Skip to main content
mark14
mark14
New Member
May 17, 2019
Question

Poor bandwidth to S2S Ipsec Azure

  • May 17, 2019
  • 1 reply
  • 8177 views

Hello,

 

I get really strange problem with my Azure tunnel on Fortigate 60E (FortiOS 5.6.8). I have configured tunnel according to this article:

https://cookbook.fortinet...pn-microsoft-azure-54/

 

I have set up tcp-mss sender and receiver for 1350. Tunnel is stable but performance from LAN Fortigate is very poor.

 

I performed iperf3 test and result is 3-5Mbit/s. Our ISP provide us 100/100Mbit/s.

 

The weirdest thing is when I beeing connected to fortigate in LAN, and set UP SSL-VPN connection (FortiClient SSL-VPN on the same Fortigate) so technically traffic go through ssl-vpn tunnel but all communication is closed to these Fortigate I get 30-35Mbit/s performance result. What I tried:

 

1) Set up new Azure tunnel - the same result

2) Delete tcp-mss sender/receiver function from IPv4 policies to Azure - same result

 

Someone got these problem? It looks like there is something wrong in LAN interface. MTU? 

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    May 17, 2019

    For a bandwith issue over IPsec vpn, there are many things you need to eliminate one-by-on. 

    As a start I would suggest one thing to test: adjust mtu size on the physical interface on the FGT that  this tunnel is going out of. I don't know if it's possible on Azure side, but try the same on that side as well. The tcp-mss adjustment works only TCP traffic. You might be doing only TCP test with iPerf so each packet should be much shorter than the minimum mtu on the path. But since you said SSL VPN (TCP) was performing much better, I'm suspecting it might be related to UDP/ESP (IPsec) traffic over the internet. Or at least you can eliminate that factor.

    mark14
    mark14Author
    New Member
    May 17, 2019
    What do you mean adjust mtu on interface that tunel is going out of? wan interface (that ipsec tunnel is connected with azure) or for example internal2 physical interface that I was performed test to virtual machine behind azure? Can you suggest changes for testing? What exactly mtu should I set on interface? As I said while using the same network on FG but connecting to azure machine through ssl vpn tunnel (forticlient split tunneling to azure subnet) performance is 10x better.
    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    May 17, 2019

    The outgoing wan interface mtu to let the FGT to fragment in case the packet sides are bigger than the mtu. The opposite direction is dectated by Azure side mtu setting. LAN side mtu setting is for PMTUD by applications on Azure side, which works over the top to VPN layer.

    For test purpose I wouldn't care if the mtu is optimum or not, so let's say 1400, which would be short enough for any intermediate carrier to pass traffic without fragmentation. I think the commands would look like below:

    config sys int

      edit PHY_INTERFACE

        set mtu-override ena

        set mtu 1400

      next

    end

     

    I have no knowledge on Azure so you have to figure out how to do the same yourself.

    Terms & ConditionsAccessibility statement