PIX-to-PIX VPN tunnel problem

[rmv72]

I have PIX-to-PIX VPN tunnel.

i started ping to PIX2 outside interface and reply always stable ( near 50 ms) but if i ping PIX2 inside interface than reply is very various ( more 300 ms and until 1500 ms).

If i start ping to internal interface with packet size 10000 than i get reply near 1000ms but reply from outside interface still near 50-80 ms.

How to unserstand it and how to resolve it?

[pkinzel]

The encryption you are using may be killing system resources. What kind of encryption are you using? And which model of Pix?

I did some testing and found AES-128 to be the best bet for security and speed (AES-256 killed my 501 and 506s).

Login to PDM (at least version 3) and watch the Processor and Memory to see if they are getting maxed out.

[rmv72]

PIX 501E

PIX Version 6.3(3)

crypto ipsec transform-set AES esp-aes esp-sha-hmac

crypto map M 10 ipsec-isakmp

crypto map MOSCOW 10 set transform-set AES

crypto map MOSCOW interface outside

isakmp identity address

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption aes

isakmp policy 20 hash sha

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

telnet timeout 60

-----------------------------------

CPU used near 20 %

Memore - 70%

--------------------------

I'm not shure which AES i used- 128 or 256?

[pkinzel]

How many VPNs are running on the 501?

You are using 128-bit encryption for IPSec.

(crypto ipsec transform-set AES esp-aes esp-sha-hmac ). I haven't found the isakmp encryption to play a major role in slowdowns because that happens fairly quickly and infrequently.

As a test, create a test transform set for des encryption on both Pix's-

"crypto ipsec transform-set des-test esp-des esp-sha-hmac"

then change the encryption on the transform-set of each pix to des

no crypto map MOSCOW 10 set transform-set AES

crypto map MOSCOW 10 set transform-set des-test

This must be done on both Pix's and will lower your VPN encryption from AES-128 to 64-bit DES. You could, as a test, remove encryption all together to see what effect it has.

[rmv72]

Onle 1 VPN are running on the 501.

I tryed to use des encryption but it didn't help.