Slow SMB transfer between 2 MX95 over AutoVPN 1gb WAN

[Andrew3]

Hey

According to specs mx95 shoud be able to transfer 2.5gbit over autovpn. 

I'm only capable to reach 500Mb during file copy over SMB between 2 servers on both locations. 

Turning AMP and IDS didn't help at all.

I'm currently on MX 19.1.7.2 firmware on both locations. Is there anything that might prevent reaching full speed over VPN ?

iperf3 also doesn't look good

[alemabrahao]

Do you have any traffic shaping rules configured?

How many users do you have on your network?

What is the device utilization and bandwidth utilization graph like?

Keep in mind that the maximum throughput is reduced to 2 Gbps when all advanced security features are enabled.

[Andrew3]

i've tested with AMP and IDS turned OFF

internet traffic was barely moving before test 5-10Mb at most

Traffic shaping was limited to 1gb. i've tested with 2.5gb limit but none of what i've tried done anything 
Servers that test has been done are connected to either 25gb or 10gb network. 

from graph its like id didnt reach 500Mb

[RaphaelL]

Hi ,

Were you ever able to reach 1Gbps ? Or is it simply with this firmware that you started to have issues ?

[Andrew3]

most i've seen i think was around 800 during veeam vm replication to another hyperv server. Still not 1gbit. and replication was done after work hours.

also on 1 pdf it says:

and on different page

MX95/105 Datasheet - Cisco Meraki Documentation
it says

i think there was some info regarding firmware that mentioned vpn speed increase is that correct ?

"

Security appliance firmware versions MX 18.208 changelog

Important notice

• USB modems with MX/Z series devices running firmware MX 18 or newer will be limited to best effort support and will not be receiving any future firmware fixes or improvements.

What's new

• Significant performance improvements for MX85, MX95, and MX105 appliances."

[ww]

Single iperf stream could be limited because of tcp latency 

Did you try with more streams?  -P 5

[Andrew3]

with 5 streams not much difference

[Mloraditch]

Have you tried connecting a test computer directly to the ISP at each site and running iPerf? While the firewall and everything involved adds some overhead it could be as simple as that throughput isn't possible between the two ISP connections.

[PhilipDAth]

I think you should be getting more throughput than you are.

What speed are your Internet connections at each end?

Is it an MX95 at each end?

We need to validate your testing methodology.

• If you run Iperf to the same host using 127.0.0.1 what do you get?  This sets the upper limit of what you can test.
• If you run iPerf between two computers directly over your LAN, what throughput do you get?

Now that we know the limits of the testing system, we need to move onto the links.

You will need to plug a computer directly into each Internet connection (using a public IP address on each), and then do an iPerf.  Painfull, I know.  This will verify the bandwidth available over the Internet path.

I see different performance numbers in the sizing guide:

https://documentation.meraki.com/MX/MX_Sizing_Information/MX_Sizing_Principles

It's not uncommon to tune SMB to get it performing well.

https://learn.microsoft.com/en-us/windows-server/administration/performance-tuning/role/file-server/...

[Andrew3]

As title mentioned i have 2 MX95 in 2 locations with 1gbit simetrical internet on both locations. 

127.0.0.1 

server in second location to vm that it hosts (10gb lan)

server in first location to physical server in first location

server in first location to vm that it hosts (25gbit lan)

I can't do that test unfortunately

"You will need to plug a computer directly into each Internet connection (using a public IP address on each), and then do an iPerf.  Painfull, I know.  This will verify the bandwidth available over the Internet path."

Both serves are identical Dell R7615 with 25gbit NICs each just 1 locations is on 25gbit network and second on 10gbit

another transfer test is still poor

[Andrew3]

Fun fact

i've reverted firmware to MX 18.211.5.2 on both mx95 and iperf speed between sites is correct now

although smb speed stil looks bit slow

[PhilipDAth]

This might not be related ...

I have just run into a problem with MX95s at a customer site running 19.1.7.2.  They had started having AnyConnect issues.  What I found out was the MX95s were constantly and regularly crashing.  They were failing over quick enough so the customer didn't notice the Internet dropping out - but they did notice their AnyConnect sessions dropping all the time.

None of their other models of MX were experiencing this issue.  Only the MX95s were affected.

We have had to roll them back to 18.211.4 (what they were running beforehand).

[Mloraditch]

We also have gotten reports in the past couple of days where newly implemented traffic shaping policies on MXs running 19.1.6 and 19.1.7.2 have caused issues. Once we removed them and rebooted the MXs things returned to normal overall.

Something seems rotten with 19.1 in several circumstances.

[Andrew3]

I've rolled back on all our locations to 18.211.4 just in case. We also have MX68CWs and vMX100
I've seen already new beta

But i won't be testing that.