Slow response across IPSEC VPN tunnel

Posted on 2006-06-22
Medium Priority
Last Modified: 2008-03-10
I have a pix 506e at a remote location terminating a VPN tunnel to a Cisco concentrator 3015 which sits at our corp. offices. The site uses split tunneling so it only accesses the site across the tunnel for corporate traffic. They connect to a terminal emulating program, oracle through a web browser and e-mail via SMTP through the tunnel.

Periodically through out the day the remote end will experience extreme slowness. When I ping across the tunnel the response is 300ms or higher. If I ping the outside interface to check the internet side it pings at 83ms. Since the internet side is stable at 83ms it can't be the internet causing the slow down. I have had every single user in the remote location shutdown all computers and printers but it does not fix the problem they still run at 300ms. I have enabled logging to debugging, installed an SNMP monitor and watch the connections. I do not see anything out of the ordinary and I can't seem to find what is causing the tunnel to slow down to that extreme.

Any ideas?
Question by:krmis
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
LVL 13

Expert Comment

ID: 16960401
It could be due to processor overload at either PIX or Cisco concentrator.


Author Comment

ID: 16960457
I don't think it would be the concentrator because its does not happen to all sites at the same time.

As far as the pix how would I check if it was the processor would I just need to run the following command
show cpu usage or is there additional commands?
LVL 13

Expert Comment

ID: 16960521

show cpu usage

For traffic(Just in case the Internet Bandwidth is being bottleneck)
show traffic

Get proactive database performance tuning online

At Percona’s web store you can order full Percona Database Performance Audit in minutes. Find out the health of your database, and how to improve it. Pay online with a credit card. Improve your database performance now!


Author Comment

ID: 16960557
Below is the out put from show traffic
how would I be able to tell if the internet bandwidth is being bottlenecked? What should I look for?

        received (in 164746.100 secs):
                402190 packets  192630649 bytes
                2 pkts/sec      1012 bytes/sec
        transmitted (in 164746.100 secs):
                383872 packets  62467026 bytes
                2 pkts/sec      14 bytes/sec
        received (in 164746.100 secs):
                417874 packets  56147600 bytes
                2 pkts/sec      1 bytes/sec
        transmitted (in 164746.100 secs):
                424749 packets  185104798 bytes
                2 pkts/sec      1019 bytes/sec

CPU utilization for 5 seconds = 0%; 1 minute: 0%; 5 minutes: 0%
LVL 13

Expert Comment

ID: 16960720
At this time, it is normal.

Do you still get slow response.

Author Comment

ID: 16961065
Yes its normal at this time

How would I tell from the show traffic if its a internet bottleneck?
LVL 13

Accepted Solution

prashsax earned 2000 total points
ID: 16961272
You need to check the bytes/sec stats.

Suppose if you have a 1Mbps link at this site.

The maximum throughput will be 131072 bytes/sec.
Now this figure is for received and transmitted both combined.

When you exp. slow perf. check these stats, add both and see if its close to the limit.


Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
Make the most of your online learning experience.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question