quick line help

Hi,

I've a remote vpn user complaining of slow blocky vpn access at time, isp says line is ok, however there does seem to be some packet loss showing:

monitor snapshot

Here's the current Netgear 834gt line stats:
NetGear Stats

I've ruled out a modem/filter issue, as the original Vigor 2820n and filter have been temporally replaced with the NetGear.

ISP have done an extended line test and say there's no problem.

Other incoming VPN users are reporting no problems either.

So, can anyone comment if the NetGear stats are showing an issue?

Could this be an exchange issue or something else?

Any help would be great!

stats etc look ok. Not many Errored Seconds for the uptime

MTU sizes can be an issue - check router setting. If its lower than standard the MTU assumed by the VPN can cause issues but that usually prevents it working rather than giving intermittent issues. That's my only guess.

In reply to a post by yarwell:

stats etc look ok. Not many Errored Seconds for the uptime

MTU sizes can be an issue - check router setting. If its lower than standard the MTU assumed by the VPN can cause issues but that usually prevents it working rather than giving intermittent issues. That's my only guess.

Checked the mtu on the router, it was set to mtu 1458, so just lowered to 1430... might drop
to 1400 is that doesn't work.

Latest graph, show packet loss up to roughly the point I changed mtu but could be a coincidence: new graph

Thanks for your feedback

If te packet loss is there everyday then it is almost certainly network congestion - which might impact the VPN in some way.

As Yarwell suggests - MTU could be teh problem. Check all values along te route from VPN client to PC to router to modem.

yo umight be going the wrong way, depends on the VPN and what it does.

This isn't my specialist subject, but I do remember seeing an issue where the MTU within the VPN tunnel was say 1400 and with the VPN overheads the MTU of the underlying service had to be increased to accommodate this.

I'm always tempted to start with the MTU at the ethernet default of 1500 (or 1492 for PPPoE services).

VPN support or RTFM may shed more light on minimum packet size requirements.

You want to use 1500 (8 for overheads)

My experience of using a Netgear DG834G as an IPSec VPN end point to a Watchguard XTM firewall tells me the VPN throughput on the Netgear is abysmal and very unreliable. It really can't cope with VPN traffic. There was packet loss and tunnels dropped when subjected to load. A reboot was needed to reestablish the tunnels.

I replaced the Netgear with a Draytek 2850 and am now able to pull 20Mbit/s across the VPN all day long with large video files transferred faultlessly.

I can't imagine the DG834GT is much better than the DG834G in terms of VPN performance.

If you're serious about using a VPN, ditch the Netgear, you won't regret it.

What are you terminating the VPN with at the other (your) end?

Edited by caffn8me (Tue 04-Jun-13 16:06:03)

Actually, I should clarify things.

I use a VPN connection from two different Watchguard firewalls (one on FTTC, one on ADSL) to two remote sites. One has ADSL2+ with an upload speed of 1Mbit/s. This is the connection which had the Netgear DG834G. It couldn't achieve anything close to 1Mbit/s over VPN and was incredibly flaky even though the line was rock steady.

The other remote site has FTTC and had a Draytek 2850 from the start. This is the connection that works at 20Mbit/s over the VPN - the speed is limited by the FTTC connection.

I can't get that over the ADSL2+ link of course but switching the Netgear out and putting in a Draytek 2850n, in anticipation of FTTC, has transformed the performance in terms of reliability, throughput and no packet loss.

As you have tried a Draytek at the remote site, it's possible your local endpoint may not be 'man enough' to handle the VPN. If it's another Netgear DG834whatever you're sunk.

Edited by caffn8me (Tue 04-Jun-13 16:20:29)