We got a strange problem bugging me for over a week now and i'm running out of ideas. The network setup is like the following:
Windows XP PC 1GBit --> GBit Switch --> 100Mbit cisco Router (2 interfaces) --> Gbit Switch --> 1Gbit Checkpoint Firewall --> Gbit Switch (DMZ) --> 1Gbit Solaris x86 on HP Proliant
Filetransfer from Windows PC via sftp to Solaris x86 gives extremly poor performance of max. 135kBytes/s. Filetransfer from windows PC via ftp gives expected performance of about 6,5 Mbytes/s also limited by the cisco routers 100MBit interfaces.
So "physically" and with routing etc. everything seems to be set up correctly.
Firewall rules were adjusted for test to accept "any" between conversation partners Windows XP PC and Solaris x86.
Ping from Windows PC to Solaris with paket size 8k shows a constant delay of 5 ms which also should be an acceptable latency for that physical setup.
We already changed the network setup for testing like this:
Windows PC 1Gbit--> GBit Switch --> 100Mbit cisco Router --> Gbit Switch --> --> 1Gbit Solaris x86 on HP Proliant
Transfer rates for sftp from Windows PC to Solaris X86 about 3,5MBytes/s limited by CPU power of the Windows PC (goes to 100% CPU Load).
So the most limiting factor in first (and desired) setup seems to be the checkpoint firewall. We would expect slower performance of sftp compared to ftp, but not factor 30x compared to the transfer without firewall. BTW, the Firewall is a Checkpoint NGX R65 and we already created our "own" port 22 service object without any service parameters set to exclude some checkpoint internal behaviour of handling service 22.
Any help appreciated, i'm loosing my mind on this now....
Regards, Ralph
