Based on two recent support cases regarding the IPsec performance between an OnPrem and Azure FortiGate, we did some testing using the latest FortiOS 6.4.1.
We’ve created a basic IPsec tunnel using the wizard, deployed an Ubuntu machine at both sites and used iPerf3 to do some speed testing. The results were nowhere near the expected numbers, while sending from Azure to OnPrem (~250Mbit/s) was a bit faster than reverse (~120Mbit/s).
We’ve then checked the IPsec interface at the Azure site. The MTU and packet statistics looked good:
FGT-Azure # fnsysctl ifconfig Azure-OnPrem Local-FortiGate Link encap:Unknown UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1438 Metric:1 RX packets:832464 errors:0 dropped:0 overruns:0 frame:0 TX packets:2908302 errors:5 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:708921008 (676.1 MB) TX bytes:5037498099 (4.7 GB)
We did the same at the OnPrem site and the figures weren’t great at all. The MTU had a value of zero and there were many errors regarding RX packets.
FGT-OnPrem # fnsysctl ifconfig OnPrem-Azure Azure-FGT Link encap:Unknown UP POINTOPOINT RUNNING NOARP MULTICAST MTU:0 Metric:1 RX packets:2826050 errors:420607 dropped:0 overruns:0 frame:0 TX packets:832986 errors:526 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:4767963128 (4.4 GB) TX bytes:646053050 (616.1 MB)
After manually setting the MTU of the OnPrem IPsec interface (to the same value as on Azure, new feature in FOS 6.4.1), the iPerf3 results greatly improved to the expected values (~600Mbit/s).
config system interface edit "OnPrem-Azure" set-mtu-override enable set-mtu 1438 next end
All we now so far is, that the algorithm to calculate the MTU of the IPsec interface had changed in FOS 6.4.x. We’re also planning to provide some troubleshooting tips using iPerf3. So stay tuned for an update – after summer vacation.
2,630 total views, 5 views today