Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 29 subscribers
  • Views 633 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN Performance (IKEv2) - Bad with VDSL - Good with Fibre

juergenb52

Hello,

we use Microsoft Always On for all Mobile and Home Office Users.

These clients connect to their home routers and connect to a public IP of our XGS2100.
The Firewall uses a symetric Fibre connection (100MBit) from German Telekom.

XGS has forwarding rule to the internal RAS Server.

SSL/TLS is currently disabled, IPS is disabled for this firewall rule at console level.

We have different situations with/without any problems

Users with a Fibre (400/200) at Deutsche Glasfaser have no problems.
Users with a VDSL  (250/10) at German Telekom have no problems.
Users with a VDSL  (100/50) at German Telekom have no problems.

But only some have problems with a VDSL Connection at German Telekom?

They use a AVM FritzBox, LANCOM R884AV, Speedport Router and all share the same problem.
Performance for MS AlwaysOn is terrible slow, they have disconnects, and no connections during the day.

I tried to change the MTU at Client Side (1300-1400) that didn´t change anything.
I changed the MTU at Internet Side in LANCOM Router <-> VDSL to 1400 and a few minutes this was better.

But most of the settings didn´t work at all.

Is there anything i could verify/change at Firewall (XGS 18.5.4) level?

I tried some TCP Dumps at Client Side, it doesn´t matter if the client uses WiFi (Connected to XGS2100) or a VDSL Internet Connection.
TCP Dumps shows a lot of TCP Retransmissions in both connection.

 But WiFi Connection and performance is good.

Has anyone solved these VPN performance Settings at Firewall Level?

Thanks

Jürgen



This thread was automatically locked due to age.
Parents
  • 0

    Hello ,

    Thank you for reaching out to the community, can you please share the config of the VPN ?

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Vivek Jagad

    <VPNProfile>
    <NativeProfile>
    <Servers>alwaysonvpn.company.de</Servers>
    <NativeProtocolType>IKEv2</NativeProtocolType>
    <Authentication>
    <MachineMethod>Certificate</MachineMethod>
    </Authentication>
    <RoutingPolicyType>SplitTunnel</RoutingPolicyType>
    <DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
    </NativeProfile>
    <DomainNameInformation>
    <DomainName>.company.de</DomainName>
    <DnsServers>192.168.0.109,192.168.0.104</DnsServers>
    </DomainNameInformation>
    <DnsSuffix>company.de</DnsSuffix>
    <Route>
    <Address>192.168.0.0</Address>
    <PrefixSize>24</PrefixSize>
    </Route>
    <AlwaysOn>true</AlwaysOn>
    <DeviceTunnel>true</DeviceTunnel>
    <RegisterDNS>true</RegisterDNS>
    <TrustedNetworkDetection>company.de</TrustedNetworkDetection>
    </VPNProfile>

Reply
  • 0 in reply to Vivek Jagad

    <VPNProfile>
    <NativeProfile>
    <Servers>alwaysonvpn.company.de</Servers>
    <NativeProtocolType>IKEv2</NativeProtocolType>
    <Authentication>
    <MachineMethod>Certificate</MachineMethod>
    </Authentication>
    <RoutingPolicyType>SplitTunnel</RoutingPolicyType>
    <DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
    </NativeProfile>
    <DomainNameInformation>
    <DomainName>.company.de</DomainName>
    <DnsServers>192.168.0.109,192.168.0.104</DnsServers>
    </DomainNameInformation>
    <DnsSuffix>company.de</DnsSuffix>
    <Route>
    <Address>192.168.0.0</Address>
    <PrefixSize>24</PrefixSize>
    </Route>
    <AlwaysOn>true</AlwaysOn>
    <DeviceTunnel>true</DeviceTunnel>
    <RegisterDNS>true</RegisterDNS>
    <TrustedNetworkDetection>company.de</TrustedNetworkDetection>
    </VPNProfile>

Children
No Data
Unfiltered HTML