topic Re: Siebel - on PA2020 v.5.0.11 - slow in General Topics

Siebel - on PA2020 v.5.0.11 - slow

DimitrisK — Tue, 17 Jun 2014 06:36:05 GMT

Hello all,

we have recently Siebel 7.8 which is behind the PA2020.

The speed working on Siebel is so slow that in some requests freeze the clients.

I created a test client which bypasses the PA and siebel runs perfectly.

I created an application override with a custom application but the PA would not recognize the application and will not go through that rule.

The application override was created following this link How to Create an Application Override Policy

I used the inbuild app (siebel-crm) on the application override and rule. The traffic now passes through the rule but the speed is worse then dail-up connection.

Does not seem that it is overriding the app.

I increased the session timeout on the inbuild siebel-crm app and that stopped the clients from freezing and improved slightly the speed,

but still nowhere close to having the clients off PA. That is not an option.

Is there any other way to completely overide the app?

Thank you

Re: Siebel - on PA2020 v.5.0.11 - slow

HULK — Tue, 17 Jun 2014 06:57:48 GMT

Hello DimitrisK,

Would it be possible for you to share the custom app configuration and other details ( screen-shots). We need to see, why it is not going through the appropriate policy. Once the traffic will go through the override policy, then we would be able to compare the performance.

Thanks

Re: Siebel - on PA2020 v.5.0.11 - slow

DimitrisK — Tue, 17 Jun 2014 07:35:02 GMT

Thank you for your quick response, this issue is bugging me for the last week!

On the print screen the destination address on the application override policy is an IP same as on the security rule.

On the security rule the source addresses are 2 /24 networks 1 /23 network and 2 IPs.

I hope this helps.

Re: Siebel - on PA2020 v.5.0.11 - slow

HULK — Tue, 17 Jun 2014 14:55:21 GMT

Hello DimitrisK,

Thanks for your reply. From the above mentioned application override policy, it, looks like you are using default application "Siebel-crm" on the policy. In order to apply an override policy, you need to create a custom application. You should not use the default Application to override.

Please find below an example:

Step-1: Go to Object > Application > Add a new application i.e Siebel-custom

Step-2: Add the protocol/port number of that application.

Step-3:

Step-4: Add the custom application on the override policy ( not the default Siebel-crm).

Hope this helps.

Thanks

Re: Siebel - on PA2020 v.5.0.11 - slow

DimitrisK — Wed, 18 Jun 2014 05:47:02 GMT

Hulk thank you, that did the trick. seems to be working smothly and fast. apart from one function within Siebel.

Though I noticed that the service needs to be defined in the security rule also for the override to work.

One last question, does the override of the custom-app created, completely ignors the timeouts and characteristics specified? or can thoughs be tweeted.

Thank you

Re: Siebel - on PA2020 v.5.0.11 - slow

HULK — Wed, 18 Jun 2014 06:59:40 GMT

Hello DimitrisK,

If you want, you can specify the timeout value for this specific application traffic, else it will take the global TCP (3600 Sec), UDP (30 Sec) timeout value.

Thanks

Re: Siebel - on PA2020 v.5.0.11 - slow

DimitrisK — Wed, 18 Jun 2014 07:11:07 GMT

thank you

Re: Siebel - on PA2020 v.5.0.11 - slow

wvechamaneesri — Tue, 22 Sep 2015 15:02:14 GMT

My customer face this issue too. However, they dont want to use app override as it bypass all content inspection. Do you know what is the root cause of slowness when enabling app-id on this application?

Re: Siebel - on PA2020 v.5.0.11 - slow

cpainchaud — Tue, 22 Sep 2015 17:22:38 GMT

bypassing content inspection on this one is not an issue if there is nothing to protect anyway for Siebel.

I advice you to open a TAC case with some packet captures.