Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently have a Draytek Vigor 3200 Multi-Wan router which has 5 incoming VPN tunnels using IPSec AES encrypted configurations. All five sites are using Draytek Vigor routers, most are Vigor 2800's.

The bandwidth at the main site (Vigor 3200) is 70Mbps down and around 30Mbps up with a backup link of 10Mbps symmetrical. Each of the remote sites have between 5Mbps and 20Mbps connections.

The Draytek routers don't seem to be able to report CPU usage using the web interface, telnet nor SNMP. I am concerned that the encryption/decryption of the AES tunnels will overload the router and cause less desirable performance.

I originally configured the router whilst running IPerf over one single VPN tunnel. I tweaked the settings to get maximum throughput via the VPN tunnel and then duplicated those settings for each site that was added thereafter.

What is the best way of ensuring I'm not stressing the router too far? I have MRTG running locally to graph the uplinks of each router but they don't seem to show the VPN tunnel via SNMP - just the main WAN/LAN links.

I'm looking for advice on any calculations and/or ways of monitoring this kind of thing.

share|improve this question

Using off hours (assuming they exist or a maintenance window) bench mark it by sending as much traffic as you can over the links until performance degrades. This will give you an idea as to how much traffic is too much. You can then use these benchmarks as warning indicators for future performance.

share|improve this answer
A problem with this could be not accounting for little packets vs big packets, since the overhead is in the encryption calculations. – mfinni Feb 19 '13 at 15:41
We don't have downtime as such. Also, the only time that may constitue as downtime is when we run all of our offsite backup jobs. If I can identify an hour thats quiet (using the monitoring graphs) I could transfer a large file from the main site to each branch site over the VPN tunnels. However, I'm not sure if this mimics actual use cases well enough. – dannymcc Feb 19 '13 at 23:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.