Skip to main content
veechee
New Member
May 5, 2011
Question

Share your WAN Optimization experiences here

So I finally took the time to try WAN Optimization between two FortiGate' s. Both are 60C' s with 32 GB Class 10 SD cards installed, and 29 GB provisioned for WAN Optimization storage space. There are Windows servers at each site with SMB file shares. I did a rule set on each site to cache traffic requested by client PCs to the servers on each side. I made two rules: one for port 445, which I think was enough, but just in case I also made one for 49152-65535, which is the random port range Server 2008/Vista+ use in conjunction with port 445. The results were fairly immediate and somewhat impressive. Downloading a 30 MB file will take 10 mins the first time, and only ~1 minute the second time - peaking at 2 MB/s file transfer versus maybe 40 KB/s for a non-cached file. However, I do notice increased latency versus before, so I' m reluctant to roll out optimization to the server to server traffic (the servers seem to use 445 for a lot of communication) and to traffic outside of CIFS/SMB. I do think this has great potential but the Fortinet docs and knowledge base are lacking on examples for site-to-site traffic optimization (e.g., generic TCP optimization mentioned in the " Inside FortiOS" sheet but totally absent in any examples). If people are interested in my rule sets that I got to work I' d be happy to share them, and conversely I' d love to hear from others that have deployed WAN Optimization and where it is benefiting them.

    20 replies

    mbrowndcm
    New Member
    June 9, 2011
    Thanks guys for your responses. This information greatly deters me from implementing WAN optimization for CIFS. Thanks, Matt
    Carl_Wallmark
    New Member
    June 9, 2011
    i just came across this article, maybe this is causing the delays: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31764&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=19880856&stateId=0 0 19882354
    mbrowndcm
    New Member
    June 9, 2011
    Signing is not packet encryption. Would be interesting to test anyway.
    kinderu28
    New Member
    June 16, 2011
    Hey guys, I' ve changed my topology a little bit,but encountered a problem.Now i have a computer between the 2 FG(which is also my server side) The idea that i had was: i' ve configured an ipsec tunnel between the 2 fg so that all traffic from the internal intf to the wan intf passes through the ipsec tunnel. My question is if i can apply wan optimization over the ipsec tunnel. I am asking this because i don' t seem to get the wan opt tunnels up. I' ve used active passive arhitecture with transparent mode enabled. My topology is smth like this: client - fg1 --wan1-- server --wan1-- fg2 ................................. |_____internal_| So the server is between the FG' s and has also a connection to the fg2 (in order for the traffic to arrive somewhere ) Like i said, can i apply wan opt over the ipsec tunnel?If so(and hope so),i must be missing something oblivious. Thanks a lot
    veechee
    veecheeAuthor
    New Member
    June 16, 2011
    I don' t totally understand your topology, but yes you can apply WAN Optimization over the IPSec links. Disregard the parts in the guide about using encrypted WAN Optimized tunnels and just set un-encrypted ones between local IPs on either side of the IPSec tunnel.
    mbrowndcm
    New Member
    June 16, 2011
    Take a long look at this: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32430&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=20290805&stateId=0%200%2020292067 You can remove a large portion of the configs and get what you want.
    kinderu28
    New Member
    June 17, 2011
    @mbrowndcm: That was the link that i used to configure my ipsec and wan optimization.I forgot to mention in my previous post. I' ve managed to set up the wan optimization tunnels,but it seems that it works only for peer-to-peer and not for active-passive(don' t know why) @veechee: my topology is a little weird due to lack of equipment(2 fortigates and 2 computers)Here is a picture of the topology.The green line is how traffic passes from the client to the server , the pink is the ipsec tunnel, red is for the wan ports and the blue and black are for the lan ports. On my server i' m now running a program (countertrace) that receives packets and sends them to user space, where it adds a number of hops(thus increasing latency).Hope this is a good enough wan simulation.Moreover, i' m using smokeping for measuring delays and latency.
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT