Thoughput issue on DMVPN with IPSec

[matthewthw]

I have setup a DMVPN network over a ISP MPLS network.

And I have conduct file transfer test from one end to the other end though the DMVPN network, and find that the thoughput is 80% of the link bandwidth (e.g the link bandwidth is 10Mbps but the actual thoughput is arpund 8Mbps)

My setup on the IPSec is ESP-AES with ESP-SHA-Hmac and on the tunnel,

Mtu size 1400 and ip tcp adjust mss is 1360 according to thw best pratice from Cisco.

Is there any way to fine tune my parameter to enhance the thoughput to reach 10Mbps?

[balaji.bandi]

what kind of device in the network, what is the IOS Code you running on them

show can you provide show version, and show running config .

Important check the CEF config on tunnel interface.

[Deepak Kumar]

Hi,

Can you share some more information as Hardware details, IOS details, Both end Internet connection Bandwidth, Delay between your ISP (Check online) and other Internet uses and CEF status?

Second, As you are getting 80% throughout of your total bandwidth so I am not looking any issue with configuration or etc. Of course, you will not  100% throughput over the VPN because of VPN is also an overlay communication. Somehow it will depend on the underlying network.

Regards,

Deepak Kumar

[Georg Pauwen]

Hello,

on a side note, you could try and configure tunnel path mtu discovery on your tunnel interfaces:

interface Tunnel0
tunnel path-mtu-discovery

Also, depending on your tunnel configuration, if you use mode transport, that will slightly decrease the MSS payload (not sure if that makes much of a difference when it comes to throughput in your case):

crypto ipsec transform-set TS esp-aes 192 esp-sha-hmac
mode transport

[Joseph W. Doherty]

How/what are you measuring for 8 Mbps throughput? Is this a the data transfer measurement? If so, besides the "lost" bandwidth to the tunnel and IPSec, don't forget the "lost" bandwidth due to L4 (TCP), L3 (IP) and L2 (frame) overhead as often 10 Mbps of link bandwidth is often noted for the physical bandwidth.

Also keep in mind, unless you've tuned the hosts for exactly the right number of buffers for the BDP, protocols like TCP will either under perform (i.e. they self limit their bandwidth usage due to insufficient buffers) or will exceed available physical bandwidth and back-off their transmission rate (due to too many buffers). The latter will generally average less than the maximum available bandwidth (the transmission rate graph tends to look saw tooth).