site to site VPN latency issues

Unanswered Question
Feb 2nd, 2005

Hello, we'er having slowness issue over our P2P VPN. We hava hub and spoke setup.

Head

PIX 515e

3 spokes

PIX 501's

all are simple IPSEC tunnels with DES encryption. I've checked all connetions for speed/duplex issues, all seem fine. I was wondering about MTU issues. If that's the case, what are my best options to resolve the latency.

The reason I think its an MTU issue is. From one of the spoke sites, I can connect with my XP laptop and browse without much trouble, but 2000 machine are god awfull slow. I checked the MTU of my laptop and it's set to 1300. The 2000 machines are default which I'm assuming is 1500, thus my grand conclusion.

Any help on this is greatly appreciated.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 0 (0 ratings)
ehirsel Wed, 02/02/2005 - 18:38

It could be an mtu issue. On the spoke and head-end units, run the show sysopt command and note if any connection tcpmss is not 1380. That is the default value that the pix uses to work properly when it terminates IPSec vpn tunnels.

Is any spoke site connected via PPPoE (or PPPoA in the provider network)? If so, then the effecive interface mtu is 1492, and if you do not allow icmp to and from the pix (note: this is not the same as through the pix) then path mtu discovery is broken. Your XP ws is using an mtu of 1300 so it won't encounter the problem. Either adjust the spoke pix sysopt connection tcpmss to something like 1300, or adjust the interface mtu to 1492.

Let me know what you find.

patgarred Thu, 02/03/2005 - 08:24

Thanks for the reply,

Here's a screen copy of that command. it looks like tcpmss is set to 1380.

privatenetwork# sh sysopt

sysopt security fragguard

no sysopt connection timewait

sysopt connection tcpmss 1380

sysopt connection tcpmss minimum 0

no sysopt nodnsalias inbound

no sysopt nodnsalias outbound

no sysopt radius ignore-secret

no sysopt uauth allow-http-cache

sysopt connection permit-ipsec

no sysopt connection permit-pptp

no sysopt connection permit-l2tp

no sysopt ipsec pl-compatible

no sysopt route dnat

Also, the head site is a 10Mb fibre to Internet and the spokes are T1's one is fractional, so not PPPoE

Thanks for you help.

Patrick

ehirsel Thu, 02/03/2005 - 09:58

Try adjusting the mtu setting on the ms win 2000 client to 1300 for the virtual adapter and then connect. Let me know how it turned out.

patgarred Thu, 02/03/2005 - 10:36

that's fine for testing, except that most of the clients at this site are thin clients (all but 3). WYSE termianls, I was told that you cannot change the MTU setting on them. Also, I don't want to have to change workstation settings. Can't the settings in the PIX be changed to remmedy this?

ehirsel Thu, 02/03/2005 - 12:44

On the pix use this command:

sysopt connection tcpmss x where x can be anything upto 1460; the minimum can be lower than 512 though I do not know the exact value.

Try settting x to 1300 and see if the win 2000 clients can connect. I would make the change on one spoke site first, as that is where the clients reside.

Let me know how it proceeds.

patgarred Thu, 02/03/2005 - 12:50

Thanks for you help ehirsel,

I'll let you know how the test goes when i get a chance to impliment the changes.

Actions

Login or Register to take actions

This Discussion

Posted February 2, 2005 at 2:53 PM
Stats:
Replies:6 Avg. Rating:
Views:762 Votes:0
Shares:0
Tags: No tags.

Discussions Leaderboard