question

PiotrMikqus-0423 avatar image
1 Vote"
PiotrMikqus-0423 asked ThomasGusset-9053 commented

Always On VPN IKEv2 - Poor Performance over WiFI?

We have a similar problem in our organization as some have written here before.
Unfortunately there is still no solution.
During a VPN connection, the bandwidth when working in a WIFI connection is very low.

Wired file copies are in the 10 MB/s range.
Wireless file copies are in the 1 MB/s range.

This applies to all home users.
This is not an individual situation.
Has anyone already encountered this and perhaps found a solution?

windows-10-network
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Please try to accept the replies which help you. It will encourage the person who help you. Appreciate your understanding. :)

2 Votes 2 ·
SunnyQi-MSFT avatar image
0 Votes"
SunnyQi-MSFT answered

Hi,

Thanks for posting in Q&A platform.

It seems your issue is that slow Wi-Fi network connection performance when VPN is connected. For network speed slow performance issue, it's necessary to analyze performance log and network traffic to find the cause. However, analysis of log is beyond our forum support level and due to forum security policy, we have no such channel to collect user log information. So, we recommend you open a case with MS Professional tech support service, they will help you open a phone or email case to Microsoft, so that you would get a technical support on a one-to-one basis while ensuring private information.

Here is the link, you could find phone number of your region accordingly from the link below::

https://support.microsoft.com/en-us/gp/customer-service-phone-numbers

Best Regards,
Sunny


If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

yannara avatar image
0 Votes"
yannara answered yannara commented

What will be the difference if you measure your wifi against wired without VPN connection? Any difference do if you use 2,4GHz vs. 5GHz? 5GHz might have some compatible issues with older WLAN adapters.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you for your reply.
This situation has nothing to do with the bandwidth on the users home routers.
I used 2,4Ghz 802.11n, our users used 802.11ac, ax etc....

WIFI and LAN works very well.I tested it on speedtest.net and many others, I also used iperf. The problem is not the router or internet performance.
I have a 120Mbps/20Mbps connection to the internet. Other users even have 500Mbps/50Mbps and have the same problem.

The tunnel performance is good when I am connected to the router with a cable.
When I connect via WIFI the performance drops very low. Could this be a problem with IKEv2 ?
When I use CiscoAnyConnect everything works fine over WIFI and over LAN.

I tested the AlwaysON tunnel to our server in our organization using iperf:

ETHERNET:
Upload iperf:8Mbps files:1MB/s so 8Mbps
Download iperf:15Mbps files: 4MB/s so 32Mbps


WIFI:
Upload iperf:1,6Mbps files:350KB/s so 2,7Mbps
Download iperf:4,7Mbps files: 1,5MB/s so 12Mbps

0 Votes 0 ·

IKEv2 should be the most fastest one if the compatibility is good. I think next you should move to SSTP and compare the performance there. I've used ALOVPN with Server 2016 for some time back over the years before going to Intune and I never witness any poor performance with WIFI. To make sure, patch Windows 10 and Server as well.

0 Votes 0 ·
GaryNebbett avatar image
1 Vote"
GaryNebbett answered

Hello @PiotrMikqus-0423,

If this problem still persists and you would be prepared to share network trace data then we could try to understand the cause of the problem. The approach that I would propose would be close to that used to solve this question: https://docs.microsoft.com/en-us/answers/questions/390860/remote-connections-speed-limited-to-about-15-mb-s.html.

Gary

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ThomasGusset-9053 avatar image
1 Vote"
ThomasGusset-9053 answered GaryNebbett commented

Hi
we have exactly the same issue.
Good SMB2 performance (around 10 MByte/s) if client is connected via LAN.
Poor SMB2 performance (around 1 MByte/s) if client is connected via WLAN (2.3 or 5 GHz).
We don't see the issue if we use SSTP instead of IKEv2.
Measuring Internet speed shows no significant difference between LAN and WLAN (force tunnel, speedtest.net).
Curiously we have an other customer where we don't see this issue (good SMB performance with LAN and WLAN).
Configuration is exactly the same.
Internet bandwidth is also not a bottleneck (> 200/200 MB/s)

Any ideas?

Thanks, Thomas

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @ThomasGusset-9053,

The suggestion that I made to Piotr still stands - if you want to investigate the behaviour by means of network tracing then I am happy to help.

Gary

0 Votes 0 ·

Hi Gary
thanks for that offer. I sent you a link request on LinkedIn.

Thomas

0 Votes 0 ·

Hello Thomas,

Thanks for that - I have accepted.

I live in Bettingen, Kanton Basel-Stadt, so our active times and waking hours should (largely) coincide (I am retired). I cycled within just a few tens of metres from your premises last August (Route 35 - we cycled from Feldkirch to Uznach that day) :-)

I need to first perform a quick test on my own equipment to make sure that my first trace proposal makes sense (i.e. delivers useful information) - if your client systems have a relatively new version of Windows, then a combination of the Microsoft-Windows-PktMon and Microsoft-Windows-TCPIP ETW providers will probably be the starting point.

Your line of business is a great help too - highly technical with a deep understanding of security issues - I am looking forward to this collaboration.

Gary

0 Votes 0 ·
GaryNebbett avatar image
1 Vote"
GaryNebbett answered GaryNebbett commented

Hello All,

Together with Thomas. I investigated this problem and we believe that we have found the explanation for the poor performance. If the explanation is correct, which we believe it probably (and mostly) is, then there are no practical workarounds.

I placed a more detailed analysis of our work at: http://gary-nebbett.blogspot.com/2021/07/slow-performance-of-ikev2-built-in.html.

In summary, there are two weaknesses in Microsoft components:

  1. The implementation of the TCP CUBIC congestion control mechanism.

  2. The distribution of work to worker threads by AgileVpn.sys (the IKEv2 WAN Miniport driver).

It takes a "third" ingredient to trigger the problem: the design of the network adapter device driver - in particular when it first indicates the arrival of a packet to NDIS. If the device driver directly indicates the arrival from its interrupt triggered DPC then everything works well. However, if the device driver defers the indication to a system worker thread then performance of the IKEv2 VPN declines sharply.

The sometimes observed and noted wired/wireless relationship between fast/slow IKEv2 VPNs is just a coincidence - it is the driver design that makes the difference. On my laptop where the built-in wired adapter is fast and the built-in wireless adapter is slow, a USB wireless network adapter is also fast.

Gary



· 8
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank for the very detailed GaryNebbett. I have had 'some' success in both improving performance (and stability) by updating some Intel NIC drivers. I still am facing stability issues in keeping tunnels up but the driver appears to assist with throughput on some adapters.

0 Votes 0 ·

Gary, thank you so much for your analysis. It is very detailed and helpful.

@Microsoft, we are attempting to migrate from MSVPN server to MS Always On VPN services, but we are unfortunately unable to proceed. Our MSVPN server is roughly 15-20 times faster than the AOVPN service on the same infrastructure. There no errors, logs or otherwise that we can find that indicate any particular issues.

It would be helpful to know if this issue is known and has any resources assigned to resolve.

0 Votes 0 ·

Hello @RobertCastles-4673,

Were/are you using IKEv2 in your old/existing set-up? If IKEv2 was used then the problem that I described is probably not the cause - it is independent of the server side.

If your old set-up was not using IKEv2 (perhaps it used L2TP/IPsec) then we could explore if there is any easy way to confirm whether you are encountering the packet reordering problem without sharing trace data (confidential information).

Gary

1 Vote 1 ·

EDIT: I'm not certain if our existing is using IKEv2. On the client side we are configured like this, below. On connection, it reports as WAN miniport (PPTP)

145008-image.png


145037-image.png

145009-image.png


0 Votes 0 ·
image.png (6.1 KiB)
image.png (10.1 KiB)
image.png (7.8 KiB)
Show more comments

What do you mean with 'MSVPN Server' and 'MS Always On VPN services'?
AoVPN uses RRAS on the server side.

1 Vote 1 ·
RobertCastles-4673 avatar image
0 Votes"
RobertCastles-4673 answered

By AoVPN, I'm referring to the IKEv2 and certificate auth based always on VPN whose setup is described here https://www.youtube.com/watch?v=aZ-thDAfuBM, referenced here https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy, without DirectAccess.

By "MSVPN" I'm referring to the "on demand" PPTP VPN services from Microsoft, generally available since around 2000. https://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protocol

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ThomasGusset-9053 avatar image
1 Vote"
ThomasGusset-9053 answered ThomasGusset-9053 commented

In my frist post I wrote what transfer rates we see. What transfer rates do you observe?
AoVPN can also be used with SSTP instead of IKEv2. With SSTP we didn't see the bad performance.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

With the IKEv2 we are seeing caps around 350Kbps, vs a normal experience of 15Mbps+

That is very interesting about the SSTP option, I had not even considered it as the guides shy away from it for some reason.

I will add trying SSTP to the list of things to try. Thanks!

0 Votes 0 ·

IKEv2 uses ESP over UDP. You might check if your edge firewall supress havy UDP traffic (UDP flood detection).This might would result in poor VPN performance.

0 Votes 0 ·
RobertCastles-4673 avatar image
0 Votes"
RobertCastles-4673 answered ThomasGusset-9053 commented

@ThomasGusset-9053 @GaryNebbett SSTP works. No notable networking issues. I did have to disable revocation check on the client as we are self signed here.
I'll look into what it takes to have a "Revocation Service".

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.