topic Re: Slow FTP Download/Upload in Firewall and Security Management

Slow FTP Download/Upload

Bond786 — Sat, 06 Nov 2021 15:46:30 GMT

Dear Experts,

I have one query as we are facing an issue that FTP connection is running slow for a website which is hosted behind Checkpoint Firewall. The security gateway is running on R81 with latest hot fix, the ISP has 800Mbps download and 700 Mbps Upload but we are only getting 1 Mbps of speed currently. We used to get 10Mbps but the speed has reduced gradually from last few months.

Any possible reasons behind this? and also what things I can check on the Firewall to make sure firewall is not causing any issues.

Many thanks

Re: Slow FTP Download/Upload

G_W_Albrecht — Sun, 07 Nov 2021 08:53:55 GMT

There are some reasons for such a behaviour:

- Basically every connection thru the GW will only get a part of the possible ISP speed, so one client doing file transfer will get e.g. 10Mbps, but every additional client will also get 10Mbps as long as that is possible.

- Of much importance is the TP policy - which blades do work on the ftp connections ? If these connections can not contain malware you could exclude them from all TP blades.

- Also look into the GW logs if there are many drops and re-transmissions of FTP packets (just to be sure !)

- Lastly you should look at other connections on the GW at the time of the FTP slowness, as you could prioritize FTP over other connections using QoS.

Re: Slow FTP Download/Upload

Timothy_Hall — Sun, 07 Nov 2021 13:32:09 GMT

If the FTP traffic is traversing an IPSec VPN tunnel, it is almost certainly an IP MTU/fragmentation issue.

Is it just the FTP connection that is slow or is everything slow? Run netstat -ni on the firewall and make sure underlying network interfaces are running cleanly.

Finally as Gunter said it is likely that recent changes to your Threat Prevention (TP) setup may be pulling this FTP traffic into a slower path for more inspection. Try creating a null TP profile (a new TP profile with all five TP blades unchecked), then match it to the FTP system via Protected Scope at the top of your TP policy and try again. Did that help?

Re: Slow FTP Download/Upload

Bond786 — Mon, 15 Nov 2021 10:14:15 GMT

Issue was with client ISP.

Many Thanks for the advise.

Re: Slow FTP Download/Upload

Bond786 — Mon, 15 Nov 2021 10:14:29 GMT

Issue was with client ISP.

Many Thanks for the advise.

Re: Slow FTP Download/Upload

Matlu — Wed, 29 Nov 2023 17:42:52 GMT

Hello,

When the problem is with the "download" of a certain resource, from my LAN to the Internet, passing through a GW, how can you rule out, that the problem is not the Firewall.

For example, I have such a flow:

User_LAN -> SW -> ClusterGW -> ISP -> INTERNET

The user tries to download a public resource that is on the Internet, but the "download" is too slow.

Is there any way to rule out that the problem is the FW?

Regards.

Re: Slow FTP Download/Upload

PhoneBoy — Thu, 30 Nov 2023 00:34:36 GMT

If the firewall is causing the problem, you would see evidence of it.
For example, a single CPU is 100% during the file transfer or something in the Super Seven Commands is off: https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/m-p/40528#M703
There may be other signs, but that's the most obvious.