topic Re: Website is slow when put behind vm-series 300 in VM-Series in the Public Cloud

Website is slow when put behind vm-series 300

Tariq87 — Mon, 12 Apr 2021 18:12:05 GMT

We have deployed vm-series 300 in AWS recently and put our production site behind it, but we are seeing a performance degradation, the website is taking around 2-3 mins to load for the first time which normally it didnt take, we have not put any url filtering profiles yet but yes we do have some security and nat profiles in place(which normal I believe), I just wanted to understand what could be the reason for the slowness and what all things can be checked in PA to troubleshoot.

PS: I am attaching a screenshot of developers tool console to show time it takes for the page to load first time

Re: Website is slow when put behind vm-series 300

rapatil — Mon, 12 Apr 2021 18:23:31 GMT

Hi Tariq87,

Can you please open a support case so we can look into this issue and help to troubleshoot it further?

Thank you.

Re: Website is slow when put behind vm-series 300

rapatil — Mon, 12 Apr 2021 18:23:45 GMT

Hi Tariq87,
Can you please open a support case so we can look into this issue and help
to troubleshoot it further?

Re: Website is slow when put behind vm-series 300

jmeurer — Mon, 12 Apr 2021 18:25:42 GMT

How are you directing traffic to the firewalls? If you are using an ALB/NLB, ensure that your routing allows the firewalls to communicate with all of the LB Subnets via the same interface that is specified in the Target Group. Similar question on the backend. If the application is deployed across multiple subnets, ensure the firewall can route to all of the backend subnets via the SNAT interface.

Re: Website is slow when put behind vm-series 300

Tariq87 — Mon, 12 Apr 2021 18:33:41 GMT

Yes, we are using NLB, which is deployed in 2 subnets across 2 az's, the backed firewalls are also in the same AZ's. The backend to the firewall is an Haproxy which are also spread across the same az's.

What else can I check?

Re: Website is slow when put behind vm-series 300

jmeurer — Mon, 12 Apr 2021 18:48:32 GMT

There is a very good chance that your external interface cannot route to the NLB subnet in the other zone or that your Trust side interface cannot route to the other zone. If you can post your subnet lists and your firewall VR "More Runtime Stats", we may be able to see the issue.

Also watch that you do not have "Automatically create default route pointing to default gateway provided by server" enabled on both of your interfaces.

Re: Website is slow when put behind vm-series 300

Tariq87 — Tue, 13 Apr 2021 02:45:28 GMT

I am sure of the second point you have mentioned, no we did not do that.

For the first, I'll check and get back to u

Re: Website is slow when put behind vm-series 300

Tariq87 — Tue, 13 Apr 2021 02:54:52 GMT

How can I do that?

Re: Website is slow when put behind vm-series 300

tostern — Tue, 13 Apr 2021 03:04:15 GMT

@Tariq87

see below on the picture. You have to make sure that on the interface on the firewall are you not select "Automatically create default route....."

Re: Website is slow when put behind vm-series 300

Tariq87 — Tue, 13 Apr 2021 03:23:44 GMT

Yes, we have not selected this for the trust interface

Re: Website is slow when put behind vm-series 300

jmeurer — Tue, 13 Apr 2021 12:51:59 GMT

Please see me earlier note about posting your resultant route table from the firewall and your subnet layout.

Re: Website is slow when put behind vm-series 300

Tariq87 — Tue, 13 Apr 2021 13:12:18 GMT

10.163.6. and 10.163.5 are untrust interfaces(subnets) and 10.163.11 and 10.163.15 are trust interfaces

Re: Website is slow when put behind vm-series 300

jmeurer — Tue, 13 Apr 2021 16:12:49 GMT

What subnets are your LB and back in? The route that I question is the /22 on only one of the firewalls. If you have backend traffic that is not in the same subnet as an interface, you could be routing it out Eth1/1 but snatting it to Eth1/2. That will cause a timeout.

On the flip side, you have a 10/8 route via eth1/2, this is going to prevent your LB health checks from return to the cross zone subnet via eth1/1.

You should have 0/0 via eth1/1 and static route for the NLB subnets also via eth1/1. You can then use the 10.8 route to get to all other subnets via eth1/2.

Re: Website is slow when put behind vm-series 300

Tariq87 — Tue, 13 Apr 2021 17:18:38 GMT

i need some time to verify this, need to look into it tomorrow morning and will get back to you

Re: Website is slow when put behind vm-series 300

Tariq87 — Thu, 15 Apr 2021 05:00:51 GMT

We have found out that it is the decryption profile which is causing the slowness, I have opened a ticket with PA support