Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
fruit_company
New Contributor

Max bandwidth on Fortigate 620B? Only getting 120Mb/s second through it.

I' m just curious if anyone else has had the same experience. I' ve got a Fortigate 620B with ASM. It' s got a 1G fiber connection to our LAN core (untrusted side) and a 1G fiber connection to a private switch on the trusted side. It seems like the maximum bandwidth through the firewall downloading from the trusted side caps out at about 120Mb/s. This firewall is running at 1% CPU. All links from the client to the switch, switch to firewall, and firewall to LAN core are running at 1G, zero interface errors on all. Super-simple rule set. Literally allow all from the trust side to the untrust side (NAT' d). I can' t find anything that looks like a choke point other than the firewall. Clients can pull way over 120Mb/s locally. One hop later (through the firewall directly to a host on the same subnet as the outside interface) WHAM... down to 120Mb/s. Just to add: there is no other traffic passing inter-firewall across other interfaces. It' s straight from inside to outside. Running: Firmware Version v4.0,build0496,111108 (MR3 Patch 3)
3 REPLIES 3
Dave_Hall
Honored Contributor

and firewall to LAN core are running at 1G, zero interface errors on all.
I' m going to assume both sides of the connection are running at the same duplex/speed and you have tested for such? How did you perform the tests to confirm there were no errors? (e.g. diag hardware deviceinfo nic <interface>)

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
FortiRack_Eric
New Contributor III

Looks indeed like a speed/duplex issue as Dave said or a MTU issue. For most fiber ISP the MTU is 1492. To be sure / test conf sys interface edit <external port> set mtu override enable set mtu 1492 end

Rackmount your Fortinet --> http://www.rackmount.it/fortirack

 

Rackmount your Fortinet --> http://www.rackmount.it/fortirack
ede_pfau
Esteemed Contributor III

Looking at the firmware version, I' d strongly recommend upgrading. Patch 3 was one early version of the then brand new MR3 release, and if I remember correctly, MR3 was bug ridden at the beginning. No comparison to the current MR3 patch 15. I wouldn' t be too surprised if Fortinet had optimised for speed only in later patch releases.

Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
Labels
Top Kudoed Authors