Throughput of SSL VPN and Passthrough SSL VPN

Hello All,

I am in desperate need for assistance. I have an 80C as my perimeter firewall, and an ASA 5505 directly connected behind it.

[Internet] > 80C > ASA (DMZ)

Previously, the 5505 used to be the perimeter, and users would connect with AnyConnect for SSL VPN access, with zero issues with throughput (getting maximum bandwidth over the VPN) or MTU size. Now they are experiencing two issues:

1) AnyConnect gives an error about MTU size being too low and disconnects. I have confirmed my end-users' machine's interface MTU is set to 1500, the interface on the ASA is set to 1500, and have set the "set tcp-mss-sender 1452" on the passthrough policies on my 80C on each of the policies for the passthrough traffic, but still users get disconnected because of MTU.

2) Throughput over the VPN is far from the maximum 70mbps that 80Cs can handle (getting about 3-4mbps). I have confirmed this via my phone, as well as my laptop over many different connections to ensure the connection I was using wasn't causing the issue.

As a fix, I configured SSL VPN on the 80C, and don't have the MTU issue, but throughput is still dog slow (about 10% of what the speed should be). What I find weird is: if I connect off one of the internal ports (essentially, my LAN) via AnyConnect to the ASA (so LAN > DMZ), I get no MTU issues and full throughput.

I have no security profiles on the policies for the passthrough traffic to ensure that is not bottlenecking anything, but the fact that I have the throughput issues on AnyConnect and FortiClient is puzzling. 

Finally, I had a spare 80C that I spun up and only configured the passthrough SSL VPN and the Fortigate's SSL VPN and still have the same issue, so I have confirmed it is not the unit.

Is this due to the fact that the ASA is using the designated "DMZ" port? Or is there something I am missing.

Any help would be greatly appreciated.

Thank you.