Starting an SSL-VPN tunnel CPS test
This test establishes a SSL-VPN tunnel connection and completes a full of HTTP transaction through it. It creates one HTTP(FTP) transaction per tunnel.
|
The tunnel is only established if configured in empty tunnel mode. |
To start an SSL VPN CPS tunnel test:
- Go to Cases > Performance Testing> VPN> > SSLVPN > CPS to display the test case summary page.
- Click + Create New to display the Select case options dialog box.
-
Configure the Inner Traffic and click OK to continue.
HTTP CPS FTP -
Set the server network to Peer Network.
If Fortigate SSLVPN policy has disabled NAT mode, you need set the Internal IP assigned by Fortigate.
If Fortigate SSLVPN policy has enabled NAT mode, you need to set a peer IP.
- Set Specifics for Load and Client. See the table below.
-
Set Inner protocol case Specifics >HTTPCPS.
Simulated Users Number of simusers in a Tunnel.
SSL-VPN Test Case common options
IPsec Test Case configuration specific to remote access CPS
| Settings | Guidelines | ||
|---|---|---|---|
| Basic Information | |||
| Network Settings If you have selected a network config template, the network settings automatically inherit the configurations in the template. See Using network configuration templates for the description of network settings. |
|||
| Load | |||
| Mode |
Simuser: Simulated users. Simuser simulates a user processing through an Actions list one at a time. It allows you to determine the maximum number of concurrent users your device, infrastructure, or system can handle.
What is the difference between Simuser and Connections/second? |
||
|
Tunnel Concurrent Connection |
The total number of tunnels created in the Throughput case. |
||
| Ramp Up Time |
The duration in seconds for which new sessions can be opened, attempting to reach the desired Connections per Second configured. (Range: 0 - 300). Note: If FortiTester cannot reach the Connections per Second configured during the specified Ramp Up Time, it will keep the highest CPS it reached during the Ramp Up Time. |
||
| Ramp Down Time | The duration in second during which the device ramps down the number of connections it is making. 0 will cause the FortiTester to cease generating sessions. (Range: 0 - 300). | ||
| VPN Gateway Port | Specify the VPN gateway port number. | ||
|
Enable User Group |
Enable to simulate multiple user names. This allows FortiView to populate with more rich user name information, for example.
|
||
| VPN Username | Enter the VPN username. | ||
| VPN Password | Enter the VPN password. | ||
|
Tunnel mode |
Select TCP or UDP. |
||
| Client Profile | |||
|
Client Close Mode |
Select the connection close method: 3Way_Fin or Reset. |
||
|
Quiet Shutdown |
Enable to apply safe shutdown procedure to SSL connections by sending SSL alert to the peer. |
||
|
Available SSL Versions |
Select SSL versions. TLSv1.3 and other SSL versions are mutually exclusive. This means you can’t select TLSv1.3 at the same time with other SSL versions. |
||
|
SSL Ciphers |
Select one or more SSL ciphers from the list. |
||
| Session Resumption |
This option applies only to TLS v1 and TLS v1.2. It does not apply to TLS v1.3. |
||
|
Enable Client Certificate |
Enable the client authentication for HTTPS cases. |
||
| Piggyback Get Requests | If enabled, this means an acknowledgment is sent on the data frame, not in an individual frame. Otherwise, it sends an ACK frame individually. This feature only works with get/post requests. | ||
| Client/Server TCP Options | |||
| TCP Receive Window | The receive window in which you want the TCP stack to send TCP segments. The receive window informs the peer how many bytes of data the stack is currently able to receive. The supplied value is used in all segments sent by the stack. The valid range is 0 to 65535. | ||
| Delayed Acks | Select to cause the TCP stack to implement the Delayed ACK strategy, which attempts to minimize the transmission of zero-payload ACK packets. Acknowledgments will be deferred and should be piggybacked on top of valid data packets. If successfully deferred, these acknowledgments are free, in the sense that they consume no additional bandwidth. | ||
| Delayed Ack Timeout | If you select Delayed ACKs, use this timeout value to specify the maximum time the TCP stack waits to defer ACK transmission. If this timer expires, the stack transmits a zero-payload acknowledgment. | ||
| Timestamps Option | Select to add a TCP time stamp to each TCP segment. | ||
| Enable Push Flag | Select to set the TCP PSH (push) flag in all TCP packets. This flag causes buffered data to be pushed to the receiving application. If deselected, the PSH flag is not set in any TCP packet. | ||
| SACK Option | Select to enable TCP Selective Acknowledgment Options(SACK). | ||
| Enable TCP Keepalive | Select to enable TCP Keep-alive Timer. | ||
| Keepalive Timeout | If you enable TCP Keepalive, use this timeout value to specify the maximum time to send your peer a keep-alive probe packet | ||
| Keepalive Probes | If you enable TCP Keepalive, use this value to specify the maximum probes to detect the broken connection. | ||
| Override Internal Timeout Calculation | Select to override the TCP stack calculation of the retransmission timeout value. | ||
| Retransmission Timeout | If you select Override Internal Timeout Calculation, use this value for the first transmission of a particular data or control packet; it is doubled for each subsequent retransmission. | ||
| Retries | The number of times a timed-out packet is retransmitted before aborting further retransmission. If the client does not receive a response after the configured number of retries have been attempted, the error is logged in the results. CSV file as a TCP timeout when a SYN or FIN is sent, and no SYN/ACK or FIN/ACK from the server is received. | ||
|
FinACK Timer |
This value measures the amount of time that a SimUser waits after it finishes its actions and before it directly breaks all of its TCP connections (that is, the time to wait to receive the LAST_ACK message for a FIN request). A value of 0 disables the timer. Note: Setting this timer can adversely affect TCP performance. |
||
| Client Network | |||
| Tunnel Mode | Select TCP or UDP. | ||
| Server Network | |||
| Network MTU | The maximum transmission unit size. | ||