Troubleshooting Tip: How to troubleshoot FortiSASE On-ramp Slowness issues

In some cases, slowness may be observed when traffic is routed through the FortiSASE on-ramp. To accurately identify the root cause, the required logs must be collected to confirm whether the slowness is related to FortiSASE or to the Internet link itself. A comparison between traffic routed directly to the Internet and traffic routed through the on-ramp is required by following the steps below.

The steps must be performed twice:

• Once while routing traffic through the on-ramp.
• Once while connecting directly to the Internet (bypassing the on-ramp).

Steps:

1. Configure a clean policy on both FortiGate and FortiSASE with no inspection enabled and all UTM profiles disabled. Traffic must match this policy.
2. From the client machine, run traceroute and a continuous ping toward the iPerf server IP in the POP where the on-ramp is connected. (Refer to the note at the end for details on obtaining this IP.)
3. Perform a speed test on speedtest.net and select the server location matching the on-ramp location (for example, when connected to the Germany on-ramp, select a Germany server). Screenshots of the results must be shared.
4. Test download and upload speeds using iPerf by following the steps in Technical Tip: Proper Bandwidth test with FortiSASE SIA VPN.

After collecting the information above, if it was observed that slowness is only through FortiSASE on-ramp, open a Fortinet Technical support ticket and share the information above to the ticket.

Note: To obtain the iPerf server IP, access FortiSASE network tools. Under Server Location, select the same location as the connected on-ramp. Record the IP address displayed for the selected server and use it in the steps above.