<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Mirko,<div class=""><br class=""></div><div class="">thanks for your response. </div><div class=""><div class=""><div class=""><blockquote type="cite" class=""><div class="">On 11 May 2017, at 20:59, Mirko Parthey <<a href="mailto:mirko.parthey@web.de" class="">mirko.parthey@web.de</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span class="" style="float: none; display: inline !important;">On Thu, May 11, 2017 at 04:00:17PM +0200, Christian Hanster wrote:</span><br class=""><blockquote type="cite" class="">Hi all,<br class=""><br class="">at the moment I’m trying to optimize the network performance in a site-to-site<br class="">setup (see config below). The connection is structured as follows <br class=""><br class=""><network A> <—> VPN-Router A <—> Internet (WAN) <—> VPN-Router B <—> <network<br class="">b><br class=""><br class="">The problem is that the network performance between networks a and b is only<br class="">around 45 MBit (iperf tcp test) although the WAN connection has nearly 100MBit.<br class="">So I monitored the network interfaces of the routers and what I could see was<br class="">that there are only flowing around 48 MBit. To test if it is a performance<br class="">problem of the routers, I then connected the routers directly (through lan)<br class="">with each other and limited the network card to 100 MBit. Then the<br class="">VPN-performance is around 94 MBit. So the router performance is not the<br class="">problem.<br class=""><br class="">Then I simulate a varying delay in the network cards and this seems to be the<br class="">problem because when I make a ping between the two networks over vpn and<br class="">internet latency is around 70ms (30ms deviation). The two servers have ping<br class="">times around 32ms (3ms deviations). With varying delay activated the simulated<br class="">throughput is only around 55MBit. My question is now if there is any tuning<br class="">possibility in strongswan to deal with this varying latency. <br class=""></blockquote><br class=""><span class="" style="float: none; display: inline !important;">Hello Christian,</span><br class=""><br class=""><span class="" style="float: none; display: inline !important;">I would suggest to leave your simulation aside for now.</span></div></blockquote><blockquote type="cite" class=""><div class=""><span class="" style="float: none; display: inline !important;">Did you measure the throughput between your networks without VPN?</span><br class=""></div></blockquote><br class=""><div class=""><div class="">I measured connection speed without VPN and it is nearly 92 MBit/s Down and 10MBit/s upstream from the limiting side. So the connection between the two routers does not seem to be a problem. </div></div><br class=""><blockquote type="cite" class=""><div class=""><br class=""><span class="" style="float: none; display: inline !important;">What type of system are your VPN routers? For example, an embedded system</span><br class=""><span class="" style="float: none; display: inline !important;">running OpenWrt/LEDE, or a PC running a standard Linux distribution.</span><br class=""></div></blockquote>I’m using two Routers based on AMD embedded series running Ubuntu x64. The CPU should not be the limiting factor as the performance between two devices directly is nearly at 150 MBit/s. </div><div class=""><br class=""><blockquote type="cite" class=""><div class=""><br class=""><span class="" style="float: none; display: inline !important;">Do your VPN routers use a bandwidth limiter (shaper), such as HTB or</span><br class=""><span class="" style="float: none; display: inline !important;">Cake?</span><br class=""></div></blockquote>There are no bandwidth limiters installed. In my simulations I limited the bandwidth directly on the interface with ethtool. But in normal environment there are no limitations. </div><div class=""><br class=""></div><div class="">Kind regards </div><div class="">Christian <br class=""><br class=""><blockquote type="cite" class=""><div class=""><span class="" style="float: none; display: inline !important;">Regards,</span><br class=""><span class="" style="float: none; display: inline !important;">Mirko</span></div></blockquote></div></div></div></body></html>