BAlfson - you were on the money (as usual). It was indeed Anti-Flooding. But it was the client side not the UTM itself. Once this was corrected increase in speed was immediately noticeable. Sophos support almost RMA'd the red device but we checked the logs again and found the anti-flooding.
↧