topic Re: HTTP performance issue in General Topics

HTTP performance issue

migration — Wed, 03 Nov 2010 15:17:37 GMT

Hi,

our PAN 4020 device is deployed to enforce visibility and control for all user-generated traffic (from LAN to Internet and from Internet to DMZ).

This is the scenario:

- 2 fw, performing layer3 and NAT

- 2 IPS, performing IPS and Bandwidth Management functions

- 2 4020 in vwire using SFP, after the IPS and before the Internet router. PAN configured with 2 VSYS and 2 TAP interface capturing other kinds of traffic)

TAP

(LAN)(DMZ) -> FW -> IPS -> 4020 -> Internet (200Mbps)

TAP

maximum traffic rate registered on PAN device is 100Mbps with 50k maximum connections.

This is the issues:

- slow download rates accessing services in the DMZ from Internet

- slow upload rates accessing Internet from LAN (drop down to 50Kbps)

This issues has been reproduced and verified many times and seems to involve HTTP traffic only. This strange behaviour happen with PAN inserted on the Internet traffic only. Removing PAN box recovers the expected traffic rates.

Did anyone have the same issue?

Some interesting tips or place to investigate?

Thanks for your support

Re: HTTP performance issue

migration — Wed, 03 Nov 2010 15:18:44 GMT

Sorry for the diagram, both TAP interfaces are attached to PAN device

Re: HTTP performance issue

pantac — Mon, 08 Nov 2010 17:03:23 GMT

The first thing I would check is that the Interface speeds match to the device they are plugged into. If the PAN plugs into a switch, and the interfaces on teh switch are froce to 100Mb/Full. Make sure teh PAN is configured the same way. If the switch interfaces are set Auto/Auto, configure the PAN the same way.

Some relevant commands to run via CLI:

show system statistics                  - shows total bandwidth passing through the PAN
show running resource-monitor           - shows data plane CPU usgae at different time intervals
show system resources                   - shows management plane CPU usage

Do you have QOS enabled?
What application is the PAN detecting this traffic as?

On a related note, only apply url filter to outbound internet traffic.
Do not apply URL filtering on your own internal servers.

If you continue to have problems you should contact support.

Re: HTTP performance issue

prashant_jani — Wed, 04 May 2011 09:39:06 GMT

I have the same problem with Vwire on PAN 4050, did anybody came to know about the cause/solution for this behaviour ?

Re: HTTP performance issue

migration — Fri, 06 May 2011 07:35:55 GMT

prashant.jani@helpag.com

I have the same problem with Vwire on PAN 4050, did anybody came to know about the cause/solution for this behaviour ?

Hi.

with the PAN inline, check the drop counter "tcp_out_of_win", showed with the command show counter global

The drop counter grows up if there's the local QoS enabled or a traffic shapere between the PAN device and other segments.