slow transfer speeds ove ipsec
-
@hescominsoon If Windows check the scaling settings on both ends.
https://forum.netgate.com/topic/152496/download-speed-varies-by-os-after-setting-up-pfsense-router-with-2-4-5/10 (and rest of thread)
Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
Upvote 👍 helpful posts! -
@SteveITS Yeah also a good point, though I still think without adjusting that, 20 megabits is pretty slow assuming the IPsec settings are solid and using accelerated ciphers.
@hescominsoon this is definitely worth a try though.
-
@SteveITS said in slow transfer speeds ove ipsec:
@hescominsoon If Windows check the scaling settings on both ends.
https://forum.netgate.com/topic/152496/download-speed-varies-by-os-after-setting-up-pfsense-router-with-2-4-5/10 (and rest of thread)
i am going to try those changes..i am also going to compress the data and send it as one large chunk..should overcome any other penalties....
-
@planedrop said in slow transfer speeds ove ipsec:
@hescominsoon Yeah that latency isn't too bad, SMB still wants sub millisecond for really solid performance. And keep in mind pings are small packets, so the latency for larger 1500 byte packets will be somewhat higher.
What are your IPsec settings at both sites though? That'll help the most here, I think we can still get you higher performance, 20 megabits is certainly a bit slow.
i would have to look but i have the crypto accelerators enabled and active to reduce the overhead...
-
@hescominsoon If we could get all the IPsec settings you are using (except the PSK and IPs of course lol) that would greatly help here.
You have to user ciphers that are properly accelerated and then make sure you have IPsec MB and/or QAT enabled.
-
@planedrop i am using aes 128 and AES-NI CPU Crypto: Yes (active)
IPsec-MB Crypto: Yes (active) sha 256 dh group 14. everything else is pretty much at defaults..i am using psk as well. -
@planedrop said in slow transfer speeds ove ipsec:
@hescominsoon If we could get all the IPsec settings you are using (except the PSK and IPs of course lol) that would greatly help here.
You have to user ciphers that are properly accelerated and then make sure you have IPsec MB and/or QAT enabled.
so i compressed the files into one large 580 gb file after checking rss and such i am getting around 100 megabits...with bursts to 120.
-
@hescominsoon AES-GCM? Or normal AES? GCM will get you much much better results.
-
Use AES-GCM and check "Asynchronous Cryptography" and "Make before Break" is activ in IPsec Advanced Settings.
Setup "Enable Maximum MSS" and set it to 1328, you will find it under: System Advanced Firewall & NAT.
I use "IP Fragment Reassemble" too.
This 1328 is the best MSS for IPsec tunnel mode if you want to avoid padding data.And don't use SMB over high latency connections, it's very slow. Use rsync or other WAN optimized stuff instead. Even ftp performance better, if you run up to 10 paralle streams.
-
@NOCling IIRC but make-before-break is only needed if you are doing re-auth rather than rekeying.
Also not sure how big a difference async makes, I have VPNs that move gigabit without that set, but I do have dedicated CPIC cards for acceleration so maybe it'd make more of a difference on normal hardware. Either way async can break things.
Agreed about the 1328 MSS, though not all TCP workloads support clamping. I have a setup where clamping isn't supported so traffic is fragmented no matter what (in fact 100% of packets are fragmented and I still can manage gigabit lol).
And yeah @hescominsoon like @NOCling says, SMB really isn't ideal for this, if you actually need to move data super fast over a VPN, you should look elsewhere. Even NFS should be better.
