Skip to main content
zoriax
New Member
November 23, 2021
Question

Site to site IPsec traffic very slow

  • November 23, 2021
  • 11 replies
  • 60814 views

Hi everyone !

 

I'm facing a really strange problem with IPSec VPN. I configured IPSec tunnel FortiGate to FortiGate on different models (40F - 80F and 100F) all of my VPN tunnels are slow and they not reflecting my bandwidth throughput. I'm on FortiOs 7.0.1

 

For exemple I have :
- FortiGate-80F <-> FortiGate-80F with a bandwidth of 1Gb/1Gb on both sites. Trough my tunnel, I reach with difficulties about 200Mb/200Mb

- FortiGate-100F <-> FortiGate-80F with a bandwidth of 1Gb/1Gb on 100F sites and a bandwidth of 500Mb/500mb. Trough my tunnel, I reach with difficulties about 200Mb/200Mb

- FortiGate-100F - Fortigate-100F with a bandwidth of 500Mb/500Mb on both sites. Trough my tunnel, I reach with difficulties about 200Mb/200Mb

 

I tried many options to optimise my tunnel but nothing woks. I tried :
- Set correct MTU on WAN Interface and MSS on Firewall rules (for exemple MTU of 1500 and MSS of 1380) --> no change
- Set different encryptions on my tunnels --> no change
- Disabled ipsec-asic and ipsec-hmac --> no change

 

This slowness on IPSec seems to be the same on every models and on very configurations... Here is for exemple one of my phase1 config

 

config ipsec phase1-interface
   edit "vpn"
      set interface "wan1"
      set ike-version 2
      set local-gw 1.2.3.4
      set keylife 28800
      set peertype any
      set net-device disable
      set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
      set dhgrp 19 20
      set nattraversal forced
      set remote-gw 4.3.2.1
      set add-gw-route enable
      set psksecret Secret
   next
end

 

I really need your help. I don't understand what I'v missed in configuration.

 

Thanks !

 

 

11 replies

latos1224
New Member
March 29, 2025
Hi zoriax, I also have the same problem, I configured a site-to-site IPsec VPN between 02 fortigate 40F computers, when pinging through the tunnel the response time is 7ms, however, the client reports slowness when accessing their applications and web pages located on a server in the datacenter, the BW at both sites is 1Gb. At headquarters, users have the application client installed that works with a network drive (x:\\A3), that is, this app works with the client-server method. When users connect and open the program, it runs slowly. This morning they told me that it was working well but as more users started connecting, it became slow. I have also validated this slowness by connecting through another remote access VPN to the client site and using the site-to-site tunnel I access the forti located in the DC and if I notice slowness when accessing the equipment, I changed the encryption and DH parameters to secure ones, but not so robust, as well as, I updated the firmware on both computers to v7.2.11 and there are no improvements in the performance of the tunnel, I thought about changing the MTU and MSS values, however, I do not think it is necessary since the problem is in the tunnel itself; your help please, very angry customer !!!