Traffic taking to much time

[Silver]

Dear all,

anyone can advise to me about this issue, in my network the intervlan routing is being done by the firewall. i have an application server on a server vlan and users on different vlan. while the users access the server application is taking to much time to generate the same process while if we are doing the process withing the server vlan itself its very quick. 

anyone can advise me on it if its a firewall issues etc.

Thank

[jb_kalm]

Hi, you should check the Traffic logs and see if any traffic is being blocked from client to server. It may be that you need to open up some more ports. 

Thanks,

jb

[rwpatterson]

Also check the amount of traffic being passed. If the application uses large amounts of data, the problem may be that the same VLAN traffic is being passed through GB ports while the inter VLAN traffic is passing through fastE ports. That would make a significantly different appearance to the end user.

[ashukla_FTNT]

Check the following:

1) Speed/Duplex of firewall interface and the connected switch interface

2) Do a ping test and make sure mtu is not less then 1500

     ping -f -l 1472 server ip

If you get any message the packet needs to be fragmented but df bit is set that means the mtu is less than 1500.

suppose if you are able to ping with size 1400 but not with 1401 that means mtu is 1400+28(ip and icmp header)=1428.

3)Either fix the mtu in network device or set the tcp mss in firewall poiicy to 1428-40=1388

4) Is the traffic between client and server asymmetric

5) Cpu/memory utilization in firewall

6) Do a wireshark capture in client pc and server (if possible) and upload it here

[Silver]

Hi all,

Thank for your input, what is the tcp mass in policy and how to modify it plz

Thanks

[ashukla_FTNT]

TCP mss (Maximum Segment Size) is a parameter in packet which defines the maximum layer 4 payload size. By default it will 40 bytes less than MTU. So if a pc's MTU is by default 1500 it will send MSS as 1460.

By this parameter the PC can notify the remote end the maximum size of Layer4 payload it can receive.

If there is lesser mtu in network and the client pc is not aware it will send MSS as 1460, so server thinks the client can receive 1500 (1460 layer4 +20 ip +20 tcp) and send 1500 size of packet. Now if MTU is less somewhere in path the packet can be fragmented or if DF (don't fragment) is set packet can be dropped which was cause delay and slowness

To avoid such situations we can configure tcp mss for sender and receiver in firewall policy. By doing this firewall will modify the tcp mss sent by client/server in tcp syn/syn-ack packet so the remote end receives  a smaller mss and sends smaller packets.

We should always do the ping test to find the mtu and then reduce 40 form that value and set that as tcp-mss in policy.

To change the tcp-mss in Fortigate  do the following:

config firewall poicy

edit <policy id of the related policy>

tcp-mss-sender <mss value>

tcp-mss-receiver <mss value>

tcp-mss sender will modify tcp mss in tcp syn packet

and tcp-mss-receiver will modify tcp mss in syn-ack packet

[Silver]

thanks issue sorted out!!

[rwpatterson]

Well? What was it? Curiosity is killing me!

[ashukla_FTNT]

rwpatterson wrote:

Well? What was it? Curiosity is killing me!

Even I am curios :)

[Silver]

tcp-mss