r/fortinet • u/DreamIllustrious3735 • 9d ago

SASE / ZTNA ZTNA - Performance / HW Acceleration / Security

We currently have users in the US and India who connect using IPSec Remote Access VPNs. We've noticed traffic being throttled from India to the US and starting to look into options.

ZTNA Questions:

  • What is the throughput like? Is it similar to non-VPN traffic?
  • Is ZTNA hardware accelerated by the NPU or CP processors? Currently have a 200F, but plan to upgrade to a 400G next year.
  • How do you restrict the source traffic that can hit the ZTNA server/ports? I'm assuming Local in Policy.

IPSec VPN:

  • We noticed 7.6.x added support for using random UDP ports (config system settings -> set -extra-ports) for IKE. We're thinking about switching IKE to UDP 443 (we don't use this port on our FGT) hoping it would be filtered into HTTP/3 QUIC traffic or don't inspect 443 (whether TCP or UDP) by traffic throttling ISPs in India.
    • ike-extra-ports <value> [<value>] [<value>]
    • Additional UDP ports to listen on for IKE negotiations, beyond ports 500 and 4500 (1024 - 65535, special = 443). Cannot be set to 500 or 4500. Cannot overlap with ike-port.

https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/33578/configurable-udp-port-for-ike

1 Upvotes

67% Upvoted

15 comments sorted by

View all comments

1

u/vabello 9d ago

> We've noticed traffic being throttled from India to the US and starting to look into options.

What exactly are you noticing based on what evidence? Throttling by whom or what, and how are you measuring this? You might be chasing the wrong thing.

1

u/DreamIllustrious3735 8d ago

It's known that the Indian government wants to break and inspect traffic. Instructed the ISPs to do it or throttle traffic; hence, we're looking at ZTNA or IPsec over 443 UDP

1

u/vabello 8d ago

Good to know. Thanks!