cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1411
Views
0
Helpful
6
Replies

IPsec Site-to-Site help

Chris Gabel
Level 1
Level 1
Hi Experts, Looking for some help with my IPSec site-to-site VPN. The VPN connection is up and active, I can ping between my sites and share files however it's very very slow. Browsing and opening files are almost impossible. Both sides are Cisco 2911 routers, both internet connections are from the same Telco, same speed as well, 150 down 20 up. Connection to the internet from each site is working as expected. I've been troubleshooting for a few days now but I'm stumped. The only errors I'm running into is a send error or two on each side of the tunnel as you can see with show crypto ipsec sa.
6 Replies 6

How much throughput do you have over the site to site VPN?  The 2911 only supports up to a maximum of 170Mbps

 

You could also try adjusting the MTU on the VPN interface to 1300 at both ends of the VPN. Perhaps it is the overhead that is causing issues.

--
Please remember to select a correct answer and rate helpful posts

To be honest I would be fine if I was getting even a few Mbps over the tunnel but I'm not even getting that. I set up an FTP server/client over the tunnel and it can barely make 30KB/s during transfer. 

NTFS file browsing works sorta.. takes time to load small images or documents.

 

 

I tried setting the ip tcp adjust mss value to 1200 with no difference in transfer speeds.

 

I set up Wireshark on one side of the tunnel and send a file over ftp for a packet capture.

As soon as the file transfer starts I'm getting a ton of TCP Dup ACK. I'm guessing this is the issue.

 

Does anyone have any thoughts? I seem to be getting a lot of Duplicate transmissions and I'm not sure why.

 

 

 

 

Is it just file transfer that is slow or everything else also?  how large is the file you are transfering?

--
Please remember to select a correct answer and rate helpful posts

I've tried different sized files but most of them are in the 7-300MB range.

It's slow with everything, the users have a shared folder location on the other side of the tunnel and browsing it is painful. Opening an image that's 9kb can take 16 + seconds. Word and pdf documents are way slower depending on the size. Everything eventually opens though.

 

For testing:

I disconnected the tunnel and connected my server with a client-server IPsec VPN to the same router on the other end of the tunnel and it works great. Speeds are perfect. I connect to each site separately using this VPN and it works great for me too. 

 

 

Still working on this fix.. I have the users connecting using the client->Server Ipsec client currently but it's not an ideal solution.

 

I will continue to troubleshoot.

 

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: