VPN Slow

[bigdavelamb]

Hi, i have a vpn with 2 Cisco 501pix units at each site, realibility is great but it is very slow (everything thru the vpn), my encryption is 3des, and i have looked at memory being used on the Cisco units when sending traffic and this is not fluctuating, (this is my first vpn so was not sure if using higher encryption would slow them down). Some said the mtu needed to be the same on all network cards etc? Have not done this as sounds like a bit of a nightmare!?

Any idea what it could be and how best to troubleshoot?

Cheers people.
dave

 

[Castor66]

The MTU on the Cisco units should be the same. Make sure it is below 1500 as well - try around 1435. If the MTU is 1500 then the packets will get fragmented due to the overhead of the encapsulation. I can't remember the optimum value but if you dig around you should find it.

 

[cpmiles]

I think the optimum MTU should be 1492.

 

[bigdavelamb]

surely the default mtu (i have not been to the office to check yet) would not slow the vpn that much)?

 

[Castor66]

Yup - the MTU can seriously screw your setup. Have a look at this article - it's from Netgear but does give a reasonable explanation and also mentions the optimum MTUs for different situations.

http://kbserver.netgear.com/kb_web_files/n100603.asp

 

[Castor66]

Another thread here has an excellent discourse on setting the optimum mtu:

http://www.tek-tips.com/viewthread.cfm?qid=611957&page=1

 

[bigdavelamb]

cheers mate, i shall have a blast over the weekend, why is it not set as the optimum setting by default?