SRX Services Gateway
Reply
Super Contributor
johnrbaker
Posts: 210
Registered: ‎02-17-2011
0

Re: Slow downloads on the client computers behind nat SRX 210

FYI

 

Apart from the IKE AGL, unless you need to, disable all ALG.  It can cause a lot of issues.  Streaming video etc.

 

What is you MSS/MTU Value?  What is your WAN connection type?

Contributor
moslift
Posts: 14
Registered: ‎07-09-2012
0

Re: Slow downloads on the client computers behind nat SRX 210


gosi wrote:

moslift wrote:

Sebastian, these options i use only on wan interfaces following these recommendations http://jsrx.juniperwiki.com/index.php?title=Syn_Check


For internal nets i use

no syn-check-required; and no sequence-check-required;


Are you expecting asynchronous traffic?


Probably no, are you advise to globally turn off syn-check and sequence-check?

Contributor
gosi
Posts: 82
Registered: ‎12-11-2009
0

Re: Slow downloads on the client computers behind nat SRX 210


moslift wrote:
Probably no, are you advise to globally turn off syn-check and sequence-check?

No, you should be fine. Could you please run flow traceoption to capture the traffic from your slow ftp transfer?

 

Kind regards,

Sebastian

Contributor
moslift
Posts: 14
Registered: ‎07-09-2012
0

Re: Slow downloads on the client computers behind nat SRX 210

I turned off all ALG and now I have

 >show security alg status    
ALG Status :
  DNS      : Disabled
  FTP      : Disabled
  H323     : Disabled
  MGCP     : Disabled
  MSRPC    : Disabled
  PPTP     : Disabled
  RSH      : Disabled
  RTSP     : Disabled
  SCCP     : Disabled
  SIP      : Disabled
  SQL      : Disabled
  SUNRPC   : Disabled
  TALK     : Disabled
  TFTP     : Disabled
  IKE-ESP  : Disabled

But speed ftp downloads still remain at 25-35 kb/sec

 

I use mtu 1472 and mss 1300. Also set 'path-mtu-discovery'.

WAN connection type - ethernet.

Super Contributor
johnrbaker
Posts: 210
Registered: ‎02-17-2011
0

Re: Slow downloads on the client computers behind nat SRX 210

Hi

Your MTU value could still be an issue. Try 1452 to even lower.

What are the setting for your Ethernet WAN port? 100/Full Auto?


However I have just tried to ftp from the same site and I am only getting 300-400KBps
Contributor
moslift
Posts: 14
Registered: ‎07-09-2012
0

Re: Slow downloads on the client computers behind nat SRX 210

> show security flow session source-prefix 192.168.0.7 destination-port 21
Session ID: 4496, Policy name: nat_list/6, Timeout: 1764, Valid
  In: 192.168.0.7/50189 --> 204.152.184.73/21;tcp, If: ge-0/0/0.0, Pkts: 25, Bytes: 1616
  Out: 204.152.184.73/21 --> 62.117.117.20/2065;tcp, If: fe-0/0/2.0, Pkts: 35, Bytes: 2678
Total sessions: 1

Policies are:

 

from-zone trusted to-zone untrusted {
            policy nat_list {
                match {
                    source-address nat_list_set;
                    destination-address any;
                    application any;
                }
                then {
                    permit {
                        tcp-options {
                            syn-check-required;
                            sequence-check-required;
                        }
                    }
                }
            }
        }
        default-policy {
            deny-all;
        }

 

And I add IP-addresses to nat_list, who need internet access (for example proxy-server).

Super Contributor
johnrbaker
Posts: 210
Registered: ‎02-17-2011

Re: Slow downloads on the client computers behind nat SRX 210

Hi

 

I am still getting flow FTP from the main freebsd site

 

Try one of its mirrors

 

ftp://ftp.uk.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/9.0/

 

My speed went from 300 to 1500KB/s

 

 

 

 

Contributor
moslift
Posts: 14
Registered: ‎07-09-2012
0

Re: Slow downloads on the client computers behind nat SRX 210

100Mb, link-mode-auto.

 

I set mtu to 1452, then 1432, then to 1400. Problem still persists.

 

The command > show interfaces fe-0/0/2

shows me

Link-level type: Ethernet, MTU: 1514, Link-mode: Full-duplex, Speed: 100mbps

 

But in configuration i set 1452!

What to believe?

Super Contributor
johnrbaker
Posts: 210
Registered: ‎02-17-2011
0

Re: Slow downloads on the client computers behind nat SRX 210

The Ethernet link MTU is seperate to the IP MSS value.  Dont worry about it.

 

Does any other type of traffic have any speed/preformance issues?

 

What is te modem/router that the SRX is connected to?

 

Are you running any UTM on the SRX?

 

I would still suggest upgrading to 12.1R2.9

Super Contributor
johnrbaker
Posts: 210
Registered: ‎02-17-2011
0

Re: Slow downloads on the client computers behind nat SRX 210

Also

 

Run

 

show interfaces fe-0/0/2 statistics detail

 

 

Look for the Input/Output errors

Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.