand,

We migrated from SIDraki

Re: Cisco Secure Connect download bandwidth problem

derhag — Thu, 05 Dec 2024 02:08:29 GMT

we are current multi-site meraki customers (MR, MX, MS, MC, Umbrella) and looking to upgrade/migrate to Merak Secure Connect... wondering if this was resolved, and if anyone else has advice on how well this works for SASE, CASB, and ZTNA... or should we look at Cato or Prisma or something else?

Re: Cisco Secure Connect download bandwidth problem

anfare — Thu, 05 Dec 2024 13:37:39 GMT

It has not been resolved for me. I still cannot get any SMB file transfers to happen faster than ~5MB/s at most. Usually hangs around ~1-3MB/s. I've spent 10+ hours on the phone with Meraki and ATT support trying to fix it to no avail. Not sure what other options there are--we're trying an MPLS line but are still having similar issues with that when it is connected to the Meraki equipment for some reason. I may end up just getting cheap netgear or whatever hubs to put at both ends of the MPLS line if I can't get it solved soon. I will report back if/when that happens.

And to be clear: this does not include solving for the same slow connectivity when people use AnyConnect Secure VPN client. All VPN users experience the ~5MB/s slow SMB file transfer speeds no matter what. Otherwise, I'm experiencing the issue on the SD-Wan connection to our single second location. Those users all have abysmal file transfer speeds over SD-Wan on 1GB connections (all speed tests show full symmetric speeds are being achieved).

Re: Cisco Secure Connect download bandwidth problem

SecureConnctUsr — Fri, 21 Feb 2025 09:53:42 GMT

We deployed a new site in our SD-WAN recently and have no throughput problems on it even after activating AMP, IDS/IPS and passing all flows through secure connect.

The difference with other sites is that this one contains very few clients, so bandwidth isn't used very much.

According to the various feedbacks I've had, it's possible that the secure connect bandwidth is ‘overloaded’ (I can't see it from the console but that's what the support team told me) and that business flows, Microsoft for example, should be passed through local internet breakout.

The SD-WAN Plus licence allows you to put categories in the local internet breakout without having to enter all the IPs one by one.

The second thing that has improved throughput on our side is the removal of load balancing.

Perhaps it will be the same for you.

Best regards,