PIX & Packeteer

[LittleFishy]

I have asked a similar question before, but I want to get clear in my head whay I'm doing before I commit.

I have two sites each has a Internet link and we then link the two sites using our PIX 515R's VPN setup. Our problem is that when using the VPN, its bandwidth get shrunk down when too many people are on the Net (at either site). We run a business critical app through the VPN and being a terminal services type app as soon as the bandwidth drops users get kicked out. I know the 515R doesn't support traffic shaping and so after a previous suggestion I was looking into Packeteer Packetshapers. My question is (a) are they going to work and (b) am I going to need one at each end? Each site has a separate IP structure and other than the app and the odd bit network browsing nothing else goes down the VPN. Thanks.


We have a PIX 515R used mainly for internet access, but also for a vpn connection to another office. I understand that the PIX will not allow traffic shaping, but does anyone know of any software/hardware solutions that will allow me to do it (without fiddling with our router)?

 

[WebSpyExpert]

http://www.webspy.com

There has been a stratigic partnership with an Optimization system that is a hard/soft combination that will allow you to optimize the bandwidth utilization enough to make this problem go away. If you would like to get some more information, check out the contact information at

http://www.webspy.com

 

[CHOUM]

I have this topology it work fine. Install a shaper on your central site. Of course it's better to use one on each side (to shape UDP or make compression).

It's a good solution.

 

[Shute]

I am also using a 1500 Packet shaper. You only need to if your wish to use compression. I do not think you will be able to compress encrypted traffic though.

Only Draw back, you will want to place your packeteer on teh outside interface of your PIX so that you can see IPsec and ISAKMP, however if you are using NAT or PAT, you will not be able to prioritise each application by source address.

 

[CHOUM]

for compression it work but you need to install it like this :

LAN=>LAN router=>SHAPER=>PIX====PIX<=SHAPER<=LAN ROUTER<=LAN

 

[UnaBomber]

We have Shapers at all our remote sites and it works a treat... We have different Partitions depending on how mission critical the protocols are within the partition. On our 2.2MB VPN Links we have all Bandwidth reserved for SSH and Telent, thus no matter how greedy FTP etc trys to get gets the PS will not allow the it to take up all the bandwidth and thus Telnet and SSH have good COS and QOS and dont get dropped! (FTP has a very low priority and will get qued when applicable)

PS's are great and would suit your needs perfectly! We also use them for traffic analysis and troubleshooting!!