CIsco RV130W - The router is slow to navigate the internet, how to fix?

[Guarino01]

I have a 2 RV Series 130 wireless VPN routers connected to each other.  The VPN functions excellently.  However connection to the internet is...odd.

On some pages, not all, you will connect and the page will not load just a loading symbol however the moment you hit refresh the page instantly loads.  It does the same thing when you are working with the routers configurations.  I will click on lan the screen will go white, I will wait a few moments then click refresh and instead of refreshing the page will instantly load.  This happens on both routers.  I have eliminated all of the firewall defenses in order to speed things up but nothing seems to change it.

Just for diagnostics.

Have the latest firmware installed.

Each router is set to gateway, as a static IP.  Each router connects a VPN to each other soley for the purpose of IP Phones (nothing else needs the VPN tunnel).  About 50 devices are connecting to the Routers.  Wireless is setup and running. Otherwise the setup is...well default. 

Any clues as to what causes this issue?

Thanks in advance for any assistance.

[SamirD]

Have you tried different browsers?  Also, does rebooting the router help?

[Guarino01]

Different Browsers act slightly differently depending on the page, however all of them seem to end up on some pages needing to be refreshed before loading the page.  As for rebooting the router, that does not seem to resolve the issue.  I've been monitoring the RX and TX of the VPN and both numbers stay well below the Download and Upload, heck they stay around 750K.  Our band width is 35 Mbs down and 5 Mbs up.  

However the Wi Fi seems exempt from this issue. 

Again thanks

[SamirD]

So when you say that wifi is exempt, is it exempt from the slowness and refresh issue?

[Guarino01]

Yes the wifi seems to be exempt from the refresh issue, it is slower technically but it is not acting in any abnormal way. 

[SamirD]

Can you do a speed test from the wired and wireless and post both here?

[Guarino01]

OOKLA SPEEDTEST Wireless

• PING 29ms
• DOWNLOAD 39.99 Mbps
• UPLOAD 6.13 Mbps

OOKLA SPEEDTEST Wired

• PING 15ms
• DOWNLOAD 39.67 Mbps
• UPLOAD 5.61 Mbps

[Guarino01]

Side note.  I changed the Exchange Mode from Main to Aggressive, and the Authentication Algorithms from MD5 to SHA-1 and it seems to have at least temporarily reduced the occurrence of the issues. 

Does the help in diagnostic's of the issue? Is there anything else I can lesson in order to increase functionality (DH Group?)

Thanks for all the assistance.

[SamirD]

Why would the vpn mode and encryption affect the connection?  Are you connecting to the Internet over the tunnel?

[Guarino01]

First I don't know, however let me diagram the set up for you.

The ISP provides a cable modem, behind the cable modem is the cisco router, behind the router is the POE switch and a normal switch.  

• The Remote End Point is the Static IP provided by the ISP
• Local Traffic is the IP of the router
• Remote Traffic is the IP of the other branches router.

The same setup exist for the alternate location as well.  I hope that clears up any confusion. Maybe I did it wrong.

Thanks

[SamirD]

That is how I would have set it up too.  Completely normal.

Can you disable the vpn link and see if that improves the browsing?

[Guarino01]

It seems that the browsers download and load considerable faster without the VPN connected. 

[SamirD]

Okay, now we're getting somewhere.  What are your vpn settings?  I don't need to know IP addresses or passcode phrease, just the various configuration options, specifically encryptions.

[Guarino01]

Auto Poloicy Parameters

IPSec SA Lifetime: 3600

Encryption Algroithm: AES-128

Integrity Algrothim: SHA-1

PFS Key Group: Enabled

DH Group: Group2(1024 bit)

From the Advanced VPN Setup

Exhange Mode: Aggressive

Local

Local Identifier Type: Local WAN IP

Remote

Remote Identifier Type: Remote WAN IP

IKE SA Parameters

Encryption Algorithm: AES-128

Authentication Algorithm: SHA-1

DH Group: Group2 (1024 bit)

SA-Lifetime: 28800

Dead Peer Detection: Not-enabled

DPD Delay: 10

DPD Timeout: 30

[SamirD]

Try setting the encryption to DES and DH Group to Group 1 and see if it improves.