Description
This article describes how to use DTLS to improve SSL VPN performance.
Occasionally, SSL VPN performance can be slower than expected.
Since the SSL VPN encapsulates a TCP connection within another TCP connection, this can cause interference between timeouts, and other issues. See the external link for more information.
Since FortiOS 5.4, it is possible to use DTLS to address this problem.
DTLS has the same security as SSL, but uses UDP instead of TCP. This can improve performance drastically.
Useful link: FortiClient help article VPN options.
Occasionally, SSL VPN performance can be slower than expected.
Since the SSL VPN encapsulates a TCP connection within another TCP connection, this can cause interference between timeouts, and other issues. See the external link for more information.
Since FortiOS 5.4, it is possible to use DTLS to address this problem.
DTLS has the same security as SSL, but uses UDP instead of TCP. This can improve performance drastically.
Useful link: FortiClient help article VPN options.
Scope
FortiGate.
Solution
To enable DTLS on SSL VPN, run the following commands:
config vpn ssl settings
set dtls-tunnel enable
end
This has been enabled by default since 5.4.
If the client(s) are still using TCP, check FortiClient settings to ensure that the option 'Preferred DTLS Tunnel' is checked in the settings. If the option is greyed out, select the padlock on the top right to unlock it (Screenshot below). See the FortiClient help article for more information: VPN options.
When FortiClients are managed by EMS, the DTLS option cannot be enabled directly on the FortiClient console. Changes need to be pushed by the administrator from EMS.
Related article:
