Hi,
First time poster here, so hopefully I got the most appropriate thread.
I have just purchased a Fortigate 600c firewall to route my home office network to the internet. I have two ISPs and am on a 1Gb plan with both of them.
When I connect the basic routers that were provided from each ISP I get close to what is promised 900 Mb+. However, when I run my connections through the Fortigate, I am only getting circa 500 Mb. (As tested using Speedtest.net)
I previously had a Fortigate 200b, which gave me the same speeds, and while investigating I noted that the CPU of the fortigate was maxing out. Actually, initially I was getting slower speeds but after turning off logging it increased to around the 500 mark.
I thought okay, the CPU isn't powerful enough to handle what I wanted, so I kept an eye out for a second hand later model when I found the 600c being sold locally. Checking the specs on the 600c and seeing that it has 2.5 Gbps IPS I thought this would be powerful enough to give me closer to the 1 Gbps speeds.
Is there any way I can tweak the fortigate to get better performance, or does anyone have any ideas as to why I am not getting the speeds as advertised?
I'm running FortiOS 5.4, not using WAN LLB (as I require VPN). Other than this the Fortigate is functioning as I require;
* Seperate Network for myself and my flatmates (I can't have them accessing the VPN to work)
* Traffic routed through specific ISP for specific tasks (Mail through one, other traffic through another)
* Reverse Proxy
Thanks
Brent
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
From a Windows work station:
Get to the command prompt ("CMD" from the start box/globe thing)
In the open window, type:
C:\windows\system32> ping -f -l <packet size> <IP address>
The Ethernet packet size on the WAN maxes out at 1500, so start there and decrease until you get a valid response. The "-f" tells the network to not fragment the packets. This will prevent the ping from happening until the entire PING packet can be transmitted. When you get this number, set this on your WAN interface in the GUI. This will then enable communications over the Internet without either end having to break down and reassemble the traffic to traverse the Internet.
Hope that helps.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
I would have checked first if this phenomenon is connected to the WAN port and/or protocols.
Please run a performance test between 2 hosts on your LAN, both with GbE ports, AV disabled. I usually use iperf for this as the same exe-file contains the server and the client.
You should see wirespeed here.
If you don't there is a problem within FortiOS such as the traffic offloading to the network ASIC (NP) being disabled. Have you reset the unit after purchase to factory defaults ("exec factoryreset") before configuring it? Beware that this command will delete all of the config.
If you do see wirespeed between LAN ports I would investigate the WAN protocol used. How do you connect to your IPS(s)? DHCP, PPPoE, static IP? There is a known gotcha with PPPoE processing in FortiOS. Cheap but dedicated WAN routers use a special chip to handle the protocol, FortiOS doesn't. It might well suck up the CPU performance if the WAN line speed is in excess of 100 Mbps for desktop models, higher speeds for multi-core FGTs like yours.
The 600C itself is very capable, with decent memory size, content ASIC (CP) and network ASIC (NP) for offloading chores off the CPU. CPU will mostly handle session setup, negotiations (IPsec, SSLVPN, PPPoE, DHCP), logging and GUI. Plus some more but will usually stay out of the way of running session traffic. That's why you would expect wirespeed performance on GbE ports. IMHO the specs on the datasheet come quite close to realworld figures.
Lastly, if you're running FOS v5.4 do update to the latest build (v5.4.6). Each patch version will fix some bugs and possibly improve throughput (while adding features which introduce more bugs...). For a used unit without contract this will be, hm, difficult but you may well ask FTNT for a contract. FortiCare will do (firmware updates, warranty extension) but of course FortiGuard would be more beneficial for you (AV, IPS, botnet IP blacklist, webfilter,...). If such contracts are no longer available from the regular price list you could ask FTNT for a 'coterm quote'.
Happy testing!
Oh yeah, CLI is like this:
config system interface
edit <interface_name>
set mtu-override enable
set mtu <byte_size>
end
So I found that my ISP "likes" packets sized @ 1472, however, that hasn't changed my laggy speeds or bufferbloat. Any other suggestions? I too have tried my other router(s) and CPU/utilization on the fortigate look healthy during testing.
Ok, so the mtu size after ping tests was 1472, once I set it to 1472, the max size after ping test dropped by 28 again, something in the fortigate is causing it to drop by 28 (100-28=72, 72-28=44, etc).
What I am doing is setting the max mtu on the wan1 interface which is pointing to my ISP. What is that 28 byte overhead?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.