Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fortinetuser2020
New Contributor

ipsec tunnel settings for best performance

i want to setup an ipsec tunnel adjusted for stability and best performance/throughput, ignoring security. the security is not a requirement here

 

fortigate 200e. what's the best settings and proposal needed for best performance and stability, while ignoring security?

 

thank you

1 Solution
emnoc
Esteemed Contributor III

I would look at GCM vrs CBC ciphers for performance but the impact might not be that much of anything, but overhead would be less with Galios Counter Mode take a look at "suite-b-gcm-128/256"

 

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/238852/encryption-algorithms

 

YMMV 

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

View solution in original post

5 REPLIES 5
ede_pfau
Esteemed Contributor III

Quite a broad question...mainly you're asking for 'best practices'.

1- performance

You can only reduce performance by choosing proposals (phase1 and phase2) which are not hardware-accelerated. ATM AES256 is deemed secure, costs less performance than 3DES (ugh) and is run on the SP (ASIC), that is, accelerated.

I'd rather stay away from EC proposals.

 

2- stability

Is IMHO mainly dependent on line stability. If the WAN line glitches, an IPsec tunnel has to renegotiate. (Which BTW reduces throughput as well.).

 

But you can plan for more stability in the network design. Use redundant tunnels and monitor connectivity with link-monitors. If set up correctly, this minimizes downtime. See to it that switching between tunnels is delayed (with hysteresis) to avoid flapping.

In FortiOS 5.6 and esp. 6.0 and 6.2 you can achieve all of this with the SD-WAN construct. Recommended.

 

And one last stability hint: do not use the latest, bleeding-edge firmware version. You never do. v6.0.6 is stable and secure.


Ede

"Kernel panic: Aiee, killing interrupt handler!"
fortinetuser2020

thank you

so about performance, a good choice with 200e will be aes256 with md5, right?

 

and about stability, i only have only 1 wan in each side, so the only stability is as good as the stability of my wan lines on each side, right?

emnoc
Esteemed Contributor III

I would look at GCM vrs CBC ciphers for performance but the impact might not be that much of anything, but overhead would be less with Galios Counter Mode take a look at "suite-b-gcm-128/256"

 

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/238852/encryption-algorithms

 

YMMV 

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

fortinetuser2020

yes, it looks like the 128gcm provides the best results, thank you sir. i'll keep track of it over time

ede_pfau
Esteemed Contributor III

Please drop MD5 from your list of hash algos. Use SHA1 or better still, SHA256. MD5 has been compromised before.

Again, I'm not sure that the higher SHA algos are hw accelerated (though they are supported in FortiOS).

Seems they are, up to SHA512 (cf. KB article).

aria, seed, aesXXXgcm all cannot be offloaded. CPU will have to do that which forfeits one major advantage of a Fortigate.

You'll notice that some algos are not offloaded in phase1 but are in phase2. No idea why.

In addition to the "Encryption" chapter, have a look at the preceding chapter "ASIC offloading" in the Cookbook.

And in encryption, do not use DES or 3DES.

 

And all of your other assumptions are correct.


Ede

"Kernel panic: Aiee, killing interrupt handler!"