Odd Performance Issue

[SecurityPlus]

We have a FortiWiFi serving about 8 users running FortiOS 6.04. The bandwidth at the location is fast: 300/20. The firewall is set to Proxy. We noticed on about 4 different occasions that when trying to download a file from a remote server (connected via WAN1) that the download would take an exceptional long time or would fail. This occurred on multiple computer on the network, different browsers, different source servers, over a number of days. This happened even when no other activity was taking place on the network at the time.

We finally did some testing. We noticed that when downloading with AV and Web Filter security profiles Off in the IPv4 Policy that the download speed was about 18 Mb/s. With either AV and Web Filter security profiles On in the IPv4 Policy the download speed was initially 1 Mb/s. After about a minute though the speed would fall from 1 Mb/s all the way down to 5 Kb/s.

We further isolated the performance impact to the HTTP inspection in the AV Profile. Concerning the Web Filter, it did not matter how much or how many filters were turned on to create the very low download speed problem.

Support recommended setting the AV and Web Filter Profiles to Flow inspection. Doing this increased the download speed to 7 Mb/s. This is still less than 1/2 of the speed without AV or Web Protection running. I would prefer instead to use Proxy inspection but it appears to slow the download down excessively.

Have others encountered this issue? Is this normal for a FortiWiFi 60D? Any suggestions?

[SecurityPlus]

Does anyone have any feedback concerning what the download speed typically is with a 60D if the internet connection is 20 Mb/s? I know that with AV and Web Protection that it will be less, just not sure how much less is normal.

[rwpatterson · Accepted solution]

I would start with the basics. Does the duplex match on the interface with your ISP? A duplex mismatch would severely hamper your speeds in both directions. from the CLI (I'm doing this from memory, so please don't hang me if it's not quite right):

FGT# diag hard dev nic wanx (replace with your WAN port)

Check for errors in the output. Also you will see what speeds your are connected at. Half duplex would be a major problem here.

IMPORTANT NOTE: Don't do this from the remote side. You may lock yourself out if the duplex modes don't sync up. You'll then be in a rush to get back to the office to correct it!

[SecurityPlus]

Bob,

Thank you for the suggestion!

How do the settings below look to you? Duplex is set to Full. I don't notice any errors.

Here are the results of your command:

Acme_1 # diagnose hardware deviceinfo nic wan1

Description     :FortiASIC NP4LITE Adapter

Driver Name     :Fortinet NP4Lite Driver

Version         :1.0.0

Admin           :up

Current_HWaddr   08:5b:0e:21:0a:58

Permanent_HWaddr 08:5b:0e:21:0a:58

Status          :up

Speed           :1000

Duplex          :Full

Host Rx Pkts    :304137957

Host Rx Bytes   :3913571314

Host Tx Pkts    :284700851

Host Tx Bytes   :4068856796

Rx Pkts         :366785869

Rx Bytes        :96457245

Tx Pkts         :334841967

Tx Bytes        :731838757

rx_buffer_len   :2048

Hidden          :No

cmd_in_list     : 0

promiscuous     : 1

enabled 802.1x  : 0

authorized      : 0

mac bypass      : 0

[SecurityPlus]

By the way, this I believe is a Spectrum cable 300/20 cable connection.

[rwpatterson]

Sorry for the delay. Crazy 24 hours. All looks well. Not sure where to proceed from here.

[SecurityPlus]

Does the performance appear to be lower than the performance that a 60D should provide? That way my estimate but I don't have as much experience as many others on the forum have.

[rwpatterson]

Is there any way you could duplicate the port and run Wireshark on the traffic? That would nip all this in the bud...

[SecurityPlus]

I have not used Wireshark in a good while but I could try this. Is there anything in particular that you would suggest that I look for using Wireshark?

Thanks!