FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
jlim11
Staff
Staff
Article Id 304776
Description

This article describes how to test the speed of the interfaces on a FortiGate. Normally, the traffictest command on the FortiGate and an iPerf server for the speed test are used.

Scope FortiGate v7.0 and above.
Solution

It is not possible to select the 'ppp' interface when trying to set 'diagnose traffictest client-intf' and 'diagnose traffictest server-intf'.

The example below shows port2 using PPOoE for the addressing mode:


sys intf.JPG

When the interface is in PPPoE addressing mode, the FortiGate creates the 'ppp' interface:


ip addrlist.JPG
If the 'ppp1' is set for the client-intf and server-intf for the traffictest commands, it will not allow it:


traffictest intf.JPG
A traffictest will fail, since no IP address is assigned on the Physical Interface (port2). An IP address is assigned on the virtual interface 'ppp':


traffictest notworking.JPG
sniffer pppoe.JPG

 

Solution 1:

 

Starting from v7.0.0, FortiGate can be a Speedtest Server.

Use the following commands to enable this feature:

config sys global
    set speedtest-server enable
end


Add 'speedtest' on the interface where PPPoE is the addressing mode:


config sys interface
    edit port2
    append allowaccess speedtest
end


port2 intf.JPG

 

It is now possible to run speedtest using iPerf on a machine and point it to the Public IP of FortiGate's PPPoE interface:


iperf to pppoe.JPG
Traffic from the iPerf Client for TCP port 5201 is incoming on the 'ppp1' interface:


sniffer working to pppoe.JPG
For this setup, the topology looks like this:


[IperfClient]---------Internet-------------------publicIP[PPPoE-ISP-Router]------------------------10.13.13.255[FortiGate]

 

The PPPoE Router is configured to port-forward traffic to 10.13.13.255, which is a private IP.

If the FortiGate has the public IP assigned directly to the PPPoE interface, it is possible to use the Public IP which is attached to the FortiGate's interface. There is no need for port-forwarding on the ISP's PPPoE Router.

 

Solution 2:

 

Configure a PPPoE interface instead of having PPPoE addressing mode on a Physical Interface.

Select the PPPoE interface on the traffictest commands after configuring the PPPoE interface.


pppoe interface config.JPG

 

gui pppoe-interface.JPG

 

traffic test using pppoe-intf.JPG

 

using pppoe interface.JPG
Related articles: