Expected Bandwidth through IPSec VPN

ORIGINAL: UkWizard Not sure this makes sense, could you please elaborate? do you mean if you copy data from site to site without going via the ipsec tunnel, its 10 times more bandwidth? not sure how you can compare the two easily.

I' ll try to make my question a little clearer -- Simple comparison tests were carried out initially: 1) We transferred a file of approx 1.2Gbyte using FTP through the VPN tunnel. The FTP program reported that the file was transferred at 380 kbits/s. 2) The same file was then transferred with the same FTP program between the same two end machines but not via the VPN. To do the comparisons I set up a policy which used NAT on the remote firewall in order to by-pass the VPN tunnel. This time the FTP program reported that the file had transferred at 3.42Mbits/s. So this indicates to me that transferring data through the VPN is considerably slower and appears to offer only 11% throughput compared to transfers external to the VPN. This test was repeated a number of times and the average was closer to 10% of the throughput available without using VPN. We also used a bandwidth measuring tool " iperf" which indicates the same difference between VPN and non-VPN traffic Reading the specification for the firewall as suggested by Abel in another reply: http://www.fortinet.com/doc/FGT200_800DS.pdf This PDF shows that the FGT800 has a firewall throughput of 1Gbit/s and IPSEC VPN (168-Bit Triple DES) throughput of 200Mbit/s. So if I interpret this to read that the VPN throughput is expected to be 20% or possibly less compared to firewall throughput (or the maximum bandwidth between the two firewalls?) then I suppose the throughput we have measured of around 10% is only half of what we might have been lead to expect. i.e. if the maximum bandwidth available between the two firewalls is around 4Mbit/s then we may not expect to achieve better than 800kbit/s through the VPN tunnel. Maybe other firewalls offer better thoughput on VPN. The specifications for the FGT200A for instance appears to show VPN throughput near to 50% of firewall throughput with figures of 70Mbps and 150Mbps respectively. I suppose it all depends on how we interpret published figures. My original question should have been-- Has anyone else compared traffic through an IPSec VPN tunnel with a direct connection and have they seen similar differences in throughput? I suspect now that anyone answering YES to the first part of this question will also answer YES to the second part. Some general points to note: a) The Fortigates at each end of the link are connected to routers which have 100Mbit/s full duplex interfaces. Hence neither connects at 1Gbit. b) The link between the two Fortigates has 11 router hops including the the two routers mentioned in a) above. This may indicate why our maximum achievable available bandwidth is around 4Mbit/s. We are addressing improved available maximum bandwidth between the two sites as a separate issue.

ORIGINAL: abelio

Is this what I should expect?

I don' t think so

or is there a fix or a way of ' tuning' the circuit or VPN to improve things?

you have the option of ' traffic shape' vpn firewall policy

Other firewall manufacturers publish figures for expected throughput on IPSec VPN circuits but Fortinet do not appear to do so.

You have that info in each product pdf datasheet from fortinet' s site http://www.fortinet.com/products/enterprise.html in your case

Abel Thanks for the info. I just need to sit down and try to interpret the information in the PDF file correctly. Tom.

I' ll try to answer your questions below:

ORIGINAL: UkWizard Are you saying you have a 100Mb connection between the sites then? take the paper spec' s with a pinch of salt, as this max throughput ratings are when EVERYTHING ELSE is turned off, ie IPS/AV/AUTH ETC. When you done the tests, did you insure that AV was turned off, and that you are not getting Mb (bits) and MB (Bytes) mixed up?

I wish we did have 100Mbit/s between sites. Since we do not have a dedicated link end to end we are constrained by the weakest link in circuit path between the two sites. At the remote site all interfaces including that to the external router are 100Mbit full duplex. The external router belongs to a service provider and we have no knowledge of what happens i.e. what inteface speeds exist beyond that point. Traceroute output shows that average response times start to exceed 10mS after the 6th hop with avaerage response time for the remote router being around 18mS. As I said we are talking to the provider about how we can improve end to end overall bandwidth. However even if we had a 100Mbit/s dedicated circuit I would like to know what VPN throughput we could expect to achieve. Will it always be around 10% of the circuit bandwidth? All IPS and AV etc are turned off on bothe firewalls. I don' t think I' m mixing my bits with my bytes just reporting the results I get. Below is a typical output from the " iperf" program. Note this is cut and paste from the program output. Details of " iperf" are available at the following URL: http://dast.nlanr.net/Projects/Iperf/ Sample output from the bandwidth measuring tool " iperf" is shown below. Sample 1 shows the iperf results when traffic goes directly out to the internet from the firewall via a NAT policy. Sample 2 shows iperf results when traffic goes via the IPSec VPN tunnel. Sample 1 ======== C:\iperf>iperf -c 129.234.2.39 ------------------------------------------------------------ Client connecting to 129.234.2.39, TCP port 5001 TCP window size: 8.00 KByte (default) ------------------------------------------------------------ [1916] local 193.60.196.1 port 4049 connected with 129.234.2.39 port 5001 [ ID] Interval Transfer Bandwidth [1916] 0.0-10.0 sec 4.09 MBytes 3.42 Mbits/sec Sample 2 ======== C:\iperf>iperf -c 129.234.2.39 ------------------------------------------------------------ Client connecting to 129.234.2.39, TCP port 5001 TCP window size: 8.00 KByte (default) ------------------------------------------------------------ [1916] local 193.60.196.1 port 4058 connected with 129.234.2.39 port 5001 [ ID] Interval Transfer Bandwidth [1916] 0.0-12.0 sec 672 KBytes 459 Kbits/sec Thanks for your questions. They help me to think through the problem to see if there is anything I have missed. Best regards Tom