Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +4 person also asked this people also asked this
  • Locked Locked
  • Replies 100 replies
  • Answers 2 answers
  • Subscribers 53 subscribers
  • Views 53783 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Poor SSL VPN performance when using TCP

Dreamcatcher

Hello folks,

 

i am pretty disappointed with the SSL VPN performance on TCP connections. When using TCP i only get ~16 Mbit/s when copying files over SMB. With UDP the performance is much better and i get the full 50 MBit/s. This is not acceptable at all, since i always got the full performance with UTM on even slower hardware and i need to use TCP on some sites. I've tested this on multiple appliances with our customers (XG210, XG125, XG115 etc.) and it's always the same: TCP performance on SSL VPN is plain bad and there is no heavy load on the CPUs involved.

 

Is this a bug, or is the TCP SSL VPN performance really that bad compared to UTM?



This thread was automatically locked due to age.
Parents
  • 0

    Shouldnt be the case, as i tested it with Sophos Connect 2.0 back in the days on multiple devices. 

    Do you use Compression on SSLVPN? 

    Did you try Sophos Connect 2.0 or the OpenVPN Client? 

    Did you only try SMB? Can you try other protocols, as SMB can actually cause such problems (re transmissions). 

    Likely caused by MTU Issues: https://forums.openvpn.net/viewtopic.php?t=25039

     

     

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I really need this to get sorted out, otherwise we will stop deploying XG firewalls to our customers. Since it has nothing to do with SMB and SG Firewall is using the very same MTU size, it should be something else going on.

  • 0 in reply to LuCar Toni

    I added the two parameters to my config file. Unfortunately it makes no difference at all, tried with the OpenVPN Client and the Sophos Connect 2.0 Client.

    Edit:

    I tested this now with android. I tested UDP, TCP and TCP edited with the parameters you mentioned. The results are roughly the same as with Windows:
    TCP: 8-10 Mbit/s
    UDP: 35-45 Mbit/s

  • 0 in reply to LuCar Toni

    hi  

    Tried with your 2 params and no difference at all, exacly 16Mbit/s using TCP.

    (windows 10 / openssl / XGvirutal v18 MR1 hosted on gigabit link)

  • 0 in reply to guillaume bottollier

    Thanks for the feedback.
    Please give Sophos some time to review the test scenario and the different perspectives. 

    As far as i know, Sophos has a RootCause of this issue and will look into fixing this in a upcoming release. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I've just compared the OpenVPN Client logs from UTM and XG. Those are the differences i've found.

    Why is XG only using TSL v1 while UTM is using TLS v1.2?

  • 0 in reply to LuCar Toni

    Where do i find these config file on the Windows 10 client PC?

    I had a second user today (in Dortmund/Germany).
    He uses WLAN and MS Direct access.

    Due to latency his SMB downloads is about 355-800kbit/s.

    I don´t think that this something that a VPN client could fix.

    I read some threads about mtu size and tcp autoscaling with MS DA Servers on Hyper-V ...

  • 0 in reply to juergenb52

    I'd suggest you open your own thread, since this has nothing to do with this topic.

  • 0 in reply to Dreamcatcher

    Thas right,

    but even with Sopos VPN Client the error is the same.

    I had a own thread and was directed here.

  • 0 in reply to juergenb52

    Hi,

    I redirected you because your original post was about a VPN user, now you have changed to being W10 users in your office.

    Ian

    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • +1 in reply to rfcat_vk

    Just to update this thread. I would ask everybody with a valid Support Subscription to open a Case referring to this Thread, if he has this issue. 

     

    Properly this will be resolved in the next bug fix version - So i will mark this Answer as a Answer. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    When I get back into the office on Monday, I'll pass over the details and the case that one of my clients had opened and we closed it because we found a work-around, and put it down to the OpenVPN client issues.

     

    Like I say, we found that changing the connection method to SHA1 worked - in itself for them wasn't so much of a problem as they use encrypted traffic as per best practices throughout the network, and if Azure files can use SMB direct onto the internet, there is no reason why SMB files cannot be used with a weaker VPN as an extra layer.

    Tim Grantham

    Enterprise Architect & Business owner

Reply
  • 0 in reply to LuCar Toni

    When I get back into the office on Monday, I'll pass over the details and the case that one of my clients had opened and we closed it because we found a work-around, and put it down to the OpenVPN client issues.

     

    Like I say, we found that changing the connection method to SHA1 worked - in itself for them wasn't so much of a problem as they use encrypted traffic as per best practices throughout the network, and if Azure files can use SMB direct onto the internet, there is no reason why SMB files cannot be used with a weaker VPN as an extra layer.

    Tim Grantham

    Enterprise Architect & Business owner

Children
No Data
Unfiltered HTML