topic Getting Low Speed in General Topics

Getting Low Speed

HilalWani — Tue, 14 Dec 2021 05:58:25 GMT

Guys,

My Lan users are getting a slow downloading speed. I have checked the ISP cable directly and there I am getting the accurate speed which is 30Mbps. But when I am connecting the ISP cable to Paloalto after that I am running the speed test it's gives me only 4 Mbps.

I have tested also one pc with no URL filtering or no profiles applied on it, and also gives full internet access but still the same issue.

Is there anyone who can help?

Re: Getting Low Speed

Gustavo_Aristi — Mon, 17 Jan 2022 20:31:37 GMT

I would try running a trace route from an affected endpoint and see if the hops make sense.

Also a packet capture from the Palo Alto from such endpoint.

Goals:

Check if there is a resulting "drop" packet capture.

Check the global counters by using the same packet capture filters running the command:

"show counter global filter packet-filter yes delta yes"

This will give you global counters filtered by your packet capture filters. This will very likely point you to the culprit.

I would assume you will see things such as "asymmetric path" drops or "land attack" related drops.

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/monitoring/take-packet-captures

Re: Getting Low Speed

nikoolayy1 — Tue, 18 Jan 2022 15:12:49 GMT

If you are always using a globalprotect VPN then check if your VPN is using SSL as this has bad performance compared to ipsec:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK

How to Confirm if GlobalProtect Tunnel is Using IPSec or SSL? - Knowledge Base - Palo Alto Networks

Also you can check for drops using packet capture and global counters following the article:

LIVEcommunity - Knowledge sharing: Palo Alto checking for drops (rejects ,discards), slowness (latency) and counters using captures, global counters, flow basic etc. - LIVEcommunity - 402102 (paloaltonetworks.com)

For more globalprotect issues and you don't see anything in the counters and capture then check also the PanGPS and PanGPA logs and you check the article below:

LIVEcommunity - Knowledge sharing: Globalprotect troubleshooting/investgation. Split tunnel,Globalprotect app/agent configuration options and etc. to solve issues - LIVEcommunity - 415420 (paloaltonetworks.com)