Recommended MTU for GlobalProtect Gateway

[Farzana]

Hello,

We’re experiencing slowness from global connect clients located offsite back to firewall (i.e. 5MBps). Without the VPN client, the user can get up to 60MBps.

What is the recommended MTU settings for GlobalProtect Gateway/interface should be set at? Our Ethernet interface(1/3) MTU where gateway terminates in DMZ is set at 1350 and the tunnel.11 is set to 1400. Does this need to be the same?

I have already checked the KB below.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Improve-Performance-for-IPSec-Traffi...

Thanks in advance.

[Raido_Rattameister]

Open GlobalProtect client.

Go to Details tab.

Is protocol SSL or IPSec?

If SSL then check if you are blocking incoming UDP port 4501 towards GlobalProtect Gateway.

SSL runs over TCP.

IPSec runs over UDP and avoids TCP meltdown issue.

[Farzana]

Hi,

Checked all that you mentioned is fine. Clients connecting using IPSEC.

[Raido_Rattameister]

How do you measure speed?
Do you have public website in your environment you could place some big file and try to download it without GP over public internet and with GP connected over tunnel?

[Farzana]

Hi Raido,

Yes, we have a FTP service in the DMZ on same interface and speed is fine.

All we really want to know is what should the MTU settings on the tunnel vs interface be set at?

We have tried setting interface to 1360, tunnel MTU to 1400 and select Adjust TCP MSS.

Getting 10MB down/10MB up. Without VPN we’re getting 40MB down/27MB up.

Is this what we should be seeing for GP VPN?

[Raido_Rattameister]

You have 0.0.0.0/0 route so all traffic goes into tunnel when GP is connected?

I have not changed MTU in my environment so using default.

Currently at home with 20Mbit down and I get same result (+/- 1Mbit) with and without GlobalProtect (no split tunneling, using 0.0.0.0/0 route in my GP config).

Test with http://www.speedtest.net

What is speed and latency when GP is on and when GP is off?

Any QoS in use?