5

So we have an environment with several VLANs connected to a FortiNet firewall using multiple interfaces trunked back to our L3 Dell PowerConnect 6248P switches.

Currently the FortiNet is setup to do the routing for all networks but I was curious performance benefit we may get by moving routing from the FortiNet to the Dell switches. I created a test by creating IP addresses for a couple of VLANs on our network on the Dell switches and made sure routing was enabled on the switches. I then set my computer up to use the new test gateway for that switch.

I did a simple ping test to get the latency and it came back with an average of about 1.5ms every time I pinged the new IP address for that VLAN on the switch.

If I change back so my gateway is going through the FortiNet so it does the routing and ping the IP address assigned for the VLAN on the FortiNet, I get an average latency of 0.5ms.

Shouldn't routing through the L3 switches have reduced latency over the FortiNet?

Am I missing some obvious crucial piece to getting this working as I had expected?

Improve this question
5
  • 1
    That depends. To start with, what is the model on the FortiNet? I don't have a lot of experience with Dell switches personally, but from what I can see the 6200 switches seem to be mainly targeted at L2 access. While they have L3 features, I wouldn't use them for routing personally. Just because a device can do something doesn't mean it should do it.
    – YLearn
    Oct 29, 2014 at 23:54
  • Also the initial ping could require an arp from the gateway. Generally the latency of the initial ping is not representative of actual performance.
    – cpt_fink
    Oct 30, 2014 at 6:16
  • This wasn't just the initial ping. I did the test several times to allow the ARP cache to populate. The model of firewall is a Fortinet 80c. The switch ports/interfaces are 10/100 but the WAN is gigabit. I wish the interfaces were gigabit as well. Not meaning to be completely ignorant about how all of this stuff works, but would it be a bottleneck to just leave the routing up to the Fortinet and not do it on at the Dell switch level? Does all traffic literally go through the Fortinet if it is used for routing? If that's the case, the 10/100 vs gigabit on the Dell's would obviously bottleneck
    – Donavon Yelton
    Oct 30, 2014 at 13:55
  • I should mention that we route things like VoIP through the Fortinet as well. Perhaps the best course of action would be to selectively route through the Dell switches? Things like VoIP would be an obvious choice I would think since it carries a lot of traffic. I would think routing everything through the Fortinet would benefit for security however on other networks.
    – Donavon Yelton
    Oct 30, 2014 at 14:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 18:08

2 Answers 2

Reset to default
5

Am I missing some obvious crucial piece to getting this working as I had expected?

You musn't confuse the latency of traffic destined to the switch with the latency through the switch.

When you ping a VLAN interface on a switch, you are quite often hitting the CPU/Control plane, which in the case of most enterprise-grade switches, is not a very powerful processor, and treats thing like inbound ICMP with a very low priority.

Re-run your test by rapidly pinging a device (multiple times) on another subnet when the Firewall is the gateway, and again when the switch is the gateway. You will probably find that latency measurements are now virtually indistinguishable.

Where you will get the best performance improvement though is routing throughput - most switches should be able route L3 at line rate (at least the majority should for the majority of their interfaces).

Use a tool like iperf to measure throughput between two hosts on different subnets with both the firewall and the switch in path and see what your results look like.

You didn't mention the model of your firewall, but it may handle 1Gbps of traffic without any issue, so be sure to scale your testing!

Improve this answer
0

Seems to be your are in right direction . As firewall is security device optimise its routing features and to increase firewall performance .it's better to move routing part to dell switch .

Layer3 dell switch is capable of performing routing . So the best and optimised way is to have gateway on Dell switch .

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.