You say your router is configured for redundancy with 2 WAN links, are these equal cost default routes, routes with different costs or a primary and standby type configuration?
If the links appear as equal cost paths then your IPSec traffic may be arriving out of order, which will give performance problems, that's one thought I had on reading this post. Or even arriving with differnet source addresses due to the NAT on the external router.
If you break one WAN link does your IPSec performance improve?
In a situation like this I'd prefer to use public addresses on the PIX to router link, remove the NAT from the external router and use routing (policy routing to push the IPSec down one link to prevent packet re-ordering problems.
Configuration is two WAN links. Arrangment is primary and backup. All traffic flow through primary. I use IP SLA to declare a route down and the other floating static kicks in via the backup. Both outside appear as two differnent IPs. This works great with www etc.
PIX sits behind the router with router as next hop and PIX is unaware of which route it takes.
I have configured remote PIX peers with both addresses. Under normal load PIX remote peers access the NAT'd pix via static port maps on UDP 4500 and 500. I also have static NAT on the backup interface. When the link fails over www traffic works great but IPSEC doesnt fail over very reliable. I see it building NAT translations on the router for the link thats down.
Normally PIX works ok behind NAT router, but it really doesnt work well with the failover interface, despite remote peers having this as an alternative endpoint.
BenefitsDocumentationPrerequisiteImage Download LinksLimitationsSupported PlatformsLicense RequirementsTopologyStep-By-Step ConfigurationConfigure Virtual ServiceActivate the virtual service and configure guest IPsConfiguring UTD (Service Plane)Configurin...
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...