Processors Toolkit

Watch these factors for VPN performance

Tags:
PPTP,
L2TP,
IPSec,
VPN

Scott Lowe Tech Republic

Published: 20 Mar 2003 13:15 GMT

Watch your traffic

Traffic monitoring software can help you to tweak your policies with regards to your infrastructure. For example, is there a lot of file sharing traffic coming across the VPN link? If so, put a stop to it by enforcing a stricter administrator policy on file sharing among users. If there is excessive replication traffic coming across the link between Windows domain controllers, consider changing the replication interval between the two machines.

What about DNS and DHCP? Are these services hosted at the central site or at each location? If they are centrally served and you're having performance issues, consider separating these services and placing them closer to the users who need them.

The next steps

When all is said and done and you've tweaked everything you can to increase performance, you may need to consider replacing the VPN concentrators. Most VPNs tell you how many tunnels they can support. As you begin to approach this number, the system may not have the capability to keep up with the processing requirements.

On the other hand, if you have a VPN for which there is a central VPN server or VPN concentrator, and VPN connections are created on demand directly from remote user workstations, you have different things to try. First, if a user with a dial-up connection complains that the VPN is slow, the reason is obvious. Unless it's for e-mail only or for a low-bandwidth application, a dial-up connection to a VPN just won't cut it.

Second, make sure that the remote user's PC is capable of handling the load. Bear in mind that in this type of VPN, the workstation is responsible for establishing, maintaining, and using the tunnel, as well as for encrypting and encapsulating data, which can tax a CPU, depending on the level of encryption. If you simply want to enhance performance for these machines and you aren't concerned about security, you could disable encryption, which would increase the overall performance of the VPN.

In this type of scenario, the VPN client included with newer versions of Windows, such as Windows XP, is capable of telling you what kind of compression you're getting (Figure A). Compressing data definitely helps with the performance of the actual link for the VPN, but it can spell trouble if the client machine doesn't have the CPU resources to handle the compression as well as all of its other duties.

Figure A

VPN status under Windows XP.

A simple test of VPN performance

Because of their complexity and the huge differences in technology between different types of VPNs and different vendors, it's difficult to determine the actual efficiency of a VPN, let alone improve it. The simplest method is to determine the actual size of the tunnel between two sites, clock the average file transfer speed between the sites, and take the ratio as a percentage. You'll never achieve 100 percent efficiency--that would imply a perfect VPN with no overhead, which is impossible.

For example, if you have 1Mbps of bandwidth dedicated between two sites and you get 800Kbps of raw throughput, your efficiency would be 80 percent. From there, you can begin to assess some of the factors I've discussed to determine where you can make improvements.

For a weekly round-up of the enterprise IT news, sign up for the Enterprise newsletter.

Tell us what you think in the Enterprise Mailroom.

Go to section: