SSL VPN Speed

[sensorsinc]

Hello, I was wondering what kind of speed / performance others are getting with the SSL VPN in tunnel mode. I have a FortiGate 80C and a 10Mbps Internet connection. I have been running some download speed tests. I' m downloading a folder containing 129 files with a grand total of 130 MB. On a 4G WiFi (12,000 kbps), it takes 12 minutes to download which works out to 1,444 kbps. On a Comcast line (14,000 kbps), it takes 9 minutes 30 seconds which works out to 1,824 kbps. The 4G & Comcast speeds are based on speeds tests from DSL Reports. So even if you take those with a grain of salt, I still expect the download speed to closer match my slowest connection. At least on the Comcast line I would expect higher, double for example. I talked to a Fortinet consultant at a trade show who said to check my CPU% because 80C' s vpn is totally software based and doesn' t have a special chip (n2p?) to accelerate VPN performance. So I did that and the CPU percentage number got more than 14%. He thought if the CPU was limiting, the % would jump to 100%. What kind of file transfer speeds are others getting via SSL VPN? Or does anyone have any tips (other than lowering encryption) to get more speed out of it? Thanks, Jamie

[Carl_Wallmark]

Hi, the Fortinet consultant is right, the SSL VPN is software based, however i was under the impression that the SSL VPN was offloaded to the CP6 chip, and the 80C does have one. The NP2 chip is good for pure firewalling and IPSEC VPN and first available FortiGate with a NP2 is the 200B. i did some tests with a FortiGate 60C between two computers in the same room, and the speed i got with MR2 was around 10 MB/s and the CPU was around 80-90%, then i tried the MR3 and got around 15-16 MB/s And notice that the 80C is more powerfull than the 60C.

[sensorsinc]

Good information, thanks Selective! Nice to know the hardware is capable of high speed SSL VPN if only in a " lab" environment. Would be interested in hearing some real world speed info.

[jmac]

Keep in mind that there may be dramatic differences in speed based on the protocol used and the access method: Are you using a SSL-VPN tunnel connection, or are you using the web portal to access files? Are you using FTP, SMB/CIFS, etc? SMB will generally have more overhead in than FTP resulting in lower data transfer rates. Are there any scanning or filtering policies applied to the firewall rules (if tunnel mode)? You can create or check a traffic history graph in the GUI for the internet interface to see raw data rate.

[sensorsinc]

SSL VPN Tunnel SMB No filtering or scanning. Next test, I' m going to check the history graph as you suggested. Also going to check utiltilzation of the network connection on the PC through Task Manager. Still would like to hear what kind of speeds others are getting out of their 80C or smaller devices. Maybe I just have my expectations set to high, I don' t know.

[vanc]

You can never fully utilize your bandwidth with SMB/CIFS. Better try HTTP, or FTP.

[sensorsinc]

Inspired by Selective' s " in the room test" . I did my own in the room test. I plugged my laptop into the outside of my edge router and ran the same 130MB download. FortiGATE is on the inside of said edge router. So it was PC -> Router -> FortiGATE. So on this 100 MB/s connection, It took 3 minutes and 40 seconds. The firewall was seeing ~5,600 Kbps. Actual transfer speed was ~4,800 Kbps. CPU percentage was around 15%. Memory was around 39%. Task manager showed around 5,000 Kbps. So only about a third of what Selective saw in his test. However, my test included a router and was done during business hours. Still not even close to the advertised 50 Kbps SSL VPN specification. The router is new and managed so I need to find out how it is configured. And I guess I should try plugging my laptop directly into the WAN port on my FortiGATE and try again. Thank you everyone for the advice! Jamie

[Carl_Wallmark]

In my tests i connected a laptop to the wan port and another laptop on the internal port. the laptop on the " outside" connected with a SSL VPN tunnel, then i uploaded/downloaded a file from a Windows share on one of the laptops, very simple, however, i did not do any tests with HTTP/FTP

[emnoc]

A fairer test would be to test with the server directly for the same files. Your making an assumption the slowness iss firewall_sslvpn related and it might be your server. Other methods that would support thruput, would be to run iperf/jperf between the client+server and server+cleint. Running these test with UDP would also rule out tcp slow start, and any overhead for tcp.

[sensorsinc]

@Selective...That' s what I am going to try next. @emnoc... Sorry should have mentioned that it only takes 7 seconds (150 Mbps) when connected over the LAN. Neither the server nor my PC is the limiting factor. The goal of course is not to hold ForiNET' s feet to the fire about the 50 Mbps throughput. I don' t expect to reach that " under perfect conditions" spec. I am checking to see why I' m getting 10% of the spec. I imagine there is a misconfiguration in my firewall or my router, both of which are new. No real conclusion can be made till I duplicate Selective' s test which is the only thing I can compare to so far. Right now his 60C is 3 times faster than my 80C, but I still need to match that test. Again, thank you to everyone helping me out! Jamie