Why the Internet speed is chopped to 150 MBps?

MichaelBalack
MichaelBalack used Ask the Experts™
on
This using a subscribed Internet line with speed  - 250 Mbps. During the setup,my ISP engineer came down and did the speed test on the WAN router, and it can reach 250 Mbps. However, after we connect the Watchguard XTM series 2 firewall and 1 hp procurve 1910-24-poe switch, we found that the speed can not reach 250, the most it can reach is 130 Mbps. The connection is from Interne t towards the internal, are WAN router > Firewall > hp procurve 1910-24-poe switch.

On Watchguard xtm series 2, I already change both the trusted and untrusted interfaces to 1000M/duplex. After on hp switch, where the uplink connected to port 24, I also changed to 1000M/duplex. Still speed stay at 130 mbps, the most. Is there a way to increase the speed to up to 250 Mbps?

thanks,
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
MichaelBalackSenior System Engineer

Author

Commented:
MichaelBalackSenior System Engineer

Author

Commented:
MichaelBalackSenior System Engineer

Author

Commented:
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Muhammad BurhanManager I.T.
Top Expert 2015

Commented:
connect  PC or laptop just after WAN Router and run speed test.
call your ISP and discuss with them regarding CIR (Committed Information Rate).

if speed test shows 250 so connect PC/Loptop before switch (select that IP which have full access to internet) and then check the response.
Commented:
Another thing to note is the OS on the watchguard, i have had issues with a previous version that capped a connection to 50mb due to bad firmware. Complete the following steps:

Connect you laptop direct to the ISP Router
Set your Laptop with the WAN IP details
confirm internet access
Run speedtest (test to different servers)
If you do not receive the full speed contact the ISP with your findings, as this will be outside your network
If speeds are good confirm watchguard ONLY speedtest (just your laptop connected to trusted interface (you may need to re-configure your IP
If speed is restricted upgrade the firmware on the Watchguard and repeat test
If you still have speed issues log a ticket with Watchguard and they will support
If Speed is good at the Watchguard connect your switch and test again

If you follow the above you should find the hardware to continue testing with
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
You need to check the internal throughput of the WatchGuard Firewall. It may be too slow, and you may need to upgrade the firewall. I have had to do that to get higher internal throughput.

Commented:
Good comment John,
    Firewall Throughput XTM25 @ 240Mbps XTM26 @ 540Mbps, bigger issue maybe the VPN throughput @ 40Mbps & 60Mbps. If you are using additional tools and services AV/IPS/UTM these are also slower than you bandwidth so could be holding the unit back i have attached the unit Specs below:
wg_xtm2_ds.pdf
MichaelBalackSenior System Engineer

Author

Commented:
Hi ncomper and John,

Thanks for the suggestions. Moving forward from here, I will do the tests as mentioned by ncomper in his previous comments. I'll update you guys about the status.
MichaelBalackSenior System Engineer

Author

Commented:
Hi ncomputer and john,

Please see the test results:

a. Directly to router, with my laptop: 280/280
b. Connect router > watchguard > switch > my laptop: 130/130
c. Connect router > fortigate > switch > mylaptop: 110/110

Obviously, no hardware is faulty. Shall I check with ISP for CIR?
Muhammad BurhanManager I.T.
Top Expert 2015

Commented:
d. Router > switch > laptop
??
MichaelBalackSenior System Engineer

Author

Commented:
Hi Muhammed,

280/280
Muhammad BurhanManager I.T.
Top Expert 2015

Commented:
oK, if your switch is configurable so please ensure that there isn't any restriction in terms of bandwidth.
and then you have to do something with your firewalls.
MichaelBalackSenior System Engineer

Author

Commented:
Hi Muhammad,

Anything have to do on the firewalls?
Muhammad BurhanManager I.T.
Top Expert 2015

Commented:
check its configuration and try to find something which relates to the bandwidth at WAN and LAN as well.
JohnBusiness Consultant (Owner)
Most Valuable Expert 2012
Expert of the Year 2018

Commented:
a. Directly to router, with my laptop: 280/280
b. Connect router > watchguard > switch > my laptop: 130/130


I was not trying to say the hardware was faulty, but I was saying that internal throughput or other limitation of your watchguard and fortigate could possibly cause this issue.

I don't think the issue lies with your ISP since you can connect the computer and get full speed.
MichaelBalackSenior System Engineer

Author

Commented:
change internet line with higher CIR and it seems that the speed is maintained
President and Btrieve Guru
Commented:
This seems clear from the testing done thus far. The firewall is the issue. Remember that each device will have a maximum rated speed, but these reasons are indeed maximums - like saying that my car has a maximum speed of 120, it doesn't mean that I go everywhere really fast. Usually I top out around 75 or 80.

Try opening a support ticket with the vendor to see if your device should even be able to teach these speeds under normal conditions. You may need to eliminate all firewall rules to actually achieve this rate, which doesn't make for a good firewall.

If that fails, replace it with a faster unit, definitely one with a faster cpu, and you should be able to get higher throughput. Btw,my own firewall is rated somewhere around 120mbps, but I only get about 65 through it. Just hasn't seemed important enough to spend the money on a new one yet.
Its the Watchguard causing the slowdown and the fastest they claim for AV throughput is 142 Mbps for the XTM26 which, BTW, is processing a h*ll of a lot of data even though you don't say how many users are connected.
Check the data sheet: http://www.watchguard.com/wgrd-products/utm/xtm-2/overview
If you feel secure with your internal A/V, turn off the AV scanning in the Watchguard.
Aaron TomoskyDirector of Solutions Consulting
Commented:
It's the firewall. Try turning off all security features and see what happens. Usually the "rated " speed is bidirectional , so divide by 2 for 1 way throughput.
MichaelBalackSenior System Engineer

Author

Commented:
Thanks for the 4 experts in pointing out the culprit - watchguard firewall; at first, I didn't believe, but, after that I gave it a try to replace the firewall with a different brand firewall, and Vroom, the speed is a lot different.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial