Slow File Copy Issue across vpn tunnel

[Chuck.Reimer]

I am copying a 5 meg file across a permanent tunnel (vpn) from server A (behind a UTM-1 running NGX R65) to server B (behind a Nokia IP380 running NGX R65).

The issue I am having is when I copy the file (power point files seem to be the worst) the copy window on server B pops up about 4 minutes after I have clicked paste.

The reverse is true on the other end of the tunnel. When I click Paste on server A the copy window appears immediately, but when the copy hits 0 seconds remaining it waits 4 minutes and then finishes the copy.

The UTM-1 has a 10/1 internet connection.

The IP 380 has a 9/2 internet connection.

My guess is there is some kind of caching issue on the IP 380 but I am at a loss finding it.

Does anyone have any ideas?

[melipla]

Its a known issue. Taken from sk32651, issue this [SPLAT] command to the NGX gateway(s):
fw ctl set int fwtcpstr_max_window 65536

That setting won't survive reboot, but if it fixes your problem, edit the $FWDIR/boot/modules/fwkern.conf file (create a new one if it doesn't exist) and add this line:
fwtcpstr_max_window=0x10000

Which should set the parameter after each boot. Took me forever to solve that one. Be aware that changing that parameter affects the performance of Smart Defense, which is the primary reason why its not "fixed" by default.

[Chuck.Reimer]

That helped a little. Thank you.

Here is the performance issue:

When I copy an 11 meg pdf file it takes just under 2 minutes. Which is fine.

When I copy a 5 meg ppt file it takes almost 8 minutes. There must be something scanning something. Can smartdefense cause this issue?

[jaskaran224]

may be smart defense can cause this.... did u see something in logs....try disabling tht...

[Chuck.Reimer]

Unfortunately, I did not see anything in the logs.

One other symptom I see is I cannot connect to the fw on the other end of the vpn through the R65 GUI.

[jaskaran224]

u can check the routes between the managment server and the other end firewall.. and I have seen in some other post that by disbaling PFS the speed increases...... (but that was between checkpoint and Cisco) may be u can give it a shot..