FortiGate 101F upload and download speed is limited, Dropbox sync is very slow less than KB speed.

[IT_Histoindex]

Hi Fortinet People, I've just updated firmware v7.0.17 to v7.2.11 and tested network internet download speed and upload speed, which is limited. Before updated firmware download speed and upload speed is 600Mbps- 700Mbps. Now download speed is 200Mbps and upload speed less than 100Mbps. And also Dropbox sync is taking very longer time upload speed is less than kb.  What going wrong? Try to disable security policies antivirus Dns filter, application control, IPS. Issue still persists. Do I need edit SSL inspection?

 

[BillH_FTNT]

Hi @IT_Histoindex 

I am Bill from Fortinet, and I would like to investigate your issue. Could you please share the following information?

• What type of traffic test are you running? Is it a speed test or client/server traffic?
• Which policy is being used for the test?
• Could you share the output of "dia sys session list" for the source/destination IPs related to that traffic?
• Please also share the output of the following commands:

diagnose npu np6xlite dce 0
fnsysctl cat /proc/net/np6xlite_0/pdq
diagnose npu np6xlite hpe 0
fnsysctl cat /proc/net/np6xlite_0/hpe_dce_qs
diagnose npu np6xlite anomaly-drop 0
diagnose npu np6xlite session-stats
diagnose npu np6xlite sse-stats 0
fnsysctl cat /proc/net/np6xlite_0/sse-dump
fnsysctl cat /proc/net/np6xlite_0/hif-stats
fnsysctl cat /proc/net/np6xlite_0/hifdrop
diagnose npu np6xlite ipsec-fragment
fnsysctl cat /proc/net/np6xlite_0/ipsec
fnsysctl cat /proc/net/np6xlite_0/ipt-stat
fnsysctl cat /proc/net/np6xlite_0/ipsec-perf
fnsysctl cat /proc/net/np6xlite_0/ipsec-ob0
fnsysctl cat /proc/net/np6xlite_0/ipsec-ib0
fnsysctl cat /proc/net/np6xlite_0/osw
fnsysctl cat /proc/net/np6xlite_0/fos-perf
fnsysctl cat /proc/net/np6xlite_0/msg
diagnose npu np6xlite register 0
fnsysctl cat /proc/net/np6xlite_0/capwap-stats
fnsysctl cat /proc/net/np6xlite_0/hpe_dce_qs
fnsysctl cat /proc/net/np6xlite_0/lacps
fnsysctl cat /proc/net/np6xlite_0/tce
fnsysctl cat /proc/net/np6xlite_0/tpe
fnsysctl cat /proc/net/np6xlite_0/vlif
fnsysctl cat /proc/net/np6xlite_0/mibs/gigeN

If possible, please also share your configuration. I will attempt to reproduce the issue in my lab based on the configuration and the log outputs from the commands mentioned above.

Thank you

Bill

[IT_Histoindex]

Hi @BillH_FTNT 

1. Yes, is running speed test for testing. 

2.I'm only apply web filtering and default SSL-inspection running the test.

3. Output one for diagnose sys session list 

[funkylicious]

hi,

for point 3 i think that Bill wanted to see the session for the speed test. in your output there's only a DNS query :)

you should do this while performing the speedtest and find in the list the connection towards the specific destination speedtest server then copy/paste it here.

here's more info about the command and certain filters you can put to easier get that info : https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-session-table-information/... 

[IT_Histoindex]

Hi, now I upload or download files from Dropbox. What destination server it is? If like that what command should I use to get the output? No familiar with the command. 

[funkylicious]

it would be easier to filter by source ip where you initiate the traffic/have issues.

after you set the filter, initiate the traffic in question and then do a diag sys session list, this will narrow the list. you can also do a ping <> to see to what IP the DNS resolves dropbox.com and maybe you will find the same dst IP in the list.