?
Solved

Site-to-site vpn - LAB - slow?

Posted on 2011-10-08
26
Medium Priority
?
1,558 Views
Last Modified: 2012-05-12
Hi,

to practice vpns I setup a small lab like this:

LAPTOP1 ----- ASA5505 --------- ZYXEL_USG50--------LAPTOP2

Stie to site vpn work fine, ping works great (1-2ms) but when I try to copy a file, it is slow. It is around 1-2 MB/s even though they are connected via 100Mb/s directly...

I know it is VPN, I am using AES but it is really slow... I get only around 10% of the bandwidth of this link really, as 100Mb/s = 12.5MB...

Any ideas? In the real life I never paid attention to it, vpn works and that's it... ;-)
0
Comment
Question by:m1979
  • 8
  • 8
  • 3
  • +3
26 Comments
 
LVL 20

Expert Comment

by:RPPreacher
ID: 36935919
CIFS (SMB) is pretty chatty and inefficient; you will never use 100% of BW using SMB.  sMB v2 (Windows 7 to Windows 7) and FTP are both better options to utilize bw.
0
 
LVL 99

Expert Comment

by:John Hurst
ID: 36936178
VPN is slow because traffic tends to move on the slow part of the DSL bandwidth. That is, if your download is fast, the file copy going the other way is uploading and so is slow.

The one thing that does affect VPN on DSL is the MTU size. Set the MTU size on the routers at both ends to 1492 or a bit less. Default is 1500. .... Thinkpads_User
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 36936229
Dsl???  Um, the author said 100mb direct connection
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
LVL 99

Expert Comment

by:John Hurst
ID: 36936232
Yes, I read that after. But I will still check MTU sizes to see if they make any difference.

... Thinkpads_User
0
 
LVL 4

Accepted Solution

by:
dcj21 earned 800 total points
ID: 36936293
Any errors on the ASA? Are the interface counters increasing?

What's the speed and duplex settings on the between ASA and ZYtel? Try setting them to 100 full, not auto. Auto negotiation doesn't always work. and can produce errors like this.
0
 
LVL 71

Expert Comment

by:Qlemo
ID: 36936389
The Zyxel can handle 90Mbit/s of VPN traffic, as Zyxel stated - but that does not say which encryption parameters they measure that with. AES should be fast, but there are not figures available showing that.
Further, the UTM part is only capable of 24Mbit/s, so maybe UTM features are applied to the VPN, slowing down performance.
0
 

Author Comment

by:m1979
ID: 36938327
Thank you, yes counters are increasing on asa and zyxel, vpn is working fine.

There are NO services enabled on Zyxel. Will check duplex/speed today and let you know.

Thanks guys!
0
 

Author Comment

by:m1979
ID: 36938726
I checked on Zyxel and it shows:

Router# show port status
Port Status     TxPkts     RxPkts     Colli.  TxB/s      RxB/s      Up Time
===============================================================================
1    100M/Full  127390     126785     0       0          0          184:54:38


So it is in full duplex and 100Mb...

MTU is 1500
0
 

Author Comment

by:m1979
ID: 36938873
Ok so what I did, I reconfigured my devices in a way that I can ROUTE between ASA and Zyxel, no VPNs. And... the speed is still very low. It is not as bad as it was, but still...

So the problem was/is not with VPNs but somewhere in these devices? No NAT is setup, no additional features enabled...

And when I try to copy a file, it shows around 30Mb/s even though it is 100Mb/s :(

0
 
LVL 99

Expert Comment

by:John Hurst
ID: 36938897
Assuming you have VPN still connected, 30Mb/sec is actually fairly decent (nothing will run at the full 100Mb/sec).   Try a smaller MTU to see if there is any difference as VPN likes to fragment packets.
... Thinkpads_User
0
 

Author Comment

by:m1979
ID: 36938956
no, 30Mb/s is WITHOUT vpn, just a static route from one firewall to another
0
 
LVL 99

Assisted Solution

by:John Hurst
John Hurst earned 800 total points
ID: 36938965
File Copy (Windows) has copy overhead related to Windows Explorer browse activities and that slows things down as well.

Can you try a different file transfer method (say FTP) to compare. FTP may work faster once the transfer has started. ... Thinkpads_User
0
 
LVL 4

Expert Comment

by:dcj21
ID: 36938967
Check the configuration to make sure it's set as  100M full on both devices, if it says auto, force them to 100 full
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 36939021
>File Copy (Windows) has copy overhead related to Windows Explorer browse activities and that slows things down as well.

Same thing I said on first post.
0
 
LVL 99

Expert Comment

by:John Hurst
ID: 36939048
>>> Same thing I said on first post.  Yes. In my comment, it was purely explanatory to trying a different transfer method.
0
 

Author Comment

by:m1979
ID: 36939228
Thanks thinkpads_user

I tried FTP: 5MB/s = 40Mb/s

Better but still 40% of my link only. I am curious why it is happening. I would accept 10-20% but not 60% decrease...
0
 
LVL 99

Expert Comment

by:John Hurst
ID: 36939388
Another file copy application is SyncBack Pro. It has a free trial and you might give it a whirl.  ... Thinkpads_User
0
 
LVL 37

Assisted Solution

by:ArneLovius
ArneLovius earned 400 total points
ID: 36939425
for testind bandwidth, don't use file copy software, use iperf http://en.wikipedia.org/wiki/Iperf
0
 

Author Comment

by:m1979
ID: 36939471
Fair enought ArneLovius, but my users will just copy files so this is really important.

What I want to know: is it normal or should I look for a solution?
0
 
LVL 71

Expert Comment

by:Qlemo
ID: 36939697
You should get a Ethernet capture, e.g with Wireshark, to analyze whether the IP exchange is ok, in particular in regard of retries, duplicate Acks, or other anomalies. Having a non-VPN, ethenernet type connection with that throughput is not normal. MTU restrictions could still apply, leading to unnecessary fragmentation (increasing the traffic overhead) and more processing.
0
 
LVL 99

Expert Comment

by:John Hurst
ID: 36939820
The file copy software I mentioned uses compression during copy so it speeds things up. ... Thinkpads_User
0
 
LVL 37

Expert Comment

by:ArneLovius
ID: 36941492
completely understand why you want to test file copy speeds as that is what it will be used for, but to for testing the bandwidth, iperf is the way forward, you can then make changes to the VPN config and retest knowing that the test is repeatable, once you have the VPN working as best as you can get it, then try your file copy test.
0
 

Author Comment

by:m1979
ID: 36951604
Iperf showed the same:

[ ID] Interval       Transfer     Bandwidth
[128]  0.0- 2.1 sec  9.54 MBytes  37.4 Mbits/sec


Any ideas please?
0
 

Author Closing Comment

by:m1979
ID: 36952020
Thanks guys. I decided to check the laptops as well and when I connected another laptop -  it was really ok 6-7MB/s... I think sth was wrong with one laptop... nic card was set up in 100/duplex but... well...

THANKS!
0
 
LVL 99

Expert Comment

by:John Hurst
ID: 36952028
Thank you. I was pleased to assist. .... Thinkpads_User
0
 
LVL 4

Expert Comment

by:dcj21
ID: 36952648
Yep, that auto-detect the speed and duplex doesn't always work right. I've seen it enough that know It's one of the first things I test on 'slow, but working' connections - set the speed and duplex manually.

I also recommend setting servers manually from the start since you know they will be around for awhile. Desktop ports I leave as auto unless there is an issue.
0

Featured Post

What Security Threats Are We Predicting for 2018?

Cryptocurrency, IoT botnets, MFA, and more! Hackers are already planning their next big attacks for 2018. Learn what you might face, and how to defend against it with our 2018 security predictions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes, you want your microsoft VPN to route all the traffic to the remote network. Usually your employer network. This makes it possible to access all the nodes inside this remote LAN, even if they have no "public DNS" entries. To do so, you wo…
Will you be ready when the clock on GDPR compliance runs out? Is GDPR even something you need to worry about? Find out more about the upcoming regulation changes and download our comprehensive GDPR checklist today !
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Course of the Month16 days, 5 hours left to enroll

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question