Technical Tip: How to verify bandwidth passing through a FortiGate remotely

[Gab_FTNT]

Description	This article describes a method to bypass SSLVPN or IPsec dial-up for bandwidth verification using Iperf.
Scope	All FortiGate firmware.
Solution	The main goal of this test is to help identify and narrow down where a bandwidth issue lies. By running an IPerf test without passing through SSLVPN or IPsec Dialup, it is possible to confirm if the issue is related to those or from another source. Requirements. It is first necessary to have IPerf installed on a host sitting outside of the network and on another one sitting internally. IPerf is available to download at this external link: https://iperf.fr/iperf-download.php VIP configuration. Go to -> Policy & Object -> Virtual IPs -> Create new. Interface: Select which WAN interface traffic will be coming from. External IP address/range: The public IP of the WAN interface. IPv4 address/range: The private IP of the internal host running IPerf. Port Forwarding: Since IPerf uses port 5201 by default, the External service port can be set to 5201 as well as the Map to IPv4 Port. Policy. Create a policy to allow traffic from WAN to LAN with the destination VIP previously created. Incoming Interface: The WAN interface traffic is coming from. Outgoing Interface: The LAN interface on which the internal host is located. Source: Can be the public IP of the host sitting outside or ALL. Destination: The VIP previously created. Service: Can be 'all' or a custom service specifying port 5201. Action: Accept. NAT: Enable. IPerf Test. Starting on the internal host: open CMD, go to the IPerf folder and run IPerf as a server. In this example, IPerf is located on the desktop. cd Desktop cd iperf iperf3 -s Now, open CMD on the external host. Navigate to the IPerf folder and run IPerf as a client. In this exemple, IPerf is located on the desktop. cd Desktop cd iperf iperf3 -c 10.9.11.15 <- This command is for testing upload speed. or iperf3 -c 10.9.11.15 -R <- This command is for testing download speed. After testing the bandwidth for downloading and uploading, compare the speed obtained with and without the use of SSLVPN or IPSec. Also please make sure to remove the policy and VIP configuration once finished with the testing. For more information or if any problem occurs, contact Fortinet Support.