unstable/slow ipsec vpn connection

Question

Hi.I have a FG 100D. It was on fortios 5.4.1 but fortinet support advised me to upgrade to the latest build 5.6.1So 5.6.1 we are now. I created a new forticlient ipsec  test tunnel with the wizard.  No UTM are aplied on the policies used.This tunnel works but when I copy files over this tunnel the connection is slow and unstable.I have a 250/30 internet connection but downloading a file from the file server at the remote location is very slow (5mbit). So can anyone help me to solve this problem?

Toshi_Esumi · Answer

There is no silver bullet to pin-point this type of performance issue easily so I'll through out some things you need to consider when you troubleshoot like this.

[ul]

most often very poor performance/speed comes from ethernet duplex mismatch somewhere between the FW and the local device/PC/Server. Check it at all interfaces along the path, on both client and server end.

If no duplex mismatch all the way, the next thing you need to rule out is the internet path(s) between the client side and the server side the IPSec vpn goes through. Compare continuous pinging end-to-end through the tunnel and public-to-public between those FWs outside the tunnel, then trace-route from both ends toward the other end if you see some intermittent drops. It might explain "unstable" portion of the symptoms. Often packet drops happen at a hand-off between internet vendors, like comcast-to-Level3, centurylink-to-Cogent, and so on when they over aggregate traffic.

Along with the ping test above, run internet speedtests, like speedtest.net picking a closest test server on the opposite side, like if you're between Denver and Dallas, test at Denver by choosing speedtest.net's one of Dallas servers. If you can find your ISP at Dallas in the server list, that would be ideal.

Download speed at one end is decided by upload speed on the other end when you do end-to-end file transfer, which you're probably aware of. If the server location also has 250/30 circuit, the download speed never go beyond 30Mbps.

Lastly Windows TCP/IP protocol stack's window size comes in a factor if you're testing between windows machines. You might need to adjust them. You can find some articles if you google it. Ideally you want to test with something like iperf servers running on Linux machines, which provides an UDP test option.[/ul]

The bottom line is FortiGate's VPN itself is unlikely the cause. We dealt with many cases like yours for our customers. Most of them are the first one or the second issue. Good luck!

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded