Technical Tip: Low data transfer rate between FortiGate and FortiAP due to dtls-policy

Description

This article describes a scenario in which a speed test shows slow data transfer between a FortiGate and a FortiAP Model 421E due to the DTLS policy configuration in the AP profile.

Scope

FortiGate v7.6.x.

Solution

A speed test from FortiGate to the wireless client connected to FortiAP model 421E could result in a transfer rate of around 40 Mbps when the SSID is in tunnel mode.

In this example, the wireless client's connection settings show good signal strength.

A traffic test from FortiGate shows results of around 40 Mbits.

diagnose traffictest run -c 10.60.70.2
Connecting to host 10.60.70.2, port 5201
[  9] local 10.60.70.1 port 23876 connected to 10.60.70.2 port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  9]   0.00-1.00   sec  5.78 MBytes  48.5 Mbits/sec   24    103 KBytes
[  9]   1.00-2.00   sec  5.55 MBytes  46.6 Mbits/sec    3    104 KBytes
[  9]   2.00-3.00   sec  5.61 MBytes  47.1 Mbits/sec   11   72.2 KBytes
[  9]   3.00-4.00   sec  5.57 MBytes  46.7 Mbits/sec    0    115 KBytes
[  9]   4.00-5.00   sec  5.43 MBytes  45.5 Mbits/sec   15   81.3 KBytes
[  9]   5.00-6.00   sec  5.63 MBytes  47.2 Mbits/sec   15   83.9 KBytes
[  9]   6.00-7.00   sec  5.73 MBytes  48.1 Mbits/sec    0    123 KBytes
[  9]   7.00-8.00   sec  5.80 MBytes  48.6 Mbits/sec    7   89.0 KBytes
[  9]   8.00-9.00   sec  5.56 MBytes  46.6 Mbits/sec    4    104 KBytes
[  9]   9.00-10.00  sec  5.67 MBytes  47.6 Mbits/sec    3   85.1 KBytes

To diagnose the issue, verify the configuration in the dtls-policy in the AP profile, in case it is configured as dtls-policy dtls-enable.

The admin can try to change the dtls-policy to cleartext in the AP Profile assigned to FortiAP to get the maximum bandwidth.

config wireless-controller wtp-profile
    edit "FAP421E-default"
        config platform
            set type 421E
        end
        set dtls-policy clear-text
    end
end

If the connection between the FortiGate and the FortiAP must be encrypted due to compliance or other reasons, and the full bandwidth is required, 'ipsec-vpn' can be used as the dtls-policy instead if on the correct version.

In versions below v8.0.0, IPsec will have the same speed restrictions as DTLS.

In v8.0.0, offloading support was added for FortiAPs using IPsec, so bandwidths comparable to plaintext can be achieved while still encrypting the traffic in transit:
Support IPsec traffic offloading from the FortiAP