topic Re: VPN Performance Problem in General Topics

VPN Performance Problem

gafrol — Fri, 20 Jun 2014 06:57:15 GMT

Just wanted to all let you know about a VPN performance issue we have with one of our customers.

The customers is running an IPSec Site2Site Tunnel to a third party company (Cisco Device). They have a PA-5020 Cluster (5.0.12) and the Tunnel link is providing 1Gb/s throughput. Now all was working fine until the customer added a source NAT for the traffic entering the tunnel. The throughput went down from around 900Mb/s to 300Mb/s. Disabling that particular NAT restores full throughput again. Case is open, so far there are no config issues, but still waiting for further findings.

Has anyone observed such a performance impact when configuring a source NAT in a VPN Tunnel ?

Re: VPN Performance Problem

pulukas — Sat, 21 Jun 2014 12:17:03 GMT

Certainly seems like a bug that will need to be addressed.

What do the cpu stats look like when the nat is enabled?

I'm guessing there is some kind of bug interaction between nat and some other portion of the configuration. So you may end up with an option to keep the nat and change some other portion of the config to get past the bug until it is patched.

Re: VPN Performance Problem

gafrol — Mon, 23 Jun 2014 06:57:06 GMT

Nothing abnormal on the CPU load. Cleartext source NAT does not suffer from this performance hit, only source NAT within a tunnel seems to create the problem.

Re: VPN Performance Problem

ajbool — Mon, 23 Jun 2014 08:06:10 GMT

Are your NAT rules sufficiently wide to include ICMP traffic?

The MTU across the tunnel will be lower than normal. Perhaps without the NAT, MTU discovery (using ICMP) is working - lowering the MSS of the TCP sessions across the tunnel. If the NAT doesn't include ICMP traffic, MTU discovery will be broken and your traffic flow rate will suffer greatly...

I'd ensure the NAT rule has no service component so it is just acting on the IP addresses at each end of the link (and perhaps the in/out interfaces).

Re: VPN Performance Problem

gafrol — Mon, 23 Jun 2014 08:28:44 GMT

Are your NAT rules sufficiently wide to include ICMP traffic?

Yes, we usually don't use service restrictions in the NAT, this is done in the security rules.

Re: VPN Performance Problem

Wenar — Mon, 23 Jun 2014 09:00:18 GMT

I saw a case with the same issue which is still in the research phase. You should open a case too. Maybe this will speed up the process if you can provide more data.

Re: VPN Performance Problem

gafrol — Mon, 23 Jun 2014 09:52:56 GMT

Case is open since one week