Low Speed

[handiansudianto]

Hello,

I feel strange when upload file to the internet we got slow speed, my internet bandwidth is 100 Mbps but the upload only get around 20 Mbps. But when i test on speedtest.net i got high speed, can be more than 90 Mbps. What should i check on my checkpoint? I using Checkpoint 5800 series.

[PhoneBoy]

Please provide the following:

• Version/JHF of Gateway in question (should be of form Rxx.yy JHF Take zz, can get from cpinfo -y all)
• Output of the Super Seven Commands: https://community.checkpoint.com/t5/Scripts/S7PAC-Super-Seven-Performance-Assessment-Commands/td-p/4... 

[the_rock]

That could be so many things...IPS, any other threat prevention blades, Securexl, vpn accel, MTU size. First off, I would start with disabling sxl to see if it makes any difference at all.

fwaccel off

[Kaspars_Zibarts]

Before starting "fixing" FW, you need to think about latency - if your web service is "far away", i.e. having high round trip time (RTT), you might never get close to 100Mbps with or without FW. Easiest way would be running ping (if it responds) or traceroute and see the closest hop to finish line. Just google if you don't want to calculate yourself, but there are two major factors in throughput - latency and TCP window size. You can see from example below: even your connection is 100Mbps, but with latency of 35ms and with default TCP window of 64kB, your transfer rate will be close to 14Mbps.

Normally TCP window scaling (growing it larger automatically) compensates for higher latency, but then you would have to make sure that it is in use in your case. I.e. with TCP dump

Once you have eliminated these basic factors outside FW, then jump into deeper analyses.

HTTPS inspection, if used, will reduce rates considerably. Check your logs and policy for that.

Turning off SXL as suggested by Rock is a risky business - you might overload your FW, be carefull with that.

[the_rock]

Thanks for sharing that, excellent!