topic Re: Low Speedtest result when behind CheckPoint Firewall in Spark Firewall (SMB)

Low Speedtest result when behind CheckPoint Firewall

Theo — Wed, 02 Jan 2019 14:38:12 GMT

Subscribed Internet Rate: 10Mbps Download, 10Mbps Upload

Clients behind the CheckPoint firewall only achieves max. of 3Mbps download and upload. If I attached a laptop directly to internet line, I got consistent 10M/10M (download/upload). But, if I used the same laptop and connect to Eth port of the CheckPoint I got the same as the clients behind the firewall.

Security Gateway: CheckPoint 1450

OS: Gaia

Version: R77.20.81 (990172541)

Enabled Blades:

Firewall
IPSec VPN
IPS
Anti-Bot
Anti-Virus
identity Awareness
Application Control
URL Filtering
QoS

Re: Low Speedtest result when behind CheckPoint Firewall

PhoneBoy — Wed, 02 Jan 2019 14:53:49 GMT

Moving this to SMB and SMP‌ section.

Which speed test site did you use?

How is the PC connecting to the 1450 (specifically what is speed and duplex setting)?

Re: Low Speedtest result when behind CheckPoint Firewall

Theo — Wed, 02 Jan 2019 14:55:55 GMT

I used speedtest.net

The laptop is connected using an ethernet cable (CAT5) to LAN3 of CheckPoint 1450. The Speed is set to Auto Full Duplex.

Re: Low Speedtest result when behind CheckPoint Firewall

Chris_Atkinson — Wed, 02 Jan 2019 15:10:51 GMT

I would start with reviewing sk125097 for relevance.

Also is the connection PPPoE based?

Re: Low Speedtest result when behind CheckPoint Firewall

Danny — Wed, 02 Jan 2019 15:13:39 GMT

You've activated almost all Software Blades available. On an SMB 1450 Embedded GAiA appliance (Datasheet) using an ARM926EJ-S processor with 1GB RAM (see 1400 FAQ). Try disabling if disabling all blades but FW speeds up your performance. Then investigate which blades requires most of your performance.

Re: Low Speedtest result when behind CheckPoint Firewall

Pedro_Espindola — Wed, 02 Jan 2019 15:24:57 GMT

What happens if you disable QoS?

Re: Low Speedtest result when behind CheckPoint Firewall

John_Pinegar — Wed, 02 Jan 2019 15:35:27 GMT

I have a bunch of 1450 appliances deployed and have run into this issue in the past. The first thing I would do is set the speed and duplex settings manually (Device >> Internet >> Edit >> Advanced >> Port Settings). Let me know if that solves your problem. Thanks.

Re: Low Speedtest result when behind CheckPoint Firewall

PhoneBoy — Wed, 02 Jan 2019 17:13:31 GMT

I was thinking of this on the client side, but yeah, also good to check this on the WAN link as well.

Re: Low Speedtest result when behind CheckPoint Firewall

Theo — Thu, 03 Jan 2019 01:17:58 GMT

Pedro Espindola wrote:
What happens if you disable QoS?

This works!

Re: Low Speedtest result when behind CheckPoint Firewall

Theo — Thu, 03 Jan 2019 01:21:17 GMT

Thanks. I'm using Static connection.

I couldn't find this "Threat Prevention Anti-Virus policy - Resource classification mode" in my Advance Settings. The suggestion of Pedro Espindola‌ below helps

Re: Low Speedtest result when behind CheckPoint Firewall

Theo — Thu, 03 Jan 2019 01:31:43 GMT

I did but got the same results. Thanks for the tip

Re: Low Speedtest result when behind CheckPoint Firewall

Pedro_Espindola — Thu, 03 Jan 2019 01:57:15 GMT

It seems QoS limits speed of a single connection to 25 - 30% of the link speed for whatever reason, even if it is the only connection.

What were your QoS configs?

I have to do some testing, but it seems there are some hidden default QoS rules for traffic shaping besides the ones we can configure.

Re: Low Speedtest result when behind CheckPoint Firewall

Theo — Thu, 03 Jan 2019 02:25:38 GMT

I'm still doing the troubleshooting, the download returned to 3M while upload seems fine at 8 or 9M.

My QoS only have Default as I temporary deleted the created previously (for test purposes)

Now, download drops again to max. 3M

Re: Low Speedtest result when behind CheckPoint Firewall

Theo — Thu, 03 Jan 2019 06:20:14 GMT

What a strange behavior, I started to disabled Anti-Bot, Antivirus, QoS and noticed that the speed went up for a couple of minutes but was also revert to maximum of 3Mbps download and upload.

Re: Low Speedtest result when behind CheckPoint Firewall

Timothy_Hall — Thu, 03 Jan 2019 14:50:56 GMT

Please provide output of netstat -ni, and ethtool (interfacename) for all interfaces, it sounds like your network is not running cleanly.

CheckMates Break Out Sessions Speaker

CPX 2019 Las Vegas & Vienna - Tuesday@13:30

Re: Low Speedtest result when behind CheckPoint Firewall

Balamurugan_M — Fri, 04 Jan 2019 03:20:46 GMT

Hi,

Have you verified tracker logs for any restricted traffic due to some policy?

Once I had a similar issue due to IPS policy. Kindly do review ur policy settings.

Thanks.

Re: Low Speedtest result when behind CheckPoint Firewall

HristoGrigorov — Fri, 04 Jan 2019 04:14:32 GMT

netstat -ni is unfortunately not available on SMB. ethtool is there but won't give any useful info.

I wonder what build is Darius running?

Also does that happen if you download something from the appliance itself ? I mean login with ssh and use wget or curl.

What IPS profile is in use ?

fwaccel stats -s may be and also have you tried to connect ONLY your laptop behind the appliance and directly to it not through some switch ?

Re: Low Speedtest result when behind CheckPoint Firewall

Timothy_Hall — Fri, 04 Jan 2019 04:21:39 GMT

How about ifconfig (interfacename) or ifconfig -a? That should provide enough detail...

CheckMates Break Out Sessions Speaker

CPX 2019 Las Vegas & Vienna - Tuesday@13:30

Re: Low Speedtest result when behind CheckPoint Firewall

HristoGrigorov — Fri, 04 Jan 2019 04:28:36 GMT

Yeah, ifconfig -a would be nice to see. May want to replace your public IP with something else for privacy.

Re: Low Speedtest result when behind CheckPoint Firewall

Theo — Fri, 04 Jan 2019 05:28:24 GMT

Hi Timothy Hall and Hristo Grigorov thanks for the comments guys

I update the version in my original post it's R77.20.81 (990172541)

I copied only important ports, LAN1 and LAN2 uses to connect Switch. Btw, I changed the MAC and IP into xxx for privacy indeed.

WAN Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:xxx.xxx.xxx.xxx Bcast:xxx.xxx.xxx.xxx Mask:xxx.xxx.xxx.xxx
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:29392574 errors:1439911 dropped:755 overruns:0 frame:1557862
TX packets:25045004 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4292707451 (3.9 GiB) TX bytes:2376566533 (2.2 GiB)
eth1 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:28961827 errors:0 dropped:1 overruns:0 frame:0
TX packets:29090006 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3400537063 (3.1 GiB) TX bytes:4190357047 (3.9 GiB)
LAN1 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:24087372 errors:0 dropped:1 overruns:0 frame:0
TX packets:27842428 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1511988096 (1.4 GiB) TX bytes:3947024923 (3.6 GiB)
LAN2 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4866498 errors:0 dropped:6 overruns:0 frame:0
TX packets:1247572 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1771935171 (1.6 GiB) TX bytes:533676195 (508.9 MiB)

I disabled QoS yesterday and I noticed the speed jumped now to 9M/9M. I also noticed that there is an entry in Limits for Office365 Applications with 3M/3M and I temporary delete this for test purposes