Slow VPN connections

[ITworks]

He recently upgraded from a FortiGate 80E to a 200F. Running version 7.4.1 .

The config has been rewritten manually to match the different interfaces.

Everything went well, but recently we are seeing a serious slowdown in VPN traffic:

The internet connection is 1000/300Mbit/s.
With a speed test from an internal server, we are reaching this speed without problems.

When connected via VPN -no matter if SSLVPN, Client IPSEC or Site-to-Site IPSEC, we only get speeds of 5-10Mbit/s in both directions, measured via iPerf3.

iPerf3 to an internal server directly executed on the FortiGate shows about 4GBit/s.

All traffic shapers have been deactivated for testing purposes.

All additional functions like Antivirus, IPS... are disabled on the SSLVPN policy (ssl.root->lan).

I don't have any clue why all VPN connections are that slow... anyone has an idea?

[ITworks]

Hi @netmin_02 

we use two WAN connections:
a local Fiber provider which ist "M-Net" (1000 Mbit down, 300 Mbit up) and

a Vodafone cable connection which is only used for guest internet/backup.
In both cases there is a FritzBox as router, and the Fortigate Interfaces are configured as "exposed host" so all traffic is being forwarded to the FG.
In both cases there is separate NAT, so the real external IP is on the FritzBox Router.

Best, Florian

[netmin_02]

I had the same problem. The wan settings are the same as yours. The problem was with the router/firmware in front of the FG. The router dropped the bandwidth only in vpn tunnels.

[BillH_FTNT]

Hi @ITworks and all.

Please check the new temporary workaround for 7.4.2, 7.4.3 in this link : 

FortiOS 7.4.2 Bug Causes IPsec VPN Tunnel Phase 2 ... - Page 4 - Fortinet Community

HTH

[ITworks]

@netmin_02thats very interesting. We will check if SSLVPN from the "transfer network" between the FritzBox Router and the Fortigate makes any difference, and report here. Thank you!

[ITworks]

@BillH_FTNTthank you, I red this post and it just mentions IPSEC unstability... SSLVPN seems not affected (or not tested). If it's not really the router, we will have to consider downgrading to a previous FG firmware... will report here.

[ITSBM]

@ITworks 

It's fascinating that we use the same setup and have encountered similar issues with SSL VPN (Fortigate 200F + Fritzbox 5490 + Fiber Speed Download: 500 Mbit/s Upload: 400 Mbit/s). Today we upgraded to version 7.4.4 and observed a slight improvement in performance (previously 5 Mbit/s Download 50 Mbit/s Upload, now 35 Mbit/s Download 50 Mbit/s Upload). Have you already carried out a test on the transmission network or found another solution?

[Tahsin]

Hi ITworks,

Maybe use DTLS can solved your problem.I shared  document below how can apply DTLS on your VPN

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-DTLS-to-improve-SSL-VPN-performance/...

Tahsin

[ITSBM]

Hi @Tahsin 

We have already tried activating DTLS. Unfortunately, this did not bring any significant improvement. While there were issues with DTLS before version 7.4.4 which should now be resolved, the speed problem persists in version 7.4.4 with or without DTLS enabled.

[Waloo5]

Hello,

I have semilar issue With 2 fortigates 300E and 200F connected with sdwan 3  and 2 ISP connexions.

Ticket Was opened but no solution. Any help?!!!