Solved

Slow response across IPSEC VPN tunnel

Posted on 2006-06-22
9
611 Views
Last Modified: 2008-03-10
Hi,
I have a pix 506e at a remote location terminating a VPN tunnel to a Cisco concentrator 3015 which sits at our corp. offices. The site uses split tunneling so it only accesses the site across the tunnel for corporate traffic. They connect to a terminal emulating program, oracle through a web browser and e-mail via SMTP through the tunnel.

Periodically through out the day the remote end will experience extreme slowness. When I ping across the tunnel the response is 300ms or higher. If I ping the outside interface to check the internet side it pings at 83ms. Since the internet side is stable at 83ms it can't be the internet causing the slow down. I have had every single user in the remote location shutdown all computers and printers but it does not fix the problem they still run at 300ms. I have enabled logging to debugging, installed an SNMP monitor and watch the connections. I do not see anything out of the ordinary and I can't seem to find what is causing the tunnel to slow down to that extreme.

Any ideas?
0
Comment
Question by:krmis
  • 4
  • 3
9 Comments
 
LVL 13

Expert Comment

by:prashsax
ID: 16960401
It could be due to processor overload at either PIX or Cisco concentrator.



0
 

Author Comment

by:krmis
ID: 16960457
I don't think it would be the concentrator because its does not happen to all sites at the same time.

As far as the pix how would I check if it was the processor would I just need to run the following command
show cpu usage or is there additional commands?
thanks
0
 
LVL 13

Expert Comment

by:prashsax
ID: 16960521
Yes,

For CPU
show cpu usage

For traffic(Just in case the Internet Bandwidth is being bottleneck)
show traffic

0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:krmis
ID: 16960557
Below is the out put from show traffic
how would I be able to tell if the internet bandwidth is being bottlenecked? What should I look for?
thanks



outside:
        received (in 164746.100 secs):
                402190 packets  192630649 bytes
                2 pkts/sec      1012 bytes/sec
        transmitted (in 164746.100 secs):
                383872 packets  62467026 bytes
                2 pkts/sec      14 bytes/sec
inside:
        received (in 164746.100 secs):
                417874 packets  56147600 bytes
                2 pkts/sec      1 bytes/sec
        transmitted (in 164746.100 secs):
                424749 packets  185104798 bytes
                2 pkts/sec      1019 bytes/sec

CPU utilization for 5 seconds = 0%; 1 minute: 0%; 5 minutes: 0%
0
 
LVL 13

Expert Comment

by:prashsax
ID: 16960720
At this time, it is normal.

Do you still get slow response.
0
 

Author Comment

by:krmis
ID: 16961065
Yes its normal at this time

How would I tell from the show traffic if its a internet bottleneck?
thanks
0
 
LVL 13

Accepted Solution

by:
prashsax earned 500 total points
ID: 16961272
You need to check the bytes/sec stats.

Suppose if you have a 1Mbps link at this site.

The maximum throughput will be 131072 bytes/sec.
Now this figure is for received and transmitted both combined.

When you exp. slow perf. check these stats, add both and see if its close to the limit.


0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question