topic Re: VWire and Oracle Database Traffic - Devs are complaining that its slow - Palo Alto 6.1.6 in General Topics

VWire and Oracle Database Traffic - Devs are complaining that its slow - Palo Alto 6.1.6

mlinsemier — Mon, 21 Sep 2015 12:04:33 GMT

I was wondering if anyone in the community had any experience with implementing Oracle databases and Palo Alto in a VWire environment.

Over the weekend we implemented a pair of Active/Active 5060's between the our data center and core. Every other application (AD, File Share, Print, VMWare View, Video, Voice, etc.) seems to be working as normal except the developers for our Oracle Database have started to complain about increased latency with their application. Their tools are stating that Oracle is reporting that the problem is mostly with the "socket generation" task where Oracle opens up communication to another server or client.

I have implented the changes around the URG flag that I saw in another post (I didn't reboot, but it didn't state that you had too) as well as am working with the developers to implement DCD, but I can't seem to put my finger on why there would be increased latency with opening connections. Yes there is a firewall now as a bump on the wire, but we aren't even close to taxing 1% of the session rate and the throughput is in the Mbps on a 40Gbps port-channel (4x 10Gbps).

If connection setup time is the culprit, can anyone suggest where I can look.

-Matt

Re: VWire and Oracle Database Traffic - Devs are complaining that its slow - Palo Alto 6.1.6

cpainchaud — Tue, 22 Sep 2015 11:26:51 GMT

problem may not come from this connection but another one (think about FTP control vs data connection) , you may experience slow data connection start because control session is acting weird or distrutped.

As an example, may be the client is trying to resolve server name from dns, but dns is blocked on primary server so you take 3 seconds delay until secondary DNS server is queried and answers

Do a PCAP to prove that firewall delays or not the packets of the connections that devs say they have a problem with.

If PAN delays packet, open a TAC case.

if PAN doesnt delay packets, tell devs to provide better troubleshooting because whatever the problem is (PANOS or other) they are not pointing which flow is not working.

Re: VWire and Oracle Database Traffic - Devs are complaining that its slow - Palo Alto 6.1.6

mlinsemier — Tue, 22 Sep 2015 14:37:52 GMT

This looks to be an asymmetrical pathing issue between a Cisco VSS core port-channel to southbound Nexus 5k vPC port-channel. Shutting down the ports in the port channel effectively removing the secondary firewall from the A/A resolved the issues. Now to just troubleshoot that side of the house.