topic Re: Issues with Webpages Hanging in General Topics

Issues with Webpages Hanging

suaveswede — Tue, 10 May 2016 03:50:14 GMT

Hi All,

I'm new to Palo Alto and have been having issues with content loading on my network. Across the network, webpages that are being loaded in browser will periodically hang and as soon as the user refreshes them they load right away. Also video streaming and image viewing applications appear to behave the same way in that a user will try to load content, can't, will restart the application and then the content will load up fine from the internet. I'm using the VM-100 and have alocated plenty of RAM and CPU for the VM. Have looked at security policies but they appear to be fine. Any suggestions on where to look next would be much appreciated.

Thanks!

Re: Issues with Webpages Hanging

rmonvon — Tue, 10 May 2016 13:52:10 GMT

Hi...A couple of things that you can check:

- Ethernet port speed/duplex mismatch

- If you are using URL filtering, FQDN objects, maek sure the DNS server(s) are configured and reachable by the PA.

- Make sure the mgmt port of the PA can get out to the Internet for content updates

Thanks,

Re: Issues with Webpages Hanging

suaveswede — Tue, 10 May 2016 14:26:00 GMT

None of those appear to be an issue. Maybe MTU setting?

Re: Issues with Webpages Hanging

rmonvon — Tue, 10 May 2016 15:30:05 GMT

You can take a packet capture to see if there are many fragmented packets which would point to MTU.

Do you have proxy that would affect the cachin of web contents?

Are you seeing similar symptom for other traffic like FTP, SSL, etc?

Re: Issues with Webpages Hanging

suaveswede — Tue, 10 May 2016 15:31:49 GMT

Just a DNS proxy. It's most obvious when streaming video or loading images.

Re: Issues with Webpages Hanging

rmonvon — Tue, 10 May 2016 16:10:50 GMT

Just to test if any of your policies may cause this, can you allow a test user full access (src=ip-test-user any any action=allow) with no blocking on any URL categories, etc.

Re: Issues with Webpages Hanging

suaveswede — Tue, 10 May 2016 17:58:07 GMT

Just tested it out and there seems to be minimal change. live.paloaltonetworks.com actually is one of the sites that takes forever to load.

Re: Issues with Webpages Hanging

rmonvon — Tue, 10 May 2016 18:24:00 GMT

I suggest the next step may be to contact Support and open a case. Thanks.

Re: Issues with Webpages Hanging

jvalentine — Wed, 11 May 2016 00:56:41 GMT

A couple of questions:

Which hypervisor are you using?

If you're using VMware ESXi/vSphere, are you using Promiscuous mode on the port-groups where your firewall is connected or have you enabled "Use Hypervisor-assigned MAC address" in the firewall?

Re: Issues with Webpages Hanging

suaveswede — Wed, 11 May 2016 15:27:10 GMT

Hi All,

I've discovered that having the services in my Security Policies set to "application-default," is what causes the issue. Defining this myself fixes the issue.

Re: Issues with Webpages Hanging

Brandon_Wertz — Wed, 11 May 2016 15:38:16 GMT

That's odd. What application needed to use "Any?"

Did you have any deny logs of that application on any port other than the "standard?" If no logs did you have a clean-up rule that's actually logging the denies? By default palo's implict deny doesn't log.

Re: Issues with Webpages Hanging

suaveswede — Wed, 11 May 2016 16:19:38 GMT

It caused big problems with Netflix and other streaming services. Maybe it took too long to look it up in the application-default list? I'm not sure. I defined the service ports manually.