Cisco VPN slow for smb shares and sftp but fast for ftp. Need advice

[wallsfd949]

I'm fairly confused and it may help by me stating that I'm not a network expert, I'm a Linux System Admin.

We have 2-T1's bonded for 300KB/sec + transfer rates. Our ISP is providing the connection and VOIP phones. They also agreed to put us on their Cisco VPN concentrator and give us the client software to connect.

We have 20 external IPs 1-to-1 NAT'd (I think- they call it 'mapped') to 20 interal IPs on the 10.100.11.1/25 subnet. When I connect via VPN I get a 10.0.5.1/8 IP address.

We only have 4 remote workers, but they immediately complained about slow, slow speeds when working on shares over VPN. I did some testing from home and it looks like I'm getting the 250-300KB/sec via ftp over the VPN connection but when I mount a samba share or transfer via SFTP, it drops to 20-40KB/sec.

I've tried to connect to two boxes so far with the same results, one is a Linux box that has IPTABLES firewall rules to allow all internal connections and the other is an OSX box w/no internal firewall.

Can anyone shead some light on this mystery?

 

[ssbpgsr]

Have you checked your MTU by any chance?

 

[Boscoh]

It's your ISP's VPN concentrator. Most troubleshooting is going to require access to that, so it should be their responsibility to fix the problem. Sounds like a managed service to me.

Get them to fix the problem.

 

[p0lar]

Originally posted by: ssbpgsr
Have you checked your MTU by any chance?

*nod* This is a good place to start.

 

[Rogue]

What is the ideal MTU for a Cisco VPN concentrator? I know encryption adds overhead, so is larger than 1500 MTU suitable and if so, how large?

 

[wallsfd949]

Originally posted by: ssbpgsr
Have you checked your MTU by any chance?

I'm assuming since it's not our VPN concentrator that I do not have access to this?

Originally posted by: Boscoh
It's your ISP's VPN concentrator. Most troubleshooting is going to require access to that, so it should be their responsibility to fix the problem. Sounds like a managed service to me.

Get them to fix the problem.

That was my initial thought, but I wanted to make sure that there was nothing on our end (servers, clients, etc..) that would or could cause issues. I didn't think so since all clients had the same problem w/ all servers.

 

[nightowl]

Did you change the MTU on any of your PCs? There is a untility with the Cisco VPN client that can change your MTU. Try changing to to some like 1300 and see if that helps.

 

[wallsfd949]

The MTU was already set @ 1300 on the client. I was able to ping the server with ping -s1410 before getting 100% loss.

Keep in mind, I'm not a network guy so I set the MTU to 1500, tried to mount the smb share, and no go (but it does make sense).

If I can ping with 1410byte packets does that mean their MTU is set to 1500?