Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sysadm
New Contributor

Hardware for a 200 Mbps ipsec tunnel

Hi:

 

I wonder what kind of hardware would you recommend in order to support a 200 Mbps ipsec tunnel.

 

It will be a single tunnel between 2 metropolitan locations, FTTH links with 200 upload / 200 downoad capability, i have one of this links already, with less than 7 milliseconds of ping round trip side to side of the tunnel (same provider on both sides), on this link i already have two FG100Ds, with very low cpu usage, no utm, just vpn, and it ´s giving me 60 Mbps more or less in a ftp transfer.

 

So, my questions are:

 

1.-Is this 60 Mbps ftp transfer rate acceptable?, given the hardware and the latency?

 

2.-Are there any other factors missing?

 

3.-Will a fortigate 200 improve the transfer speed?

 

any toughs or recommendations?

 

Thanks in advance

 

Victor

 

 

7 REPLIES 7
rwpatterson
Valued Contributor III

I would suggest using a program such as iperf which is basically a bandwidth capacity tool. There isn't much overhead as there may be with FTP. Also, try futzing with the encryption and compression on both sides. That may help as well. Thirdly, force your external ports to the speed your ISP is providing, if you haven't done that already.

 

My two cents

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
sysadm

Thanks for you comments, i will try them, at this time i´m using 3DES-SHA1 DH5.

Speed tests on normal internet traffic (not vpn), are showing 180 mbps

Regards

rwpatterson
Valued Contributor III

90% on an Internet speed test is pretty solid. I would be pleased with that. The other 10% is more than likely just overhead and congestion.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
sysadm

I agree, let me find a window to make some aditionals tests, and will post the results, thanks

sysadm
New Contributor

Hi:

 

Just want to update this post.

 

I have conducted some tests on the mentioned scenario, i can confirm that FG100D can forward 200 mbps ipsec tunnel without problems, the test was conducted on a live working environment, here is the main data

 

Internet links: 200 mbps simetric on both sides, on the same city

Firewalls:   FG100D

IPSEC: 3DES-SHA1 DH2 for phase1 and phase2

Software used:   iperf3

CPU on Diag Sys Top during test: 0U, 0N, 16S, 84I;

iperf3 results:

[ ID] Interval           Transfer     Bandwidth [  4]   0.00-1.01   sec  22.1 MBytes   183 Mbits/sec [  4]   1.01-2.01   sec  23.4 MBytes   196 Mbits/sec [  4]   2.01-3.01   sec  19.8 MBytes   166 Mbits/sec [  4]   3.01-4.01   sec  22.1 MBytes   186 Mbits/sec [  4]   4.01-5.01   sec  21.2 MBytes   179 Mbits/sec [  4]   5.01-6.01   sec  21.8 MBytes   183 Mbits/sec [  4]   6.01-7.00   sec  23.1 MBytes   194 Mbits/sec [  4]   7.00-8.00   sec  21.1 MBytes   177 Mbits/sec [  4]   8.00-9.00   sec  20.1 MBytes   169 Mbits/sec [  4]   9.00-10.02  sec  19.0 MBytes   157 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval           Transfer     Bandwidth [  4]   0.00-10.02  sec   214 MBytes   179 Mbits/sec                  sender [  4]   0.00-10.02  sec   214 MBytes   179 Mbits/sec                  receiver iperf Done.

 

 

 

So we can conclude that this harwdare is enough, of course mileage may vary with the application, but that´s another story, thanks for the help and ideas!

 

 

 

 

 

 

 

 

ede_pfau
Esteemed Contributor III

While having set up a testing environment...if you substitute AES for 3DES, will that reduce the CPU footprint? In theory, AES is less computationally intensive; but both 3DES and AES are usually offloaded to the NP ASIC, bypassing the CPU.

This would be the one rare moment to gain insight...


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
sysadm

I agree...

 

I´m going to do another tests in the next weeks, switching 3DES to AES, then we will know a little bit more, thanks for the comments

Labels
Top Kudoed Authors