Should our Fortigate 40c be slowing our internet this much?

[Koocha]

Hi all

 

We've got a Fortigate 40c doing our firewall and filtering. We've got a fibre line which we were quoted as getting 66Mb down and 20Mb up.

 

When the Firtigate box is plugged in, our speeds drop to 25Mb down and 10Mb up. If I bypass the firewall and plug directly into the router, our speeds are near enough what we were quoted.

 

Should that box be slowing the traffic that much? If so, am I right to complain and try and get a faster firewall?

 

Thanks

[pantscat]

That does sound a bit slow - you'll always get a tiny bit of a speed drop off, but that seems excessive.

 

Are you sure it's not cabling or a duplex mismatch? (Or some other config issue).

[synaesthesia]

It shouldn't be - is it provided by your ISP? Have a chat, they might be able to do something.

If not, maybe try disabling things like inline AV and see if that makes a difference, and would give you a starting point for diagnosis

[Quackers]

The 40C is quite a small box, how much load are you putting on? Its designed only for a small network really. Do you still get that speed when all filtering is turned off? Also are you on the latest Forti OS?

[synaesthesia]

Latest isn't reliable. (MR5)

[Koocha]

Thanks for all the replies, guys.

 

Unfortunately, I don't get to fiddle with most of the settings, as it's managed by our broadband provider.

 

Here's what I've found out:

 

1. Firmware version is v4.0,build0656,130211 (MR3 Patch 12)

 

2. If I disable AV it goes to 32Mb down

 

3. As for load, we've got 2 servers, about 60 workstations, 25 laptops and a bank of 30 netbooks. Unifi managed wifi too

 

Thanks

 

EDIT:

 

Here's the reply I got from them:

 

I have looked into this with our Technical Team, and the issue with your speed is not being limited by the firewall, but by general network contention over the BT network. The 66m/b shown as max. available speeds can be mis-leading, there may be times you can / do get that speed, but also many times when you get much less.

 

We are moving to a cloud based Firewall solution within the next 6 – 8 weeks and will happily move you to that solution once it is available, and that will remove any doubt, but we do not expect you to be able to get greater speeds than you’re already seeing.

 

From the several hundred primary school customers we have around the UK, our experience tells us that 25 m/b should not inhibit what you are trying to do with the network, are you finding you need more speed?

Edited May 7, 2013 by Koocha

[synaesthesia]

Have you told them about disabling AV increasing the speed and that it's vastly faster if you bypass the firewall?

[Koocha]

I've told them (not about the AV, just found that out now), but I was trying it again today and I couldn't replicate the speeds I had been receiving in the past.

 

I'll keep trying and see about the speeds.

 

See, I've got a 40Mb fibre connection at home through Sky and my speeds are pretty much what they should be. My max download speed is 4.4MBps which I'm more than happy about.

 

When we were told we could get 66Mbps I thought "Yes, that'll be at least 6MBps", but it's working out to be more like 3MBps.

 

If anything I'm really disappointed by it.

[SchoolsBroadband]

That doesn't sound right at all. If you're only getting 3Mbit download that's a lower threshold breach and needs to be taken up with BT.

 

It's true that although the line can support speeds of 66Mbit that BT can't necessarily deliver this to the ISP (I presume us here) as FTTC is not a 1:1 contention ratio service. Still though you should really be getting speeds of 20Mbit + for the vast majority of the times.

 

I know the updated version using web filtering proxy flow mode can put load on the devices if heavy usage occurs but it should still never go that low. I'm in the office tomorrow afternoon so will give you a call.

 

FYI if you're not happy I'll make sure we give you an upgrade to our new hosted Fortigate / Lightspeed FOC which will be here very very soon. That gives you carrier grade Fortigates and you will never have any issue wiht load on the box.

 

I'll send you a PM too.

 

Thanks

 

Dave

[Koocha]

That doesn't sound right at all. If you're only getting 3Mbit download that's a lower threshold breach and needs to be taken up with BT.

 

It's true that although the line can support speeds of 66Mbit that BT can't necessarily deliver this to the ISP (I presume us here) as FTTC is not a 1:1 contention ratio service. Still though you should really be getting speeds of 20Mbit + for the vast majority of the times.

 

I know the updated version using web filtering proxy flow mode can put load on the devices if heavy usage occurs but it should still never go that low. I'm in the office tomorrow afternoon so will give you a call.

 

FYI if you're not happy I'll make sure we give you an upgrade to our new hosted Fortigate / Lightspeed FOC which will be here very very soon. That gives you carrier grade Fortigates and you will never have any issue wiht load on the box.

 

I'll send you a PM too.

 

Thanks

 

Dave

 

Hi Dave

 

Thanks for the reply.

 

I'll reply to your PM now.

 

BTW, we're getting 25Mbps downstream, meaning our actual download rate is 3MBps. That's what I meant by that.

[SchoolsBroadband]

phew, there's quite a difference between 3Mbit and 3Mbyte

[Koocha]

phew, there's quite a difference between 3Mbit and 3Mbyte

 

There is indeed!

 

You still giving me a call?