Skip to main content
jcvm
jcvm
New Member
January 4, 2022
Question

problems with VPN IPsec Site to Site

  • January 4, 2022
  • 6 replies
  • 7571 views

Hello,

 

I need help, I have an IPsec VPN created and it is connected at both ends, the PING works perfectly between computers but I cannot transfer even 0.5Kbps between computers.

 

jcvm_0-1641312287636.png

 

i have a Fotigate 100F OS7

6 replies

A
Anonymous_User
Contributor
January 4, 2022

Hello @jcvm ,

 

                    Welcome to Fortinet community and Thank you for your post. Hopefully, you've been keeping safe and doing well!

 

Have you verified if the wan speed on both sites are good? If the speed from the local to internet on both ends seems alright, then  we can try tweaking some settings on the VPN or the VPN policy to look further. Hope to hear back from you.

 

Regards

jcvm
jcvmAuthor
New Member
January 4, 2022

Hello @Anonymous ,

 

Site A's WAN is 500/500 Mbps connection and Site B's WAN connection is 950/950 Mbps.

 

I have read a lot in the forums that many people have problems with slow data transfers with IPsec but nobody says how to solve it.

 

I would like you to guide me with the best configuration so that everything flows better.

 

Yurisk
SuperUser
Yurisk
SuperUser
January 5, 2022

What latency do you get inside VPN tunnel between hosts with ping?

AlexC-FTNT
Staff
AlexC-FTNT
Staff
January 5, 2022

Check the policy that allows the traffic through the tunnel (both sides of the tunnel) - it may only allow ICMP, or not allow return traffic. 
Then make sure the traffic enters the tunnel interface (packet capture both sides).
You may need to disable asic accelleration on both ends to see the packets.
And last but not least - do all these checks after bringing down and then up the tunnel. The tunnel may show up to the remote ISP router, but there may be no real connection to remote FG (you can see if VPN phase2 is flapping in the VPN event logs)

    dannylee0307
    dannylee0307
    Visitor III
    January 5, 2022

    Hi @jcvm 

     

    You are using route-based VPN or Policy-Based VPN? 

    I think you can try use diagnose sniffer packet with check both site have any error packet or drop packet.

    jcvm
    jcvmAuthor
    New Member
    January 5, 2022

    After reviewing all the configurations I have noticed that the problem is in the transfer of large files.

    When I try to transfer a file of 100mb this file does not exceed 400 kbps and I do not understand why.

     

    This is a tunnel speed test.

    [ ID] Interval Transfer Bandwidth
    [ 4] 0.00-1.00 sec 1.11 MBytes 9.29 Mbits/sec
    [ 4] 1.00-2.00 sec 1.32 MBytes 11.1 Mbits/sec
    [ 4] 2.00-3.00 sec 1.32 MBytes 11.1 Mbits/sec
    [ 4] 3.00-4.00 sec 1.32 MBytes 11.1 Mbits/sec
    [ 4] 4.00-5.00 sec 1.32 MBytes 11.1 Mbits/sec
    [ 4] 5.00-6.00 sec 1.32 MBytes 11.1 Mbits/sec
    [ 4] 6.00-7.00 sec 1.24 MBytes 10.4 Mbits/sec
    [ 4] 7.00-8.00 sec 1.33 MBytes 11.1 Mbits/sec
    [ 4] 8.00-9.00 sec 1.32 MBytes 11.1 Mbits/sec
    [ 4] 9.00-10.00 sec 1.32 MBytes 11.1 Mbits/sec
    - - - - - - - - - - - - - - - - - - - - - - - - -
    [ ID] Interval Transfer Bandwidth
    [ 4] 0.00-10.00 sec 13.1 MBytes 11.0 Mbits/sec sender
    [ 4] 0.00-10.00 sec 13.1 MBytes 11.0 Mbits/sec receiver

     

    A
    Anonymous_User
    Contributor
    January 5, 2022

    Hello @jcvm 

     

                    Can you check if there is any IPsec VPN interface level  packet drop? Also please verify the MTU size of the tunnel interface on both ends. Commands that gives you the very same information can be found in the below article

     

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Troubleshooting-IPsec-VPN-tunnel-errors-with-large/ta-p/194539?externalID=FD46184

     

    Hope to hear back from you.

     

    Regards

    network360_2021
    network360_2021
    New Member
    January 5, 2022

    please check below points

    1. Check  if Traffic Shaping policy is applied in IPSEC traffic

    2. Check ipsec Interface Error [diagnose netlink interface list <Phase 1 name> ] Rxe and TXe value

    3. check MSS and MTU values[ try to find out MTU value from source to destination using ping -- command [ping x.x.x.x -f -l 1000] where 1000 is  size of the packet in byte ,, try to increase MTU value  and check end to end MTU value .  if the value is smaller than default value adjust MSS value in the ipsec VPN policy - normally MSS value is calculated by MTU-40byte .

     

     

    Thanks,

    Network360

    https://www.youtube.com/channel/UCSQUIhnEgz2-6JP_ykhIMUw

    Terms & ConditionsAccessibility statement