Poor IPSec VPN Throughput in One Direction

Hi Matthew,

what kind of OS are you using to measure throughput on both sides? I have seen some weird behaviour with windows clients and Sophos IPSec connections (policy mode).

In order to find what is going on I'd use wireshark on both sides and wee what happens ...

Also usually you don't get the whole bandwidth with one connection but I guess iperf uses udp ...

(Check both sides (rules, IPSEC configuration, IDS, .... of the tunnel)).

Maybe deleting and reconfiguration helps ...

Regards,
Bernd

Hi Matthew,

what kind of OS are you using to measure throughput on both sides? I have seen some weird behaviour with windows clients and Sophos IPSec connections (policy mode).

In order to find what is going on I'd use wireshark on both sides and wee what happens ...

Also usually you don't get the whole bandwidth with one connection but I guess iperf uses udp ...

(Check both sides (rules, IPSEC configuration, IDS, .... of the tunnel)).

Maybe deleting and reconfiguration helps ...

Regards,
Bernd

I had a Ubuntu system on one side and a Mac on another.  I was testing the throughput with iPerf, but I have also noticed in other just general usage of the network that there are throughout issues with traffic going in the one direction.

I will try Wireshark when I am physically with the equipment again to test it.

I don't necessarily expect to get the full 1Gbps throughput that both sides have, but was not expecting to see 200-300 Mbps one direction and 3 Mbps the other.

I will keep looking through the firewall rules to see if I can find anything.  The odd part is these rules have not been changed since it was configured and are currently pretty basic doing logging only with no Application controls or IPS.

Looking at Wireshark on both sides, with transfers in each direction, I am not seeing a whole lot different.  There are some TCP

 Window Full, TCP Dup ACK, and TCP Out of Order in the packet capture, but that happens in captures in both directions.

I looked through the firewall logs and there is only one rule for each direction that is hit with this traffic and it is a log only allow rule.  There is no App Control, IDS/IPS, etc.  IPSec config is identical on either side as well.

The weird part is that this used to work fine and suddenly stopped.  I am getting between 2-18 Mbps in one direction and 92-108 Mbps in the other today even though both sides have symmetrical gigabit internet.  I do not expect to get the full gigabit, but it is odd that one direction of traffic is so much lower than the other.

Hi Matthew,

why do you have two rules, you only need one firewall rule, please try disabling one and then run the tests again.

Ian 

It is one for each direction.  One for the outbound traffic and one for the inbound on each side.

Hi,

 what do you mean by traffic in each direction? Incoming and outgoing from your connection is all handled by one rule. 

Ian

For outbound traffic originating from location A, the rule is Source Zone: LAN, Any networks. Destination zone VPN, Destination Networks: Subnet at Location B

For traffic initiating on the other side of the tunnel. Source Zone: VPN, Source Network: Subnet at Location B, Destination Zone: LAN, Any networks.