FG60E - FG60E IPSec Tunnel Slow

[remosito]

Hi everybody,

our Site2Site IPSec VPN Tunnel between two FTG-60E on 5.4.4 is slow and I have run out of stuff to try.

Both Sites are connected via Gbps Fiber Internet. Iperf3 to a public Iperf Server gave 600+ Mbps results on both ends. So we know our Internet uplinks are good. But our IPSec Tunnel tops out at 130-ish Mbps.

I have tried from tips I read in various places:

 - deleted the udp-dns session helper thingie

 - took all internal1-8 out of the internal hardware switch

 - tried different enc algos

 - set local-gw

here the sanitized relevant parts of the config from MainSite FTG-60E

config system npu
    set enc-offload-antireplay enable
    set offload-ipsec-host enable
end

config system interface
    edit "wan1"
        set vdom "root"
        set ip a.a.a.a 255.255.255.248
        set allowaccess ping ssh
        set type physical
        set estimated-upstream-bandwidth 1000000
        set estimated-downstream-bandwidth 1000000
        set role wan
        set snmp-index 1
        set secondary-IP enable
        config secondaryip
            edit 1
                set ip a.a.a.b 255.255.255.255
            next
        end
    next


    edit "internal1"
        set vdom "root"
        set ip p.p.p.p 255.255.255.0
        set allowaccess ping https ssh
        set type physical
        set snmp-index 11
    next

config vpn ipsec phase1-interface
    edit "VPN-BRN-LSN"
        set interface "wan1"
        set local-gw a.a.a.a
        set peertype any
        set comments "VPN: VPN-BRN-LSN (Created by VPN wizard)"
        set remote-gw f.f.f.f
        set psksecret ENC secretsauce
    next
end

config vpn ipsec phase2-interface
   edit "VPN-BRN-LSN"
        set phase1name "VPN-BRN-LSN"
        set proposal aes256-sha256
        set dhgrp 14
        set comments "VPN: VPN-BRN-LSN (Created by VPN wizard)"
        set src-subnet p.p.p.p 255.255.255.0
        set dst-subnet q.q.q.q 255.255.255.0
    next

and here some diag output from the same 60E:

diagnose vpn ipsec status
All ipsec crypto devices in use:
NP6LITE_0
        null: 0 0
        des: 0 0
        3des: 0 0
        aes: 1682560 1894400
        aes-gcm: 0 0
        aria: 0 0
        seed: 0 0
        null: 0 0
        md5: 0 0
        sha1: 6784 8192
        sha256: 1675776 1886208
        sha384: 0 0
        sha512: 0 0
NPU HARDWARE
        null: 0 0
        des: 0 0
        3des: 0 0
        aes: 33331 0
        aes-gcm: 0 0
        aria: 0 0
        seed: 0 0
        null: 0 0
        md5: 0 0
        sha1: 544 0
        sha256: 32754 0
        sha384: 0 0
        sha512: 0 0
SOC3:
        null: 0 0
        des: 0 0
        3des: 0 0
        aes: 20 32
        aes-gcm: 0 0
        aria: 0 0
        seed: 0 0
        null: 0 0
        md5: 0 0
        sha1: 1 2
        sha256: 18 30
        sha384: 0 0
        sha512: 0 0
SOFTWARE:
        null: 0 0
        des: 0 0
        3des: 0 0
        aes: 0 0
        aes-gcm: 0 0
        aria: 0 0
        seed: 0 0
        null: 0 0
        md5: 0 0
        sha1: 0 0
        sha256: 0 0
        sha384: 0 0
        sha512: 0 0

get system npu
enc-offload-antireplay: enable
dec-offload-antireplay: enable
offload-ipsec-host : enable


diagnose vpn tunnel list
list all ipsec tunnel in vd 0
------------------------------------------------------
name=VPN-BRN-LSN ver=1 serial=3 a.a.a.a:0->f.f.f.f:0
bound_if=3 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/8 options[0008]=npu
proxyid_num=1 child_num=0 refcnt=20 ilast=13 olast=13 auto-discovery=0
stat: rxp=1715632 txp=1911092 rxb=833611779 txb=1426710396
dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=1101
natt: mode=none draft=0 interval=0 remote_port=0
proxyid=VPN-BRN-LSN proto=0 sa=1 ref=5 serial=1
  src: 0:p.p.p.p/255.255.255.0:0
  dst: 0:q.q.q.q/255.255.255.0:0
  SA: ref=6 options=2e type=00 soft=0 mtu=1438 expire=11928/0B replaywin=1024 seqno=29811 esn=0 replaywin_lastseq=00025e80
  life: type=01 bytes=0/0 timeout=43174/43200
  dec: spi=257f4fb4 esp=aes key=32 secretsauce
       ah=sha256 key=32 secretsauce
  enc: spi=8574257e esp=aes key=32 secretsauce
       ah=sha256 key=32 secretsauce
  dec:pkts/bytes=155266/49170368, enc:pkts/bytes=173054/97413586
  npu_flag=03 npu_rgwy=f.f.f.f npu_lgwy=a.a.a.a npu_selid=0 dec_npuid=1 enc_npuid=1

kinda all looks as it should be to me.

I can post the same info for the other FGT-60E if needed. Or any other output or config parts....

any help greatly appreciated

[remosito]

No takers?

Would be really glad for any ideas or feedback or throughput values of others with two 60E over gigabit.

60E has a new processor that is supposed to be twice as fast in IPSec as the 90D (2Gbps vs 1Gbps). And for the 60D I had found somebody achieving 600-800 Mbps ( https://blog.webernetz.net/2016/03/15/fortigate-vpn-speedtests/ )...

[Paul_S]

I have a 1 gbps link too with slow IPSEC VPN.

FG200D 5.2.10 to FG60D 5.2.11.

500 to 700mbps in one direction and 124 mbps in the other. I will replace my FG60D with a FG60E for testing purposes if I don't find a solution soon.

[remosito]

Paul S wrote:

I have a 1 gbps link too with slow IPSEC VPN.

FG200D 5.2.10 to FG60D 5.2.11.

500 to 700mbps in one direction and 124 mbps in the other. I will replace my FG60D with a FG60E for testing purposes if I don't find a solution soon.

124mbps is pretty much the speeds I get with my two 60Es. Coincidence or unpublished limitation by the 60 line?

Would be most interested in knowing what speeds you get with a 60E. But if I were you haven't that 60E lying around, but need to buy it. I think I would not risk it and go 90...

[Paul_S]

I have a 60E lying around so I will try that and see what happens.

I've upgraded to 5.4.4 on my 60D and I get over 124 mbps now, but never over around 700+ for up+down. I want to get 700mbps+ in both directions for 1.4gbps total. The wireless link that this fiber replaced maxed out around 700 mbps per direction, so I was hoping for at least that.

[Smartypants]

I wish I could get 130Mbps.

I have a 900D HA Pair trying to connect to a VM version of the Fortigate FW over a 500MBps circuit on my end and a bigger pipe at the remote data center and I'm only getting 30-50Mbps. Both me and the Data Center engineering team are at a loss.

Opened a ticket with support (we pay a lot $$ for support) and was told to buy IPerf and run tests and report back.

So much fro support ;)

I'm stuck at this point we planned on using Forti's for a site 2 site and we can't and I don't know why.

We have ASA's on a different network and they work so maybe I need to do that but I don't really want to do that.

[Paul_S]

iperf is a free utility. What OS versions?  does your CPU usage get high on either side? are you using encryption and hashing algorithms supported by ASIC?  Since Fortigate-VM has no ASIC you will probably have a limit due to CPU speed, but I image it is much higher than you are seeing now.

[ispcolohost]

Hey all, I'd be interested in any updates you might have on the throughput issue.  I have not been able to find out if Fortinet's newer SoC3 hardware actually accelerates SHA256, or by how much.  I know the hardware without an NPU, and up through the NP4, tunnels using SHA256 would cause all VPN traffic to hit the CPU where SHA1 lets it stay on the NPU.  Based on their 'hardware acceleration' document:

http://docs.fortinet.com/uploaded/files/2855/fortigate-hardware-acceleration-54.pdf

I can tell that NP6/NP6Lite should accelerate an AES256/SHA256 tunnel, but of course there's zero guidance on what the real world throughput should be and their support seems unwilling to release an estimate for anything.

I've been running into horrid throughput between 200D's with AES256/SHA256/DH14 tunnels, as well as between 200D's and remote 60D and 100D locations.  I came across this thread while trying to research what real world expectations I should have on the 100E with SoC3 (same as 60E/80E in theory but no knowledge of clock speed), and the 200E with CP8+NP6Lite, as we have some remote locations that would get a 60E or 100E instead of 200E.

The data sheets are of course useless since they just say IPSec with no mention of encryption or hash algorithms and that seems to make or break Fortigate hardware.

[Paul_S]

After doing some troubleshooting today with my ISP regarding our 1 Gbps circuit running at 100 Mbps, I am contributing the following information:

Setup:

- IPSEC VPN (AES-256/SHA1) between FWF60D (5.4.4) and FG200D (5.2.10).

- All interfaces at 1 Gb, full Duplex.

- with policy set to "set auto-asic-offload disable"

iperf test shows only around 91 mbps throughput.

after running command: "unset auto-asic-offload" on the policy. NO other changes.

iperf test shows 650 to 700 mbps, in one direction. in+out maxes out at around ~725mbps.

conclusions:

- enabling ASIC does in fact improve VPN performance significantly.

- without ASIC I can only get 100 Mbps through my IPSEC VPN.

- ASIC (NP4Lite) will accelerate SHA256/SHA1

- There is another limit somewhere in the 60D or the 200D that prevents me from getting closer to 1 Gbps in each direction.

remaining questions I have not answered yet:

- Would the NP6Lite ASIC on the 60E get higher throughput on the IPSEC VPN?

- Would throughput change on the 60D or the 60E if I used AES256/SHA256?

[ispcolohost]

I have some E-series units on the way and support & sales both claim it offloads SHA256, so we shall see.