What's packet size your testing with? IpSEC can't handle 1500 bytes mtu, and fragmenting packets needs additional CPU.
On live link setting MTU on VTI interface and/or mss-clamp might avoid fragmentation.
What's packet size your testing with? IpSEC can't handle 1500 bytes mtu, and fragmenting packets needs additional CPU.
On live link setting MTU on VTI interface and/or mss-clamp might avoid fragmentation.