Processors Toolkit

Watch these factors for VPN performance

Tags:
PPTP,
L2TP,
IPSec,
VPN

Scott Lowe Tech Republic

Published: 20 Mar 2003 13:15 GMT

As virtual private network (VPN) connections thrive, performance joins security and interoperability as a primary concern. If you need to add bandwidth to your VPN connection because of performance issues, how much would you need to achieve a good balance between security and performance?

While every situation is different, a good background on what determines VPN performance can help you maximise that performance without compromising security and interoperability. Here, I'll explain how various factors can affect your VPN performance and tell you about some of the options you have for increasing that performance.

VPN performance is an increasingly important issue

Many of today's VPN products emphasise security and interoperability, with performance a lower priority -- and rightly so. A VPN is usually set up with security as one of the primary goals, and in many cases, VPNs need to be able to interoperate among different vendors, so interoperability is also a key factor. However, performance is becoming more important as VPNs become more prevalent on corporate networks.

If your VPN seems slow, or you just want to know how efficient it really is, you have a number of options for improving its performance. Let's look at some of the factors involved.

VPN types -- and my test set-up

In general, there are two types of VPNs -- remote client VPNs and site-to-site VPNs. A remote client is generally a single PC that uses VPN software to connect to the host network on demand, while a site-to-site VPN is generally a permanent connection between two sites using dedicated networking equipment. A remote client VPN typically supports telecommuters, while the site-to-site variety usually connects office networks.

For the purposes of this article, I've set up a remote-client VPN, using Windows 2000 Server with VPN services enabled via Windows 2000's built-in Remote Access Services. On the client side, I'm running a Windows XP Professional workstation over a 1-Mbps DSL connection. This connection uses Point-to-Point Tunnelling Protocol (PPTP) to connect to the central server.

My lab network uses Network Address Translation (NAT) to get out over the DSL connection to the Internet.

PPTP vs. L2TP

While more widely supported than Layer 2 Tunnelling Protocol (L2TP), PPTP is giving way to L2TP as the tunneling protocol of choice because of L2TP's enhanced security features. However, establishing an L2TP VPN is somewhat more complex than setting up a PPTP connection. PPTP-based VPNs may also operate slightly faster because there is less processing involved in encrypting and encapsulating the packets. Under PPTP, the point-to-point protocol (PPP) payload packet is encapsulated inside a generic routing encapsulation (GRE) packet, which is then encapsulated inside an IP packet to which the data link header is attached. The packet is then sent across the tunnel.

Under L2TP, packets are encapsulated no fewer than four times and as many as six times, depending on the IPSec policy being used. Each time a packet is processed, overhead is added to the overall procedure, resulting in higher latency. I'd be remiss if I didn't mention that L2TP provides additional levels of security through the use of DES and 3DES encryption as well as data authentication. However, if you're looking at a VPN from a strict standpoint of performance, L2TP may not be the best choice.

One point worth mentioning is the fact that PPTP relies on the TCP protocol, while L2TP uses UDP for typical communication. This can result in slightly lower performance capabilities for PPTP. Bear in mind, though, that since PPTP uses fewer levels of encapsulation, the total message size is smaller than with L2TP, which would tend to cancel this advantage.

What kind of VPN are you using?

The topology of your VPN can also have a significant impact on its performance and can vary widely among the remote devices. If you're supporting a site-to-site VPN that connects two different remote offices, it's likely that both ends use dedicated equipment configured for a permanent VPN tunnel. If your VPN performance seems slow, you may need to increase the size of the tunnel by adding bandwidth at both ends. You might also be able to change configuration options to increase performance.

For example, if your tunnel allows a maximum of 50 users but all 50 of them don't need to use it all day long, you can decrease the maximum number of clients allowed to preserve bandwidth. You can also use traffic monitoring software to determine the type of traffic that is traversing the VPN. You'll need to place a system running such software between your users and the VPN, since the VPN traffic is likely to be encrypted.

Go to section: