What’s the max throughput on a SpeedFusion VPN bond with the following configuration?:
256-bit AES encryption turned on.
2 x Peplink Balance 380 - 1 at each location.
4 x 100Mbit/sec WAN links from 2 different ISPs - (1 x 100Mbit/sec metro Ethernet + 1 x 100 Mbit/sec FIOS) at each location?
Drop in Mode configured for one WAN at each location.
We’re not getting anywhere near the performance limit of the 380 - i.e. 300 Mbit/sec. In fact, we get less than 100Mbit with SpeedFusion turned on.
With the SpeedFusion turned off, we get close to 100 Mbit/sec between the locations.
Yes, that’s the configuration.
Each WAN link has been independently tested with speedtest.com to perform at near wire speeds i.e. 95-103 Mbps through each Peplink at the endpoints.
Here’s the result of the synthetic test from SpeedFusion™ Throughput Test
The Balance 380 is rated for up to 60Mbps of SpeedFusion throughput, as indicated on the spec page of our website. If you turn off 256 AES encryption it will go higher of course.
Wow, I can’t believe I missed that information.
Was that info. just added to the feature listing?
So, it seems that I’ll have to be running a pair of Balance 710s to get anywhere close to the performance I’m looking for.
That’s $5K down the drain, and another $10K to get 160mbps.
Even with the 710, I’m not sure that I’ll get anything like the performance I’m looking for.
Without the VPN encryption, on a SpeedFusion VPN Bond, are the packets sent in the clear?
Aren’t they then subject to man-in-the-middle type attacks?
I’d like make this work with the existing equipment.
Since I’m using drop-in mode in both locations, is there any impact of this mode on the SpeedFusion VPN Bond?
What’s the SpeedFusion VPN Bond throughput when 256 AES encryption is turned off?
My firewalls have IPSEC tunneling throughput of up 500mbps, is there any impact of tunneling inside the SpeedFusion VPN Bond?
The info has been the same for at least two years, maybe you just assumed router throughput = SpeedFusion throughput?
If you just recently bought these directly from us we can arrange a trade-up to a higher model and you would just need to pay the difference, otherwise just contact your reseller.
With no encryption, the packets are sent in the clear but they could only sniff out half of the packets because the other half would be sent across the other WAN connection. They would need to sniff both lines at the same time and be able to re-assemble the packets back in their original order. Not impossible, but unlikely.
The drop-in mode has no effect on SpeedFusion performance.
SpeedFusion throughput with no 256 AES encryption on the Balance 380 is up to 120Mbps.
You can definitely run an IPSEC tunnel within the SpeedFusion tunnel.
Another thing we want to remember is that best performance is achieved when bonding connections of similar nature in terms of speed and latency.
WRT IPSEC tunnels/Drop In Mode etc interoperability with a SpeedFusion VPN Bond, I guess what I’m asking is that how can this work, since the endpoint of the tunnel is a single IP on one of the trunks that make up the SpeedFusion VPN Bond?
Example:
Device **A **behind a Balance 510 w/SpeedFusion VPN Bond of WAN trunks, each with IP addr **W **and **X **connecting to another Device **B **behind a remote Balance 510 w/SpeedFusion VPN Bond, each with IP addr **Y **and Z .
AFAIK, an IPSEC tunnel can only be established between say **W **and Y. What, if any advantage - does SpeedFusion offer in this case?
In my case, I also have another IPSEC tunnel established between **X **and **Z. **Again, any advantage of using SpeedFusion in this scenario?
When using drop-in mode, usually the firewall sitting behind the Peplink will terminate the IPsec tunnels and the advantage is that the tunnel will not break if one of the WAN connections fail.
So, to clarify - using my example above, a tunnel established between:
The primary WAN links in drop-in mode, i.e. Firewall **A **(IP address W[10.10.10.1]) and Firewall **B **(IP address Y[172.18.10.1]) will be re-established using IP address **X **[10.11.11.1]and IP address **Z **[172.11.11.1] (secondary, non drop-in mode NAT), if the primary WAN links with IP address W and Y fail . This is because the firewalls will think the WAN links are still up, as the packets are now getting routed over the secondary or tertiary WAN links on the Peplinks.
This would seem to work without Speedfusion - right?
Illustration:
Firewall A[10.10.10.1]<->Peplink A.WAN1<—IPSEC TUNNEL—>WAN1.Peplink B<->[172.18.10.1]Firewall B
Upon failure of either or both WAN1 links. Firewall A[10.10.10.1]<->Peplink A.WAN2[10.11.11.1]<—IPSEC TUNNEL—>[172.11.11.1]WAN2.Peplink B<->[172.18.10.1]Firewall B
SpeedFusion is definitely needed if you want to create the “Unbreakable” VPN. If using IPsec only, the tunnel would definitely break upon the failure of the individual WAN connection it is established with. You would then have downtime while the new IPsec tunnel gets established with the new IP address.
SpeedFusion uses all WAN links simultaneously to create one virtual tunnel, so there is no need to re-establish the VPN in the event of a single WAN failure. It simply will never break unless all WANs fail at the exact same time.
This is why SpeedFusion is so much better than IPsec, plus it is dead simple to configure. Customers can also enjoy increased throughput in the tunnel because of bandwidth bonding, which you would never see using IPsec alone.
In drop-in mode, i.e. where there’s another Firewall inline, how can traffic be passed from a network behind the firewall to a remote network behind another firewall that’s also using drop-in mode?
Say I want to pass traffic from 192.168.0.0/24 to 192.168.1.0/24. using drop-in mode, I configure an IPSEC tunnel between the firewalls that these addresses sit behind.
There’s no routing necessary, the firewalls detect, encrypt and pass the traffic between them based on the source and destination addresses.
Are you saying that Speedfusion makes it unnecessary to create this IPSEC tunnel?
I found that I can’t pass traffic between the networks without the IPSEC tunnel between the firewalls.
Again, I’m specifically talking about drop-in mode.
Here are the options for routing an IPsec VPN through the Peplinks:
Send the IPsec VPN through a SpeedFusion VPN. This can use both WANs on each side simultaneously, and if a WAN link goes down - the IPsec VPN remains established because SpeedFusion is essentially an “unbreakable VPN”. You can disable encryption with SpeedFusion; however there is still the bonded VPN throughput rating of the router to consider.
If SpeedFusion is not used, you can lock IPsec traffic down to the drop-in mode WAN under Network> Service Passthrough> IPsec NAT-T, and check “Route IPsec Site-to-Site VPN”. This does not allow for failover. If you want to include WAN2 for failover, service passthrough support for IPsec NAT-T must be disabled and UDP 500 needs to be forwarded to your firewall. An outbound policy rule using the priority algorithm will determine which WAN is the primary. With this method, if you lose WAN1 the IPsec VPN will go down and have to be re-established. Sessions will be lost so they will also have to be re-established.
Using SpeedFusion, your firewall simply needs to have a Nat exclusion policy described below:
When Source = 192.168.0.0/24
And Destination = 192.168.1.0/24
Don’t NAT
The Balance needs a static route for the 192.168.0.0 network pointing to the firewall under: Network> LAN> Static Route Settings. Once that is done you will see the private IP addresses under Status> Client List.
Thanks for the info.
I’ll give that configuration a try.
To clarify, the Balance needs only a single static route for 192.168.0.0 and not one for 192.168.1.0?
How does the Balance sitting in front of 192.168.0.0/24 know where 192.168.1.0/24 is? Or, is that done on the firewall?
And how does the Balance know how to send the packets from 192.168.0.0/24 to 192.168.1.0/24 and vice-versa.
Does it advertise the routes? I guess I’m asking how to make sure that these non-routable IPs are kept inside the SpeedFusion VPN.
Each Balance needs a static route pointing to the firewall for its local network. The Balance will advertise the local network through SpeedFusion and know how to route to the private network on the other side.