| Solution | - A test is conducted in lab with Fortigate 60F device with the following topology:
Local_LAN ==== FGT60F ==== MPLS/P2P or IPSec VPN ==== Remote-FW ==== Remote_LAN - In this test, a large file (~ 5GB) is transferring between Local_LAN and Remote_LAN, over either MPLS/P2P or IPSec VPN tunnel. The speed is measured and calculated by the iPerf application and SMB protocol. The average speed of the IPSec VPN tunnel is slower than that of MPLS/P2P, significantly. Besides, if npu-offload is disabled in the VPN setting (which means that the traffic was not offloaded by NPU), the speed is even worse.
| | iPerf (MB/s) | SMB (MB/s) | | MPLS / P2P | 94.8 | 90.5 | | IPSec VPN (enable npu-offload) | 56 | 55.57 | | IPSec VPN (disable npu-offload) | 22.84 | 18.7 | - In the real world, the user should also consider the type of Internet line (which is used for the IPSec tunnel); because if it is PPPoE type, it will not support the NPU offload and reduce the IPSec tunnel's performance. The solution is either (1) to switch to an Internet leased-line for a VPN connection or (2) to work with the ISP to change the ISP modem/router's working mode.
|
