VPN Performance?

[yipster]

Hello,

I have a Site to Site VPN created via two NGX firewall. Is there anyway to speed up performance between the two sites. Both are connected to a T1 to the internet.

Both firewall are running Windows 2003 server.

Regards,

-y

[BarryStiefel]

Originally Posted by yipster

Hello,

I have a Site to Site VPN created via two NGX firewall. Is there anyway to speed up performance between the two sites. Both are connected to a T1 to the internet.

Both firewall are running Windows 2003 server.

Regards,

-y

If the binding constraint is the size of the pipe and not your processor (most likely true), then here are two suggestions:

1. Turn on site-to-site IP compression (free, and easy to do). You can configure this in your VPN settings.

2. Consider traffic shaping (expensive, and hard to do).

[yipster]

where do you turn it on from?

[BarryStiefel]

Originally Posted by yipster

where do you turn it on from?

I believe you have to be using VPN Communities, but at least in NG AI it's one of the settings in the fairly non-complicated configuration dialog boxes for your VPN community.

[yipster]

What would be a better platform in performance??

Splat or Windows 2003

[kva.kva]

I think SPLAT

...And some facts from CP site
http://www.checkpoint.com/products/c...s_product.html

SecurePlatform Basic 200-500 Mbps
SecurePlatform Mid-Range 1-3 Gbps
SecurePlatform High Performance >3 Gbps

Windows Basic 200-500 Mbps
Windows Mid Range 200-500 Mbps
Windows High Performance 500-1000 Mbps

[Sergej]

Originally Posted by yipster

I have a Site to Site VPN created via two NGX firewall. Is there anyway to speed up performance between the two sites. Both are connected to a T1 to the internet.-y

If both sites connected to one ISP and ISP supporting QoS prioritisation you have a chance.
The problem is the congestion point. It is on the ISP side. Two types of traffic came to IPS router toward you firewall: encrypted VPN traffic and normal internet replays. ISP router need to understand and prioritize which traffic goes first. Is the link from you FW to the ISP congested prioritization on the firewall do not give any benefits.