Different traffic at internal and external ports

[nbcuser]

Hello All,

I'm very new to the Fortigate products and I'm still learning a lot of this.  I have a question regarding some interesting traffic patterns between my external port and internal port on my system.  We are a multi-campus school with a 300C at each of our five campuses plus one at the datacentre with a 50Mbps internet link.

Over the past week we have been having very bad internet connection and today I noticed that there was quite a difference between the traffic pattern at the external port and the internal port on our 300C.

In the attached graph, the top graph (pink line) shows the traffic at the internal port.  This is relatively constant at approx 35Mbps for most of the time.  The drop to around 10Mbps corresponds with my blocking windows update traffic.

However, the bottom graph (green line) shows a flat-line at 50Mbps all day from 8am to 5pm.

My question is whether this is normal to have such a large difference between the traffic hitting the external port of the Fortigate and the traffic which is passed onto internal devices.

Thanks in advance,

Chris.