Skip to main content
RolandBaumgaertner72
RolandBaumgaertner72
New Member
December 10, 2024
Question

VPN Connection Europe to Brasil

  • December 10, 2024
  • 2 replies
  • 1567 views

Hi,

 

we have a FG200F on our main headquarter and a new office in Brasil with FG60F. We configured a VPN connection between the FGs (IKE V2, AES256-SHA256. AES256-SHA256). Both sides have 1GB internet access (well on the other side we are not so sure but some tests gave us very high bandwith).

 

Now the problem, users from Brasil connect to our office with RDP and sometimes they complain about preformance. So it is not everyday but sometimes they cant even refresh a RDP screen. We have like 195ms latency.

 

Has anyone experience and any ideas what we can do to check and improve?

 

Thanks 

2 replies

msolanki
Staff
msolanki
Staff
December 10, 2024

please tried to disable Anti-replay of phase-2 and check the RDP server setting too.

KB in sslvpn case but check setting for RDP server

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Windows-RDP-connection-dropped/ta-p/197443?externalID=FD40006

    RolandBaumgaertner72
    RolandBaumgaertner72Author
    New Member
    December 10, 2024

    Yes we can try that on one host but this is S2S IPSec, no SSL VPN.

     

    Any ideas what could be done on the VPN parameters to gain stability? At the end checking the usage yesterday they only get 15MB according to the VPN bandwith wizzard.

     

    Thanks

    sjoshi
    Staff
    sjoshi
    Staff
    December 10, 2024

    Hi,

     

    Can you check by disabling NPU offload if that could be of any help

    https://docs.fortinet.com/document/fortigate/7.6.0/hardware-acceleration/636026/disabling-np-offloading-for-individual-ipsec-vpn-phase-1s

     

    Further please check the CPU/Memory status of the device too.

    If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.
      RolandBaumgaertner72
      RolandBaumgaertner72Author
      New Member
      December 10, 2024

      Hi,

       

      never done that, can we expect some change from that?

       

      Checking CPU and Memory looks all good, we only have like max. 2000 sessions in 24h on the FG60F site. The other one is safe for sure since we also have other VPN connections that are working with no problems.

       

      Thanks

      sjoshi
      Staff
      sjoshi
      Staff
      December 10, 2024

      yes npu you can try disabling it but do it in off hours because disabling/enabling NPU will flap the tunnel

      You can also do the iperf test

      https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-troubleshoot-speed-issue-through-IPsec/ta-p/248594

      If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.
        Terms & ConditionsAccessibility statement