topic Re: Slow webpage Load times in VM-Series in the Public Cloud

Slow webpage Load times

S_Williams901 — Wed, 15 Mar 2023 22:40:09 GMT

Have two Firewalls setup in azure with LB on the trust interface side and no LB on the untrust side. I am experiencing slow web page load times. Sometimes it doesnt even load or loads parts of the page. Any ideas what could be causing this?

Re: Slow webpage Load times

nikoolayy1 — Wed, 22 Mar 2023 10:40:20 GMT

Did you test dissabling SSL decryption for the page as VM machines are not good with this?

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs

Also did you check the VM for HIGH CPU or memory?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRTCA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNtHCAW

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POEKCA4&lang=en_US%E2%80%A9

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUb

Also I had simiar issue "I have seen for example on a small firewall when the customer enables SSL decryption that the counters for work groups "ecdhe_key_gen", "flow_host " etc. jump. This may show that the firewall can't handle the ssl decryption or that there is an SSL DDOS attack".

See:

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-high-data-plane-cpu-because-of-ddos-or/td-p/405772

Re: Slow webpage Load times

nikoolayy1 — Wed, 22 Mar 2023 12:20:15 GMT

Also just in case check your DOS logs as the DOS profile and Zone protection profile could cause such issues in rare cases:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOKCA0

https://live.paloaltonetworks.com/t5/general-topics/why-i-see-no-logs-for-dos-policies/td-p/387805

Check just in case this article and check if the Azure LB is redistibuting correcly the traffic between the firewalls:

Cannot get SSL decrypt to work on Azure with AZ App Gateway

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM6TCAW&lang=en_US%E2%80%A9

And just in case see the URL filtering logs but as page loads sometimes I do not think the issue is there:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clt2CAC&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Re: Slow webpage Load times

nikoolayy1 — Thu, 23 Mar 2023 07:07:19 GMT

I forgot to add that you can use the new palo alto AIOps feature to check the firewall. The feature supports streaming data to the Palo Alto cloud or uploading tech support file:

https://live.paloaltonetworks.com/t5/blogs/announcing-aiops-for-ngfw-2-5/ba-p/523963

https://www.youtube.com/watch?v=Be6ZlbfV5GA