HTTPS/SSL upload speed is slow through FTD with SSL Policy

[SIMMN]

I have FTD1K running 6.6.1 (build 91) managed by FMC...

From a user laptop inside network to run speedtest via speedtest.net in browser, I got about 150Mbps down and 1Mbps up...What I found is disabling the SSL policy on FTD improved dramatically on upload speed (increase to about 80Mbps)... but the SSL Policy configured is a fairly basic cert checking policy like screenshots below (defaults are used in other tabs of the policy/rule). But why?

[Mohammed al Baqari]

Hi,

Speed test uses port TCP/8080 for download and upload. So no direct
relation between SSL policy and speed test. However, SSL policy drops the
performance of any hardware including firepower as it needs to perform
decryption and encryption for every packet (if you use resign).

In your case, cert check won't cause decryption/encryption cause this is
inspected in SSL handshake.

Try to do a pcap to see the destination server for speed test. Then apply a
test pre-filter policy to fastpath that traffic and see if it improves.
This is to isolate if FTD is doing something to speed tes traffic specific
or its general ssl inspection for all traffic.


**** please remember to rate useful posts

[SIMMN]

With the policy I have in place, it should not consume much of the FTD performance. Even it did, why only "throttle" the upload, not the download direction?

Also speedtest.net was just an example, I also tried onedrive and google cloud for uploading with similar slowness.

[aliozturk9@gmail.com]

Hi , I have same problem  ,  What was done and solved. Is there any improvement ? 

[SIMMN · Accepted solution]

If you use the FTD 1K platform, reach out to TAC and they would provide you a hot fix for the issue on v6.6.1.