AnsweredHot!ipsec tunnel settings for best performance

Author
liorme
Bronze Member
  • Total Posts : 31
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
2019/10/22 06:49:49 (permalink)
0

ipsec tunnel settings for best performance

i want to setup an ipsec tunnel adjusted for stability and best performance/throughput, ignoring security. the security is not a requirement here
 
fortigate 200e. what's the best settings and proposal needed for best performance and stability, while ignoring security?
 
thank you
post edited by liorme - 2019/10/22 06:51:53
#1
ede_pfau
Expert Member
  • Total Posts : 6097
  • Scores: 490
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: ipsec tunnel settings for best performance 2019/10/22 10:22:24 (permalink)
0
Quite a broad question...mainly you're asking for 'best practices'.
1- performance
You can only reduce performance by choosing proposals (phase1 and phase2) which are not hardware-accelerated. ATM AES256 is deemed secure, costs less performance than 3DES (ugh) and is run on the SP (ASIC), that is, accelerated.
I'd rather stay away from EC proposals.
 
2- stability
Is IMHO mainly dependent on line stability. If the WAN line glitches, an IPsec tunnel has to renegotiate. (Which BTW reduces throughput as well.).
 
But you can plan for more stability in the network design. Use redundant tunnels and monitor connectivity with link-monitors. If set up correctly, this minimizes downtime. See to it that switching between tunnels is delayed (with hysteresis) to avoid flapping.
In FortiOS 5.6 and esp. 6.0 and 6.2 you can achieve all of this with the SD-WAN construct. Recommended.
 
And one last stability hint: do not use the latest, bleeding-edge firmware version. You never do. v6.0.6 is stable and secure.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#2
liorme
Bronze Member
  • Total Posts : 31
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: ipsec tunnel settings for best performance 2019/10/22 10:42:09 (permalink)
0
thank you
so about performance, a good choice with 200e will be aes256 with md5, right?
 
and about stability, i only have only 1 wan in each side, so the only stability is as good as the stability of my wan lines on each side, right?
#3
emnoc
Expert Member
  • Total Posts : 5366
  • Scores: 351
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: ipsec tunnel settings for best performance 2019/10/22 12:15:10 (permalink) ☼ Best Answerby liorme 2019/10/22 12:35:28
0
I would look at GCM vrs CBC ciphers for performance but the impact might not be that much of anything, but overhead would be less with Galios Counter Mode take a look at "suite-b-gcm-128/256"
 
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/238852/encryption-algorithms
 
YMMV 
 
Ken Felix

PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
#4
liorme
Bronze Member
  • Total Posts : 31
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/02/28 13:10:59
  • Status: offline
Re: ipsec tunnel settings for best performance 2019/10/22 12:35:17 (permalink)
0
yes, it looks like the 128gcm provides the best results, thank you sir. i'll keep track of it over time
#5
ede_pfau
Expert Member
  • Total Posts : 6097
  • Scores: 490
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: ipsec tunnel settings for best performance 2019/10/22 12:57:16 (permalink)
0
Please drop MD5 from your list of hash algos. Use SHA1 or better still, SHA256. MD5 has been compromised before.
Again, I'm not sure that the higher SHA algos are hw accelerated (though they are supported in FortiOS).
Seems they are, up to SHA512 (cf. KB article).
aria, seed, aesXXXgcm all cannot be offloaded. CPU will have to do that which forfeits one major advantage of a Fortigate.
You'll notice that some algos are not offloaded in phase1 but are in phase2. No idea why.
In addition to the "Encryption" chapter, have a look at the preceding chapter "ASIC offloading" in the Cookbook.
And in encryption, do not use DES or 3DES.
 
And all of your other assumptions are correct.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#6
Jump to:
© 2019 APG vNext Commercial Version 5.5