This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN Connection Slow (warning large screenshots)

Hi All,

I am experiencing very slow SSL VPN speeds (10x slower than internet upload speed, 70x slower than internet download speed). I read almost all posts I could find, but no solution worked.

Can you help me out?

Thanks,

Here is what I have as a setup:

Hardware: Qotom q355g4, 6GB RAM, 120GB SSD, (Sophos XG runs directly on the hardware)

Internet connection:

Resource usage:

Transfer speeds on the VPN (both download and upload):

SSL VPN UDP Settings:

VPN to LAN rule:

This thread was automatically locked due to age.

Top Replies

Prism over 4 years ago in reply to Jaco de Klerk +2

Hi Jaco de Klerk , It has been fixed on v18 MR2. I'm using TCP, AES-256-CBC & SHA256. Thanks!

Parents

0 Chris Korte over 4 years ago

Any solutions after 5 Month now? I have the same trouble.
Cancel
Vote Up 0 Vote Down

Cancel
0 guillaume bottollier over 4 years ago in reply to Chris Korte

Hi

SSL VPN poor performance has been solved in 17.5 mr14 !
Cancel
Vote Up 0 Vote Down

Cancel
0 Jaco de Klerk over 4 years ago in reply to guillaume bottollier

No, its not been solved. Sitting on SFOS 18.0.1 MR-1-Build396 and its still slow. Still looking for a resolution if anyone has anything.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Jaco de Klerk over 4 years ago in reply to guillaume bottollier

No, its not been solved. Sitting on SFOS 18.0.1 MR-1-Build396 and its still slow. Still looking for a resolution if anyone has anything.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Prism over 4 years ago in reply to Jaco de Klerk

Hi Jaco de Klerk,

It has been fixed on v18 MR2.

I'm using TCP, AES-256-CBC & SHA256.

Thanks!

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 GA @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up +2 Vote Down

Cancel
0 Regex over 4 years ago in reply to Prism

How do you have configured it, as a gateway or split tunneling ? and do you use compression ?

__________SETUP___________

HP Small Form Factor: i5 4Cores, 8Gb of RAM.
Intel Network Card 5x Eth
SSD: 256Gb
Cancel
Vote Up +1 Vote Down

Cancel
0 Prism over 4 years ago in reply to Regex

I'm not doing split tunneling, all traffic goes to the firewall for inspection.

Also, I'm not doing SSL/TLS Decryption right now over VPN users, but I'll be doing it later.

Regex said:
and do you use compression ?

No, compression over SSL VPN is known to have vulnerabilities, I don't trust it.

Thanks!

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 GA @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up +2 Vote Down

Cancel
0 Jaco de Klerk over 4 years ago in reply to Prism

Hi Prism, Where did you get v18 MR 2? I have a XG 210 and there is no updated firmware available yet.

I have mine configured as a gateway.
Cancel
Vote Up +1 Vote Down

Cancel
0 Regex over 4 years ago in reply to Prism

Well I'm also not using compression but as you "as a gateway(TCP not UDP)" and i can see much better performance . I'll test it later from another location - Im a home user :D
Thx for sharing !^^

__________SETUP___________

HP Small Form Factor: i5 4Cores, 8Gb of RAM.
Intel Network Card 5x Eth
SSD: 256Gb
Cancel
Vote Up 0 Vote Down

Cancel
0 Jaco de Klerk over 4 years ago in reply to Regex

Thank you very much. I am also not using any compression, SSL/TLS inspection turned off and running SSL over UDP.
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 4 years ago in reply to Jaco de Klerk

I suggest you to wait for v18 MR3 which should be released soon, v18 MR2 has a "beta release".

Well, I found no bugs or issues with it, It even fixed a lot of issues I've been having with SSL/TLS Decryption.

But if you really want to upgrade to it, then you can download the update file from "MySophos".

Thanks!

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 GA @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up 0 Vote Down

Cancel
0 Jaco de Klerk over 4 years ago in reply to Prism

Awwsome, thanks, will maybe try it and see if it makes any difference over the next few days. I also see in other posts that they say you should run off UDP Flood Protection. Where do you do that?
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 4 years ago in reply to Jaco de Klerk

Inside DoS & Spoof Protection, on the "Intrusion Prevention" Tab; It's disabled by default.

Thanks!

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 GA @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up 0 Vote Down

Cancel
0 Jaco de Klerk over 4 years ago in reply to Prism

Thank you very much. I have checked and nothing is ticked in there. i have also added a DoS bypass rule for my VPN range, just in case.
Cancel
Vote Up +2 Vote Down

Cancel