slow scp transfer - ASR router

[Edwin Summers]

Experiencing extremely slow transfer times using scp to transfer an IOS XE image to an ASR-1002(X).  Have attempted using three different routers and two separate servers.  In all cases scp is extremely slow.  A 380MB image is still transferring after three hours.

Transferring the same file using tftp takes just over 5 minutes. I have attempted the transfer using a Windows and a Linux scp server. In addition, I have scp'ed files to each of these servers to ensure they were operating properly - in both cases the servers can transfer the file in minutes.

-Do not believe it is an issue with the protocol itself or implementation on the servers: other scp transfers to the servers run quickly

-Research on this topic returned one response that the issue was due to writing the file to a flash filesystem. I have doubts about this since tftp transfers orders of magnitude more quickly, writing to the same filesystem.

I'm researching to see if there is a bug in these versions of code.

Next step is to run a packet capture during a transfer to look for clues.  Any experience/solutions to this issue appreciated!

-Ed

[Leo Laohoo]

Can't say I've seen this kind of behaviour, Edwin.  I always use TFTP and in some cases use USB to transfer IOS/Bootstrap to the appliance.

[Marvin Rhoads]

I've always used ftp and have pushed the ~380 MB IOS-XE images to ASR routers across a VPN and WAN in just a few minutes.

[ausregistry]

I noticed the same thing.  Noticed fluctuation in TCP WINDOW size. Couldn't find solution yet.

[shams.ahmad]

We have some similar issue.

1- SCP transfer from Server to the Router/switch is slow

2- SCP transfer on same network i-e using the same network devices from server to server is pretty good.

3- Same images of IOS working in other sites with no issue. all boxes have similar configuration.

verified  the WAN link directly connected a PC TO ISP and did a file transfer work extremely good.

The issue only observed while we copy to and from Networking device to the SCP server located on other site.

[shams.ahmad]

Have you found any cause of this ?We have some similar issue.

1- SCP transfer from Server to the Router/switch is slow

2- SCP transfer on same network i-e using the same network devices from server to server is pretty good.

3- Same images of IOS working in other sites with no issue. all boxes have similar configuration.

verified the WAN link directly connected a PC TO ISP and did a file transfer work extremely good.

The issue only observed while we copy to and from Networking device to the SCP server located on other site.

[Steve Howard]

I’ve been fighting this for a while and finally found a solution. It is due to default ssh control place policing. After entering the following commands on IOS-XR, my scp time dropped from a few hours to a few minutes!

lpts pifib hardware police

flow ssh known rate 15000

flow ssh default rate 15000

These rates are much higher than the recommended best practices values. See this document for more info: https://tools.cisco.com/security/center/resources/increase_security_ios_xr_devices.html

[jamesburnett]

This fixed it for me using NCS routers on IOS-XR 7.0.2. Went from 300K/s to 2.4MB/s. Thank you! 

[Chris Flint]

Old thread but really annoying problem.  This seems to have fixed it from ~150kB/s to 2MB/s, but it does drive CPU up to 80% or so on a quiet box.

ip tcp path-mtu-discovery
ip ssh window-size 131072

ip tcp window-size 131072

[Nathan Spitzer]

Thank You for this post! This solved it for me and my transfer rate (basically Coast to Coast over 1Gbs links) went from 50kB/S to 500kB/s. The transfer would have taken over 5 hours originally and went down to 45 min.