i want to setup an ipsec tunnel adjusted for stability and best performance/throughput, ignoring security. the security is not a requirement here
fortigate 200e. what's the best settings and proposal needed for best performance and stability, while ignoring security?
thank you
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I would look at GCM vrs CBC ciphers for performance but the impact might not be that much of anything, but overhead would be less with Galios Counter Mode take a look at "suite-b-gcm-128/256"
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/238852/encryption-algorithms
YMMV
Ken Felix
PCNSE
NSE
StrongSwan
Quite a broad question...mainly you're asking for 'best practices'.
1- performance
You can only reduce performance by choosing proposals (phase1 and phase2) which are not hardware-accelerated. ATM AES256 is deemed secure, costs less performance than 3DES (ugh) and is run on the SP (ASIC), that is, accelerated.
I'd rather stay away from EC proposals.
2- stability
Is IMHO mainly dependent on line stability. If the WAN line glitches, an IPsec tunnel has to renegotiate. (Which BTW reduces throughput as well.).
But you can plan for more stability in the network design. Use redundant tunnels and monitor connectivity with link-monitors. If set up correctly, this minimizes downtime. See to it that switching between tunnels is delayed (with hysteresis) to avoid flapping.
In FortiOS 5.6 and esp. 6.0 and 6.2 you can achieve all of this with the SD-WAN construct. Recommended.
And one last stability hint: do not use the latest, bleeding-edge firmware version. You never do. v6.0.6 is stable and secure.
thank you
so about performance, a good choice with 200e will be aes256 with md5, right?
and about stability, i only have only 1 wan in each side, so the only stability is as good as the stability of my wan lines on each side, right?
I would look at GCM vrs CBC ciphers for performance but the impact might not be that much of anything, but overhead would be less with Galios Counter Mode take a look at "suite-b-gcm-128/256"
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/238852/encryption-algorithms
YMMV
Ken Felix
PCNSE
NSE
StrongSwan
yes, it looks like the 128gcm provides the best results, thank you sir. i'll keep track of it over time
Please drop MD5 from your list of hash algos. Use SHA1 or better still, SHA256. MD5 has been compromised before.
Again, I'm not sure that the higher SHA algos are hw accelerated (though they are supported in FortiOS).
Seems they are, up to SHA512 (cf. KB article).
aria, seed, aesXXXgcm all cannot be offloaded. CPU will have to do that which forfeits one major advantage of a Fortigate.
You'll notice that some algos are not offloaded in phase1 but are in phase2. No idea why.
In addition to the "Encryption" chapter, have a look at the preceding chapter "ASIC offloading" in the Cookbook.
And in encryption, do not use DES or 3DES.
And all of your other assumptions are correct.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.