Hi all

We have two sites, first with 2820n (FW 3.3.7.3_232201) and remote 2860n (FW 3.7.4.2)

On the 2820 we have set up the LAN-LAN VPN on WAN 2 which has an EFM 20MB up/down and the other end 2860 has only one WAN connection which is a BT fibre with speed tests showing up to 75Mb down and between 10 and 15MB up.

No problem connecting but accessing files on the servers sat behind the two routers can be painfully slow. As an example, a file opened on a local C drive took 20 secs and opening the same over a mapped drive across the VPN took 32 minutes.

On inspection, the 2820 has MTU set at 1442 and the 2860 at 1492 and we have set IPsec security.

Before I mess up the internet and VPN performance altogether, could I ask please;

a) Do both MTU's need to match?
b) Is setting both to the lower 1442 likely to help?
c) If all pcs are set to 1500 (which I think is Windows default) would seriously impact on the Drayteks' performance? or is the LAN behind the VPN at each end capable of operating with a different MTU than the tunnel itself?

Many thanks.

DT

Is this "Windows" file sharing or FTP?

I think windows file sharing is never very efficient over an asymmetric link due to the bidirectional telemetry...but that's a bit of a guess. Maybe try an FTP (if you can set up a temporary server or use a USB stick on the Vigor!) to test raw data movement speed.

It's just copying and/ or opening files from windows network mapped drives. Even just copying files can take a lot longer than expected. Opening say Excel and then opening a spreadsheet on the remote server can cause Excel to hang for a while.

Yes, but my point is that it might be a Windows inefficiency hence the suggestion to measure raw transfer speed. There are also tools to measure throughput.

Thanks Admin. I am away now for a bit so won't be able to test further.

I was expecting that there would be many installs of Draytek LAN to LAN with Windows Servers at both ends and someone would just say "Do X and Y" and it will work fine.

Interestingly, I reset MTU on both routers to 1442 and re-booted both. These settings were confirmed as active in the GUI. Using the ping command "ping server -f -l 1472" I was able to ping each way. It only started to suggest fragmentation with 1473. Why would 1472 be ok when I had set 1442?

Thanks.

With the do not fragment bit set it would suggest the MTU is higher than being reported or fragmentation is actually happening and the do not fragment bit is being ignored. Do you see the same result across wan rather than VPN ?

Personally I'd try with MTU set to 1492 on both routers.