Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPN Performance


I´m no tech genius, so please be patiance.

My VPN between our two offices are extremely slow. Both offices have 5 Mbit/s Internet connection and a Cisco Pix 501. My measurements show that trafic to Internet is actually 4-5 Mbit/s at both places, but trafic between our offices not nearly that good, I only get 0.2 to 0,3 Mbit/s.

What can be wrong?

//Jocke bohlin


Re: VPN Performance

Hi Jocke,

so you have a fully loaded access-line in both locations and site-to-site VPN gets only a small portion of the bandwidth? Can you test VPN throughput during off-peak hours?

You might run into some performance limitation of the Pix 501 and that can be checked when there is no other traffic on the access-link.

Mainly however I think the overloaded links are the reason. You could apply QoS at the WAN router to guarantee VPN traffic lets say 50% of your access bandwidth.

Hope this helps


New Member

Re: VPN Performance

Thanks for your answer Martin

I will try this although I have hard to belive this is the case. We are only a few people at both offices and there should be bandwidth available. I have tested more than once.

To dedicate bandwith to the VPN-connection is not an option in our case.

But I will test again next week when people are on christmas holiday. I´ll be back!


Hall of Fame Super Silver

Re: VPN Performance

While loaded links are certainly one possibility to consider, I believe that there may be other possibilities to consider. Whenever I hear someone describe performance difficulties in VPN I wonder about fragmentation. If the end stations are creating large frame sizes and the VPN adds extra headers, it is likely to produce frames that need to be fragmented. The overehad of doing the fragmentation and reassembly on the devices that are carrying the VPN traffic can have negative impact on VPN performance. If Jocke can set the max frame size lower on a pair of end stations and then test performance between that pair I wonder if performance would improve?



CreatePlease to create content