Why the Internet speed is chopped to 150 MBps?

This using a subscribed Internet line with speed  - 250 Mbps. During the setup,my ISP engineer came down and did the speed test on the WAN router, and it can reach 250 Mbps. However, after we connect the Watchguard XTM series 2 firewall and 1 hp procurve 1910-24-poe switch, we found that the speed can not reach 250, the most it can reach is 130 Mbps. The connection is from Interne t towards the internal, are WAN router > Firewall > hp procurve 1910-24-poe switch.

On Watchguard xtm series 2, I already change both the trusted and untrusted interfaces to 1000M/duplex. After on hp switch, where the uplink connected to port 24, I also changed to 1000M/duplex. Still speed stay at 130 mbps, the most. Is there a way to increase the speed to up to 250 Mbps?

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MichaelBalackAuthor Commented:
MichaelBalackAuthor Commented:
MichaelBalackAuthor Commented:
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

Muhammad BurhanManager I.T.Commented:
connect  PC or laptop just after WAN Router and run speed test.
call your ISP and discuss with them regarding CIR (Committed Information Rate).

if speed test shows 250 so connect PC/Loptop before switch (select that IP which have full access to internet) and then check the response.
Another thing to note is the OS on the watchguard, i have had issues with a previous version that capped a connection to 50mb due to bad firmware. Complete the following steps:

Connect you laptop direct to the ISP Router
Set your Laptop with the WAN IP details
confirm internet access
Run speedtest (test to different servers)
If you do not receive the full speed contact the ISP with your findings, as this will be outside your network
If speeds are good confirm watchguard ONLY speedtest (just your laptop connected to trusted interface (you may need to re-configure your IP
If speed is restricted upgrade the firmware on the Watchguard and repeat test
If you still have speed issues log a ticket with Watchguard and they will support
If Speed is good at the Watchguard connect your switch and test again

If you follow the above you should find the hardware to continue testing with
JohnBusiness Consultant (Owner)Commented:
You need to check the internal throughput of the WatchGuard Firewall. It may be too slow, and you may need to upgrade the firewall. I have had to do that to get higher internal throughput.
Good comment John,
    Firewall Throughput XTM25 @ 240Mbps XTM26 @ 540Mbps, bigger issue maybe the VPN throughput @ 40Mbps & 60Mbps. If you are using additional tools and services AV/IPS/UTM these are also slower than you bandwidth so could be holding the unit back i have attached the unit Specs below:
MichaelBalackAuthor Commented:
Hi ncomper and John,

Thanks for the suggestions. Moving forward from here, I will do the tests as mentioned by ncomper in his previous comments. I'll update you guys about the status.
MichaelBalackAuthor Commented:
Hi ncomputer and john,

Please see the test results:

a. Directly to router, with my laptop: 280/280
b. Connect router > watchguard > switch > my laptop: 130/130
c. Connect router > fortigate > switch > mylaptop: 110/110

Obviously, no hardware is faulty. Shall I check with ISP for CIR?
Muhammad BurhanManager I.T.Commented:
d. Router > switch > laptop
MichaelBalackAuthor Commented:
Hi Muhammed,

Muhammad BurhanManager I.T.Commented:
oK, if your switch is configurable so please ensure that there isn't any restriction in terms of bandwidth.
and then you have to do something with your firewalls.
MichaelBalackAuthor Commented:
Hi Muhammad,

Anything have to do on the firewalls?
Muhammad BurhanManager I.T.Commented:
check its configuration and try to find something which relates to the bandwidth at WAN and LAN as well.
JohnBusiness Consultant (Owner)Commented:
a. Directly to router, with my laptop: 280/280
b. Connect router > watchguard > switch > my laptop: 130/130

I was not trying to say the hardware was faulty, but I was saying that internal throughput or other limitation of your watchguard and fortigate could possibly cause this issue.

I don't think the issue lies with your ISP since you can connect the computer and get full speed.
MichaelBalackAuthor Commented:
change internet line with higher CIR and it seems that the speed is maintained
Bill BachPresident and Btrieve GuruCommented:
This seems clear from the testing done thus far. The firewall is the issue. Remember that each device will have a maximum rated speed, but these reasons are indeed maximums - like saying that my car has a maximum speed of 120, it doesn't mean that I go everywhere really fast. Usually I top out around 75 or 80.

Try opening a support ticket with the vendor to see if your device should even be able to teach these speeds under normal conditions. You may need to eliminate all firewall rules to actually achieve this rate, which doesn't make for a good firewall.

If that fails, replace it with a faster unit, definitely one with a faster cpu, and you should be able to get higher throughput. Btw,my own firewall is rated somewhere around 120mbps, but I only get about 65 through it. Just hasn't seemed important enough to spend the money on a new one yet.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Davis McCarnOwnerCommented:
Its the Watchguard causing the slowdown and the fastest they claim for AV throughput is 142 Mbps for the XTM26 which, BTW, is processing a h*ll of a lot of data even though you don't say how many users are connected.
Check the data sheet: http://www.watchguard.com/wgrd-products/utm/xtm-2/overview
If you feel secure with your internal A/V, turn off the AV scanning in the Watchguard.
Aaron TomoskyDirector of Solutions ConsultingCommented:
It's the firewall. Try turning off all security features and see what happens. Usually the "rated " speed is bidirectional , so divide by 2 for 1 way throughput.
MichaelBalackAuthor Commented:
Thanks for the 4 experts in pointing out the culprit - watchguard firewall; at first, I didn't believe, but, after that I gave it a try to replace the firewall with a different brand firewall, and Vroom, the speed is a lot different.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.