Hardware for a 200 Mbps ipsec tunnel

[sysadm]

Hi:

I wonder what kind of hardware would you recommend in order to support a 200 Mbps ipsec tunnel.

It will be a single tunnel between 2 metropolitan locations, FTTH links with 200 upload / 200 downoad capability, i have one of this links already, with less than 7 milliseconds of ping round trip side to side of the tunnel (same provider on both sides), on this link i already have two FG100Ds, with very low cpu usage, no utm, just vpn, and it ´s giving me 60 Mbps more or less in a ftp transfer.

So, my questions are:

1.-Is this 60 Mbps ftp transfer rate acceptable?, given the hardware and the latency?

2.-Are there any other factors missing?

3.-Will a fortigate 200 improve the transfer speed?

any toughs or recommendations?

Thanks in advance

Victor

[rwpatterson]

I would suggest using a program such as iperf which is basically a bandwidth capacity tool. There isn't much overhead as there may be with FTP. Also, try futzing with the encryption and compression on both sides. That may help as well. Thirdly, force your external ports to the speed your ISP is providing, if you haven't done that already.

My two cents

[sysadm]

Thanks for you comments, i will try them, at this time i´m using 3DES-SHA1 DH5.

Speed tests on normal internet traffic (not vpn), are showing 180 mbps

Regards

[rwpatterson]

90% on an Internet speed test is pretty solid. I would be pleased with that. The other 10% is more than likely just overhead and congestion.

[sysadm]

I agree, let me find a window to make some aditionals tests, and will post the results, thanks

[sysadm]

Hi:

Just want to update this post.

I have conducted some tests on the mentioned scenario, i can confirm that FG100D can forward 200 mbps ipsec tunnel without problems, the test was conducted on a live working environment, here is the main data

Internet links: 200 mbps simetric on both sides, on the same city

Firewalls:   FG100D

IPSEC: 3DES-SHA1 DH2 for phase1 and phase2

Software used:   iperf3

CPU on Diag Sys Top during test: 0U, 0N, 16S, 84I;

iperf3 results:

[ ID] Interval           Transfer     Bandwidth [  4]   0.00-1.01   sec  22.1 MBytes   183 Mbits/sec [  4]   1.01-2.01   sec  23.4 MBytes   196 Mbits/sec [  4]   2.01-3.01   sec  19.8 MBytes   166 Mbits/sec [  4]   3.01-4.01   sec  22.1 MBytes   186 Mbits/sec [  4]   4.01-5.01   sec  21.2 MBytes   179 Mbits/sec [  4]   5.01-6.01   sec  21.8 MBytes   183 Mbits/sec [  4]   6.01-7.00   sec  23.1 MBytes   194 Mbits/sec [  4]   7.00-8.00   sec  21.1 MBytes   177 Mbits/sec [  4]   8.00-9.00   sec  20.1 MBytes   169 Mbits/sec [  4]   9.00-10.02  sec  19.0 MBytes   157 Mbits/sec - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval           Transfer     Bandwidth [  4]   0.00-10.02  sec   214 MBytes   179 Mbits/sec                  sender [  4]   0.00-10.02  sec   214 MBytes   179 Mbits/sec                  receiver iperf Done.

So we can conclude that this harwdare is enough, of course mileage may vary with the application, but that´s another story, thanks for the help and ideas!

[ede_pfau]

While having set up a testing environment...if you substitute AES for 3DES, will that reduce the CPU footprint? In theory, AES is less computationally intensive; but both 3DES and AES are usually offloaded to the NP ASIC, bypassing the CPU.

This would be the one rare moment to gain insight...

[sysadm]

I agree...

I´m going to do another tests in the next weeks, switching 3DES to AES, then we will know a little bit more, thanks for the comments