@flyboy50 I don't have any good suggestions for VPN services in Canada as I don't use a VPN (I probably should) . I'd be hesitant to buy a router from any specific service unless you absolutely had the ability to load it with something else such as PfSense, and that router had AES-NI support. Fwiw, the next PfSense version will require AES-NI support. My guess is that it won't load unless AES-NI support is present.
The Asus RT-AC88U, RT-AC3100, RT-AC5300 and RT-AC86U has IPSEC support when loaded with Merlin's Asuswrt. As far as I know, only the RT-AC86U has AES-NI support which results in much faster IPSEC throughput rates. You would have to look around to see what else might run AES-NI with IPSEC support.
Fwiw, QOS is an issue with Asus router. Seems this goes back a long ways. I don't use QOS so I haven't kept up with its current status.
For a VPN recommendation, you could post a question in the Canadian Broadband forum of the DSLReports site:
https://www.dslreports.com/forums/23
Here is one small thread from that forum.
https://www.dslreports.com/forum/r32003437-Do-you-trust-your-VPN-provider
Have a look at the following thread:
Here's a page from the smallnetbuilder site with a few interesting comments regarding VPN capability:
https://www.snbforums.com/threads/advice-needed-new-asus-router.47748/page-2
There is a better thread regarding the RT-AC86U and VPN support, just have to find it somewhere.
Good morning @EricMc!
Welcome to our Community!
VPNs are very important to many of our customers, so please update us once the tech has come to replace your modem and let us know if that resolves it.
Regards,
RogersCorey
@EricMc usually when tech support can't push a firmware upload to the modem, that's an indication of an external cable and / or connector fault. Do not let the tech leave without him or her checking the cable signal levels, which can be done via the techs wireless tablet or laptop. That connects to the Rogers system, allowing the tech to look at the signal levels without connecting directly to the modem or its RG-6 cable.
Personal opinion, the first thing that should be done is to check the signal levels, take whatever corrective action is required, then consider swapping the modem.
Actually low IPSEC data rates with Intel Puma modems, which includes the Puma 5, 6 and 7, are a known issue. There is an upcoming update which will hopefully resolve the low data rates. Won't know until that's released and users have a chance to test it. So, swapping the modem will not do anything to increase the IPSEC data rates.
The black Hitron modems are Puma 6 modems, the white Hitron modem is a Puma 7 modem.
This problem probably dates back to 2008 when Intel bought the Puma modem line from Texas Instruments and dropped in an Arm and Atom processor into the design. Either the IPSEC limitation was in the original Puma 5 modem that Texas Instruments built, and that limitation was dragged 10 years into the future, or, the limitation was caused by the chipset design changes that Intel introduced.
Other users who require IPSEC data transfer have simply left Rogers and gone elsewhere, where IPSEC isn't an issue.
Edit: You should find that you're limited to 25 Mb/s over an IPSEC VPN, which is an Intel Puma 5/6/7 modem limitation. If you were running the new Ignite TV service, with a Technicolour XB6 modem instead of the Arris XB6 modem you might see higher IPSEC data rates. The Technicolour XB6 is a Broadcom BCM-3390 modem, the Arris XB6 is an Intel Puma 7 modem. Now having said that, when someone with a Technicolour XB6 manages to really test IPSEC VPNS, we'll find out if there are any additional network issues lurking about as well, and that possibly this isn't just a modem issue. I haven't seen anyone with the Technicolour XB6 post any IPSEC results, but, one of these days it will happen. I'm looking forward to those results, whenever they show up.
Have a look at my additional "Edit" above. There is an update in the works, just not sure if its going to be included in the next one or two updates. I'll inquire about any progress on this.
First thing that comes to mind is a cable issue. Its possible that the problem is beyond your cable system, somewhere between the local tap, which you are connected to, and the neighbourhood node. As I indicated above, the first item that comes to mind when tech support can't push an update is a cable issue. Since your cabling was replaced very recently, I would suspect some issue further upstream, in which case tech support should have dispatched a senior tech, not a contractor tech.
Then there is always the possibility of some configuration change witin the Cable Modem Termination System (CMTS). Your modem connects to the CMTS via the neighbourhood node. Any configuration change, accidental or deliberate can result in issues for users.
Are you running IPV6 by any chance, and if so, does your transfer target use IPV4 or IPV6? If you're running IPV6, I wouldn't be surprised if there was a configuration change with the CMTS which is causing IPV6 problems for users connected to that particular CMTS.
You should be able to log into the modem using 192.168.0.1 or 192.168.100.1 if the modem is in Gateway mode, or by using 102.168.100.1 if the modem is in Bridge mode with a router behind it. You can log into the modem thru the router.
If you can log into the modem and its running in Gateway mode, you will see two WAN addresses in the upper right hand data block on the Status page. That page is displayed automatically when you log into the modem. The upper right hand corner is the WAN address block and it will show both IPV4 and IPV6 addresses if the modem is running IPV6.
Are you on a business plan? Just wondering why the static IPs would prevent the user from logging into the modem?
Alternatives are to go with a fibre provider, if one is available in the building, or with a TPIA, which will only be able to give you reduced overall data rates as neither Rogers, Bell or other large providers will allow TPIAs to run high speed services. The gain out of this situation is that you wouldn't necessarily be using a Puma 6 modem. A fibre provider will supply a totally different modem, for a TPIA you would just have to be careful and avoid any Puma 6 modems they might offer.
40 Mb/s thru the IPSEC VPN? Is that correct?
The only people who are in the know concerning the Puma modem IPSEC VPN performance are the engineering staff and a few people on this forum. Tech support and the field techs won't know anything about this.
That's not terribly shabby, 100 down 40 up thru the IPSEC VPN. I'm actually impressed with that upload speed thru the 4582 modem. Higher than what I would have expected. Is the Azure ingress point nearby, or is that at some distant point, just curious.
Sounds like there isn't much choice in your building. Ugh....
Looks like Teksavvy might be "up to 250 Mbps Down / 20 Mbps Up", half the rate of your current upload. You would have to check with Teksavvy's site to see if the upload rate is the same for your location. The only modems that would be suitable would be the SmartRG SR808ac or TP-Link TC7650. I think Teksavvy has a request in with Rogers to test and approve a Broadcom BCM-3390 based modem.
https://help.teksavvy.com/hc/en-us/articles/200315110-Approved-Cable-Modems-Rogers-Network-Ontario-
You would want to avoid the Hitron and Cisco modems and the Technicolor DPC3848V
as they are all Puma 6 modems. Technicolour took over Cisco's modem line from what I remember.
- last edited on by
RogersTony
VPN data shouldnt be throttled.. that being said i have never got full speeds on mine.. BUT there is a lot of things into that as to possibly why as well.
Just to make sure, your router is connecting to a VPN itself? So then all traffic through the router, is then VPNd, etc?
The questions I have, are what and where is the VPN connecting to? What address, and where is that located?
As that can make all the difference in the world as well.
For example, without it.. do a speed test to one of the closer test points to yourself.. then start choosing ones farther away. The results will drop, as the distance can make quite a difference.
If the VPN endpoint that your connecting to is further away.. could make a difference.
That being said.. could be some routing stuff too. The route to that VPN location, could be taking a different, less efficient route than say bell has?
Thoughts @Datalink
All of the above plus:
1. What protocol is the VPN using, UDP or TCP/IP?
2. What VPN is it (for future reference purposes)
3. Please confirm that you have the white Hitron CODA-4582. I thought that the modem was only being used for 500 Mb/s service and above these days, unless you were assigned the modem when the requirement was an unlimited plan, no matter what data rate was being used.
Just to note, the Intel Puma chipset has issues with certain protocols. Much of this dates back to the previous black Hitron CGN3xxxx (Intel Puma 6) models, and most likely predates that, back to the original Texas Instruments Puma 5 chipset (2008). Intel bought the Puma modem line from Texas Instruments in 2010. From the Rogers firmware update list comes the following note at the bottom of the post:
- Non TCP/UDP/ICMP traffic (such as ESP/IPSec without NAT-T) is slowed down below 25 Mbps
So, Encapsulating Security Payloads, more specifically IPSEC has been seen to run slow on the previous CGN3xxx modems. That hasn't been so much of an issue with the CODA-4582, most likely due to the lack of users with the 4582 who are actually attempting to run a VPN. There is a fix slated for release at some point which will address the ESP/IPSEC issue, but, I don't know when that will be release. I'd hope to see it in the next release but, who knows? The additional question here is, are there firmware problems with any other VPN protocols? It would be nice to see a list published by Intel that would provide that, but, that's dreaming in technicolor. Intel will never publish a list that provides those details, so, the end customer continues to suffer with poor VPN performance.
In addition to checking other ingress points with your VPN company, look at the protocol that happens to be in use and look at the encryption level as well. If you have a choice of protocols, select the other protocols for test purposes to see if that makes a positive change. If you can drop the encryption level and still meet your security goals, that might result in a higher data rate.
My personal thoughts are that the original firmware design in 2008 limited the VPN data rates for some reason that was determined by a firmware engineer at that point in time. Those limitations were probably carried forward into Intel's version of the modem which were the follow-up Puma 6 CGN3xxxx and then the Puma 7 4582 and others. Don't know why Intel hasn't picked up on the growing trend of VPN use, which has been on the uptick now for several years, and addressed the issue for all protocols used by VPNs. Faster processors used in the Puma 7 line does somewhat address this, but, the firmware limitations, if that is the problem, also have to be addressed. That's not a case of throttling, but, simply a default data rate that may have been selected a very long time ago for use by certain protocols, or, in the event that the modem ran into a protocol that wasn't on its list of "if you see this protocol, then use this data rate xxx Mb/s". That default data rate might have made sense in 2008, but, it doesn't make sense anymore, given the processing capability that is available for VPN use these days.
Out of curiosity, what router do you currently have, and, does it have hardware support for Intel's AES-NI, which is used for encryption.
Please let us know what you find.
Edit: what are your normal (non-VPN) data rates like? Are you getting 150 Mb/s down / 15 Mb/s up?
-
20297 views
-
13 Likes
-
-
