Sophos XG 18 MR3 DPI slow download

This is just the way it is.  Also you get the bonus of it breaking random sites with no idea why or what to do about it.

are there any new ideas on this topic?

I don't think that this is not happening to lot's of other people if this would be a bug?

Gunter Kaufmann thanks for testing this at your end.

Very strange that everyone seems to get different results while doing the tests.

If Firefox would use several sessions for a download this should also give good results on Windows 10 which it does not do at my end.

Currently I have no clue what I could test or change on top of the things I already did. Perhaps it is a bug or an issue I can't resolve, but as long as there is no feedback from Sophos I will stay at the legacy proxy configuration which works very well.

I recently updated my Home UTM to Sophos XG Home firewall, I had a few fun and games with the UEFI boot problem but when I had circumnavigated around that I was pleased with the look and feel of the new interface (despite there not being a SET STATIC option from the lease list in DHCP).  All appeared fine as I played around with the features and settings for a few days until I realised my download speeds via a windows client seemed severely limited from what I had before, I have a 200Mbps download link but via a windows client this was reported as 9Mbps, if I try the same speed test from a MAC computer on the same network it was revealing a 199Mbps download speed.  I tried switching of various features and disabling dpi and using traditional web proxy but could not get download speeds to match the MAC or what I have in reality, the actual system was not heavily loaded.  

I have now reverted back to my old UTM restore and download speeds are as they should be with 40GB downloads finishing in minutes again instead of the XG network predicted 10 hours.

This does appear to be an issue with the new XG which I am supposed to be rolling out in my company in a few weeks but am now hesitant if this issue carries over to the business environment.   

Could an engineer from Sophos confirm this is a known issue and when there is likely to be a fix or if anyone else has found a workaround could they let me know.

I took some time looking into this concept and found some interesting points. 

Of course IPS, App control and web filtering will cause some decrease of performance. 

I could found some limitation of single connection downloads (single stream). Using a speedtest, everything looks normal (speedtest.net). Using test downloads, which offers a download file, seems to point to this issue. It will slowly increase over time. 

So if i download for example a 1 GB test file (https://speed.hetzner.de/) which are encrypted, i can start with a slower speed but it increase over time to a acceptable speed. 

Also by starting multiple connection from this test page, i can quickly match the overall acceptable speed. 

It is important to understand about the DPI: The client actually communicate with the server. There is no redirect to any proxy what so ever (compared to proxy, which in direct/transparent, will redirect it to the proxy and the proxy build up a new connection).

Just to confirm: If you see different values on different OS, it could lead to a different handling of the flow state between the server/client. 

Another question, do you see any kind of increase over the time of a bigger download? 

And please: For the future discussions, please be specific in your numbers. There is MB/s and there is mbit/s. To mix this up is unhealthy to get a common sense of the actual throughput numbers. 

No long 40GB downloads did not appear to speed up, I left them for over two hours and they did not increase in speed HOWEVER when I reverted to UTM and tried again the downloads started and finished in minutes.  To my mind there is certainly an issue with the XG firewall, even with IPS and every other feature switched off the speed did not improve.

edited my original message to be more specific on numbers  :-)

We need to be careful. UTM does not have anything like DPI in XG. Its another technology, another approach. The proxy will work differently. Lets see what the other post. 

I understand DPI in XG is another technology but surely it should not bottleneck your internet bandwidth so severely, I understand it is a technology that is supposed to process packets faster not drop bandwidth from 200Mbps to 9Mbps.  I have three windows machines, a Macbook Pro and a number of wireless devices, CPU sat around11% so the firewall was not overly busy.  Even with features switched off or web proxy enabled the bottleneck was still present.  The reinstated home UTM is working as well as it has for the past 7 years with no discernible bottlenecks, I had upgraded to XG as a home experiment to learn about the new system and as well because I am looking to upgrade some business UTM's, I was just advertising the fact that there appears to be a problem with it and requesting some help from fellow forum members or a Sophos engineer.  Others have reported similar issues so I am not an isolated case.

General Question to all who tested:

Did you diable ip V6 or do you have it configured on the Sophos?

Since it did rerun some test and had an win10 VM newly created i thouht why not test it to.

After getting some relatively high speedtest results i checked the cert from the site and it was not from my sophos.

And that led me to ip v6, which is configured mostly in my infrastructure but not on the xg125, so my win10 client got an ip v6 lease from my dhcp and talked through/over the xg125 with my dsl modem. sort of bypass...i will check how thats possible or has someone a hint?

So here are some more Numbers, MB=Megabyte, kbit=kilobit

Testsites: www.wieistmeineip.de , speed.hetzner.de 10GB File for 2-3 Minutes

W7 + W10 current Chrome

Ubuntu current Fifrefox

DPI

W7  Speedtest  down 155.157 kbit  up fails   Download 10GB 3 MB/s (slows down, when the Ubuntu VM starts the same file)

Win10 Speedtest  down 160.960 kbit  up 6112 kbit   Download 10GB 2,5 MB/s 

Ubuntu Speedtest  down 248.445 kbit  up 1575 kbit   Download 10GB 10 MB/s (slows down, when the Ubuntu VM starts the same file)

Webproxy

W7  Speedtest  down 742.214 kbit  up 63.936 kbit   Download 10GB 30 MB/s 

Win10 Speedtest  down 460.061 kbit  up 64.005 kbit   Download 10GB 26 MB/s 

Ubuntu Speedtest  down 916.345 kbit  up 31.275 kbit   Download 10GB 30 MB/s 

Cpu Load was around 40% in the gui, top -d1 showed around 45% snort (dpi) org 40-50% awarrenhttp (proxy)

My test results, with Windows 10 Clients (VM) 

Provider vodafon business (1000mbits Download/ 50mbits Upload) 

Router Fritzbox 6591 (exposed host) --> Sophos XG 210 (Static IP) 

No ip V6 in Sophos and no ip V6 in Network LAN 

DPI is still very slow or the download crash after a time 

WebProx there is no problem 

CPU Load of the Sophos is max. at 25% with DPI and Multi-Downloads, at WebProxy the CPu goes to round about 50%. 

Why does Sophos only use one core for a download at DPI, that is actually an exclusion criterion for the DPI. We have to load a lot

of large files from different servers. With the web proxy you could choose the maximum size. Is this also used for DPI?

What happen, if you wait some more time after starting the download in DPI Engine? 

As already written, the download fails after a while. 

As already written, the download fails after a while. 

Hi Dome In case you get this fail. Do you see any kind of TLS Issue with this site in the Logviewer? Because on all of my appliances i cannot reproduce this. 

Why are dome`s web-proxy numbers that much higher? 

according to sophos marketing:

XG210 Rev 3

BEDROHUNGSSCHUTZ

800 MBit/s

XSTREAM-SSL-ENTSCHLÜSSELUNG

230 MBit/s

XG123 Rev 3

BEDROHUNGSSCHUTZ

400 MBit/s

XSTREAM-SSL-ENTSCHLÜSSELUNG

170 MBit/s

From my unerstandig XSTREAM = dpi

And shouldnt webproxy be "bedrohungsschutz" ?

dome do you have av scanning , ips and web policy off or configured?

No, until now I haven't seen a TLS error in the protocol. But I'll test it again on the weekend

Gunter Kaufmann yes ips and web policy is on, with the av scanning we have a limit of 30mb above it is not scanned. If I set this limit higher, the speed is 20mbits (field test 30PCs are currently working) I will test the exact speed on the weekend

Limit 30 MB

Limit increased for the Test 

Is there a possibility to also set such a limit for the DPI?