OpenConnect is very slow

petro2033 · 2020-06-10 10:47:19

I'm using openconnect as an alternative for Cisco AnyConnect, but there is a problem.The connection is very slow, ping is ok, but it seems there is a delay before every request. I've installed openconnect via yaourt and use it like this

sudo openconnect ip_address_here

I've found information that we need to create a tunnel like this

sudo openvpn —mktun —dev tun1

but not sure that's the reason. Maybe there is a kinda config...?

heywoodlh · 2020-06-17 02:48:32

The lack of information makes suggesting any ideas a bit like in shooting in the dark, but here are some questions that might provide some useful information:

1. Have you ruled out that it's not an issue with the Cisco ASA that is providing the connection?

2. Are you in a full tunnel or split tunnel group?

3. What kind of speeds are you looking at before you connect vs after? A simple speedtest before and after may provide some helpful insight.

I've used openconnect (just from the official repositories) on my corporate network and never saw an issue with speed.

heywoodlh · 2020-06-17 02:52:55

Also, AnyConnect does have a Linux client available if you'd rather just use AnyConnect directly. You would have to get the Linux client using your (or your company's) Cisco account.

Abaddon · 2020-06-23 12:47:08

petro2033 wrote:

I've found information that we need to create a tunnel like this
sudo openvpn —mktun —dev tun1
but not sure that's the reason. Maybe there is a kinda config...?

This is not needed. Openconnect will create tun interface automatically.

Delay before every request sounds little bit like bad DNS configuration. Take a look and check if it was properly applied.

jonnyeom · 2020-09-23 19:20:03

I am also running into the same latency when connecting to a Cisco AnyConnect VPN.

It may be related to version 8+, testing with some teammates.

Im trying to get more verbose debugging info, not sure where to start with this.

Zod · 2020-09-23 20:07:32

Find a ping target on the opposite end of the tunnel (preferably not the Cisco ASA).

It could be an IP address or a hostname (if you have name resolution).

$ ping -s 1500 -M do <target>

The ping needs to go through the tunnel, you can use traceroute to verify.

Post the results.

Edit: to add the switch that does the majik..duh.

Last edited by Zod (2020-09-24 15:11:47)

Arch Linux

#1 2020-06-10 10:47:19

OpenConnect is very slow

#2 2020-06-17 02:48:32

Re: OpenConnect is very slow

#3 2020-06-17 02:52:55

Re: OpenConnect is very slow

#4 2020-06-23 12:47:08

Re: OpenConnect is very slow

#5 2020-09-23 19:20:03

Re: OpenConnect is very slow

#6 2020-09-23 20:07:32

Re: OpenConnect is very slow

Board footer