Sophos SSL VPN - Severe performance issue after upgrade to XGS-2100 SFOS 19.5.3

Any help is appreciated. Thanks LuCar Toni Alok 

Hi Graboid$,

Thank you for reaching out to Sophos Community.

We regret to hear about your experience. Upon checking your case 07005202, this has already been forwarded to our GESTeam, and will be reaching out to you.

Hi Erick Jan , I mean no disrespect, however, the case is now several weeks old and I have been calling since Friday and asking to work on the case since it is a critical issue. Everyone (Support) keeps telling me someone from GES Team will call back, but no callback at all. That is why I am asking the Community for assistance

Hi Graboid$,

None taken, and I can see where you're coming from, I have put a note on your case and will further reach out to the respective team and have this case with the greatest importance. 

Hello,

This is now being investigated under NCL-1798.

Regards,

I see support has replied and is working on a case but I will throw in my 2 cents. We have an XGS-3100 and we found the fastest SSL VPN performance using the AES-128-GCM encryption and switch to TCP. I realize UDP should be faster for SSL VPN but on our XGS doing comparative tests, TCP seems like it was being accelerated more than UDP was. Couldn't hurt to try it as a test. And yes, leave debug and compression turned off.

Good find, indeed SSLVPN over TCP not only performing better but also consuming much less CPU than UDP.

On some cases the CPU consumption over TCP is half of UDP.

Gary Balbach - Thank you for the 2 settings. The combination of TCP and AES-128-GCM encryption is a lot faster than what we currently have after the migration.

The above recommendation pointed me in the right direction. I tested several combinations of TCP, Encryption Algorithm and Key Size, however, it only resolves one performance issue over the other and it does not resolve all other performance issues. e.g., I used TCP, AES-128GCM, 1024 and SMB transfer is a lot faster but has high ping latency which affects internal apps. TCP and AES-128-CBC, 2054 key resolves ping latency but Outlook performance is very poor. I am still trying all possible combinations, however, unless I know what is really causing the issue after the migration, it would be hard to find the proper setup.

Sophos GES is way toooo slow for a critical issue that affects all users in the business. I was asked again to wait until 3 days from now. I am running out of options here, I tested several combinations of TCP/UDP and encryption settings, however, I cannot get everything back to normal. It only resolves one issue at a time depending on the protocol and security algorithm,