IPsec S2S with GRE Cisco ASA

[Jon Are Endrerud]

Hello

We are having troubles with our IPsec setup and Aruba Wireless Controllers and access points in our network.

Setup as show in picture:

The Aruba Controllers are running GRE against the wireless access points through the IPsec tunnel. The problem is that download speed to clients in the branch network are very low. Upload though are as expected. We are suspecting MTU of course, but are uncertain were to start.

Do anyone in the forum have experience with IPsec and GRE ? We would really appreciate any help you could give.

Thanks you all in advance.

[M-Square]

Hi Jon,

Have you tried any other tests regarding mtu/fragmentation?  I.e. ping various tests with larger packet size etc across the VPN to the WLCs and other various nodes on the head end?  Might provide some additional info and is a quick and easy to do.

Have you confirmed that wired devices across the VPN (unrelated to the Aruba wrls infrastructure) are indeed getting the UL/DL speeds anticipated?

Cheers,

~Merlin

[Jon Are Endrerud]

Tests have been done, but I will do them step by step in the days to come.

IPsec perfomance is as expected when running iperf and other performance tests. This problem only occurs with GRE encapsulated traffic.

We have TAC support from Aruba, but I thought someone in this forum had seen this before.