Fortinet black logo

Handbook

Starting a RFC 3511 IP throughput test

Copy Link
Copy Doc ID 0fc7455d-2de0-11eb-96b9-00505692583a:817370
Download PDF

Starting a RFC 3511 IP throughput test

FortiTester tests the ability of the DUT to handle network-layer data throughput. RFC 3511 is specifically focused on firewall performance.

To start a throughput test:
  1. Go to Cases > Performance Testing > RFC Benchmark > RFC 3511 > IP Throughput to display the test case summary page.
  2. Click + Create New to display the Case Options dialog box.
  3. In the pop-up dialog, configure DUT Working Mode as TP or NAT.
  4. For the Network Config option, select the network template you have created in Cases > Security Testing > Objects > Networks. Then the network related options will automatically be filled. See Using network configuration templates for how to create a network template.
  5. Select a Certificate Group if applicable.
  6. Click OK to continue.
  7. Configure the test case options described below.
  8. Click Start to run the test case.

FortiTester saves the configuration automatically so you can run the test again later. You can also click Save to save the test case without running it.

Tip: You can also copy an existing case, and change its settings to create a new case. In the case list, click Clone to clone the configuration. Only the case name is different from the original case.

RFC 3511 IP Throughput Test Case configuration

Settings Guidelines
Basic Information
Name Specify the case name, or just use the default. The name appears in the list of test cases.
Ping Server Timeout If a FortiTester connects to a DUT via a switch, the switch might cause a ping timeout, resulting in the test case failing to run. If this occurs, increase the timeout. The default is 15 seconds. The valid range is 0 to 600.
Note: You can disable this end-to-end connectivity test by entering a setting of 0. If the DUT is unable to return packets, it is recommended you do so.
Number of Samples Select the number of samples. The default is 20, which means the web UI will show the last 20 sample data (about 20 seconds) in the test case running page. You can select 20, 60, or 120.

Script Config

Select the script that will run before/after the test. To create a script, see Using script object templates.

Steady Duration Specify the test duration. The default is 10 minutes. The test stops automatically after the duration you specify.
Stopping Status in Second The maximum time out in seconds allotted for FortiTester to close all TCP connections after the test finishes.

DNS Host Group

Select the DNS host group to look up the IP address of a domain name. To create a DNS host group, see Creating DNS host group.

DUT Monitor

Select to monitor a FortiGate device under test (DUT). If selected, you can monitor the DUT from the DUT Monitor tab on the management interface. To create a DUT monitoring, see Using DUT monitoring.

Network Settings
If you have selected a network config template, the network settings automatically inherit the configurations in the template. See Using network configuration templates for the description of network settings.
Load
Flows Enter the port pair.
Traffic Direction Specify the direction of traffic flow.
Packet Size Specify the desired packet sizes, in bytes.
Traffic Cycle Time Traffic burst duration in seconds for each frame size. (minimum of 10)
Aging Time Wait time for packet transmitting after traffic stop, in seconds. (range: 2 - 300)
Maximum Iterative Cycle Maximum traffic cycle for each frame size. (minimum 1)
Acceptable Packet Loss Rate Percentage of packets that can be lost.
Iteration Mode Select either Binary Search to search using binary search mode or Custom Load to search using a custom load.
Initial Send Speed Binary Search only. Specify a speed in Mbps. A setting of 0 means the speed will be set through automatic detection.
Maximum Send Speed Speed in Mbps. A setting of 0 means throughput speed is copied from the BaseValue case.
Send Resolution Speed Binary Search only. Specify a minimum send speed of the traffic cycle for each frame size.
Client Profile
Source Port Range Specify a client port range. The valid range is 10,000 to 65,535, which is also the default.
IP Change Algorithm/Port Change Algorithm Select a change algorithm: Increment or Random. This setting determines how the system changes source/destination IP addresses and ports to simulate multiple client requests. The Increment option uses the next IP address or port in the range, for example: 10.11.12.1 -> 10.11.12.2; port 10000 -> 10001. The Random option selects an IP address or port in the range randomly.
IPv4 UDP Checksum Select to enable the checksum calculation in the UDP header of IPv4 packets sent by this device.
Server Profile
Case Server Port The server port where the test case traffic arrives.
IPv4 UDP Checksum Select to enable the checksum calculation in the UDP header of IPv4 packets sent by this device.
Client/Server Network
Network MTU The maximum transmission unit size.
IP Option DSCP Provide quality of service (QoS).

Starting a RFC 3511 IP throughput test

FortiTester tests the ability of the DUT to handle network-layer data throughput. RFC 3511 is specifically focused on firewall performance.

To start a throughput test:
  1. Go to Cases > Performance Testing > RFC Benchmark > RFC 3511 > IP Throughput to display the test case summary page.
  2. Click + Create New to display the Case Options dialog box.
  3. In the pop-up dialog, configure DUT Working Mode as TP or NAT.
  4. For the Network Config option, select the network template you have created in Cases > Security Testing > Objects > Networks. Then the network related options will automatically be filled. See Using network configuration templates for how to create a network template.
  5. Select a Certificate Group if applicable.
  6. Click OK to continue.
  7. Configure the test case options described below.
  8. Click Start to run the test case.

FortiTester saves the configuration automatically so you can run the test again later. You can also click Save to save the test case without running it.

Tip: You can also copy an existing case, and change its settings to create a new case. In the case list, click Clone to clone the configuration. Only the case name is different from the original case.

RFC 3511 IP Throughput Test Case configuration

Settings Guidelines
Basic Information
Name Specify the case name, or just use the default. The name appears in the list of test cases.
Ping Server Timeout If a FortiTester connects to a DUT via a switch, the switch might cause a ping timeout, resulting in the test case failing to run. If this occurs, increase the timeout. The default is 15 seconds. The valid range is 0 to 600.
Note: You can disable this end-to-end connectivity test by entering a setting of 0. If the DUT is unable to return packets, it is recommended you do so.
Number of Samples Select the number of samples. The default is 20, which means the web UI will show the last 20 sample data (about 20 seconds) in the test case running page. You can select 20, 60, or 120.

Script Config

Select the script that will run before/after the test. To create a script, see Using script object templates.

Steady Duration Specify the test duration. The default is 10 minutes. The test stops automatically after the duration you specify.
Stopping Status in Second The maximum time out in seconds allotted for FortiTester to close all TCP connections after the test finishes.

DNS Host Group

Select the DNS host group to look up the IP address of a domain name. To create a DNS host group, see Creating DNS host group.

DUT Monitor

Select to monitor a FortiGate device under test (DUT). If selected, you can monitor the DUT from the DUT Monitor tab on the management interface. To create a DUT monitoring, see Using DUT monitoring.

Network Settings
If you have selected a network config template, the network settings automatically inherit the configurations in the template. See Using network configuration templates for the description of network settings.
Load
Flows Enter the port pair.
Traffic Direction Specify the direction of traffic flow.
Packet Size Specify the desired packet sizes, in bytes.
Traffic Cycle Time Traffic burst duration in seconds for each frame size. (minimum of 10)
Aging Time Wait time for packet transmitting after traffic stop, in seconds. (range: 2 - 300)
Maximum Iterative Cycle Maximum traffic cycle for each frame size. (minimum 1)
Acceptable Packet Loss Rate Percentage of packets that can be lost.
Iteration Mode Select either Binary Search to search using binary search mode or Custom Load to search using a custom load.
Initial Send Speed Binary Search only. Specify a speed in Mbps. A setting of 0 means the speed will be set through automatic detection.
Maximum Send Speed Speed in Mbps. A setting of 0 means throughput speed is copied from the BaseValue case.
Send Resolution Speed Binary Search only. Specify a minimum send speed of the traffic cycle for each frame size.
Client Profile
Source Port Range Specify a client port range. The valid range is 10,000 to 65,535, which is also the default.
IP Change Algorithm/Port Change Algorithm Select a change algorithm: Increment or Random. This setting determines how the system changes source/destination IP addresses and ports to simulate multiple client requests. The Increment option uses the next IP address or port in the range, for example: 10.11.12.1 -> 10.11.12.2; port 10000 -> 10001. The Random option selects an IP address or port in the range randomly.
IPv4 UDP Checksum Select to enable the checksum calculation in the UDP header of IPv4 packets sent by this device.
Server Profile
Case Server Port The server port where the test case traffic arrives.
IPv4 UDP Checksum Select to enable the checksum calculation in the UDP header of IPv4 packets sent by this device.
Client/Server Network
Network MTU The maximum transmission unit size.
IP Option DSCP Provide quality of service (QoS).