Anyconnect poor performance depending on service provider

[l.buschi]

Anyconnect poor performance depending on service provider
Hi all,

I have the following problem with ASA5506 ver asa9-14-2-8-lfbff-k8.

If I connect to a first Internet service provider I have good anyconnect performace for remote user and good Internet access general performance.

If the same firewall is connected to a new service provider only changing public ip address I have unacceptable anyconnet performance for remote user while internet access general performance still good.

this is my webvpn configuration:

webvpn
enable outside
http-headers
hsts-server
enable
max-age 31536000
include-sub-domains
no preload
hsts-client
enable
x-content-type-options
x-xss-protection
content-security-policy
anyconnect image disk0:/anyconnect-win-4.8.03052-webdeploy-k9.pkg 1 regex "Windows NT"
anyconnect image disk0:/anyconnect-win-4.8.03052-webdeploy-k9.pkg 2 regex "Windows CE"
anyconnect image disk0:/anyconnect-linux64-4.5.03040-webdeploy-k9.pkg 3 regex "Linux"
anyconnect image disk0:/anyconnect-macos-4.5.03040-webdeploy-k9.pkg 4 regex "Intel Mac OS X"
anyconnect enable
tunnel-group-list enable
cache
disable
error-recovery disable

I tried with different anyconnect version with the same result.

[balaji.bandi]

have this new link tested both download and uploads , is the results as expected , for me look like ISP issue rather config for now.

Do some testing without ASA and see you getting expected results.

[l.buschi]

I made many tests. Connection is as exptected with both service provider.

Only anyconnect remote connection by teleworkers doesn't work as expected. Could it be a matter of MTU or TCP-imss?

I also tried to connect directly to the firewall bypassing service provider and all works fine.

On his hand, service provider tested connection using a fortigate firewall and says everithing is ok.

[balaji.bandi]

If the Links are tested as expected results, next step is tune MTU as you pointed.

[l.buschi]

I don't know how to tune it. Do I have to tune MTU only for anyconnect?

[Dinesh Moudgil]

Anyconnect would ideally not behave differently for different ISP connections. Here are some pointers on MTU, crypto engine and tunnel optimization features that may help:

https://www.cisco.com/c/en/us/td/docs/security/asa/misc/anyconnect-faq/anyconnect-faq.html#Cisco_Reference.dita_376abafc-62cb-4dd4-b11c-7568b8d81f67

Configuring these features should help in Anyconnect optimization. For further investigation, you can use iperf application [https://iperf.fr/] to measure performance with VPN and without vpn(bypassing ASA) and if results are significantly different, engage TAC.

Thank you,

Dinesh Moudgil

P.S. Please rate helpful posts.