topic Re: Slow traffic on https/http on site to site in Spark Firewall (SMB)

Slow traffic on https/http on site to site

Bynet_Security_ — Sat, 08 Mar 2025 17:57:42 GMT

Hello everyone,
I set up a site to site between a Check Point 1500 machine that is managed locally and a Fortigate machine
The site above works fine but all traffic in https + http is very slow.
We checked downloading and uploading files and it was fine.
I would be happy to get some direction on what to check to locate the source of the problem
And if possible also an explanation of how to check if something is unclear.
Thanks to all who answered

Re: Slow traffic on https/http on site to site

AdiGH — Sat, 08 Mar 2025 18:02:37 GMT

Hey, which Check Point product do you have installed?

Re: Slow traffic on https/http on site to site

Lesley — Sat, 08 Mar 2025 20:39:24 GMT

what blades you have enabled on the 1500?

What encryption methods you use on the site to site?

Re: Slow traffic on https/http on site to site

Chris_Atkinson — Mon, 10 Mar 2025 06:54:59 GMT

Potentially an MTU issue, look into MSS clamping per sk121114.

Ensure 3DES isn't used where possible in favour of AES-NI friendly algorithms.

Which version of R81.10.xx is used ?

Re: Slow traffic on https/http on site to site

Timothy_Hall — Sun, 09 Mar 2025 15:18:46 GMT

Please post outputs of Super Seven plus enabled_blades.

MSS clamping would normally only apply to IPSec traffic and not HTTPS traffic. This is because in IPSec the whole ESP packet (mostly) is digitally signed and therefore cannot be fragmented (DF flag). With HTTPS the payload stream of data is digitally signed, and the packets carrying it can be fragmented into a zillion pieces, as long as the payload stream of data being carried reassembles correctly. This is why HTTPS/TLS based Remote Access VPN clients are more resistant to low MTU performance issues.