Skip to main content
sysadm
sysadm
New Member
June 14, 2016
Question

Hardware for a 200 Mbps ipsec tunnel

  • June 14, 2016
  • 2 replies
  • 8265 views

Hi:

 

I wonder what kind of hardware would you recommend in order to support a 200 Mbps ipsec tunnel.

 

It will be a single tunnel between 2 metropolitan locations, FTTH links with 200 upload / 200 downoad capability, i have one of this links already, with less than 7 milliseconds of ping round trip side to side of the tunnel (same provider on both sides), on this link i already have two FG100Ds, with very low cpu usage, no utm, just vpn, and it ´s giving me 60 Mbps more or less in a ftp transfer.

 

So, my questions are:

 

1.-Is this 60 Mbps ftp transfer rate acceptable?, given the hardware and the latency?

 

2.-Are there any other factors missing?

 

3.-Will a fortigate 200 improve the transfer speed?

 

any toughs or recommendations?

 

Thanks in advance

 

Victor

 

 

    2 replies

    rwpatterson
    rwpatterson
    New Member
    June 15, 2016

    I would suggest using a program such as iperf which is basically a bandwidth capacity tool. There isn't much overhead as there may be with FTP. Also, try futzing with the encryption and compression on both sides. That may help as well. Thirdly, force your external ports to the speed your ISP is providing, if you haven't done that already.

     

    My two cents

    sysadm
    sysadmAuthor
    New Member
    June 15, 2016

    Thanks for you comments, i will try them, at this time i´m using 3DES-SHA1 DH5.

    Speed tests on normal internet traffic (not vpn), are showing 180 mbps

    Regards

    rwpatterson
    rwpatterson
    New Member
    June 15, 2016

    90% on an Internet speed test is pretty solid. I would be pleased with that. The other 10% is more than likely just overhead and congestion.

    sysadm
    sysadmAuthor
    New Member
    July 7, 2016

    Hi:

     

    Just want to update this post.

     

    I have conducted some tests on the mentioned scenario, i can confirm that FG100D can forward 200 mbps ipsec tunnel without problems, the test was conducted on a live working environment, here is the main data

     

    Internet links: 200 mbps simetric on both sides, on the same city

    Firewalls:   FG100D

    IPSEC: 3DES-SHA1 DH2 for phase1 and phase2

    Software used:   iperf3

    CPU on Diag Sys Top during test: 0U, 0N, 16S, 84I;

    iperf3 results:

    [ ID] Interval           Transfer     Bandwidth [  4]   0.00-1.01   sec  22.1 MBytes   183 Mbits/sec [  4]   1.01-2.01   sec  23.4 MBytes   196 Mbits/sec [  4]   2.01-3.01   sec  19.8 MBytes   166 Mbits/sec [  4]   3.01-4.01   sec  22.1 MBytes   186 Mbits/sec [  4]   4.01-5.01   sec  21.2 MBytes   179 Mbits/sec [  4]   5.01-6.01   sec  21.8 MBytes   183 Mbits/sec [  4]   6.01-7.00   sec  23.1 MBytes   194 Mbits/sec [  4]   7.00-8.00   sec  21.1 MBytes   177 Mbits/sec [  4]   8.00-9.00   sec  20.1 MBytes   169 Mbits/sec [  4]   9.00-10.02  sec  19.0 MBytes   157 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval           Transfer     Bandwidth [  4]   0.00-10.02  sec   214 MBytes   179 Mbits/sec                  sender [  4]   0.00-10.02  sec   214 MBytes   179 Mbits/sec                  receiver iperf Done.

     

     

     

    So we can conclude that this harwdare is enough, of course mileage may vary with the application, but that´s another story, thanks for the help and ideas!

     

     

     

     

     

     

     

     

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    July 8, 2016

    While having set up a testing environment...if you substitute AES for 3DES, will that reduce the CPU footprint? In theory, AES is less computationally intensive; but both 3DES and AES are usually offloaded to the NP ASIC, bypassing the CPU.

    This would be the one rare moment to gain insight...

    sysadm
    sysadmAuthor
    New Member
    July 13, 2016

    I agree...

     

    I´m going to do another tests in the next weeks, switching 3DES to AES, then we will know a little bit more, thanks for the comments

    Terms & ConditionsAccessibility statement