Helpful ReplyHot!Odd Performance Issue

Author
SecurityPlus
Gold Member
  • Total Posts : 271
  • Scores: 4
  • Reward points: 0
  • Joined: 2014/08/11 18:41:34
  • Status: offline
2019/05/08 23:18:47 (permalink)
0

Odd Performance Issue

We have a FortiWiFi serving about 8 users running FortiOS 6.04. The bandwidth at the location is fast: 300/20. The firewall is set to Proxy. We noticed on about 4 different occasions that when trying to download a file from a remote server (connected via WAN1) that the download would take an exceptional long time or would fail. This occurred on multiple computer on the network, different browsers, different source servers, over a number of days. This happened even when no other activity was taking place on the network at the time.
 
We finally did some testing. We noticed that when downloading with AV and Web Filter security profiles Off in the IPv4 Policy that the download speed was about 18 Mb/s. With either AV and Web Filter security profiles On in the IPv4 Policy the download speed was initially 1 Mb/s. After about a minute though the speed would fall from 1 Mb/s all the way down to 5 Kb/s.
 
We further isolated the performance impact to the HTTP inspection in the AV Profile. Concerning the Web Filter, it did not matter how much or how many filters were turned on to create the very low download speed problem.
 
Support recommended setting the AV and Web Filter Profiles to Flow inspection. Doing this increased the download speed to 7 Mb/s. This is still less than 1/2 of the speed without AV or Web Protection running. I would prefer instead to use Proxy inspection but it appears to slow the download down excessively.
 
Have others encountered this issue? Is this normal for a FortiWiFi 60D? Any suggestions?

FWF30E, FG50E, FWF50E, FG60D, FWF60D, FG60E, FG80E, FG100D
FortiOS 5.2, 5.4, 5.6, and 6.0
FAP-221E, FAP-221C
#1
SecurityPlus
Gold Member
  • Total Posts : 271
  • Scores: 4
  • Reward points: 0
  • Joined: 2014/08/11 18:41:34
  • Status: offline
Re: Odd Performance Issue 2019/05/09 15:35:50 (permalink)
0
Does anyone have any feedback concerning what the download speed typically is with a 60D if the internet connection is 20 Mb/s? I know that with AV and Web Protection that it will be less, just not sure how much less is normal.

FWF30E, FG50E, FWF50E, FG60D, FWF60D, FG60E, FG80E, FG100D
FortiOS 5.2, 5.4, 5.6, and 6.0
FAP-221E, FAP-221C
#2
rwpatterson
Expert Member
  • Total Posts : 8396
  • Scores: 195
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: online
Re: Odd Performance Issue 2019/05/09 16:22:20 (permalink) ☄ Helpfulby SecurityPlus 2019/05/09 21:31:34
5 (1)
I would start with the basics. Does the duplex match on the interface with your ISP? A duplex mismatch would severely hamper your speeds in both directions. from the CLI (I'm doing this from memory, so please don't hang me if it's not quite right):
 
FGT# diag hard dev nic wanx (replace with your WAN port)
 
Check for errors in the output. Also you will see what speeds your are connected at. Half duplex would be a major problem here.
 
IMPORTANT NOTE: Don't do this from the remote side. You may lock yourself out if the duplex modes don't sync up. You'll then be in a rush to get back to the office to correct it!
post edited by rwpatterson - 2019/05/09 16:28:52

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.19-b0694
FWF60B
FWF80CM (4)
FWF81CM (2)
 
#3
SecurityPlus
Gold Member
  • Total Posts : 271
  • Scores: 4
  • Reward points: 0
  • Joined: 2014/08/11 18:41:34
  • Status: offline
Re: Odd Performance Issue 2019/05/09 21:31:24 (permalink)
0
Bob,
 
Thank you for the suggestion!
 
How do the settings below look to you? Duplex is set to Full. I don't notice any errors.
 
Here are the results of your command:
 
Acme_1 # diagnose hardware deviceinfo nic wan1
Description     :FortiASIC NP4LITE Adapter
Driver Name     :Fortinet NP4Lite Driver
Version         :1.0.0
Admin           :up
Current_HWaddr   08:5b:0e:21:0a:58
Permanent_HWaddr 08:5b:0e:21:0a:58
Status          :up
Speed           :1000
Duplex          :Full
Host Rx Pkts    :304137957
Host Rx Bytes   :3913571314
Host Tx Pkts    :284700851
Host Tx Bytes   :4068856796
Rx Pkts         :366785869
Rx Bytes        :96457245
Tx Pkts         :334841967
Tx Bytes        :731838757
rx_buffer_len   :2048
Hidden          :No
cmd_in_list     : 0
promiscuous     : 1
enabled 802.1x  : 0
authorized      : 0
mac bypass      : 0

FWF30E, FG50E, FWF50E, FG60D, FWF60D, FG60E, FG80E, FG100D
FortiOS 5.2, 5.4, 5.6, and 6.0
FAP-221E, FAP-221C
#4
SecurityPlus
Gold Member
  • Total Posts : 271
  • Scores: 4
  • Reward points: 0
  • Joined: 2014/08/11 18:41:34
  • Status: offline
Re: Odd Performance Issue 2019/05/09 21:32:38 (permalink)
0
By the way, this I believe is a Spectrum cable 300/20 cable connection.
 

FWF30E, FG50E, FWF50E, FG60D, FWF60D, FG60E, FG80E, FG100D
FortiOS 5.2, 5.4, 5.6, and 6.0
FAP-221E, FAP-221C
#5
rwpatterson
Expert Member
  • Total Posts : 8396
  • Scores: 195
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: online
Re: Odd Performance Issue 2019/05/10 20:07:27 (permalink)
0
Sorry for the delay. Crazy 24 hours. All looks well. Not sure where to proceed from here.

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.19-b0694
FWF60B
FWF80CM (4)
FWF81CM (2)
 
#6
SecurityPlus
Gold Member
  • Total Posts : 271
  • Scores: 4
  • Reward points: 0
  • Joined: 2014/08/11 18:41:34
  • Status: offline
Re: Odd Performance Issue 2019/05/14 11:54:22 (permalink)
0
Does the performance appear to be lower than the performance that a 60D should provide? That way my estimate but I don't have as much experience as many others on the forum have.

FWF30E, FG50E, FWF50E, FG60D, FWF60D, FG60E, FG80E, FG100D
FortiOS 5.2, 5.4, 5.6, and 6.0
FAP-221E, FAP-221C
#7
rwpatterson
Expert Member
  • Total Posts : 8396
  • Scores: 195
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: online
Re: Odd Performance Issue 2019/05/15 05:31:16 (permalink)
0
Is there any way you could duplicate the port and run Wireshark on the traffic? That would nip all this in the bud...

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.19-b0694
FWF60B
FWF80CM (4)
FWF81CM (2)
 
#8
SecurityPlus
Gold Member
  • Total Posts : 271
  • Scores: 4
  • Reward points: 0
  • Joined: 2014/08/11 18:41:34
  • Status: offline
Re: Odd Performance Issue 2019/05/15 20:47:48 (permalink)
0
I have not used Wireshark in a good while but I could try this. Is there anything in particular that you would suggest that I look for using Wireshark?
 
Thanks!

FWF30E, FG50E, FWF50E, FG60D, FWF60D, FG60E, FG80E, FG100D
FortiOS 5.2, 5.4, 5.6, and 6.0
FAP-221E, FAP-221C
#9
Jump to:
© 2019 APG vNext Commercial Version 5.5