My fortigate located in HQ with internet speed 500Mbps.
My mikrotik router located in the branch with internet speed 150Mbps.
I already success build vpn site2site from fortigate to mikrotik, but the throughput is very low.
The data transfer speed around 30-40Mbps.
How we can troubleshoot where is the bottleneck? I use RB760iGS and from the datasheet we can achive more than 200Mbps VPN throughput.
Not using wireguard for starters.
If its a new hexS, then its a known problem with low throughput using port1 for WAN.
Dont use port 1 and for now take off the bridge.
Excellent use would be OffportBridge, look for threads OffBridge5 for example to safely configure the router from your laptop..
The latest beta firmware includes a fix for this bug and apparently it works to will be giving normal speeds soonest.
I'm not asked about wireguard.
The last beta version, can you specifiy which version?
If I had to assume, anav means 7.20beta7.
Do both sites have symmetric Internet connections? If not, you will be limited by the upload speed of the slower of the two sites.
As to how to debug it, observe cpu usage and per-core usage. That usually gives a clue.
Also, mss clamping is usually required for tcp to reach reasonable speeds.
no, in the office the bandwidth is symetric 500Mbps for upload and download, but in the branch download speed is 150Mbps but upload speed is 60Mbps. But this is not be a problem because i test by download file from HQ to branch, so from HQ side the traffic is upload and in the branch is download.
Does this happen to involve smb by any chance?
yes correct
Could you do a network speedtest by using iPerf? Too many variables currently.
The slowest part of both sides is what will largely determine the pace, regardless of what you think you are doing.
You also did not mention what type of VPN tunnel you are using ?
If not using one of the HW offloaded options with IPSEC for example, your CPU will become the bottleneck. Which actually shows in your screenshot ... most VPN solutions are single core and your cpu3 shows close to 100%, so not much more it can do.
I use RB760iGS and from the datasheet we can achive more than 200Mbps VPN throughput.
Where do you see that ?
Assuming you are using IPSEC (because you STILL did not answer that question)
On your device, go to IP/IPSEC and then Installed SAs.
If there is H in front of those lines, it's HW offloaded.
Like this (example from AX2):
If not ... it's not which then probably means you're not using an encryption method which can be HW offloaded.
For MT7621 (CPU on Hex S) you can find the supported modes here:
Quite easy.
Make sure you use encryption methods on both sides which are supported for HW offload.
That wasn't too hard, was it ?
So ... time to put your IPSEC config on the table.
From terminal:
/ip ipsec export file=anynameyouwish
remove public IP info (replace with IP1, IP2, ... so we know there is something)
remove any passwds (replace with passwd1, ...)
post back here between code quotes for easier readability.
GCM modes are simply unsupported.
hi @holvoetn
changed to aes128cbc now the speed increased from 25Mbps to 80Mbps, but i expect can more than 100Mbps. What else should i tune?
Is fasttrack still enabled on that device ?
Or better... are there rules in front of the fasttrack rule handling ipsec traffic before the fasttrack rule is being hit ?
