Hi,
I have two 7206 VXR routers with the VPN Service Adapter either side of a leased line (i.e. no provider between, pure layer two connectivity)
A requirement is that traffic traversing the link is encrypted so I've configured an IPSec VPN between the two endpoints.
During load testing we noticed a very severe performance hit when the VPN was enabled, disabling it again saw we were able to use almost 100% of the 1000Mbs line.
The performance hit looks to be due to the increased MTU size when using IPSec, possible due to fragmentation.
I've read that the 7206 VXR can support 980Mbs (or there abouts) of throughput using AES providing the MTU size is 1400.
Configuring this manually on each server in each data centre isn't feasible.
As the link is effectively a point to point and we have control over the MTU size between the two routers, what options are available to increase the performance when the VPN is enabled?
Many thanks
Lee