IPSec inside of IPSec

Unanswered Question
Jun 17th, 2009

Hello,

I have a scenario that has IPSec inside of IPSec. Below is how:

From our Data Center, we have IPSec to ISP. For our remote sites serviced by this IPS, ISP assigns a priavate IP Address to WAN port on Cisco router. Let this private IP Address be 10.254.254.29/24. All traffic that originates from remote site comes in to our data center. We do one-to-one private-public NAT for this 10.254.254.29 address. Let the public IP address be 172.16.16.16 (I know it is not public, but for sake of discussion).

Our customers establish IPSec tunnel from their HQ to this NAT'd IP Address (172.16.16.16).

What we are experiencing is about 75% degradation in data rate. Comparision is as below:

When we download a 5 MB file from Internet to PC at Remote site (10.254.254.29), it takes about a minute. But a 5MB file download from HQ, it takes between 4-5 minutes.

Any thoughts???

Thanks in advance,

Paresh.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
srue Wed, 06/17/2009 - 09:25

double encryption i'm sure is adding tons of overhead. check for fragmentation along the path.

pkpatel Wed, 06/17/2009 - 10:49

Thanks.

Is it desirable to have DF bit set or cleared in this situation?

Actions

This Discussion