Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,554 questions
Very slow P2S VPN Gateway
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(102.4, 11%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Juan Miguel
0
Reputation points
Hello,
I'm testing a basic scenario evaluating Azure before our enterprise transition from old on-premise scenario to cloud.
The scenario has:
- One VNet with a VM (Ubuntu).
- One VPN Gateway (sku: VpnGw1, 650Mbps bandwith), in Azure a P2S connection with IKEv2 + OpenVPN.
- A on-premise client Windows 10 PC with the Azure client VPN P2S downloaded from Azure Portal.
Test:
- Mount a simple Samba file server in VM, and transfer a 50MB file over the VPN from client PC. It has some peak transfers speed about 2-3 MBps = 16-24 Mbps.
- Run iperf3 in VM as server, and launch iperf3 client (ACTTools) from on-premise windows machine throw the VPN. Results here:
C:\ACTTools>iperf3.exe -c 192.168.0.4
Connecting to host 192.168.0.4, port 5201
[ 4] local 10.10.0.2 port 50046 connected to 192.168.0.4 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.01 sec 1.75 MBytes 14.5 Mbits/sec
[ 4] 1.01-2.01 sec 640 KBytes 5.29 Mbits/sec
[ 4] 2.01-3.01 sec 1.62 MBytes 13.5 Mbits/sec
[ 4] 3.01-4.02 sec 1.50 MBytes 12.5 Mbits/sec
[ 4] 4.02-5.01 sec 1.75 MBytes 14.8 Mbits/sec
[ 4] 5.01-6.01 sec 2.12 MBytes 17.9 Mbits/sec
[ 4] 6.01-7.01 sec 2.25 MBytes 18.8 Mbits/sec
[ 4] 7.01-8.01 sec 2.38 MBytes 19.9 Mbits/sec
[ 4] 8.01-9.01 sec 2.25 MBytes 18.9 Mbits/sec
[ 4] 9.01-10.02 sec 2.25 MBytes 18.8 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.02 sec 18.5 MBytes 15.5 Mbits/sec sender
[ 4] 0.00-10.02 sec 18.5 MBytes 15.5 Mbits/sec receiver
The speed is very slow (real 18 Mbps vs theoretic 650Mbps) .... why ? I have found people claiming about the same problem only in P2S connections, but not in 2S2, but there is no a response why o how to improve it.
If I repeat the same example but with 10 parallel connections, the SUM is about 50Mbps, but individual not rise 10Mbps. Why slow performance in individual transfer ? Note, for example, that a single file transfer to Azure Files Share, through the VPN is not splited in 10 parallel transfers.
Here results:
C:\ACTTools>iperf3.exe -c 192.168.0.4 -P 10
Connecting to host 192.168.0.4, port 5201
[ 4] local 10.10.0.2 port 50085 connected to 192.168.0.4 port 5201
[ 6] local 10.10.0.2 port 50086 connected to 192.168.0.4 port 5201
[ 8] local 10.10.0.2 port 50087 connected to 192.168.0.4 port 5201
[ 10] local 10.10.0.2 port 50088 connected to 192.168.0.4 port 5201
[ 12] local 10.10.0.2 port 50089 connected to 192.168.0.4 port 5201
[ 14] local 10.10.0.2 port 50090 connected to 192.168.0.4 port 5201
[ 16] local 10.10.0.2 port 50091 connected to 192.168.0.4 port 5201
[ 18] local 10.10.0.2 port 50092 connected to 192.168.0.4 port 5201
[ 20] local 10.10.0.2 port 50093 connected to 192.168.0.4 port 5201
[ 22] local 10.10.0.2 port 50094 connected to 192.168.0.4 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.01 sec 512 KBytes 4.17 Mbits/sec
[ 6] 0.00-1.01 sec 640 KBytes 5.21 Mbits/sec
[ 8] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[ 10] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[ 12] 0.00-1.01 sec 640 KBytes 5.21 Mbits/sec
[ 14] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[ 16] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[ 18] 0.00-1.01 sec 640 KBytes 5.21 Mbits/sec
[ 20] 0.00-1.01 sec 512 KBytes 4.17 Mbits/sec
[ 22] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[SUM] 0.00-1.01 sec 4.12 MBytes 34.4 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 1.01-2.01 sec 256 KBytes 2.09 Mbits/sec
[ 6] 1.01-2.01 sec 640 KBytes 5.23 Mbits/sec
[ 8] 1.01-2.01 sec 0.00 Bytes 0.00 bits/sec
[ 10] 1.01-2.01 sec 0.00 Bytes 0.00 bits/sec
[ 12] 1.01-2.01 sec 768 KBytes 6.27 Mbits/sec
[ 14] 1.01-2.01 sec 0.00 Bytes 0.00 bits/sec
[ 16] 1.01-2.01 sec 0.00 Bytes 0.00 bits/sec
[ 18] 1.01-2.01 sec 896 KBytes 7.32 Mbits/sec
[ 20] 1.01-2.01 sec 256 KBytes 2.09 Mbits/sec
[ 22] 1.01-2.01 sec 128 KBytes 1.05 Mbits/sec
[SUM] 1.01-2.01 sec 2.88 MBytes 24.1 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 2.01-3.01 sec 128 KBytes 1.04 Mbits/sec
[ 6] 2.01-3.01 sec 896 KBytes 7.31 Mbits/sec
[ 8] 2.01-3.01 sec 128 KBytes 1.04 Mbits/sec
[ 10] 2.01-3.01 sec 0.00 Bytes 0.00 bits/sec
[ 12] 2.01-3.01 sec 512 KBytes 4.18 Mbits/sec
[ 14] 2.01-3.01 sec 0.00 Bytes 0.00 bits/sec
[ 16] 2.01-3.01 sec 0.00 Bytes 0.00 bits/sec
[ 18] 2.01-3.01 sec 1.00 MBytes 8.36 Mbits/sec
[ 20] 2.01-3.01 sec 128 KBytes 1.04 Mbits/sec
[ 22] 2.01-3.01 sec 0.00 Bytes 0.00 bits/sec
[SUM] 2.01-3.01 sec 2.75 MBytes 23.0 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 3.01-4.02 sec 384 KBytes 3.12 Mbits/sec
[ 6] 3.01-4.02 sec 768 KBytes 6.25 Mbits/sec
[ 8] 3.01-4.02 sec 128 KBytes 1.04 Mbits/sec
[ 10] 3.01-4.02 sec 0.00 Bytes 0.00 bits/sec
[ 12] 3.01-4.02 sec 384 KBytes 3.12 Mbits/sec
[ 14] 3.01-4.02 sec 0.00 Bytes 0.00 bits/sec
[ 16] 3.01-4.02 sec 128 KBytes 1.04 Mbits/sec
[ 18] 3.01-4.02 sec 128 KBytes 1.04 Mbits/sec
[ 20] 3.01-4.02 sec 512 KBytes 4.16 Mbits/sec
[ 22] 3.01-4.02 sec 0.00 Bytes 0.00 bits/sec
[SUM] 3.01-4.02 sec 2.38 MBytes 19.8 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 4.02-5.01 sec 256 KBytes 2.11 Mbits/sec
[ 6] 4.02-5.01 sec 512 KBytes 4.23 Mbits/sec
[ 8] 4.02-5.01 sec 0.00 Bytes 0.00 bits/sec
[ 10] 4.02-5.01 sec 128 KBytes 1.06 Mbits/sec
[ 12] 4.02-5.01 sec 384 KBytes 3.17 Mbits/sec
[ 14] 4.02-5.01 sec 128 KBytes 1.06 Mbits/sec
[ 16] 4.02-5.01 sec 128 KBytes 1.06 Mbits/sec
[ 18] 4.02-5.01 sec 384 KBytes 3.17 Mbits/sec
[ 20] 4.02-5.01 sec 384 KBytes 3.17 Mbits/sec
[ 22] 4.02-5.01 sec 0.00 Bytes 0.00 bits/sec
[SUM] 4.02-5.01 sec 2.25 MBytes 19.0 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 5.01-6.01 sec 512 KBytes 4.21 Mbits/sec
[ 6] 5.01-6.01 sec 640 KBytes 5.26 Mbits/sec
[ 8] 5.01-6.01 sec 128 KBytes 1.05 Mbits/sec
[ 10] 5.01-6.01 sec 0.00 Bytes 0.00 bits/sec
[ 12] 5.01-6.01 sec 768 KBytes 6.31 Mbits/sec
[ 14] 5.01-6.01 sec 0.00 Bytes 0.00 bits/sec
[ 16] 5.01-6.01 sec 128 KBytes 1.05 Mbits/sec
[ 18] 5.01-6.01 sec 768 KBytes 6.31 Mbits/sec
[ 20] 5.01-6.01 sec 512 KBytes 4.21 Mbits/sec
[ 22] 5.01-6.01 sec 0.00 Bytes 0.00 bits/sec
[SUM] 5.01-6.01 sec 3.38 MBytes 28.4 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 6.01-7.00 sec 1.25 MBytes 10.5 Mbits/sec
[ 6] 6.01-7.00 sec 896 KBytes 7.37 Mbits/sec
[ 8] 6.01-7.00 sec 640 KBytes 5.27 Mbits/sec
[ 10] 6.01-7.00 sec 256 KBytes 2.11 Mbits/sec
[ 12] 6.01-7.00 sec 1.38 MBytes 11.6 Mbits/sec
[ 14] 6.01-7.00 sec 256 KBytes 2.11 Mbits/sec
[ 16] 6.01-7.00 sec 640 KBytes 5.27 Mbits/sec
[ 18] 6.01-7.00 sec 1.50 MBytes 12.6 Mbits/sec
[ 20] 6.01-7.00 sec 896 KBytes 7.37 Mbits/sec
[ 22] 6.01-7.00 sec 128 KBytes 1.05 Mbits/sec
[SUM] 6.01-7.00 sec 7.75 MBytes 65.3 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 7.00-8.00 sec 1.88 MBytes 15.7 Mbits/sec
[ 6] 7.00-8.00 sec 1.62 MBytes 13.6 Mbits/sec
[ 8] 7.00-8.00 sec 512 KBytes 4.19 Mbits/sec
[ 10] 7.00-8.00 sec 512 KBytes 4.19 Mbits/sec
[ 12] 7.00-8.00 sec 1.88 MBytes 15.7 Mbits/sec
[ 14] 7.00-8.00 sec 512 KBytes 4.19 Mbits/sec
[ 16] 7.00-8.00 sec 1.12 MBytes 9.42 Mbits/sec
[ 18] 7.00-8.00 sec 2.12 MBytes 17.8 Mbits/sec
[ 20] 7.00-8.00 sec 1.25 MBytes 10.5 Mbits/sec
[ 22] 7.00-8.00 sec 640 KBytes 5.24 Mbits/sec
[SUM] 7.00-8.00 sec 12.0 MBytes 101 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 8.00-9.00 sec 2.12 MBytes 17.8 Mbits/sec
[ 6] 8.00-9.00 sec 1.88 MBytes 15.7 Mbits/sec
[ 8] 8.00-9.00 sec 768 KBytes 6.29 Mbits/sec
[ 10] 8.00-9.00 sec 896 KBytes 7.34 Mbits/sec
[ 12] 8.00-9.00 sec 1.12 MBytes 9.44 Mbits/sec
[ 14] 8.00-9.00 sec 768 KBytes 6.29 Mbits/sec
[ 16] 8.00-9.00 sec 1.12 MBytes 9.44 Mbits/sec
[ 18] 8.00-9.00 sec 1.38 MBytes 11.5 Mbits/sec
[ 20] 8.00-9.00 sec 640 KBytes 5.24 Mbits/sec
[ 22] 8.00-9.00 sec 640 KBytes 5.24 Mbits/sec
[SUM] 8.00-9.00 sec 11.2 MBytes 94.4 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 4] 9.00-10.00 sec 2.88 MBytes 24.2 Mbits/sec
[ 6] 9.00-10.00 sec 1.88 MBytes 15.8 Mbits/sec
[ 8] 9.00-10.00 sec 1.38 MBytes 11.6 Mbits/sec
[ 10] 9.00-10.00 sec 1.62 MBytes 13.7 Mbits/sec
[ 12] 9.00-10.00 sec 1.75 MBytes 14.7 Mbits/sec
[ 14] 9.00-10.00 sec 1.12 MBytes 9.47 Mbits/sec
[ 16] 9.00-10.00 sec 1.75 MBytes 14.7 Mbits/sec
[ 18] 9.00-10.00 sec 1.62 MBytes 13.7 Mbits/sec
[ 20] 9.00-10.00 sec 1.00 MBytes 8.41 Mbits/sec
[ 22] 9.00-10.00 sec 1.25 MBytes 10.5 Mbits/sec
[SUM] 9.00-10.00 sec 16.2 MBytes 137 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 10.1 MBytes 8.49 Mbits/sec sender
[ 4] 0.00-10.00 sec 10.0 MBytes 8.42 Mbits/sec receiver
[ 6] 0.00-10.00 sec 10.2 MBytes 8.60 Mbits/sec sender
[ 6] 0.00-10.00 sec 10.1 MBytes 8.43 Mbits/sec receiver
[ 8] 0.00-10.00 sec 3.88 MBytes 3.25 Mbits/sec sender
[ 8] 0.00-10.00 sec 3.76 MBytes 3.15 Mbits/sec receiver
[ 10] 0.00-10.00 sec 3.62 MBytes 3.04 Mbits/sec sender
[ 10] 0.00-10.00 sec 3.40 MBytes 2.85 Mbits/sec receiver
[ 12] 0.00-10.00 sec 9.50 MBytes 7.97 Mbits/sec sender
[ 12] 0.00-10.00 sec 9.30 MBytes 7.80 Mbits/sec receiver
[ 14] 0.00-10.00 sec 3.00 MBytes 2.52 Mbits/sec sender
[ 14] 0.00-10.00 sec 2.79 MBytes 2.34 Mbits/sec receiver
[ 16] 0.00-10.00 sec 5.25 MBytes 4.40 Mbits/sec sender
[ 16] 0.00-10.00 sec 5.12 MBytes 4.30 Mbits/sec receiver
[ 18] 0.00-10.00 sec 10.4 MBytes 8.70 Mbits/sec sender
[ 18] 0.00-10.00 sec 10.2 MBytes 8.57 Mbits/sec receiver
[ 20] 0.00-10.00 sec 6.00 MBytes 5.03 Mbits/sec sender
[ 20] 0.00-10.00 sec 5.86 MBytes 4.91 Mbits/sec receiver
[ 22] 0.00-10.00 sec 3.00 MBytes 2.52 Mbits/sec sender
[ 22] 0.00-10.00 sec 2.84 MBytes 2.38 Mbits/sec receiver
[SUM] 0.00-10.00 sec 65.0 MBytes 54.5 Mbits/sec sender
[SUM] 0.00-10.00 sec 63.4 MBytes 53.2 Mbits/sec receiver
P2S is very important in our business because remote workers with laptops, and 15Mbps is a poor low bandwidth.
Nowadays, we connect from this on-premise client windows PC using P2S connections to others (non Azure) on-premise VPN remote offices using (IPSec, Wireguard or OpenVPN) limited to 300Mbps channel, and get speeds about 38-40MBps = 300 Mbps aprox.
Why Azure IKEv2 P2S VPN is so slow ? What I'm doing wrong ?
Thanks in advance.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee2024-05-15T00:52:50.74+00:00 Thank you for reaching out.
In order to help isolate this issue, if not already tried can you please check from a different client machine and see if you are able to observe the same issue?
Thank you!
-
Juan Miguel 0 Reputation points
2024-05-15T12:48:57.2666667+00:00 Hello, thanks for your suggestion.
Early tests were done inside a Windows VM connected by WIFI 6G side by side the Wifi Router (1m) and 600Mbps optical fiber internet connection.
I have done a lot of tests and variations.
The new tests are in a different office with a 300Mbps and 600 Mbps optical fiber internet connections. All file transfers use the same 55MB test file.
For each scenario y checked:
a) Transfer a file via Azure VPN Gw1 to Azure VM using samba.
b) Iperf3 test via Azure VPN Gw1 to Azure VM. Single transfer (-P 1) and 5 parallel transfers (-P 5).
c) Transfer a file via Azure VPN Gw1 to Azure Files.
d) The same as (a) but using a Wireguard VPN hosted in Azure VM (B1s).
e) The same as (b) but using a Wireguard VPN hosted in Azure VM (B1s).Scenario 1. Office 1. Physical Windows 10 PC. RJ45.
a) Samba transfer 20 / 22 MBps = 176Mbps.
b) Single: 43Mbps. Parallel (about 69Mbps / 289Mbps total)
c) 22/23 MBps peaks = 184 Mbps peaks.
d) stable 27/28 MBps = 216-224 Mbps.
e) Single: 55 Mbps. Parallel (about 53Mbps / 266 Mbps total)Scenario 2. Office 1. Windows 10 VM. RJ45.
a) Samba transfer 10 MBps = 80Mbps.
b) Not available.
c) Samba transfer 8 / 11 MBps = 64Mbps / 88Mbps.
d) stable 10/12 MBps = 80-96 Mbps.
e) Single: 10 Mbps. Parallel (about 8Mbps / 65 Mbps total)Scenario 3. Office 2. Physical GNU/Linux laptop. Wifi 6G. (600 Mbps internet fiber)
a) Not available. Problems with IKEv2 Ciphers VPN negotiation.
b) Not available. Problems with IKEv2 Ciphers VPN negotiation.
c) Not available. Problems with IKEv2 Ciphers VPN negotiation.
d) stable 39,04MBps = 312 Mbps.
e) Single: 370Mbps. Parallel (about 8Mbps / 65 Mbps total)Scenario 4. Office 2. Windows 10 VM. Wifi 6.
The older initial results.In summary:
I realize that Azure / Wireguard VPN inside VM in on-premise servers has a poor speed (no matter the Office / internet connection).
Physical machines has a good performance with Azure VPN, but so bottom from top max fiber or VPN max speed (VPNGw1 should be max 650Mbps).
Connect a Linux client to Azure VPN fails, and the official docs / scripts are wrong:
https://learn.microsoft.com/es-es/azure/storage/files/storage-files-configure-p2s-vpn-linuxUsing Networkmanager with strongswan, fails with ciphers negotiation:
may 15 14:40:52 juan-executive charon-nm[75258]: 06[CFG] received proposals: ESP:AES_GCM_16_256/NO_EXT_SEQ may 15 14:40:52 juan-executive charon-nm[75258]: 06[CFG] configured proposals: ESP:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256> may 15 14:40:52 juan-executive charon-nm[75258]: 06[IKE] no acceptable proposal found may 15 14:40:52 juan-executive charon-nm[75258]: 06[IKE] failed to establish CHILD_SA, keeping IKE_SAFor now, GNU/Linux clients cannot connect to Azure VPN with IKEv2 (this is other problem, not a speed problem).
-
Juan Miguel 0 Reputation points
2024-05-15T14:16:56.9866667+00:00 Now I can connect IPSec IKEv2 from GNU/Linux with strongswan to Azure VPN, following this (https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-cert-linux)
And there is a bug in "Scenario 3 > e". So new datas:
This is the correct values:
Scenario 3. Office 2. Physical GNU/Linux laptop. Wifi 6G. (600 Mbps internet fiber)
a) 25MBps = 200Mbps
b) Single: 299 Mbps, peaks 310Mbps. Parallel (about 60Mbps / 417Mbps total)
c) Samba transfer 16,51MB = 138Mbps
d) stable 39,04MBps = 312 Mbps.
e) Single: 349Mbps, peaks of 461Mbps. Parallel (about 65-96Mbps / 425Mps total).With all that test, I discover that:
- Inside VM, the VPN connections has a very poor performance.
- In physical machines the VPN connections has a good performance, but about so far from the optimal speed (417Mps vs 600Mbps [fiber speed]) in a 650Mbps VPNgw1. I don`t know why, but the speed is near enough for our actual needs.
- Wireguard server in a "cheap" B1s VM, outperforms the Azure VPNgw1, and speed is more stable.
-
ChaitanyaNaykodi-MSFT 26,216 Reputation points Microsoft Employee
2024-05-20T18:42:06.6666667+00:00 Thank you for posting a detailed response here. I think we will need specialized 1:1 session, where a support engineer can have a screen share session to pin point the issue. If you have a support plan you may file a support ticket, else please refer to my private message here. Thank you!
Sign in to comment
Sign in to answer