VPN suddenly and consistently much slower than before

[tenspeed]

We have been running a VPN between a PIX 525 and a 2600 Router and been getting FTP speeds averaging 200 KB/s.

A few days ago that speed dropped to 3 KB/s and has remained consistently that slow, never changing.

There has been no change in our configuration.

The PIX is generating logs. The router is not.

What can I look at to tell me what the problem is?

 

[BozoDaKlone]

Are you sending the PIX traps to a syslog server? This might help in analyzing.

I have noticed a huge increase in ICMP (ping) over the last few weeks across the Internet. There have been pings coming in through our MS RAS, even though the sender(s) makes no TCP connections or authenticates. The pings only happen when a legitimate user logs in, and the pings come from an unknown IP on that user's subnet. When the unknown IP is blocked by an ACL, it just comes back moments later with a different IP. When the legitimate user disconnects, the pings stop. The legit users all have MS patches and AV.

Oddly, it only occurs with some ISPs. Never with Verizon, always with FastNet.

I'm trully baffled by this. Not sure if any of this applies to you, but again, you might want to run a syslog server and trap at the error and warning level. That might show something.

You can do a sh proc cpu on the Cisco router. Also, set up some ACLs, and then after awhile do a sh access-lists. This will show the number of "hits" for each ACL entry.

Write incoming ACLs for the usual suspects, NetBIOS, ICMP, etc. then do the sh access-lists.

Might give you an idea of where your bandwidth is going.