Site to Site Connection Slow on XGS116 and XGS2300 with big Files

Hello Markus,

Greetings!

If you have captured the tcpdump on destination IP address, while file transfer and if you have observed that server replied with the lower MSS. Certainly, lowering down the MTU/MSS of the LAN interface would help! You will need to lower down the MTU and MSS of the interface for which the network used in IPSec! 

Hello Markus,

Greetings!

If you have captured the tcpdump on destination IP address, while file transfer and if you have observed that server replied with the lower MSS. Certainly, lowering down the MTU/MSS of the LAN interface would help! You will need to lower down the MTU and MSS of the interface for which the network used in IPSec! 

Thank you very much for your fast answer. I have to configure both Interfaces on the xgs under Interfaces /Advanced Settings and lower the MTU from 1500 to 1378? Actually i do not use override mss, should i?

Hello,

Please do change the MSS accordingly by choosing an option override MSS.

After changing the MTU, speed increases with large Files nearly to 36Mb/s. Thanks

What firmware version are you running on the firewall, Some other things to note down here, Please see if IPsec acceleration is enabled on both the appliances : 

console> system ipsec-acceleration show 
IPsec acceleration status: turned on

Also AES 128 GCM ciphers are less CPU intensive than that off the AES 250 CBC they should yeild much better performance. Also is there a NAT involved in either side WAN interface having a private IP ? or are you terminating your tunnel on an alias interface ? if yes try it on the parent interface You can also change to IKEv1 

is there a LAG in the picture on the WAN interface on either sides ? 

-Cheers,

Kranthi

i use SFOS 19.0.1 MR-1-Build365 on both sides. At least deactivating the Ipsec-acceleration the speed was better as activated. One Firewall is Nat, the other not. A lag in the picture?

Unfortunately, the connection had stopped working this morning. I had to set the MTU back to 1500.
After that I wanted to configure a site to site tunnel interface which worked on the XGS116. But when I want to activate the tunnel interface DataCenter on the XGS2300 I get the following error:

Hello,

Do you have any tunnel with the remote gateway set as any (*)? If so, in that case you have to use the same preshared key to make it work. 

Hey Markus Straubinger, try restarting the VPN service the tunnel should be connected !! 

Hi Vivek, same Error after restarting VPN Service, when i activate the Tunnel, get this Error.

to use the same preshared key 

thank you, that´s it!