topic Re: VPN Performance over Prisma Access : slow downloads in Next-Generation Firewall Discussions

VPN Performance over Prisma Access : slow downloads

zGomez — Thu, 12 Oct 2023 14:52:03 GMT

Hi,

Can somebody tell met what you can expect from downloading a file over prisma access backbone.

Our datacenter is connected to service connection and when I try to download a 200 Mbps file from the datacenter to a remote network located in the same region, I am getting a download speed of 500Kbps per second.(smb transfer)

Within the remote site copying a large file over the firewall from a local file server I am getting speeds up to 35 Mbps and increasing, so threat inspection or local firewall doesn't seem to be the issue.

The remote site has a 200/200 link the DC has a 500/500 link.

Re: VPN Performance over Prisma Access : slow downloads

NuvinG — Sat, 24 Feb 2024 18:14:02 GMT

We are having similar problems but unfortunately non of the PAN support team have been able to resolve the issue.

The only actions they did today was repeated packet captures and then they keep changing engineers to gain time.

This is negatively impacted business and it seems that PAN does not care.

The issue has been reported more than 3 months back and still pending!

Re: VPN Performance over Prisma Access : slow downloads

zGomez — Mon, 26 Feb 2024 15:53:34 GMT

Hi NuvinG,

Troubleshooting performance issues is always hard. Are you experiencing slowness in all kinds of traffic or only SMB traffic?

SMB protocol is not the most performing protocol it was never designed to be used on higher latency networks.

You can try some things,

1. Make sure dns is not slowing you down.

2. Test if you IPSEC tunnel on global protect client works faster then over SSL.

3. Disable inspections on SMB traffic.

4. use ipert to test you speed.

Re: VPN Performance over Prisma Access : slow downloads

NuvinG — Mon, 18 Mar 2024 16:17:06 GMT

Hi zGomez,

Thank you for this and we have been working with PAN support and they are still struggling.

We have also been disabling SMB multichannel (Deploy SMB Multichannel | Microsoft Learn)

So up to now this is still an issue.

Thanks

Re: VPN Performance over Prisma Access : slow downloads

GOMEZZZ — Mon, 18 Mar 2024 17:11:51 GMT

Hello,

Did you try disabling all inspection for SMB? Or dit an app override for SMB. Is there any other application going slow? Or only SMB. What speeds are you getting? Can you do a test with iperf and post output.

can you maybe do a packet capture on client side and firewall. What are the MTU settings on your tunnel interface?

are you using SSL or IPSEC for your global protect client.

Re: VPN Performance over Prisma Access : slow downloads

rdumoulin — Tue, 19 Mar 2024 13:08:23 GMT

@NuvinG I see that you are using SC and RN. Are you using PANW NGFWs to Prisma Access?

NGFW -- Prisma Access -- NGFW? What models?

Regards

--Richard

Re: VPN Performance over Prisma Access : slow downloads

JamesBagby — Wed, 08 May 2024 17:20:48 GMT

We're having the same issue. We have tried disabling SMB multichannel on client/server, app override, and DSRI, but there is no change. Now Palo is trying to get us to buy app accelerator which isn't cheap. We decided to test it out in our lab and file transfers are actually slower!! And now we're being asked to use a different application instead of SMB. This is ridiculous as much as we are paying.

Re: VPN Performance over Prisma Access : slow downloads

JamesBagby — Thu, 30 May 2024 12:49:56 GMT

Palo did the same thing with us. They will probably try to sell you on app acceleration which is another feature that you will have to pay for. They can't get that to work either!

Re: VPN Performance over Prisma Access : slow downloads

TCAPMdarrentan — Tue, 26 Aug 2025 01:27:43 GMT

We're having the same issue here as well.
We have also tried disabling SMB multichannel on client/server, app override, and DSRI, but the performance never improves.
Compared to on-prem firewall VPN back to HQ, the SMB performance degraded too much.
PA support team also keep blaming it's on the nature of SMB behavior.
We understand that SMB is a chatty protocol and not optimized for high-latency networks. However, the performance gap compared to on-premises access is far too large to be acceptable.
Now, PA team they just keep pointing here and there, and the issue never resolved.
Our confidence in continuing with Prisma Access is diminishing...
Disappointed on their solution