Whenever you have a Bandwidth constraint question (encrypted network or not, doesn't matter), the question is always the same. Where's the bottleneck?
The answer to #1 is: Don't know, where's your bottleneck?
In any WAN (any topology), you usually only have three questions to answer to find the problem.
First question, what is the slowest link in the network from point A to point B, and is it congested?
Second question, is there a piece of equipment involved in the WAN that has hit some capacity limit? This question for non-encrypted/compressed networks normally doesn't come up in recent times, but for those of us who live with secured networks, this question comes up all of the time. Cisco isn't that great at publishing performance data on their encryption engines, but you can find this data if you search enough, and definately if you ask your Cisco rep/TAC.
Third question, what is the latency between point A and point B, and is it enough to slow down the window to effect the overall speed of data transfers? Most people don't truely understand this aspect. This is a rule of thumb question, and there are a number of specifics that can cause a debate to spark, but this entire question can be summarized by a fairly simple equation. 1000 / ms rtt * 64 = Maximum transfer speed under any circumstances.
So, to find what needs to be upgraded is to find the limits of each of these 3 questions.
As an example:
2 sites, both with E1's and 2621's with no VPN adapters. 180ms round trip (rtt) latency.
The latency is the easiest of figure out. 1000 / 180 * 64 = 355k Byte Maximum transfer speed. So, no matter what we do, a single transfer will never exceed 355kB on this link (depending on link saturation, on window size, on number of flows, etc... But this is just a rule of thumb).
For simplicity sake, I'll take the latency number and times it by 10 to make it bps and cover for protocol, network, and encryption overhead. 3.5 Mbit max
E1 = 2 Mbit Maximum speed
2651 in software encryption mode = ~ .256 Mbit
3.5 Mbit max, 2 Mbit, 0.256 Mbit. Which one is the bottleneck?
Here's the trick to this, balancing the solution.
Anyways, this should be enough to get you in the right direction. I have no idea what the IMix bandwidth limit is for a 515e. Good Luck.
As for #2. Yes, it's called an SLA. We has several vendors that provide us SLA's across their commodity IP networks (although none of them want to admit it, they want to tell you that it's impossible and sell you MPLS).
If you're saying applying traffic-shaping/priority/partitioning between the VPN devices themselves, that's a bit more difficult. Cisco is a bit limited in this respect, but I'd take a look at DMVPN as a good place to start.
Rob
