Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
SecurityPlus
Contributor II

Odd Performance Issue

We have a FortiWiFi serving about 8 users running FortiOS 6.04. The bandwidth at the location is fast: 300/20. The firewall is set to Proxy. We noticed on about 4 different occasions that when trying to download a file from a remote server (connected via WAN1) that the download would take an exceptional long time or would fail. This occurred on multiple computer on the network, different browsers, different source servers, over a number of days. This happened even when no other activity was taking place on the network at the time.

 

We finally did some testing. We noticed that when downloading with AV and Web Filter security profiles Off in the IPv4 Policy that the download speed was about 18 Mb/s. With either AV and Web Filter security profiles On in the IPv4 Policy the download speed was initially 1 Mb/s. After about a minute though the speed would fall from 1 Mb/s all the way down to 5 Kb/s.

 

We further isolated the performance impact to the HTTP inspection in the AV Profile. Concerning the Web Filter, it did not matter how much or how many filters were turned on to create the very low download speed problem.

 

Support recommended setting the AV and Web Filter Profiles to Flow inspection. Doing this increased the download speed to 7 Mb/s. This is still less than 1/2 of the speed without AV or Web Protection running. I would prefer instead to use Proxy inspection but it appears to slow the download down excessively.

 

Have others encountered this issue? Is this normal for a FortiWiFi 60D? Any suggestions?

1 Solution
rwpatterson
Valued Contributor III

I would start with the basics. Does the duplex match on the interface with your ISP? A duplex mismatch would severely hamper your speeds in both directions. from the CLI (I'm doing this from memory, so please don't hang me if it's not quite right):

 

FGT# diag hard dev nic wanx (replace with your WAN port)

 

Check for errors in the output. Also you will see what speeds your are connected at. Half duplex would be a major problem here.

 

IMPORTANT NOTE: Don't do this from the remote side. You may lock yourself out if the duplex modes don't sync up. You'll then be in a rush to get back to the office to correct it!

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

View solution in original post

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
8 REPLIES 8
SecurityPlus
Contributor II

Does anyone have any feedback concerning what the download speed typically is with a 60D if the internet connection is 20 Mb/s? I know that with AV and Web Protection that it will be less, just not sure how much less is normal.

rwpatterson
Valued Contributor III

I would start with the basics. Does the duplex match on the interface with your ISP? A duplex mismatch would severely hamper your speeds in both directions. from the CLI (I'm doing this from memory, so please don't hang me if it's not quite right):

 

FGT# diag hard dev nic wanx (replace with your WAN port)

 

Check for errors in the output. Also you will see what speeds your are connected at. Half duplex would be a major problem here.

 

IMPORTANT NOTE: Don't do this from the remote side. You may lock yourself out if the duplex modes don't sync up. You'll then be in a rush to get back to the office to correct it!

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
SecurityPlus

Bob,

 

Thank you for the suggestion!

 

How do the settings below look to you? Duplex is set to Full. I don't notice any errors.

 

Here are the results of your command:

 

Acme_1 # diagnose hardware deviceinfo nic wan1
Description     :FortiASIC NP4LITE Adapter
Driver Name     :Fortinet NP4Lite Driver
Version         :1.0.0
Admin           :up
Current_HWaddr   08:5b:0e:21:0a:58
Permanent_HWaddr 08:5b:0e:21:0a:58
Status          :up
Speed           :1000
Duplex          :Full
Host Rx Pkts    :304137957
Host Rx Bytes   :3913571314
Host Tx Pkts    :284700851
Host Tx Bytes   :4068856796
Rx Pkts         :366785869
Rx Bytes        :96457245
Tx Pkts         :334841967
Tx Bytes        :731838757
rx_buffer_len   :2048
Hidden          :No
cmd_in_list     : 0
promiscuous     : 1
enabled 802.1x  : 0
authorized      : 0
mac bypass      : 0
SecurityPlus

By the way, this I believe is a Spectrum cable 300/20 cable connection.

 

rwpatterson
Valued Contributor III

Sorry for the delay. Crazy 24 hours. All looks well. Not sure where to proceed from here.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
SecurityPlus

Does the performance appear to be lower than the performance that a 60D should provide? That way my estimate but I don't have as much experience as many others on the forum have.

rwpatterson
Valued Contributor III

Is there any way you could duplicate the port and run Wireshark on the traffic? That would nip all this in the bud...

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
SecurityPlus

I have not used Wireshark in a good while but I could try this. Is there anything in particular that you would suggest that I look for using Wireshark?

 

Thanks!

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors