Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Replies 14 replies
  • Answers 3 answers
  • Subscribers 40 subscribers
  • Views 1817 views
  • Users 0 members are here
Options
Suggested

SSL VPN Performance is horrible using TCP or UDP

Shawn Adams

We have 2 XG330 in HA, a 300Mbit connection and are using the SFOS 20.0.0 GA-Build222 firmware with Sophos Connect.

Using the SSL VPN with UDP we are seeing speeds of 3.6Mbit down and 6.9Mbit up.  The Client has 100Mbit.

I've read a lot of different threads here regarding this issue, most of them are older than 2 years and most of them do not have an acceptable answer to this problem other than to switch the people who need a faster connection to IPSEC.

If anyone has any ideas I'll be glad to hear them.



Added V20 TAG
[edited by: Erick Jan at 12:22 AM (GMT -7) on 7 May 2024]
Parents Reply Children
  • 0 in reply to BrucekConvergent

    compression is now off, no change in performance at all.  Do I need to reboot the firewalls?

  • 0 in reply to Shawn Adams

    I'm starting to think we should try IPSEC for the users who need it, I've read that it is faster than the SSL.

  • 0 in reply to Shawn Adams

    No reboot should be needed.  

    You have an interesting problem there, and I haven't seen a speed issue like this in a while.  Though in the recesses of my mind, I recall a couple of scenarios:

    1)  The WAN link on the firewall had a speed / duplex mismatch with the ISP gear -- granted I have not seen this in many moons but I have before.  Causes strange behavior.

    2)  I don't see it mentioned here -- have you disabled UDP flood protection?  That can cause issues with UDP streams.

    3)  Also, haven't seen it here, have you tried testing, say, from a directly connected link?  There could be some throttling happening at your ISP, the client's ISP, or in between, of that traffic.  YOu can try a different port, etc.

    Of course trying IPSEC may work as well -- but more "free" Wi-Fi connections block that usage than others.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Sophos Platinum Partner

    --------------------------------------

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Unfiltered HTML