Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We got a strange problem bugging me for over a week now and i'm running out of ideas. The network setup is like the following:

Windows XP PC 1GBit --> GBit Switch --> 100Mbit cisco Router (2 interfaces) --> Gbit Switch --> 1Gbit Checkpoint Firewall --> Gbit Switch (DMZ) --> 1Gbit Solaris x86 on HP Proliant

Filetransfer from Windows PC via sftp to Solaris x86 gives extremly poor performance of max. 135kBytes/s. Filetransfer from windows PC via ftp gives expected performance of about 6,5 Mbytes/s also limited by the cisco routers 100MBit interfaces.

So "physically" and with routing etc. everything seems to be set up correctly.

Firewall rules were adjusted for test to accept "any" between conversation partners Windows XP PC and Solaris x86.

Ping from Windows PC to Solaris with paket size 8k shows a constant delay of 5 ms which also should be an acceptable latency for that physical setup.

We already changed the network setup for testing like this:

Windows PC 1Gbit--> GBit Switch --> 100Mbit cisco Router --> Gbit Switch --> --> 1Gbit Solaris x86 on HP Proliant

Transfer rates for sftp from Windows PC to Solaris X86 about 3,5MBytes/s limited by CPU power of the Windows PC (goes to 100% CPU Load).

So the most limiting factor in first (and desired) setup seems to be the checkpoint firewall. We would expect slower performance of sftp compared to ftp, but not factor 30x compared to the transfer without firewall. BTW, the Firewall is a Checkpoint NGX R65 and we already created our "own" port 22 service object without any service parameters set to exclude some checkpoint internal behaviour of handling service 22.

Any help appreciated, i'm loosing my mind on this now....

Regards, Ralph

share|improve this question
Have you tried: Any Checkpoint settings for MTU or packet fragmentation? A different SFTP client (e.g. bitvise.com/tunnelier)? A tcp port other than 22? –  Paul Jul 22 '11 at 21:02
Hmmm, MTU and packet fragmentation should affect FTP also, right ? Tried several sftp clients. winscp, tunelier etc. But we'll give the different port a chance on monday. Thanks for that hint... –  Ralph Jul 23 '11 at 17:14
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.