IPsec tunnel traffic slowness.

Traffic going through IPsec tunnel is experiencing slowness/latency.

Slowness/latency can be experienced on traffic going through an IPsec tunnel due to multiple reasons:
 

• ESP anti replay being constantly triggered for this SA (Security Association): 
  • Anti-replay is an IPSec security mechanism at a packet level which helps to avoid unwanted users from intercepting and modifying an ESP packet. It does this by adding a sequence number to the ESP encapsulation which is verified by the VPN peer so that packets are received within a correct sequence. This will cause issues if for any reason packets are not received in the order in which they were sent out (refer to KB29580 [juniper.net]).
  • To see the ESP anti replay window size for that specific SA use "show security ipsec security-associations index <IPsec SA index value> detail", to see the ESP replay errors use "show security ipsec statistics".
  • If this error is constantly increasing check why this may be happening and what other devices involved in the processing of this ESP traffic may be leading to this behavior
• High CPU utilization on the PFE:
  • High PFE utilization can lead to traffic performance issues not only for IPsec traffic but for all the traffic, check for any logs on /var/log/messages indicating high CPU on the PFE and see if these alarms are constantly triggered.
• Fragmentation:
  • Fragmentation in general can cause performance issues if it is constantly performed and can even lead to undesired CPU utilizations
  • In order to check for pre-fragmentation and post-fragmentation use the following command: "show security flow statistics", if this value is constantly increasing please check the size of the packets being sent through the tunnel, take the IPsec processing into account and check the MTU values of the physical egress interface and the MTU value of the st0 interface used for that specific SA
  • If the traffic being initiated behind the SRX is too big and that is causing fragmentation issues then the firewall t the other end may need to adjust the MSS size of the device at the other end (if this is TCP traffic).

If you already performed these checks consider troubleshooting at the other end of the tunnel and even in the middle as some drops may be happening on the path or the other end.

https://supportportal.juniper.net/s/article/SRX-Anti-replay-errors-on-VPN-tunnel?language=en_US