Re: Slow local performance on remote VPN site

This post has the same issue,

Solved: slow network performance over wan
http://chicagotech.net/netforums/viewtopic.php?t=712

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"Jeff Vandervoort" <jeffv @ jrvsystems dot com> wrote in message
news:OvuNx3TiHHA.392@xxxxxxxxxxxxxxxxxxxxxxx
WS2003 domain, 2 AD Sites connected by new site-to-site RRAS L2TP/IPSec
VPN. Main office endpoint is ISA2004 on WS2003 R2, branch office endpoint
is WS2003 R2 SP2. Each site has (at least 1) DC & DNS server. At (small)
branch office, these are on the RRAS server.

When branch office server was on the main office's LAN, it was as fast as
any other similar machine on the network. Once it was on its own AD site,
with only a VPN connection, the server became very slow. Even browsing
local drives on that server takes a long time. Can take a couple minutes
for Explorer to move from a folder to a subfolder.

Performance aside, we have connectivity between the 2 sites.

Other, likely-related symptoms: DFS referrals that should go to the branch
office server often go to the main office servers. Roaming profiles, which
should be loading from a local copy of a DFSR-replicated user profile
share, load only the cached copy. If you look in System
Properties/Advanced/User Profiles, Type is "Roaming" but Status is
"Local". In DNS, AD Sites & Services, and querying WMI, branch office
server and its clients are in the correct AD Site.

Nothing in Event Logs that points me to the cause.

My gut tells me this is a routing problem. I'm not catching it, but maybe
I don't know what I'm looking for.

Main office LAN: 192.168.0.x
Main office internal IP: 192.168.0.234
Main office VPN interface: 172.16.100.222
Main office external IP (on perimeter network) 192.168.1.101

Branch office internal IP: 10.10.11.221
Branch office LAN: 10.10.11.x
Branch office VPN interface: 172.16.100.223

Here are the routing tables from both RRAS servers:

Main office--

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 12 17 5a ad 77 ...... Linksys EG1032 v3 Instant Gigabit Desktop
Network Adapter Driver - Packet Scheduler Miniport
0x10004 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
0x30003 ...00 0f 1f f8 c2 c0 ...... Intel(R) PRO/1000 MT Network
Connection - Packet Scheduler Miniport
0x40006 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface
Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.101 20
[VPNClientIP] 255.255.255.255 192.168.1.1 192.168.1.101
20
10.10.11.0 255.255.255.0 0.0.0.0 172.16.100.223 1
10.10.11.0 255.255.255.0 172.16.100.222 172.16.100.223 1
[VPNClientIP] 255.255.255.255 192.168.1.1 192.168.1.101 20
[VPNClientIP] 255.255.255.255 192.168.1.1 192.168.1.101
20
[VPNClientIP] 255.255.255.255 192.168.1.1 192.168.1.101 20
[Branch Office Ext IP] 255.255.255.255 192.168.1.1 192.168.1.101
20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.16.0.1 255.255.255.255 127.0.0.1 127.0.0.1 50
172.16.0.2 255.255.255.255 172.16.0.1 172.16.0.1 1
172.16.0.5 255.255.255.255 172.16.0.1 172.16.0.1 1
172.16.0.6 255.255.255.255 172.16.0.1 172.16.0.1 1
172.16.0.14 255.255.255.255 172.16.0.1 172.16.0.1 1
172.16.0.17 255.255.255.255 172.16.0.1 172.16.0.1 1
172.16.100.222 255.255.255.255 172.16.100.223 172.16.100.223 1
172.16.100.223 255.255.255.255 127.0.0.1 127.0.0.1 50
172.16.255.255 255.255.255.255 172.16.100.223 172.16.100.223 50
192.168.0.0 255.255.255.0 192.168.0.234 192.168.0.234 10
192.168.0.234 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.0.255 255.255.255.255 192.168.0.234 192.168.0.234 10
192.168.1.0 255.255.255.0 192.168.1.101 192.168.1.101 20
192.168.1.101 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.101 192.168.1.101 20
[VPNClientIP] 255.255.255.255 192.168.1.1 192.168.1.101 20
224.0.0.0 240.0.0.0 172.16.100.223 172.16.100.223 50
224.0.0.0 240.0.0.0 192.168.0.234 192.168.0.234 10
224.0.0.0 240.0.0.0 192.168.1.101 192.168.1.101 20
255.255.255.255 255.255.255.255 172.16.100.223 172.16.100.223 1
255.255.255.255 255.255.255.255 192.168.0.234 192.168.0.234 1
255.255.255.255 255.255.255.255 192.168.1.101 192.168.1.101 1
Default Gateway: 192.168.1.1
===========================================================================
Persistent Routes:
None


Branch Office--

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10002 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
0x10003 ...00 04 23 bd 5d a4 ...... Intel(R) PRO/1000 MT Dual Port Server
Adapter
0x10004 ...00 0d 56 fe 01 b5 ...... Intel(R) PRO/1000 XT Network
Connection
0x20005 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface
Metric
0.0.0.0 0.0.0.0 [ExternalDG] [ExternalIP] 20
10.2.0.0 255.255.255.0 172.16.100.223 172.16.100.222 1
10.10.11.0 255.255.255.0 10.10.11.221 10.10.11.221 20
10.10.11.5 255.255.255.255 127.0.0.1 127.0.0.1 50
10.10.11.221 255.255.255.255 127.0.0.1 127.0.0.1 20
10.255.255.255 255.255.255.255 10.10.11.221 10.10.11.221 20
[ExternalIPBlock] 255.255.255.0 [ExternalIP] [ExternalIP]
20
[ExternalIP] 255.255.255.255 127.0.0.1 127.0.0.1 20
xx.255.255.255 255.255.255.255 [ExternalIP] [ExternalIP] 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.16.100.222 255.255.255.255 127.0.0.1 127.0.0.1 50
172.16.100.223 255.255.255.255 172.16.100.222 172.16.100.222 1
172.16.255.255 255.255.255.255 172.16.100.222 172.16.100.222 50
192.168.0.0 255.255.255.0 172.16.100.223 172.16.100.222 1
[MainOfficeExtIP] 255.255.255.255 [ExtDG] [ExtIP] 20
224.0.0.0 240.0.0.0 10.10.11.221 10.10.11.221 20
224.0.0.0 240.0.0.0 [ExtIP] [ExtIP] 20
224.0.0.0 240.0.0.0 172.16.100.222 172.16.100.222 50
255.255.255.255 255.255.255.255 10.10.11.221 10.10.11.221 1
255.255.255.255 255.255.255.255 [ExtIP] [ExtIP] 1
255.255.255.255 255.255.255.255 172.16.100.222 172.16.100.222 1
Default Gateway: [ExtDG]
===========================================================================
Persistent Routes:
None

TIA!

--
Jeff Vandervoort
JRVsystems



.

Relevant Pages

  • Re: [Full-disclosure] Remote Desktop Command Fixation Attacks
    ... This set of steps is redundant in many places, and it's also enormously expensive, since you're using no less than three different expensive bits of networking hardware (AP, PIX, VPN Concentrator), in addition to a bunch of x86 server hardware, windows server licenses, and at least one ISA license. ... Your computers necessarily don't have full access to your network infrastructure when they aren't logged on, so GPOs, software updates, etc can't be applied at the times you want them to be applied. ... Turning on, enabling, and implementing every possible security setting and device you think of is not defence in depth, and will probably only have two effects - your users won't use your wireless network, and you'll burn so much cash you won't have any left to spend on *useful* security measures. ...
    (Full-Disclosure)
  • Re: VPN with SBS 2003 (not R2) and DSL.
    ... Reading property value for VPN returned OK ... Reading VPN Server Name returned OK ... identical network cards. ... it seems doubtful that SBS will work properly with two NICs ...
    (microsoft.public.windows.server.sbs)
  • RE: VPN Connection Problems
    ... Note that we are able to successfully VPN into the office. ... to browse the network, RDP to the server or even ping the server. ... > This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • Re: VPN clients unable to connect to other resources.
    ... on the SBS 2003 server just not sure where to go for help on it. ... Next time I'm at my home PC, I'll VPN in and see what IP info I'm getting ... client PC on your LAN, you should be able to do so from a remote VPN client, ... get the network path was not found. ...
    (microsoft.public.windows.server.sbs)
  • RE: VPN Error 800
    ... The VPN client IP is 10.0.1.40, this is a private IP address. ... server IP address is 81.137.105.244, this is a Internet IP address. ... not test VPN connection from your perimeter network. ... SBS on your switch to make it work. ...
    (microsoft.public.windows.server.sbs)
Loading