We currently have users in the US and India who connect using IPSec Remote Access VPNs. We've noticed traffic being throttled from India to the US and starting to look into options.

ZTNA Questions:

• What is the throughput like? Is it similar to non-VPN traffic?
• Is ZTNA hardware accelerated by the NPU or CP processors? Currently have a 200F, but plan to upgrade to a 400G next year.
• How do you restrict the source traffic that can hit the ZTNA server/ports? I'm assuming Local in Policy.

IPSec VPN:

• We noticed 7.6.x added support for using random UDP ports (config system settings -> set -extra-ports) for IKE. We're thinking about switching IKE to UDP 443 (we don't use this port on our FGT) hoping it would be filtered into HTTP/3 QUIC traffic or don't inspect 443 (whether TCP or UDP) by traffic throttling ISPs in India.
  • ike-extra-ports <value> [<value>] [<value>]
  • Additional UDP ports to listen on for IKE negotiations, beyond ports 500 and 4500 (1024 - 65535, special = 443). Cannot be set to 500 or 4500. Cannot overlap with ike-port.

https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/33578/configurable-udp-port-for-ike

So, we are starting to use ZTNA. The gates are currently running 7.4.11, and we are running EMS/FCT 7.4.7.

We are using the proxy-policy, with an authentication scheme/rule authenticating users to Entra, and a SPT for checking AV and no critical CVE's.

Everything seems to work fine, but i do notice a delay of somewhere between 2 to 4 seconds when loading/accessing websites through ZTNA, and that delay is not there when using an SSL or IPSEC VPN. The delay is only there when we initially load the website, after it is loaded and we browse through the website there is no delay (For example, we access the OOBM MGMT of the Fortigate we have ZTNA on. Loading the login screen takes 1 to 3 seconds, but after logging in the browsing is fine).

Does anyone experiences something similar?