IPSec inside of IPSec

Unanswered Question
Jun 17th, 2009
User Badges:


I have a scenario that has IPSec inside of IPSec. Below is how:

From our Data Center, we have IPSec to ISP. For our remote sites serviced by this IPS, ISP assigns a priavate IP Address to WAN port on Cisco router. Let this private IP Address be All traffic that originates from remote site comes in to our data center. We do one-to-one private-public NAT for this address. Let the public IP address be (I know it is not public, but for sake of discussion).

Our customers establish IPSec tunnel from their HQ to this NAT'd IP Address (

What we are experiencing is about 75% degradation in data rate. Comparision is as below:

When we download a 5 MB file from Internet to PC at Remote site (, it takes about a minute. But a 5MB file download from HQ, it takes between 4-5 minutes.

Any thoughts???

Thanks in advance,


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
srue Wed, 06/17/2009 - 09:25
User Badges:
  • Blue, 1500 points or more

double encryption i'm sure is adding tons of overhead. check for fragmentation along the path.

pkpatel Wed, 06/17/2009 - 10:49
User Badges:


Is it desirable to have DF bit set or cleared in this situation?


This Discussion