1

CONTEXT

I have an VPN connection between 2 ASA-5515's set up between our main site and new back up site. This is to replace our old backup site we have which is currently connected between an ASA-5515(Main Site) and FreeBDS using Racoon.

PROBLEM

The file transfer speeds between the 2 ASA-5515's is half that of the connection between ASA-5515 to FreeBDS connection.

EXPECTATIONS

My expectations is that the speeds should be around the same if not better as the old backup site is based in France and the new backup site is based in the UK where our main site is based.

INVESTIGATION

I have transferred files from one server to another whilst doing some Disk R/W testing and have ruled out that this is to do with disk R/W speed issues.

I have also performed this test against both old and new backup sites:

root@main_site_server:# dd if=/dev/zero bs=1M count=10240 | ssh server@backup 'cat > /dev/null'

(https://www.commandlinefu.com/commands/view/5799/test-network-speed-without-wasting-disk)

transfer from primary_site to new_backup_site 
10240+0 records in
10240+0 records out
10737418240 bytes (11 GB) copied, 351.285 s, 30.6 MB/s

transfer from primary_site to old_backup_site
0240+0 records in
10240+0 records out
10737418240 bytes (11 GB) copied, 189.332 s, 56.7 MB/s

My suspicions lie with maybe how the site-to-site VPN is configured.

The only differences between the site-to-site configurations is that one of the backup sites is configured with NAT exemption and configured with unlimited traffic volume (as apposed to 4608000) under SAL as well as being priority 7 (as apposed to 5) in its cypto-map entry.

QUESTION

My question is would you expect any of these settings to have that much of an impact on transfer speed?

TECHNICAL

All servers are connected via the following Cisco switch model ws-c2960x-48ts-l

CONFIGURATION (These have been cleansed as much as I can)

main site router configuration (Cisco ASA-5515)


ASA Version 9.8(2)
!
interface GigabitEthernet0/0
 description Link to redstation
 nameif outside
 security-level 0
 ip address <maindatacenter_external_ip> standby <main_site_secondary_ip>
!
interface GigabitEthernet0/1
 description prodsw - internal
 nameif inside
 security-level 100
 ip address <maindatacenter_gateway_ip> standby <main_site_secondary_gateway_ip>
!
interface GigabitEthernet0/2
 description prodsw - dmz
 nameif dmz
 security-level 50
 ip address <maindatacenter_dmz_gateway_ip>  standby <main_site_dmz_secondary_gateway_ip>
!
boot system disk0:/asa982-smp-k8.bin
!
object network network_internal
 subnet <main_site_internal_network> 
!
object network <old_backup_internal>
 subnet <old_backup_internal_network> 
!
object network <new_backup_internal>
 subnet <new_backup_internal_network> 
object network NETWORK_OBJ_<main_site_internal_network>
 subnet <main_site_internal_network> 
object network <new_backup_external>
 host <new_backup_external_ip>
!
 group-object hostgroup_connect
 network-object object <old_backup_internal>
 network-object object <new_backup_internal>
!
object-group network hostgroup_ike_peers
 network-object object <new_backup_external>
!
access-list outside_cryptomap_1 extended permit ip object network_internal object <old_backup_internal>
!
access-list outside_cryptomap_4 extended permit ip object network_internal object <new_backup_internal>
!
access-list inside_access_in extended permit ip any any
!
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-782.bin
asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside,any) source static network_internal network_internal destination static no_nat no_nat no-proxy-arp route-lookup
nat (dmz,any) source static network_internal network_internal destination static no_nat no_nat no-proxy-arp route-lookup
nat (inside,outside) source dynamic any interface
nat (dmz,outside) source dynamic any interface
nat (inside,outside) source static network_internal network_internal destination static <new_backup_internal> <new_backup_internal>
!
access-group outside_access_in in interface outside control-plane
access-group outside_in in interface outside
access-group inside_access_in in interface inside
access-group dmz_in in interface dmz
!
route outside 0.0.0.0 0.0.0.0 <main_site_external_ip> 1
!
crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto ipsec df-bit clear-df outside
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
!
crypto map outside_map 5 match address outside_cryptomap_1
crypto map outside_map 5 set pfs
crypto map outside_map 5 set peer <old_backup_external_ip>
crypto map outside_map 5 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
!
crypto map outside_map 7 match address outside_cryptomap_4
crypto map outside_map 7 set pfs
crypto map outside_map 7 set peer <new_backup_external_ip>
crypto map outside_map 7 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 7 set security-association lifetime kilobytes unlimited
!
crypto isakmp identity address
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside client-services port 443
crypto ikev2 remote-access trustpoint ASDM_TrustPoint6
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 201
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 28800
!
 error-recovery disable
!
tunnel-group <old_backup_external_ip> type ipsec-l2l
tunnel-group <old_backup_external_ip> general-attributes
 default-group-policy GroupPolicy_Backup
tunnel-group <old_backup_external_ip> ipsec-attributes
 ikev1 pre-shared-key 
!
tunnel-group <new_backup_external_ip> type ipsec-l2l
tunnel-group <new_backup_external_ip> general-attributes
 default-group-policy GroupPolicy_<new_backup_external_ip>
tunnel-group <new_backup_external_ip> ipsec-attributes
 ikev1 pre-shared-key 
 ikev2 remote-authentication pre-shared-key
 ikev2 local-authentication pre-shared-key


: end

new backup router configuration (Cisco ASA-5515)

Result of the command: "show running-config"

: Saved
:
ASA Version 9.1(1) 
!
interface GigabitEthernet0/0
 description LINK TO WAN
 nameif outside
 security-level 0
 ip address <newbackup_external_ip>  
!
interface GigabitEthernet0/1
 description LINK TO LAN
 nameif inside
 security-level 100
 ip address <newbackup_gateway_ip>  
!
ftp mode passive
!
object network my-inside-net
 subnet <newbackup_internal_network> 
object network <maindatacenter_internal_network>
 subnet <maindatacenter_internal_network> 
object network <maindatacenter_external_ip>
 host <maindatacenter_external_ip>
object network NETWORK_OBJ_<newbackup_internal_network>
 subnet <newbackup_internal_network> 
object network <oldbackup_internal_network>
 subnet <oldbackup_internal_network> 
object network <oldbackup_external_ip>
 host <oldbackup_external_ip>
object-group service 4500 udp
 description port 4500 adsm
 port-object eq 4500
object-group icmp-type DM_INLINE_ICMP_1
 icmp-object echo
 icmp-object echo-reply
object-group icmp-type DM_INLINE_ICMP_2
 icmp-object echo
 icmp-object echo-reply
access-list OUTSIDE-IN extended permit icmp any any object-group DM_INLINE_ICMP_2 
access-list OUTSIDE-IN extended permit ip any any 
access-list outside_cryptomap_1 extended permit ip <newbackup_internal_network> object <maindatacenter_internal_network> 
access-list inside_access_in extended permit ip <newbackup_internal_network> object <maindatacenter_internal_network> 
access-list inside_access_in extended permit ip <newbackup_internal_network> object <oldbackup_internal_network> 
access-list inside_access_in extended permit ip object <maindatacenter_internal_network> <newbackup_internal_network> 
access-list inside_access_in extended permit ip object <oldbackup_internal_network> <newbackup_internal_network>
access-list inside_access_in extended permit ip object <maindatacenter_internal_network> object my-inside-net 
access-list inside_access_in extended permit icmp any object <maindatacenter_internal_network> object-group DM_INLINE_ICMP_1 
access-list inside_access_in extended permit ip any any 
access-list global_access extended permit ip object <maindatacenter_internal_network> interface inside 
access-list outside_access_in extended permit udp object <maindatacenter_external_ip> any eq isakmp 
access-list outside_access_in extended permit udp object <oldbackup_external_ip> any eq isakmp 
access-list outside_access_in extended permit ip any any 
access-list outside_cryptomap extended permit ip <newbackup_internal_network> object <oldbackup_internal_network> 
!
mtu outside 1500
mtu inside 1500
!
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-792-152.bin
!
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static NETWORK_OBJ_<newbackup_internal_network> NETWORK_OBJ_<newbackup_internal_network>_24 destination static <maindatacenter_internal_network> <maindatacenter_internal_network> no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_<newbackup_internal_network> NETWORK_OBJ_<newbackup_internal_network>_24 destination static <oldbackup_internal_network> <oldbackup_internal_network> no-proxy-arp route-lookup
!
object network my-inside-net
 nat (inside,outside) dynamic interface
access-group outside_access_in in interface outside control-plane
access-group OUTSIDE-IN in interface outside
access-group inside_access_in in interface inside
access-group global_access global
route outside 0.0.0.0 0.0.0.0 <newbackup_external_ip> 1
!
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto map outside_map 1 match address outside_cryptomap_1
crypto map outside_map 1 set pfs 
crypto map outside_map 1 set peer <maindatacenter_external_ip> 
crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 set security-association lifetime kilobytes 2147483647
crypto map outside_map 2 match address outside_cryptomap
crypto map outside_map 2 set pfs 
crypto map outside_map 2 set peer <oldbackup_external_ip> 
crypto map outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map interface outside
crypto ca trustpool policy
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 20
 authentication rsa-sig
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 40
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 50
 authentication rsa-sig
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 70
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 80
 authentication rsa-sig
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 100
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 110
 authentication rsa-sig
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 130
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 201
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 28800
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy GroupPolicy_<oldbackup_external_ip> internal
group-policy GroupPolicy_<oldbackup_external_ip> attributes
 vpn-tunnel-protocol ikev1 
group-policy GroupPolicy_<maindatacenter_external_ip> internal
group-policy GroupPolicy_<maindatacenter_external_ip> attributes
 vpn-tunnel-protocol ikev1 
!
tunnel-group <maindatacenter_external_ip> type ipsec-l2l
tunnel-group <maindatacenter_external_ip> general-attributes
 default-group-policy GroupPolicy_<maindatacenter_external_ip>
tunnel-group <maindatacenter_external_ip> ipsec-attributes
 ikev1 pre-shared-key 
tunnel-group <oldbackup_external_ip> type ipsec-l2l
tunnel-group <oldbackup_external_ip> general-attributes
 default-group-policy GroupPolicy_<oldbackup_external_ip>
tunnel-group <oldbackup_external_ip> ipsec-attributes
 ikev1 pre-shared-key 
!
class-map inspection_default
 match default-inspection-traffic
!
: end

old backup router configuration (FreeBSD/Racoon)

padding
{
    maximum_length  20;
    randomize       off;
    strict_check    off;
    exclusive_tail  off;
}

timers
{
    counter         5;
    interval        20 sec;
    persend         1;
    phase1          24 hour;
    phase2          3600 sec;
}

listen
{
    isakmp          <old_backup_external_ip> [500];
    isakmp_natt     <old_backup_external_ip> [4500];
}

remote <main_site_external_ip> [500]
{
    exchange_mode     main;
    situation         identity_only;
    my_identifier     address <old_backup_external_ip>;
    peers_identifier  address <main_site_external_ip>;
    lifetime          time 24 hour;
    passive           off;
    proposal_check    obey;
    generate_policy   off;

    proposal {
        encryption_algorithm    aes128;
        hash_algorithm          sha1;
        authentication_method   pre_shared_key;
        lifetime time           24 hour;
        dh_group                2;
    }
}

sainfo (address <old_backup_internal_network> any address <primary_site_internal_network> any)
{
    pfs_group                 2;
    lifetime                  time 3600 sec;
    encryption_algorithm      aes;
    authentication_algorithm  hmac_sha1;
    compression_algorithm     deflate;
}

sainfo (address <old_backup_internal_network> any address <internal_network_range> any)
{
    pfs_group                 2;
    lifetime                  time 3600 sec;
    encryption_algorithm      aes;
    authentication_algorithm  hmac_sha1;
    compression_algorithm     deflate;
}

remote <new_backup_external_ip> [500]
{
    exchange_mode     main;
    situation         identity_only;
    my_identifier     address <old_backup_external_ip>;
    peers_identifier  address <new_backup_external_ip>;
    lifetime          time 24 hour;
    passive           off;
    proposal_check    obey;
    generate_policy   off;

    proposal {
        encryption_algorithm    aes128;
        hash_algorithm          sha1;
        authentication_method   pre_shared_key;
        lifetime time           24 hour;
        dh_group                2;
    }
}

sainfo (address <old_backup_internal_network>/24 any address <new_backup_internal_network> any)
{
    pfs_group                 2;
    lifetime                  time 3600 sec;
    encryption_algorithm      aes;
    authentication_algorithm  hmac_sha1;
    compression_algorithm     deflate;
}

sainfo (address <new_backup_internal_network>/24 any address <old_backup_internal_network> any)
{
    pfs_group                 2;
    lifetime                  time 3600 sec;
    encryption_algorithm      aes;
    authentication_algorithm  hmac_sha1;
    compression_algorithm     deflate;
}
  • Please edit your question to include the (sanitized) network device configurations. We cannot simply guess where you may have gone wrong. – Ron Maupin Feb 3 at 17:16
  • i have added the sanitised configuration as per your request. – CrazyHorse019 Feb 4 at 15:02
  • But you did not put in the full configurations. There are other configuration in the devices that could affect this. We have some ASA experts here that would like to see more of the configurations. – Ron Maupin Feb 4 at 15:12
  • I also want to know what kind of switches the hosts are connected to, what speed you expect things to travel at (and why), along with seeing the stats on your active SAs (show ipsec sa) on both ends to see if there are issues. – Jesse P. Feb 5 at 16:44
  • Hi all, sorry it's taken a while. I have supplied as much info as I can. Please let me know if there is anymore I can do. – CrazyHorse019 Feb 10 at 12:10

Browse other questions tagged or ask your own question.