Skip to main content
sensorsinc
sensorsinc
New Member
May 17, 2011
Question

SSL VPN Speed

  • May 17, 2011
  • 8 replies
  • 10240 views
Hello, I was wondering what kind of speed / performance others are getting with the SSL VPN in tunnel mode. I have a FortiGate 80C and a 10Mbps Internet connection. I have been running some download speed tests. I' m downloading a folder containing 129 files with a grand total of 130 MB. On a 4G WiFi (12,000 kbps), it takes 12 minutes to download which works out to 1,444 kbps. On a Comcast line (14,000 kbps), it takes 9 minutes 30 seconds which works out to 1,824 kbps. The 4G & Comcast speeds are based on speeds tests from DSL Reports. So even if you take those with a grain of salt, I still expect the download speed to closer match my slowest connection. At least on the Comcast line I would expect higher, double for example. I talked to a Fortinet consultant at a trade show who said to check my CPU% because 80C' s vpn is totally software based and doesn' t have a special chip (n2p?) to accelerate VPN performance. So I did that and the CPU percentage number got more than 14%. He thought if the CPU was limiting, the % would jump to 100%. What kind of file transfer speeds are others getting via SSL VPN? Or does anyone have any tips (other than lowering encryption) to get more speed out of it? Thanks, Jamie

    8 replies

    Carl_Wallmark
    Carl_Wallmark
    New Member
    May 17, 2011
    Hi, the Fortinet consultant is right, the SSL VPN is software based, however i was under the impression that the SSL VPN was offloaded to the CP6 chip, and the 80C does have one. The NP2 chip is good for pure firewalling and IPSEC VPN and first available FortiGate with a NP2 is the 200B. i did some tests with a FortiGate 60C between two computers in the same room, and the speed i got with MR2 was around 10 MB/s and the CPU was around 80-90%, then i tried the MR3 and got around 15-16 MB/s And notice that the 80C is more powerfull than the 60C.
    sensorsinc
    sensorsincAuthor
    New Member
    May 17, 2011
    Good information, thanks Selective! Nice to know the hardware is capable of high speed SSL VPN if only in a " lab" environment. Would be interested in hearing some real world speed info.
    jmac
    jmac
    New Member
    May 18, 2011
    Keep in mind that there may be dramatic differences in speed based on the protocol used and the access method: Are you using a SSL-VPN tunnel connection, or are you using the web portal to access files? Are you using FTP, SMB/CIFS, etc? SMB will generally have more overhead in than FTP resulting in lower data transfer rates. Are there any scanning or filtering policies applied to the firewall rules (if tunnel mode)? You can create or check a traffic history graph in the GUI for the internet interface to see raw data rate.
    vanc
    vanc
    New Member
    May 18, 2011
    You can never fully utilize your bandwidth with SMB/CIFS. Better try HTTP, or FTP.
    sensorsinc
    sensorsincAuthor
    New Member
    May 19, 2011
    Inspired by Selective' s " in the room test" . I did my own in the room test. I plugged my laptop into the outside of my edge router and ran the same 130MB download. FortiGATE is on the inside of said edge router. So it was PC -> Router -> FortiGATE. So on this 100 MB/s connection, It took 3 minutes and 40 seconds. The firewall was seeing ~5,600 Kbps. Actual transfer speed was ~4,800 Kbps. CPU percentage was around 15%. Memory was around 39%. Task manager showed around 5,000 Kbps. So only about a third of what Selective saw in his test. However, my test included a router and was done during business hours. Still not even close to the advertised 50 Kbps SSL VPN specification. The router is new and managed so I need to find out how it is configured. And I guess I should try plugging my laptop directly into the WAN port on my FortiGATE and try again. Thank you everyone for the advice! Jamie
    Carl_Wallmark
    Carl_Wallmark
    New Member
    May 19, 2011
    In my tests i connected a laptop to the wan port and another laptop on the internal port. the laptop on the " outside" connected with a SSL VPN tunnel, then i uploaded/downloaded a file from a Windows share on one of the laptops, very simple, however, i did not do any tests with HTTP/FTP
    emnoc
    emnoc
    New Member
    May 19, 2011
    A fairer test would be to test with the server directly for the same files. Your making an assumption the slowness iss firewall_sslvpn related and it might be your server. Other methods that would support thruput, would be to run iperf/jperf between the client+server and server+cleint. Running these test with UDP would also rule out tcp slow start, and any overhead for tcp.
    sensorsinc
    sensorsincAuthor
    New Member
    May 20, 2011
    @Selective...That' s what I am going to try next. @emnoc... Sorry should have mentioned that it only takes 7 seconds (150 Mbps) when connected over the LAN. Neither the server nor my PC is the limiting factor. The goal of course is not to hold ForiNET' s feet to the fire about the 50 Mbps throughput. I don' t expect to reach that " under perfect conditions" spec. I am checking to see why I' m getting 10% of the spec. I imagine there is a misconfiguration in my firewall or my router, both of which are new. No real conclusion can be made till I duplicate Selective' s test which is the only thing I can compare to so far. Right now his 60C is 3 times faster than my 80C, but I still need to match that test. Again, thank you to everyone helping me out! Jamie
    vanc
    vanc
    New Member
    May 20, 2011
    The configuration of VPN policies may affect the throughput. You can try different cipher strength. And don' t enable any UTM features, such as IPS, AV.
    rwpatterson
    rwpatterson
    New Member
    May 20, 2011
    Cipher strength has a much smaller bearing on the bigger boxes. My 1000A didn' t see any difference between 3DES or AES.
    vanc
    vanc
    New Member
    May 20, 2011
    Both 3DES and AES are hardware accelerated. On low end models, you may not have new CP build-in. That should affect affect the performance, to some extent. UTM features have much more effect on the throughput.
    emnoc
    emnoc
    New Member
    May 20, 2011
    If you want to match fortinet testing, than you might want find out what/how they test and via what protocol. TCP is not a protocol I would use for benchmarking encrypted fw performance btw
    sensorsinc
    sensorsincAuthor
    New Member
    May 23, 2011
    This weekend I ran another test. PC->WAN1->80C->Internal1->Gigabit Switch->Server It still took me 3 minutes and 12 seconds. 5,400 Kbps which matched the traffice history graph. CPU was never above 15% and memory 31%. Immediately after, I ran this test PC->Gigabit Switch->Server That took 7 seconds. There is no UTM turned on anywhere. The encryption is default. But my speeds are a third of what Selective got with a 60C. Anyone have any ideas of what else I should check? I don' t expect to hit 50 Mbps (spec) but I should be able to match/beat 15MBps (Selective' s 60C).
    rwpatterson
    rwpatterson
    New Member
    May 26, 2011
    Are all ports GBit?
    vanc
    vanc
    New Member
    May 25, 2011
    The official spec for SSL VPN throughput is, unfortunately, the web portal speed. NOT the tunnel mode throughput. My resource told me that tunnel mode speed depends on the PC side. PC' s CPU and network card may be different and it' s not possible to obtain a meaningful value. You can check your PC' s CPU usage and see if there are bottlenecks somewhere.
    Terms & ConditionsAccessibility statement