Slow VPN throughput via Cisco 831

[rts-net-support]

Hello all,

I have the current situation. A remote office has an ADSL connection (6Mbps down, 512kbps up) and we use a Cisco 831 router to establish a site-to-site VPN to our HQ. The connection works fine, VPN as well, we have connectivity between the two sites. My problem is that they can only download with about 1.5Mbps, via the VPN, from the HQ. The upload is fine, they can send for the full 512kbps over the VPN.

We have tested the connection and we can download with 6Mbps from the internet, via the same Cisco router so the connection is fine. Why am I seeing slow throughput via the VPN ? There is no limitation on the HQ side where we have a 100Mbps connection.

The config on the cisco 831 is pretty basic, no rate-limiting, just a crypto map applied to the external interface. The router is acting as a PPPoE client as well, not sure if this impacts on anything.

Any ideas are appreciated.

Thank you,

Stefan

[rts-net-support]

No ideas ? Is it something wrong with my setup or 1.5Mbps is the max IPSEC throughput I can get from a Cisco 831 ?

[jstrine]

Clear interface counters with "clear counters". Perform the download test and then issue a the "show proc cpu hist" command to look at CPU usage. Then do "show int" and see if you are getting dropped packets. This is only a start but see what that turns up. Maybe there is a CPU bottleneck when it comes to doing encryption. The 831 does have a hardware encryption module, but depending on your VPN setup, it may not be doing all the work and putting some strain on the CPU. Let us know what you find.

[rts-net-support]

I tried what you suggested. Cleared the counters, transfered a file and then looked at the interfaces. No packet drops, nothing weird there.

The "show proc cpu hist" shoes a constant 70% CPU usage during the transfer. Is that normal ?

[jstrine]

70% seems a bit high. Issue the following command and post the output (it will show what crypto engines are in your 831):

show crypto engine brief

Also, have you disabled the hardware engine using the following command at all:

no crypto engine accelerator

Finally, what program are you using to test the throughput? My experience with programs like iperf are that TCP window size tuning can dramatically affect the throughput on these types of connections.

[ahmed.badawy]

Would you send show version on 831?

I need to know the VPN device used at HQ?

[rts-net-support]

The solution to this might be a lot easier than expected, as always. We're investigating with our datacenter ISP, there are indication they use some kind of QoS policies we were not aware of. I'll get back on this if that's the case.