Thread Info
  • State Verified Answer
  • +6 person also asked this people also asked this
  • Locked Locked
  • Replies 63 replies
  • Answers 4 answers
  • Subscribers 34 subscribers
  • Views 166310 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Slow downloads on smartphones connected over AP

Jelle

Hi,

we have a WiFi running for our smartphones mainly to update Android and apps. WiFi is offered through an AP55. Only smartphones can connect based on their MAC address. There is an own firewall rule for these connections with the following options active: HTTP scanning, block Google QUIC, detect zero day malware with Sandstorm, Scan FTP.

Unfortunately downloads are very slow. App updates take a long time and Android updates are canceled at a certain point by the smartphone itself.

As all updates are done over secure socket layer protocol and HTTPS scanning is not active I wonder what could be the reason. I checked the IP addresses that are used during update and always got to https://r3---sn-h0jeened.gvt1.com/ and https://r4---sn-h0jeened.gvt1.com/ so I excluded gvt1.com from HTTPS scanning, malware scanning and sandstorm. But also this showed no improvement on download speed.

Currently I wonder if the throughput of the AP55 is that slow?

 

Does anybody have any suggestions? Thanks.



This thread was automatically locked due to age.
Parents
  • 0

    Perhaps we're experiencing the same issue. :-/

    Have you tried to turn off Scan HTTP and set Web Policy to None in your network rule?

    We're using this both components in several network rules. But if we use them in a Wifi network rule, the Wifi performance drops extremely. I've already opened a ticket and Sophos Support is currently investigating our problem.

  • 0 in reply to dja

    Turned off Scan HTTP and set web policy to None. No improvement...

  • 0 in reply to Jelle

    Mmh... Suddenly I'm seeing a real improvement. Maybe I was too fast with testing after changing the settings.

    Currently everything is turned off and using www.speedof.me I'm at 16.09 download and 1.04 upload which is connection max.

     

    Testing 3 times after each change now

    Step 1: Turned on HTTP scanning -> download 15.2 / 15.73 / 15.8, upload 0.78 / 0.96 / 1.04, latency 42ms / 35ms / 41ms

    Step 2: Turned on Block Google QUIC -> download 15.73 / 15.63 / 15.87, upload 1.02 / 0.82 / 0.79, latency 35ms / 37ms / 36ms

    Step 3: Turned on Sandstorm protection -> download 13.43 / 15.74 / 15.91, upload 0.84 / 0.78 / 0.79, latency 43ms / 56ms / 34ms

    Step 4: Turned on FTP scanning -> download 15.71 / 16.14 / 15.78, upload 0.74 / 0.76 / 0.77, latency 56ms / 47ms / 33ms

    Step 5: Activated web policy -> download 3.28 / 5.47 / 5.32, upload 0.75 / 0.97 / 0.75, latency 80ms / 33ms / 35ms

     

    Verification: Deactivated web policy -> download 15.69 / 15.27 / 15.48, upload 0.78 / 0.82 / 0.89, latency 48ms / 39ms / 48ms

     

    So I can definitely confirm that using a web policy is the showstopper.

    What is interesting is that the same web policy is used for the web browsing rule for our office computers. Running www.speedof.me here returns good values.

  • 0 in reply to Jelle

    Can you show us a screenshot of the Interface tab - Wireless interface?

    I assume there could be an "very old" issue which affects the MTU Size of the interface. 

  • 0 in reply to LuCar Toni

    I assume there could be an "very old" issue which affects the MTU Size of the interface. 

    As we're having the same issue. Here's a screenshot of our MSS/MTU values on the wireless interface:

    But I see no way to change this settings.

  • 0 in reply to LuCar Toni

    Same values here like  posted. Looks like MSS is too high. Mentioned this in a previous post as MTU seems to be fixed to 1450 on wireless interfaces. But were comes MSS from as I already changed it manually on the WAN interface (to 1444)?

     

    Edit: OK, I assume MSS is taken from the LAN interface...?

  • 0 in reply to Jelle

    Funny.

    Please delete your Wireless Network and recreate it. 

    It should be created with MTU Size 1500 and the issue should be fixed.

     

    This is kinda an old bug from UTM. In UTM 9.3 i guess, we tried to fix an issue and setup all networks with 1450. This causes an other issue. Wireless Protection in XG had the same behavior and we fixed it in 16.05. Afterwards all Networks should be created with 1500 instead of 1450. 

  • 0 in reply to LuCar Toni

    manbearpig said:

    Please delete your Wireless Network and recreate it. 

    Unfortunately that doesn't help. The screenshot shows a test Wifi I've created last week, running SFOS 17.1.1 MR1.

  • 0 in reply to LuCar Toni

    Well, AP55 and WiFi have been created with the current SFOS 17.1.1 MR-1 so was it really fixed in 16.05???

    How can I recreate without configuring everything from the beginning?

  • 0 in reply to dja

    Oh - Maybe i am wrong? Try to change the MTU Size on GUI. 

    I do not have access to a XG right now, so i cannot check the CLI for a Console switch. 

    But "from which" Firmware did you upgrade? As far as i know, this can only happen, if you used an old firmware and upgrade to V17.X 

    You should be able to change the MTU Size. The Problem is, i did not saw those issue for quite a while (2 years, since it was fixed in V16.05 ..) 

Reply
  • 0 in reply to dja

    Oh - Maybe i am wrong? Try to change the MTU Size on GUI. 

    I do not have access to a XG right now, so i cannot check the CLI for a Console switch. 

    But "from which" Firmware did you upgrade? As far as i know, this can only happen, if you used an old firmware and upgrade to V17.X 

    You should be able to change the MTU Size. The Problem is, i did not saw those issue for quite a while (2 years, since it was fixed in V16.05 ..) 

Children
  • 0 in reply to LuCar Toni

    MTU for wireless interface can't be changed (on GUI)

  • 0 in reply to Jelle

    This should be 1500 after recreation. I am quite sure. Checked another appliance right now. There is every Wireless Network created with 1450. 

    So i would highly assume, if you delete all network attached to this AP and recreate it, it should work fine. 

  • 0 in reply to LuCar Toni

    Why should it be ok after recreating when it was already created with the current firmware?

    What if I create an additional wifi network which creates an additional wireless interface? Should this have an MTU of 1500 right now (without deleting and recreating the other networks)?

  • 0 in reply to Jelle

    The MTU Size (1450) is written in der Database. 

    So can you explain the history of your current installation? Because we dont change such thing with a firmware update. Basically the appliance should create everything new with the correct value (1500). 

    But dja already explained, it is not. So i have to assume, that the appliance does not allow to create 1450 and 1500 on one access points (which is clearly correct, because this would cause a real mess). 

    So basically if you delete everything from the wireless protection and maybe disable and enable the wireless protection, the new created wireless network should work fine. 

    You could also go with the Sophos Support. I could be possible to change the MTU Size via database, but i would not do that. 

    tbh, recreating wireless protection is a 5-10 minute task. 

  • 0 in reply to LuCar Toni

    The appliance was first installed in february 2018 with SFOS 17 and was directly updated to 17.0.5-MR5. It has been updated to 17.1.1-MR1 about 5 weeks ago. WiFi with AP55 was set up about 3 weeks ago. So where comes MTU 1450 from when it was fixed in 16.05?

  • 0 in reply to Jelle

    I cannot tell you, how this can happen. 

    I already checked three appliances right now. All Wireless Networks are correct there. 

    And this is the first time since 2 years, where i could find such an issue. 

     

    Found some threads about this. 

    https://community.sophos.com/products/xg-firewall/f/sophos-xg-firewall-general-discussion/76768/unacceptable-guest-wifi-performance-regular-wifi-is-ok

     

    Also interesting is the initial firmware. You updated it "directly to MR5". From which version? 

  • 0 in reply to LuCar Toni

    manbearpig said:

    So i have to assume, that the appliance does not allow to create 1450 and 1500 on one access points (which is clearly correct, because this would cause a real mess). 

    Tested again and you're right. I've created a new Wireless Network, it has a MTU size of 1500. Then I assigned this new Wireless Network to an existing AP, now it has a MTU size of 1450.

    We've also would prefer to just change the values, instead of re-creating several Wifi networks...

    PS: We're coming from SFOS 15. It has been a loooong way. ;)

  • 0 in reply to dja

    I can confirm that. A new wireless network has MTU 1500 until assigned to the AP. Then it has MTU 1450. Unassigning it from the AP has no effect, MTU still is 1450. So I have to delete all wifi networks (3 active networks) and then do what? Delete the AP?

  • 0 in reply to Jelle

    Hi,

    Seems like the config of the MTU is attached to the AP. 

    So delete the AP and try to attach it again to the AP. Should stay with MTU1500 and this will most likely resolve all your issues. 

  • 0 in reply to LuCar Toni

    do you work with a testing system? Would it then be possible to test this? Our XG and WiFi are productive system so I wouldn't want to test it on them.