RV345 IPSec VPN - Shouldn't I get a better speed?

[jeremy000]

I have 2 RV345 routers at two sites, about 25 miles apart.  They each have 1gig up/down fiber Internet so speed is not an issue.  I setup a single IPSec VPN between the two sites and it connects and works fine, but the best speed I can get is 15mbit/sec.  No matter if I switch from very, very low (3DES, etc) security up to SHA2-256 and it stays the same.  So this tells me that it's not the router being "maxed out" and no matter what IPSec Profile settings I try, it's almost always 14.5-15.0mbit/sec tested via iperf from a server in each site.  

Is there some sort of QoS setting that'd limit it to 15mbit/sec by default?  i didn't set up any other firewall or QoS rules after I setup the IPSec tunnel.  It's a pretty basic setup for now as I wanted to test the VPN tunnel before setting up anything extra.

[balaji.bandi]

Post the full configuration, what is MTU configuration ?

[jeremy000]

Looks like MTU is 1500 -- I haven't changed any of those settings.  There are no modems in from of these devices, they are directly connected from the Ethernet coming into the buildings from the ISP.

I could not find a way to do a 'show run' and get the config.  It looks like I can save the config to an XML.  Should I post that once it is sanitized of sensitive information?

Thanks for your help.

[jeremy000]

I cleaned the XML from the main site and site2 and am attaching it here (renamed to .txt).  If there's another way of getting a running config that you'd like then please let me know.    Note that I am using the default IPSec profile, but even when I created my own and used the lowest security settings (just to test), I still maxed out at the SAME exact speed when testing (15mbit/sec).

[jeremy000]

I didn't set any MTUs, so I assumed it was 1500, but after looking at the config files, it looks like the VLANs I added later (I did not use VLAN1), were set to 1400. However, I do not see anywhere in the settings where I can set the VLAN's MTU. I only see 1400 in the config file. Could this be the problem? The WAN ports on both routers are set to the default, which it says is 1500 MTU.

[balaji.bandi]

At this moment, the configuration not able to read correctly.

To bottom of the speed issue you are encountering now,  you need to do more test and input here to suggest.

1. site to site you have 1GB link - have you tested with out VPN, what is your results.

2. Do you have High level network diagram to visualize what are the device involved in the network when you doing this test.

3. worth to take screen shot of the configuration attached to ticket to analyse what is wrong configured(what you think is wrong).

4. since we only having issue  with  vpn as you mentioned originally, i was suspected it may be MTU issue based on the issue reported here(may be not).

you need to test every point of test to mitigate this issue.

[jeremy000]

Thank you for the response.  I will address each part of these questions:

1)  There is no site-to-site direct link (besides VPN).  But each site has fiber Internet from an ISP.  I was incorrect that both sites are 1gbps up/down.  One site (site 2) is 1gbps up.down, but site 1 site hasn't been upgraded and is rated at 1gbps up, 100mb down.  Since the VPN is only connecting the two local subnets, Internet traffic does NOT go over VPN.  I can run a speed test and get these speeds (tested to www.speedtest.net).

Site 1 (1000 down, 100 up rated speed);  

Down:  333mbps

Up:  97mbps

Site 2 (1000mbps up, 1000mbps down rated speed:

Down: 547mbps

Up:  799mbps

2) I do not have a diagram, but this is a very simple network:

  Site 1:  ISP has demarc on the wall with an RJ45 jack that that goes directly into WAN1 of RV345 via Ethernet.  A server is on a LAN port, using VLAN7.

  Site 2:  ISP has demarc on the wall with an RJ45 jack that goes directly into WAN1 of RV345 via Ethernet.  The other server is on a LAN port of RV345, using VLAN20.

3) I am attaching a screen shot of the Site-to-site VPN settings.  This is the same for both sites, just opposite info.  The advanced options has no settings checked.  Note that I am using the DEFAULT IPSec profile.  I tried others but no change in speed.  The MTU of the WAN connections are set to "Auto" which the CIsco GUI says is the default of 1500.  I do not see where to set that MTU of the VLANs, but the config I exported shows it as 1400 (I did not set this, it was set by default).  These are new RV345s so 99% of things are factory settings.  No special firewall rules and no QoS are set by me (all are default).

4)  Should I export the config, edit the MTU of the VLANs to 1500, and then reupload to the RV345?  I do not see any way to change the MTU setting of the LAN/VLAN.  Only can change MTU of the WAN port and I left it at default of 1500.

Thanks again for your help.

[jeremy000]

I kept testing and realized I could copy a file from a server in site 2 back to a DIFFERENT server than I was testing in site 1 and was hitting much faster speeds, sometimes 50-70mbit/sec.  So I found a setting on the original server I was testing from in the Broadcom NIC settings about QoS and disabled it.  I am now hitting faster than the 15mbit/sec I was limited to before.  I'll keep testing, but it looks like it could have been this setting causing my problems.

[balaji.bandi]

Glad now you know the bottleneck of the issue. yes some time it happens

you also need check Server side NIC model and limitation, what is the speed handshake with device port.

If i were you, i introduce another device in the same network and test locally also(each site- confirmed there is no local issues), what is the performance compare to over wan.