topic Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow? in Spark Firewall (SMB)

Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

rdiaz — Mon, 04 Aug 2025 19:38:21 GMT

Hello Checkmates,

this is my first time creating a post here. 🙂 Also, I'm fairly new to CheckPoint firewalls. I'm seeing what I consider slow VPN tunnel speed/throughput between sites. All tests i ran (with OpenSpeedTestServer) yield pretty much the same speeds (around 150 to 175 Mbps download and upload). All sites have 1Gbps Internet speeds (expect 2 of them at 500Mbps and 200Mbps, but I don't bother testing those). There are 6 x Quantum Spark 1600s and 2 x 1535 series (the 1535 are connected to the slower ISPs). Azure Vnet is part of the site-to-site as well. I have most of the blades enabled on these firewalls (App control, Identity, URL filtering, IPS, Anti-Bot & Anti-virus). All these are managed by a on-premise management server and the main site has a cluster of 2 x 1600s where the VPN tunnels run from.

These are all up to date running R81.10.x verisons.

my question is, is this the expected perforcemance (around 150 to 175 Mbps download and upload) from these firewalls in a site to site setup?

I come from Cisco ASA 5500x and they were able to reach near the speeds of internet connections of 1Gbps via a site-to-site connection.

Any guidance is welcome and appreciated. thank you in Advance.

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

Chris_Atkinson — Mon, 04 Aug 2025 23:19:40 GMT

Which encryption algorithms are used?

Is MSS clamping configured?

How is the test being run, are multiple concurrent connections used rather than a single flow?

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

the_rock — Tue, 05 Aug 2025 00:58:16 GMT

First off, WELCOME :). Secondly, totally valid points. I would refer you to below sk, as it would certainly explain the behaviour.

Andy

https://support.checkpoint.com/results/sk/sk73980

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

G_W_Albrecht — Tue, 05 Aug 2025 08:04:07 GMT

As an addition:

- enabled TP blades maketraffic slower

- try to open more than one connection at the same time for testing, as single connections will not get the full speed (so there will be ressources left for other connections)

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

rdiaz — Tue, 05 Aug 2025 14:17:52 GMT

Hi Chris,

Thank you for the quick response.

1. see attached screenshot of the VPN community with all encryiptions used (not sure which is which). I tried to embed the image, but got a message syaing invalid HTML found in teh message body.

2. I have no clue what MSS clamping is. 🙂 can you tell me what this is and how to do it?

3. I downloaded OpenSpeedTestServer (a web server that I put on a VM taht has a 25Gbps NIC on it) and then open the URL of that web server on the other side of the vpn tunnel in another site. in this case HQ hosting the vpn server (with 1Gbps link and the other is the Datacenter with 1Gbps on a physical sever in the web browser). Not sure if this is using Multiple or single flow. How can I find out?

Thank you!

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

rdiaz — Tue, 05 Aug 2025 14:22:21 GMT

Thank you! 🙂 I'm seeing the encryption types might be the issue for me. looking at the link you provided and the encryption combination I see in my config (screenshot attached). it seems i have the worst combination for speed. 🙂 is my conclution correct?

Also, If i choose to change it, will this interrupt the VPN Tunnels? thanks for your gudiance, much appreciated.

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

the_rock — Tue, 05 Aug 2025 14:24:43 GMT

Technically, it might interrupt the tunnel for few minutes, since it needs policy push and probably resetting the tunnel would not be a bad idea.

Other than that, I would not anticipate any issues.

Andy

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

rdiaz — Tue, 05 Aug 2025 14:24:57 GMT

Thanks, I'm not familiar on how to do this on checkpoint. Can you provide guidance on how to do this please? thank you.

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

the_rock — Tue, 05 Aug 2025 14:27:33 GMT

Here is one IMPORTANT thing to remember...so, faster algorithms will NOT be as secure as slower ones, so please keep that in mind. We all know how important IT security is 🙂

Andy

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

rdiaz — Tue, 05 Aug 2025 14:36:22 GMT

Thank you! Yes, I'm willing to take a bit more risk since we only deal with file/print and nothing includes PII data of any sort.

so Question: based on my screenshot, (attached)

If i change Phase 1 Data integrity from SHA256 to SHA1 (or MD5) and Diffie-hellman group from Group 14 to group 2 (1024-bit)

and

in Phase 2, change Data integrity from SHA256 to Sha1 (or MD5) and Group 14 to Group 2 (1024-bit).

Will that work properly and still be secure to some extend?

Thanks.

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

the_rock — Tue, 05 Aug 2025 14:37:51 GMT

It would be LESS secure, but in your case, I would give it a go.

Andy

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

rdiaz — Tue, 05 Aug 2025 14:47:49 GMT

Thank you, I will give that a go during off hours just in case. I'm using SmartConsole to do all this. Just to make sure i'm doing this right...make changes to encryption as noted above, push policy to all firewalls, then test tunnels and test speeds as per before? that sounds about right? 🙂

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

the_rock — Tue, 05 Aug 2025 14:49:36 GMT

You got it.

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

the_rock — Tue, 05 Aug 2025 15:24:33 GMT

I was thinking you should do policy verification, but no need, since you would not be changing policy itself, so no need, just install.

Andy

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

Danny — Tue, 05 Aug 2025 15:30:08 GMT

Best practice is to set up a VPN datasheet with most compatible settings at first (example).
Once this is working you can start fine tuning your VPN parameters to more secure values.
Speed tests based on a single file transfer will not show you the full picture, just give you an indication. Try multiple file transfers at the same time in both directions instead.

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

G_W_Albrecht — Tue, 05 Aug 2025 15:32:38 GMT

- make a server accessible on one site (http, ftp...)

- use e.g. a browser on the site on the other side of the tunnel to open up- or downlod connections

- first try one connection and note the thruput (time and size of transfered file), then more at the same time

- compare the possible troughputs according to the number of connections

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

G_W_Albrecht — Tue, 05 Aug 2025 15:34:08 GMT

Threath Prevention: Disable the TP blades (only for a very short time!), test and compare thruput

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

rdiaz — Tue, 05 Aug 2025 15:39:05 GMT

Thank you! I will give multiple files transfers simultaneously and test. I believe the OpenSpeedTestServer does multi-connection to perform the speedtest.

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

rdiaz — Tue, 05 Aug 2025 15:42:42 GMT

Thank you, I will try this as well tonight. 🙂

Re: Quantum Spark 1600s site-to-site VPN Tunnel speed/throughput about 150Mbps on 1Gbps link...slow?

the_rock — Tue, 05 Aug 2025 15:56:04 GMT