topic Re: IPSEC compression in Spark Firewall (SMB)

IPSEC compression

Stephan_Kremer — Fri, 16 Nov 2018 15:22:22 GMT

Hi,

I established a site-to-site VPN between a 600 appliance and an old UTM-1 edge. Both devices support IPSEC compression related to their datasheets, but the tunnel is established without.

I find no options at all to check this. Any help is welcome.

Best regards,

Stephan

Re: IPSEC compression

PhoneBoy — Fri, 16 Nov 2018 17:18:38 GMT

Here's where you set it on the 600 Series:

I don't believe there is a specific setting on the UTM-1 EDGE appliance to enable it, but the way I understand it, if the other side is configured to support it, the UTM-1 EDGE will use it.

Re: IPSEC compression

Stephan_Kremer — Fri, 16 Nov 2018 18:03:06 GMT

I found that advanced setting, but it does not change the behaviour. Still no compression with the tunnel...

Re: IPSEC compression

PhoneBoy — Fri, 16 Nov 2018 18:34:32 GMT

It looks like it's a setting for VPN clients (i.e. what Remote Access means), not site-to-site VPN.

I know with centrally managed SMB appliances, you can configure IP Compression in the VPN Community.

There does not appear to be a way to enable this option for local management.

Re: IPSEC compression

Stephan_Kremer — Fri, 16 Nov 2018 18:45:19 GMT

Okay, thanks a lot for your answers. Not a big issue for me, I just wanted to make sure that I don‘t overlook the place of configuration.

Re: IPSEC compression

HristoGrigorov — Fri, 16 Nov 2018 19:07:42 GMT

Compression should really only be enabled for slow connections (e.g. Remote Access). On high speed site-to-site VPNs it will more likely cause performance issues, especially on SMB.