Multiple Simultaneous VPN Tunnels cause HUGE slowdown, dropped packets

ctxspy

Hello.

I have set up PFSense at one facility, and ZyWALL 5 units at two remote facilities.

I can have either remote facility connected via IPSEC VPN and i get around 20ms latency,
no dropped packets, high throughput (300kbps)

If i enable the 2nd facility's vpn connection, i start dropping packets on BOTH vpn tunnels,
and the ping times rise from 20ms to 100+ ms.

I ensured that the identifiers are different, and event went so far to have different
pre-shared keys, encryption algorithms, etc.

Please help me understand whether this is a limitation of racoon, a pfsense specific issue,
perhaps a hardware issue, or just a configuration problem?

I am trying to eliminate the point to point T1s my company currently uses and implement
cable with dsl backup, so (for me at least), this has a sense of urgency.

Thank you for your help!

-Tomaj

drees

Are you watching bandwidth utilization when this occurs and sure that your pipe isn't filling up when the IPsec connection to the 2nd facility comes up for some reason?

Wasca

Hey Guys

I'm seeing something very similar. I have 3 tunnels and and intermittently I cannot ping through the tunnel, it's really odd, it's causing me all sorts of problems. Is there something I can post up here that may help identify the problem.

I don't think bandwidth is an issue for me as I have a 10Mb symmetrical link the tunnels are going over.

ctxspy

Hello all.

I am not sure what I did to fix the issue (if anything at all) but it seems OK now.

I believe i was able to see that the racoon process was dying, so I just rebooted the whole box, and only ran 1 tunnel for a while. Then one night I was playing with the configurations, testing, doing some file transfers etc etc and it all seems OK..?

to ensure it was really stable i ran 1 million pings at 100ms interval on both tunnels simultaneously (takes around a day), and I lost around 0.01% of the packets, averaging around 20ms round trip.

Sorry I can't really help anyone else out there, i guess my only suggestion is play with the encryption settings, identifiers, etc etc..

-Tomaj

Wasca

Good to hear yours is ok.

Well I've been running for just over 24 hours and mine has been fine as well, I might try the ping test my self and test how stable it is. The only real difference between now and my last post is that I did have a duplex issue on my WAN that was fixed and have since reinstalled and loaded up the old config, and all is good so far.

Wasca