Odd Performance Issue

Question

We have a FortiWiFi serving about 8 users running FortiOS 6.04. The bandwidth at the location is fast: 300/20. The firewall is set to Proxy. We noticed on about 4 different occasions that when trying to download a file from a remote server (connected via WAN1) that the download would take an exceptional long time or would fail. This occurred on multiple computer on the network, different browsers, different source servers, over a number of days. This happened even when no other activity was taking place on the network at the time.

We finally did some testing. We noticed that when downloading with AV and Web Filter security profiles Off in the IPv4 Policy that the download speed was about 18 Mb/s. With either AV and Web Filter security profiles On in the IPv4 Policy the download speed was initially 1 Mb/s. After about a minute though the speed would fall from 1 Mb/s all the way down to 5 Kb/s.

We further isolated the performance impact to the HTTP inspection in the AV Profile. Concerning the Web Filter, it did not matter how much or how many filters were turned on to create the very low download speed problem.

Support recommended setting the AV and Web Filter Profiles to Flow inspection. Doing this increased the download speed to 7 Mb/s. This is still less than 1/2 of the speed without AV or Web Protection running. I would prefer instead to use Proxy inspection but it appears to slow the download down excessively.

Have others encountered this issue? Is this normal for a FortiWiFi 60D? Any suggestions?

rwpatterson · Accepted Answer

I would start with the basics. Does the duplex match on the interface with your ISP? A duplex mismatch would severely hamper your speeds in both directions. from the CLI (I'm doing this from memory, so please don't hang me if it's not quite right):

FGT# diag hard dev nic wanx (replace with your WAN port)

Check for errors in the output. Also you will see what speeds your are connected at. Half duplex would be a major problem here.

IMPORTANT NOTE: Don't do this from the remote side. You may lock yourself out if the duplex modes don't sync up. You'll then be in a rush to get back to the office to correct it!

SecurityPlus · Answer

Does anyone have any feedback concerning what the download speed typically is with a 60D if the internet connection is 20 Mb/s? I know that with AV and Web Protection that it will be less, just not sure how much less is normal.

Sign up

Login with SSO

Login to the community

Login with SSO