Terribly slow SSL VPN

So you' re seeing rates or 100MB file: FTP = 10 minutes SMB over SSL-VPN = 35 minutes Are you using the web applet or utilizing tunnel-mode and Linux/Windows' SMB clients? If you' re utilizing Linux/Windows' SMB client, I' d be curious what your throughput to the server is. Try running iperf server (iperf -s)on the SMB server and iperf client on the SMB client (iperf -c SMB_Server). I' d then move onto testing the throughput against the other encryption key algorithms; all the while watching CPU and Memory utilization on your Fortigate. Thanks, Matt

I don' t know who your ISP is, but Cablevision systems will throttle your bandwidth WAY back if they feel you have a server on their network (ask me how I know...). Transferring a large file or files (like I used to do to the photo lab I worked for) fits the pattern of a ' server' and they cut me down at the knees. Why I' m a FIOS customer now. My two cents

Yes you are correct Matt. I am just using the tunnel mode between Windows only machines. Both the server and the remote client have business class internet connections with 6/2 each. I did a test on the client machine to see what the tunnel did to my throughput. I ran a speed test with and with out the VPN connected and with the VPN connected I lost about 60% of my speed. I currently dont have split tunneling enabled because I cant seem to find anything in the worthless documentation on configuring that part and get an error message when I try to enable it. I tried using lower and higher encryption settings but it didnt change anything. RE: Bob...my ISPs on either end dont care about the servers since they are both business class with 6/2 on both ends.

I did a test on the client machine to see what the tunnel did to my throughput.

To where did you do you test? Point-to-point using iperf? Or did you test to the internet meaning: Option 1: VPN Client>Internet (6 up/2 down)> Fortinet> Internet (6 up/2 down)> Bandwidth testing server/site or Option 2: VPN Client (not connected)>Internet (6 down/2 up)> Bandwidth testing server/site AKA This is a little difficult to explain in text... Internet bandwidth test tunneling through VPN: 6Mbit-overhead>6Mbit-overhead>2Mbit>6Mbit>2Mbit-overhead Anyway... use iperf to test throughput... use hrping to test latency... What you need is a piece of software that transfers a file and give you time of the operation... creatfil.exe (not a typo) is a tool that will make a file, but doesn' t give you a T0+ time stamp. iometer is a little crazy for this situation. maybe xcopy or robocopy have a switch that' ll give you time? First thing you should do is test with iperf. You' ll be quite sad what the throughput actually is... how many hops? no QoS over the internets :( Are you using the same isp? While not connected, run a tracert or a pathping to see how many hops you' re going through. If it' s the same ISP, the traffic may not leave their network. We use Cogent in NYC and will be using Cogent in Geneva, Switzerland; Cogent said that it won' t leave their network. Let me know how it goes. I' d be interested in an average of ten runs from both sides. Good luck, Matt

Matt, I had all traffic being tunneled through the VPN (since I cant make the split tunneling work) and just ran about 15 network speed tests at several different websites. Ill look in to that utility you mentioned. Bob, Ill give that a try too. Is it normal to have this slow of download speed via SSL VPN? Is IPSec faster?

As Bob stated, if your TCP Maximum Transmission Unit is too large, lowering it will cut out the overhead on the Fortigate adjusting it (even though it' s safe to say your router is adjusting it). Usually MTU size on the internet is 1472. See determining your MTU (it' s really easy). Test MTU both to a host on the other side of the VPN, and to the internet (I would expect them to both be 1472, since both are traversing the Internets). Here' s some more points that I think you need to concentrate on: 1) Your internet bandwidth is going to be slow while tunneling over the VPN. 2) To solve this, configure split tunnel. 3) You seem to be actually concerned with SMB efficiency, which includes bandwidth, throughput and latency. Concentrate on making this more efficient, or simply determining if it is inefficient; because it doesn' t seem that you' ve solidly determined this yet. I' m on the edge of my seat over here. Let me know how it goes, Matt

I lowered the MTU a bit and am about to test it out. You will have to forgive my ignorance, but I dont know anything about ipref. I keep trying to configure the split tunneling but I get that error about split destination invalid in policy or something. The main point of using VPN for my users is to download and upload large files that are on our file servers. Glad you are keeping entertained over there :)

The results are still the same with the lower MTU. Im not sure if split tunneling would make it faster or not. The remote machine isnt doing anything else but this so there shouldnt bee too much additional traffic being forced through the VPN tunnel.

You keep saying that you' re trying to provide good throughput to a file server; so what the hell is testing internet bandwidth gonna do for ya? Here' s what I would do if I was you: 1) Get split tunneling working -I didn' t have to do anything more than check off " split tunnel..." so contact fortigate support. 2) Test connectivity with iperf Testing connectivity with iperf: -Connect with the VPN -Download iperf for windows: http://www.noc.ucf.edu/Tools/Iperf/iperf.exe -run iperf -s on the File server -run iperf -c [IP address of the file server] on the VPN client -run it nine more times keeping the results handy -average these ten results -run iperf -s on the VPN client -run iperf -c [IP address of the VPN client] on the file server -run it nine more times keeping the results handy -average these ten results And you' ve tested the throughput to and from your file server.

Lol I was just running the bandwidth test because I was curious. I also tested downloading and uploading files between the remote machine and the mapped drive of the file server and there was no improvement. Ill do that with ipref. I was doing more reading and found some good info on why SSL VPN is so slow. Im also going to try and configure the IPSec VPN and see if I get any improvements.