SSL VPN Speed

[sensorsinc]

Hello, I was wondering what kind of speed / performance others are getting with the SSL VPN in tunnel mode. I have a FortiGate 80C and a 10Mbps Internet connection. I have been running some download speed tests. I' m downloading a folder containing 129 files with a grand total of 130 MB. On a 4G WiFi (12,000 kbps), it takes 12 minutes to download which works out to 1,444 kbps. On a Comcast line (14,000 kbps), it takes 9 minutes 30 seconds which works out to 1,824 kbps. The 4G & Comcast speeds are based on speeds tests from DSL Reports. So even if you take those with a grain of salt, I still expect the download speed to closer match my slowest connection. At least on the Comcast line I would expect higher, double for example. I talked to a Fortinet consultant at a trade show who said to check my CPU% because 80C' s vpn is totally software based and doesn' t have a special chip (n2p?) to accelerate VPN performance. So I did that and the CPU percentage number got more than 14%. He thought if the CPU was limiting, the % would jump to 100%. What kind of file transfer speeds are others getting via SSL VPN? Or does anyone have any tips (other than lowering encryption) to get more speed out of it? Thanks, Jamie

[vanc]

The configuration of VPN policies may affect the throughput. You can try different cipher strength. And don' t enable any UTM features, such as IPS, AV.

[rwpatterson]

Cipher strength has a much smaller bearing on the bigger boxes. My 1000A didn' t see any difference between 3DES or AES.

[vanc]

Both 3DES and AES are hardware accelerated. On low end models, you may not have new CP build-in. That should affect affect the performance, to some extent. UTM features have much more effect on the throughput.

[emnoc]

If you want to match fortinet testing, than you might want find out what/how they test and via what protocol. TCP is not a protocol I would use for benchmarking encrypted fw performance btw

[sensorsinc]

This weekend I ran another test. PC->WAN1->80C->Internal1->Gigabit Switch->Server It still took me 3 minutes and 12 seconds. 5,400 Kbps which matched the traffice history graph. CPU was never above 15% and memory 31%. Immediately after, I ran this test PC->Gigabit Switch->Server That took 7 seconds. There is no UTM turned on anywhere. The encryption is default. But my speeds are a third of what Selective got with a 60C. Anyone have any ideas of what else I should check? I don' t expect to hit 50 Mbps (spec) but I should be able to match/beat 15MBps (Selective' s 60C).

[rwpatterson]

Are all ports GBit?

[sensorsinc]

@vanc I checked the network utilization and it matched the speed I was getting. And I know it can handle higher speeds since it works fine on the LAN. Now I didn' t check CPU% but I would be shocked if my i7 (2nd Gen) 2.2 GHz quad core CPU was strained. But I will check that. Thanks for the info! @rwpatterson Yes, with one exception. The server has two teamed Gigabit ports which are plugged into a Gigabit switch. The 80C is plugged into the same switch. Internal1 on a 80C is just a 10/100, hence the one exception. The WAN port is Gigabit. Finally, my laptop has a gigabit card.

[vanc]

The official spec for SSL VPN throughput is, unfortunately, the web portal speed. NOT the tunnel mode throughput. My resource told me that tunnel mode speed depends on the PC side. PC' s CPU and network card may be different and it' s not possible to obtain a meaningful value. You can check your PC' s CPU usage and see if there are bottlenecks somewhere.