TCP congestion control enhancement with BBR

FortiGate integrates bottleneck bandwidth and round-trip propagation time (BBR), a model-based TCP congestion control algorithm developed by Google, offering significantly improved data transmission speeds under congested network conditions compared to the traditional CUBIC method.

To select the TCP congestion control algorithm:

config system global
    set tcp-congestion-control {bbr | cubic}
end

Option	Description
cubic	FortiGate unit employs a cubic function for TCP congestion control (default).
bbr	FortiGate unit employs a bottleneck bandwidth and round-trip propagation time (BBR) for TCP congestion control.

Example

In this example, a file is downloaded on PC1 from PC5 using both algorithms under the same network conditions, and the data transmission speed is compared.

To compare the congestion control algorithms:

1. On the FortiGate, configure a proxy-mode firewall policy:

   conf firewall policy
       edit 100
           set srcintf port2
           set dstintf port1
           set srcaddr all
           set dstaddr all
           set service ALL
           set schedule always
           set action accept
           set inspection-mode proxy
           set utm-status enable
           set av-profile "default"
           set ssl-ssh-profile certificate-inspection
       next
   end

2. Set the TCP congestion control algorithm to CUBIC:

   config system global
       set tcp-congestion-control cubic
   end

3. Download a 100MB file from PC5 to PC1 with a 50ms delay and 1% packet loss rate on the network, and check the data transmission speed:

   root@pc1:~# wget -O /dev/null http://172.16.200.155/big100MB.html
   --2025-09-25 09:40:11--  http://172.16.200.155/big100MB.html
   Connecting to 172.16.200.155:80... connected.
   HTTP request sent, awaiting response... 200 OK
   Length: 101869444 (97M) [text/html]
   Saving to: ‘/dev/null’
   
    2% [==>                                                                              ] 2,733,506    570KB/s  eta 2m 38s
    2% [==>                                                                              ] 2,832,922    326KB/s  eta 3m 8s
    2% [==>                                                                              ] 2,903,874    217KB/s  eta 3m 8s
    3% [==>                                                                              ] 3,172,250   95.0KB/s  eta 4m 32s ^C

4. On the FortiGate, change the TCP congestion algorithm to BBR:

   config system global
       set tcp-congestion-control bbr
   end

5. Download the 100MB file again from PC5 to PC1 with a 50ms delay and 1% packet loss rate on the network, and check the data transmission speed:

   root@pc1:~# wget -O /dev/null http://172.16.200.155/big100MB.html
   --2025-09-25 09:44:42--  http://172.16.200.155/big100MB.html
   Connecting to 172.16.200.155:80... connected.
   HTTP request sent, awaiting response... 200 OK
   Length: 101869444 (97M) [text/html]
   Saving to: ‘/dev/null’
   
   15% [==>                                                                              ] 16,216,786  3.82MB/s  eta 30s
   32% [=====================>                                                           ] 33,615,954  6.71MB/s  eta 17s
   51% [===========================================>                                     ] 52,550,002  9.29MB/s  eta 9s
   61% [======================================================>                          ] 62,858,314  10.3MB/s  eta 6s
   73% [====================================================================>            ] 75,079,434  10.7MB/s  eta 4s
   84% [===============================================================================> ] 85,609,290  10.1MB/s  eta 2s

6. Note that, under the same network conditions, the data transmission speed when using BBR is significantly better than when using CUBIC.