Poor SSL VPN performance when using TCP

Shouldnt be the case, as i tested it with Sophos Connect 2.0 back in the days on multiple devices. 

Do you use Compression on SSLVPN? 

Did you try Sophos Connect 2.0 or the OpenVPN Client? 

Did you only try SMB? Can you try other protocols, as SMB can actually cause such problems (re transmissions). 

Likely caused by MTU Issues: https://forums.openvpn.net/viewtopic.php?t=25039

I really need this to get sorted out, otherwise we will stop deploying XG firewalls to our customers. Since it has nothing to do with SMB and SG Firewall is using the very same MTU size, it should be something else going on.

When I get back into the office on Monday, I'll pass over the details and the case that one of my clients had opened and we closed it because we found a work-around, and put it down to the OpenVPN client issues.

Like I say, we found that changing the connection method to SHA1 worked - in itself for them wasn't so much of a problem as they use encrypted traffic as per best practices throughout the network, and if Azure files can use SMB direct onto the internet, there is no reason why SMB files cannot be used with a weaker VPN as an extra layer.

I am not sure if it is still the case but I saw this when connecting two XG's together using Site to Site SSL VPN as well.  TCP performance was dreadful, UDP was near wirespeed.  

To follow up with what LuCar Toni mentioned,

For users that are experiencing issues with poor SSL VPN performance, please raise a support case and reference the following ID's:

• If on XG v17.5 - NC-59080

• If on XG v18.0 - NC-61102

Please share your support case number on this community thread as well.

Thanks,

hello FloSupport 

Case opened with ID #9964013

Same issue. Ticket opened. Case number is [#9969535]

Hi all,

Following the support ticket opened, Sophos cofnirmed me that this issue is presumed to be corrected on 18.0.2 and 17.5.14 ... which have no ETA for now.

I've just upgraded my XG to v18 MR-2, apparently this issue has been fixed. Just tested with both UDP and TCP and I'm getting same speeds on both protocols. (400Mbit/s).

Thanks!

Hi All,

Please note that SFOS v18 MR2 is a limited release that includes early access of an IPS engine version upgrade and other related changes.

Sophos will soon publish a broader release that includes additional fixes.

Regards,

Is there a change log available?  I am not going to install it but I am curious if there were any improvements or fixes for the DPI engine as it relates to the FLOW_TIMEOUT errors I was seeing.

Hi Prism 

Haven't upgraded yet my v18 mr1 labs, but upgraded a production 17.5 MR13 to MR14 and i can see a significant improvement using remote client SSL with an openvpn in TCP and those parameters : 

mr13 : 16 Mbit/s

mr14 : 104 Mbit/s (which is still really far from our gigabit fiber bandwith though) !

Hi Prism 

Haven't upgraded yet my v18 mr1 labs, but upgraded a production 17.5 MR13 to MR14 and i can see a significant improvement using remote client SSL with an openvpn in TCP and those parameters : 

mr13 : 16 Mbit/s

mr14 : 104 Mbit/s (which is still really far from our gigabit fiber bandwith though) !