This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL - Terrible speed

Reaching out here before calling support as its tricky to try and solve this with users connected and having to get them to redownload config files for changes.

Running 17.5.7. We have TCP enabled and get about 1.5MB/ps on SMB share access. We tried changing to UDP which bumped us to 2.4MB/ps. We have a 500Mb connection. Our other settings are as follows. Any recommendations to try and get this up?

Compression off

AES-128-CB

SHA2 256

2048Bit

This thread was automatically locked due to age.

Parents

0 Keyur over 5 years ago

Hi ADH

Please check the system graphs and check WAN interface usage.

Please check DOS settings for UDP flood and bypass SSL VPN port from it, if applied

What is the ISP speed of the user system connect over SSL VPN?
Cancel
Vote Up 0 Vote Down

Cancel
0 ADH over 5 years ago in reply to Keyur

Hello,

Interface usage was low and the end-user has Gig internet. These tests have been tried on other end users as well.

What setting are you referring to for flood protection? There are no IDS/Scanning on the firewall rule for the SSL access.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 ADH over 5 years ago in reply to Keyur

Hello,

Interface usage was low and the end-user has Gig internet. These tests have been tried on other end users as well.

What setting are you referring to for flood protection? There are no IDS/Scanning on the firewall rule for the SSL access.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 LuCar Toni over 5 years ago in reply to ADH

In XG, you can configure DOS Protection (Flood Protection) which will lead into speed problems, because XG will drop packets, which has to be re transmitted by the client.

Actually SSLVPN Traffic could be slow because of the way, the packets are transmitted.

If you start to lower MTU Size on Server, and Server XG Interface, will the speed be boosted?

Also lowering the MTU Size of the WAN Interface?
Cancel
Vote Up 0 Vote Down

Cancel
0 ADH over 5 years ago in reply to LuCar Toni

Won't lowering MTU cause other issues? We only experience problems with SSL VPN. I don't want to mess around with the server MTU as internally this all works fine
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to ADH

SSLVPN could be connected to MTU size issues. If you have a lower MTU size on the Endpoint / WAN interface. Each packets needs to be re transmitted with a proper MTU. That causes a huge delay, so to speak slow performance.

There are plenty of old threads about this (Take a look at UTM / XG, should be the same for this).
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to LuCar Toni

Can you pls provide some examples regarding that mtu ?;)
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Regex

https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/34741/mtu-size-change-internal-network

There are many examples in the community, which lead to the MTU.

Here: https://www.networkworld.com/article/2224654/mtu-size-issues.html

https://hamy.io/post/0003/optimizing-openvpn-throughput/

https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
Cancel
Vote Up 0 Vote Down

Cancel
0 ADH over 5 years ago in reply to LuCar Toni

No client or server would have had MTU size changes made so I would expect they are all at windows defaults. Is his common for SSL vpn with all companies like meraki, palo alto, and fortinet for example?
Cancel
Vote Up 0 Vote Down

Cancel
0 ADH over 5 years ago in reply to LuCar Toni

So this is an issue with openvpn? Sorry I'm not a networking expert. I'm skeptical any large companies deploying this would be hacking up server MTUs sizes etc.
Cancel
Vote Up 0 Vote Down

Cancel