Packet loss and Delay between P2P sw-wan with IPsec tunnel

[Akbar_ali]

recently we have implemented p2p connection between 2 sites both sites has fortigate 101F in branch office and 400F i guess in HQ. we have two links L2 VPN p2p and L3 VPN p2p. here is the config example.

2MB 1st link interface IP 172.97.66.6 other end 172.97.66.5

            IPsec tunnel IP 172.97.66.45 other end 172.97.66.46

2MB 2nd link Interface IP 172.101.19.182 other end 172.101.19.181

            IPsec tunnel IP 172.97.66.53 other end 172.97.66.54

reason of posing this is because of delay in communication our AD and all other servers on other site and utilization is not always full.

[Toshi_Esumi]

First of all, an "L2 Link" generally means a point-to-point circuit between both ends so you don't need IPSec over it. For L3 circuits, I assume those are just separate internet circuits on both ends then you've set up IPSec VPN to connect them.

The first thing you want to look at is any packet losses or larger-than-expected latency on each link. The SD-WAN statistics should show you the numbers in "diag sys virtual-wan-link health-check" command like in the cookbook (6.2):

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/818746/sd-wan-related-diagnose-commands

Then if identified, you need to troubleshoot with the circuit venders especially for L2 circuit. For L3 circuits, first you need to figure out where/which side is causing the packet losses/larger latency by testing each L3 circuit separately.

[akabarasif]

Yes but traffic is going through iSP so it should be encrypted correct me if i am wrong,

here is the troubleshoot result.

diagnose sys virtual-wan-link health-check

Health Check(XSDWANSLA): Seq(1): state(alive), packet-loss(10.000%) latency(4.254), jitter(1.145) sla_map=0x1 Health Check(XSDWANICSLA): Seq(2): state(alive), packet-loss(0.000%) latency(0.722), jitter(0.014) sla_map=0x0

diagnose sys virtual-wan-link member

Member(1): interface: SC-IPSec-VPN, gateway: 172.16.66.9, priority: 0, weight: 28 Config volume ratio: 1, last reading: 40043617689B, volume room 28MB Member(2): interface: IC-IPSec-VPN, gateway: 172.16.66.13, priority: 0, weight: 27 Config volume ratio: 1, last reading: 40088009183B, volume room 27MB

is it over loaded?

[Toshi_Esumi]

You definitely need to fix the cause of the 10% packet loss first before looking into anything else.

L2 links between two locations are generally considered as "dedicated wires". I never hear anybody set up an IPSec VPN over it although of course nothing is wrong doing so. And I don't think it has anything to do with the problem. Based on the usage graphs, you're not over-utilizing circuits. Likely you would feel more normal when you fixed the packet loss.