I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and MD5 Auth. After switching the Active Protocol to AH still in tunnel mode but now using SHA-256 for Authentication, I see a threefold increase in throughput across the VPN. I think the AH has a much lower overhead thanks to no encryption being performed on the packets. But isn't the data still being inherently encrypted since it is in tunnel mode?
The real question boils down to, "Is my data still secure in AH mode?" If so, this increased throughput is wonderful and I would like to keep my endpoint settings this way. If not, it's obviously not worth it and I need to revert to the previous ESP protocol.
Gateways are Zyxel Zywall USG 200s at sites ~3000 miles apart. Thanks in advance for your time.