SRX5308 ProSafe Firewall - downstream running at slow speed, when Virgin Router in 'modem mode'

Hi DaneA.

Thanks again for your post.

Here is what I ultimately established (after doing all resets, etc, as promised).

I had been using the very commonly utilised speed test at www.speedtest.net in order to assess our broadband speeds. As you know, our Virgin line was connected up to our WAN2 port.

On visiting www.speedtest.net, it confirms you IP address and the ISP your connected with. This was coming up as the correct dynamic IP for our Virgin Line, and confirming that the broadband ISP was 'Virgin Media'.

On running the tests, typically on the SRX5308 I would get downstream speeds of no more than 17 Mbps, and upstream speeds of up to 12 Mbps. This indicated a great problem with our downstream bandwidth that should have been running at 125 Mbps. I have the ProSafe Firewall configured to forward all http (port 80) and https (443) to WAN2, no exceptions - so this should have been good enough.

What I discovered is that speedtest.net do not utilise port 80 or 443, but 8080 for at least their downstream tests. As there was no strict rule on the SRX5308 for this, the net result was the firewall actually forwarding the test traffic over our slower BT ADSL connection on WAN1, which tops out at about 17 Mbps. 99% of the time, it correctly sent the upstream test through WAN2 (giving us the 12 Mbps speed), but on very rare occasions it failed at this too, giving about 0.75 Mbps (this only happened very recently). For whatever reason, the load balancing on the SRX5308 must be slightly different to the FVX538, the latter largely sending the port 8080 traffic down WAN2, hence largely seeing correct readouts on this. Other tests I did had the Virgin line linked up as a single WAN option, so it always behaved, as it had nowhere else to send the traffic!

The red herrings along the way were:

1) When first noticing the test results, by coincidence the line was either running genuinely at a lower speed (perhaps some temp issues at Virgin) or the web server I was downloading files from was running at these lower speeds.

2) The issue listed in the SRX5308 change log file, which has turned out to not be relevant.

3) The FVX538 generally performing the test correctly, despite being configured identically to the SRX5308 (load balancing must just be tweaked differently internally).

4) speedtest.net not warning of the fact the actually Adobe Flash based test (you hit the 'begin test' button, and it does it's magic) doesn't inform you that the test is running on a different IP address to the one that the front end displays, i.e. it should have assessed the difference between the Virgin IP displayed, and the BT one it was actually testing  (that would really make sense for them to implement).

5) Probably other things which I forget in the process!

Incidentally, the SRX5308 did not take well to applying the old firmware - had a lot of problems rebooting and getting it accessible successfully, and had to do many resets. I did manage it in the end, and upgraded it back to the most recent firmware as soon as it was playing ball. Might be advisable to tell people to be cautious when flashing an old version of the firmware, even if it was ultimately salvagable.

The speed test at www.thinkbroadband.com appears to use the conventional http ports, giving accurate speed test results everytime.

So basically, this is problem solved! I'm going to post my own answer as the answer, as it was something quite outside of anything being discussed on here - but I truly do appreciate your input and Bob's input in trying to help me solve this conundrum. Thank you both very much, and sorry to have wasted any of your time at all! :-)

Many thanks,

Bobby