Issue with File Transfer Speeds using an ATP800

2

All Replies

  • NEP
    NEP Posts: 92  Ally Member
    First Comment Friend Collector Third Anniversary
    edited August 7

    Just ran an iPerf test with 1 stream and it is hitting 100+ MB/s.

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,620  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @NEP

    Thanks for the update. Please allow me to summarize the test result:

    1. We tested with the devices going through UTM and also not (skip App Patrol and Content Filter via policy). The results were 21-37 MB/s. UTM on and off didn't make much difference. The range seems to be a result of other traffic.
      This is the result of Window file transfer.
    2. Two PC connect directly with ATP800 and use iPerf test, you get the result is hitting 100+ MB/s.

    Please help me clarify this summarize is correct or not.

    Zyxel Melen


  • NEP
    NEP Posts: 92  Ally Member
    First Comment Friend Collector Third Anniversary

    @Zyxel_Melen That is not correct. Some information is applied to the wrong test.

    Point # 1 is mostly correct, but it applies to two PCs being connected through switches to the ATP.

    Point # 2 is wrong. Two laptops were connected to each other (PeterUK request) and got 100 MB/s.

    To summarize, at no point have tests been above 40 MB/s with single stream iPerf through the ATP.

  • NEP
    NEP Posts: 92  Ally Member
    First Comment Friend Collector Third Anniversary

    @Zyxel_Melen I just direct messaged you the config (obfuscated of course) for our device. Hopefully that will shed some light on what might be happening.

  • NEP
    NEP Posts: 92  Ally Member
    First Comment Friend Collector Third Anniversary

    Hello. I have a little bit more to add to the discussion.

    We have a spare ATP800 (kept as a backup), so I factory reset it, clicked Next-Next through the Initial Setup (ie. defaults), and then upgraded it to the latest 5.40 firmware. Afterwards I ran some tests between three devices. With them connected, I'm getting ~112 MB/s on the same subnet and ~94 MB/s on a different subnet. This was the same for all devices, which were a server, desktop, and laptop.

    So I backed up our production ATP config and restored it on the spare ATP. When devices are on the same subnet, I get 108 MB/s. When they are on different subnets the speed is 52.6 MB/s. That is 12.6 MB/s higher than the fastest speed achieved with our production ATP, albeit without a large quantity of devices connected. That doesn't seem like a lot.

    At any rate, the limited speed we are seeing seems to be a combination of device load and the configuration. @Zyxel_Melen Based on the above and the CONF that was sent, what do you guys think?

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,620  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @NEP

    Thanks for your update. For the main issue, we are still clarifying it. However, I want to let you know that the security services that affect the transmit speed are Anti-Malware and IPS in a cross-subnet scenario. According to your comment, it appears that you are only bypassing the content filter and application patrol. Could you create an IP exception policy for Anti-Malware and IPS for internal LAN subnets?

    image.png

    Additionally, the IP exception policy is not bidirectional. It only applies to the direction you set.

    Zyxel Melen


  • NEP
    NEP Posts: 92  Ally Member
    First Comment Friend Collector Third Anniversary
    edited August 12

    @Zyxel_Melen Thanks. Based on your response, we've made the following changes.

    1. Ran iPerf test from my PC to the server and got 36.8 MB/s
    2. Added an IP Exception (all services) for my PC to the server IP range
    3. Ran iPerf test and got 38.6 MB/s
    4. Added an exception for the server IP range to my PC
    5. Ran test and got 37.3 MB/s

    Unless I misunderstood what you asked, it does not seem to have made any difference.

    Is there any way to get better metrics on what system usage is like? The dashboard view doesn't show a whole lot. Kind of have to guess what is going on. Anyway, according to the graph, the highest TX (yellow) is 265 Mbps and the highest RX (green) is 215 Mbps. Since those happen at the same time I expect those need added together for a total of 480 Mbps. If UTM throughput for the ATP is 1900 Mbps (UDP), but we lower that to 1400 Mbps (TCP) just because, the attained speed is 1/3 of the total available throughput. That said, naturally this would be limited by the ATP only having 1Gb Ethernet uplink, but that would still be almost double. Double the performance would be great. Can the uplink limitation be improved by creating a LAG for it? I understand we won't exactly get faster speeds, but I would expect the ATP to receive more data and since there is room for processing be able to process it. Maybe that isn't correct. I understand enough about networking to be dangerous :-)

    Anyway, haven't gotten an answer yet, so I'm going to ask this point blank. Is the ATP800 capable of this higher throughput? I just need a yes or no. The numbers would seem to indicate yes, so if that is true we can continue to figure out how to fix it. If the answer is no, then we need to look for a new firewall. I understand there is a lot involved, but it should be a relatively easy question for those who designed/manufactured the hardware.

    msedge_nUmiirpgCo.png

    Thank you for your continued help with this!

  • NEP
    NEP Posts: 92  Ally Member
    First Comment Friend Collector Third Anniversary

    Side note, slightly unrelated. There is a bug which affects the "Tx/Rx Statistics" where the graph shows a different value than the selected port. I noticed it when jumping back and forth between this thread and the dashboard. It probably has to do with the graph refreshing and not respecting the selected port. Not a big deal but it is confusing/misleading.

  • PeterUK
    PeterUK Posts: 3,939  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited August 12

    LAG will not help between two computers there must be something wrong because with my VPN300 (EOL) under ZLD that has less throughput does 105MB/s SMB between two subnets.

    Did you say that under the same subnet by your switch your speed was slow?

  • NEP
    NEP Posts: 92  Ally Member
    First Comment Friend Collector Third Anniversary

    Again, I don't know tons about networking, but I could potentially see LAG helping between two computers. Unless I'm misunderstanding something, packets are split up before being sent. All of my packets do not flood the "pipe" and take precedent over those of everyone else. So if my single stream to a server through the ATP has to wait on packets, my speed will be affected. However, if LAG was added I see the potential for my packets getting through "faster" to increase my speed. Is that not how it works? I understand that I won't be able to get more than 100 MB/s because I am limited by max 1GB Ethernet speeds, but it should improve.

    We have quite a few NAT, Routing, and Security Policy entries (~40). Could they slow things down?

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）