VPN Performance

[JockeBohlin]

Hello

I´m no tech genius, so please be patiance.

My VPN between our two offices are extremely slow. Both offices have 5 Mbit/s Internet connection and a Cisco Pix 501. My measurements show that trafic to Internet is actually 4-5 Mbit/s at both places, but trafic between our offices not nearly that good, I only get 0.2 to 0,3 Mbit/s.

What can be wrong?

//Jocke bohlin

[mheusinger]

Hi Jocke,

so you have a fully loaded access-line in both locations and site-to-site VPN gets only a small portion of the bandwidth? Can you test VPN throughput during off-peak hours?

You might run into some performance limitation of the Pix 501 and that can be checked when there is no other traffic on the access-link.

Mainly however I think the overloaded links are the reason. You could apply QoS at the WAN router to guarantee VPN traffic lets say 50% of your access bandwidth.

Hope this helps

Martin

[JockeBohlin]

Thanks for your answer Martin

I will try this although I have hard to belive this is the case. We are only a few people at both offices and there should be bandwidth available. I have tested more than once.

To dedicate bandwith to the VPN-connection is not an option in our case.

But I will test again next week when people are on christmas holiday. I´ll be back!

//Jocke

[Richard Burts]

While loaded links are certainly one possibility to consider, I believe that there may be other possibilities to consider. Whenever I hear someone describe performance difficulties in VPN I wonder about fragmentation. If the end stations are creating large frame sizes and the VPN adds extra headers, it is likely to produce frames that need to be fragmented. The overehad of doing the fragmentation and reassembly on the devices that are carrying the VPN traffic can have negative impact on VPN performance. If Jocke can set the max frame size lower on a pair of end stations and then test performance between that pair I wonder if performance would improve?

HTH

Rick