Max bandwidth on Fortigate 620B? Only getting 120Mb/s second through it.

[fruit_company]

I' m just curious if anyone else has had the same experience. I' ve got a Fortigate 620B with ASM. It' s got a 1G fiber connection to our LAN core (untrusted side) and a 1G fiber connection to a private switch on the trusted side. It seems like the maximum bandwidth through the firewall downloading from the trusted side caps out at about 120Mb/s. This firewall is running at 1% CPU. All links from the client to the switch, switch to firewall, and firewall to LAN core are running at 1G, zero interface errors on all. Super-simple rule set. Literally allow all from the trust side to the untrust side (NAT' d). I can' t find anything that looks like a choke point other than the firewall. Clients can pull way over 120Mb/s locally. One hop later (through the firewall directly to a host on the same subnet as the outside interface) WHAM... down to 120Mb/s. Just to add: there is no other traffic passing inter-firewall across other interfaces. It' s straight from inside to outside. Running: Firmware Version v4.0,build0496,111108 (MR3 Patch 3)

[Dave_Hall]

and firewall to LAN core are running at 1G, zero interface errors on all.

I' m going to assume both sides of the connection are running at the same duplex/speed and you have tested for such? How did you perform the tests to confirm there were no errors? (e.g. diag hardware deviceinfo nic <interface>)

[FortiRack_Eric]

Looks indeed like a speed/duplex issue as Dave said or a MTU issue. For most fiber ISP the MTU is 1492. To be sure / test conf sys interface edit <external port> set mtu override enable set mtu 1492 end

[ede_pfau]

Looking at the firmware version, I' d strongly recommend upgrading. Patch 3 was one early version of the then brand new MR3 release, and if I remember correctly, MR3 was bug ridden at the beginning. No comparison to the current MR3 patch 15. I wouldn' t be too surprised if Fortinet had optimised for speed only in later patch releases.