How to configure iPerf as a client and server for network bandwidth testing using FortiGate and Hosts

iPerf is a very useful tool for testing network bandwidth between two hosts. It can be used to test the Internet link or the network bandwidth of a segment as a client and a server during troubleshooting.

Often, both the server and the client can report the interface speed, but it will not be possible to validate whether the entire link is in fact at the speed reported on the hosts with this information alone. In this way, using iPerf, both the Firewall and the remote host can act as a server or client for the validation process.

Link to download iPerf on the host (multiplatform)here. FortiGate already has the iPerf client.

Configuring FortiGate as a Server

config system global
set speedtest-server enable
end

config system interface
edit <interface name>
append allowaccess speed-test
next
end

FGT01 (iPerf Server):

config system interface
edit VLAN_300
set ip 172.16.200.250 255.255.255.0
set allowaccess ping https ssh speed-test
end

FGT02 (iPerf Client):

diagnose traffictest client-intf VLAN_300
diagnose traffictest server-intf VLAN_300
diagnose traffictest port 5201
diagnose traffictest show
diagnose traffictest run -c 172.16.200.250

By default, the test is done in the "inbound" direction of the interface, to test the "outbound" or reverse, download, the syntax should be as follows:

diagnose traffictest run -R -c 172.16.200.250

In the following gallery, the sequence of configurations on FG01 as Server, FG02 as client and the graphs of use of the VLAN_300 interface in upload and download.

Host iPerf (Windows) as Server

After downloading iPerf, extract it to the desired location. In our example, we extracted it to the user's default Downloads directory. To run iPerf, open Promt as administrator. Go to the directory where the executable was extracted and run the following command:

iperf3.exe -s

iPerf Host (Windows) as Client

To run as a client, the syntax will be as follows:

iperf3-exe -c 172.16.200.250
iperf3-exe -R -c 172.16.200.250

Testing the FortiGate Internet link

In this case, FortiGate will act as a client and to do so, we will need to configure the interface where the link is and enter the destination IP address. The website iperf3serverlist.net has a list of addresses available by country and bandwidth for testing and other parameters such as IPV6 availability and download testing. In FortiGate, it is possible to perform iPerf tests on IPsec VPN tunnel interfaces as long as the source and destination interfaces have IP addresses assigned. For testing on the internet link, the syntax is the same as in the scenario where FortiGate is the client. The following is the syntax on the internet link.