Network Management

So at my corporate office I have a 7210 VPN Gateway Controller.  All the RAP 505H will connect to this via public IP that NATs to the local controller over ip-sec port 4500.

When I am connected to ethernet port on the RAP and just do a regular speed test I get like over 100Mbs and I know it is going through the tunnel between rap and 7210 gateway because I did a traceroute.  Now when I just do an Iperf test to a local server at corporate office the bandwidth is only 20Mbs and it sucks.  What could be the problem

So, if I summarize correctly:

Client is wired connected to a RAP; all traffic tunneled to a gateway at the corporate office.
From that client a speed test to the internet results in 100 Mbps.
From that same client an iPerf to a system at the corporate office only results in 20 Mbps.

First of all, iPerf and Speedtest are two very different technologies and comparing or thinking the outcome is the same, may be misleading.
Second, make sure that you compare Mbps with Mbps and MBps with MBps. The Mbps (mega bits per second) value is 8x higher than the MBps (mega bytes per second).
Also, for iPerf to fill a link with some latency, you may need to run parallel connections (add -P 8 to run 8 parallel streams). Increasing the window size may help as well, I think iPerf keeps that low by default intentionally.
And iPerf may use UDP, which may be fragmented in the path between client and server (and vice versa). Fragmentation results in significant performance loss. Because the IPSec tunnel between AP and controller/gateway adds some additional headers, you may exceed the path-mtu on the connection between the AP and controller/gateway.

You may also have a look at Librespeed, which is a kind of speedtest similar to the ones you find online, but can be installed locally in your network. That may provide a more like-for-like comparison.

I don't see a reason why you would have less through put to local destinations on your corporate network, versus to the internet when traffic flows through the same controller that is installed in your corporate network and has high-bandwidth connections internally.

So at my corporate office I have a 7210 VPN Gateway Controller.  All the RAP 505H will connect to this via public IP that NATs to the local controller over ip-sec port 4500.

When I am connected to ethernet port on the RAP and just do a regular speed test I get like over 100Mbs and I know it is going through the tunnel between rap and 7210 gateway because I did a traceroute.  Now when I just do an Iperf test to a local server at corporate office the bandwidth is only 20Mbs and it sucks.  What could be the problem

No actually I also tried to transfer a file from out Corporate file server to this remote device plugged into the RAP and it was ungodly slow and did not even transfer completely.  It errored out and stopped transferring completely.  It was also 20Mbits 

So as far as mtu or window size.  Where would I go to adjust either one of these?

So, if I summarize correctly:

Client is wired connected to a RAP; all traffic tunneled to a gateway at the corporate office.
From that client a speed test to the internet results in 100 Mbps.
From that same client an iPerf to a system at the corporate office only results in 20 Mbps.

First of all, iPerf and Speedtest are two very different technologies and comparing or thinking the outcome is the same, may be misleading.
Second, make sure that you compare Mbps with Mbps and MBps with MBps. The Mbps (mega bits per second) value is 8x higher than the MBps (mega bytes per second).
Also, for iPerf to fill a link with some latency, you may need to run parallel connections (add -P 8 to run 8 parallel streams). Increasing the window size may help as well, I think iPerf keeps that low by default intentionally.
And iPerf may use UDP, which may be fragmented in the path between client and server (and vice versa). Fragmentation results in significant performance loss. Because the IPSec tunnel between AP and controller/gateway adds some additional headers, you may exceed the path-mtu on the connection between the AP and controller/gateway.

You may also have a look at Librespeed, which is a kind of speedtest similar to the ones you find online, but can be installed locally in your network. That may provide a more like-for-like comparison.

I don't see a reason why you would have less through put to local destinations on your corporate network, versus to the internet when traffic flows through the same controller that is installed in your corporate network and has high-bandwidth connections internally.

So at my corporate office I have a 7210 VPN Gateway Controller.  All the RAP 505H will connect to this via public IP that NATs to the local controller over ip-sec port 4500.

When I am connected to ethernet port on the RAP and just do a regular speed test I get like over 100Mbs and I know it is going through the tunnel between rap and 7210 gateway because I did a traceroute.  Now when I just do an Iperf test to a local server at corporate office the bandwidth is only 20Mbs and it sucks.  What could be the problem

Can you capture traffic at the iPerf server and/or the client? I would check if there is fragmented traffic seen there; and otherwise if there is dropped traffic/retries etc.

MTU can be a challenge to find the right value, and should not be an issue for tcp traffic. Window sizes normally are set automatically, but in iPerf you can set it artificially.

Working with your partner or TAC Support may be easiest to get the data analyzed.

No actually I also tried to transfer a file from out Corporate file server to this remote device plugged into the RAP and it was ungodly slow and did not even transfer completely.  It errored out and stopped transferring completely.  It was also 20Mbits 

So as far as mtu or window size.  Where would I go to adjust either one of these?

So, if I summarize correctly:

Client is wired connected to a RAP; all traffic tunneled to a gateway at the corporate office.
From that client a speed test to the internet results in 100 Mbps.
From that same client an iPerf to a system at the corporate office only results in 20 Mbps.

First of all, iPerf and Speedtest are two very different technologies and comparing or thinking the outcome is the same, may be misleading.
Second, make sure that you compare Mbps with Mbps and MBps with MBps. The Mbps (mega bits per second) value is 8x higher than the MBps (mega bytes per second).
Also, for iPerf to fill a link with some latency, you may need to run parallel connections (add -P 8 to run 8 parallel streams). Increasing the window size may help as well, I think iPerf keeps that low by default intentionally.
And iPerf may use UDP, which may be fragmented in the path between client and server (and vice versa). Fragmentation results in significant performance loss. Because the IPSec tunnel between AP and controller/gateway adds some additional headers, you may exceed the path-mtu on the connection between the AP and controller/gateway.

You may also have a look at Librespeed, which is a kind of speedtest similar to the ones you find online, but can be installed locally in your network. That may provide a more like-for-like comparison.

I don't see a reason why you would have less through put to local destinations on your corporate network, versus to the internet when traffic flows through the same controller that is installed in your corporate network and has high-bandwidth connections internally.

So at my corporate office I have a 7210 VPN Gateway Controller.  All the RAP 505H will connect to this via public IP that NATs to the local controller over ip-sec port 4500.

When I am connected to ethernet port on the RAP and just do a regular speed test I get like over 100Mbs and I know it is going through the tunnel between rap and 7210 gateway because I did a traceroute.  Now when I just do an Iperf test to a local server at corporate office the bandwidth is only 20Mbs and it sucks.  What could be the problem

Can you capture traffic at the iPerf server and/or the client? I would check if there is fragmented traffic seen there; and otherwise if there is dropped traffic/retries etc.

MTU can be a challenge to find the right value, and should not be an issue for tcp traffic. Window sizes normally are set automatically, but in iPerf you can set it artificially.

Working with your partner or TAC Support may be easiest to get the data analyzed.

No actually I also tried to transfer a file from out Corporate file server to this remote device plugged into the RAP and it was ungodly slow and did not even transfer completely.  It errored out and stopped transferring completely.  It was also 20Mbits 

So as far as mtu or window size.  Where would I go to adjust either one of these?

So, if I summarize correctly:

Client is wired connected to a RAP; all traffic tunneled to a gateway at the corporate office.
From that client a speed test to the internet results in 100 Mbps.
From that same client an iPerf to a system at the corporate office only results in 20 Mbps.

First of all, iPerf and Speedtest are two very different technologies and comparing or thinking the outcome is the same, may be misleading.
Second, make sure that you compare Mbps with Mbps and MBps with MBps. The Mbps (mega bits per second) value is 8x higher than the MBps (mega bytes per second).
Also, for iPerf to fill a link with some latency, you may need to run parallel connections (add -P 8 to run 8 parallel streams). Increasing the window size may help as well, I think iPerf keeps that low by default intentionally.
And iPerf may use UDP, which may be fragmented in the path between client and server (and vice versa). Fragmentation results in significant performance loss. Because the IPSec tunnel between AP and controller/gateway adds some additional headers, you may exceed the path-mtu on the connection between the AP and controller/gateway.

You may also have a look at Librespeed, which is a kind of speedtest similar to the ones you find online, but can be installed locally in your network. That may provide a more like-for-like comparison.

I don't see a reason why you would have less through put to local destinations on your corporate network, versus to the internet when traffic flows through the same controller that is installed in your corporate network and has high-bandwidth connections internally.

So at my corporate office I have a 7210 VPN Gateway Controller.  All the RAP 505H will connect to this via public IP that NATs to the local controller over ip-sec port 4500.

When I am connected to ethernet port on the RAP and just do a regular speed test I get like over 100Mbs and I know it is going through the tunnel between rap and 7210 gateway because I did a traceroute.  Now when I just do an Iperf test to a local server at corporate office the bandwidth is only 20Mbs and it sucks.  What could be the problem

MTU and Window size is something you would configure on the endpoints, not on the RAP or gateway. Window size is only for TCP.

If you see retransmissions, it's key to find out where traffic is lost between your client and the iPerf server. If you see retransmits, I'd think you have TCP traffic, which should auto-adjust the 'path-MTU' and Window sizes. So I'm a bit puzzled what it could be that RAP-Internet-GW-Internet has a better throughput than RAP-Internet-GW-LAN; doesn't make sense unless traffic is really different. For UDP traffic, it's known to have issues, but TCP flows should adjust automatically.

If you know better where the traffic is lost, you are close to the answer and a solution.

Can you capture traffic at the iPerf server and/or the client? I would check if there is fragmented traffic seen there; and otherwise if there is dropped traffic/retries etc.

MTU can be a challenge to find the right value, and should not be an issue for tcp traffic. Window sizes normally are set automatically, but in iPerf you can set it artificially.

Working with your partner or TAC Support may be easiest to get the data analyzed.

No actually I also tried to transfer a file from out Corporate file server to this remote device plugged into the RAP and it was ungodly slow and did not even transfer completely.  It errored out and stopped transferring completely.  It was also 20Mbits 

So as far as mtu or window size.  Where would I go to adjust either one of these?

So, if I summarize correctly:

Client is wired connected to a RAP; all traffic tunneled to a gateway at the corporate office.
From that client a speed test to the internet results in 100 Mbps.
From that same client an iPerf to a system at the corporate office only results in 20 Mbps.

First of all, iPerf and Speedtest are two very different technologies and comparing or thinking the outcome is the same, may be misleading.
Second, make sure that you compare Mbps with Mbps and MBps with MBps. The Mbps (mega bits per second) value is 8x higher than the MBps (mega bytes per second).
Also, for iPerf to fill a link with some latency, you may need to run parallel connections (add -P 8 to run 8 parallel streams). Increasing the window size may help as well, I think iPerf keeps that low by default intentionally.
And iPerf may use UDP, which may be fragmented in the path between client and server (and vice versa). Fragmentation results in significant performance loss. Because the IPSec tunnel between AP and controller/gateway adds some additional headers, you may exceed the path-mtu on the connection between the AP and controller/gateway.

You may also have a look at Librespeed, which is a kind of speedtest similar to the ones you find online, but can be installed locally in your network. That may provide a more like-for-like comparison.

I don't see a reason why you would have less through put to local destinations on your corporate network, versus to the internet when traffic flows through the same controller that is installed in your corporate network and has high-bandwidth connections internally.

So at my corporate office I have a 7210 VPN Gateway Controller.  All the RAP 505H will connect to this via public IP that NATs to the local controller over ip-sec port 4500.

When I am connected to ethernet port on the RAP and just do a regular speed test I get like over 100Mbs and I know it is going through the tunnel between rap and 7210 gateway because I did a traceroute.  Now when I just do an Iperf test to a local server at corporate office the bandwidth is only 20Mbs and it sucks.  What could be the problem