Slow web browsing performance

[goftari]

Here' s how my scenario looks like: We had a Mikrotik RB1000 as our network edge with two Internet connections (one through an IPIP tunnel [2 Mbps] which was replaced by a GRE tunnel as IPIP tunnel cannot be set on Fortigate and it supports GRE, and the other through a dedicated fiber which is connected to Mikrotik from a line terminal [1.5 Mbps]). When I configured load balancing on Mikrotik, I experienced faulty web performance, after searching Mikrotik forums I figured out it was a fragmentation problem which was fixed by changing TCP syn packages' MSS (Max Segment Size) larger than 1360 to 1360 in forward chain. Now we have replaced our Mikrotik RB1000 with a Fortigate 311B configured load balancing on those two Internet connections on Fortigate; We' re experiencing the same faulty web browsing performance; What should I do? I know it is possible to set tcp-mss on Fortigate interfaces and I' ve done that but it didn' t solve my problem. Setting tcp-mss is different from setting MSS for only tcp syn packages, isn' t it?

[rwpatterson]

' Crappy' web browsing performance can be a result of several issues:

Check your WAN interface for duplex mismatch

diag hard dev nic <port>

Check for fragmentation (as you already stated). From Windows:

ping <internet host> -l <packet size> -f 

Start at 1500 (the max) and decrease until you find the largest size that fits through the pipe.

Check your DNS server. I used this app: DNS Benchmark from GRC Research. You' ll be amazed at how much a slow DNS server can affect the browsing experience...

[goftari]

Thanks for your prompt and accurate reply Bob! As declared here, I did set tcp-mss to 1440 on the GRE tunnel; so is it necessary to also set MTU to a smaller value? as I mentioned there is a boolean MTU-override option available on the GRE tunnel. should I reduce the MTU size on the interface through which the tunnel is established and set this option to true?

[rwpatterson]

I' m not sure, but it couldn' t hurt.

[goftari]

yep it worked. I did set the MTU on the interface through which the GRE tunnel is conencted to 1470 and did set MSS on both the interface and the tunnel to 1360. I' ve got smooth web browsing performance

[rwpatterson]

Very nice. Glad it all worked out.

[FortiRack_Eric]

TCP-MSS = MTU - 40.

[goftari]

I know the formula, but will it hurt not to conform to the formula? Do you suggest lowering the MTU value or increasing the MSS value? Thanks

[FortiRack_Eric]

No, just as a matter of fact. You can use your line better with bigger packet sizes that' s all. cheers, Eric

[goftari]

Thanks I took your advice. Now I have a MTU size of 1470 and TCP-MSS set to 1430