Network bottleneck

[carmicklec@gmail.com]

I am a Network Admin for a company that has 19 branch offices. All Branches are using Cisco routers and gigabit switches. We just got upgraded from 10Mbps to 50Mbps. It has been confirmed onsite, we are receiving the full 50Mbps, however at the workstations the speedtest only shows not quite 20Mbps. We are not using any QoS or traffic shaping in any way that I am aware of. I have gone so far as to turn off the access-group to see if it was holding it up even just a little (it wasn't). I am not onsite to do any of the normal troubleshooting. My question is: Is there anything you can think of that would throttle 30Mbps+ in the router config?

[balaji.bandi]

Yes depends on model ?

You need to give us full information, what is the device in HO where all teh braches termniate and what licenses you have in HO

also what is the brach router and what license you have ?

Do you use VPN to connect to HO ? any topology will be good to understand network.

if possible post point to point interface statics like : show interface gi 0/0 HO and Branch.

[carmicklec@gmail.com]

Cisco series 800 routers at branch generally 871 or 891. Main HQ is a 1941

I don't have any subscriptions to these. I buy them configure them and put them in production.

Branch router:

interface FastEthernet4
description Connected to CenturyLink
ip address xx.xxx.xx.xx 255.255.255.252
ip access-group 110 in
ip nat outside
ip inspect STOP out
ip virtual-reassembly in max-reassemblies 128
no ip route-cache
duplex full
speed 100
no cdp enable
bridge-group 1

Branch VPN:

interface TunnelX
description VPN Tunnel to HQ
ip address xxx.xxx.x.x 255.255.255.252
tunnel source FastEthernet4
tunnel destination xx.xxx.xxx.xx
tunnel key 0
tunnel protection ipsec profile cisco2

HQ Router:

interface GigabitEthernet0/1
description Connected to CenturyLink
bandwidth 100000
ip address xx.xxx.xxx.xx 255.255.255.248
ip access-group 101 in
no ip redirects
no ip proxy-arp
ip nbar protocol-discovery
ip nat outside
ip inspect STOP out
ip virtual-reassembly in max-reassemblies 64
duplex full
speed 100
crypto map cm-cryptomap

HQ VPN to Branch:

interface TunnelX
description Tunnel to San Francisco Branch#8
ip address xxx.xxx.x.x 255.255.255.252
tunnel source GigabitEthernet0/1
tunnel destination xx.xxx.xx.xx
tunnel key 0
tunnel protection ipsec profile cisco2

[balaji.bandi]

Looks the bandwidth support based on the models.

attache document for your reference

[carmicklec@gmail.com]

So if I am reading this correctly, it states my Cisco 881 Series router will not do more than 25Mbps?

[Leo Laohoo]

Nope.

[Richard Burts]

In addition to the limitations of the hardware already noted there are a couple of things that I see in the config that will have some impact on performance. You are inspecting traffic

ip inspect STOP out

And you are running the branch traffic through a vpn tunnel so there is processing overhead of doing encryption.

I am not suggesting that you should not do these but suggesting that you recognize that there is some performance impact in doing them.

HTH

Rick

[carmicklec@gmail.com]

I do expect some slow down but we are looking at 30+Mbps. Is this the amount of slow down you would expect?

[Richard Burts]

I believe that a large part of that 30+ is the limitations of the hardware and that some of that 30+ is the impact of inspecting traffic and encrypting traffic. What it is saying is that these functions help keep your network safe and are worth doing. But be aware that when you do them you will not get full rated performance of the platform (and that full rated performance of the platform is considerably lower than the new speed of your connection).

HTH

Rick

[carmicklec@gmail.com]

Ok then what is it saying?

[carmicklec@gmail.com]

Then what is it saying?

[Leo Laohoo]

What is the model of the router?

[carmicklec@gmail.com]

See reply above, Thank you.