IPSec VPN throughput

[#1]

We have a Fortigate 200 between our LAN and a 15Mb internet connection. At an offsite location, we have a 6Mb circuit. Using a laptop and Forticlient at the offsite location, we are unable to get more than 1.95Mb/s through the VPN with FTP transfers. (and only 750Kbps with Windows file copy). When not using the VPN, each site can get 4Mb/s+ , as tested through large file transfers and bandwidth testing websites. We are not maxing out the bandwidth at either site, so traffic shaping is not in play. Fortigate Technicians have told us everything from " enable traffic shaping" to " each policy must have a priority" . We have tried traffic shaping with what little documentation is available, but it made no difference in throughput. (if you know of any traffic shaping documentation, that would be appreciated too) We have no trouble connecting to the VPN, and no trouble maintaining the connection. Pings are 30ms or better. Fortigate CPU util hasn' t gone over 20% and memory usage doesnt exceed 50% during our tests. I realize IPSec has some overhead associated with it, but I wouldn' t figure it would be that much. With plans to use a Fortigate60-Fortigate200 hardware VPN between these sites, I would like to be sure this isn' t going to be an issue. If anyone has had any experience solving this type of issue, I would appreciate your input. Thanks!

[vanc]

You can check your PC' s CPU usage. If it reaches 100% when doing the file copying, it means your hardware is not powerful enough. This is true if you are using 3DES. The client will use your CPU to do the math and takes a lot of CPU time. You can try to switch to AES128 to see if you get better throughput.

[#3]

The laptop' s CPU utilization hovers around 12% with an occasional peak at 20%

[#4]

Are your Internet connections synchronous ones? I mean 15 MB up and down? Are the test of that 4 MB from to site one to site two?

[romanr]

IS there lot of packet-fragmentation happening? I have seen VPN bandwidth often goes down due to wrong MTU sizes....

[#6]

Our connections are synchronous. I' ve tested upload speeds from each site, but not directly to each other. I have tested the packet fragmenting with the " ping -f" tests and it' s ok.

[UkWizard]

Sounds about right to me, dont forget a 15mb internet connection is MegaBIT not MegaByte, therefore its approx about a tenth of the actual transfer speed. For example, if you have a 1mb internet connection, you will max at download speeds of 120kb/s (approx) not a download speed of 1000kb/s (aka 1mb). Hope this makes sense.

[#8]

You' re right. So 750 KB with Windows is about normal when you take into account that the slowest connection is 6 Mbit. The 1,95 MB achieved with FTP is due to the compression in the FTP.

[UkWizard]

I suspect the FTP speed test was via the 15mb connection, like a web download. thus the speed is about right (ish).

[#10]

The transfer rates I mentioned above are 750kilobits/sec( 0.732421875megabits/s) and 1.95 megabits/s.