How troubleshoot poor ipsec connection?

Question

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers have low cpu load during the tests. The vpn tunnel negotiation works fine, so no trouble there.

I'm thinking of doing a wireshark capture but I'm not quite sure what to look for there. Do I look for anything in particular when it comes to potential ipsec problems? What are typical signs to look for?

Appreciate your thoughts

Answer 1

Normally you would first check whether all packets are being encapsulated and decapsulated OK by viewing ipsec counters on the tunnel endpoints.

However if you want to look at packets, first you need to know whether or not low throughput is first caused by TCP effects, either packet loss or latency. That will influence where to look next. You need to see the traffic in the clear at either end of the tunnel if that's possible, not so easy if you are using transport mode, but I assume your "connection" is a tunnel, please confirm.

If you can capture packets at both ends of the tunnel and also the IPSec packets, it is relatively easy to match them, as IPSec has a fixed overhead for the tunnel depending upon ciphers used. You can then see where they are getting dropped or delayed.