Unexpectedly slow speed through VPN tunnel

[swiftblade]

Hi all, just to start with the fact that despite 20+ years IT Experience, I am a complete novice when it comes to Cisco products. Our current setup was installed by a 3rd party, but unfortunaltey they do not exist any more.

We have a setup whereby 2 sites are connected over the internet via reasonably high speed broadband (80meg up, 20meg down at both sites) using 2 x PIX 506e firewalls. Connection to the internet is as expected and nice speeds acheieved, but traffic between the 2 sites seems extremely slow. File transfers, site B accessing a SQL server at site A, even simple explorer navigation can be painfully slow (and I'm talking click a folder... wait sometimes 20 seconds+...).

My lack of experience/understanding of how Cisco works is hampering my ability to investigate what could possibly be wrong here, so I was hoping that maybe some of you would have some advice as to what to do/check - and possibly how to do it - in order to resolve this.

Could anyone advise on what to do to resolve/investigate?

[pompeychimes]

Does any traffic over the VPN perform as expected. For example how does a simple ping perform using IP addresses (Not names) over the VPN.

James

[swiftblade]

a standard ip ping seems ok, average response is 25ms.

RDC seems more or less ok, occasionally its a little slow to respond, but this is visual and really an accurate account.

[pompeychimes]

Up your pings to 1500 bytes. If it fails, reduce the byte size (1480, 1460, 1420, etc...) till you get a consistent reply with no drops. When consistent what is the response time?

[swiftblade]

sending without fragmentation I get 1400 bytes @ average 24ms.

with fragmentation I get 17750 @ average 46ms.

Any higher and the ping fails.

[swiftblade]

Don't suppose you have any update for me do you?

[Joseph W. Doherty]

Disclaimer

The    Author of this posting offers the information contained within this    posting without consideration and with the reader's understanding that    there's no implied or expressed suitability or fitness for any  purpose.   Information provided is for informational purposes only and  should not   be construed as rendering professional advice of any kind.  Usage of  this  posting's information is solely at reader's own risk.

Liability Disclaimer

In    no event shall Author be liable for any damages whatsoever  (including,   without limitation, damages for loss of use, data or  profit) arising  out  of the use or inability to use the posting's  information even if  Author  has been advised of the possibility of such  damage.

Posting

Some common causes for VPN slowness: IP fragmentation, packet drops when interface exceeds ISP rate limits and sharing bandwidth with other Internet traffic.

[swiftblade]

Can anyone follow up on where pompey was going with what he was suggesting or maybe help out any other way at all? Would be most appreciated.

[swiftblade]

Ok, I'll try one more time for help, but if no-one here can help, can anyone then advise on the best place to look for an answer next?

[Joseph W. Doherty]

Disclaimer

The  Author of this posting offers the information contained within this  posting without consideration and with the reader's understanding that  there's no implied or expressed suitability or fitness for any purpose.  Information provided is for informational purposes only and should not  be construed as rendering professional advice of any kind. Usage of this  posting's information is solely at reader's own risk.

Liability Disclaimer

In  no event shall Author be liable for any damages whatsoever (including,  without limitation, damages for loss of use, data or profit) arising out  of the use or inability to use the posting's information even if Author  has been advised of the possibility of such damage.

Posting

From what you describe, I would first suspect IP fragmentation.  Firewalls can preclude PMTUD.  Even when they don't, PMTUD isn't optimal with initial IP fragmentation (one reason for Cisco's adjust-mss on some platforms).

I'm unfamilar with PIX firewalls, so I'm unable to be more specific.