Expected Bandwidth through IPSec VPN

[#1]

We have established a point to point IPSec VPN between two sites using an FGT3600 and an FGT800 All traffic between the two sites goes via this VPN Testing shows that bandwidth through the VPN is around 10% of that available on the link without IPSec VPN. So encryption and decryption takes up around 90% of the available bandwidth. Is this what I should expect? or is there a fix or a way of ' tuning' the circuit or VPN to improve things? Other firewall manufacturers publish figures for expected throughput on IPSec VPN circuits but Fortinet do not appear to do so. Thanks

[UkWizard]

Not sure this makes sense, could you please elaborate? do you mean if you copy data from site to site without going via the ipsec tunnel, its 10 times more bandwidth? not sure how you can compare the two easily.

[#3]

ORIGINAL: UkWizard Not sure this makes sense, could you please elaborate? do you mean if you copy data from site to site without going via the ipsec tunnel, its 10 times more bandwidth? not sure how you can compare the two easily.

I' ll try to make my question a little clearer -- Simple comparison tests were carried out initially: 1) We transferred a file of approx 1.2Gbyte using FTP through the VPN tunnel. The FTP program reported that the file was transferred at 380 kbits/s. 2) The same file was then transferred with the same FTP program between the same two end machines but not via the VPN. To do the comparisons I set up a policy which used NAT on the remote firewall in order to by-pass the VPN tunnel. This time the FTP program reported that the file had transferred at 3.42Mbits/s. So this indicates to me that transferring data through the VPN is considerably slower and appears to offer only 11% throughput compared to transfers external to the VPN. This test was repeated a number of times and the average was closer to 10% of the throughput available without using VPN. We also used a bandwidth measuring tool " iperf" which indicates the same difference between VPN and non-VPN traffic Reading the specification for the firewall as suggested by Abel in another reply: http://www.fortinet.com/doc/FGT200_800DS.pdf This PDF shows that the FGT800 has a firewall throughput of 1Gbit/s and IPSEC VPN (168-Bit Triple DES) throughput of 200Mbit/s. So if I interpret this to read that the VPN throughput is expected to be 20% or possibly less compared to firewall throughput (or the maximum bandwidth between the two firewalls?) then I suppose the throughput we have measured of around 10% is only half of what we might have been lead to expect. i.e. if the maximum bandwidth available between the two firewalls is around 4Mbit/s then we may not expect to achieve better than 800kbit/s through the VPN tunnel. Maybe other firewalls offer better thoughput on VPN. The specifications for the FGT200A for instance appears to show VPN throughput near to 50% of firewall throughput with figures of 70Mbps and 150Mbps respectively. I suppose it all depends on how we interpret published figures. My original question should have been-- Has anyone else compared traffic through an IPSec VPN tunnel with a direct connection and have they seen similar differences in throughput? I suspect now that anyone answering YES to the first part of this question will also answer YES to the second part. Some general points to note: a) The Fortigates at each end of the link are connected to routers which have 100Mbit/s full duplex interfaces. Hence neither connects at 1Gbit. b) The link between the two Fortigates has 11 router hops including the the two routers mentioned in a) above. This may indicate why our maximum achievable available bandwidth is around 4Mbit/s. We are addressing improved available maximum bandwidth between the two sites as a separate issue.

[abelio]

Is this what I should expect?

I don' t think so

or is there a fix or a way of ' tuning' the circuit or VPN to improve things?

you have the option of ' traffic shape' vpn firewall policy

Other firewall manufacturers publish figures for expected throughput on IPSec VPN circuits but Fortinet do not appear to do so.

You have that info in each product pdf datasheet from fortinet' s site http://www.fortinet.com/products/enterprise.html in your case

[#5]

ORIGINAL: abelio

Is this what I should expect?

I don' t think so

or is there a fix or a way of ' tuning' the circuit or VPN to improve things?

you have the option of ' traffic shape' vpn firewall policy

Other firewall manufacturers publish figures for expected throughput on IPSec VPN circuits but Fortinet do not appear to do so.

You have that info in each product pdf datasheet from fortinet' s site http://www.fortinet.com/products/enterprise.html in your case

Abel Thanks for the info. I just need to sit down and try to interpret the information in the PDF file correctly. Tom.

[UkWizard]

Are you saying you have a 100Mb connection between the sites then? take the paper spec' s with a pinch of salt, as this max throughput ratings are when EVERYTHING ELSE is turned off, ie IPS/AV/AUTH ETC. When you done the tests, did you insure that AV was turned off, and that you are not getting Mb (bits) and MB (Bytes) mixed up?

[#7]

I' ll try to answer your questions below:

ORIGINAL: UkWizard Are you saying you have a 100Mb connection between the sites then? take the paper spec' s with a pinch of salt, as this max throughput ratings are when EVERYTHING ELSE is turned off, ie IPS/AV/AUTH ETC. When you done the tests, did you insure that AV was turned off, and that you are not getting Mb (bits) and MB (Bytes) mixed up?

I wish we did have 100Mbit/s between sites. Since we do not have a dedicated link end to end we are constrained by the weakest link in circuit path between the two sites. At the remote site all interfaces including that to the external router are 100Mbit full duplex. The external router belongs to a service provider and we have no knowledge of what happens i.e. what inteface speeds exist beyond that point. Traceroute output shows that average response times start to exceed 10mS after the 6th hop with avaerage response time for the remote router being around 18mS. As I said we are talking to the provider about how we can improve end to end overall bandwidth. However even if we had a 100Mbit/s dedicated circuit I would like to know what VPN throughput we could expect to achieve. Will it always be around 10% of the circuit bandwidth? All IPS and AV etc are turned off on bothe firewalls. I don' t think I' m mixing my bits with my bytes just reporting the results I get. Below is a typical output from the " iperf" program. Note this is cut and paste from the program output. Details of " iperf" are available at the following URL: http://dast.nlanr.net/Projects/Iperf/ Sample output from the bandwidth measuring tool " iperf" is shown below. Sample 1 shows the iperf results when traffic goes directly out to the internet from the firewall via a NAT policy. Sample 2 shows iperf results when traffic goes via the IPSec VPN tunnel. Sample 1 ======== C:\iperf>iperf -c 129.234.2.39 ------------------------------------------------------------ Client connecting to 129.234.2.39, TCP port 5001 TCP window size: 8.00 KByte (default) ------------------------------------------------------------ [1916] local 193.60.196.1 port 4049 connected with 129.234.2.39 port 5001 [ ID] Interval Transfer Bandwidth [1916] 0.0-10.0 sec 4.09 MBytes 3.42 Mbits/sec Sample 2 ======== C:\iperf>iperf -c 129.234.2.39 ------------------------------------------------------------ Client connecting to 129.234.2.39, TCP port 5001 TCP window size: 8.00 KByte (default) ------------------------------------------------------------ [1916] local 193.60.196.1 port 4058 connected with 129.234.2.39 port 5001 [ ID] Interval Transfer Bandwidth [1916] 0.0-12.0 sec 672 KBytes 459 Kbits/sec Thanks for your questions. They help me to think through the problem to see if there is anything I have missed. Best regards Tom

[FortiRack_Eric]

You have to keep in mind that you are comparing apples and pears. If you are copying a file via SMB protocol to another windows machine via the tunnel the thru-put is heavily suffering by the latency of the connection. Whereas FTP doesn' t has this drawback. You should be comparing FTP thru the tunnel and FTP via the internet. Then you can have a rough idea what the IPsec overhead is. I would expect the overhead of IPsec to be around 15-20%. Cheers, Eric

[UkWizard]

looks like the iperf tool is a load of rubbish, its mixing bits and bytes. hence the 10% confusion. Because typically 10Mbit gives about 1MByte throughput. (note 10% less) the sample 1 you posted shows it almost the same for bits and bytes, which is rubbish. suggest using a different tool to test it.