How to Improve a Slow Cross-Border IPSec VPN When Headquarters Will Not Replace the Firewall?

Why cross-border IPSec is still slow after setup

The role of an IPSec VPN is to establish an encrypted tunnel between the two firewalls at the China branch and overseas headquarters to protect internal enterprise data from leaking. However, the encrypted tunnel itself only solves the security problem—it does not change which path packets take between the two locations.

If the existing IPSec tunnel travels over the public internet, the cross-border link may encounter congestion, packet loss, and latency fluctuations during operation. Such packet loss and latency fluctuations slow down data transmission inside the tunnel and, in severe cases, cause tunnel or application connection interruptions. On employee computers, this shows up as headquarters system pages failing to load, document saves suddenly freezing, or file transfers dropping halfway through.

Elevated ping latency or packet loss observed on a computer can serve as a supplementary indicator of an unstable cross-border link. However, ping probe packets are very small; on their own, they do not fully reflect the degree of lag in real applications, nor can they solely prove all fault causes. In actual environments, if the firewalls at both ends are overloaded with encryption processing, local office broadband has a fault, tunnel parameters are improperly configured, or the application servers at overseas headquarters respond slowly, employees will likewise feel that “the system is lagging.” You do not need to rule out every possibility on your own before reaching out for a consultation; by reviewing your basic live network setup together, we can help confirm whether the issue lies primarily in the cross-border transmission path or in other areas.

Improving performance without replacing the firewall: keep the existing tunnel and replace only the cross-border transmission channel

When lag is indeed caused by congestion and packet loss on the cross-border public internet, an enterprise does not need to replace the firewalls at either end or tear down and rebuild its global network architecture. Under suitable live network conditions, we can route the IPSec encrypted traffic that originally travelled over the public internet onto our cross-border transmission channel to the region where overseas headquarters is located, and then hand it off to the headquarters firewall.

This approach of keeping the existing tunnel while replacing only the middle cross-border transmission segment has three direct characteristics in terms of security and operation:

• Both ends remain the original encrypted firewall connection: The IPSec tunnel continues to be established and maintained by the two existing firewalls at the enterprise’s China site and overseas headquarters, keeping the original network architecture and connection relationship unchanged.
• Enterprise data is not decrypted in transit: Traffic entering the tunnel has already been encrypted by the enterprise firewall. Our transmission network only carries and forwards the encrypted packets; it does not decrypt enterprise data inside the original IPSec tunnel in transit, nor does it add any decryption node for that tunnel along the link.
• Carried as a complete encrypted tunnel: Precisely because the middle network does not unwrap the outer IPSec encryption, we carry the entire encrypted tunnel as a whole and do not identify or split out which specific application is running inside the tunnel. Therefore, while keeping the original encrypted tunnel intact, individual applications inside the tunnel are not scheduled separately.

Practical benefits of this approach for enterprises

For enterprises whose domestic branches lack a dedicated network team while needing to comply strictly with overseas headquarters policies, accelerating the network while keeping the existing IPSec tunnel offers several practical benefits:

• Continue leveraging existing firewall and broadband investments: Access is planned around your existing FortiGate, Palo Alto, or other firewalls and current network, eliminating the need to rebuild a separate network for China operations that is disconnected from headquarters, and reducing the burden of duplicate equipment purchases and major LAN overhauls.
• Faster provisioning over existing broadband: Connect to our cross-border channel using your enterprise’s existing public internet broadband without extra construction to install new physical lines, resulting in shorter provisioning lead times than traditional carrier dedicated lines.
• Scale bandwidth anytime as business grows: Bandwidth can be expanded on demand whenever needed, without waiting through the lengthy construction cycles of traditional network dedicated lines.
• Aligned with headquarters security management requirements: The encryption relationship between existing firewalls and headquarters security rules remains intact, allowing the China team and overseas IT team to coordinate using familiar technical methods. Within a multinational enterprise, whether adjusting the underlying transmission path requires change approval is still determined by the global headquarters security team under internal procedures; during consultation, we can help document the firewall configurations that remain unchanged, any local adjustments needed, and the rollback steps so headquarters can review and verify them easily.
• Clearer onboarding coordination and performance verification: Before onboarding, we clarify equipment, routing, and coordination arrangements with both sides based on actual site conditions, confirming cutover windows and rollback plans in advance to minimise impact on daily office work. After onboarding, there is no need to rely on obscure theoretical metrics—you can verify the improvement directly through real daily operations such as opening headquarters systems, saving orders, transferring files, and holding cross-border meetings.